X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?p=secnet.git;a=blobdiff_plain;f=slip.c;h=3f7935a008ad16e483a3aaee72af8795b033147a;hp=a296e420597ee9e1ae81ef1ea0b16492b25ee91c;hb=6b30affc1ec14bf38a73994e8fdd39f26b5bccb3;hpb=90a39563035b70196da9c5bdc7c17a63b64449b0 diff --git a/slip.c b/slip.c index a296e42..3f7935a 100644 --- a/slip.c +++ b/slip.c @@ -7,6 +7,7 @@ #include "util.h" #include "netlink.h" #include "process.h" +#include "unaligned.h" #include #include #include @@ -23,8 +24,9 @@ struct slip { struct buffer_if *buff; /* We unstuff received packets into here and send them to the netlink code. */ bool_t pending_esc; + bool_t ignoring_packet; /* If this packet was corrupt or overlong, + we ignore everything up to the next END */ netlink_deliver_fn *netlink_to_tunnel; - uint32_t local_address; }; /* Generic SLIP mangling code */ @@ -73,35 +75,67 @@ static void slip_unstuff(struct slip *st, uint8_t *buf, uint32_t l) BUF_ASSERT_USED(st->buff); for (i=0; ibuff->size) + buffer_init(st->buff,calculate_max_start_pad()); + if (st->pending_esc) { st->pending_esc=False; switch(buf[i]) { case SLIP_ESCEND: - *(uint8_t *)buf_append(st->buff,1)=SLIP_END; + outputchr=SLIP_END; break; case SLIP_ESCESC: - *(uint8_t *)buf_append(st->buff,1)=SLIP_ESC; + outputchr=SLIP_ESC; break; default: - fatal("userv_afterpoll: bad SLIP escape character"); + if (!st->ignoring_packet) { + Message(M_WARNING, "userv_afterpoll: bad SLIP escape" + " character, dropping packet\n"); + } + st->ignoring_packet=True; + outputchr=OUTPUT_NOTHING; + break; } } else { switch (buf[i]) { case SLIP_END: - if (st->buff->size>0) { - st->netlink_to_tunnel(&st->nl,st->buff); - BUF_ALLOC(st->buff,"userv_afterpoll"); - } - buffer_init(st->buff,st->nl.max_start_pad); + outputchr=OUTPUT_END; break; case SLIP_ESC: st->pending_esc=True; + outputchr=OUTPUT_NOTHING; break; default: - *(uint8_t *)buf_append(st->buff,1)=buf[i]; + outputchr=buf[i]; break; } } + + if (st->ignoring_packet) { + if (outputchr == OUTPUT_END) { + st->ignoring_packet=False; + st->buff->size=0; + } + } else { + if (outputchr == OUTPUT_END) { + if (st->buff->size>0) { + st->netlink_to_tunnel(&st->nl,st->buff); + BUF_ALLOC(st->buff,"userv_afterpoll"); + } + st->buff->size=0; + } else if (outputchr != OUTPUT_NOTHING) { + if (buf_remaining_space(st->buff)) { + buf_append_uint8(st->buff,outputchr); + } else { + Message(M_WARNING, "userv_afterpoll: dropping overlong" + " SLIP packet\n"); + st->ignoring_packet=True; + } + } + } } } @@ -112,10 +146,9 @@ static void slip_init(struct slip *st, struct cloc loc, dict_t *dict, netlink_init(&st->nl,st,loc,dict, "netlink-userv-ipif",NULL,to_host); st->buff=find_cl_if(dict,"buffer",CL_BUFFER,True,"name",loc); - st->local_address=string_item_to_ipaddr( - dict_find_item(dict,"local-address", True, name, loc),"netlink"); BUF_ALLOC(st->buff,"slip_init"); st->pending_esc=False; + st->ignoring_packet=False; } /* Connection to the kernel through userv-ipif */ @@ -137,13 +170,13 @@ static int userv_beforepoll(void *sst, struct pollfd *fds, int *nfds_io, struct userv *st=sst; if (st->rxfd!=-1) { - *nfds_io=2; + BEFOREPOLL_WANT_FDS(2); fds[0].fd=st->txfd; fds[0].events=0; /* Might want to pick up POLLOUT sometime */ fds[1].fd=st->rxfd; fds[1].events=POLLIN; } else { - *nfds_io=0; + BEFOREPOLL_WANT_FDS(0); } return 0; } @@ -177,6 +210,14 @@ static void userv_deliver_to_kernel(void *sst, struct buffer_if *buf) { struct userv *st=sst; + if (buf->size > st->slip.nl.mtu) { + Message(M_ERR,"%s: packet of size %"PRIu32" exceeds mtu %"PRIu32":" + " cannot be injected into kernel, dropped\n", + st->slip.nl.name, buf->size, st->slip.nl.mtu); + BUF_FREE(buf); + return; + } + slip_stuff(&st->slip,buf,st->txfd); } @@ -189,19 +230,13 @@ static void userv_userv_callback(void *sst, pid_t pid, int status) "(expected %d)\n",pid,st->pid); return; } - if (!st->expecting_userv_exit) { - if (WIFEXITED(status)) { - fatal("%s: userv exited unexpectedly with status %d", - st->slip.nl.name,WEXITSTATUS(status)); - } else if (WIFSIGNALED(status)) { - fatal("%s: userv exited unexpectedly: uncaught signal %d", - st->slip.nl.name,WTERMSIG(status)); - } else { - fatal("%s: userv stopped unexpectedly"); - } + if (!(st->expecting_userv_exit && + (!status || + (WIFSIGNALED(status) && WTERMSIG(status)==SIGTERM)))) { + lg_exitstatus(0,st->slip.nl.name,0, + st->expecting_userv_exit ? M_WARNING : M_FATAL, + status,"userv"); } - Message(M_WARNING,"%s: userv subprocess died with status %d\n", - st->slip.nl.name,WEXITSTATUS(status)); st->pid=0; } @@ -220,7 +255,6 @@ static void userv_entry(void *sst) dup2(st->in,0); dup2(st->out,1); - /* XXX close all other fds */ setsid(); /* XXX We really should strdup() all of argv[] but because we'll just exit anyway if execvp() fails it doesn't seem worth bothering. */ @@ -231,10 +265,9 @@ static void userv_entry(void *sst) static void userv_invoke_userv(struct userv *st) { - struct userv_entry_rec *er; + struct userv_entry_rec er[1]; int c_stdin[2]; int c_stdout[2]; - string_t addrs; string_t nets; string_t s; struct netlink_client *r; @@ -250,14 +283,14 @@ static void userv_invoke_userv(struct userv *st) /* This is where we actually invoke userv - all the networks we'll be using should already have been registered. */ - addrs=safe_malloc(512,"userv_invoke_userv:addrs"); - snprintf(addrs,512,"%s,%s,%d,slip", - ipaddr_to_string(st->slip.local_address), + char addrs[512]; + snprintf(addrs,sizeof(addrs),"%s,%s,%d,slip", + ipaddr_to_string(st->slip.nl.local_address), ipaddr_to_string(st->slip.nl.secnet_address),st->slip.nl.mtu); allnets=ipset_new(); for (r=st->slip.nl.clients; r; r=r->next) { - if (r->up) { + if (r->link_quality > LINK_QUALITY_UNUSED) { struct ipset *nan; r->kup=True; nan=ipset_union(allnets,r->networks); @@ -273,7 +306,6 @@ static void userv_invoke_userv(struct userv *st) s=subnet_to_string(snets->list[i]); strcat(nets,s); strcat(nets,","); - free(s); } nets[strlen(nets)-1]=0; subnet_list_free(snets); @@ -284,17 +316,11 @@ static void userv_invoke_userv(struct userv *st) st->slip.pending_esc=False; /* Invoke userv */ - if (pipe(c_stdin)!=0) { - fatal_perror("userv_invoke_userv: pipe(c_stdin)"); - } - if (pipe(c_stdout)!=0) { - fatal_perror("userv_invoke_userv: pipe(c_stdout)"); - } + pipe_cloexec(c_stdin); + pipe_cloexec(c_stdout); st->txfd=c_stdin[1]; st->rxfd=c_stdout[0]; - er=safe_malloc(sizeof(*r),"userv_invoke_userv: er"); - er->in=c_stdin[0]; er->out=c_stdout[1]; /* The arguments are: @@ -303,7 +329,8 @@ static void userv_invoke_userv(struct userv *st) service-name local-addr,secnet-addr,mtu,protocol route1,route2,... */ - er->argv=safe_malloc(sizeof(*er->argv)*6,"userv_invoke_userv:argv"); + const char *er_argv[6]; + er->argv=er_argv; er->argv[0]=st->userv_path; er->argv[1]=st->service_user; er->argv[2]=st->service_name; @@ -316,9 +343,6 @@ static void userv_invoke_userv(struct userv *st) er, st, st->slip.nl.name); close(er->in); close(er->out); - free(er->argv); - free(er); - free(addrs); free(nets); Message(M_INFO,"%s: userv-ipif pid is %d\n",st->slip.nl.name,st->pid); /* Read a single character from the pipe to confirm userv-ipif is @@ -360,7 +384,7 @@ static void userv_phase_hook(void *sst, uint32_t newphase) if (newphase==PHASE_RUN) { userv_invoke_userv(st); /* Register for poll() */ - register_for_poll(st, userv_beforepoll, userv_afterpoll, 2, + register_for_poll(st, userv_beforepoll, userv_afterpoll, st->slip.nl.name); } if (newphase==PHASE_SHUTDOWN) {