Adjusted formatting/conventions to conform to rest of ZT codebase

This commit is contained in:
Joseph Henry 2016-01-15 10:09:31 -08:00
parent 7cb08630d0
commit 321bca4bf7
5 changed files with 600 additions and 637 deletions

File diff suppressed because it is too large Load Diff

View File

@ -46,6 +46,8 @@
#include "netif/etharp.h"
#include "RPC.h"
struct tcp_pcb;
struct socket_st;
struct listen_st;
@ -102,44 +104,312 @@ public:
private:
// LWIP callbacks
static err_t nc_poll(void* arg, struct tcp_pcb *tpcb);
static err_t nc_accept(void *arg, struct tcp_pcb *newpcb, err_t err);
static err_t nc_recved(void *arg, struct tcp_pcb *tpcb, struct pbuf *p, err_t err);
// NOTE: these are called from within LWIP, meaning that lwipstack->_lock is ALREADY
// locked in this case!
/*
* Callback from LWIP for when a connection has been accepted and the PCB has been
* put into an ACCEPT state.
*
* A socketpair is created, one end is kept and wrapped into a PhySocket object
* for use in the main ZT I/O loop, and one end is sent to the client. The client
* is then required to tell the service what new file descriptor it has allocated
* for this connection. After the mapping is complete, the accepted socket can be
* used.
*
* @param associated service state object
* @param newly allocated PCB
* @param error code
* @return ERR_OK if everything is ok, -1 otherwise
*
* i := should be implemented in intercept lib
* I := is implemented in intercept lib
* X := is implemented in service
* ? := required treatment Unknown
* - := Not needed
*
* [ ] EAGAIN or EWOULDBLOCK - The socket is marked nonblocking and no connections are present
* to be accepted. POSIX.1-2001 allows either error to be returned for
* this case, and does not require these constants to have the same value,
* so a portable application should check for both possibilities.
* [I] EBADF - The descriptor is invalid.
* [I] ECONNABORTED - A connection has been aborted.
* [i] EFAULT - The addr argument is not in a writable part of the user address space.
* [-] EINTR - The system call was interrupted by a signal that was caught before a valid connection arrived; see signal(7).
* [I] EINVAL - Socket is not listening for connections, or addrlen is invalid (e.g., is negative).
* [I] EINVAL - (accept4()) invalid value in flags.
* [I] EMFILE - The per-process limit of open file descriptors has been reached.
* [ ] ENFILE - The system limit on the total number of open files has been reached.
* [ ] ENOBUFS, ENOMEM - Not enough free memory. This often means that the memory allocation is
* limited by the socket buffer limits, not by the system memory.
* [I] ENOTSOCK - The descriptor references a file, not a socket.
* [I] EOPNOTSUPP - The referenced socket is not of type SOCK_STREAM.
* [ ] EPROTO - Protocol error.
*
*/
static err_t nc_accept(void *arg, struct tcp_pcb *newPCB, err_t err);
/*
* Callback from LWIP for when data is available to be read from the network.
*
* Data is in the form of a linked list of struct pbufs, it is then recombined and
* send to the client over the associated unix socket.
*
* @param associated service state object
* @param allocated PCB
* @param chain of pbufs
* @param error code
* @return ERR_OK if everything is ok, -1 otherwise
*
*/
static err_t nc_recved(void *arg, struct tcp_pcb *PCB, struct pbuf *p, err_t err);
/*
* Callback from LWIP when an internal error is associtated with the given (arg)
*
* Since the PCB related to this error might no longer exist, only its perviously
* associated (arg) is provided to us.
*
* @param associated service state object
* @param error code
*
*/
static void nc_err(void *arg, err_t err);
static void nc_close(struct tcp_pcb *tpcb);
static err_t nc_send(struct tcp_pcb *tpcb);
static err_t nc_sent(void *arg, struct tcp_pcb *tpcb, u16_t len);
static err_t nc_connected(void *arg, struct tcp_pcb *tpcb, err_t err);
// RPC handlers (from NetconIntercept)
void unload_rpc(void *data, pid_t &pid, pid_t &tid,
int &rpc_count, char (timestamp[20]), char (magic[sizeof(uint64_t)]), char &cmd, void* &payload);
/*
* Callback from LWIP to do whatever work we might need to do.
*
* @param associated service state object
* @param PCB we're polling on
* @return ERR_OK if everything is ok, -1 otherwise
*
*/
static err_t nc_poll(void* arg, struct tcp_pcb *PCB);
void handle_getsockname(PhySocket *sock, PhySocket *rpcsock, void **uptr, struct getsockname_st *getsockname_rpc);
void handle_bind(PhySocket *sock, PhySocket *rpcsock, void **uptr, struct bind_st *bind_rpc);
void handle_listen(PhySocket *sock, PhySocket *rpcsock, void **uptr, struct listen_st *listen_rpc);
TcpConnection * handle_socket(PhySocket *sock, void **uptr, struct socket_st* socket_rpc);
void handle_connect(PhySocket *sock, PhySocket *rpcsock, TcpConnection *conn, struct connect_st* connect_rpc);
void handle_write(TcpConnection *conn);
/*
* Callback from LWIP to signal that 'len' bytes have successfully been sent.
* As a result, we should put our socket back into a notify-on-readability state
* since there is now room on the PCB buffer to write to.
*
* NOTE: This could be used to track the amount of data sent by a connection.
*
* @param associated service state object
* @param relevant PCB
* @param length of data sent
* @return ERR_OK if everything is ok, -1 otherwise
*
*/
static err_t nc_sent(void *arg, struct tcp_pcb *PCB, u16_t len);
int send_return_value(PhySocket *sock, int retval, int _errno);
int send_return_value(int fd, int retval, int _errno);
/*
* Callback from LWIP which sends a return value to the client to signal that
* a connection was established for this PCB
*
* @param associated service state object
* @param relevant PCB
* @param error code
* @return ERR_OK if everything is ok, -1 otherwise
*
*/
static err_t nc_connected(void *arg, struct tcp_pcb *PCB, err_t err);
//static void nc_close(struct tcp_pcb *PCB);
//static err_t nc_send(struct tcp_pcb *PCB);
/*
* Handles an RPC to bind an LWIP PCB to a given address and port
*
* @param PhySocket associated with this RPC connection
* @param structure containing the data and parameters for this client's RPC
*
i := should be implemented in intercept lib
I := is implemented in intercept lib
X := is implemented in service
? := required treatment Unknown
- := Not needed
[ ] EACCES - The address is protected, and the user is not the superuser.
[X] EADDRINUSE - The given address is already in use.
[I] EBADF - sockfd is not a valid descriptor.
[X] EINVAL - The socket is already bound to an address.
[I] ENOTSOCK - sockfd is a descriptor for a file, not a socket.
[X] ENOMEM - Insufficient kernel memory was available.
- The following errors are specific to UNIX domain (AF_UNIX) sockets:
[-] EACCES - Search permission is denied on a component of the path prefix. (See also path_resolution(7).)
[-] EADDRNOTAVAIL - A nonexistent interface was requested or the requested address was not local.
[-] EFAULT - addr points outside the user's accessible address space.
[-] EINVAL - The addrlen is wrong, or the socket was not in the AF_UNIX family.
[-] ELOOP - Too many symbolic links were encountered in resolving addr.
[-] ENAMETOOLONG - s addr is too long.
[-] ENOENT - The file does not exist.
[-] ENOTDIR - A component of the path prefix is not a directory.
[-] EROFS - The socket inode would reside on a read-only file system.
*/
void handleBind(PhySocket *sock, PhySocket *rpcsock, void **uptr, struct bind_st *bind_rpc);
/*
* Handles an RPC to put an LWIP PCB into LISTEN mode
*
* @param PhySocket associated with this RPC connection
* @param structure containing the data and parameters for this client's RPC
*
i := should be implemented in intercept lib
I := is implemented in intercept lib
X := is implemented in service
? := required treatment Unknown
- := Not needed
[?] EADDRINUSE - Another socket is already listening on the same port.
[IX] EBADF - The argument sockfd is not a valid descriptor.
[I] ENOTSOCK - The argument sockfd is not a socket.
[I] EOPNOTSUPP - The socket is not of a type that supports the listen() operation.
*/
void handleListen(PhySocket *sock, PhySocket *rpcsock, void **uptr, struct listen_st *listen_rpc);
/*
* Handles an RPC to create a socket (LWIP PCB and associated socketpair)
*
* A socketpair is created, one end is kept and wrapped into a PhySocket object
* for use in the main ZT I/O loop, and one end is sent to the client. The client
* is then required to tell the service what new file descriptor it has allocated
* for this connection. After the mapping is complete, the socket can be used.
*
* @param PhySocket associated with this RPC connection
* @param structure containing the data and parameters for this client's RPC
*
i := should be implemented in intercept lib
I := is implemented in intercept lib
X := is implemented in service
? := required treatment Unknown
- := Not needed
[-] EACCES - Permission to create a socket of the specified type and/or protocol is denied.
[I] EAFNOSUPPORT - The implementation does not support the specified address family.
[I] EINVAL - Unknown protocol, or protocol family not available.
[I] EINVAL - Invalid flags in type.
[I] EMFILE - Process file table overflow.
[?] ENFILE - The system limit on the total number of open files has been reached.
[X] ENOBUFS or ENOMEM - Insufficient memory is available. The socket cannot be created until sufficient resources are freed.
[?] EPROTONOSUPPORT - The protocol type or the specified protocol is not supported within this domain.
*/
TcpConnection * handleSocket(PhySocket *sock, void **uptr, struct socket_st* socket_rpc);
/*
* Handles an RPC to connect to a given address and port
*
* @param PhySocket associated with this RPC connection
* @param structure containing the data and parameters for this client's RPC
--- Error handling in this method will only catch problems which are immedately
apprent. Some errors will need to be caught in the nc_connected(0 callback
i := should be implemented in intercept lib
I := is implemented in intercept lib
X := is implemented in service
? := required treatment Unknown
- := Not needed
[-] EACCES - For UNIX domain sockets, which are identified by pathname: Write permission is denied ...
[?] EACCES, EPERM - The user tried to connect to a broadcast address without having the socket broadcast flag enabled ...
[X] EADDRINUSE - Local address is already in use.
[I] EAFNOSUPPORT - The passed address didn't have the correct address family in its sa_family field.
[X] EAGAIN - No more free local ports or insufficient entries in the routing cache.
[ ] EALREADY - The socket is nonblocking and a previous connection attempt has not yet been completed.
[IX] EBADF - The file descriptor is not a valid index in the descriptor table.
[ ] ECONNREFUSED - No-one listening on the remote address.
[i] EFAULT - The socket structure address is outside the user's address space.
[ ] EINPROGRESS - The socket is nonblocking and the connection cannot be completed immediately.
[-] EINTR - The system call was interrupted by a signal that was caught.
[X] EISCONN - The socket is already connected.
[X] ENETUNREACH - Network is unreachable.
[I] ENOTSOCK - The file descriptor is not associated with a socket.
[X] ETIMEDOUT - Timeout while attempting connection.
[X] EINVAL - Invalid argument, SVr4, generally makes sense to set this
*/
void handleConnect(PhySocket *sock, PhySocket *rpcsock, TcpConnection *conn, struct connect_st* connect_rpc);
/*
* Return the address that the socket is bound to
*/
void handleGetsockname(PhySocket *sock, PhySocket *rpcsock, void **uptr, struct getsockname_st *getsockname_rpc);
/*
* Writes data from the application's socket to the LWIP connection
*/
void handleWrite(TcpConnection *conn);
/*
* Sends a return value to the intercepted application
*/
int sendReturnValue(PhySocket *sock, int retval, int _errno);
int sendReturnValue(int fd, int retval, int _errno);
/*
* Unpacks the buffer from an RPC command
*/
void unloadRPC(void *data, pid_t &pid, pid_t &tid,
int &rpc_count, char (timestamp[RPC_TIMESTAMP_SZ]), char (magic[sizeof(uint64_t)]), char &cmd, void* &payload);
// Unused -- no UDP or TCP from this thread/Phy<>
void phyOnDatagram(PhySocket *sock,void **uptr,const struct sockaddr *from,void *data,unsigned long len);
void phyOnTcpConnect(PhySocket *sock,void **uptr,bool success);
void phyOnTcpAccept(PhySocket *sockL,PhySocket *sockN,void **uptrL,void **uptrN,const struct sockaddr *from);
void phyOnTcpClose(PhySocket *sock,void **uptr);
void phyOnTcpData(PhySocket *sock,void **uptr,void *data,unsigned long len);
void phyOnTcpWritable(PhySocket *sock,void **uptr);
/*
* Add a new PhySocket for the client connections
*/
void phyOnUnixAccept(PhySocket *sockL,PhySocket *sockN,void **uptrL,void **uptrN);
/*
* Signals us to close the TcpConnection associated with this PhySocket
*/
void phyOnUnixClose(PhySocket *sock,void **uptr);
/*
* Notifies us that there is data to be read from an application's socket
*/
void phyOnUnixData(PhySocket *sock,void **uptr,void *data,unsigned long len);
/*
* Notifies us that we can write to an application's socket
*/
void phyOnUnixWritable(PhySocket *sock,void **uptr);
/*
* Handles data on a application's data buffer. Data is sent to LWIP to be enqueued.
* TODO: This is a candidate for removal now that phyOnUnixData() is used for everything
*/
void phyOnFileDescriptorActivity(PhySocket *sock,void **uptr,bool readable,bool writable);
/*
* Returns a pointer to a TcpConnection associated with a given PhySocket
*/
TcpConnection *getConnection(PhySocket *sock);
void addConnection(TcpConnection *conn);
/*
* Safely adds a new TcpConnection to _TcpConnections
*/
TcpConnection *addConnection(TcpConnection *conn);
/*
* Safely removes a TcpConnection from _TcpConnections
*/
void removeConnection(TcpConnection *conn);
/*
* Closes a TcpConnection, associated LWIP PCB strcuture,
* PhySocket, and underlying file descriptor
*/
void closeConnection(PhySocket *sock);
ip_addr_t convert_ip(struct sockaddr_in * addr)
@ -157,12 +427,10 @@ private:
Phy<NetconEthernetTap *> _phy;
PhySocket *_unixListenSocket;
std::vector<TcpConnection*> tcp_connections;
std::map<PhySocket*, pid_t> pidmap;
std::vector<TcpConnection*> _TcpConnections;
std::map<uint64_t, std::pair<PhySocket*, void*> > jobmap;
pid_t rpc_counter;
pid_t rpcCounter;
netif interface;
MAC _mac;
@ -174,7 +442,7 @@ private:
Mutex _multicastGroups_m;
std::vector<InetAddress> _ips;
Mutex _ips_m, _tcpconns_m, _rx_buf_m, _tx_buf_m;
Mutex _ips_m, _tcpconns_m, _rx_buf_m;
unsigned int _mtu;
volatile bool _enabled;

View File

@ -113,22 +113,22 @@ int rpc_join(const char * sockname)
int rpc_send_command(char *path, int cmd, int forfd, void *data, int len)
{
pthread_mutex_lock(&lock);
char c, padding[] = {0, 1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89};
char cmdbuf[BUF_SZ], CANARY[TOKEN_SIZE], metabuf[BUF_SZ];
memcpy(CANARY+CANARY_SIZE, padding, sizeof(padding));
char c, padding[] = {PADDING};
char cmdbuf[BUF_SZ], CANARY[CANARY_SZ+PADDING_SZ], metabuf[BUF_SZ];
memcpy(CANARY+CANARY_SZ, padding, sizeof(padding));
uint64_t canary_num;
// ephemeral RPC socket used only for this command
int rpc_sock = rpc_join(path);
// Generate token
int fdrand = open("/dev/urandom", O_RDONLY);
if(read(fdrand, &CANARY, CANARY_SIZE) < 0) {
if(read(fdrand, &CANARY, CANARY_SZ) < 0) {
fprintf(stderr,"unable to read from /dev/urandom for RPC canary data\n");
return -1;
}
memcpy(&canary_num, CANARY, CANARY_SIZE);
memcpy(&canary_num, CANARY, CANARY_SZ);
cmdbuf[CMD_ID_IDX] = cmd;
memcpy(&cmdbuf[CANARY_IDX], &canary_num, CANARY_SIZE);
memcpy(&cmdbuf[CANARY_IDX], &canary_num, CANARY_SZ);
memcpy(&cmdbuf[STRUCT_IDX], data, len);
#ifdef VERBOSE
@ -140,7 +140,7 @@ int rpc_send_command(char *path, int cmd, int forfd, void *data, int len)
time_t timestamp;
timestamp = time(NULL);
strftime(timestring, sizeof(timestring), "%H:%M:%S", localtime(&timestamp));
memcpy(metabuf, RPC_PHRASE, RPC_PHRASE_SIZE); // Write signal phrase
memcpy(metabuf, RPC_PHRASE, RPC_PHRASE_SZ); // Write signal phrase
memcpy(&metabuf[IDX_PID], &pid, sizeof(pid_t) ); /* pid */
memcpy(&metabuf[IDX_TID], &tid, sizeof(pid_t) ); /* tid */
@ -148,7 +148,7 @@ int rpc_send_command(char *path, int cmd, int forfd, void *data, int len)
memcpy(&metabuf[IDX_TIME], &timestring, 20 ); /* timestamp */
#endif
/* Combine command flag+payload with RPC metadata */
memcpy(&metabuf[IDX_PAYLOAD], cmdbuf, len + 1 + CANARY_SIZE);
memcpy(&metabuf[IDX_PAYLOAD], cmdbuf, len + 1 + CANARY_SZ);
// Write RPC
int n_write = write(rpc_sock, &metabuf, BUF_SZ);
@ -162,7 +162,7 @@ int rpc_send_command(char *path, int cmd, int forfd, void *data, int len)
return -1;
}
if(c == 'z' && n_write > 0 && forfd > -1){
if(send(forfd, &CANARY, TOKEN_SIZE, 0) < 0) {
if(send(forfd, &CANARY, CANARY_SZ+PADDING_SZ, 0) < 0) {
fprintf(stderr,"unable to write canary to stream\n");
return -1;
}

View File

@ -3,48 +3,43 @@
#include <stdint.h>
#define CANARY_SIZE sizeof(uint64_t)
#define CANARY_PADDING_SIZE 12
#define TOKEN_SIZE CANARY_SIZE+CANARY_PADDING_SIZE
#define CANARY_SZ sizeof(uint64_t)
#define PADDING_SZ 12
#define PADDING 0, 1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89
#define RPC_PHRASE "zerotier\0"
#define RPC_PHRASE_SIZE 9
#define RPC_PHRASE "zerotier\0"
#define RPC_PHRASE_SZ 9
#define RPC_TIMESTAMP_SZ 20
// 1st RPC section (metdata)
#define IDX_SIGNAL_PHRASE 0
#define IDX_PID IDX_SIGNAL_PHRASE + RPC_PHRASE_SIZE
#define IDX_TID sizeof(pid_t) + IDX_PID
#define IDX_COUNT IDX_TID + sizeof(pid_t)
#define IDX_TIME IDX_COUNT + sizeof(int)
#define IDX_PAYLOAD IDX_TIME + 20 /* 20 being the length of the timestamp string */
#define IDX_SIGNAL_PHRASE 0
#define IDX_PID IDX_SIGNAL_PHRASE + RPC_PHRASE_SZ
#define IDX_TID sizeof(pid_t) + IDX_PID
#define IDX_COUNT IDX_TID + sizeof(pid_t)
#define IDX_TIME IDX_COUNT + sizeof(int)
#define IDX_PAYLOAD IDX_TIME + RPC_TIMESTAMP_SZ
// 2nd RPC section (payload and canary)
#define CMD_ID_IDX 0
#define CANARY_IDX 1
#define STRUCT_IDX CANARY_IDX+CANARY_SIZE
#define CMD_ID_IDX 0
#define CANARY_IDX 1
#define STRUCT_IDX CANARY_IDX+CANARY_SZ
#define BUF_SZ 512
#define BUF_SZ 512
#define ERR_OK 0
#define ERR_OK 0
/* RPC codes */
#define RPC_UNDEFINED 0
#define RPC_CONNECT 1
#define RPC_CONNECT_SOCKARG 2
#define RPC_CLOSE 3
#define RPC_READ 4
#define RPC_WRITE 5
#define RPC_BIND 6
#define RPC_ACCEPT 7
#define RPC_LISTEN 8
#define RPC_SOCKET 9
#define RPC_SHUTDOWN 10
#define RPC_GETSOCKNAME 11
/* Administration RPC codes */
#define RPC_MAP 20 /* Give the service the value we "see" for the new buffer fd */
#define RPC_MAP_REQ 21 /* A call to determine whether an fd is mapped to the service */
#define RPC_RETVAL 22 /* not RPC per se, but something we should codify */
#define RPC_KILL_INTERCEPT 23 /* Tells the service we need to shut down all connections */
#define RPC_UNDEFINED 0
#define RPC_CONNECT 1
#define RPC_CONNECT_SOCKARG 2
#define RPC_CLOSE 3
#define RPC_READ 4
#define RPC_WRITE 5
#define RPC_BIND 6
#define RPC_ACCEPT 7
#define RPC_LISTEN 8
#define RPC_SOCKET 9
#define RPC_SHUTDOWN 10
#define RPC_GETSOCKNAME 11
#define RPC_RETVAL 22
#ifdef __cplusplus
extern "C" {

View File

@ -44,11 +44,11 @@
#define DEBUG_LEVEL 0
#define MSG_WARNING 4
#define MSG_ERROR 1 // Errors
#define MSG_INFO 2 // Information which is generally useful to any user
#define MSG_DEBUG 3 // Information which is only useful to someone debugging
#define MSG_DEBUG_EXTRA 4 // If nothing in your world makes sense
#define MSG_TRANSFER 1 // RX/TX specific statements
#define MSG_ERROR 2 // Errors
#define MSG_INFO 3 // Information which is generally useful to any user
#define MSG_DEBUG 4 // Information which is only useful to someone debugging
#define MSG_DEBUG_EXTRA 5 // If nothing in your world makes sense
#ifdef NETCON_INTERCEPT