3 * Make programs use Unix-domain sockets instead of IP
5 * (c) 2008 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of the preload-hacks package.
12 * Preload-hacks are free software; you can redistribute it and/or modify
13 * them under the terms of the GNU General Public License as published by
14 * the Free Software Foundation; either version 2 of the License, or (at
15 * your option) any later version.
17 * Preload-hacks are distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
22 * You should have received a copy of the GNU General Public License along
23 * with preload-hacks; if not, write to the Free Software Foundation, Inc.,
24 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
32 /*----- Header files ------------------------------------------------------*/
48 #include <sys/ioctl.h>
49 #include <sys/socket.h>
53 #include <netinet/in.h>
54 #include <arpa/inet.h>
55 #include <netinet/tcp.h>
56 #include <netinet/udp.h>
60 /*----- Data structures ---------------------------------------------------*/
62 /* Unix socket status values. */
63 #define UNUSED 0u /* No sign of anyone using it */
64 #define STALE 1u /* Socket exists, but is abandoned */
65 #define USED 16u /* Socket is in active use */
67 enum { DENY, ALLOW }; /* ACL verdicts */
69 static int address_families[] = { AF_INET, AF_INET6, -1 };
73 /* Address representations. */
74 typedef union ipaddr {
79 /* Convenient socket address hacking. */
80 typedef union address {
82 struct sockaddr_in sin;
83 struct sockaddr_in6 sin6;
86 /* Access control list nodes */
87 typedef struct aclnode {
91 ipaddr minaddr, maxaddr;
92 unsigned short minport, maxport;
95 /* Implicit bind records */
96 typedef struct impbind {
99 ipaddr minaddr, maxaddr, bindaddr;
101 enum { EXPLICIT, SAME };
103 /* A type for an address range */
104 typedef struct addrrange {
107 struct { int af; ipaddr min, max; } range;
110 enum { EMPTY, ANY, LOCAL, RANGE };
112 /* Local address records */
113 typedef struct full_ipaddr {
117 #define MAX_LOCAL_IPADDRS 64
118 static full_ipaddr local_ipaddrs[MAX_LOCAL_IPADDRS];
119 static int n_local_ipaddrs;
121 /* General configuration */
123 static char *sockdir = 0;
124 static int debug = 0;
125 static unsigned minautoport = 16384, maxautoport = 65536;
127 /* Access control lists */
128 static aclnode *bind_real, **bind_tail = &bind_real;
129 static aclnode *connect_real, **connect_tail = &connect_real;
130 static impbind *impbinds, **impbind_tail = &impbinds;
132 /*----- Import the real versions of functions -----------------------------*/
134 /* The list of functions to immport. */
136 _(socket, int, (int, int, int)) \
137 _(socketpair, int, (int, int, int, int *)) \
138 _(connect, int, (int, const struct sockaddr *, socklen_t)) \
139 _(bind, int, (int, const struct sockaddr *, socklen_t)) \
140 _(accept, int, (int, struct sockaddr *, socklen_t *)) \
141 _(getsockname, int, (int, struct sockaddr *, socklen_t *)) \
142 _(getpeername, int, (int, struct sockaddr *, socklen_t *)) \
143 _(getsockopt, int, (int, int, int, void *, socklen_t *)) \
144 _(setsockopt, int, (int, int, int, const void *, socklen_t)) \
145 _(sendto, ssize_t, (int, const void *buf, size_t, int, \
146 const struct sockaddr *to, socklen_t tolen)) \
147 _(recvfrom, ssize_t, (int, void *buf, size_t, int, \
148 struct sockaddr *from, socklen_t *fromlen)) \
149 _(sendmsg, ssize_t, (int, const struct msghdr *, int)) \
150 _(recvmsg, ssize_t, (int, struct msghdr *, int)) \
151 _(ioctl, int, (int, unsigned long, ...))
153 /* Function pointers to set up. */
154 #define DECL(imp, ret, args) static ret (*real_##imp) args;
158 /* Import the system calls. */
159 static void import(void)
161 #define IMPORT(imp, ret, args) \
162 real_##imp = (ret (*)args)dlsym(RTLD_NEXT, #imp);
167 /*----- Utilities ---------------------------------------------------------*/
169 /* Socket address casts */
170 #define SA(sa) ((struct sockaddr *)(sa))
171 #define SIN(sa) ((struct sockaddr_in *)(sa))
172 #define SIN6(sa) ((struct sockaddr_in6 *)(sa))
173 #define SUN(sa) ((struct sockaddr_un *)(sa))
176 #define UC(ch) ((unsigned char)(ch))
178 /* Memory allocation */
179 #define NEW(x) ((x) = xmalloc(sizeof(*x)))
180 #define NEWV(x, n) ((x) = xmalloc(sizeof(*x) * (n)))
184 # define D(body) { if (debug) { body } }
185 # define Dpid pid_t pid = debug ? getpid() : -1
191 /* Preservation of error status */
192 #define PRESERVING_ERRNO(body) do { \
193 int _err = errno; { body } errno = _err; \
196 /* Allocate N bytes of memory; abort on failure. */
197 static void *xmalloc(size_t n)
201 if ((p = malloc(n)) == 0) { perror("malloc"); exit(127); }
205 /* Allocate a copy of the null-terminated string P; abort on failure. */
206 static char *xstrdup(const char *p)
208 size_t n = strlen(p) + 1;
209 char *q = xmalloc(n);
214 /*----- Address-type hacking ----------------------------------------------*/
216 /* If M is a simple mask, i.e., consists of a sequence of zero bits followed
217 * by a sequence of one bits, then return the length of the latter sequence
218 * (which may be zero); otherwise return -1.
220 static int simple_mask_length(unsigned long m)
224 while (m & 1) { n++; m >>= 1; }
228 /* Answer whether AF is an interesting address family. */
229 static int family_known_p(int af)
240 /* Return the socket address length for address family AF. */
241 static socklen_t family_socklen(int af)
244 case AF_INET: return (sizeof(struct sockaddr_in));
245 case AF_INET6: return (sizeof(struct sockaddr_in6));
250 /* Return the width of addresses of kind AF. */
251 static int address_width(int af)
254 case AF_INET: return 32;
255 case AF_INET6: return 128;
260 /* If addresses A and B share a common prefix then return its length;
261 * otherwise return -1.
263 static int common_prefix_length(int af, const ipaddr *a, const ipaddr *b)
267 unsigned long aa = ntohl(a->v4.s_addr), bb = ntohl(b->v4.s_addr);
268 unsigned long m = aa^bb;
269 if ((aa&m) == 0 && (bb&m) == m) return (32 - simple_mask_length(m));
273 const uint8_t *aa = a->v6.s6_addr, *bb = b->v6.s6_addr;
278 for (i = 0; i < 16 && aa[i] == bb[i]; i++);
282 if ((aa[i]&m) != 0 || (bb[i]&m) != m) return (-1);
283 n += 8 - simple_mask_length(m);
284 for (i++; i < 16; i++)
285 if (aa[i] || bb[i] != 0xff) return (-1);
294 /* Extract the port number (in host byte-order) from SA. */
295 static int port_from_sockaddr(const struct sockaddr *sa)
297 switch (sa->sa_family) {
298 case AF_INET: return (ntohs(SIN(sa)->sin_port));
299 case AF_INET6: return (ntohs(SIN6(sa)->sin6_port));
304 /* Store the port number PORT (in host byte-order) in SA. */
305 static void port_to_sockaddr(struct sockaddr *sa, int port)
307 switch (sa->sa_family) {
308 case AF_INET: SIN(sa)->sin_port = htons(port); break;
309 case AF_INET6: SIN6(sa)->sin6_port = htons(port); break;
314 /* Extract the address part from SA and store it in A. */
315 static void ipaddr_from_sockaddr(ipaddr *a, const struct sockaddr *sa)
317 switch (sa->sa_family) {
318 case AF_INET: a->v4 = SIN(sa)->sin_addr; break;
319 case AF_INET6: a->v6 = SIN6(sa)->sin6_addr; break;
324 /* Store the address A in SA. */
325 static void ipaddr_to_sockaddr(struct sockaddr *sa, const ipaddr *a)
327 switch (sa->sa_family) {
329 SIN(sa)->sin_addr = a->v4;
332 SIN6(sa)->sin6_addr = a->v6;
333 SIN6(sa)->sin6_scope_id = 0;
334 SIN6(sa)->sin6_flowinfo = 0;
341 /* Copy a whole socket address about. */
342 static void copy_sockaddr(struct sockaddr *sa_dst,
343 const struct sockaddr *sa_src)
344 { memcpy(sa_dst, sa_src, family_socklen(sa_src->sa_family)); }
346 /* Convert an AF_INET socket address into the equivalent IPv4-mapped AF_INET6
349 static void map_ipv4_sockaddr(struct sockaddr_in6 *a6,
350 const struct sockaddr_in *a4)
353 in_addr_t a = ntohl(a4->sin_addr.s_addr);
355 a6->sin6_family = AF_INET6;
356 a6->sin6_port = a4->sin_port;
357 a6->sin6_scope_id = 0;
358 a6->sin6_flowinfo = 0;
359 for (i = 0; i < 10; i++) a6->sin6_addr.s6_addr[i] = 0;
360 for (i = 10; i < 12; i++) a6->sin6_addr.s6_addr[i] = 0xff;
361 for (i = 0; i < 4; i++) a6->sin6_addr.s6_addr[15 - i] = (a >> 8*i)&0xff;
364 /* Convert an AF_INET6 socket address containing an IPv4-mapped IPv6 address
365 * into the equivalent AF_INET4 address. Return zero on success, or -1 if
366 * the address has the wrong form.
368 static int unmap_ipv4_sockaddr(struct sockaddr_in *a4,
369 const struct sockaddr_in6 *a6)
374 for (i = 0; i < 10; i++) if (a6->sin6_addr.s6_addr[i] != 0) return (-1);
375 for (i = 10; i < 12; i++) if (a6->sin6_addr.s6_addr[i] != 0xff) return (-1);
376 for (i = 0, a = 0; i < 4; i++) a |= a6->sin6_addr.s6_addr[15 - i] << 8*i;
377 a4->sin_family = AF_INET;
378 a4->sin_port = a6->sin6_port;
379 a4->sin_addr.s_addr = htonl(a);
383 /* Answer whether two addresses are equal. */
384 static int ipaddr_equal_p(int af, const ipaddr *a, const ipaddr *b)
387 case AF_INET: return (a->v4.s_addr == b->v4.s_addr);
388 case AF_INET6: return (memcmp(a->v6.s6_addr, b->v6.s6_addr, 16) == 0);
393 /* Answer whether the address part of SA is between A and B (inclusive). We
394 * assume that SA has the correct address family.
396 static int sockaddr_in_range_p(const struct sockaddr *sa,
397 const ipaddr *a, const ipaddr *b)
399 switch (sa->sa_family) {
401 unsigned long addr = ntohl(SIN(sa)->sin_addr.s_addr);
402 return (ntohl(a->v4.s_addr) <= addr &&
403 addr <= ntohl(b->v4.s_addr));
406 const uint8_t *ss = SIN6(sa)->sin6_addr.s6_addr;
407 const uint8_t *aa = a->v6.s6_addr, *bb = b->v6.s6_addr;
411 for (i = 0; h && l && i < 16; i++, ss++, aa++, bb++) {
412 if (*ss < *aa || *bb < *ss) return (0);
413 if (*aa < *ss) l = 0;
414 if (*ss < *bb) h = 0;
423 /* Fill in SA with the appropriate wildcard address. */
424 static void wildcard_address(int af, struct sockaddr *sa)
428 struct sockaddr_in *sin = SIN(sa);
429 memset(sin, 0, sizeof(*sin));
430 sin->sin_family = AF_INET;
432 sin->sin_addr.s_addr = INADDR_ANY;
435 struct sockaddr_in6 *sin6 = SIN6(sa);
436 memset(sin6, 0, sizeof(*sin6));
437 sin6->sin6_family = AF_INET6;
439 sin6->sin6_addr = in6addr_any;
440 sin6->sin6_scope_id = 0;
441 sin6->sin6_flowinfo = 0;
448 /* Mask the address A, forcing all but the top PLEN bits to zero or one
449 * according to HIGHP.
451 static void mask_address(int af, ipaddr *a, int plen, int highp)
455 unsigned long addr = ntohl(a->v4.s_addr);
456 unsigned long mask = plen ? ~0ul << (32 - plen) : 0;
458 if (highp) addr |= ~mask;
459 a->v4.s_addr = htonl(addr & 0xffffffff);
463 unsigned m = (0xff << (8 - plen%8)) & 0xff;
464 unsigned s = highp ? 0xff : 0;
466 a->v6.s6_addr[i] = (a->v6.s6_addr[i] & m) | (s & ~m);
469 for (; i < 16; i++) a->v6.s6_addr[i] = s;
476 /* Write a presentation form of SA to BUF, a buffer of length SZ. LEN is the
477 * address length; if it's zero, look it up based on the address family.
478 * Return a pointer to the string (which might, in an emergency, be a static
479 * string rather than your buffer).
481 static char *present_sockaddr(const struct sockaddr *sa, socklen_t len,
482 char *buf, size_t sz)
484 #define WANT(n_) do { if (sz < (n_)) goto nospace; } while (0)
485 #define PUTC(c_) do { *buf++ = (c_); sz--; } while (0)
487 if (!sa) return "<null-address>";
488 if (!sz) return "<no-space-in-buffer>";
489 if (!len) len = family_socklen(sa->sa_family);
491 switch (sa->sa_family) {
493 struct sockaddr_un *sun = SUN(sa);
494 char *p = sun->sun_path;
495 size_t n = len - offsetof(struct sockaddr_un, sun_path);
503 case 0: WANT(2); PUTC('\\'); PUTC('0'); break;
504 case '\a': WANT(2); PUTC('\\'); PUTC('a'); break;
505 case '\n': WANT(2); PUTC('\\'); PUTC('n'); break;
506 case '\r': WANT(2); PUTC('\\'); PUTC('r'); break;
507 case '\t': WANT(2); PUTC('\\'); PUTC('t'); break;
508 case '\v': WANT(2); PUTC('\\'); PUTC('v'); break;
509 case '\\': WANT(2); PUTC('\\'); PUTC('\\'); break;
511 if (*p > ' ' && *p <= '~')
512 { WANT(1); PUTC(*p); }
514 WANT(4); PUTC('\\'); PUTC('x');
515 PUTC((*p >> 4)&0xf); PUTC((*p >> 0)&0xf);
522 if (*p != '/') { WANT(2); PUTC('.'); PUTC('/'); }
523 while (n && *p) { WANT(1); PUTC(*p); p++; n--; }
527 case AF_INET: case AF_INET6: {
528 char addrbuf[NI_MAXHOST], portbuf[NI_MAXSERV];
529 int err = getnameinfo(sa, len,
530 addrbuf, sizeof(addrbuf),
531 portbuf, sizeof(portbuf),
532 NI_NUMERICHOST | NI_NUMERICSERV);
534 snprintf(buf, sz, strchr(addrbuf, ':') ? "[%s]:%s" : "%s:%s",
538 snprintf(buf, sz, "<unknown-address-family %d>", sa->sa_family);
548 /* Guess the family of a textual socket address. */
549 static int guess_address_family(const char *p)
550 { return (strchr(p, ':') ? AF_INET6 : AF_INET); }
552 /* Parse a socket address P and write the result to SA. */
553 static int parse_sockaddr(struct sockaddr *sa, const char *p)
557 struct addrinfo *ai, ai_hint = { 0 };
559 if (strlen(p) >= sizeof(buf) - 1) return (-1);
560 strcpy(buf, p); p = buf;
562 if ((q = strchr(p, ':')) == 0) return (-1);
566 if ((q = strchr(p, ']')) == 0) return (-1);
568 if (*q != ':') return (-1);
572 ai_hint.ai_family = AF_UNSPEC;
573 ai_hint.ai_socktype = SOCK_DGRAM;
574 ai_hint.ai_flags = AI_NUMERICHOST | AI_NUMERICSERV;
575 if (getaddrinfo(p, q, &ai_hint, &ai)) return (-1);
576 memcpy(sa, ai->ai_addr, ai->ai_addrlen);
581 /*----- Access control lists ----------------------------------------------*/
585 static void dump_addrrange(int af, const ipaddr *min, const ipaddr *max)
591 plen = common_prefix_length(af, min, max);
592 p = inet_ntop(af, min, buf, sizeof(buf));
593 fprintf(stderr, strchr(p, ':') ? "[%s]" : "%s", p);
595 p = inet_ntop(af, &max, buf, sizeof(buf));
596 fprintf(stderr, strchr(p, ':') ? "-[%s]" : "-%s", p);
597 } else if (plen < address_width(af))
598 fprintf(stderr, "/%d", plen);
601 /* Write to standard error a description of the ACL node A. */
602 static void dump_aclnode(const aclnode *a)
604 fprintf(stderr, "noip(%d): %c ", getpid(), a->act ? '+' : '-');
605 dump_addrrange(a->af, &a->minaddr, &a->maxaddr);
606 if (a->minport != 0 || a->maxport != 0xffff) {
607 fprintf(stderr, ":%u", (unsigned)a->minport);
608 if (a->minport != a->maxport)
609 fprintf(stderr, "-%u", (unsigned)a->maxport);
614 static void dump_acl(const aclnode *a)
618 for (; a; a = a->next) {
622 fprintf(stderr, "noip(%d): [default policy: %s]\n", getpid(),
623 act == ALLOW ? "DENY" : "ALLOW");
628 /* Returns nonzero if the ACL A allows the socket address SA. */
629 static int acl_allows_p(const aclnode *a, const struct sockaddr *sa)
631 unsigned short port = port_from_sockaddr(sa);
635 D({ char buf[ADDRBUFSZ];
636 fprintf(stderr, "noip(%d): check %s\n", pid,
637 present_sockaddr(sa, 0, buf, sizeof(buf))); })
638 for (; a; a = a->next) {
639 D( dump_aclnode(a); )
640 if (a->af == sa->sa_family &&
641 sockaddr_in_range_p(sa, &a->minaddr, &a->maxaddr) &&
642 a->minport <= port && port <= a->maxport) {
643 D( fprintf(stderr, "noip(%d): aha! %s\n", pid,
644 a->act ? "ALLOW" : "DENY"); )
649 D( fprintf(stderr, "noip(%d): nothing found: %s\n", pid,
650 act ? "DENY" : "ALLOW"); )
654 /*----- Socket address conversion -----------------------------------------*/
656 /* Return a uniformly distributed integer between MIN and MAX inclusive. */
657 static unsigned randrange(unsigned min, unsigned max)
661 /* It's so nice not to have to care about the quality of the generator
665 for (mask = 1; mask < max; mask = (mask << 1) | 1)
667 do i = rand() & mask; while (i > max);
671 /* Return the status of Unix-domain socket address SUN. Returns: UNUSED if
672 * the socket doesn't exist; USED if the path refers to an active socket, or
673 * isn't really a socket at all, or we can't tell without a careful search
674 * and QUICKP is set; or STALE if the file refers to a socket which isn't
675 * being used any more.
677 static int unix_socket_status(struct sockaddr_un *sun, int quickp)
685 /* If we can't find the socket node, then it's definitely not in use. If
686 * we get some other error, then this socket is weird.
688 if (stat(sun->sun_path, &st))
689 return (errno == ENOENT ? UNUSED : USED);
691 /* If it's not a socket, then something weird is going on. If we're just
692 * probing quickly to find a spare port, then existence is sufficient to
695 if (!S_ISSOCK(st.st_mode) || quickp)
698 /* The socket's definitely there, but is anyone actually still holding it
699 * open? The only way I know to discover this is to trundle through
700 * `/proc/net/unix'. If there's no entry, then the socket must be stale.
703 if ((fp = fopen("/proc/net/unix", "r")) == 0)
705 if (!fgets(buf, sizeof(buf), fp)) goto done; /* skip header */
706 len = strlen(sun->sun_path);
707 while (fgets(buf, sizeof(buf), fp)) {
709 if (n >= len + 2 && buf[n - len - 2] == ' ' && buf[n - 1] == '\n' &&
710 memcmp(buf + n - len - 1, sun->sun_path, len) == 0)
723 /* Encode SA as a Unix-domain address SUN, and return whether it's currently
726 static int encode_single_inet_addr(const struct sockaddr *sa,
727 struct sockaddr_un *sun,
733 snprintf(sun->sun_path, sizeof(sun->sun_path), "%s/%s", sockdir,
734 present_sockaddr(sa, 0, buf, sizeof(buf)));
735 if ((rc = unix_socket_status(sun, quickp)) == USED) return (USED);
736 else if (rc == STALE) unlink(sun->sun_path);
740 /* Convert the IP address SA to a Unix-domain address SUN. Fail if the
741 * address seems already taken. If DESPARATEP then try cleaning up stale old
744 static int encode_unused_inet_addr(struct sockaddr *sa,
745 struct sockaddr_un *sun,
748 address waddr, maddr;
749 struct sockaddr_un wsun;
750 int port = port_from_sockaddr(sa);
752 /* First, look for an exact match. Only look quickly unless we're
753 * desperate. If the socket is in use, we fail here. (This could get
754 * racy. Let's not worry about that for now.)
756 if (encode_single_inet_addr(sa, sun, !desperatep)&USED)
759 /* Next, check the corresponding wildcard address, so as to avoid
760 * inadvertant collisions with listeners. Do this in the same way.
762 wildcard_address(sa->sa_family, &waddr.sa);
763 port_to_sockaddr(&waddr.sa, port);
764 if (encode_single_inet_addr(&waddr.sa, &wsun, !desperatep)&USED)
767 /* We're not done yet. If this is an IPv4 address, then /also/ check (a)
768 * the v6-mapped version, (b) the v6-mapped v4 wildcard, /and/ (c) the v6
771 if (sa->sa_family == AF_INET) {
772 map_ipv4_sockaddr(&maddr.sin6, SIN(&sa));
773 if (encode_single_inet_addr(&maddr.sa, &wsun, !desperatep)&USED)
776 map_ipv4_sockaddr(&maddr.sin6, &waddr.sin);
777 if (encode_single_inet_addr(&maddr.sa, &wsun, !desperatep)&USED)
780 wildcard_address(AF_INET6, &waddr.sa);
781 port_to_sockaddr(&waddr.sa, port);
782 if (encode_single_inet_addr(&waddr.sa, &wsun, !desperatep)&USED)
790 /* Encode the Internet address SA as a Unix-domain address SUN. If the flag
791 * `ENCF_FRESH' is set, and SA's port number is zero, then we pick an
792 * arbitrary local port. Otherwise we pick the port given. There's an
793 * unpleasant hack to find servers bound to local wildcard addresses.
794 * Returns zero on success; -1 on failure.
796 #define ENCF_FRESH 1u
797 static int encode_inet_addr(struct sockaddr_un *sun,
798 const struct sockaddr *sa,
804 struct sockaddr_in6 sin6;
805 int port = port_from_sockaddr(sa);
809 D( fprintf(stderr, "noip(%d): encode %s (%s)", getpid(),
810 present_sockaddr(sa, 0, buf, sizeof(buf)),
811 (f&ENCF_FRESH) ? "FRESH" : "EXISTING"); )
813 /* Start making the Unix-domain address. */
814 sun->sun_family = AF_UNIX;
816 if (port || !(f&ENCF_FRESH)) {
818 /* Try the address as given. If it's in use, or we don't necessarily
819 * want an existing socket, then we're done.
821 rc = encode_single_inet_addr(sa, sun, 0);
822 if ((rc&USED) || (f&ENCF_FRESH)) goto found;
824 /* We're looking for a socket which already exists. This is
825 * unfortunately difficult, because we must deal both with wildcards and
826 * v6-mapped IPv4 addresses.
828 * * We've just tried searching for a socket whose name is an exact
829 * match for our remote address. If the remote address is IPv4, then
830 * we should try again with the v6-mapped equivalent.
832 * * Failing that, we try again with the wildcard address for the
833 * appropriate address family.
835 * * Failing /that/, if the remote address is IPv4, then we try
836 * /again/, increasingly desperately, first with the v6-mapped IPv4
837 * wildcard address, and then with the IPv6 wildcard address. This
838 * will cause magic v6-mapping to occur when the connection is
839 * accepted, which we hope won't cause too much trouble.
842 if (sa->sa_family == AF_INET) {
843 map_ipv4_sockaddr(&addr.sin6, SIN(sa));
844 if (encode_single_inet_addr(&addr.sa, sun, 0)&USED) goto found;
847 wildcard_address(sa->sa_family, &addr.sa);
848 port_to_sockaddr(&addr.sa, port);
849 if (encode_single_inet_addr(&addr.sa, sun, 0)&USED) goto found;
851 if (sa->sa_family == AF_INET) {
852 map_ipv4_sockaddr(&sin6, &addr.sin);
853 if (encode_single_inet_addr(SA(&sin6), sun, 0)&USED) goto found;
854 wildcard_address(AF_INET6, &addr.sa);
855 port_to_sockaddr(&addr.sa, port);
856 if (encode_single_inet_addr(&addr.sa, sun, 0)&USED) goto found;
859 /* Well, this isn't going to work (unless a miraculous race is lost), but
860 * we might as well try.
862 encode_single_inet_addr(sa, sun, 1);
865 /* We want a fresh new socket. */
867 /* Make a copy of the given address, because we're going to mangle it. */
868 copy_sockaddr(&addr.sa, sa);
870 /* Try a few random-ish port numbers to see if any of them is spare. */
871 for (i = 0; i < 10; i++) {
872 port_to_sockaddr(&addr.sa, randrange(minautoport, maxautoport));
873 if (!encode_unused_inet_addr(&addr.sa, sun, 0)) goto found;
876 /* Things must be getting tight. Work through all of the autoport range
877 * to see if we can find a spare one. The first time, just do it the
878 * quick way; if that doesn't work, then check harder for stale sockets.
880 for (desperatep = 0; desperatep < 2; desperatep++) {
881 for (i = minautoport; i <= maxautoport; i++) {
882 port_to_sockaddr(&addr.sa, i);
883 if (!encode_unused_inet_addr(&addr.sa, sun, 0)) goto found;
887 /* We failed to find any free ports. */
889 D( fprintf(stderr, " -- can't resolve\n"); )
895 D( fprintf(stderr, " -> `%s'\n", sun->sun_path); )
899 /* Decode the Unix address SUN to an Internet address SIN. If AF_HINT is
900 * nonzero, an empty address (indicative of an unbound Unix-domain socket) is
901 * translated to a wildcard Internet address of the appropriate family.
902 * Returns zero on success; -1 on failure (e.g., it wasn't one of our
905 static int decode_inet_addr(struct sockaddr *sa, int af_hint,
906 const struct sockaddr_un *sun,
910 size_t n = strlen(sockdir), nn;
913 if (!sa) sa = &addr.sa;
914 if (sun->sun_family != AF_UNIX) return (-1);
915 if (len > sizeof(*sun)) return (-1);
916 ((char *)sun)[len] = 0;
917 nn = strlen(sun->sun_path);
918 D( fprintf(stderr, "noip(%d): decode `%s'", getpid(), sun->sun_path); )
919 if (af_hint && !sun->sun_path[0]) {
920 wildcard_address(af_hint, sa);
921 D( fprintf(stderr, " -- unbound socket\n"); )
924 if (nn < n + 1 || nn - n >= sizeof(buf) || sun->sun_path[n] != '/' ||
925 memcmp(sun->sun_path, sockdir, n) != 0) {
926 D( fprintf(stderr, " -- not one of ours\n"); )
929 if (parse_sockaddr(sa, sun->sun_path + n + 1)) return (-1);
930 D( fprintf(stderr, " -> %s\n",
931 present_sockaddr(sa, 0, buf, sizeof(buf))); )
935 /* SK is (or at least might be) a Unix-domain socket we created when an
936 * Internet socket was asked for. We've decided it should be an Internet
937 * socket after all, with family AF_HINT, so convert it. If TMP is not null,
938 * then don't replace the existing descriptor: store the new socket in *TMP
941 static int fixup_real_ip_socket(int sk, int af_hint, int *tmp)
946 struct sockaddr_un sun;
959 _(LINGER, struct linger) \
962 _(RCVTIMEO, struct timeval) \
963 _(SNDTIMEO, struct timeval)
966 if (real_getsockname(sk, SA(&sun), &len))
968 if (decode_inet_addr(&addr.sa, af_hint, &sun, len))
969 return (0); /* Not one of ours */
971 if (real_getsockopt(sk, SOL_SOCKET, SO_TYPE, &type, &len) < 0 ||
972 (nsk = real_socket(addr.sa.sa_family, type, 0)) < 0)
974 #define FIX(opt, ty) do { \
977 if (real_getsockopt(sk, SOL_SOCKET, SO_##opt, &ov_, &len) < 0 || \
978 real_setsockopt(nsk, SOL_SOCKET, SO_##opt, &ov_, len)) { \
988 if ((f = fcntl(sk, F_GETFL)) < 0 ||
989 (fd = fcntl(sk, F_GETFD)) < 0 ||
990 fcntl(nsk, F_SETFL, f) < 0 ||
995 unlink(sun.sun_path);
997 if (fcntl(sk, F_SETFD, fd) < 0) {
998 perror("noip: fixup_real_ip_socket F_SETFD");
1005 /* We found the real address SA, with length LEN; if it's a Unix-domain
1006 * address corresponding to a fake socket, convert it to cover up the
1007 * deception. Whatever happens, put the result at FAKE and store its length
1010 #define FNF_V6MAPPED 1u
1011 static void return_fake_name(struct sockaddr *sa, socklen_t len,
1012 struct sockaddr *fake, socklen_t *fakelen,
1016 struct sockaddr_in6 sin6;
1019 if (sa->sa_family == AF_UNIX &&
1020 !decode_inet_addr(&addr.sa, 0, SUN(sa), len)) {
1021 if (addr.sa.sa_family != AF_INET || !(f&FNF_V6MAPPED)) {
1023 len = family_socklen(addr.sa.sa_family);
1025 map_ipv4_sockaddr(&sin6, &addr.sin);
1027 len = family_socklen(AF_INET6);
1031 if (len > *fakelen) len = *fakelen;
1032 if (len > 0) memcpy(fake, sa, len);
1036 /* Variant of `return_fake_name' above, specifically handling the weirdness
1037 * of remote v6-mapped IPv4 addresses. If SK's fake local address is IPv6,
1038 * and the remote address is IPv4, then return a v6-mapped version of the
1041 static void return_fake_peer(int sk, struct sockaddr *sa, socklen_t len,
1042 struct sockaddr *fake, socklen_t *fakelen)
1045 socklen_t mylen = sizeof(sabuf);
1051 rc = real_getsockname(sk, SA(sabuf), &mylen);
1052 if (!rc && sa->sa_family == AF_UNIX &&
1053 !decode_inet_addr(&addr.sa, 0, SUN(sabuf), mylen) &&
1054 addr.sa.sa_family == AF_INET6)
1055 fnf |= FNF_V6MAPPED;
1057 return_fake_name(sa, len, fake, fakelen, fnf);
1060 /*----- Implicit binding --------------------------------------------------*/
1064 static void dump_impbind(const impbind *i)
1066 char buf[ADDRBUFSZ];
1068 fprintf(stderr, "noip(%d): ", getpid());
1069 dump_addrrange(i->af, &i->minaddr, &i->maxaddr);
1071 case SAME: fprintf(stderr, " <self>"); break;
1073 fprintf(stderr, " %s", inet_ntop(i->af, &i->bindaddr,
1078 fputc('\n', stderr);
1081 static void dump_impbind_list(void)
1085 for (i = impbinds; i; i = i->next) dump_impbind(i);
1090 /* The socket SK is about to be used to communicate with the remote address
1091 * SA. Assign it a local address so that getpeername(2) does something
1094 * If the flag `IBF_V6MAPPED' is set then, then SA must be an `AF_INET'
1095 * address; after deciding on the appropriate local address, convert it to be
1096 * an IPv4-mapped IPv6 address before final conversion to a Unix-domain
1097 * socket address and actually binding. Note that this could well mean that
1098 * the socket ends up bound to the v6-mapped v4 wildcard address
1099 * ::ffff:0.0.0.0, which looks very strange but is meaningful.
1101 #define IBF_V6MAPPED 1u
1102 static int do_implicit_bind(int sk, const struct sockaddr *sa, unsigned f)
1105 struct sockaddr_in6 sin6;
1106 struct sockaddr_un sun;
1110 D( fprintf(stderr, "noip(%d): checking impbind list...\n", pid); )
1111 for (i = impbinds; i; i = i->next) {
1112 D( dump_impbind(i); )
1113 if (sa->sa_family == i->af &&
1114 sockaddr_in_range_p(sa, &i->minaddr, &i->maxaddr)) {
1115 D( fprintf(stderr, "noip(%d): match!\n", pid); )
1116 addr.sa.sa_family = sa->sa_family;
1117 ipaddr_to_sockaddr(&addr.sa, &i->bindaddr);
1121 D( fprintf(stderr, "noip(%d): no match; using wildcard\n", pid); )
1122 wildcard_address(sa->sa_family, &addr.sa);
1124 if (addr.sa.sa_family != AF_INET || !(f&IBF_V6MAPPED)) sa = &addr.sa;
1125 else { map_ipv4_sockaddr(&sin6, &addr.sin); sa = SA(&sin6); }
1126 encode_inet_addr(&sun, sa, ENCF_FRESH);
1127 D( fprintf(stderr, "noip(%d): implicitly binding to %s\n",
1128 pid, sun.sun_path); )
1129 if (real_bind(sk, SA(&sun), SUN_LEN(&sun))) return (-1);
1133 /* The socket SK is about to communicate with the remote address *SA. Ensure
1134 * that the socket has a local address, and adjust *SA to refer to the real
1137 * If we need to translate the remote address, then the Unix-domain endpoint
1138 * address will end in *SUN, and *SA will be adjusted to point to it.
1140 static int fixup_client_socket(int sk, const struct sockaddr **sa_r,
1141 socklen_t *len_r, struct sockaddr_un *sun)
1143 struct sockaddr_in sin;
1144 socklen_t mylen = sizeof(*sun);
1145 const struct sockaddr *sa = *sa_r;
1148 /* If this isn't a Unix-domain socket then there's nothing to do. */
1149 if (real_getsockname(sk, SA(sun), &mylen) < 0) return (-1);
1150 if (sun->sun_family != AF_UNIX) return (0);
1151 if (mylen < sizeof(*sun)) ((char *)sun)[mylen] = 0;
1153 /* If the remote address is v6-mapped IPv4, then unmap it so as to search
1154 * for IPv4 servers. Also remember to v6-map the local address when we
1157 if (sa->sa_family == AF_INET6 && !(unmap_ipv4_sockaddr(&sin, SIN6(sa)))) {
1159 ibf |= IBF_V6MAPPED;
1162 /* If we're allowed to talk to a real remote endpoint, then fix things up
1163 * as necessary and proceed.
1165 if (acl_allows_p(connect_real, sa)) {
1166 if (fixup_real_ip_socket(sk, (*sa_r)->sa_family, 0)) return (-1);
1170 /* Speaking of which, if we don't have a local address, then we should
1173 if (!sun->sun_path[0] && do_implicit_bind(sk, sa, ibf)) return (-1);
1175 /* And then come up with a remote address. */
1176 encode_inet_addr(sun, sa, 0);
1178 *len_r = SUN_LEN(sun);
1182 /*----- Configuration -----------------------------------------------------*/
1184 /* Return the process owner's home directory. */
1185 static char *home(void)
1190 if (getuid() == uid &&
1191 (p = getenv("HOME")) != 0)
1193 else if ((pw = getpwuid(uid)) != 0)
1194 return (pw->pw_dir);
1199 /* Return a good temporary directory to use. */
1200 static char *tmpdir(void)
1204 if ((p = getenv("TMPDIR")) != 0) return (p);
1205 else if ((p = getenv("TMP")) != 0) return (p);
1206 else return ("/tmp");
1209 /* Return the user's name, or at least something distinctive. */
1210 static char *user(void)
1212 static char buf[16];
1216 if ((p = getenv("USER")) != 0) return (p);
1217 else if ((p = getenv("LOGNAME")) != 0) return (p);
1218 else if ((pw = getpwuid(uid)) != 0) return (pw->pw_name);
1220 snprintf(buf, sizeof(buf), "uid-%lu", (unsigned long)uid);
1225 /* Skip P over space characters. */
1226 #define SKIPSPC do { while (*p && isspace(UC(*p))) p++; } while (0)
1228 /* Set Q to point to the next word following P, null-terminate it, and step P
1230 #define NEXTWORD(q) do { \
1233 while (*p && !isspace(UC(*p))) p++; \
1237 /* Set Q to point to the next dotted-quad address, store the ending delimiter
1238 * in DEL, null-terminate it, and step P past it. */
1239 static void parse_nextaddr(char **pp, char **qq, int *del)
1247 p += strcspn(p, "]");
1252 while (*p && (*p == '.' || isdigit(UC(*p)))) p++;
1259 /* Set Q to point to the next decimal number, store the ending delimiter in
1260 * DEL, null-terminate it, and step P past it. */
1261 #define NEXTNUMBER(q, del) do { \
1264 while (*p && isdigit(UC(*p))) p++; \
1269 /* Push the character DEL back so we scan it again, unless it's zero
1271 #define RESCAN(del) do { if (del) *--p = del; } while (0)
1273 /* Evaluate true if P is pointing to the word KW (and not some longer string
1274 * of which KW is a prefix). */
1276 #define KWMATCHP(kw) (strncmp(p, kw, sizeof(kw) - 1) == 0 && \
1277 !isalnum(UC(p[sizeof(kw) - 1])) && \
1278 (p += sizeof(kw) - 1))
1280 /* Parse a port list, starting at *PP. Port lists have the form
1281 * [:LOW[-HIGH]]: if omitted, all ports are included; if HIGH is omitted,
1282 * it's as if HIGH = LOW. Store LOW in *MIN, HIGH in *MAX and set *PP to the
1283 * rest of the string.
1285 static void parse_ports(char **pp, unsigned short *min, unsigned short *max)
1292 { *min = 0; *max = 0xffff; }
1295 NEXTNUMBER(q, del); *min = strtoul(q, 0, 0); RESCAN(del);
1298 { p++; NEXTNUMBER(q, del); *max = strtoul(q, 0, 0); RESCAN(del); }
1305 /* Parse an address range designator starting at PP and store a
1306 * representation of it in R. An address range designator has the form:
1308 * any | local | ADDR | ADDR - ADDR | ADDR/ADDR | ADDR/INT
1310 static int parse_addrrange(char **pp, addrrange *r)
1318 if (KWMATCHP("any")) r->type = ANY;
1319 else if (KWMATCHP("local")) r->type = LOCAL;
1321 parse_nextaddr(&p, &q, &del);
1322 af = guess_address_family(q);
1323 if (inet_pton(af, q, &r->u.range.min) <= 0) goto bad;
1328 parse_nextaddr(&p, &q, &del);
1329 if (inet_pton(af, q, &r->u.range.max) <= 0) goto bad;
1331 } else if (*p == '/') {
1334 n = strtoul(q, 0, 0);
1335 r->u.range.max = r->u.range.min;
1336 mask_address(af, &r->u.range.min, n, 0);
1337 mask_address(af, &r->u.range.max, n, 1);
1340 r->u.range.max = r->u.range.min;
1351 /* Call FUNC on each individual address range in R. */
1352 static void foreach_addrrange(const addrrange *r,
1353 void (*func)(int af,
1359 ipaddr minaddr, maxaddr;
1366 for (i = 0; address_families[i] >= 0; i++) {
1367 af = address_families[i];
1368 memset(&minaddr, 0, sizeof(minaddr));
1369 maxaddr = minaddr; mask_address(af, &maxaddr, 0, 1);
1370 func(af, &minaddr, &maxaddr, p);
1374 for (i = 0; address_families[i] >= 0; i++) {
1375 af = address_families[i];
1376 memset(&minaddr, 0, sizeof(minaddr));
1377 maxaddr = minaddr; mask_address(af, &maxaddr, 0, 1);
1378 func(af, &minaddr, &minaddr, p);
1379 func(af, &maxaddr, &maxaddr, p);
1381 for (i = 0; i < n_local_ipaddrs; i++) {
1382 func(local_ipaddrs[i].af,
1383 &local_ipaddrs[i].addr, &local_ipaddrs[i].addr,
1388 func(r->u.range.af, &r->u.range.min, &r->u.range.max, p);
1395 struct add_aclnode_ctx {
1397 unsigned short minport, maxport;
1401 static void add_aclnode(int af, const ipaddr *min, const ipaddr *max,
1404 struct add_aclnode_ctx *ctx = p;
1410 a->minaddr = *min; a->maxaddr = *max;
1411 a->minport = ctx->minport; a->maxport = ctx->maxport;
1412 **ctx->tail = a; *ctx->tail = &a->next;
1415 /* Parse an ACL line. *PP points to the end of the line; *TAIL points to
1416 * the list tail (i.e., the final link in the list). An ACL entry has the
1417 * form +|- ADDR-RANGE PORTS
1418 * where PORTS is parsed by parse_ports above; an ACL line consists of a
1419 * comma-separated sequence of entries..
1421 static void parse_acl_line(char **pp, aclnode ***tail)
1423 struct add_aclnode_ctx ctx;
1430 if (*p == '+') ctx.act = ALLOW;
1431 else if (*p == '-') ctx.act = DENY;
1435 if (parse_addrrange(&p, &r)) goto bad;
1436 parse_ports(&p, &ctx.minport, &ctx.maxport);
1437 foreach_addrrange(&r, add_aclnode, &ctx);
1439 if (*p != ',') break;
1447 D( fprintf(stderr, "noip(%d): bad acl spec (ignored)\n", getpid()); )
1451 /* Parse an ACL from an environment variable VAR, attaching it to the list
1454 static void parse_acl_env(const char *var, aclnode ***tail)
1458 if ((p = getenv(var)) != 0) {
1460 parse_acl_line(&q, tail);
1465 struct add_impbind_ctx {
1470 static void add_impbind(int af, const ipaddr *min, const ipaddr *max,
1473 struct add_impbind_ctx *ctx = p;
1476 if (ctx->af && af != ctx->af) return;
1480 i->minaddr = *min; i->maxaddr = *max;
1482 case EXPLICIT: i->bindaddr = ctx->addr;
1486 *impbind_tail = i; impbind_tail = &i->next;
1489 /* Parse an implicit-bind line. An implicit-bind entry has the form
1490 * ADDR-RANGE {ADDR | same}
1492 static void parse_impbind_line(char **pp)
1494 struct add_impbind_ctx ctx;
1500 if (parse_addrrange(&p, &r)) goto bad;
1502 if (KWMATCHP("same")) {
1507 parse_nextaddr(&p, &q, &del);
1508 ctx.af = guess_address_family(q);
1509 if (inet_pton(ctx.af, q, &ctx.addr) < 0) goto bad;
1512 foreach_addrrange(&r, add_impbind, &ctx);
1514 if (*p != ',') break;
1522 D( fprintf(stderr, "noip(%d): bad implicit-bind spec (ignored)\n",
1527 /* Parse implicit-bind instructions from an environment variable VAR,
1528 * attaching it to the list.
1530 static void parse_impbind_env(const char *var)
1534 if ((p = getenv(var)) != 0) {
1536 parse_impbind_line(&q);
1541 /* Parse the autoports configuration directive. Syntax is MIN - MAX. */
1542 static void parse_autoports(char **pp)
1549 NEXTNUMBER(q, del); x = strtoul(q, 0, 0); RESCAN(del);
1551 if (*p != '-') goto bad;
1553 NEXTNUMBER(q, del); y = strtoul(q, 0, 0); RESCAN(del);
1554 minautoport = x; maxautoport = y;
1555 SKIPSPC; if (*p) goto bad;
1560 D( fprintf(stderr, "noip(%d): bad port range (ignored)\n", getpid()); )
1564 /* Read the configuration from the config file and environment. */
1565 static void readconfig(void)
1573 parse_acl_env("NOIP_REALBIND_BEFORE", &bind_tail);
1574 parse_acl_env("NOIP_REALCONNECT_BEFORE", &connect_tail);
1575 parse_impbind_env("NOIP_IMPBIND_BEFORE");
1576 if ((p = getenv("NOIP_AUTOPORTS")) != 0) {
1578 parse_autoports(&q);
1581 if ((p = getenv("NOIP_CONFIG")) == 0)
1582 snprintf(p = buf, sizeof(buf), "%s/.noip", home());
1583 D( fprintf(stderr, "noip(%d): config file: %s\n", pid, p); )
1585 if ((fp = fopen(p, "r")) == 0) {
1586 D( fprintf(stderr, "noip(%d): couldn't read config: %s\n",
1587 pid, strerror(errno)); )
1590 while (fgets(buf, sizeof(buf), fp)) {
1595 if (!*p || *p == '#') continue;
1596 while (n && isspace(UC(buf[n - 1]))) n--;
1601 if (strcmp(cmd, "socketdir") == 0)
1602 sockdir = xstrdup(p);
1603 else if (strcmp(cmd, "realbind") == 0)
1604 parse_acl_line(&p, &bind_tail);
1605 else if (strcmp(cmd, "realconnect") == 0)
1606 parse_acl_line(&p, &connect_tail);
1607 else if (strcmp(cmd, "impbind") == 0)
1608 parse_impbind_line(&p);
1609 else if (strcmp(cmd, "autoports") == 0)
1610 parse_autoports(&p);
1611 else if (strcmp(cmd, "debug") == 0)
1612 debug = *p ? atoi(p) : 1;
1614 D( fprintf(stderr, "noip(%d): bad config command %s\n", pid, cmd); )
1619 parse_acl_env("NOIP_REALBIND", &bind_tail);
1620 parse_acl_env("NOIP_REALCONNECT", &connect_tail);
1621 parse_impbind_env("NOIP_IMPBIND");
1622 parse_acl_env("NOIP_REALBIND_AFTER", &bind_tail);
1623 parse_acl_env("NOIP_REALCONNECT_AFTER", &connect_tail);
1624 parse_impbind_env("NOIP_IMPBIND_AFTER");
1628 if (!sockdir) sockdir = getenv("NOIP_SOCKETDIR");
1630 snprintf(buf, sizeof(buf), "%s/noip-%s", tmpdir(), user());
1631 sockdir = xstrdup(buf);
1633 D( fprintf(stderr, "noip(%d): socketdir: %s\n", pid, sockdir);
1634 fprintf(stderr, "noip(%d): autoports: %u-%u\n",
1635 pid, minautoport, maxautoport);
1636 fprintf(stderr, "noip(%d): realbind acl:\n", pid);
1637 dump_acl(bind_real);
1638 fprintf(stderr, "noip(%d): realconnect acl:\n", pid);
1639 dump_acl(connect_real);
1640 fprintf(stderr, "noip(%d): impbind list:\n", pid);
1641 dump_impbind_list(); )
1644 /*----- Overridden system calls -------------------------------------------*/
1646 static void dump_syserr(long rc)
1647 { fprintf(stderr, " => %ld (E%d)\n", rc, errno); }
1649 static void dump_sysresult(long rc)
1651 if (rc < 0) dump_syserr(rc);
1652 else fprintf(stderr, " => %ld\n", rc);
1655 static void dump_addrresult(long rc, const struct sockaddr *sa,
1658 char addrbuf[ADDRBUFSZ];
1660 if (rc < 0) dump_syserr(rc);
1662 fprintf(stderr, " => %ld [%s]\n", rc,
1663 present_sockaddr(sa, len, addrbuf, sizeof(addrbuf)));
1667 int socket(int pf, int ty, int proto)
1671 D( fprintf(stderr, "noip(%d): SOCKET pf=%d, type=%d, proto=%d",
1672 getpid(), pf, ty, proto); )
1676 if (!family_known_p(pf)) {
1677 D( fprintf(stderr, " -> unknown; refuse\n"); )
1678 errno = EAFNOSUPPORT;
1681 D( fprintf(stderr, " -> inet; substitute"); )
1689 D( fprintf(stderr, " -> safe; permit"); )
1692 sk = real_socket(pf, ty, proto);
1693 D( dump_sysresult(sk); )
1697 int socketpair(int pf, int ty, int proto, int *sk)
1701 D( fprintf(stderr, "noip(%d): SOCKETPAIR pf=%d, type=%d, proto=%d",
1702 getpid(), pf, ty, proto); )
1703 if (!family_known_p(pf))
1704 D( fprintf(stderr, " -> unknown; permit"); )
1706 D( fprintf(stderr, " -> inet; substitute"); )
1710 rc = real_socketpair(pf, ty, proto, sk);
1711 D( if (rc < 0) dump_syserr(rc);
1712 else fprintf(stderr, " => %d (%d, %d)\n", rc, sk[0], sk[1]); )
1716 int bind(int sk, const struct sockaddr *sa, socklen_t len)
1718 struct sockaddr_un sun;
1722 D({ char buf[ADDRBUFSZ];
1723 fprintf(stderr, "noip(%d): BIND sk=%d, sa[%d]=%s", pid,
1724 sk, len, present_sockaddr(sa, len, buf, sizeof(buf))); })
1726 if (!family_known_p(sa->sa_family))
1727 D( fprintf(stderr, " -> unknown af; pass through"); )
1729 D( fprintf(stderr, " -> checking...\n"); )
1731 if (acl_allows_p(bind_real, sa)) {
1732 if (fixup_real_ip_socket(sk, sa->sa_family, 0))
1735 encode_inet_addr(&sun, sa, ENCF_FRESH);
1737 len = SUN_LEN(&sun);
1740 D( fprintf(stderr, "noip(%d): BIND ...", pid); )
1742 rc = real_bind(sk, sa, len);
1743 D( dump_sysresult(rc); )
1747 int connect(int sk, const struct sockaddr *sa, socklen_t len)
1749 struct sockaddr_un sun;
1753 D({ char buf[ADDRBUFSZ];
1754 fprintf(stderr, "noip(%d): CONNECT sk=%d, sa[%d]=%s", pid,
1755 sk, len, present_sockaddr(sa, len, buf, sizeof(buf))); })
1757 if (!family_known_p(sa->sa_family)) {
1758 D( fprintf(stderr, " -> unknown af; pass through"); )
1759 rc = real_connect(sk, sa, len);
1761 D( fprintf(stderr, " -> checking...\n"); )
1763 fixup_client_socket(sk, &sa, &len, &sun);
1765 D( fprintf(stderr, "noip(%d): CONNECT ...", pid); )
1766 rc = real_connect(sk, sa, len);
1769 case ENOENT: errno = ECONNREFUSED; break;
1773 D( dump_sysresult(rc); )
1777 ssize_t sendto(int sk, const void *buf, size_t len, int flags,
1778 const struct sockaddr *to, socklen_t tolen)
1780 struct sockaddr_un sun;
1784 D({ char addrbuf[ADDRBUFSZ];
1785 fprintf(stderr, "noip(%d): SENDTO sk=%d, len=%lu, flags=%d, to[%d]=%s",
1786 pid, sk, (unsigned long)len, flags, tolen,
1787 present_sockaddr(to, tolen, addrbuf, sizeof(addrbuf))); })
1790 D( fprintf(stderr, " -> null address; leaving"); )
1791 else if (!family_known_p(to->sa_family))
1792 D( fprintf(stderr, " -> unknown af; pass through"); )
1794 D( fprintf(stderr, " -> checking...\n"); )
1796 fixup_client_socket(sk, &to, &tolen, &sun);
1798 D( fprintf(stderr, "noip(%d): SENDTO ...", pid); )
1800 n = real_sendto(sk, buf, len, flags, to, tolen);
1801 D( dump_sysresult(n); )
1805 ssize_t recvfrom(int sk, void *buf, size_t len, int flags,
1806 struct sockaddr *from, socklen_t *fromlen)
1809 socklen_t mylen = sizeof(sabuf);
1813 D( fprintf(stderr, "noip(%d): RECVFROM sk=%d, len=%lu, flags=%d",
1814 pid, sk, (unsigned long)len, flags); )
1817 D( fprintf(stderr, " -> null addr; pass through"); )
1818 n = real_recvfrom(sk, buf, len, flags, 0, 0);
1820 n = real_recvfrom(sk, buf, len, flags, SA(sabuf), &mylen);
1822 D( fprintf(stderr, " -> converting...\n"); )
1824 return_fake_peer(sk, SA(sabuf), mylen, from, fromlen);
1826 D( fprintf(stderr, "noip(%d): ... RECVFROM", pid); )
1829 D( dump_addrresult(n, from, fromlen ? *fromlen : 0); )
1833 ssize_t sendmsg(int sk, const struct msghdr *msg, int flags)
1835 struct sockaddr_un sun;
1836 const struct sockaddr *sa = SA(msg->msg_name);
1837 struct msghdr mymsg;
1841 D({ char addrbuf[ADDRBUFSZ];
1842 fprintf(stderr, "noip(%d): SENDMSG sk=%d, "
1843 "msg_flags=%d, msg_name[%d]=%s, ...",
1844 pid, sk, msg->msg_flags, msg->msg_namelen,
1845 present_sockaddr(sa, msg->msg_namelen,
1846 addrbuf, sizeof(addrbuf))); })
1849 D( fprintf(stderr, " -> null address; leaving"); )
1850 else if (!family_known_p(sa->sa_family))
1851 D( fprintf(stderr, " -> unknown af; pass through"); )
1853 D( fprintf(stderr, " -> checking...\n"); )
1856 fixup_client_socket(sk, &sa, &mymsg.msg_namelen, &sun);
1857 mymsg.msg_name = SA(sa);
1860 D( fprintf(stderr, "noip(%d): SENDMSG ...", pid); )
1862 n = real_sendmsg(sk, msg, flags);
1863 D( dump_sysresult(n); )
1867 ssize_t recvmsg(int sk, struct msghdr *msg, int flags)
1870 struct sockaddr *sa = SA(msg->msg_name);
1871 socklen_t len = msg->msg_namelen;
1875 D( fprintf(stderr, "noip(%d): RECVMSG sk=%d msg_flags=%d, ...",
1876 pid, sk, msg->msg_flags); )
1878 if (!msg->msg_name) {
1879 D( fprintf(stderr, " -> null addr; pass through"); )
1880 return (real_recvmsg(sk, msg, flags));
1882 msg->msg_name = sabuf;
1883 msg->msg_namelen = sizeof(sabuf);
1884 n = real_recvmsg(sk, msg, flags);
1886 D( fprintf(stderr, " -> converting...\n"); )
1888 return_fake_peer(sk, SA(sabuf), msg->msg_namelen, sa, &len);
1891 D( fprintf(stderr, "noip(%d): ... RECVMSG", pid); )
1893 msg->msg_namelen = len;
1895 D( dump_addrresult(n, sa, len); )
1899 int accept(int sk, struct sockaddr *sa, socklen_t *len)
1902 socklen_t mylen = sizeof(sabuf);
1906 D( fprintf(stderr, "noip(%d): ACCEPT sk=%d", pid, sk); )
1908 nsk = real_accept(sk, SA(sabuf), &mylen);
1909 if (nsk < 0) /* failed */;
1910 else if (!sa) D( fprintf(stderr, " -> address not wanted"); )
1912 D( fprintf(stderr, " -> converting...\n"); )
1913 return_fake_peer(sk, SA(sabuf), mylen, sa, len);
1914 D( fprintf(stderr, "noip(%d): ... ACCEPT", pid); )
1916 D( dump_addrresult(nsk, sa, len ? *len : 0); )
1920 int getsockname(int sk, struct sockaddr *sa, socklen_t *len)
1923 socklen_t mylen = sizeof(sabuf);
1927 D( fprintf(stderr, "noip(%d): GETSOCKNAME sk=%d", pid, sk); )
1928 rc = real_getsockname(sk, SA(sabuf), &mylen);
1930 D( fprintf(stderr, " -> converting...\n"); )
1931 return_fake_name(SA(sabuf), mylen, sa, len, 0);
1932 D( fprintf(stderr, "noip(%d): ... GETSOCKNAME", pid); )
1934 D( dump_addrresult(rc, sa, *len); )
1938 int getpeername(int sk, struct sockaddr *sa, socklen_t *len)
1941 socklen_t mylen = sizeof(sabuf);
1945 D( fprintf(stderr, "noip(%d): GETPEERNAME sk=%d", pid, sk); )
1946 rc = real_getpeername(sk, SA(sabuf), &mylen);
1948 D( fprintf(stderr, " -> converting...\n"); )
1949 return_fake_peer(sk, SA(sabuf), mylen, sa, len);
1950 D( fprintf(stderr, "noip(%d): ... GETPEERNAME", pid); )
1952 D( dump_addrresult(rc, sa, *len); )
1956 int getsockopt(int sk, int lev, int opt, void *p, socklen_t *len)
1967 return (real_getsockopt(sk, lev, opt, p, len));
1970 int setsockopt(int sk, int lev, int opt, const void *p, socklen_t len)
1980 case SO_BINDTODEVICE:
1981 case SO_ATTACH_FILTER:
1982 case SO_DETACH_FILTER:
1985 return (real_setsockopt(sk, lev, opt, p, len));
1988 int ioctl(int fd, unsigned long op, ...)
1996 arg = va_arg(ap, void *);
2000 case SIOCGIFBRDADDR:
2001 case SIOCGIFDSTADDR:
2002 case SIOCGIFNETMASK:
2004 if (fixup_real_ip_socket(fd, AF_INET, &sk)) goto real;
2006 rc = real_ioctl(sk, op, arg);
2007 PRESERVING_ERRNO({ close(sk); });
2011 rc = real_ioctl(fd, op, arg);
2018 /*----- Initialization ----------------------------------------------------*/
2020 /* Clean up the socket directory, deleting stale sockets. */
2021 static void cleanup_sockdir(void)
2026 struct sockaddr_un sun;
2030 if ((dir = opendir(sockdir)) == 0) return;
2031 sun.sun_family = AF_UNIX;
2032 while ((d = readdir(dir)) != 0) {
2033 if (d->d_name[0] == '.') continue;
2034 snprintf(sun.sun_path, sizeof(sun.sun_path),
2035 "%s/%s", sockdir, d->d_name);
2036 if (decode_inet_addr(&addr.sa, 0, &sun, SUN_LEN(&sun)) ||
2037 stat(sun.sun_path, &st) ||
2038 !S_ISSOCK(st.st_mode)) {
2039 D( fprintf(stderr, "noip(%d): ignoring unknown socketdir entry `%s'\n",
2040 pid, sun.sun_path); )
2043 if (unix_socket_status(&sun, 0) == STALE) {
2044 D( fprintf(stderr, "noip(%d): clearing away stale socket %s\n",
2046 unlink(sun.sun_path);
2052 /* Find the addresses attached to local network interfaces, and remember them
2055 static void get_local_ipaddrs(void)
2057 struct ifaddrs *ifa_head, *ifa;
2062 D( fprintf(stderr, "noip(%d): fetching local addresses...\n", pid); )
2063 if (getifaddrs(&ifa_head)) { perror("getifaddrs"); return; }
2064 for (n_local_ipaddrs = 0, ifa = ifa_head;
2065 n_local_ipaddrs < MAX_LOCAL_IPADDRS && ifa;
2066 ifa = ifa->ifa_next) {
2067 if (!ifa->ifa_addr || !family_known_p(ifa->ifa_addr->sa_family))
2069 ipaddr_from_sockaddr(&a, ifa->ifa_addr);
2070 D({ char buf[ADDRBUFSZ];
2071 fprintf(stderr, "noip(%d): local addr %s = %s", pid,
2073 inet_ntop(ifa->ifa_addr->sa_family, &a,
2074 buf, sizeof(buf))); })
2075 for (i = 0; i < n_local_ipaddrs; i++) {
2076 if (ifa->ifa_addr->sa_family == local_ipaddrs[i].af &&
2077 ipaddr_equal_p(local_ipaddrs[i].af, &a, &local_ipaddrs[i].addr)) {
2078 D( fprintf(stderr, " (duplicate)\n"); )
2082 D( fprintf(stderr, "\n"); )
2083 local_ipaddrs[n_local_ipaddrs].af = ifa->ifa_addr->sa_family;
2084 local_ipaddrs[n_local_ipaddrs].addr = a;
2088 freeifaddrs(ifa_head);
2091 /* Print the given message to standard error. Avoids stdio. */
2092 static void printerr(const char *p)
2093 { if (write(STDERR_FILENO, p, strlen(p))) ; }
2095 /* Create the socket directory, being careful about permissions. */
2096 static void create_sockdir(void)
2100 if (lstat(sockdir, &st)) {
2101 if (errno == ENOENT) {
2102 if (mkdir(sockdir, 0700)) {
2103 perror("noip: creating socketdir");
2106 if (!lstat(sockdir, &st))
2109 perror("noip: checking socketdir");
2113 if (!S_ISDIR(st.st_mode)) {
2114 printerr("noip: bad socketdir: not a directory\n");
2117 if (st.st_uid != uid) {
2118 printerr("noip: bad socketdir: not owner\n");
2121 if (st.st_mode & 077) {
2122 printerr("noip: bad socketdir: not private\n");
2127 /* Initialization function. */
2128 static void setup(void) __attribute__((constructor));
2129 static void setup(void)
2136 if ((p = getenv("NOIP_DEBUG")) && atoi(p))
2138 get_local_ipaddrs();
2145 /*----- That's all, folks -------------------------------------------------*/