X-Git-Url: https://tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Fnet_socket.c;h=767e91e92b30ba92d1af9ded372760ed2647ce72;hp=a28be54a62e2511679a578f7186056c265b86220;hb=cef40b8b978694fc0e7c02e292fcbb60806bf028;hpb=3847b78ba5900fe4311e9ef62474e32e1a6750e5 diff --git a/src/net_socket.c b/src/net_socket.c index a28be54a..767e91e9 100644 --- a/src/net_socket.c +++ b/src/net_socket.c @@ -1,7 +1,7 @@ /* net_socket.c -- Handle various kinds of sockets. Copyright (C) 1998-2005 Ivo Timmermans, - 2000-2013 Guus Sliepen + 2000-2014 Guus Sliepen 2006 Scott Lamb 2009 Florian Forster @@ -43,8 +43,9 @@ int addressfamily = AF_UNSPEC; int maxtimeout = 900; int seconds_till_retry = 5; -int udp_rcvbuf = 0; -int udp_sndbuf = 0; +int udp_rcvbuf = 1024 * 1024; +int udp_sndbuf = 1024 * 1024; +int max_connection_burst = 100; listen_socket_t listen_socket[MAXSOCKETS]; int listen_sockets; @@ -102,7 +103,7 @@ static bool bind_to_interface(int sd) { status = setsockopt(sd, SOL_SOCKET, SO_BINDTODEVICE, (void *)&ifr, sizeof(ifr)); if(status) { logger(DEBUG_ALWAYS, LOG_ERR, "Can't bind to interface %s: %s", iface, - strerror(errno)); + sockstrerror(sockerrno)); return false; } #else /* if !defined(SOL_SOCKET) || !defined(SO_BINDTODEVICE) */ @@ -112,6 +113,34 @@ static bool bind_to_interface(int sd) { return true; } +static bool bind_to_address(connection_t *c) { + int s = -1; + + for(int i = 0; i < listen_sockets && listen_socket[i].bindto; i++) { + if(listen_socket[i].sa.sa.sa_family != c->address.sa.sa_family) + continue; + if(s >= 0) + return false; + s = i; + } + + if(s < 0) + return false; + + sockaddr_t sa = listen_socket[s].sa; + if(sa.sa.sa_family == AF_INET) + sa.in.sin_port = 0; + else if(sa.sa.sa_family == AF_INET6) + sa.in6.sin6_port = 0; + + if(bind(c->socket, &sa.sa, SALEN(sa.sa))) { + logger(DEBUG_CONNECTIONS, LOG_WARNING, "Can't bind outgoing socket: %s", sockstrerror(sockerrno)); + return false; + } + + return true; +} + int setup_listen_socket(const sockaddr_t *sa) { int nfd; char *addrstr; @@ -150,7 +179,7 @@ int setup_listen_socket(const sockaddr_t *sa) { if(setsockopt(nfd, SOL_SOCKET, SO_BINDTODEVICE, (void *)&ifr, sizeof ifr)) { closesocket(nfd); logger(DEBUG_ALWAYS, LOG_ERR, "Can't bind to interface %s: %s", iface, - strerror(sockerrno)); + sockstrerror(sockerrno)); return -1; } #else @@ -218,10 +247,10 @@ int setup_vpn_in_socket(const sockaddr_t *sa) { setsockopt(nfd, SOL_SOCKET, SO_BROADCAST, (void *)&option, sizeof option); if(udp_rcvbuf && setsockopt(nfd, SOL_SOCKET, SO_RCVBUF, (void *)&udp_rcvbuf, sizeof(udp_rcvbuf))) - logger(DEBUG_ALWAYS, LOG_WARNING, "Can't set UDP SO_RCVBUF to %i: %s", udp_rcvbuf, strerror(errno)); + logger(DEBUG_ALWAYS, LOG_WARNING, "Can't set UDP SO_RCVBUF to %i: %s", udp_rcvbuf, sockstrerror(sockerrno)); if(udp_sndbuf && setsockopt(nfd, SOL_SOCKET, SO_SNDBUF, (void *)&udp_sndbuf, sizeof(udp_sndbuf))) - logger(DEBUG_ALWAYS, LOG_WARNING, "Can't set UDP SO_SNDBUF to %i: %s", udp_sndbuf, strerror(errno)); + logger(DEBUG_ALWAYS, LOG_WARNING, "Can't set UDP SO_SNDBUF to %i: %s", udp_sndbuf, sockstrerror(sockerrno)); #if defined(IPPROTO_IPV6) && defined(IPV6_V6ONLY) if(sa->sa.sa_family == AF_INET6) @@ -242,8 +271,6 @@ int setup_vpn_in_socket(const sockaddr_t *sa) { option = 1; setsockopt(nfd, IPPROTO_IP, IP_DONTFRAGMENT, (void *)&option, sizeof(option)); } -#else -#warning No way to disable IPv4 fragmentation #endif #if defined(SOL_IPV6) && defined(IPV6_MTU_DISCOVER) && defined(IPV6_PMTUDISC_DO) @@ -256,8 +283,6 @@ int setup_vpn_in_socket(const sockaddr_t *sa) { option = 1; setsockopt(nfd, IPPROTO_IPV6, IPV6_DONTFRAG, (void *)&option, sizeof(option)); } -#else -#warning No way to disable IPv6 fragmentation #endif if (!bind_to_interface(nfd)) { @@ -294,7 +319,7 @@ void retry_outgoing(outgoing_t *outgoing) { void finish_connecting(connection_t *c) { logger(DEBUG_CONNECTIONS, LOG_INFO, "Connected to %s (%s)", c->name, c->hostname); - c->last_ping_time = time(NULL); + c->last_ping_time = now.tv_sec; c->status.connecting = false; send_id(c); @@ -305,7 +330,7 @@ static void do_outgoing_pipe(connection_t *c, char *command) { int fd[2]; if(socketpair(AF_UNIX, SOCK_STREAM, 0, fd)) { - logger(DEBUG_ALWAYS, LOG_ERR, "Could not create socketpair: %s", strerror(errno)); + logger(DEBUG_ALWAYS, LOG_ERR, "Could not create socketpair: %s", sockstrerror(sockerrno)); return; } @@ -349,18 +374,21 @@ static void do_outgoing_pipe(connection_t *c, char *command) { } static void handle_meta_write(connection_t *c) { + if(c->outbuf.len <= c->outbuf.offset) + return; + ssize_t outlen = send(c->socket, c->outbuf.data + c->outbuf.offset, c->outbuf.len - c->outbuf.offset, 0); if(outlen <= 0) { - if(!errno || errno == EPIPE) { + if(!sockerrno || sockerrno == EPIPE) { logger(DEBUG_CONNECTIONS, LOG_NOTICE, "Connection closed by %s (%s)", c->name, c->hostname); } else if(sockwouldblock(sockerrno)) { logger(DEBUG_CONNECTIONS, LOG_DEBUG, "Sending %d bytes to %s (%s) would block", c->outbuf.len - c->outbuf.offset, c->name, c->hostname); return; } else { - logger(DEBUG_CONNECTIONS, LOG_ERR, "Could not send %d bytes of data to %s (%s): %s", c->outbuf.len - c->outbuf.offset, c->name, c->hostname, strerror(errno)); + logger(DEBUG_CONNECTIONS, LOG_ERR, "Could not send %d bytes of data to %s (%s): %s", c->outbuf.len - c->outbuf.offset, c->name, c->hostname, sockstrerror(sockerrno)); } - terminate_connection(c, c->status.active); + terminate_connection(c, c->edge); return; } @@ -373,19 +401,38 @@ static void handle_meta_io(void *data, int flags) { connection_t *c = data; if(c->status.connecting) { - c->status.connecting = false; - - int result; - socklen_t len = sizeof result; - getsockopt(c->socket, SOL_SOCKET, SO_ERROR, (void *)&result, &len); - - if(!result) - finish_connecting(c); - else { - logger(DEBUG_CONNECTIONS, LOG_DEBUG, "Error while connecting to %s (%s): %s", c->name, c->hostname, sockstrerror(result)); - terminate_connection(c, false); + /* + The event loop does not protect against spurious events. Verify that we are actually connected + by issuing an empty send() call. + + Note that the behavior of send() on potentially unconnected sockets differ between platforms: + +------------+-----------+-------------+-----------+ + | Event | POSIX | Linux | Windows | + +------------+-----------+-------------+-----------+ + | Spurious | ENOTCONN | EWOULDBLOCK | ENOTCONN | + | Failed | ENOTCONN | (cause) | ENOTCONN | + | Successful | (success) | (success) | (success) | + +------------+-----------+-------------+-----------+ + */ + if (send(c->socket, NULL, 0, 0) != 0) { + if (sockwouldblock(sockerrno)) + return; + int socket_error; + if (!socknotconn(sockerrno)) + socket_error = sockerrno; + else { + socklen_t len = sizeof socket_error; + getsockopt(c->socket, SOL_SOCKET, SO_ERROR, (void *)&socket_error, &len); + } + if (socket_error) { + logger(DEBUG_CONNECTIONS, LOG_DEBUG, "Error while connecting to %s (%s): %s", c->name, c->hostname, sockstrerror(socket_error)); + terminate_connection(c, false); + } return; } + + c->status.connecting = false; + finish_connecting(c); } if(flags & IO_WRITE) @@ -477,6 +524,7 @@ begin: #endif bind_to_interface(c->socket); + bind_to_address(c); } /* Connect */ @@ -501,11 +549,13 @@ begin: c->status.connecting = true; c->name = xstrdup(outgoing->name); +#ifndef DISABLE_LEGACY c->outcipher = myself->connection->outcipher; c->outdigest = myself->connection->outdigest; +#endif c->outmaclength = myself->connection->outmaclength; c->outcompression = myself->connection->outcompression; - c->last_ping_time = time(NULL); + c->last_ping_time = now.tv_sec; connection_add(c); @@ -514,6 +564,39 @@ begin: return true; } +// Find edges pointing to this node, and use them to build a list of unique, known addresses. +static struct addrinfo *get_known_addresses(node_t *n) { + struct addrinfo *ai = NULL; + + for splay_each(edge_t, e, n->edge_tree) { + if(!e->reverse) + continue; + + bool found = false; + for(struct addrinfo *aip = ai; aip; aip = aip->ai_next) { + if(!sockaddrcmp(&e->reverse->address, (sockaddr_t *)aip->ai_addr)) { + found = true; + break; + } + } + if(found) + continue; + + struct addrinfo *nai = xzalloc(sizeof *nai); + if(ai) + ai->ai_next = nai; + ai = nai; + ai->ai_family = e->reverse->address.sa.sa_family; + ai->ai_socktype = SOCK_STREAM; + ai->ai_protocol = IPPROTO_TCP; + ai->ai_addrlen = SALEN(e->reverse->address.sa); + ai->ai_addr = xmalloc(ai->ai_addrlen); + memcpy(ai->ai_addr, &e->reverse->address, ai->ai_addrlen); + } + + return ai; +} + void setup_outgoing_connection(outgoing_t *outgoing) { timeout_del(&outgoing->ev); @@ -521,9 +604,12 @@ void setup_outgoing_connection(outgoing_t *outgoing) { if(n && n->connection) { logger(DEBUG_CONNECTIONS, LOG_INFO, "Already connected to %s", outgoing->name); - - n->connection->outgoing = outgoing; - return; + if(!n->connection->outgoing) { + n->connection->outgoing = outgoing; + return; + } else { + goto remove; + } } init_configuration(&outgoing->config_tree); @@ -531,11 +617,19 @@ void setup_outgoing_connection(outgoing_t *outgoing) { outgoing->cfg = lookup_config(outgoing->config_tree, "Address"); if(!outgoing->cfg) { - logger(DEBUG_ALWAYS, LOG_ERR, "No address specified for %s", outgoing->name); - return; + if(n) + outgoing->aip = outgoing->ai = get_known_addresses(n); + if(!outgoing->ai) { + logger(DEBUG_ALWAYS, LOG_DEBUG, "No address known for %s", outgoing->name); + goto remove; + } } do_outgoing_connection(outgoing); + return; + +remove: + list_delete(outgoing_list, outgoing); } /* @@ -558,17 +652,70 @@ void handle_new_meta_connection(void *data, int flags) { sockaddrunmap(&sa); + // Check if we get many connections from the same host + + static sockaddr_t prev_sa; + static int tarpit = -1; + + if(tarpit >= 0) { + closesocket(tarpit); + tarpit = -1; + } + + if(!sockaddrcmp_noport(&sa, &prev_sa)) { + static int samehost_burst; + static int samehost_burst_time; + + if(now.tv_sec - samehost_burst_time > samehost_burst) + samehost_burst = 0; + else + samehost_burst -= now.tv_sec - samehost_burst_time; + + samehost_burst_time = now.tv_sec; + samehost_burst++; + + if(samehost_burst > max_connection_burst) { + tarpit = fd; + return; + } + } + + memcpy(&prev_sa, &sa, sizeof sa); + + // Check if we get many connections from different hosts + + static int connection_burst; + static int connection_burst_time; + + if(now.tv_sec - connection_burst_time > connection_burst) + connection_burst = 0; + else + connection_burst -= now.tv_sec - connection_burst_time; + + connection_burst_time = now.tv_sec; + connection_burst++; + + if(connection_burst >= max_connection_burst) { + connection_burst = max_connection_burst; + tarpit = fd; + return; + } + + // Accept the new connection + c = new_connection(); c->name = xstrdup(""); +#ifndef DISABLE_LEGACY c->outcipher = myself->connection->outcipher; c->outdigest = myself->connection->outdigest; +#endif c->outmaclength = myself->connection->outmaclength; c->outcompression = myself->connection->outcompression; c->address = sa; c->hostname = sockaddr2hostname(&sa); c->socket = fd; - c->last_ping_time = time(NULL); + c->last_ping_time = now.tv_sec; logger(DEBUG_CONNECTIONS, LOG_NOTICE, "Connection from %s", c->hostname); @@ -607,7 +754,7 @@ void handle_new_unix_connection(void *data, int flags) { c->address = sa; c->hostname = xstrdup("localhost port unix"); c->socket = fd; - c->last_ping_time = time(NULL); + c->last_ping_time = now.tv_sec; logger(DEBUG_CONNECTIONS, LOG_NOTICE, "Connection from %s", c->hostname); @@ -660,6 +807,11 @@ void try_outgoing_connections(void) { continue; } + if(!strcmp(name, myself->name)) { + free(name); + continue; + } + bool found = false; for list_each(outgoing_t, outgoing, outgoing_list) { @@ -671,7 +823,7 @@ void try_outgoing_connections(void) { } if(!found) { - outgoing_t *outgoing = xmalloc_and_zero(sizeof *outgoing); + outgoing_t *outgoing = xzalloc(sizeof *outgoing); outgoing->name = name; list_insert_tail(outgoing_list, outgoing); setup_outgoing_connection(outgoing); @@ -684,7 +836,7 @@ void try_outgoing_connections(void) { if(c->outgoing && c->outgoing->timeout == -1) { c->outgoing = NULL; logger(DEBUG_CONNECTIONS, LOG_INFO, "No more outgoing connection to %s", c->name); - terminate_connection(c, c->status.active); + terminate_connection(c, c->edge); } }