1 /* UDP send/receive module for secnet */
4 * This file is part of secnet.
5 * See README for full list of copyright holders.
7 * secnet is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version d of the License, or
10 * (at your option) any later version.
12 * secnet is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * version 3 along with secnet; if not, see
19 * https://www.gnu.org/licenses/gpl.html.
22 /* This module enables sites to communicate by sending UDP
23 * packets. When an instance of the module is created we can
24 * optionally bind to a particular local IP address (not implemented
27 * Packets are offered to registered receivers in turn. Once one
28 * accepts it, it isn't offered to any more. */
36 #include <sys/socket.h>
38 #include <netinet/in.h>
39 #include <arpa/inet.h>
42 #include "unaligned.h"
45 #include "comm-common.h"
47 static comm_sendmsg_fn udp_sendmsg
;
51 struct udpsocks socks
;
52 bool_t addr_configured
;
57 * Re comm_addr.ix: This field allows us to note in the comm_addr
58 * which socket an incoming packet was received on. This is required
59 * for conveniently logging the actual source of a packet. But the ix
60 * does not formally form part of the address: it is not used when
61 * sending, nor when comparing two comm_addrs.
63 * The special value -1 means that the comm_addr was constructed by
64 * another module in secnet (eg the resolver), rather than being a
65 * description of the source of an incoming packet.
68 static const char *udp_addr_to_string(void *commst
, const struct comm_addr
*ca
)
70 struct udp
*st
=commst
;
71 struct udpsocks
*socks
=&st
->socks
;
72 static char sbuf
[100];
73 int ix
=ca
->ix
>=0 ? ca
->ix
: 0;
75 assert(ix
>=0 && ix
<socks
->n_socks
);
76 snprintf(sbuf
, sizeof(sbuf
), "udp#%u@l%d:%s%s-%s",
77 st
->counter
, st
->uc
.cc
.loc
.line
,
78 iaddr_to_string(&socks
->socks
[ix
].addr
),
79 ca
->ix
<0 && socks
->n_socks
>1 ?
"&" : "",
80 iaddr_to_string(&ca
->ia
));
84 static int udp_socks_beforepoll(void *state
, struct pollfd
*fds
, int *nfds_io
,
87 struct udpsocks
*socks
=state
;
89 BEFOREPOLL_WANT_FDS(socks
->n_socks
);
90 for (i
=0; i
<socks
->n_socks
; i
++) {
91 fds
[i
].fd
=socks
->socks
[i
].fd
;
97 const char *af_name(int af
)
100 case AF_INET6
: return "IPv6";
101 case AF_INET
: return "IPv4";
102 case 0: return "(any)";
107 void udp_sock_experienced(struct log_if
*lg
, struct udpcommon
*uc
,
108 struct udpsocks
*socks
, struct udpsock
*us
,
109 const union iaddr
*dest
, int af
,
113 if (us
->experienced
[!!dest
][af
][success
]++)
115 lg_perror(lg
, uc
->cc
.cl
.description
, &uc
->cc
.loc
,
116 success ? M_INFO
: M_WARNING
,
117 success ?
0 : errnoval
,
118 "%s %s experiencing some %s %s%s%s%s%s%s",
119 socks
->desc
,iaddr_to_string(&us
->addr
),
120 success?
"success":"trouble",
121 dest?
"transmitting":"receiving",
122 af?
" ":"", af?
af_name(af
):"",
124 dest?
iaddr_to_string(dest
):"",
128 static void udp_socks_afterpoll(void *state
, struct pollfd
*fds
, int nfds
)
130 struct udpsocks
*socks
=state
;
131 struct udpcommon
*uc
=socks
->uc
;
138 struct commcommon
*cc
=&uc
->cc
;
140 for (i
=0; i
<socks
->n_socks
; i
++) {
141 struct udpsock
*us
=&socks
->socks
[i
];
142 if (i
>=nfds
) continue;
143 if (!(fds
[i
].revents
& POLLIN
)) continue;
144 assert(fds
[i
].fd
== us
->fd
);
147 fromlen
=sizeof(from
);
148 BUF_ASSERT_FREE(cc
->rbuf
);
149 BUF_ALLOC(cc
->rbuf
,"udp_afterpoll");
150 buffer_init(cc
->rbuf
,calculate_max_start_pad());
151 rv
=recvfrom(fd
, cc
->rbuf
->start
,
152 buf_remaining_space(cc
->rbuf
),
153 0, &from
.sa
, &fromlen
);
157 /* Check that the packet came from our poxy server;
158 we shouldn't be contacted directly by anybody else
159 (since they can trivially forge source addresses) */
160 if (!iaddr_equal(&from
,&uc
->proxy
,False
)) {
161 Message(M_INFO
,"udp: received packet that's not "
166 /* proxy protocol supports ipv4 transport only */
167 from
.sa
.sa_family
=AF_INET
;
168 BUF_GET_BYTES(unprepend
,cc
->rbuf
,&from
.sin
.sin_addr
,4);
169 buf_unprepend(cc
->rbuf
,2);
170 BUF_GET_BYTES(unprepend
,cc
->rbuf
,&from
.sin
.sin_port
,2);
176 done
=comm_notify(&cc
->notify
, cc
->rbuf
, &ca
);
178 udp_sock_experienced(0,uc
,socks
,us
,0,
179 from
.sa
.sa_family
,0,0);
182 if (cc
->rbuf
->size
>12 /* prevents traffic amplification */
183 && ((msgtype
=get_uint32(cc
->rbuf
->start
+8))
185 uint32_t source
,dest
;
186 /* Manufacture and send NAK packet */
187 source
=get_uint32(cc
->rbuf
->start
); /* Us */
188 dest
=get_uint32(cc
->rbuf
->start
+4); /* Them */
189 send_nak(&ca
,source
,dest
,msgtype
,cc
->rbuf
,"unwanted");
193 BUF_ASSERT_FREE(cc
->rbuf
);
195 if (errno
!=EINTR
&& !iswouldblock(errno
))
196 udp_sock_experienced(0,uc
,socks
,us
, 0,0, rv
,errno
);
203 static bool_t
udp_sendmsg(void *commst
, struct buffer_if
*buf
,
204 const struct comm_addr
*dest
)
206 struct udp
*st
=commst
;
207 struct udpcommon
*uc
=&st
->uc
;
208 struct udpsocks
*socks
=&st
->socks
;
212 struct udpsock
*us
=&socks
->socks
[0];
213 sa
=buf_prepend(buf
,8);
214 if (dest
->ia
.sa
.sa_family
!= AF_INET
) {
216 "udp: proxy means dropping outgoing non-IPv4 packet to %s\n",
217 iaddr_to_string(&dest
->ia
));
220 memcpy(sa
,&dest
->ia
.sin
.sin_addr
,4);
222 memcpy(sa
+6,&dest
->ia
.sin
.sin_port
,2);
223 int r
=sendto(us
->fd
,sa
,buf
->size
+8,0,&uc
->proxy
.sa
,
224 iaddr_socklen(&uc
->proxy
));
225 udp_sock_experienced(0,uc
,socks
,us
, &dest
->ia
,0, r
,errno
);
226 buf_unprepend(buf
,8);
229 bool_t allunsupported
=True
;
230 int af
=dest
->ia
.sa
.sa_family
;
231 for (i
=0; i
<socks
->n_socks
; i
++) {
232 struct udpsock
*us
=&socks
->socks
[i
];
233 if (us
->addr
.sa
.sa_family
!= af
)
234 /* no point even trying */
236 r
=sendto(us
->fd
, buf
->start
, buf
->size
, 0,
237 &dest
->ia
.sa
, iaddr_socklen(&dest
->ia
));
238 udp_sock_experienced(0,uc
,socks
,us
, &dest
->ia
,af
, r
,errno
);
239 if (r
>=0) return True
;
240 if (!(errno
==EAFNOSUPPORT
|| errno
==ENETUNREACH
))
241 /* who knows what that error means? */
242 allunsupported
=False
;
244 return !allunsupported
; /* see doc for comm_sendmsg_fn in secnet.h */
250 void udp_destroy_socket(struct udpcommon
*uc
, struct udpsock
*us
)
258 #define FAIL_LG 0, cc->cl.description, &cc->loc, failmsgclass
259 #define FAIL(...) do{ \
260 lg_perror(FAIL_LG,errno,__VA_ARGS__); \
264 static bool_t
record_socket_gotaddr(struct udpcommon
*uc
, struct udpsock
*us
,
267 struct commcommon
*cc
=&uc
->cc
;
268 socklen_t salen
=sizeof(us
->addr
);
269 int r
=getsockname(us
->fd
,&us
->addr
.sa
,&salen
);
270 if (r
) FAIL("getsockname()");
271 if (salen
>sizeof(us
->addr
)) { errno
=0; FAIL("getsockname() length"); }
278 bool_t
udp_import_socket(struct udpcommon
*uc
, struct udpsock
*us
,
279 int failmsgclass
, int fd
)
281 FILLZERO(us
->experienced
);
283 return record_socket_gotaddr(uc
,us
,failmsgclass
);
286 bool_t
udp_make_socket(struct udpcommon
*uc
, struct udpsock
*us
,
289 const union iaddr
*addr
=&us
->addr
;
290 struct commcommon
*cc
=&uc
->cc
;
293 FILLZERO(us
->experienced
);
294 us
->fd
=socket(addr
->sa
.sa_family
, SOCK_DGRAM
, IPPROTO_UDP
);
295 if (us
->fd
<0) FAIL("socket");
299 if (addr
->sa
.sa_family
==AF_INET6
) {
302 socklen_t optlen
=sizeof(optval
);
303 r
=setsockopt(us
->fd
,IPPROTO_IPV6
,IPV6_V6ONLY
,&optval
,optlen
);
304 if (r
) FAIL("setsockopt(,IPV6_V6ONLY,&1,)");
312 snprintf(desc
,sizeof(desc
),"authbind for %s: %s",
313 iaddr_to_string(addr
), uc
->authbind
);
315 /* XXX this fork() and waitpid() business needs to be hidden
316 in some system-specific library functions. */
319 FAIL("fork() for authbind");
321 char *argv
[5], addrstr
[33], portstr
[5];
325 switch (addr
->sa
.sa_family
) {
327 sprintf(addrstr
,"%08lX",(long)addr
->sin
.sin_addr
.s_addr
);
328 port
=addr
->sin
.sin_port
;
335 sprintf(addrstr
+i
*2,"%02X",addr
->sin6
.sin6_addr
.s6_addr
[i
]);
336 port
=addr
->sin6
.sin6_port
;
340 #endif /*CONFIG_IPV6*/
342 fatal("udp (%s:%d): unsupported address family for authbind",
343 cc
->loc
.file
,cc
->loc
.line
);
345 sprintf(portstr
,"%04X",port
);
346 argv
[0]=uc
->authbind
;
349 argv
[3]=(char*)addrfam
;
352 execvp(uc
->authbind
,argv
);
355 while (waitpid(c
,&status
,0)==-1) {
356 if (errno
==EINTR
) continue;
357 FAIL("waitpid for authbind");
360 if (WIFEXITED(status
) && WEXITSTATUS(status
)<127) {
361 int es
=WEXITSTATUS(status
);
362 lg_perror(FAIL_LG
,es
,
363 "%s exited with error exit status %d;"
364 " indicates error",desc
,es
);
366 lg_exitstatus(FAIL_LG
,status
,desc
);
371 if (bind(us
->fd
, &addr
->sa
, iaddr_socklen(addr
))!=0)
372 FAIL("bind (%s)",iaddr_to_string(addr
));
375 bool_t ok
=record_socket_gotaddr(uc
,us
,failmsgclass
);
376 if (!ok
) goto failed
;
381 udp_destroy_socket(uc
,us
);
387 void udp_socks_register(struct udpcommon
*uc
, struct udpsocks
*socks
,
393 register_for_poll(socks
,udp_socks_beforepoll
,udp_socks_afterpoll
,"udp");
396 void udp_socks_deregister(struct udpcommon
*uc
, struct udpsocks
*socks
)
399 deregister_for_poll(socks
->interest
);
402 void udp_socks_childpersist(struct udpcommon
*uc
, struct udpsocks
*socks
)
405 for (i
=0; i
<socks
->n_socks
; i
++)
406 udp_destroy_socket(uc
,&socks
->socks
[i
]);
409 static void udp_childpersist_hook(void *sst
, uint32_t new_phase
)
412 udp_socks_childpersist(&st
->uc
,&st
->socks
);
415 static void udp_phase_hook(void *sst
, uint32_t new_phase
)
418 struct udpsocks
*socks
=&st
->socks
;
419 struct udpcommon
*uc
=&st
->uc
;
423 for (i
=0; i
<socks
->n_socks
; i
++) {
424 bool_t required
=st
->addr_configured
425 || (!anydone
&& i
==socks
->n_socks
-1);
426 anydone
+= udp_make_socket(uc
,&socks
->socks
[i
],
427 required ? M_FATAL
: M_WARNING
);
430 udp_socks_register(uc
,socks
, uc
->use_proxy ?
"proxy" : "socket");
432 add_hook(PHASE_CHILDPERSIST
,udp_childpersist_hook
,st
);
435 static list_t
*udp_apply(closure_t
*self
, struct cloc loc
, dict_t
*context
,
438 static unsigned counter
;
446 COMM_APPLY(st
,&st
->uc
.cc
,udp_
,"udp",loc
);
447 COMM_APPLY_STANDARD(st
,&st
->uc
.cc
,"udp",args
);
448 UDP_APPLY_STANDARD(st
,&st
->uc
,"udp");
450 struct udpcommon
*uc
=&st
->uc
;
451 struct udpsocks
*socks
=&st
->socks
;
452 struct commcommon
*cc
=&uc
->cc
;
454 st
->counter
=counter
++;
456 union iaddr defaultaddrs
[] = {
458 { .sin6
= { .sin6_family
=AF_INET6
,
459 .sin6_port
=htons(uc
->port
),
460 .sin6_addr
=IN6ADDR_ANY_INIT
} },
462 { .sin
= { .sin_family
=AF_INET
,
463 .sin_port
=htons(uc
->port
),
464 .sin_addr
= { .s_addr
=INADDR_ANY
} } }
467 caddrl
=dict_lookup(d
,"address");
468 st
->addr_configured
=!!caddrl
;
469 socks
->n_socks
=st
->addr_configured ?
list_length(caddrl
)
470 : (int)ARRAY_SIZE(defaultaddrs
);
471 if (socks
->n_socks
<=0 || socks
->n_socks
>UDP_MAX_SOCKETS
)
472 cfgfatal(cc
->loc
,"udp","`address' must be 1..%d addresses",
475 for (i
=0; i
<socks
->n_socks
; i
++) {
476 struct udpsock
*us
=&socks
->socks
[i
];
477 if (!st
->addr_configured
) {
478 us
->addr
=defaultaddrs
[i
];
480 string_item_to_iaddr(list_elem(caddrl
,i
),uc
->port
,&us
->addr
,"udp");
485 l
=dict_lookup(d
,"proxy");
488 uc
->proxy
.sa
.sa_family
=AF_INET
;
490 if (!item
|| item
->type
!=t_string
) {
491 cfgfatal(cc
->loc
,"udp","proxy must supply ""addr"",port\n");
493 a
=string_item_to_ipaddr(item
,"proxy");
494 uc
->proxy
.sin
.sin_addr
.s_addr
=htonl(a
);
496 if (!item
|| item
->type
!=t_number
) {
497 cfgfatal(cc
->loc
,"udp","proxy must supply ""addr"",port\n");
499 uc
->proxy
.sin
.sin_port
=htons(item
->data
.number
);
502 update_max_start_pad(&comm_max_start_pad
, uc
->use_proxy ?
8 : 0);
504 add_hook(PHASE_GETRESOURCES
,udp_phase_hook
,st
);
506 return new_closure(&cc
->cl
);
509 void udp_module(dict_t
*dict
)
511 add_closure(dict
,"udp",udp_apply
);