1 /* UDP send/receive module for secnet */
3 /* This module enables sites to communicate by sending UDP
4 * packets. When an instance of the module is created we can
5 * optionally bind to a particular local IP address (not implemented
8 * Packets are offered to registered receivers in turn. Once one
9 * accepts it, it isn't offered to any more. */
17 #include <sys/socket.h>
19 #include <netinet/in.h>
20 #include <arpa/inet.h>
23 #include "unaligned.h"
26 #include "comm-common.h"
28 static beforepoll_fn udp_beforepoll
;
29 static afterpoll_fn udp_afterpoll
;
30 static comm_sendmsg_fn udp_sendmsg
;
34 struct udpsocks socks
;
38 * Re comm_addr.ix: This field allows us to note in the comm_addr
39 * which socket an incoming packet was received on. This is required
40 * for conveniently logging the actual source of a packet. But the ix
41 * does not formally form part of the address: it is not used when
42 * sending, nor when comparing two comm_addrs.
44 * The special value -1 means that the comm_addr was constructed by
45 * another module in secnet (eg the resolver), rather than being a
46 * description of the source of an incoming packet.
49 static const char *udp_addr_to_string(void *commst
, const struct comm_addr
*ca
)
51 struct udp
*st
=commst
;
52 struct udpsocks
*socks
=&st
->socks
;
53 static char sbuf
[100];
54 int ix
=ca
->ix
>=0 ? ca
->ix
: 0;
56 assert(ix
>=0 && ix
<socks
->n_socks
);
57 snprintf(sbuf
, sizeof(sbuf
), "udp:%s%s-%s",
58 iaddr_to_string(&socks
->socks
[ix
].addr
),
60 iaddr_to_string(&ca
->ia
));
64 int udp_socks_beforepoll(struct udpsocks
*socks
,
65 struct pollfd
*fds
, int *nfds_io
,
69 BEFOREPOLL_WANT_FDS(socks
->n_socks
);
70 for (i
=0; i
<socks
->n_socks
; i
++) {
71 fds
[i
].fd
=socks
->socks
[i
].fd
;
77 static int udp_beforepoll(void *state
, struct pollfd
*fds
, int *nfds_io
,
81 return udp_socks_beforepoll(&st
->socks
,fds
,nfds_io
,timeout_io
);
84 void udp_socks_afterpoll(struct udpcommon
*uc
, struct udpsocks
*socks
,
85 struct pollfd
*fds
, int nfds
)
93 struct commcommon
*cc
=&uc
->cc
;
95 for (i
=0; i
<socks
->n_socks
; i
++) {
96 if (i
>=nfds
) continue;
97 if (!(fds
[i
].revents
& POLLIN
)) continue;
98 assert(fds
[i
].fd
== socks
->socks
[i
].fd
);
99 int fd
=socks
->socks
[i
].fd
;
101 fromlen
=sizeof(from
);
102 BUF_ASSERT_FREE(cc
->rbuf
);
103 BUF_ALLOC(cc
->rbuf
,"udp_afterpoll");
104 buffer_init(cc
->rbuf
,calculate_max_start_pad());
105 rv
=recvfrom(fd
, cc
->rbuf
->start
,
106 buf_remaining_space(cc
->rbuf
),
107 0, &from
.sa
, &fromlen
);
111 /* Check that the packet came from our poxy server;
112 we shouldn't be contacted directly by anybody else
113 (since they can trivially forge source addresses) */
114 if (!iaddr_equal(&from
,&uc
->proxy
)) {
115 Message(M_INFO
,"udp: received packet that's not "
120 /* proxy protocol supports ipv4 transport only */
121 from
.sa
.sa_family
=AF_INET
;
122 BUF_GET_BYTES(unprepend
,cc
->rbuf
,&from
.sin
.sin_addr
,4);
123 buf_unprepend(cc
->rbuf
,2);
124 BUF_GET_BYTES(unprepend
,cc
->rbuf
,&from
.sin
.sin_port
,2);
130 done
=comm_notify(&cc
->notify
, cc
->rbuf
, &ca
);
133 if (cc
->rbuf
->size
>12 /* prevents traffic amplification */
134 && ((msgtype
=get_uint32(cc
->rbuf
->start
+8))
136 uint32_t source
,dest
;
137 /* Manufacture and send NAK packet */
138 source
=get_uint32(cc
->rbuf
->start
); /* Us */
139 dest
=get_uint32(cc
->rbuf
->start
+4); /* Them */
140 send_nak(&ca
,source
,dest
,msgtype
,cc
->rbuf
,"unwanted");
144 BUF_ASSERT_FREE(cc
->rbuf
);
152 static void udp_afterpoll(void *state
, struct pollfd
*fds
, int nfds
)
154 struct udp
*st
=state
;
155 return udp_socks_afterpoll(&st
->uc
,&st
->socks
,fds
,nfds
);
158 static bool_t
udp_sendmsg(void *commst
, struct buffer_if
*buf
,
159 const struct comm_addr
*dest
)
161 struct udp
*st
=commst
;
162 struct udpcommon
*uc
=&st
->uc
;
163 struct udpsocks
*socks
=&st
->socks
;
167 sa
=buf_prepend(buf
,8);
168 if (dest
->ia
.sa
.sa_family
!= AF_INET
) {
170 "udp: proxy means dropping outgoing non-IPv4 packet to %s\n",
171 iaddr_to_string(&dest
->ia
));
174 memcpy(sa
,&dest
->ia
.sin
.sin_addr
,4);
176 memcpy(sa
+6,&dest
->ia
.sin
.sin_port
,2);
177 sendto(socks
->socks
[0].fd
,sa
,buf
->size
+8,0,&uc
->proxy
.sa
,
178 iaddr_socklen(&uc
->proxy
));
179 buf_unprepend(buf
,8);
182 bool_t allunsupported
=True
;
183 for (i
=0; i
<socks
->n_socks
; i
++) {
184 if (dest
->ia
.sa
.sa_family
!= socks
->socks
[i
].addr
.sa
.sa_family
)
185 /* no point even trying */
187 r
=sendto(socks
->socks
[i
].fd
, buf
->start
, buf
->size
, 0,
188 &dest
->ia
.sa
, iaddr_socklen(&dest
->ia
));
189 if (r
>=0) return True
;
190 if (!(errno
==EAFNOSUPPORT
|| errno
==ENETUNREACH
))
191 /* who knows what that error means? */
192 allunsupported
=False
;
194 return !allunsupported
; /* see doc for comm_sendmsg_fn in secnet.h */
200 static void udp_make_socket(struct udp
*st
, struct udpsock
*us
)
202 const union iaddr
*addr
=&us
->addr
;
203 struct udpcommon
*uc
=&st
->uc
;
204 struct commcommon
*cc
=&uc
->cc
;
206 us
->fd
=socket(addr
->sa
.sa_family
, SOCK_DGRAM
, IPPROTO_UDP
);
208 fatal_perror("udp (%s:%d): socket",cc
->loc
.file
,cc
->loc
.line
);
210 if (fcntl(us
->fd
, F_SETFL
, fcntl(us
->fd
, F_GETFL
)|O_NONBLOCK
)==-1) {
211 fatal_perror("udp (%s:%d): fcntl(set O_NONBLOCK)",
212 cc
->loc
.file
,cc
->loc
.line
);
216 if (addr
->sa
.sa_family
==AF_INET6
) {
219 socklen_t optlen
=sizeof(optval
);
220 r
=setsockopt(us
->fd
,IPPROTO_IPV6
,IPV6_V6ONLY
,&optval
,optlen
);
221 if (r
) fatal_perror("udp (%s:%d): setsockopt(,IPV6_V6ONLY,&1,)",
222 cc
->loc
.file
,cc
->loc
.line
);
230 /* XXX this fork() and waitpid() business needs to be hidden
231 in some system-specific library functions. */
234 fatal_perror("udp_phase_hook: fork() for authbind");
237 char *argv
[5], addrstr
[33], portstr
[5];
240 switch (addr
->sa
.sa_family
) {
242 sprintf(addrstr
,"%08lX",(long)addr
->sin
.sin_addr
.s_addr
);
243 port
=addr
->sin
.sin_port
;
250 sprintf(addrstr
+i
*2,"%02X",addr
->sin6
.sin6_addr
.s6_addr
[i
]);
251 port
=addr
->sin6
.sin6_port
;
255 #endif /*CONFIG_IPV6*/
257 fatal("udp (%s:%d): unsupported address family for authbind",
258 cc
->loc
.file
,cc
->loc
.line
);
260 sprintf(portstr
,"%04X",port
);
261 argv
[0]=uc
->authbind
;
264 argv
[3]=(char*)addrfam
;
267 execvp(uc
->authbind
,argv
);
270 while (waitpid(c
,&status
,0)==-1) {
271 if (errno
==EINTR
) continue;
272 fatal_perror("udp (%s:%d): authbind",cc
->loc
.file
,cc
->loc
.line
);
274 if (WIFSIGNALED(status
)) {
275 fatal("udp (%s:%d): authbind died on signal %d",cc
->loc
.file
,
276 cc
->loc
.line
, WTERMSIG(status
));
278 if (WIFEXITED(status
) && WEXITSTATUS(status
)!=0) {
279 fatal("udp (%s:%d): authbind died with status %d",cc
->loc
.file
,
280 cc
->loc
.line
, WEXITSTATUS(status
));
283 if (bind(us
->fd
, &addr
->sa
, iaddr_socklen(addr
))!=0) {
284 fatal_perror("udp (%s:%d): bind",cc
->loc
.file
,cc
->loc
.line
);
289 static void udp_phase_hook(void *sst
, uint32_t new_phase
)
292 struct udpsocks
*socks
=&st
->socks
;
294 for (i
=0; i
<socks
->n_socks
; i
++)
295 udp_make_socket(st
,&socks
->socks
[i
]);
297 register_for_poll(st
,udp_beforepoll
,udp_afterpoll
,"udp");
300 static list_t
*udp_apply(closure_t
*self
, struct cloc loc
, dict_t
*context
,
309 COMM_APPLY(st
,&st
->uc
.cc
,udp_
,"udp",loc
);
310 COMM_APPLY_STANDARD(st
,&st
->uc
.cc
,"udp",args
);
311 UDP_APPLY_STANDARD(st
,&st
->uc
,"udp");
313 struct udpcommon
*uc
=&st
->uc
;
314 struct udpsocks
*socks
=&st
->socks
;
315 struct commcommon
*cc
=&uc
->cc
;
317 union iaddr defaultaddrs
[] = {
319 { .sin6
= { .sin6_family
=AF_INET6
,
320 .sin6_port
=htons(uc
->port
),
321 .sin6_addr
=IN6ADDR_ANY_INIT
} },
323 { .sin
= { .sin_family
=AF_INET
,
324 .sin_port
=htons(uc
->port
),
325 .sin_addr
= { .s_addr
=INADDR_ANY
} } }
328 caddrl
=dict_lookup(d
,"address");
329 socks
->n_socks
=caddrl ?
list_length(caddrl
) : (int)ARRAY_SIZE(defaultaddrs
);
330 if (socks
->n_socks
<=0 || socks
->n_socks
>UDP_MAX_SOCKETS
)
331 cfgfatal(cc
->loc
,"udp","`address' must be 1..%d addresses",
334 for (i
=0; i
<socks
->n_socks
; i
++) {
335 struct udpsock
*us
=&socks
->socks
[i
];
336 if (!list_length(caddrl
)) {
337 us
->addr
=defaultaddrs
[i
];
339 string_item_to_iaddr(list_elem(caddrl
,i
),uc
->port
,&us
->addr
,"udp");
344 l
=dict_lookup(d
,"proxy");
347 uc
->proxy
.sa
.sa_family
=AF_INET
;
349 if (!item
|| item
->type
!=t_string
) {
350 cfgfatal(cc
->loc
,"udp","proxy must supply ""addr"",port\n");
352 a
=string_item_to_ipaddr(item
,"proxy");
353 uc
->proxy
.sin
.sin_addr
.s_addr
=htonl(a
);
355 if (!item
|| item
->type
!=t_number
) {
356 cfgfatal(cc
->loc
,"udp","proxy must supply ""addr"",port\n");
358 uc
->proxy
.sin
.sin_port
=htons(item
->data
.number
);
361 update_max_start_pad(&comm_max_start_pad
, uc
->use_proxy ?
8 : 0);
363 add_hook(PHASE_GETRESOURCES
,udp_phase_hook
,st
);
365 return new_closure(&cc
->cl
);
368 void udp_module(dict_t
*dict
)
370 add_closure(dict
,"udp",udp_apply
);