Commit | Line | Data |
---|---|---|
2fe58dfd SE |
1 | /* UDP send/receive module for secnet */ |
2 | ||
3 | /* This module enables sites to communicate by sending UDP | |
4 | * packets. When an instance of the module is created we can | |
5 | * optionally bind to a particular local IP address (not implemented | |
6 | * yet). | |
7 | * | |
2fe58dfd SE |
8 | * Packets are offered to registered receivers in turn. Once one |
9 | * accepts it, it isn't offered to any more. */ | |
10 | ||
8689b3a9 | 11 | #include "secnet.h" |
2fe58dfd SE |
12 | #include <stdio.h> |
13 | #include <unistd.h> | |
14 | #include <fcntl.h> | |
15 | #include <string.h> | |
16 | #include <errno.h> | |
2fe58dfd | 17 | #include <sys/socket.h> |
b2a56f7c | 18 | #include <sys/wait.h> |
5edf478f IJ |
19 | #include <netinet/in.h> |
20 | #include <arpa/inet.h> | |
2fe58dfd | 21 | #include "util.h" |
dd9209d1 | 22 | #include "magic.h" |
794f2398 | 23 | #include "unaligned.h" |
ff05a229 | 24 | #include "ipaddr.h" |
136740e6 | 25 | #include "magic.h" |
2fe58dfd SE |
26 | |
27 | static beforepoll_fn udp_beforepoll; | |
28 | static afterpoll_fn udp_afterpoll; | |
29 | static comm_request_notify_fn request_notify; | |
30 | static comm_release_notify_fn release_notify; | |
31 | static comm_sendmsg_fn udp_sendmsg; | |
32 | ||
2fe58dfd SE |
33 | struct notify_list { |
34 | comm_notify_fn *fn; | |
35 | void *state; | |
36 | struct notify_list *next; | |
37 | }; | |
38 | ||
39 | struct udp { | |
40 | closure_t cl; | |
41 | struct comm_if ops; | |
42 | struct cloc loc; | |
a32d56fb | 43 | union iaddr addr; |
2fe58dfd | 44 | int fd; |
b2a56f7c | 45 | string_t authbind; |
2fe58dfd SE |
46 | struct buffer_if *rbuf; |
47 | struct notify_list *notify; | |
ff05a229 | 48 | bool_t use_proxy; |
a32d56fb | 49 | union iaddr proxy; |
2fe58dfd SE |
50 | }; |
51 | ||
5edf478f IJ |
52 | static const char *addr_to_string(void *commst, const struct comm_addr *ca) { |
53 | struct udp *st=commst; | |
54 | static char sbuf[100]; | |
55 | ||
5edf478f | 56 | snprintf(sbuf, sizeof(sbuf), "udp:%s-%s", |
a32d56fb | 57 | iaddr_to_string(&st->addr), iaddr_to_string(&ca->ia)); |
5edf478f IJ |
58 | return sbuf; |
59 | } | |
60 | ||
2fe58dfd | 61 | static int udp_beforepoll(void *state, struct pollfd *fds, int *nfds_io, |
90a39563 | 62 | int *timeout_io) |
2fe58dfd SE |
63 | { |
64 | struct udp *st=state; | |
65 | if (*nfds_io<1) { | |
66 | *nfds_io=1; | |
67 | return ERANGE; | |
68 | } | |
69 | *nfds_io=1; | |
70 | fds->fd=st->fd; | |
71 | fds->events=POLLIN; | |
72 | return 0; | |
73 | } | |
74 | ||
90a39563 | 75 | static void udp_afterpoll(void *state, struct pollfd *fds, int nfds) |
2fe58dfd SE |
76 | { |
77 | struct udp *st=state; | |
a32d56fb | 78 | union iaddr from; |
b1a0f651 | 79 | socklen_t fromlen; |
2fe58dfd SE |
80 | struct notify_list *n; |
81 | bool_t done; | |
82 | int rv; | |
83 | ||
84 | if (nfds && (fds->revents & POLLIN)) { | |
85 | do { | |
86 | fromlen=sizeof(from); | |
87 | BUF_ASSERT_FREE(st->rbuf); | |
88 | BUF_ALLOC(st->rbuf,"udp_afterpoll"); | |
6af9a984 | 89 | buffer_init(st->rbuf,calculate_max_start_pad()); |
1b4ca45e | 90 | rv=recvfrom(st->fd, st->rbuf->start, |
92795040 | 91 | buf_remaining_space(st->rbuf), |
a32d56fb | 92 | 0, &from.sa, &fromlen); |
2fe58dfd SE |
93 | if (rv>0) { |
94 | st->rbuf->size=rv; | |
ff05a229 SE |
95 | if (st->use_proxy) { |
96 | /* Check that the packet came from our poxy server; | |
97 | we shouldn't be contacted directly by anybody else | |
98 | (since they can trivially forge source addresses) */ | |
a32d56fb | 99 | if (!iaddr_equal(&from,&st->proxy)) { |
ff05a229 SE |
100 | Message(M_INFO,"udp: received packet that's not " |
101 | "from the proxy\n"); | |
102 | BUF_FREE(st->rbuf); | |
103 | continue; | |
104 | } | |
a32d56fb IJ |
105 | /* proxy protocol supports ipv4 transport only */ |
106 | from.sa.sa_family=AF_INET; | |
107 | memcpy(&from.sin.sin_addr,buf_unprepend(st->rbuf,4),4); | |
ff05a229 | 108 | buf_unprepend(st->rbuf,2); |
a32d56fb | 109 | memcpy(&from.sin.sin_port,buf_unprepend(st->rbuf,2),2); |
ff05a229 | 110 | } |
8534d602 | 111 | struct comm_addr ca; |
8534d602 | 112 | ca.comm=&st->ops; |
a32d56fb | 113 | ca.ia=from; |
2fe58dfd SE |
114 | done=False; |
115 | for (n=st->notify; n; n=n->next) { | |
a15faeb2 | 116 | if (n->fn(n->state, st->rbuf, &ca)) { |
2fe58dfd SE |
117 | done=True; |
118 | break; | |
119 | } | |
120 | } | |
121 | if (!done) { | |
bf28fc73 IJ |
122 | uint32_t msgtype; |
123 | if (st->rbuf->size>12 /* prevents traffic amplification */ | |
124 | && ((msgtype=get_uint32(st->rbuf->start+8)) | |
125 | != LABEL_NAK)) { | |
126 | uint32_t source,dest; | |
127 | /* Manufacture and send NAK packet */ | |
128 | source=get_uint32(st->rbuf->start); /* Us */ | |
129 | dest=get_uint32(st->rbuf->start+4); /* Them */ | |
8534d602 | 130 | send_nak(&ca,source,dest,msgtype,st->rbuf,"unwanted"); |
bf28fc73 | 131 | } |
2fe58dfd SE |
132 | BUF_FREE(st->rbuf); |
133 | } | |
134 | BUF_ASSERT_FREE(st->rbuf); | |
135 | } else { | |
136 | BUF_FREE(st->rbuf); | |
137 | } | |
138 | } while (rv>=0); | |
139 | } | |
140 | } | |
141 | ||
142 | static void request_notify(void *commst, void *nst, comm_notify_fn *fn) | |
143 | { | |
144 | struct udp *st=commst; | |
145 | struct notify_list *n; | |
146 | ||
147 | n=safe_malloc(sizeof(*n),"request_notify"); | |
148 | n->fn=fn; | |
149 | n->state=nst; | |
150 | n->next=st->notify; | |
151 | st->notify=n; | |
152 | } | |
153 | ||
154 | static void release_notify(void *commst, void *nst, comm_notify_fn *fn) | |
155 | { | |
156 | struct udp *st=commst; | |
157 | struct notify_list *n, **p, *t; | |
158 | ||
159 | /* XXX untested */ | |
160 | p=&st->notify; | |
161 | for (n=st->notify; n; ) | |
162 | { | |
163 | if (n->state==nst && n->fn==fn) { | |
164 | t=n; | |
165 | *p=n->next; | |
166 | n=n->next; | |
167 | free(t); | |
168 | } else { | |
169 | p=&n->next; | |
170 | n=n->next; | |
171 | } | |
172 | } | |
173 | } | |
174 | ||
175 | static bool_t udp_sendmsg(void *commst, struct buffer_if *buf, | |
a15faeb2 | 176 | const struct comm_addr *dest) |
2fe58dfd SE |
177 | { |
178 | struct udp *st=commst; | |
ff05a229 | 179 | uint8_t *sa; |
2fe58dfd | 180 | |
ff05a229 | 181 | if (st->use_proxy) { |
3abd18e8 | 182 | sa=buf_prepend(buf,8); |
a32d56fb IJ |
183 | if (dest->ia.sa.sa_family != AF_INET) { |
184 | Message(M_INFO, | |
185 | "udp: proxy means dropping outgoing non-IPv4 packet to %s\n", | |
186 | iaddr_to_string(&dest->ia)); | |
187 | return False; | |
188 | } | |
189 | memcpy(sa,&dest->ia.sin.sin_addr,4); | |
ff05a229 | 190 | memset(sa+4,0,4); |
a32d56fb IJ |
191 | memcpy(sa+6,&dest->ia.sin.sin_port,2); |
192 | sendto(st->fd,sa,buf->size+8,0,&st->proxy.sa, | |
193 | iaddr_socklen(&st->proxy)); | |
3abd18e8 | 194 | buf_unprepend(buf,8); |
ff05a229 SE |
195 | } else { |
196 | sendto(st->fd, buf->start, buf->size, 0, | |
a32d56fb | 197 | &dest->ia.sa, iaddr_socklen(&dest->ia)); |
ff05a229 | 198 | } |
2fe58dfd SE |
199 | |
200 | return True; | |
201 | } | |
202 | ||
baa06aeb SE |
203 | static void udp_phase_hook(void *sst, uint32_t new_phase) |
204 | { | |
205 | struct udp *st=sst; | |
a32d56fb | 206 | union iaddr addr; |
baa06aeb | 207 | |
3b83c932 | 208 | st->fd=socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); |
baa06aeb SE |
209 | if (st->fd<0) { |
210 | fatal_perror("udp (%s:%d): socket",st->loc.file,st->loc.line); | |
211 | } | |
212 | if (fcntl(st->fd, F_SETFL, fcntl(st->fd, F_GETFL)|O_NONBLOCK)==-1) { | |
213 | fatal_perror("udp (%s:%d): fcntl(set O_NONBLOCK)", | |
214 | st->loc.file,st->loc.line); | |
215 | } | |
4fb0f88d | 216 | setcloexec(st->fd); |
baa06aeb | 217 | |
a32d56fb | 218 | addr=st->addr; |
b2a56f7c SE |
219 | if (st->authbind) { |
220 | pid_t c; | |
221 | int status; | |
222 | ||
223 | /* XXX this fork() and waitpid() business needs to be hidden | |
224 | in some system-specific library functions. */ | |
225 | c=fork(); | |
226 | if (c==-1) { | |
227 | fatal_perror("udp_phase_hook: fork() for authbind"); | |
228 | } | |
229 | if (c==0) { | |
3b83c932 | 230 | char *argv[4], addrstr[9], portstr[5]; |
a32d56fb IJ |
231 | switch (addr.sa.sa_family) { |
232 | case AF_INET: | |
233 | sprintf(addrstr,"%08lX",(long)addr.sin.sin_addr.s_addr); | |
234 | sprintf(portstr,"%04X",addr.sin.sin_port); | |
235 | break; | |
236 | default: | |
237 | fatal("udp (%s:%d): unsupported address family for authbind", | |
238 | st->loc.file,st->loc.line); | |
239 | } | |
b2a56f7c | 240 | argv[0]=st->authbind; |
3b83c932 SE |
241 | argv[1]=addrstr; |
242 | argv[2]=portstr; | |
b2a56f7c SE |
243 | argv[3]=NULL; |
244 | dup2(st->fd,0); | |
245 | execvp(st->authbind,argv); | |
3b83c932 | 246 | _exit(255); |
b2a56f7c | 247 | } |
3b83c932 SE |
248 | while (waitpid(c,&status,0)==-1) { |
249 | if (errno==EINTR) continue; | |
b2a56f7c SE |
250 | fatal_perror("udp (%s:%d): authbind",st->loc.file,st->loc.line); |
251 | } | |
3b83c932 SE |
252 | if (WIFSIGNALED(status)) { |
253 | fatal("udp (%s:%d): authbind died on signal %d",st->loc.file, | |
254 | st->loc.line, WTERMSIG(status)); | |
255 | } | |
256 | if (WIFEXITED(status) && WEXITSTATUS(status)!=0) { | |
257 | fatal("udp (%s:%d): authbind died with status %d",st->loc.file, | |
258 | st->loc.line, WEXITSTATUS(status)); | |
259 | } | |
b2a56f7c | 260 | } else { |
a32d56fb | 261 | if (bind(st->fd, &addr.sa, iaddr_socklen(&addr))!=0) { |
b2a56f7c SE |
262 | fatal_perror("udp (%s:%d): bind",st->loc.file,st->loc.line); |
263 | } | |
baa06aeb SE |
264 | } |
265 | ||
266 | register_for_poll(st,udp_beforepoll,udp_afterpoll,1,"udp"); | |
267 | } | |
268 | ||
2fe58dfd SE |
269 | static list_t *udp_apply(closure_t *self, struct cloc loc, dict_t *context, |
270 | list_t *args) | |
271 | { | |
272 | struct udp *st; | |
3b83c932 | 273 | item_t *i,*j; |
2fe58dfd | 274 | dict_t *d; |
ff05a229 SE |
275 | list_t *l; |
276 | uint32_t a; | |
2fe58dfd SE |
277 | |
278 | st=safe_malloc(sizeof(*st),"udp_apply(st)"); | |
279 | st->loc=loc; | |
280 | st->cl.description="udp"; | |
281 | st->cl.type=CL_COMM; | |
282 | st->cl.apply=NULL; | |
283 | st->cl.interface=&st->ops; | |
284 | st->ops.st=st; | |
285 | st->ops.request_notify=request_notify; | |
286 | st->ops.release_notify=release_notify; | |
287 | st->ops.sendmsg=udp_sendmsg; | |
5edf478f | 288 | st->ops.addr_to_string=addr_to_string; |
ff05a229 | 289 | st->use_proxy=False; |
2fe58dfd SE |
290 | |
291 | i=list_elem(args,0); | |
292 | if (!i || i->type!=t_dict) { | |
293 | cfgfatal(st->loc,"udp","first argument must be a dictionary\n"); | |
294 | } | |
295 | d=i->data.dict; | |
296 | ||
a32d56fb | 297 | st->addr.sa.sa_family=AF_INET; |
3b83c932 | 298 | j=dict_find_item(d,"address",False,"udp",st->loc); |
a32d56fb IJ |
299 | st->addr.sin.sin_addr.s_addr=j?string_item_to_ipaddr(j, "udp"):INADDR_ANY; |
300 | st->addr.sin.sin_port=dict_read_number(d,"port",True,"udp",st->loc,0); | |
2fe58dfd | 301 | st->rbuf=find_cl_if(d,"buffer",CL_BUFFER,True,"udp",st->loc); |
b2a56f7c | 302 | st->authbind=dict_read_string(d,"authbind",False,"udp",st->loc); |
ff05a229 SE |
303 | l=dict_lookup(d,"proxy"); |
304 | if (l) { | |
305 | st->use_proxy=True; | |
a32d56fb | 306 | st->proxy.sa.sa_family=AF_INET; |
ff05a229 SE |
307 | i=list_elem(l,0); |
308 | if (!i || i->type!=t_string) { | |
309 | cfgfatal(st->loc,"udp","proxy must supply ""addr"",port\n"); | |
310 | } | |
311 | a=string_item_to_ipaddr(i,"proxy"); | |
a32d56fb | 312 | st->proxy.sin.sin_addr.s_addr=htonl(a); |
ff05a229 SE |
313 | i=list_elem(l,1); |
314 | if (!i || i->type!=t_number) { | |
315 | cfgfatal(st->loc,"udp","proxy must supply ""addr"",port\n"); | |
316 | } | |
a32d56fb | 317 | st->proxy.sin.sin_port=htons(i->data.number); |
ff05a229 | 318 | } |
2fe58dfd | 319 | |
3abd18e8 IJ |
320 | update_max_start_pad(&comm_max_start_pad, st->use_proxy ? 8 : 0); |
321 | ||
baa06aeb | 322 | add_hook(PHASE_GETRESOURCES,udp_phase_hook,st); |
2fe58dfd SE |
323 | |
324 | return new_closure(&st->cl); | |
325 | } | |
326 | ||
2fe58dfd SE |
327 | void udp_module(dict_t *dict) |
328 | { | |
329 | add_closure(dict,"udp",udp_apply); | |
330 | } |