17 #include <sys/ioctl.h>
18 #include <sys/socket.h>
22 #include <netinet/in.h>
23 #include <arpa/inet.h>
24 #include <netinet/tcp.h>
25 #include <netinet/udp.h>
28 enum { UNUSED, STALE, USED };
29 enum { WANT_FRESH, WANT_EXISTING };
31 typedef struct aclnode {
34 unsigned long minaddr, maxaddr;
35 unsigned short minport, maxport;
38 #define MAX_LOCAL_IPADDRS 16
39 static struct in_addr local_ipaddrs[MAX_LOCAL_IPADDRS];
40 static int n_local_ipaddrs;
43 static char *sockdir = 0;
45 static unsigned minautoport = 16384, maxautoport = 65536;
47 static aclnode *bind_real, **bind_tail = &bind_real;
48 static aclnode *connect_real, **connect_tail = &connect_real;
50 /* --- Import magic --- */
53 _(socket, int, (int, int, int)) \
54 _(socketpair, int, (int, int, int, int *)) \
55 _(connect, int, (int, const struct sockaddr *, socklen_t)) \
56 _(bind, int, (int, const struct sockaddr *, socklen_t)) \
57 _(accept, int, (int, struct sockaddr *, socklen_t *)) \
58 _(getsockname, int, (int, struct sockaddr *, socklen_t *)) \
59 _(getpeername, int, (int, struct sockaddr *, socklen_t *)) \
60 _(getsockopt, int, (int, int, int, void *, socklen_t *)) \
61 _(setsockopt, int, (int, int, int, const void *, socklen_t)) \
62 _(sendto, ssize_t, (int, const void *buf, size_t, int, \
63 const struct sockaddr *to, socklen_t tolen)) \
64 _(recvfrom, ssize_t, (int, void *buf, size_t, int, \
65 struct sockaddr *from, socklen_t *fromlen)) \
66 _(sendmsg, ssize_t, (int, const struct msghdr *, int)) \
67 _(recvmsg, ssize_t, (int, struct msghdr *, int)) \
70 #define DECL(imp, ret, args) static ret (*real_##imp) args;
74 static void setup(void) __attribute__((constructor));
75 static void import(void)
77 #define IMPORT(imp, ret, args) \
78 real_##imp = (ret (*)args)dlsym(RTLD_NEXT, #imp);
85 #define SA(sa) ((struct sockaddr *)(sa))
86 #define SIN(sa) ((struct sockaddr_in *)(sa))
87 #define SUN(sa) ((struct sockaddr_un *)(sa))
89 #define UC(ch) ((unsigned char)(ch))
91 #define NEW(x) ((x) = xmalloc(sizeof(*x)))
92 #define NEWV(x, n) ((x) = xmalloc(sizeof(*x) * (n)))
95 # define D(body) { if (debug) { body } }
100 #define PRESERVING_ERRNO(body) do { \
101 int _err = errno; { body } errno = _err; \
104 static void *xmalloc(size_t n)
108 if ((p = malloc(n)) == 0) { perror("malloc"); exit(1); }
112 static char *xstrdup(const char *p)
114 size_t n = strlen(p) + 1;
115 char *q = xmalloc(n);
120 static int unix_socket_status(struct sockaddr_un *sun, int quick_p)
129 if (stat(sun->sun_path, &st) && errno == ENOENT)
135 if ((fp = fopen("/proc/net/unix", "r")) == 0)
137 fgets(buf, sizeof(buf), fp); /* skip header */
138 len = strlen(sun->sun_path);
139 while (fgets(buf, sizeof(buf), fp)) {
141 if (n >= len + 2 && buf[n - len - 2] == ' ' && buf[n - 1] == '\n' &&
142 memcmp(buf + n - len - 1, sun->sun_path, len) == 0)
155 static void dump_aclnode(aclnode *a)
157 char minbuf[16], maxbuf[16];
158 struct in_addr amin, amax;
160 amin.s_addr = htonl(a->minaddr);
161 amax.s_addr = htonl(a->maxaddr);
162 fprintf(stderr, "noip: %c ", a->act ? '+' : '-');
163 if (a->minaddr == 0 && a->maxaddr == 0xffffffff)
164 fprintf(stderr, "any");
166 fprintf(stderr, "%s",
167 inet_ntop(AF_INET, &amin, minbuf, sizeof(minbuf)));
168 if (a->maxaddr != a->minaddr) {
169 fprintf(stderr, "-%s",
170 inet_ntop(AF_INET, &amax, maxbuf, sizeof(maxbuf)));
173 if (a->minport != 0 || a->maxport != 0xffff) {
174 fprintf(stderr, ":%u", (unsigned)a->minport);
175 if (a->minport != a->maxport)
176 fprintf(stderr, "-%u", (unsigned)a->maxport);
183 static int acl_allows_p(aclnode *a, const struct sockaddr_in *sin)
185 unsigned long addr = ntohl(sin->sin_addr.s_addr);
186 unsigned short port = ntohs(sin->sin_port);
190 fprintf(stderr, "noip: check %s:%u\n",
191 inet_ntop(AF_INET, &sin->sin_addr, buf, sizeof(buf)),
192 ntohs((unsigned)sin->sin_port)); )
193 for (; a; a = a->next) {
194 D( dump_aclnode(a); )
195 if (a->minaddr <= addr && addr <= a->maxaddr &&
196 a->minport <= port && port <= a->maxport) {
197 D( fprintf(stderr, "noip: aha! %s\n", a->act ? "ALLOW" : "DENY"); )
202 D( fprintf(stderr, "noip: nothing found: %s\n", act ? "DENY" : "ALLOW"); )
208 static void dump_acl(aclnode *a)
212 for (; a; a = a->next) {
216 fprintf(stderr, "noip: [default policy: %s]\n",
217 act == ALLOW ? "DENY" : "ALLOW");
222 static unsigned randrange(unsigned min, unsigned max)
226 /* It's so nice not to have to care about the quality of the generator
229 for (mask = 1; mask < max; mask = (mask << 1) | 1)
231 do i = rand() & mask; while (i > max);
235 static int encode_inet_addr(struct sockaddr_un *sun,
236 const struct sockaddr_in *sin,
241 char buf[INET_ADDRSTRLEN];
244 D( fprintf(stderr, "noip: encode %s:%u (%s)",
245 inet_ntop(AF_INET, &sin->sin_addr, buf, sizeof(buf)),
246 (unsigned)ntohs(sin->sin_port),
247 want == WANT_EXISTING ? "EXISTING" : "FRESH"); )
248 sun->sun_family = AF_UNIX;
249 if (sin->sin_port || want == WANT_EXISTING) {
250 snprintf(sun->sun_path, sizeof(sun->sun_path), "%s/%s:%u", sockdir,
251 inet_ntop(AF_INET, &sin->sin_addr, buf, sizeof(buf)),
252 (unsigned)ntohs(sin->sin_port));
253 rc = unix_socket_status(sun, 0);
254 if (rc == STALE) unlink(sun->sun_path);
255 if (rc != USED && want == WANT_EXISTING) {
256 snprintf(sun->sun_path, sizeof(sun->sun_path), "%s/0.0.0.0:%u",
257 sockdir, (unsigned)ntohs(sin->sin_port));
258 if (unix_socket_status(sun, 0) == STALE) unlink(sun->sun_path);
261 for (i = 0; i < 10; i++) {
262 snprintf(sun->sun_path, sizeof(sun->sun_path), "%s/%s:%u", sockdir,
263 inet_ntop(AF_INET, &sin->sin_addr, buf, sizeof(buf)),
264 randrange(minautoport, maxautoport));
265 if (unix_socket_status(sun, 1) == UNUSED) goto found;
267 for (desperate_p = 0; desperate_p < 2; desperate_p++) {
268 for (i = minautoport; i <= maxautoport; i++) {
269 snprintf(sun->sun_path, sizeof(sun->sun_path), "%s/%s:%u", sockdir,
270 inet_ntop(AF_INET, &sin->sin_addr, buf, sizeof(buf)),
272 rc = unix_socket_status(sun, !desperate_p);
274 case STALE: unlink(sun->sun_path);
275 case UNUSED: goto found;
280 D( fprintf(stderr, " -- can't resolve\n"); )
284 D( fprintf(stderr, " -> `%s'\n", sun->sun_path); )
288 static int decode_inet_addr(struct sockaddr_in *sin,
289 const struct sockaddr_un *sun,
292 char buf[INET_ADDRSTRLEN + 16];
294 size_t n = strlen(sockdir), nn = strlen(sun->sun_path);
295 struct sockaddr_in sin_mine;
300 if (sun->sun_family != AF_UNIX)
302 if (len < sizeof(sun)) ((char *)sun)[len] = 0;
303 D( fprintf(stderr, "noip: decode (%d) `%s'",
304 *sun->sun_path, sun->sun_path); )
305 if (!sun->sun_path[0]) {
306 sin->sin_family = AF_INET;
307 sin->sin_addr.s_addr = INADDR_ANY;
309 D( fprintf(stderr, " -- unbound socket\n"); )
312 if (nn < n + 1 || nn - n >= sizeof(buf) || sun->sun_path[n] != '/' ||
313 memcmp(sun->sun_path, sockdir, n) != 0) {
314 D( fprintf(stderr, " -- not one of ours\n"); )
317 memcpy(buf, sun->sun_path + n + 1, nn - n);
318 if ((p = strchr(buf, ':')) == 0) {
319 D( fprintf(stderr, " -- malformed (no port)\n"); )
323 sin->sin_family = AF_INET;
324 if (inet_pton(AF_INET, buf, &sin->sin_addr) <= 0) {
325 D( fprintf(stderr, " -- malformed (bad address `%s')\n", buf); )
328 port = strtoul(p, &p, 10);
329 if (*p || port >= 65536) {
330 D( fprintf(stderr, " -- malformed (port out of range)"); )
333 sin->sin_port = htons(port);
334 D( fprintf(stderr, " -> %s:%u\n",
335 inet_ntop(AF_INET, &sin->sin_addr, buf, sizeof(buf)),
340 static int fixup_real_ip_socket(int sk)
345 struct sockaddr_un sun;
346 struct sockaddr_in sin;
358 _(LINGER, struct linger) \
361 _(RCVTIMEO, struct timeval) \
362 _(SNDTIMEO, struct timeval)
365 if (real_getsockname(sk, SA(&sun), &len))
367 if (decode_inet_addr(&sin, &sun, len))
368 return (0); /* Not one of ours */
370 if (real_getsockopt(sk, SOL_SOCKET, SO_TYPE, &type, &len) < 0 ||
371 (nsk = real_socket(PF_INET, type, 0)) < 0)
373 #define FIX(opt, ty) do { \
376 if (real_getsockopt(sk, SOL_SOCKET, SO_##opt, &ov_, &len) < 0 || \
377 real_setsockopt(nsk, SOL_SOCKET, SO_##opt, &ov_, len)) { \
384 if ((f = fcntl(sk, F_GETFL)) < 0 ||
385 (fd = fcntl(sk, F_GETFD)) < 0 ||
386 fcntl(nsk, F_SETFL, f) < 0 ||
391 unlink(sun.sun_path);
393 if (fcntl(sk, F_SETFD, fd) < 0) {
394 perror("noip: fixup_real_ip_socket F_SETFD");
400 static int do_implicit_bind(int sk, const struct sockaddr **sa,
401 socklen_t *len, struct sockaddr_un *sun)
403 struct sockaddr_in sin;
404 socklen_t mylen = sizeof(*sun);
406 if (acl_allows_p(connect_real, SIN(*sa))) {
407 if (fixup_real_ip_socket(sk))
410 if (real_getsockname(sk, SA(sun), &mylen) < 0)
412 if (sun->sun_family == AF_UNIX) {
413 if (mylen < sizeof(*sun)) ((char *)sun)[mylen] = 0;
414 if (!sun->sun_path[0]) {
415 sin.sin_family = AF_INET;
416 sin.sin_addr.s_addr = INADDR_LOOPBACK;
418 encode_inet_addr(sun, &sin, WANT_FRESH);
419 if (real_bind(sk, SA(sun), SUN_LEN(sun)))
422 encode_inet_addr(sun, SIN(*sa), WANT_EXISTING);
430 static void return_fake_name(struct sockaddr *sa, socklen_t len,
431 struct sockaddr *fake, socklen_t *fakelen)
433 struct sockaddr_in sin;
436 if (sa->sa_family == AF_UNIX && !decode_inet_addr(&sin, SUN(sa), len)) {
444 memcpy(fake, sa, len);
448 /* --- Configuration --- */
450 static char *home(void)
455 if ((p = getenv("HOME")) != 0) return (p);
456 else if ((pw = getpwuid(uid)) != 0) return (pw->pw_dir);
457 else return "/notexist";
460 static char *tmpdir(void)
464 if ((p = getenv("TMPDIR")) != 0) return (p);
465 else if ((p = getenv("TMP")) != 0) return (p);
466 else return ("/tmp");
469 static char *user(void)
475 if ((p = getenv("USER")) != 0) return (p);
476 else if ((p = getenv("LOGNAME")) != 0) return (p);
477 else if ((pw = getpwuid(uid)) != 0) return (pw->pw_name);
479 snprintf(buf, sizeof(buf), "uid-%lu", (unsigned long)uid);
484 #define SKIPSPC do { while (*p && isspace(UC(*p))) p++; } while (0)
485 #define NEXTWORD(q) do { \
488 while (*p && !isspace(UC(*p))) p++; \
491 #define NEXTADDR(q, del) do { \
494 while (*p && (*p == '.' || isdigit(UC(*p)))) p++; \
498 #define NEXTNUMBER(q, del) do { \
501 while (*p && isdigit(UC(*p))) p++; \
505 #define RESCAN(del) do { if (del) *--p = del; } while (0)
506 #define KWMATCHP(kw) (strncmp(p, kw, sizeof(kw) - 1) == 0 && \
507 !isalnum(UC(p[sizeof(kw) - 1])) && \
508 (p += sizeof(kw) - 1))
510 static void parse_ports(char **pp, unsigned short *min, unsigned short *max)
517 { *min = 0; *max = 0xffff; }
520 NEXTNUMBER(q, del); *min = strtoul(q, 0, 0); RESCAN(del);
523 { NEXTNUMBER(q, del); *max = strtoul(q, 0, 0); RESCAN(del); }
530 #define ACLNODE(tail_, act_, \
531 minaddr_, maxaddr_, minport_, maxport_) do { \
535 a_->minaddr = minaddr_; a_->maxaddr = maxaddr_; \
536 a_->minport = minport_; a_->maxport = maxport_; \
537 *tail_ = a_; tail_ = &a_->next; \
540 static void parse_acl_line(char **pp, aclnode ***tail)
543 unsigned long minaddr, maxaddr, mask;
544 unsigned short minport, maxport;
553 if (*p == '+') act = ALLOW;
554 else if (*p == '-') act = DENY;
559 if (KWMATCHP("any")) {
561 maxaddr = 0xffffffff;
563 } else if (KWMATCHP("local")) {
564 parse_ports(&p, &minport, &maxport);
565 ACLNODE(*tail, act, 0, 0, minport, maxport);
566 ACLNODE(*tail, act, 0xffffffff, 0xffffffff, minport, maxport);
567 for (i = 0; i < n_local_ipaddrs; i++) {
568 minaddr = ntohl(local_ipaddrs[i].s_addr);
569 ACLNODE(*tail, act, minaddr, minaddr, minport, maxport);
574 maxaddr = 0xffffffff;
577 if (inet_pton(AF_INET, q, &addr) <= 0) goto bad;
578 minaddr = ntohl(addr.s_addr);
584 if (inet_pton(AF_INET, q, &addr) <= 0) goto bad;
586 maxaddr = ntohl(addr.s_addr);
587 } else if (*p == '/') {
590 if (strchr(q, '.')) {
591 if (inet_pton(AF_INET, q, &addr) <= 0) goto bad;
592 mask = ntohl(addr.s_addr);
594 n = strtoul(q, 0, 0);
595 mask = (~0ul << (32 - n)) & 0xffffffff;
599 maxaddr = minaddr | (mask ^ 0xffffffff);
604 parse_ports(&p, &minport, &maxport);
605 ACLNODE(*tail, act, minaddr, maxaddr, minport, maxport);
608 if (*p != ',') break;
614 D( fprintf(stderr, "noip: bad acl spec (ignored)\n"); )
618 static void parse_autoports(char **pp)
625 NEXTNUMBER(q, del); x = strtoul(q, 0, 0); RESCAN(del);
627 if (*p != '-') goto bad; p++;
628 NEXTNUMBER(q, del); y = strtoul(q, 0, 0); RESCAN(del);
629 minautoport = x; maxautoport = y;
633 D( fprintf(stderr, "bad port range (ignored)\n"); )
637 static void parse_acl_env(const char *var, aclnode ***tail)
641 if ((p = getenv(var)) != 0) {
643 parse_acl_line(&q, tail);
648 static void readconfig(void)
655 if ((p = getenv("NOIP_CONFIG")) == 0)
656 snprintf(p = buf, sizeof(buf), "%s/.noip", home());
657 D( fprintf(stderr, "noip: config file: %s\n", p); )
659 parse_acl_env("NOIP_REALBIND_BEFORE", &bind_tail);
660 parse_acl_env("NOIP_REALCONNECT_BEFORE", &connect_tail);
661 if ((p = getenv("NOIP_AUTOPORTS")) != 0) {
666 if ((fp = fopen(p, "r")) == 0)
668 while (fgets(buf, sizeof(buf), fp)) {
673 if (!*p || *p == '#') continue;
674 while (n && isspace(UC(buf[n - 1]))) n--;
679 if (strcmp(cmd, "socketdir") == 0)
680 sockdir = xstrdup(p);
681 else if (strcmp(cmd, "realbind") == 0)
682 parse_acl_line(&p, &bind_tail);
683 else if (strcmp(cmd, "realconnect") == 0)
684 parse_acl_line(&p, &connect_tail);
685 else if (strcmp(cmd, "autoports") == 0)
687 else if (strcmp(cmd, "debug") == 0)
688 debug = *p ? atoi(p) : 1;
690 D( fprintf(stderr, "noip: bad config command %s\n", cmd); )
695 parse_acl_env("NOIP_REALBIND", &bind_tail);
696 parse_acl_env("NOIP_REALCONNECT", &connect_tail);
697 parse_acl_env("NOIP_REALBIND_AFTER", &bind_tail);
698 parse_acl_env("NOIP_REALCONNECT_AFTER", &connect_tail);
701 if (!sockdir) sockdir = getenv("NOIP_SOCKETDIR");
703 snprintf(buf, sizeof(buf), "%s/noip-%s", tmpdir(), user());
704 sockdir = xstrdup(buf);
706 D( fprintf(stderr, "noip: sockdir: %s\n", sockdir);
707 fprintf(stderr, "noip: autoports: %u-%u\n",
708 minautoport, maxautoport);
709 fprintf(stderr, "noip: realbind acl:\n");
711 fprintf(stderr, "noip: realconnect acl:\n");
712 dump_acl(connect_real); )
717 int socket(int pf, int ty, int proto)
723 return real_socket(pf, ty, proto);
726 int socketpair(int pf, int ty, int proto, int *sk)
732 return (real_socketpair(pf, ty, proto, sk));
735 int bind(int sk, const struct sockaddr *sa, socklen_t len)
737 struct sockaddr_un sun;
739 if (sa->sa_family == AF_INET) {
741 if (acl_allows_p(bind_real, SIN(sa))) {
742 if (fixup_real_ip_socket(sk))
745 encode_inet_addr(&sun, SIN(sa), WANT_FRESH);
751 return real_bind(sk, sa, len);
754 int connect(int sk, const struct sockaddr *sa, socklen_t len)
756 struct sockaddr_un sun;
758 if (sa->sa_family == AF_INET) {
760 do_implicit_bind(sk, &sa, &len, &sun);
763 return real_connect(sk, sa, len);
766 ssize_t sendto(int sk, const void *buf, size_t len, int flags,
767 const struct sockaddr *to, socklen_t tolen)
769 struct sockaddr_un sun;
771 if (to && to->sa_family == AF_INET) {
773 do_implicit_bind(sk, &to, &tolen, &sun);
776 return real_sendto(sk, buf, len, flags, to, tolen);
779 ssize_t recvfrom(int sk, void *buf, size_t len, int flags,
780 struct sockaddr *from, socklen_t *fromlen)
783 socklen_t mylen = sizeof(sabuf);
787 return real_recvfrom(sk, buf, len, flags, 0, 0);
789 n = real_recvfrom(sk, buf, len, flags, SA(sabuf), &mylen);
792 return_fake_name(SA(sabuf), mylen, from, fromlen);
797 ssize_t sendmsg(int sk, const struct msghdr *msg, int flags)
799 struct sockaddr_un sun;
800 const struct sockaddr *sa;
803 if (msg->msg_name && SA(msg->msg_name)->sa_family == AF_INET) {
805 sa = SA(msg->msg_name);
807 do_implicit_bind(sk, &sa, &mymsg.msg_namelen, &sun);
808 mymsg.msg_name = SA(sa);
812 return real_sendmsg(sk, msg, flags);
815 ssize_t recvmsg(int sk, struct msghdr *msg, int flags)
823 return real_recvmsg(sk, msg, flags);
825 sa = SA(msg->msg_name);
826 len = msg->msg_namelen;
827 msg->msg_name = sabuf;
828 msg->msg_namelen = sizeof(sabuf);
829 n = real_recvmsg(sk, msg, flags);
832 return_fake_name(SA(sabuf), msg->msg_namelen, sa, &len);
834 msg->msg_namelen = len;
839 int accept(int sk, struct sockaddr *sa, socklen_t *len)
842 socklen_t mylen = sizeof(sabuf);
843 int nsk = real_accept(sk, SA(sabuf), &mylen);
847 return_fake_name(SA(sabuf), mylen, sa, len);
851 int getsockname(int sk, struct sockaddr *sa, socklen_t *len)
855 socklen_t mylen = sizeof(sabuf);
856 if (real_getsockname(sk, SA(sabuf), &mylen))
858 return_fake_name(SA(sabuf), mylen, sa, len);
863 int getpeername(int sk, struct sockaddr *sa, socklen_t *len)
867 socklen_t mylen = sizeof(sabuf);
868 if (real_getpeername(sk, SA(sabuf), &mylen))
870 return_fake_name(SA(sabuf), mylen, sa, len);
875 int getsockopt(int sk, int lev, int opt, void *p, socklen_t *len)
885 return real_getsockopt(sk, lev, opt, p, len);
888 int setsockopt(int sk, int lev, int opt, const void *p, socklen_t len)
897 case SO_BINDTODEVICE:
898 case SO_ATTACH_FILTER:
899 case SO_DETACH_FILTER:
902 return real_setsockopt(sk, lev, opt, p, len);
905 /* --- Initialization --- */
907 static void cleanup_sockdir(void)
911 struct sockaddr_un sun;
913 if ((dir = opendir(sockdir)) == 0)
915 while ((d = readdir(dir)) != 0) {
916 if (d->d_name[0] == '.') continue;
917 snprintf(sun.sun_path, sizeof(sun.sun_path),
918 "%s/%s", sockdir, d->d_name);
919 if (unix_socket_status(&sun, 0) == STALE) {
920 D( fprintf(stderr, "noip: clearing away stale socket %s\n",
922 unlink(sun.sun_path);
928 static void get_local_ipaddrs(void)
930 struct if_nameindex *ifn;
935 ifn = if_nameindex();
936 if ((sk = real_socket(PF_INET, SOCK_STREAM, 00)) < 0)
938 for (i = n_local_ipaddrs = 0;
939 n_local_ipaddrs < MAX_LOCAL_IPADDRS &&
940 ifn[i].if_name && *ifn[i].if_name;
942 strcpy(ifr.ifr_name, ifn[i].if_name);
943 if (ioctl(sk, SIOCGIFADDR, &ifr) || ifr.ifr_addr.sa_family != AF_INET)
945 local_ipaddrs[n_local_ipaddrs++] =
946 SIN(&ifr.ifr_addr)->sin_addr;
947 D( fprintf(stderr, "noip: local addr %s = %s\n", ifn[i].if_name,
948 inet_ntoa(local_ipaddrs[n_local_ipaddrs - 1])); )
953 static void setup(void)
960 if ((p = getenv("NOIP_DEBUG")) && atoi(p))
964 mkdir(sockdir, 0700);