chiark / gitweb /
secnet.git
3 years agoFinalise 0.4.0~beta1 base.ipv6-polypath-fixes-2.v1
Ian Jackson [Sun, 26 Oct 2014 15:28:39 +0000 (15:28 +0000)]
Finalise 0.4.0~beta1

3 years agoudp: Print more info in our comm_addr representations proposed.ipv6-polypath-fixes.v1
Ian Jackson [Sat, 25 Oct 2014 18:22:01 +0000 (19:22 +0100)]
udp: Print more info in our comm_addr representations

Include an index number (starting at 0) and the line number (but not
filename) at which we were defined.  This is allows the user to more
easily see (for example) which comm_addrs actually belong to the same
udp, even if they might have a different ix and thus be reported with
different local addresses.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agosite: When reporting resolution complete, print only iaddr
Ian Jackson [Sat, 25 Oct 2014 18:20:14 +0000 (19:20 +0100)]
site: When reporting resolution complete, print only iaddr

For any particular site, the comm (and ix) are always going to be the
same.  Printing only the address and port produces less clutter in the
log.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoStatic buffers: Provide new rotating static buffer macros
Ian Jackson [Sat, 25 Oct 2014 18:04:31 +0000 (19:04 +0100)]
Static buffers: Provide new rotating static buffer macros

Provide new macros SBUF_DEFINE and SBUF which replace the open coded
rotating static buffers in ipaddr_getbuf (ipaddr_to_string and
subnet_to_string) and iaddr_to_string.

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoStatic buffers: Replace references to bufs[b]
Ian Jackson [Sat, 25 Oct 2014 17:27:34 +0000 (18:27 +0100)]
Static buffers: Replace references to bufs[b]

Introduce a new macro SBUF which currently refers to bufs[b].  We are
going to change its definition in a moment.  Splitting the patches up
this way makes it easier to see that they're right.

No functional change in this patch.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoStatic buffers: ipaddr_getbuf: Rename some variables
Ian Jackson [Sat, 25 Oct 2014 17:56:32 +0000 (18:56 +0100)]
Static buffers: ipaddr_getbuf: Rename some variables

Rename ipaddr_bufnum to b and ipaddr_bufs to bufs.  That makes the
naming consistent with the other ad-hoc rotating buffers in
iaddr_to_string.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp: Insist on only one successful default socket setup
Ian Jackson [Sat, 25 Oct 2014 15:56:50 +0000 (16:56 +0100)]
udp: Insist on only one successful default socket setup

If we default the addresses to use, we only insist that at least one
of them can be successfully set up.

(This is particularly significant when upgrading an existing secnet
installation to the new secnet, with IPv6 support, but on a host with
no IPv6, and no address configured in the config file.  Without this
patch, secnet would fail to start up because it would try, and fail,
to bind the IPv6 address.)

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp: Provide st->addr_configured
Ian Jackson [Sat, 25 Oct 2014 14:00:38 +0000 (15:00 +0100)]
udp: Provide st->addr_configured

We are going to use it in udp_phase_hook.

Rewrite the tests on caddrl in terms of this new boolean.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp, polypath: Log destination address in `some success' messages
Ian Jackson [Sat, 25 Oct 2014 11:09:46 +0000 (12:09 +0100)]
udp, polypath: Log destination address in `some success' messages

Replace the boolean parameter with a pointer to the destination
address.  (Conveniently this means that the calls relating to
reception can remain unchanged and the ones relating to transmission
produce a compile error until converted.)

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoauthbind: Better logging of authbind failures
Ian Jackson [Sat, 25 Oct 2014 11:02:02 +0000 (12:02 +0100)]
authbind: Better logging of authbind failures

Report the address and the authbind helper pathname.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agostring_item_to_iaddr: Actually set port if !CONFIG_IPV6
Ian Jackson [Thu, 23 Oct 2014 22:50:45 +0000 (23:50 +0100)]
string_item_to_iaddr: Actually set port if !CONFIG_IPV6

This bug was introduced along with this function in bb839899 `Provide
string_item_to_iaddr', which simply forgot to set the port.

The practical implications are that the port number of a locally bound
socket would not be specified, if an address was supplied, but only in
builds without IPv6 support.  (This might result in the kernel picking
a port nmber; if authbind is in use it would probably cause authbind
to refuse.)

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoresolver: Actually set port in resulting ca's
Ian Jackson [Thu, 23 Oct 2014 22:49:17 +0000 (23:49 +0100)]
resolver: Actually set port in resulting ca's

This got broken in 2093fb5c `comm etc.: Provide comm_addr_equal'.

We mistakenly removed the code that copied the port from q, along with
the code that copied the adns answer from ra.  (The sockaddr that
comes back from adns obviously doesn't have a port number in it.)

As a result all actual DNS resolutions would result in an unuseable
sockaddr with port==0.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp: Print `&' in address descriptions only if multiple sockets
Ian Jackson [Thu, 23 Oct 2014 18:04:57 +0000 (19:04 +0100)]
udp: Print `&' in address descriptions only if multiple sockets

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoMakefile.in: remove *.pyc base.ipv6-polypath-fixes.v1
Ian Jackson [Tue, 21 Oct 2014 00:20:12 +0000 (01:20 +0100)]
Makefile.in: remove *.pyc

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agodebian/changelog: Write most of changelog for 0.4.x
Ian Jackson [Tue, 21 Oct 2014 00:05:53 +0000 (01:05 +0100)]
debian/changelog: Write most of changelog for 0.4.x

3 years agoMakefile.in: Handle conffile.yy.h properly
Ian Jackson [Mon, 20 Oct 2014 23:33:49 +0000 (00:33 +0100)]
Makefile.in: Handle conffile.yy.h properly

This needs to be deleted by clean.  And it needs to be a dependency of
the %.o pattern rule.  (Since we rely on autogenerated .d header file
dependencies, are fine for manually-edited header files but not
autogenerated ones.)

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agodebian: Fix build-depends
Ian Jackson [Thu, 9 Oct 2014 18:23:31 +0000 (19:23 +0100)]
debian: Fix build-depends

Add libbsd-dev and python-ipaddr

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agodebian/changelog: wip 0.4.x
Ian Jackson [Thu, 9 Oct 2014 18:20:32 +0000 (19:20 +0100)]
debian/changelog: wip 0.4.x

3 years agoNEW etc.: Use NEW at non-formulaic call sites
Ian Jackson [Tue, 7 Oct 2014 19:51:05 +0000 (20:51 +0100)]
NEW etc.: Use NEW at non-formulaic call sites

Manually replace calls to safe_malloc with NEW.  Calls where
safe_malloc was used to allocate a byte array (or a string buffer) are
left alone.

Some simple calls to allocate a single object are replaced with NEW.
(in COMM_APPLY, init_log, resolve_request, transform_cbcmac_module,
TRANSFORM_CREATE_CORE).

Some calls which were allocating arrays are replaced with NEW_ARY
(in dict_keys, ipset_new).

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoNEW etc.: Replace most calls to safe_realloc_ary
Ian Jackson [Tue, 7 Oct 2014 19:41:20 +0000 (20:41 +0100)]
NEW etc.: Replace most calls to safe_realloc_ary

Replace with REALLOC_ARY whenever the array object size is not 1

In subnet_list_set_len and ipset_set_len we abolish the unnecessary
temporary variable `nd'.  In subnet_list_set_len we also simplify the
assert integer overflow condition (the division is not needed because
REALLOC_ARY and hence safe_malloc_ary will check for potential
multiplication overflow).

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoNEW etc.: Use NEW_ARY
Ian Jackson [Tue, 7 Oct 2014 19:36:17 +0000 (20:36 +0100)]
NEW etc.: Use NEW_ARY

Replace all calls to safe_malloc_ary with the NEW_ARY wrapper.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoNEW etc.: Use NEW in all obvious places
Ian Jackson [Tue, 7 Oct 2014 19:31:26 +0000 (20:31 +0100)]
NEW etc.: Use NEW in all obvious places

Entirely automatic conversion, using the following Perl rune:

  perl -i~ -pe 's#^(\s+)(\w+)=safe_malloc\(sizeof\(\*\2\),"[^"]+"\);$#$1NEW($2);#' *.c conffile.fl conffile.y

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoNEW etc.: Provide size-safe wrappers for safe_malloc et al.
Ian Jackson [Tue, 7 Oct 2014 19:28:33 +0000 (20:28 +0100)]
NEW etc.: Provide size-safe wrappers for safe_malloc et al.

These automatically compute the size from the type to be assigned to,
and automatically generate a context string.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp, polypath: Log `experiencing success receiving', etc.
Ian Jackson [Wed, 1 Oct 2014 23:55:28 +0000 (00:55 +0100)]
udp, polypath: Log `experiencing success receiving', etc.

We want to use the `experienced' mechanism to report success while
receiving.

But, previously, the udp_socks_afterpoll function which does the
reciving didn't have a suitable description (`socksdesc') available:
in particular, for polypath, it should print the interface name.

Solve this as follows:
 * Add a `desc' field to struct udpsocks, set by udp_socks_register
   (for polypath this duplicates interf->name, but we don't really
   care much about that as it's only one pointer).
 * Add a new argument to udp_socks_register to ensure we catch
   all the creation sites.
 * Have have udp_sock_experienced take a struct udpsocks*.

After all that, the new call to udp_sock_experienced is trivial.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agotest-example: Test not specifying a port
Ian Jackson [Wed, 1 Oct 2014 23:24:24 +0000 (00:24 +0100)]
test-example: Test not specifying a port

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp, polypath: Make specifying port optional
Ian Jackson [Wed, 1 Oct 2014 23:19:34 +0000 (00:19 +0100)]
udp, polypath: Make specifying port optional

There is no particular reason why a mobile site with no stable address
ought to have to bind to a particular port.  Doing so in those
configurations can bring in additional complications.

So, make specifying the port optional.

udp_make_socket calls getsockname to find what port number it got.
(We do this unconditionally as that's simplest.)

This has more complicated fallout than appears at first glance.
polypath needs to be able to match disappearances of the interface
address, which is mostly processed in terms of the configured rather
than obtained sockaddr.

In polypath, we need to compare just the addresses when removing an
interface address, because the port will have been assigned later.  We
also use the actual address in logging, rather than the one supplied
by the interface monitor.

To support these changes, we formalise udp_import_socket, and provide
a new `ignoreport' option to iaddr_equal.  The scope of the FAIL and
FAIL_LG macros in udp.c becomes a bit wider.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agotest-example: Set `system/userid'
Ian Jackson [Wed, 1 Oct 2014 17:22:57 +0000 (18:22 +0100)]
test-example: Set `system/userid'

This means we normally test the privsep, rather than non-privsep,
version of polypath.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agotest-example: Reorder a config to better test CHILDPERSIST
Ian Jackson [Wed, 1 Oct 2014 22:33:39 +0000 (23:33 +0100)]
test-example: Reorder a config to better test CHILDPERSIST

If we move the polypath comm before the tun netlink, the tun will
already have been set up by the time polypath spawns its privsep
helper.  (Since the entries are processed in reverse order.)  This
means that the CHILDPERSIST phase hook ends up closing the tun fd,
which we can see in strace.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agopolypath: Provide privsep mode
Ian Jackson [Wed, 1 Oct 2014 17:19:20 +0000 (18:19 +0100)]
polypath: Provide privsep mode

If secnet is going to drop privileges, it won't be able to call
setsockopt(,,SO_BINDTODEVICE,) to set up the new polypath sockets.

Provide an arrangement where this is done by a child forked before we
drop privilege.

Add some comments to the existing just-broken-down interface change
handling code, saying whether and how they are used in the non-privsep
and privsep cases.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agopolypath: Log pid of long-running interface monitor
Ian Jackson [Wed, 1 Oct 2014 22:42:04 +0000 (23:42 +0100)]
polypath: Log pid of long-running interface monitor

This new reporting is going to be particularly useful for privsep,
which has a child and also a grandchild.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agologging: Persistent children include pid in their log messages
Ian Jackson [Wed, 1 Oct 2014 22:31:36 +0000 (23:31 +0100)]
logging: Persistent children include pid in their log messages

Use the new PHASE_CHILDPERSIST hook to discover when we fork and
become a persistent child.  When that happens, we call openlog() again
to add LOG_PID, and we make a note to add the pid to messages written
directly to logfiles (or the terminal) by secnet's file logger.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agofds etc.: Support non-forking persistent children
Ian Jackson [Wed, 1 Oct 2014 22:21:56 +0000 (23:21 +0100)]
fds etc.: Support non-forking persistent children

Polypath is are going to want to spawn a persistent child process,
which will not exec.  This child ought not to hold onto the various
important fds.

Otherwise, if the main secnet process dies but the child does not (for
some reason), the network interfaces, udp sockets, etc., set up by the
old secnet will remain owned by the child.

Introduce a new PHASE for this purpose (currently never entered).
Provide a convenient common hook function for closing a single fd.

Add phase hooks to:
 * Close udp sockets (in the udp and polypath comm modules);
 * Close the pipes to userv-ipif (slip netlink module);
 * Close the tun device (tun netlink module);
 * Zero out data transport keys, to improve forward secrecy in case
   the subprocess leaks somehow.  (Sadly we can't conveniently find
   the asymmmetric crypto session key negotiation state to wipe it.)

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agopolypath: Close parent's socket in child
Ian Jackson [Wed, 1 Oct 2014 17:20:44 +0000 (18:20 +0100)]
polypath: Close parent's socket in child

Previously this would happen automatically due to CLOEXEC, but we are
going to have a long-running child, which needs to not have a copy of
this fd.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agopolypath: Break up child process handling
Ian Jackson [Tue, 30 Sep 2014 17:33:59 +0000 (18:33 +0100)]
polypath: Break up child process handling

This will allow us to have different child processes, and also reuse
much of the same child output processing code in a different context.

No functional change (other than a tiny change to a message).

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agopolypath: Reorganise to break up ifaddr handling
Ian Jackson [Tue, 30 Sep 2014 16:36:44 +0000 (17:36 +0100)]
polypath: Reorganise to break up ifaddr handling

We are going to want to do some of this processing in a different
process, and hence in a different order.  So split
polypath_process_monitor_lineinto three, producing two new functions
polypath_make_socket and polypath_record_ifaddr.

We change the error handling so it can be more context-sensitive: the
BAD macros use contextual `bad' and `badctx' values.  These are
function pointers.

dump_ppml becomes dump_pria because it records interface address
recording.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoprocess: Clear SHUTDOWN hooks in afterfork()
Ian Jackson [Tue, 30 Sep 2014 17:22:14 +0000 (18:22 +0100)]
process: Clear SHUTDOWN hooks in afterfork()

That allows child processes to safely use the standard fatal() calls
etc.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agotest-example: Provide a polypath test
Ian Jackson [Sat, 27 Sep 2014 17:13:57 +0000 (18:13 +0100)]
test-example: Provide a polypath test

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agopolypath: Provide Linux interface monitor
Ian Jackson [Mon, 29 Sep 2014 14:17:13 +0000 (15:17 +0100)]
polypath: Provide Linux interface monitor

This script monitors the local network interfaces and prints output as
interfaces and addresses appear and disappear.

Install it in $(datarootdir).  Provide $(datarootdir) to C code via a
-D compiler flag.  Provide the appropriate path as the default setting
for `monitor-command' in the polypath module.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agopolypath: Provide polypath comm module
Ian Jackson [Wed, 26 Feb 2014 14:19:01 +0000 (14:19 +0000)]
polypath: Provide polypath comm module

Provide a new name `polypath' in the global dictionary which can be
made to produce new closures of type `comm'.  These comms send packets
via multiple local interfaces.

Currently this module is not very useful because we lack a suitable
`monitor-command' for enumerating local interfaces.

We disable it if we don't have CONFIG_IPV6 because then we don't have
adns_text2addr.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoutil: Break out pollbadbit()
Ian Jackson [Wed, 1 Oct 2014 17:02:19 +0000 (18:02 +0100)]
util: Break out pollbadbit()

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agobuffer: Provide buffer_destroy
Ian Jackson [Wed, 1 Oct 2014 17:00:00 +0000 (18:00 +0100)]
buffer: Provide buffer_destroy

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoutil: Use BSD queue.h for phase hook lists
Ian Jackson [Tue, 30 Sep 2014 17:17:43 +0000 (18:17 +0100)]
util: Use BSD queue.h for phase hook lists

We are about to touch this code and would like something clearer to
work with.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agosecnet: provide will_droppriv
Ian Jackson [Tue, 30 Sep 2014 17:07:10 +0000 (18:07 +0100)]
secnet: provide will_droppriv

polypath is going to want to know whether to do privsep.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agotransform: Discard previously-received packets
Ian Jackson [Sat, 27 Sep 2014 23:40:04 +0000 (00:40 +0100)]
transform: Discard previously-received packets

Keep a bitmap of previously-received packets (by sequence number
offset) and discard duplicates.

This feature can only be enabled if the bitmap (32 bits) is big enough
for the sequence number window (`max-skew'), but this is true by
default, and the feature is enabled by default when available.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agotransform: Break out SEQNUM_KEYED_FIELDS and SEQNUM_PARAMS_FIELDS
Ian Jackson [Sat, 27 Sep 2014 23:27:19 +0000 (00:27 +0100)]
transform: Break out SEQNUM_KEYED_FIELDS and SEQNUM_PARAMS_FIELDS

And provide initialiser macros SEQNUM_KEYED_INIT and
SEQNUM_PARAMS_INIT.

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agotransform-cbcmac: Move max_[seq]_skew into params struct
Ian Jackson [Sat, 27 Sep 2014 23:45:01 +0000 (00:45 +0100)]
transform-cbcmac: Move max_[seq]_skew into params struct

Like in transform-eax.  We are going to want to share this with eac
and extend it.

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoMakefile.in: Move settings of various directories above CFLAGS etc.
Ian Jackson [Sat, 27 Sep 2014 14:37:20 +0000 (15:37 +0100)]
Makefile.in: Move settings of various directories above CFLAGS etc.

We are going to want to -D some of these for the benefit of the secnet
executable finding its helpers.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp: Log transmission and reception errors, at least some of the time
Ian Jackson [Sat, 27 Sep 2014 14:03:34 +0000 (15:03 +0100)]
udp: Log transmission and reception errors, at least some of the time

We keep a bitmask for each combination of
  - receive/send
  - address family
  - success/failure
and log a message the first time each one occurs.

We also provide a new utility function `af_name()' which is going to
be used by polypath's logging.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agonetlink: Use MIN rather than ?:
Ian Jackson [Fri, 3 Oct 2014 20:16:49 +0000 (21:16 +0100)]
netlink: Use MIN rather than ?:

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoutil.h etc.: Provide MAX_RAW and MIN_RAW; etc.
Ian Jackson [Fri, 3 Oct 2014 19:22:18 +0000 (20:22 +0100)]
util.h etc.: Provide MAX_RAW and MIN_RAW; etc.

MAX and MIN are unsuitable for use where a constant expression is
required.  Provide MAX_RAW and MIN_RAW which are suitable but might
evaluate the left argument twice.

Remove max() in ipaddr.c and replace the call with one to MAX (not
MAX_RAW.  (The old max macro there is operator-priority-unsafe but
there is only one call site and it happens to be OK.)

We ae going to use MAX_RAW later.

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp: Introduce some `us' convenience variables, etc.
Ian Jackson [Sat, 27 Sep 2014 14:01:05 +0000 (15:01 +0100)]
udp: Introduce some `us' convenience variables, etc.

* Introduce appropriate `struct udpsock *us' in a few places, and use
  them as appropriate.  We are going to make a few more places where
  these are used and this avoids some repetition.

* Introduce an `af' variable for the intended destination address
  family at one point.  We are going to want to reuse this.

* Add a comment on a line `} else {' distant from its `if (..) {'.

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agocleanup: Replace a few calls to malloc/realloc with safe_malloc
Ian Jackson [Thu, 2 Oct 2014 00:16:47 +0000 (01:16 +0100)]
cleanup: Replace a few calls to malloc/realloc with safe_malloc

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoslip: Remove an incorrect XXX comment
Ian Jackson [Sat, 27 Sep 2014 13:28:20 +0000 (14:28 +0100)]
slip: Remove an incorrect XXX comment

There is no need to strdup anything before calling exec (or exit, of
course).

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoutil: Provide async_linebuf_read
Ian Jackson [Tue, 23 Sep 2014 23:33:52 +0000 (00:33 +0100)]
util: Provide async_linebuf_read

polypath is going to want to read output from the interface and
address reporting script.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agofds: Make many fds nonblocking
Ian Jackson [Sat, 27 Sep 2014 12:56:35 +0000 (13:56 +0100)]
fds: Make many fds nonblocking

Introduce iswouldblock to cope with POSIX not specifying which of
EAGAIN or EWOULDBLOCK you get).  In various subsystems, make more fds
nonblocking and handle errors appropriately.  Specifically:

* Logging self-pipe reading end.
* Signal self-pipe reading end.
* SLIP both ends.  Fixing the writing end involves breaking out a new
  function slip_write.  We have to set these nonblocking after reading
  the confiramation byte.
* tun's network interface fd.

In various of these we add code to handle EINTR, too.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoIntroduce setnonblock()
Ian Jackson [Sat, 27 Sep 2014 12:26:17 +0000 (13:26 +0100)]
Introduce setnonblock()

This involves reworking setcloexec()'s implementation so that we can
reuse it.

We now treat a failure to set O_NONBLOCK in udp_make_socket as a
fatal, rather than recoverable, error.  This is fine.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoprocess: Introduce afterfork()
Ian Jackson [Sat, 27 Sep 2014 10:10:06 +0000 (11:10 +0100)]
process: Introduce afterfork()

Rework set_default_signals into afterfork, which does the sigprocmask
too.  This is necessary for processes we fork after
setup_signal_handling(), which otherwise inherit our blocking mask and
non-default handlers.

Call it after each fork() (except the ones we use for daemonising).
As a consequence:
 - hackypar children will die if they get a terminating signal
 - our subprocesses such as `route' and `ifconfig' will inherit
   reasonable signal setups
 - it will be correct to call udp_make_socket during phase RUN
   (previously any authbind would get a strange signal setup)

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp: Break out udp_destroy_socket
Ian Jackson [Fri, 26 Sep 2014 18:26:49 +0000 (19:26 +0100)]
udp: Break out udp_destroy_socket

polypath is are going to want this.  No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp: Report authbind exit status as errno value if it seems appropriate
Ian Jackson [Sun, 5 Oct 2014 23:49:02 +0000 (00:49 +0100)]
udp: Report authbind exit status as errno value if it seems appropriate

authbind-helper is documented as indicating an errno value in its exit
status.  When the exit status is small enough that it's unlikely to
have come from the runtime system, print it as an errno value instead
of using lg_exitstatus.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoslip: Report unexpected kinds of death from userv
Ian Jackson [Mon, 6 Oct 2014 23:39:04 +0000 (00:39 +0100)]
slip: Report unexpected kinds of death from userv

If st->expecting_userv_exit, we are expecting userv to exit 0 or die
with SIGTERM.  If anything else happens, we should at least log it.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agologging: Use lg_exitstatus
Ian Jackson [Wed, 24 Sep 2014 23:50:10 +0000 (00:50 +0100)]
logging: Use lg_exitstatus

Replace two open-coded exit status checks with calls to lg_exitstatus.

In the case of slip.c and udp.c this has no significant effect other
than a slight change to message format.

In the case of process.c, we no longer log the command's first
argument.  I consider this tolerable for simplifying the code.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agologging: Provide lg_exitstatus
Ian Jackson [Wed, 24 Sep 2014 23:47:47 +0000 (00:47 +0100)]
logging: Provide lg_exitstatus

This will allow us to remove a bunch of formulaic exit status
handling.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agocomm: Provide udp_socks_deregister
Ian Jackson [Wed, 24 Sep 2014 00:28:23 +0000 (01:28 +0100)]
comm: Provide udp_socks_deregister

polypath is going to want this.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agocomm: Make udp_make_socket be able to tolerate failures
Ian Jackson [Mon, 22 Sep 2014 01:07:47 +0000 (02:07 +0100)]
comm: Make udp_make_socket be able to tolerate failures

Previously, it would log errors with fatal or fatal_perror.  Now it
takes a message class and uses lg_perror, and also returns a boolean
to let the caller know whether it worked.

The repetitive calls to fatal_perror in udp_make_socket have been
replaced with a couple of macros.

The one existing call site passes M_FATAL.  So no substantial
functional change in this patch.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agocomm: Formalise interface to udp sockets
Ian Jackson [Sun, 21 Sep 2014 23:51:58 +0000 (00:51 +0100)]
comm: Formalise interface to udp sockets

Have the poll registration done by the udpcommon/udpsocks code, rather
than by udp.c.  This means we can abolish the two wrapper functions,
but we do need an extra pointer in a udpsocks to find the udpcommon.

No overall functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agocomm: Break out some common udp parts
Ian Jackson [Sun, 21 Sep 2014 15:11:16 +0000 (16:11 +0100)]
comm: Break out some common udp parts

Provide a section in comm-common.h which allows other comms to share
some of the work done in udp.c.  Specifically, we provide the new
concepts of `udpsocks' and `udpcommon'.

The port configuration parameter is lifted into the udp struct.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agocomm: Break out common code in comm
Ian Jackson [Sun, 21 Sep 2014 11:05:28 +0000 (12:05 +0100)]
comm: Break out common code in comm

We are going to want to introduce a new kind of comm.  Currently we
only have one comm, udp, in udp.c - much of whose code we will want to
reuse.

Break that generic comm-handling code out into new files, functions
and macros.

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agocomm: Use BUF_GET_BYTES
Ian Jackson [Thu, 2 Oct 2014 14:44:18 +0000 (15:44 +0100)]
comm: Use BUF_GET_BYTES

There are two calls in udp_afterpoll which could use BUF_GET_BYTES.
Convert them.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agocomm: Rename a lot of state pointer variables
Ian Jackson [Sun, 21 Sep 2014 22:45:01 +0000 (23:45 +0100)]
comm: Rename a lot of state pointer variables

We are going to split `struct udp' into a bunch of substructures with
their own types, to assist with reuse of the udp code in a new comm.
This is going to involve members at different levels of abstraction
being accessed through different pointer variable names.

So change the names now to aliases of the standard `struct udp *st'.
This will much reduce noise in subsequent patches.

Also rename udp.c's MAX_SOCKETS to UDP_MAX_SOCKETS.

No functional change in this patch.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agologging: Provide lg_perror and lg_vperror
Ian Jackson [Mon, 22 Sep 2014 01:00:50 +0000 (02:00 +0100)]
logging: Provide lg_perror and lg_vperror

These are convenience functions for logging module, config location,
errno value, etc., along with a full formatted message.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agopoll: Document reentrancy restriction on before()
Ian Jackson [Sun, 21 Sep 2014 14:02:40 +0000 (15:02 +0100)]
poll: Document reentrancy restriction on before()

If the before() callback might modify the wanted fds or timeouts of
other poll users, the loop over poll users in run() might produce
wrong answers.  Therefore, document that this is not permitted.  (All
of the existing before() implementations are indeed fine.)

Also, document a couple of features of the afterpoll_fn interface.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agopoll: Support deregistration from the main event loop
Ian Jackson [Sat, 20 Sep 2014 12:56:04 +0000 (13:56 +0100)]
poll: Support deregistration from the main event loop

The logic here is slightly subtle because of reentrancy hazards.  See
the comment in deregister_for_poll.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agopoll: Abolish max_nfds
Ian Jackson [Sat, 20 Sep 2014 17:16:09 +0000 (18:16 +0100)]
poll: Abolish max_nfds

We do not need to be advised of a static maximum, since we dynamically
size the array now.  Abolish the variable (which is unused) and change
all the callers.

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agopoll: Avoid duplicate array index counting
Ian Jackson [Fri, 3 Oct 2014 20:43:39 +0000 (21:43 +0100)]
poll: Avoid duplicate array index counting

Calculate remain from idx at the top of the loop.  This avoids having
to keep both remain and idx in step.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agopoll: Make handling of fds array actually dynamic
Ian Jackson [Sat, 20 Sep 2014 16:28:56 +0000 (17:28 +0100)]
poll: Make handling of fds array actually dynamic

Previously we relied on the max_fds argument to register_for_poll
being big enough and allocated an array at startup.  But we are going
to want to be more dynamic, so actually do the dynamic array resizing.

We now start with a zero-sized array and increase it as needed.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agorealloc: Provide safe_realloc_ary
Ian Jackson [Sat, 20 Sep 2014 13:10:28 +0000 (14:10 +0100)]
realloc: Provide safe_realloc_ary

Also, make it OK to call safe_malloc(0).

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agopoll: Introduce and use BEFOREPOLL_WANT_FDS
Ian Jackson [Sat, 20 Sep 2014 16:52:14 +0000 (17:52 +0100)]
poll: Introduce and use BEFOREPOLL_WANT_FDS

This helper macro provides a convenient implementation of the
beforepoll_fn interface for *nfds_io.  Use it everywhere.

This produces one bugfix: log_from_fd_beforepoll would fail to set
*nfds_io if it was finished,

This also arranges for many beforepoll callbacks to actually fail
properly with ERANGE if there is not enough space.  Previously they
would blithely write the next fd entry or two.  In practice the
provided fd array never runs out in the current code, so in these
cases we are just fixing latent bugs.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agomain loop: Use <bsd/sys/queue.h> for poll interest list
Ian Jackson [Sat, 20 Sep 2014 12:42:11 +0000 (13:42 +0100)]
main loop: Use <bsd/sys/queue.h> for poll interest list

This makes the code clearer, shorter and more typesafe.

It is also going to make it easier to introduce deregistration.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp: Use <bsd/sys/queue.h> for notify lists
Ian Jackson [Sat, 20 Sep 2014 12:24:11 +0000 (13:24 +0100)]
udp: Use <bsd/sys/queue.h> for notify lists

This makes the code clearer, shorter and more typesafe.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agohackypar: Fix coding style
Ian Jackson [Sat, 27 Sep 2014 10:28:07 +0000 (11:28 +0100)]
hackypar: Fix coding style

For some reason I didn't use the standard secnet coding style for this
file.  Fix this by reindenting, and moving functions' opening braces.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agosite: Support multiple addresses base.polypath.v4 proposed.ipv6.v4
Ian Jackson [Mon, 29 Sep 2014 14:02:19 +0000 (15:02 +0100)]
site: Support multiple addresses

The `address' parameter to a site closure can now contain multiple
`address' strings, which may be multiple domain names or multiple
address literals, or some combination.

We run all the resolutions in parallel, and keep a count of how many
we have outstanding, combining the results as they come in.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoProvide dict_read_string_array
Ian Jackson [Sat, 27 Sep 2014 13:26:49 +0000 (14:26 +0100)]
Provide dict_read_string_array

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoresolver: Provide input name as argument to callback
Ian Jackson [Mon, 29 Sep 2014 14:00:47 +0000 (15:00 +0100)]
resolver: Provide input name as argument to callback

This is going to be convenient for our one call site.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agotest-example: Switch to testing IPv6 too
Ian Jackson [Fri, 19 Sep 2014 22:15:38 +0000 (23:15 +0100)]
test-example: Switch to testing IPv6 too

Make the published address of `outside' be ::1, rather than 127.0.0.1.
This means we can test both IPv4 and IPv6.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoPython IP addresses: Remove sys.path hacking from test script
Ian Jackson [Sun, 14 Sep 2014 23:14:41 +0000 (00:14 +0100)]
Python IP addresses: Remove sys.path hacking from test script

Now that we no longer have ipaddr.py in our tree, we can get rid of
this messing about with sys.path.  We use the system's ipaddr.py and
our own ipaddrset.py.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoPython IP addresses: Check for and maybe delete stale ipaddr.py
Ian Jackson [Sun, 14 Sep 2014 23:47:13 +0000 (00:47 +0100)]
Python IP addresses: Check for and maybe delete stale ipaddr.py

If ipaddr.py (or .pyc) from a previous secnet installation still
exists in /usr/share/secnet or /usr/local/share/secnet, this version
won't work.  Check for this situation in `make install' and bomb out.
Provide a `make install-force' which deletes the spurious files.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoPython IP addresses: Use modern ipaddr.py - supports IPv6
Ian Jackson [Sun, 14 Sep 2014 23:28:56 +0000 (00:28 +0100)]
Python IP addresses: Use modern ipaddr.py - supports IPv6

Switch to using the modern ipaddr.py from Scott Kitterman, and our own
ipaddrset.py.

The upshot is that make-secnet-sites now supports IPv6.

Aside from adjusting the code in make-secnet-sites to conform to the
new API, we also delete the old Cendio ipaddr.py, and delete the code
to install it, and document the new dependency both in INSTALL and in
the Debian package metadata.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoPython IP addresses: Provide ipaddrset.py library
Ian Jackson [Sun, 14 Sep 2014 21:40:52 +0000 (22:40 +0100)]
Python IP addresses: Provide ipaddrset.py library

This library module provides a class for a set of IP addresses, stored
as a list of netmasks.  This is in terms of the modern `ipaddr' module
by Scott Kitterman.

In this commit we introduce the ipaddrset.py module and its test
module.  We also patch the Makefile to install it, and test in `make
check' that it produces the expected output.

However, due to the presence of the old Cendio ipaddr.py alongside,
the provided ipaddrset-test.py needs some hideous hacking of sys.path
if it is to work when run in the ordinary way inside the secnet source
tree.  This will be removed in a later patch.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoresolver: Support IPv6 literals
Ian Jackson [Fri, 19 Sep 2014 20:02:47 +0000 (21:02 +0100)]
resolver: Support IPv6 literals

With CONFIG_IPV6, use adns_addr2text instead of inet_ntoa.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoresolver: Log reason for DNS resolution failure
Ian Jackson [Thu, 18 Sep 2014 17:38:17 +0000 (18:38 +0100)]
resolver: Log reason for DNS resolution failure

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoresolver: Support IPv6 name resolution
Ian Jackson [Tue, 2 Sep 2014 08:19:37 +0000 (09:19 +0100)]
resolver: Support IPv6 name resolution

Tell adns (via ADNS_FEATURE_MANYAF) that we want mixed address
families in the results, and handle any IPv6 addresses we find.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp: Support IPv6 when using authbind
Ian Jackson [Fri, 19 Sep 2014 21:48:45 +0000 (22:48 +0100)]
udp: Support IPv6 when using authbind

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp: Support IPv6 (mostly)
Ian Jackson [Tue, 2 Sep 2014 08:05:30 +0000 (09:05 +0100)]
udp: Support IPv6 (mostly)

Specifically:

 * struct udp now contains an array of (up to three) pairs of iaddr,
   fd.  Code which deals with the fd and addr has been updated to use
   loops etc. as appropriate.

 * The sockets are created with the right protocol family value.
   For AF_INET6, we set IPV6_V6ONLY.

 * Specifically, when transmitting, we try all appropriate sockets and
   compute the persistent-failure indication as required.

 * And a comm_addr now contains an `int ix' for udp.c's benefit,
   particularly when logging.

 * We use string_item_to_iaddr to convert the string to a socket
   address, rather than string_item_to_ipaddr.  The latter can cope
   only with IPv4 (and is now used only for private vpn addrs,
   proxies, etc.).

 * The default is now to create both IPv6 and IPv4 sockets.

Left undone are:

 * The special secnet proxy protocol has a 4-byte address prepended
   which implies IPv4.  I don't intend to fix this.

 * The authbind support for IPv6 will be in a future patch.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp.c: Remove some (ab)use of variable name `i'
Ian Jackson [Tue, 2 Sep 2014 07:59:44 +0000 (08:59 +0100)]
udp.c: Remove some (ab)use of variable name `i'

I find it very odd to find `item_t *i' etc.  I would like to be able
to use `int i'.  So change some uses of `i' to `item'.  (`j' in this
function will go away in the next patch so isn't worth renaming.)

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoProvide string_item_to_iaddr
Ian Jackson [Tue, 2 Sep 2014 08:04:27 +0000 (09:04 +0100)]
Provide string_item_to_iaddr

This will be used shortly.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoProvide ARRAY_SIZE
Ian Jackson [Tue, 2 Sep 2014 07:58:24 +0000 (08:58 +0100)]
Provide ARRAY_SIZE

No call sites yet.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoMake list_length and string_item_to_ipaddr const-correct.
Ian Jackson [Tue, 2 Sep 2014 07:56:50 +0000 (08:56 +0100)]
Make list_length and string_item_to_ipaddr const-correct.

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoudp: Break out udp_make_socket
Ian Jackson [Tue, 2 Sep 2014 06:41:37 +0000 (07:41 +0100)]
udp: Break out udp_make_socket

Make this into a function by itself and adjust its arguments so that
when we support multiple sockets (for multiple addresses so that we
can have multiple AFs) we can just call it for each one.

No functional change.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoipv6: Support printing, comparing, etc. IPv6 addresses
Ian Jackson [Sun, 29 Jun 2014 22:10:31 +0000 (23:10 +0100)]
ipv6: Support printing, comparing, etc. IPv6 addresses

If we support IPv6, convert addresses with adns_addr2text.  Otherwise
stick with inet_ntoa.

With these changes, there is nothing remaining that will actually
crash secnet if it is passed an IPv6 address.  However, it is not yet
possible to mention IPv6 addresses in the configuration, and the udp
transport needs dual stack support.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
3 years agoipv6: check for support in system and in adns
Ian Jackson [Sun, 29 Jun 2014 22:58:03 +0000 (23:58 +0100)]
ipv6: check for support in system and in adns

We #define CONFIG_IPV6 if the system has AF_INET6 and adns has
adns_addr2text (which only the IPv6-capable adns has).

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>