1 /* UDP send/receive module for secnet */
3 /* This module enables sites to communicate by sending UDP
4 * packets. When an instance of the module is created we can
5 * optionally bind to a particular local IP address (not implemented
8 * Packets are offered to registered receivers in turn. Once one
9 * accepts it, it isn't offered to any more. */
17 #include <sys/socket.h>
19 #include <netinet/in.h>
20 #include <arpa/inet.h>
23 #include "unaligned.h"
27 static beforepoll_fn udp_beforepoll
;
28 static afterpoll_fn udp_afterpoll
;
29 static comm_request_notify_fn request_notify
;
30 static comm_release_notify_fn release_notify
;
31 static comm_sendmsg_fn udp_sendmsg
;
33 struct comm_notify_entry
{
36 LIST_ENTRY(comm_notify_entry
) entry
;
38 LIST_HEAD(comm_notify_list
, comm_notify_entry
) notify
;
40 #define MAX_SOCKETS 3 /* 2 ought to do really */
52 struct udpsock socks
[MAX_SOCKETS
];
54 struct buffer_if
*rbuf
;
55 struct comm_notify_list notify
;
61 * Re comm_addr.ix: This field allows us to note in the comm_addr
62 * which socket an incoming packet was received on. This is required
63 * for conveniently logging the actual source of a packet. But the ix
64 * does not formally form part of the address: it is not used when
65 * sending, nor when comparing two comm_addrs.
67 * The special value -1 means that the comm_addr was constructed by
68 * another module in secnet (eg the resolver), rather than being a
69 * description of the source of an incoming packet.
72 static const char *addr_to_string(void *commst
, const struct comm_addr
*ca
) {
73 struct udp
*st
=commst
;
74 static char sbuf
[100];
75 int ix
=ca
->ix
>=0 ? ca
->ix
: 0;
77 assert(ix
>=0 && ix
<st
->n_socks
);
78 snprintf(sbuf
, sizeof(sbuf
), "udp:%s%s-%s",
79 iaddr_to_string(&st
->socks
[ix
].addr
),
81 iaddr_to_string(&ca
->ia
));
85 static int udp_beforepoll(void *state
, struct pollfd
*fds
, int *nfds_io
,
90 if (*nfds_io
<st
->n_socks
) {
95 for (i
=0; i
<st
->n_socks
; i
++) {
96 fds
[i
].fd
=st
->socks
[i
].fd
;
102 static void udp_afterpoll(void *state
, struct pollfd
*fds
, int nfds
)
104 struct udp
*st
=state
;
107 struct comm_notify_entry
*n
;
112 for (i
=0; i
<st
->n_socks
; i
++) {
113 if (i
>=nfds
) continue;
114 if (!(fds
[i
].revents
& POLLIN
)) continue;
115 assert(fds
[i
].fd
== st
->socks
[i
].fd
);
116 int fd
=st
->socks
[i
].fd
;
118 fromlen
=sizeof(from
);
119 BUF_ASSERT_FREE(st
->rbuf
);
120 BUF_ALLOC(st
->rbuf
,"udp_afterpoll");
121 buffer_init(st
->rbuf
,calculate_max_start_pad());
122 rv
=recvfrom(fd
, st
->rbuf
->start
,
123 buf_remaining_space(st
->rbuf
),
124 0, &from
.sa
, &fromlen
);
128 /* Check that the packet came from our poxy server;
129 we shouldn't be contacted directly by anybody else
130 (since they can trivially forge source addresses) */
131 if (!iaddr_equal(&from
,&st
->proxy
)) {
132 Message(M_INFO
,"udp: received packet that's not "
137 /* proxy protocol supports ipv4 transport only */
138 from
.sa
.sa_family
=AF_INET
;
139 memcpy(&from
.sin
.sin_addr
,buf_unprepend(st
->rbuf
,4),4);
140 buf_unprepend(st
->rbuf
,2);
141 memcpy(&from
.sin
.sin_port
,buf_unprepend(st
->rbuf
,2),2);
148 LIST_FOREACH(n
, &st
->notify
, entry
) {
149 if (n
->fn(n
->state
, st
->rbuf
, &ca
)) {
156 if (st
->rbuf
->size
>12 /* prevents traffic amplification */
157 && ((msgtype
=get_uint32(st
->rbuf
->start
+8))
159 uint32_t source
,dest
;
160 /* Manufacture and send NAK packet */
161 source
=get_uint32(st
->rbuf
->start
); /* Us */
162 dest
=get_uint32(st
->rbuf
->start
+4); /* Them */
163 send_nak(&ca
,source
,dest
,msgtype
,st
->rbuf
,"unwanted");
167 BUF_ASSERT_FREE(st
->rbuf
);
175 static void request_notify(void *commst
, void *nst
, comm_notify_fn
*fn
)
177 struct udp
*st
=commst
;
178 struct comm_notify_entry
*n
;
180 n
=safe_malloc(sizeof(*n
),"request_notify");
183 LIST_INSERT_HEAD(&st
->notify
, n
, entry
);
186 static void release_notify(void *commst
, void *nst
, comm_notify_fn
*fn
)
188 struct udp
*st
=commst
;
189 struct comm_notify_entry
*n
, *t
;
192 LIST_FOREACH_SAFE(n
, &st
->notify
, entry
, t
) {
193 if (n
->state
==nst
&& n
->fn
==fn
) {
194 LIST_REMOVE(n
, entry
);
200 static bool_t
udp_sendmsg(void *commst
, struct buffer_if
*buf
,
201 const struct comm_addr
*dest
)
203 struct udp
*st
=commst
;
207 sa
=buf_prepend(buf
,8);
208 if (dest
->ia
.sa
.sa_family
!= AF_INET
) {
210 "udp: proxy means dropping outgoing non-IPv4 packet to %s\n",
211 iaddr_to_string(&dest
->ia
));
214 memcpy(sa
,&dest
->ia
.sin
.sin_addr
,4);
216 memcpy(sa
+6,&dest
->ia
.sin
.sin_port
,2);
217 sendto(st
->socks
[0].fd
,sa
,buf
->size
+8,0,&st
->proxy
.sa
,
218 iaddr_socklen(&st
->proxy
));
219 buf_unprepend(buf
,8);
222 bool_t allunsupported
=True
;
223 for (i
=0; i
<st
->n_socks
; i
++) {
224 if (dest
->ia
.sa
.sa_family
!= st
->socks
[i
].addr
.sa
.sa_family
)
225 /* no point even trying */
227 r
=sendto(st
->socks
[i
].fd
, buf
->start
, buf
->size
, 0,
228 &dest
->ia
.sa
, iaddr_socklen(&dest
->ia
));
229 if (r
>=0) return True
;
230 if (!(errno
==EAFNOSUPPORT
|| errno
==ENETUNREACH
))
231 /* who knows what that error means? */
232 allunsupported
=False
;
234 return !allunsupported
; /* see doc for comm_sendmsg_fn in secnet.h */
240 static void udp_make_socket(struct udp
*st
, struct udpsock
*us
)
242 const union iaddr
*addr
=&us
->addr
;
243 us
->fd
=socket(addr
->sa
.sa_family
, SOCK_DGRAM
, IPPROTO_UDP
);
245 fatal_perror("udp (%s:%d): socket",st
->loc
.file
,st
->loc
.line
);
247 if (fcntl(us
->fd
, F_SETFL
, fcntl(us
->fd
, F_GETFL
)|O_NONBLOCK
)==-1) {
248 fatal_perror("udp (%s:%d): fcntl(set O_NONBLOCK)",
249 st
->loc
.file
,st
->loc
.line
);
253 if (addr
->sa
.sa_family
==AF_INET6
) {
256 socklen_t optlen
=sizeof(optval
);
257 r
=setsockopt(us
->fd
,IPPROTO_IPV6
,IPV6_V6ONLY
,&optval
,optlen
);
258 if (r
) fatal_perror("udp (%s:%d): setsockopt(,IPV6_V6ONLY,&1,)",
259 st
->loc
.file
,st
->loc
.line
);
267 /* XXX this fork() and waitpid() business needs to be hidden
268 in some system-specific library functions. */
271 fatal_perror("udp_phase_hook: fork() for authbind");
274 char *argv
[5], addrstr
[33], portstr
[5];
277 switch (addr
->sa
.sa_family
) {
279 sprintf(addrstr
,"%08lX",(long)addr
->sin
.sin_addr
.s_addr
);
280 port
=addr
->sin
.sin_port
;
287 sprintf(addrstr
+i
*2,"%02X",addr
->sin6
.sin6_addr
.s6_addr
[i
]);
288 port
=addr
->sin6
.sin6_port
;
292 #endif /*CONFIG_IPV6*/
294 fatal("udp (%s:%d): unsupported address family for authbind",
295 st
->loc
.file
,st
->loc
.line
);
297 sprintf(portstr
,"%04X",port
);
298 argv
[0]=st
->authbind
;
301 argv
[3]=(char*)addrfam
;
304 execvp(st
->authbind
,argv
);
307 while (waitpid(c
,&status
,0)==-1) {
308 if (errno
==EINTR
) continue;
309 fatal_perror("udp (%s:%d): authbind",st
->loc
.file
,st
->loc
.line
);
311 if (WIFSIGNALED(status
)) {
312 fatal("udp (%s:%d): authbind died on signal %d",st
->loc
.file
,
313 st
->loc
.line
, WTERMSIG(status
));
315 if (WIFEXITED(status
) && WEXITSTATUS(status
)!=0) {
316 fatal("udp (%s:%d): authbind died with status %d",st
->loc
.file
,
317 st
->loc
.line
, WEXITSTATUS(status
));
320 if (bind(us
->fd
, &addr
->sa
, iaddr_socklen(addr
))!=0) {
321 fatal_perror("udp (%s:%d): bind",st
->loc
.file
,st
->loc
.line
);
326 static void udp_phase_hook(void *sst
, uint32_t new_phase
)
330 for (i
=0; i
<st
->n_socks
; i
++)
331 udp_make_socket(st
,&st
->socks
[i
]);
333 register_for_poll(st
,udp_beforepoll
,udp_afterpoll
,MAX_SOCKETS
,"udp");
336 static list_t
*udp_apply(closure_t
*self
, struct cloc loc
, dict_t
*context
,
347 st
=safe_malloc(sizeof(*st
),"udp_apply(st)");
349 st
->cl
.description
="udp";
352 st
->cl
.interface
=&st
->ops
;
354 st
->ops
.request_notify
=request_notify
;
355 st
->ops
.release_notify
=release_notify
;
356 st
->ops
.sendmsg
=udp_sendmsg
;
357 st
->ops
.addr_to_string
=addr_to_string
;
359 LIST_INIT(&st
->notify
);
361 item
=list_elem(args
,0);
362 if (!item
|| item
->type
!=t_dict
) {
363 cfgfatal(st
->loc
,"udp","first argument must be a dictionary\n");
367 int port
=dict_read_number(d
,"port",True
,"udp",st
->loc
,0);
369 union iaddr defaultaddrs
[] = {
371 { .sin6
= { .sin6_family
=AF_INET6
,
372 .sin6_port
=htons(port
),
373 .sin6_addr
=IN6ADDR_ANY_INIT
} },
375 { .sin
= { .sin_family
=AF_INET
,
376 .sin_port
=htons(port
),
377 .sin_addr
= { .s_addr
=INADDR_ANY
} } }
380 caddrl
=dict_lookup(d
,"address");
381 st
->n_socks
=caddrl ?
list_length(caddrl
) : (int)ARRAY_SIZE(defaultaddrs
);
382 if (st
->n_socks
<=0 || st
->n_socks
>MAX_SOCKETS
)
383 cfgfatal(st
->loc
,"udp","`address' must be 1..%d addresses",
386 for (i
=0; i
<st
->n_socks
; i
++) {
387 struct udpsock
*us
=&st
->socks
[i
];
388 if (!list_length(caddrl
)) {
389 us
->addr
=defaultaddrs
[i
];
391 string_item_to_iaddr(list_elem(caddrl
,i
),port
,&us
->addr
,"udp");
396 st
->rbuf
=find_cl_if(d
,"buffer",CL_BUFFER
,True
,"udp",st
->loc
);
397 st
->authbind
=dict_read_string(d
,"authbind",False
,"udp",st
->loc
);
398 l
=dict_lookup(d
,"proxy");
401 st
->proxy
.sa
.sa_family
=AF_INET
;
403 if (!item
|| item
->type
!=t_string
) {
404 cfgfatal(st
->loc
,"udp","proxy must supply ""addr"",port\n");
406 a
=string_item_to_ipaddr(item
,"proxy");
407 st
->proxy
.sin
.sin_addr
.s_addr
=htonl(a
);
409 if (!item
|| item
->type
!=t_number
) {
410 cfgfatal(st
->loc
,"udp","proxy must supply ""addr"",port\n");
412 st
->proxy
.sin
.sin_port
=htons(item
->data
.number
);
415 update_max_start_pad(&comm_max_start_pad
, st
->use_proxy ?
8 : 0);
417 add_hook(PHASE_GETRESOURCES
,udp_phase_hook
,st
);
419 return new_closure(&st
->cl
);
422 void udp_module(dict_t
*dict
)
424 add_closure(dict
,"udp",udp_apply
);