Commit | Line | Data |
---|---|---|
2fe58dfd SE |
1 | /* UDP send/receive module for secnet */ |
2 | ||
3 | /* This module enables sites to communicate by sending UDP | |
4 | * packets. When an instance of the module is created we can | |
5 | * optionally bind to a particular local IP address (not implemented | |
6 | * yet). | |
7 | * | |
2fe58dfd SE |
8 | * Packets are offered to registered receivers in turn. Once one |
9 | * accepts it, it isn't offered to any more. */ | |
10 | ||
8689b3a9 | 11 | #include "secnet.h" |
2fe58dfd SE |
12 | #include <stdio.h> |
13 | #include <unistd.h> | |
14 | #include <fcntl.h> | |
15 | #include <string.h> | |
16 | #include <errno.h> | |
2fe58dfd | 17 | #include <sys/socket.h> |
b2a56f7c | 18 | #include <sys/wait.h> |
5edf478f IJ |
19 | #include <netinet/in.h> |
20 | #include <arpa/inet.h> | |
2fe58dfd | 21 | #include "util.h" |
dd9209d1 | 22 | #include "magic.h" |
794f2398 | 23 | #include "unaligned.h" |
ff05a229 | 24 | #include "ipaddr.h" |
136740e6 | 25 | #include "magic.h" |
2fe58dfd SE |
26 | |
27 | static beforepoll_fn udp_beforepoll; | |
28 | static afterpoll_fn udp_afterpoll; | |
29 | static comm_request_notify_fn request_notify; | |
30 | static comm_release_notify_fn release_notify; | |
31 | static comm_sendmsg_fn udp_sendmsg; | |
32 | ||
6bad2cd5 | 33 | struct comm_notify_entry { |
2fe58dfd SE |
34 | comm_notify_fn *fn; |
35 | void *state; | |
6bad2cd5 | 36 | LIST_ENTRY(comm_notify_entry) entry; |
2fe58dfd | 37 | }; |
6bad2cd5 | 38 | LIST_HEAD(comm_notify_list, comm_notify_entry) notify; |
2fe58dfd | 39 | |
7d31df0e | 40 | #define UDP_MAX_SOCKETS 3 /* 2 ought to do really */ |
08b62a6c IJ |
41 | |
42 | struct udpsock { | |
43 | union iaddr addr; | |
44 | int fd; | |
45 | }; | |
46 | ||
2fe58dfd SE |
47 | struct udp { |
48 | closure_t cl; | |
49 | struct comm_if ops; | |
50 | struct cloc loc; | |
08b62a6c | 51 | int n_socks; |
7d31df0e | 52 | struct udpsock socks[UDP_MAX_SOCKETS]; |
b2a56f7c | 53 | string_t authbind; |
2fe58dfd | 54 | struct buffer_if *rbuf; |
6bad2cd5 | 55 | struct comm_notify_list notify; |
ff05a229 | 56 | bool_t use_proxy; |
a32d56fb | 57 | union iaddr proxy; |
2fe58dfd SE |
58 | }; |
59 | ||
08b62a6c IJ |
60 | /* |
61 | * Re comm_addr.ix: This field allows us to note in the comm_addr | |
62 | * which socket an incoming packet was received on. This is required | |
63 | * for conveniently logging the actual source of a packet. But the ix | |
64 | * does not formally form part of the address: it is not used when | |
65 | * sending, nor when comparing two comm_addrs. | |
66 | * | |
67 | * The special value -1 means that the comm_addr was constructed by | |
68 | * another module in secnet (eg the resolver), rather than being a | |
69 | * description of the source of an incoming packet. | |
70 | */ | |
71 | ||
5edf478f IJ |
72 | static const char *addr_to_string(void *commst, const struct comm_addr *ca) { |
73 | struct udp *st=commst; | |
7d31df0e | 74 | struct udp *socks=st; /* for now */ |
5edf478f | 75 | static char sbuf[100]; |
08b62a6c | 76 | int ix=ca->ix>=0 ? ca->ix : 0; |
5edf478f | 77 | |
7d31df0e | 78 | assert(ix>=0 && ix<socks->n_socks); |
08b62a6c | 79 | snprintf(sbuf, sizeof(sbuf), "udp:%s%s-%s", |
7d31df0e | 80 | iaddr_to_string(&socks->socks[ix].addr), |
08b62a6c IJ |
81 | ca->ix<0 ? "&" : "", |
82 | iaddr_to_string(&ca->ia)); | |
5edf478f IJ |
83 | return sbuf; |
84 | } | |
85 | ||
2fe58dfd | 86 | static int udp_beforepoll(void *state, struct pollfd *fds, int *nfds_io, |
90a39563 | 87 | int *timeout_io) |
2fe58dfd | 88 | { |
08b62a6c | 89 | int i; |
2fe58dfd | 90 | struct udp *st=state; |
7d31df0e IJ |
91 | struct udp *socks=st; /* for now */ |
92 | BEFOREPOLL_WANT_FDS(socks->n_socks); | |
93 | for (i=0; i<socks->n_socks; i++) { | |
94 | fds[i].fd=socks->socks[i].fd; | |
08b62a6c IJ |
95 | fds[i].events=POLLIN; |
96 | } | |
2fe58dfd SE |
97 | return 0; |
98 | } | |
99 | ||
90a39563 | 100 | static void udp_afterpoll(void *state, struct pollfd *fds, int nfds) |
2fe58dfd SE |
101 | { |
102 | struct udp *st=state; | |
7d31df0e IJ |
103 | struct udp *socks=st; /* for now */ |
104 | struct udp *cc=st; /* for now */ | |
105 | struct udp *uc=st; /* for now */ | |
a32d56fb | 106 | union iaddr from; |
b1a0f651 | 107 | socklen_t fromlen; |
6bad2cd5 | 108 | struct comm_notify_entry *n; |
2fe58dfd SE |
109 | bool_t done; |
110 | int rv; | |
08b62a6c | 111 | int i; |
2fe58dfd | 112 | |
08b62a6c IJ |
113 | for (i=0; i<st->n_socks; i++) { |
114 | if (i>=nfds) continue; | |
115 | if (!(fds[i].revents & POLLIN)) continue; | |
7d31df0e IJ |
116 | assert(fds[i].fd == socks->socks[i].fd); |
117 | int fd=socks->socks[i].fd; | |
2fe58dfd SE |
118 | do { |
119 | fromlen=sizeof(from); | |
7d31df0e IJ |
120 | BUF_ASSERT_FREE(cc->rbuf); |
121 | BUF_ALLOC(cc->rbuf,"udp_afterpoll"); | |
122 | buffer_init(cc->rbuf,calculate_max_start_pad()); | |
123 | rv=recvfrom(fd, cc->rbuf->start, | |
124 | buf_remaining_space(cc->rbuf), | |
a32d56fb | 125 | 0, &from.sa, &fromlen); |
2fe58dfd | 126 | if (rv>0) { |
7d31df0e IJ |
127 | cc->rbuf->size=rv; |
128 | if (uc->use_proxy) { | |
ff05a229 SE |
129 | /* Check that the packet came from our poxy server; |
130 | we shouldn't be contacted directly by anybody else | |
131 | (since they can trivially forge source addresses) */ | |
7d31df0e | 132 | if (!iaddr_equal(&from,&uc->proxy)) { |
ff05a229 SE |
133 | Message(M_INFO,"udp: received packet that's not " |
134 | "from the proxy\n"); | |
7d31df0e | 135 | BUF_FREE(cc->rbuf); |
ff05a229 SE |
136 | continue; |
137 | } | |
a32d56fb IJ |
138 | /* proxy protocol supports ipv4 transport only */ |
139 | from.sa.sa_family=AF_INET; | |
7d31df0e IJ |
140 | memcpy(&from.sin.sin_addr,buf_unprepend(cc->rbuf,4),4); |
141 | buf_unprepend(cc->rbuf,2); | |
142 | memcpy(&from.sin.sin_port,buf_unprepend(cc->rbuf,2),2); | |
ff05a229 | 143 | } |
8534d602 | 144 | struct comm_addr ca; |
7d31df0e | 145 | ca.comm=&cc->ops; |
a32d56fb | 146 | ca.ia=from; |
08b62a6c | 147 | ca.ix=i; |
2fe58dfd | 148 | done=False; |
7d31df0e IJ |
149 | LIST_FOREACH(n, &cc->notify, entry) { |
150 | if (n->fn(n->state, cc->rbuf, &ca)) { | |
2fe58dfd SE |
151 | done=True; |
152 | break; | |
153 | } | |
154 | } | |
155 | if (!done) { | |
bf28fc73 | 156 | uint32_t msgtype; |
7d31df0e IJ |
157 | if (cc->rbuf->size>12 /* prevents traffic amplification */ |
158 | && ((msgtype=get_uint32(cc->rbuf->start+8)) | |
bf28fc73 IJ |
159 | != LABEL_NAK)) { |
160 | uint32_t source,dest; | |
161 | /* Manufacture and send NAK packet */ | |
7d31df0e IJ |
162 | source=get_uint32(cc->rbuf->start); /* Us */ |
163 | dest=get_uint32(cc->rbuf->start+4); /* Them */ | |
164 | send_nak(&ca,source,dest,msgtype,cc->rbuf,"unwanted"); | |
bf28fc73 | 165 | } |
7d31df0e | 166 | BUF_FREE(cc->rbuf); |
2fe58dfd | 167 | } |
7d31df0e | 168 | BUF_ASSERT_FREE(cc->rbuf); |
2fe58dfd | 169 | } else { |
7d31df0e | 170 | BUF_FREE(cc->rbuf); |
2fe58dfd SE |
171 | } |
172 | } while (rv>=0); | |
173 | } | |
174 | } | |
175 | ||
176 | static void request_notify(void *commst, void *nst, comm_notify_fn *fn) | |
177 | { | |
178 | struct udp *st=commst; | |
7d31df0e | 179 | struct udp *cc=st; /* for now */ |
6bad2cd5 | 180 | struct comm_notify_entry *n; |
2fe58dfd SE |
181 | |
182 | n=safe_malloc(sizeof(*n),"request_notify"); | |
183 | n->fn=fn; | |
184 | n->state=nst; | |
7d31df0e | 185 | LIST_INSERT_HEAD(&cc->notify, n, entry); |
2fe58dfd SE |
186 | } |
187 | ||
188 | static void release_notify(void *commst, void *nst, comm_notify_fn *fn) | |
189 | { | |
190 | struct udp *st=commst; | |
7d31df0e | 191 | struct udp *cc=st; /* for now */ |
6bad2cd5 | 192 | struct comm_notify_entry *n, *t; |
2fe58dfd SE |
193 | |
194 | /* XXX untested */ | |
7d31df0e | 195 | LIST_FOREACH_SAFE(n, &cc->notify, entry, t) { |
2fe58dfd | 196 | if (n->state==nst && n->fn==fn) { |
6bad2cd5 IJ |
197 | LIST_REMOVE(n, entry); |
198 | free(n); | |
2fe58dfd SE |
199 | } |
200 | } | |
201 | } | |
202 | ||
203 | static bool_t udp_sendmsg(void *commst, struct buffer_if *buf, | |
a15faeb2 | 204 | const struct comm_addr *dest) |
2fe58dfd SE |
205 | { |
206 | struct udp *st=commst; | |
7d31df0e IJ |
207 | struct udp *uc=st; /* for now */ |
208 | struct udp *socks=st; /* for now */ | |
ff05a229 | 209 | uint8_t *sa; |
2fe58dfd | 210 | |
7d31df0e | 211 | if (uc->use_proxy) { |
3abd18e8 | 212 | sa=buf_prepend(buf,8); |
a32d56fb IJ |
213 | if (dest->ia.sa.sa_family != AF_INET) { |
214 | Message(M_INFO, | |
215 | "udp: proxy means dropping outgoing non-IPv4 packet to %s\n", | |
216 | iaddr_to_string(&dest->ia)); | |
217 | return False; | |
218 | } | |
219 | memcpy(sa,&dest->ia.sin.sin_addr,4); | |
ff05a229 | 220 | memset(sa+4,0,4); |
a32d56fb | 221 | memcpy(sa+6,&dest->ia.sin.sin_port,2); |
7d31df0e IJ |
222 | sendto(socks->socks[0].fd,sa,buf->size+8,0,&uc->proxy.sa, |
223 | iaddr_socklen(&uc->proxy)); | |
3abd18e8 | 224 | buf_unprepend(buf,8); |
ff05a229 | 225 | } else { |
08b62a6c IJ |
226 | int i,r; |
227 | bool_t allunsupported=True; | |
7d31df0e IJ |
228 | for (i=0; i<socks->n_socks; i++) { |
229 | if (dest->ia.sa.sa_family != socks->socks[i].addr.sa.sa_family) | |
08b62a6c IJ |
230 | /* no point even trying */ |
231 | continue; | |
7d31df0e | 232 | r=sendto(socks->socks[i].fd, buf->start, buf->size, 0, |
08b62a6c IJ |
233 | &dest->ia.sa, iaddr_socklen(&dest->ia)); |
234 | if (r>=0) return True; | |
235 | if (!(errno==EAFNOSUPPORT || errno==ENETUNREACH)) | |
236 | /* who knows what that error means? */ | |
237 | allunsupported=False; | |
238 | } | |
239 | return !allunsupported; /* see doc for comm_sendmsg_fn in secnet.h */ | |
ff05a229 | 240 | } |
2fe58dfd SE |
241 | |
242 | return True; | |
243 | } | |
244 | ||
08b62a6c | 245 | static void udp_make_socket(struct udp *st, struct udpsock *us) |
baa06aeb | 246 | { |
f164f167 | 247 | const union iaddr *addr=&us->addr; |
7d31df0e IJ |
248 | struct udp *cc=st; /* for now */ |
249 | struct udp *uc=st; /* for now */ | |
08b62a6c | 250 | us->fd=socket(addr->sa.sa_family, SOCK_DGRAM, IPPROTO_UDP); |
f164f167 | 251 | if (us->fd<0) { |
7d31df0e | 252 | fatal_perror("udp (%s:%d): socket",cc->loc.file,cc->loc.line); |
baa06aeb | 253 | } |
f164f167 | 254 | if (fcntl(us->fd, F_SETFL, fcntl(us->fd, F_GETFL)|O_NONBLOCK)==-1) { |
baa06aeb | 255 | fatal_perror("udp (%s:%d): fcntl(set O_NONBLOCK)", |
7d31df0e | 256 | cc->loc.file,cc->loc.line); |
baa06aeb | 257 | } |
f164f167 | 258 | setcloexec(us->fd); |
08b62a6c IJ |
259 | #ifdef CONFIG_IPV6 |
260 | if (addr->sa.sa_family==AF_INET6) { | |
261 | int r; | |
262 | int optval=1; | |
263 | socklen_t optlen=sizeof(optval); | |
264 | r=setsockopt(us->fd,IPPROTO_IPV6,IPV6_V6ONLY,&optval,optlen); | |
265 | if (r) fatal_perror("udp (%s:%d): setsockopt(,IPV6_V6ONLY,&1,)", | |
7d31df0e | 266 | cc->loc.file,cc->loc.line); |
08b62a6c IJ |
267 | } |
268 | #endif | |
baa06aeb | 269 | |
7d31df0e | 270 | if (uc->authbind) { |
b2a56f7c SE |
271 | pid_t c; |
272 | int status; | |
273 | ||
274 | /* XXX this fork() and waitpid() business needs to be hidden | |
275 | in some system-specific library functions. */ | |
276 | c=fork(); | |
277 | if (c==-1) { | |
278 | fatal_perror("udp_phase_hook: fork() for authbind"); | |
279 | } | |
280 | if (c==0) { | |
3ff31eda IJ |
281 | char *argv[5], addrstr[33], portstr[5]; |
282 | const char *addrfam; | |
283 | int port; | |
f164f167 | 284 | switch (addr->sa.sa_family) { |
a32d56fb | 285 | case AF_INET: |
f164f167 | 286 | sprintf(addrstr,"%08lX",(long)addr->sin.sin_addr.s_addr); |
3ff31eda IJ |
287 | port=addr->sin.sin_port; |
288 | addrfam=NULL; | |
a32d56fb | 289 | break; |
3ff31eda IJ |
290 | #ifdef CONFIG_IPV6 |
291 | case AF_INET6: { | |
292 | int i; | |
293 | for (i=0; i<16; i++) | |
294 | sprintf(addrstr+i*2,"%02X",addr->sin6.sin6_addr.s6_addr[i]); | |
295 | port=addr->sin6.sin6_port; | |
296 | addrfam="6"; | |
297 | break; | |
298 | } | |
299 | #endif /*CONFIG_IPV6*/ | |
a32d56fb IJ |
300 | default: |
301 | fatal("udp (%s:%d): unsupported address family for authbind", | |
7d31df0e | 302 | cc->loc.file,cc->loc.line); |
a32d56fb | 303 | } |
3ff31eda | 304 | sprintf(portstr,"%04X",port); |
7d31df0e | 305 | argv[0]=uc->authbind; |
3b83c932 SE |
306 | argv[1]=addrstr; |
307 | argv[2]=portstr; | |
3ff31eda IJ |
308 | argv[3]=(char*)addrfam; |
309 | argv[4]=NULL; | |
f164f167 | 310 | dup2(us->fd,0); |
7d31df0e | 311 | execvp(uc->authbind,argv); |
3b83c932 | 312 | _exit(255); |
b2a56f7c | 313 | } |
3b83c932 SE |
314 | while (waitpid(c,&status,0)==-1) { |
315 | if (errno==EINTR) continue; | |
7d31df0e | 316 | fatal_perror("udp (%s:%d): authbind",cc->loc.file,cc->loc.line); |
b2a56f7c | 317 | } |
3b83c932 | 318 | if (WIFSIGNALED(status)) { |
7d31df0e IJ |
319 | fatal("udp (%s:%d): authbind died on signal %d",cc->loc.file, |
320 | cc->loc.line, WTERMSIG(status)); | |
3b83c932 SE |
321 | } |
322 | if (WIFEXITED(status) && WEXITSTATUS(status)!=0) { | |
7d31df0e IJ |
323 | fatal("udp (%s:%d): authbind died with status %d",cc->loc.file, |
324 | cc->loc.line, WEXITSTATUS(status)); | |
3b83c932 | 325 | } |
b2a56f7c | 326 | } else { |
08b62a6c | 327 | if (bind(us->fd, &addr->sa, iaddr_socklen(addr))!=0) { |
7d31df0e | 328 | fatal_perror("udp (%s:%d): bind",cc->loc.file,cc->loc.line); |
b2a56f7c | 329 | } |
baa06aeb | 330 | } |
f164f167 | 331 | } |
baa06aeb | 332 | |
f164f167 IJ |
333 | static void udp_phase_hook(void *sst, uint32_t new_phase) |
334 | { | |
335 | struct udp *st=sst; | |
7d31df0e | 336 | struct udp *socks=st; /* for now */ |
08b62a6c | 337 | int i; |
7d31df0e IJ |
338 | for (i=0; i<socks->n_socks; i++) |
339 | udp_make_socket(st,&socks->socks[i]); | |
08b62a6c | 340 | |
32fc582f | 341 | register_for_poll(st,udp_beforepoll,udp_afterpoll,"udp"); |
baa06aeb SE |
342 | } |
343 | ||
2fe58dfd SE |
344 | static list_t *udp_apply(closure_t *self, struct cloc loc, dict_t *context, |
345 | list_t *args) | |
346 | { | |
347 | struct udp *st; | |
c649eafe | 348 | item_t *item; |
08b62a6c | 349 | list_t *caddrl; |
2fe58dfd | 350 | dict_t *d; |
ff05a229 SE |
351 | list_t *l; |
352 | uint32_t a; | |
08b62a6c | 353 | int i; |
2fe58dfd SE |
354 | |
355 | st=safe_malloc(sizeof(*st),"udp_apply(st)"); | |
7d31df0e IJ |
356 | struct udp *cc=st; /* for now */ |
357 | struct udp *uc=st; /* for now */ | |
358 | struct udp *socks=st; /* for now */ | |
359 | cc->loc=loc; | |
360 | cc->cl.description="udp"; | |
361 | cc->cl.type=CL_COMM; | |
362 | cc->cl.apply=NULL; | |
363 | cc->cl.interface=&cc->ops; | |
364 | cc->ops.st=st; | |
365 | cc->ops.request_notify=request_notify; | |
366 | cc->ops.release_notify=release_notify; | |
367 | cc->ops.sendmsg=udp_sendmsg; | |
368 | cc->ops.addr_to_string=addr_to_string; | |
369 | uc->use_proxy=False; | |
370 | LIST_INIT(&cc->notify); | |
2fe58dfd | 371 | |
c649eafe IJ |
372 | item=list_elem(args,0); |
373 | if (!item || item->type!=t_dict) { | |
7d31df0e | 374 | cfgfatal(cc->loc,"udp","first argument must be a dictionary\n"); |
2fe58dfd | 375 | } |
c649eafe | 376 | d=item->data.dict; |
2fe58dfd | 377 | |
7d31df0e | 378 | int port=dict_read_number(d,"port",True,"udp",cc->loc,0); |
08b62a6c IJ |
379 | |
380 | union iaddr defaultaddrs[] = { | |
381 | #ifdef CONFIG_IPV6 | |
382 | { .sin6 = { .sin6_family=AF_INET6, | |
383 | .sin6_port=htons(port), | |
384 | .sin6_addr=IN6ADDR_ANY_INIT } }, | |
385 | #endif | |
386 | { .sin = { .sin_family=AF_INET, | |
387 | .sin_port=htons(port), | |
388 | .sin_addr= { .s_addr=INADDR_ANY } } } | |
389 | }; | |
390 | ||
391 | caddrl=dict_lookup(d,"address"); | |
7d31df0e IJ |
392 | socks->n_socks=caddrl ? list_length(caddrl) : (int)ARRAY_SIZE(defaultaddrs); |
393 | if (socks->n_socks<=0 || socks->n_socks>UDP_MAX_SOCKETS) | |
394 | cfgfatal(cc->loc,"udp","`address' must be 1..%d addresses", | |
395 | UDP_MAX_SOCKETS); | |
08b62a6c | 396 | |
7d31df0e IJ |
397 | for (i=0; i<socks->n_socks; i++) { |
398 | struct udpsock *us=&socks->socks[i]; | |
08b62a6c IJ |
399 | if (!list_length(caddrl)) { |
400 | us->addr=defaultaddrs[i]; | |
401 | } else { | |
402 | string_item_to_iaddr(list_elem(caddrl,i),port,&us->addr,"udp"); | |
403 | } | |
404 | us->fd=-1; | |
405 | } | |
406 | ||
7d31df0e IJ |
407 | cc->rbuf=find_cl_if(d,"buffer",CL_BUFFER,True,"udp",cc->loc); |
408 | uc->authbind=dict_read_string(d,"authbind",False,"udp",cc->loc); | |
ff05a229 SE |
409 | l=dict_lookup(d,"proxy"); |
410 | if (l) { | |
7d31df0e IJ |
411 | uc->use_proxy=True; |
412 | uc->proxy.sa.sa_family=AF_INET; | |
c649eafe IJ |
413 | item=list_elem(l,0); |
414 | if (!item || item->type!=t_string) { | |
7d31df0e | 415 | cfgfatal(cc->loc,"udp","proxy must supply ""addr"",port\n"); |
ff05a229 | 416 | } |
c649eafe | 417 | a=string_item_to_ipaddr(item,"proxy"); |
7d31df0e | 418 | uc->proxy.sin.sin_addr.s_addr=htonl(a); |
c649eafe IJ |
419 | item=list_elem(l,1); |
420 | if (!item || item->type!=t_number) { | |
7d31df0e | 421 | cfgfatal(cc->loc,"udp","proxy must supply ""addr"",port\n"); |
ff05a229 | 422 | } |
7d31df0e | 423 | uc->proxy.sin.sin_port=htons(item->data.number); |
ff05a229 | 424 | } |
2fe58dfd | 425 | |
7d31df0e | 426 | update_max_start_pad(&comm_max_start_pad, uc->use_proxy ? 8 : 0); |
3abd18e8 | 427 | |
baa06aeb | 428 | add_hook(PHASE_GETRESOURCES,udp_phase_hook,st); |
2fe58dfd | 429 | |
7d31df0e | 430 | return new_closure(&cc->cl); |
2fe58dfd SE |
431 | } |
432 | ||
2fe58dfd SE |
433 | void udp_module(dict_t *dict) |
434 | { | |
435 | add_closure(dict,"udp",udp_apply); | |
436 | } |