chiark / gitweb /
changelog: Retrospectively some items missing from 0.4.1
[secnet] / udp.c
CommitLineData
2fe58dfd
SE
1/* UDP send/receive module for secnet */
2
c215a4bc
IJ
3/*
4 * This file is part of secnet.
5 * See README for full list of copyright holders.
6 *
7 * secnet is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version d of the License, or
10 * (at your option) any later version.
11 *
12 * secnet is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * version 3 along with secnet; if not, see
19 * https://www.gnu.org/licenses/gpl.html.
20 */
21
2fe58dfd
SE
22/* This module enables sites to communicate by sending UDP
23 * packets. When an instance of the module is created we can
24 * optionally bind to a particular local IP address (not implemented
25 * yet).
26 *
2fe58dfd
SE
27 * Packets are offered to registered receivers in turn. Once one
28 * accepts it, it isn't offered to any more. */
29
8689b3a9 30#include "secnet.h"
2fe58dfd
SE
31#include <stdio.h>
32#include <unistd.h>
33#include <fcntl.h>
34#include <string.h>
35#include <errno.h>
2fe58dfd 36#include <sys/socket.h>
b2a56f7c 37#include <sys/wait.h>
5edf478f
IJ
38#include <netinet/in.h>
39#include <arpa/inet.h>
2fe58dfd 40#include "util.h"
dd9209d1 41#include "magic.h"
794f2398 42#include "unaligned.h"
ff05a229 43#include "ipaddr.h"
136740e6 44#include "magic.h"
54d5ef00 45#include "comm-common.h"
2fe58dfd 46
2fe58dfd
SE
47static comm_sendmsg_fn udp_sendmsg;
48
2fe58dfd 49struct udp {
763e458f
IJ
50 struct udpcommon uc;
51 struct udpsocks socks;
93910f6a 52 bool_t addr_configured;
571db148 53 unsigned counter;
2fe58dfd
SE
54};
55
08b62a6c
IJ
56/*
57 * Re comm_addr.ix: This field allows us to note in the comm_addr
58 * which socket an incoming packet was received on. This is required
59 * for conveniently logging the actual source of a packet. But the ix
60 * does not formally form part of the address: it is not used when
61 * sending, nor when comparing two comm_addrs.
62 *
63 * The special value -1 means that the comm_addr was constructed by
64 * another module in secnet (eg the resolver), rather than being a
65 * description of the source of an incoming packet.
66 */
67
54d5ef00
IJ
68static const char *udp_addr_to_string(void *commst, const struct comm_addr *ca)
69{
5edf478f 70 struct udp *st=commst;
763e458f 71 struct udpsocks *socks=&st->socks;
5edf478f 72 static char sbuf[100];
08b62a6c 73 int ix=ca->ix>=0 ? ca->ix : 0;
5edf478f 74
7d31df0e 75 assert(ix>=0 && ix<socks->n_socks);
571db148
IJ
76 snprintf(sbuf, sizeof(sbuf), "udp#%u@l%d:%s%s-%s",
77 st->counter, st->uc.cc.loc.line,
7d31df0e 78 iaddr_to_string(&socks->socks[ix].addr),
bfc34aff 79 ca->ix<0 && socks->n_socks>1 ? "&" : "",
08b62a6c 80 iaddr_to_string(&ca->ia));
5edf478f
IJ
81 return sbuf;
82}
83
f7af3192
IJ
84static int udp_socks_beforepoll(void *state, struct pollfd *fds, int *nfds_io,
85 int *timeout_io)
2fe58dfd 86{
f7af3192 87 struct udpsocks *socks=state;
08b62a6c 88 int i;
7d31df0e
IJ
89 BEFOREPOLL_WANT_FDS(socks->n_socks);
90 for (i=0; i<socks->n_socks; i++) {
91 fds[i].fd=socks->socks[i].fd;
08b62a6c
IJ
92 fds[i].events=POLLIN;
93 }
2fe58dfd
SE
94 return 0;
95}
96
2d7478f7
IJ
97const char *af_name(int af)
98{
99 switch (af) {
100 case AF_INET6: return "IPv6";
101 case AF_INET: return "IPv4";
102 case 0: return "(any)";
103 default: abort();
104 }
105}
106
107void udp_sock_experienced(struct log_if *lg, struct udpcommon *uc,
c72d679d 108 struct udpsocks *socks, struct udpsock *us,
6c5889e6 109 const union iaddr *dest, int af,
2d7478f7
IJ
110 int r, int errnoval)
111{
112 bool_t success=r>=0;
6c5889e6 113 if (us->experienced[!!dest][af][success]++)
2d7478f7
IJ
114 return;
115 lg_perror(lg, uc->cc.cl.description, &uc->cc.loc,
116 success ? M_INFO : M_WARNING,
117 success ? 0 : errnoval,
6c5889e6 118 "%s %s experiencing some %s %s%s%s%s%s%s",
c72d679d 119 socks->desc,iaddr_to_string(&us->addr),
2d7478f7 120 success?"success":"trouble",
6c5889e6
IJ
121 dest?"transmitting":"receiving",
122 af?" ":"", af?af_name(af):"",
123 dest?" (to ":"",
124 dest?iaddr_to_string(dest):"",
125 dest?")":"");
2d7478f7
IJ
126}
127
f7af3192 128static void udp_socks_afterpoll(void *state, struct pollfd *fds, int nfds)
763e458f 129{
f7af3192
IJ
130 struct udpsocks *socks=state;
131 struct udpcommon *uc=socks->uc;
a32d56fb 132 union iaddr from;
b1a0f651 133 socklen_t fromlen;
2fe58dfd
SE
134 bool_t done;
135 int rv;
08b62a6c 136 int i;
2fe58dfd 137
763e458f
IJ
138 struct commcommon *cc=&uc->cc;
139
140 for (i=0; i<socks->n_socks; i++) {
56c8ed69 141 struct udpsock *us=&socks->socks[i];
08b62a6c
IJ
142 if (i>=nfds) continue;
143 if (!(fds[i].revents & POLLIN)) continue;
56c8ed69
IJ
144 assert(fds[i].fd == us->fd);
145 int fd=us->fd;
2fe58dfd
SE
146 do {
147 fromlen=sizeof(from);
7d31df0e
IJ
148 BUF_ASSERT_FREE(cc->rbuf);
149 BUF_ALLOC(cc->rbuf,"udp_afterpoll");
150 buffer_init(cc->rbuf,calculate_max_start_pad());
151 rv=recvfrom(fd, cc->rbuf->start,
152 buf_remaining_space(cc->rbuf),
a32d56fb 153 0, &from.sa, &fromlen);
2fe58dfd 154 if (rv>0) {
7d31df0e
IJ
155 cc->rbuf->size=rv;
156 if (uc->use_proxy) {
ff05a229
SE
157 /* Check that the packet came from our poxy server;
158 we shouldn't be contacted directly by anybody else
159 (since they can trivially forge source addresses) */
9c44ef13 160 if (!iaddr_equal(&from,&uc->proxy,False)) {
ff05a229
SE
161 Message(M_INFO,"udp: received packet that's not "
162 "from the proxy\n");
7d31df0e 163 BUF_FREE(cc->rbuf);
ff05a229
SE
164 continue;
165 }
a32d56fb
IJ
166 /* proxy protocol supports ipv4 transport only */
167 from.sa.sa_family=AF_INET;
c1ddd026 168 BUF_GET_BYTES(unprepend,cc->rbuf,&from.sin.sin_addr,4);
7d31df0e 169 buf_unprepend(cc->rbuf,2);
c1ddd026 170 BUF_GET_BYTES(unprepend,cc->rbuf,&from.sin.sin_port,2);
ff05a229 171 }
8534d602 172 struct comm_addr ca;
7d31df0e 173 ca.comm=&cc->ops;
a32d56fb 174 ca.ia=from;
08b62a6c 175 ca.ix=i;
54d5ef00 176 done=comm_notify(&cc->notify, cc->rbuf, &ca);
c72d679d
IJ
177 if (done) {
178 udp_sock_experienced(0,uc,socks,us,0,
179 from.sa.sa_family,0,0);
180 } else {
bf28fc73 181 uint32_t msgtype;
7d31df0e
IJ
182 if (cc->rbuf->size>12 /* prevents traffic amplification */
183 && ((msgtype=get_uint32(cc->rbuf->start+8))
bf28fc73
IJ
184 != LABEL_NAK)) {
185 uint32_t source,dest;
186 /* Manufacture and send NAK packet */
7d31df0e
IJ
187 source=get_uint32(cc->rbuf->start); /* Us */
188 dest=get_uint32(cc->rbuf->start+4); /* Them */
189 send_nak(&ca,source,dest,msgtype,cc->rbuf,"unwanted");
bf28fc73 190 }
7d31df0e 191 BUF_FREE(cc->rbuf);
2fe58dfd 192 }
7d31df0e 193 BUF_ASSERT_FREE(cc->rbuf);
56c8ed69 194 } else { /* rv<=0 */
2d7478f7 195 if (errno!=EINTR && !iswouldblock(errno))
c72d679d 196 udp_sock_experienced(0,uc,socks,us, 0,0, rv,errno);
7d31df0e 197 BUF_FREE(cc->rbuf);
2fe58dfd
SE
198 }
199 } while (rv>=0);
200 }
201}
202
2fe58dfd 203static bool_t udp_sendmsg(void *commst, struct buffer_if *buf,
2d80199d
IJ
204 const struct comm_addr *dest,
205 struct comm_clientinfo *clientinfo)
2fe58dfd
SE
206{
207 struct udp *st=commst;
763e458f
IJ
208 struct udpcommon *uc=&st->uc;
209 struct udpsocks *socks=&st->socks;
ff05a229 210 uint8_t *sa;
2fe58dfd 211
7d31df0e 212 if (uc->use_proxy) {
56c8ed69 213 struct udpsock *us=&socks->socks[0];
3abd18e8 214 sa=buf_prepend(buf,8);
a32d56fb
IJ
215 if (dest->ia.sa.sa_family != AF_INET) {
216 Message(M_INFO,
217 "udp: proxy means dropping outgoing non-IPv4 packet to %s\n",
218 iaddr_to_string(&dest->ia));
219 return False;
220 }
221 memcpy(sa,&dest->ia.sin.sin_addr,4);
ff05a229 222 memset(sa+4,0,4);
a32d56fb 223 memcpy(sa+6,&dest->ia.sin.sin_port,2);
2d7478f7 224 int r=sendto(us->fd,sa,buf->size+8,0,&uc->proxy.sa,
7d31df0e 225 iaddr_socklen(&uc->proxy));
6c5889e6 226 udp_sock_experienced(0,uc,socks,us, &dest->ia,0, r,errno);
3abd18e8 227 buf_unprepend(buf,8);
ff05a229 228 } else {
08b62a6c
IJ
229 int i,r;
230 bool_t allunsupported=True;
56c8ed69 231 int af=dest->ia.sa.sa_family;
7d31df0e 232 for (i=0; i<socks->n_socks; i++) {
56c8ed69
IJ
233 struct udpsock *us=&socks->socks[i];
234 if (us->addr.sa.sa_family != af)
08b62a6c
IJ
235 /* no point even trying */
236 continue;
56c8ed69 237 r=sendto(us->fd, buf->start, buf->size, 0,
08b62a6c 238 &dest->ia.sa, iaddr_socklen(&dest->ia));
6c5889e6 239 udp_sock_experienced(0,uc,socks,us, &dest->ia,af, r,errno);
08b62a6c
IJ
240 if (r>=0) return True;
241 if (!(errno==EAFNOSUPPORT || errno==ENETUNREACH))
242 /* who knows what that error means? */
243 allunsupported=False;
244 }
245 return !allunsupported; /* see doc for comm_sendmsg_fn in secnet.h */
ff05a229 246 }
2fe58dfd
SE
247
248 return True;
249}
250
5f8b7a8e
IJ
251void udp_destroy_socket(struct udpcommon *uc, struct udpsock *us)
252{
253 if (us->fd>=0) {
254 close(us->fd);
255 us->fd=-1;
256 }
257}
258
9c44ef13
IJ
259#define FAIL_LG 0, cc->cl.description, &cc->loc, failmsgclass
260#define FAIL(...) do{ \
261 lg_perror(FAIL_LG,errno,__VA_ARGS__); \
262 goto failed; \
263 }while(0)
264
265static bool_t record_socket_gotaddr(struct udpcommon *uc, struct udpsock *us,
266 int failmsgclass)
267{
268 struct commcommon *cc=&uc->cc;
269 socklen_t salen=sizeof(us->addr);
270 int r=getsockname(us->fd,&us->addr.sa,&salen);
271 if (r) FAIL("getsockname()");
272 if (salen>sizeof(us->addr)) { errno=0; FAIL("getsockname() length"); }
273 return True;
274
275 failed:
276 return False;
277}
278
279bool_t udp_import_socket(struct udpcommon *uc, struct udpsock *us,
280 int failmsgclass, int fd)
281{
282 FILLZERO(us->experienced);
283 us->fd=fd;
284 return record_socket_gotaddr(uc,us,failmsgclass);
285}
286
53f4e666
IJ
287bool_t udp_make_socket(struct udpcommon *uc, struct udpsock *us,
288 int failmsgclass)
baa06aeb 289{
f164f167 290 const union iaddr *addr=&us->addr;
763e458f 291 struct commcommon *cc=&uc->cc;
53f4e666
IJ
292 us->fd=-1;
293
2d7478f7 294 FILLZERO(us->experienced);
08b62a6c 295 us->fd=socket(addr->sa.sa_family, SOCK_DGRAM, IPPROTO_UDP);
53f4e666 296 if (us->fd<0) FAIL("socket");
f54d5ada 297 setnonblock(us->fd);
f164f167 298 setcloexec(us->fd);
08b62a6c
IJ
299#ifdef CONFIG_IPV6
300 if (addr->sa.sa_family==AF_INET6) {
301 int r;
302 int optval=1;
303 socklen_t optlen=sizeof(optval);
304 r=setsockopt(us->fd,IPPROTO_IPV6,IPV6_V6ONLY,&optval,optlen);
53f4e666 305 if (r) FAIL("setsockopt(,IPV6_V6ONLY,&1,)");
08b62a6c
IJ
306 }
307#endif
baa06aeb 308
7d31df0e 309 if (uc->authbind) {
b2a56f7c
SE
310 pid_t c;
311 int status;
eea14dc2
IJ
312 char desc[200];
313 snprintf(desc,sizeof(desc),"authbind for %s: %s",
314 iaddr_to_string(addr), uc->authbind);
b2a56f7c
SE
315
316 /* XXX this fork() and waitpid() business needs to be hidden
317 in some system-specific library functions. */
318 c=fork();
53f4e666
IJ
319 if (c==-1)
320 FAIL("fork() for authbind");
b2a56f7c 321 if (c==0) {
3ff31eda
IJ
322 char *argv[5], addrstr[33], portstr[5];
323 const char *addrfam;
324 int port;
5e7a5e2d 325 afterfork();
f164f167 326 switch (addr->sa.sa_family) {
a32d56fb 327 case AF_INET:
f164f167 328 sprintf(addrstr,"%08lX",(long)addr->sin.sin_addr.s_addr);
3ff31eda
IJ
329 port=addr->sin.sin_port;
330 addrfam=NULL;
a32d56fb 331 break;
3ff31eda
IJ
332#ifdef CONFIG_IPV6
333 case AF_INET6: {
334 int i;
335 for (i=0; i<16; i++)
336 sprintf(addrstr+i*2,"%02X",addr->sin6.sin6_addr.s6_addr[i]);
337 port=addr->sin6.sin6_port;
338 addrfam="6";
339 break;
340 }
341#endif /*CONFIG_IPV6*/
a32d56fb
IJ
342 default:
343 fatal("udp (%s:%d): unsupported address family for authbind",
7d31df0e 344 cc->loc.file,cc->loc.line);
a32d56fb 345 }
3ff31eda 346 sprintf(portstr,"%04X",port);
7d31df0e 347 argv[0]=uc->authbind;
3b83c932
SE
348 argv[1]=addrstr;
349 argv[2]=portstr;
3ff31eda
IJ
350 argv[3]=(char*)addrfam;
351 argv[4]=NULL;
f164f167 352 dup2(us->fd,0);
7d31df0e 353 execvp(uc->authbind,argv);
3b83c932 354 _exit(255);
b2a56f7c 355 }
3b83c932
SE
356 while (waitpid(c,&status,0)==-1) {
357 if (errno==EINTR) continue;
53f4e666 358 FAIL("waitpid for authbind");
b2a56f7c 359 }
4ac7fd3f 360 if (status) {
313e4f0f
IJ
361 if (WIFEXITED(status) && WEXITSTATUS(status)<127) {
362 int es=WEXITSTATUS(status);
363 lg_perror(FAIL_LG,es,
eea14dc2
IJ
364 "%s exited with error exit status %d;"
365 " indicates error",desc,es);
313e4f0f 366 } else {
eea14dc2 367 lg_exitstatus(FAIL_LG,status,desc);
313e4f0f 368 }
53f4e666 369 goto failed;
3b83c932 370 }
b2a56f7c 371 } else {
53f4e666
IJ
372 if (bind(us->fd, &addr->sa, iaddr_socklen(addr))!=0)
373 FAIL("bind (%s)",iaddr_to_string(addr));
baa06aeb 374 }
9c44ef13
IJ
375
376 bool_t ok=record_socket_gotaddr(uc,us,failmsgclass);
377 if (!ok) goto failed;
378
53f4e666
IJ
379 return True;
380
381failed:
5f8b7a8e 382 udp_destroy_socket(uc,us);
53f4e666 383 return False;
9c44ef13 384}
53f4e666
IJ
385
386#undef FAIL
baa06aeb 387
c72d679d
IJ
388void udp_socks_register(struct udpcommon *uc, struct udpsocks *socks,
389 const char *desc)
f7af3192
IJ
390{
391 socks->uc=uc;
c72d679d 392 socks->desc=desc;
5c679ae0
IJ
393 socks->interest=
394 register_for_poll(socks,udp_socks_beforepoll,udp_socks_afterpoll,"udp");
395}
396
397void udp_socks_deregister(struct udpcommon *uc, struct udpsocks *socks)
398{
399 socks->uc=uc;
400 deregister_for_poll(socks->interest);
f7af3192
IJ
401}
402
32654a31
IJ
403void udp_socks_childpersist(struct udpcommon *uc, struct udpsocks *socks)
404{
405 int i;
406 for (i=0; i<socks->n_socks; i++)
407 udp_destroy_socket(uc,&socks->socks[i]);
408}
409
410static void udp_childpersist_hook(void *sst, uint32_t new_phase)
411{
412 struct udp *st=sst;
413 udp_socks_childpersist(&st->uc,&st->socks);
414}
415
f164f167
IJ
416static void udp_phase_hook(void *sst, uint32_t new_phase)
417{
418 struct udp *st=sst;
763e458f 419 struct udpsocks *socks=&st->socks;
f7af3192 420 struct udpcommon *uc=&st->uc;
08b62a6c 421 int i;
b3877445
IJ
422 bool_t anydone=0;
423
424 for (i=0; i<socks->n_socks; i++) {
425 bool_t required=st->addr_configured
426 || (!anydone && i==socks->n_socks-1);
427 anydone += udp_make_socket(uc,&socks->socks[i],
428 required ? M_FATAL : M_WARNING);
429 }
08b62a6c 430
c72d679d 431 udp_socks_register(uc,socks, uc->use_proxy ? "proxy" : "socket");
32654a31
IJ
432
433 add_hook(PHASE_CHILDPERSIST,udp_childpersist_hook,st);
baa06aeb
SE
434}
435
2fe58dfd
SE
436static list_t *udp_apply(closure_t *self, struct cloc loc, dict_t *context,
437 list_t *args)
438{
571db148
IJ
439 static unsigned counter;
440
2fe58dfd 441 struct udp *st;
08b62a6c 442 list_t *caddrl;
ff05a229
SE
443 list_t *l;
444 uint32_t a;
08b62a6c 445 int i;
2fe58dfd 446
763e458f
IJ
447 COMM_APPLY(st,&st->uc.cc,udp_,"udp",loc);
448 COMM_APPLY_STANDARD(st,&st->uc.cc,"udp",args);
449 UDP_APPLY_STANDARD(st,&st->uc,"udp");
2fe58dfd 450
763e458f
IJ
451 struct udpcommon *uc=&st->uc;
452 struct udpsocks *socks=&st->socks;
453 struct commcommon *cc=&uc->cc;
08b62a6c 454
571db148
IJ
455 st->counter=counter++;
456
08b62a6c
IJ
457 union iaddr defaultaddrs[] = {
458#ifdef CONFIG_IPV6
459 { .sin6 = { .sin6_family=AF_INET6,
763e458f 460 .sin6_port=htons(uc->port),
08b62a6c
IJ
461 .sin6_addr=IN6ADDR_ANY_INIT } },
462#endif
463 { .sin = { .sin_family=AF_INET,
763e458f 464 .sin_port=htons(uc->port),
08b62a6c
IJ
465 .sin_addr= { .s_addr=INADDR_ANY } } }
466 };
467
468 caddrl=dict_lookup(d,"address");
93910f6a
IJ
469 st->addr_configured=!!caddrl;
470 socks->n_socks=st->addr_configured ? list_length(caddrl)
471 : (int)ARRAY_SIZE(defaultaddrs);
7d31df0e
IJ
472 if (socks->n_socks<=0 || socks->n_socks>UDP_MAX_SOCKETS)
473 cfgfatal(cc->loc,"udp","`address' must be 1..%d addresses",
474 UDP_MAX_SOCKETS);
08b62a6c 475
7d31df0e
IJ
476 for (i=0; i<socks->n_socks; i++) {
477 struct udpsock *us=&socks->socks[i];
93910f6a 478 if (!st->addr_configured) {
08b62a6c
IJ
479 us->addr=defaultaddrs[i];
480 } else {
763e458f 481 string_item_to_iaddr(list_elem(caddrl,i),uc->port,&us->addr,"udp");
08b62a6c
IJ
482 }
483 us->fd=-1;
484 }
485
ff05a229
SE
486 l=dict_lookup(d,"proxy");
487 if (l) {
7d31df0e
IJ
488 uc->use_proxy=True;
489 uc->proxy.sa.sa_family=AF_INET;
c649eafe
IJ
490 item=list_elem(l,0);
491 if (!item || item->type!=t_string) {
7d31df0e 492 cfgfatal(cc->loc,"udp","proxy must supply ""addr"",port\n");
ff05a229 493 }
c649eafe 494 a=string_item_to_ipaddr(item,"proxy");
7d31df0e 495 uc->proxy.sin.sin_addr.s_addr=htonl(a);
c649eafe
IJ
496 item=list_elem(l,1);
497 if (!item || item->type!=t_number) {
7d31df0e 498 cfgfatal(cc->loc,"udp","proxy must supply ""addr"",port\n");
ff05a229 499 }
7d31df0e 500 uc->proxy.sin.sin_port=htons(item->data.number);
ff05a229 501 }
2fe58dfd 502
7d31df0e 503 update_max_start_pad(&comm_max_start_pad, uc->use_proxy ? 8 : 0);
3abd18e8 504
baa06aeb 505 add_hook(PHASE_GETRESOURCES,udp_phase_hook,st);
2fe58dfd 506
7d31df0e 507 return new_closure(&cc->cl);
2fe58dfd
SE
508}
509
2fe58dfd
SE
510void udp_module(dict_t *dict)
511{
512 add_closure(dict,"udp",udp_apply);
513}