src/src/ip.c

   1 /*************************************************
   2 *     Exim - an Internet mail transport agent    *
   3 *************************************************/
   4
   5 /* Copyright (c) University of Cambridge 1995 - 2014 */
   6 /* See the file NOTICE for conditions of use and distribution. */
   7
   8 /* Functions for doing things with sockets. With the advent of IPv6 this has
   9 got messier, so that it's worth pulling out the code into separate functions
  10 that other parts of Exim can call, expecially as there are now several
  11 different places in the code where sockets are used. */
  12
  13
  14 #include "exim.h"
  15
  16
  17 /*************************************************
  18 *             Create a socket                    *
  19 *************************************************/
  20
  21 /* Socket creation happens in a number of places so it's packaged here for
  22 convenience.
  23
  24 Arguments:
  25   type       SOCK_DGRAM or SOCK_STREAM
  26   af         AF_INET or AF_INET6
  27
  28 Returns:     socket number or -1 on failure
  29 */
  30
  31 int
  32 ip_socket(int type, int af)
  33 {
  34 int sock = socket(af, type, 0);
  35 if (sock < 0)
  36   log_write(0, LOG_MAIN, "IPv%c socket creation failed: %s",
  37     (af == AF_INET6)? '6':'4', strerror(errno));
  38 return sock;
  39 }
  40
  41
  42
  43
  44 #if HAVE_IPV6
  45 /*************************************************
  46 *      Convert printing address to numeric       *
  47 *************************************************/
  48
  49 /* This function converts the textual form of an IP address into a numeric form
  50 in an appropriate structure in an IPv6 environment. The getaddrinfo() function
  51 can (apparently) handle more complicated addresses (e.g. those containing
  52 scopes) than inet_pton() in some environments. We use hints to tell it that the
  53 input must be a numeric address.
  54
  55 However, apparently some operating systems (or libraries) don't support
  56 getaddrinfo(), so there is a build-time option to revert to inet_pton() (which
  57 does not support scopes).
  58
  59 Arguments:
  60   address     textual form of the address
  61   addr        where to copy back the answer
  62
  63 Returns:      nothing - failure provokes a panic-die
  64 */
  65
  66 static void
  67 ip_addrinfo(const uschar *address, struct sockaddr_in6 *saddr)
  68 {
  69 #ifdef IPV6_USE_INET_PTON
  70
  71   if (inet_pton(AF_INET6, CCS address, &saddr->sin6_addr) != 1)
  72     log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to parse \"%s\" as an "
  73       "IP address", address);
  74   saddr->sin6_family = AF_INET6;
  75
  76 #else
  77
  78   int rc;
  79   struct addrinfo hints, *res;
  80   memset(&hints, 0, sizeof(hints));
  81   hints.ai_family = AF_INET6;
  82   hints.ai_socktype = SOCK_STREAM;
  83   hints.ai_flags = AI_NUMERICHOST;
  84   if ((rc = getaddrinfo(CCS address, NULL, &hints, &res)) != 0 || res == NULL)
  85     log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to parse \"%s\" as an "
  86       "IP address: %s", address,
  87       (rc == 0)? "NULL result returned" : gai_strerror(rc));
  88   memcpy(saddr, res->ai_addr, res->ai_addrlen);
  89   freeaddrinfo(res);
  90
  91 #endif
  92 }
  93 #endif  /* HAVE_IPV6 */
  94
  95
  96 /*************************************************
  97 *         Bind socket to interface and port      *
  98 *************************************************/
  99
 100 /* This function binds a socket to a local interface address and port. For a
 101 wildcard IPv6 bind, the address is ":".
 102
 103 Arguments:
 104   sock           the socket
 105   af             AF_INET or AF_INET6 - the socket type
 106   address        the IP address, in text form
 107   port           the IP port (host order)
 108
 109 Returns:         the result of bind()
 110 */
 111
 112 int
 113 ip_bind(int sock, int af, uschar *address, int port)
 114 {
 115 int s_len;
 116 union sockaddr_46 sin;
 117 memset(&sin, 0, sizeof(sin));
 118
 119 /* Setup code when using an IPv6 socket. The wildcard address is ":", to
 120 ensure an IPv6 socket is used. */
 121
 122 #if HAVE_IPV6
 123 if (af == AF_INET6)
 124   {
 125   if (address[0] == ':' && address[1] == 0)
 126     {
 127     sin.v6.sin6_family = AF_INET6;
 128     sin.v6.sin6_addr = in6addr_any;
 129     }
 130   else
 131     {
 132     ip_addrinfo(address, &sin.v6);  /* Panic-dies on error */
 133     }
 134   sin.v6.sin6_port = htons(port);
 135   s_len = sizeof(sin.v6);
 136   }
 137 else
 138 #else     /* HAVE_IPv6 */
 139 af = af;  /* Avoid compiler warning */
 140 #endif    /* HAVE_IPV6 */
 141
 142 /* Setup code when using IPv4 socket. The wildcard address is "". */
 143
 144   {
 145   sin.v4.sin_family = AF_INET;
 146   sin.v4.sin_port = htons(port);
 147   s_len = sizeof(sin.v4);
 148   if (address[0] == 0)
 149     sin.v4.sin_addr.s_addr = (S_ADDR_TYPE)INADDR_ANY;
 150   else
 151     sin.v4.sin_addr.s_addr = (S_ADDR_TYPE)inet_addr(CS address);
 152   }
 153
 154 /* Now we can call the bind() function */
 155
 156 return bind(sock, (struct sockaddr *)&sin, s_len);
 157 }
 158
 159
 160
 161 /*************************************************
 162 *        Connect socket to remote host           *
 163 *************************************************/
 164
 165 /* This function connects a socket to a remote address and port. The socket may
 166 or may not have previously been bound to a local interface. The socket is not
 167 closed, even in cases of error. It is expected that the calling function, which
 168 created the socket, will be the one that closes it.
 169
 170 Arguments:
 171   sock        the socket
 172   af          AF_INET6 or AF_INET for the socket type
 173   address     the remote address, in text form
 174   port        the remote port
 175   timeout     a timeout (zero for indefinite timeout)
 176
 177 Returns:      0 on success; -1 on failure, with errno set
 178 */
 179
 180 int
 181 ip_connect(int sock, int af, const uschar *address, int port, int timeout)
 182 {
 183 struct sockaddr_in s_in4;
 184 struct sockaddr *s_ptr;
 185 int s_len, rc, save_errno;
 186
 187 /* For an IPv6 address, use an IPv6 sockaddr structure. */
 188
 189 #if HAVE_IPV6
 190 struct sockaddr_in6 s_in6;
 191 if (af == AF_INET6)
 192   {
 193   memset(&s_in6, 0, sizeof(s_in6));
 194   ip_addrinfo(address, &s_in6);   /* Panic-dies on error */
 195   s_in6.sin6_port = htons(port);
 196   s_ptr = (struct sockaddr *)&s_in6;
 197   s_len = sizeof(s_in6);
 198   }
 199 else
 200 #else     /* HAVE_IPV6 */
 201 af = af;  /* Avoid compiler warning */
 202 #endif    /* HAVE_IPV6 */
 203
 204 /* For an IPv4 address, use an IPv4 sockaddr structure, even on a system with
 205 IPv6 support. */
 206
 207   {
 208   memset(&s_in4, 0, sizeof(s_in4));
 209   s_in4.sin_family = AF_INET;
 210   s_in4.sin_port = htons(port);
 211   s_in4.sin_addr.s_addr = (S_ADDR_TYPE)inet_addr(CCS address);
 212   s_ptr = (struct sockaddr *)&s_in4;
 213   s_len = sizeof(s_in4);
 214   }
 215
 216 /* If no connection timeout is set, just call connect() without setting a
 217 timer, thereby allowing the inbuilt OS timeout to operate. */
 218
 219 sigalrm_seen = FALSE;
 220 if (timeout > 0) alarm(timeout);
 221 rc = connect(sock, s_ptr, s_len);
 222 save_errno = errno;
 223 alarm(0);
 224
 225 /* There is a testing facility for simulating a connection timeout, as I
 226 can't think of any other way of doing this. It converts a connection refused
 227 into a timeout if the timeout is set to 999999. */
 228
 229 if (running_in_test_harness)
 230   {
 231   if (save_errno == ECONNREFUSED && timeout == 999999)
 232     {
 233     rc = -1;
 234     save_errno = EINTR;
 235     sigalrm_seen = TRUE;
 236     }
 237   }
 238
 239 /* Success */
 240
 241 if (rc >= 0) return 0;
 242
 243 /* A failure whose error code is "Interrupted system call" is in fact
 244 an externally applied timeout if the signal handler has been run. */
 245
 246 errno = (save_errno == EINTR && sigalrm_seen)? ETIMEDOUT : save_errno;
 247 return -1;
 248 }
 249
 250
 251
 252 /*************************************************
 253 *    Create connected socket to remote host      *
 254 *************************************************/
 255
 256 /* Create a socket and connect to host (name or number, ipv6 ok)
 257    at one of port-range.
 258
 259 Arguments:
 260   type          SOCK_DGRAM or SOCK_STREAM
 261   af            AF_INET6 or AF_INET for the socket type
 262   address       the remote address, in text form
 263   portlo,porthi the remote port range
 264   timeout       a timeout
 265   connhost      if not NULL, host_item filled in with connection details
 266   errstr        pointer for allocated string on error
 267
 268 Return:
 269   socket fd, or -1 on failure (having allocated an error string)
 270 */
 271 int
 272 ip_connectedsocket(int type, const uschar * hostname, int portlo, int porthi,
 273         int timeout, host_item * connhost, uschar ** errstr)
 274 {
 275 int namelen, port;
 276 host_item shost;
 277 host_item *h;
 278 int af = 0, fd, fd4 = -1, fd6 = -1;
 279
 280 shost.next = NULL;
 281 shost.address = NULL;
 282 shost.port = portlo;
 283 shost.mx = -1;
 284
 285 namelen = Ustrlen(hostname);
 286
 287 /* Anything enclosed in [] must be an IP address. */
 288
 289 if (hostname[0] == '[' &&
 290     hostname[namelen - 1] == ']')
 291   {
 292   uschar * host = string_copy(hostname);
 293   host[namelen - 1] = 0;
 294   host++;
 295   if (string_is_ip_address(host, NULL) == 0)
 296     {
 297     *errstr = string_sprintf("malformed IP address \"%s\"", hostname);
 298     return -1;
 299     }
 300   shost.name = shost.address = host;
 301   }
 302
 303 /* Otherwise check for an unadorned IP address */
 304
 305 else if (string_is_ip_address(hostname, NULL) != 0)
 306   shost.name = shost.address = string_copy(hostname);
 307
 308 /* Otherwise lookup IP address(es) from the name */
 309
 310 else
 311   {
 312   shost.name = string_copy(hostname);
 313   if (host_find_byname(&shost, NULL, HOST_FIND_QUALIFY_SINGLE, NULL,
 314       FALSE) != HOST_FOUND)
 315     {
 316     *errstr = string_sprintf("no IP address found for host %s", shost.name);
 317     return -1;
 318     }
 319   }
 320
 321 /* Try to connect to the server - test each IP till one works */
 322
 323 for (h = &shost; h != NULL; h = h->next)
 324   {
 325   fd = (Ustrchr(h->address, ':') != 0)
 326     ? (fd6 < 0) ? (fd6 = ip_socket(type, af = AF_INET6)) : fd6
 327     : (fd4 < 0) ? (fd4 = ip_socket(type, af = AF_INET )) : fd4;
 328
 329   if (fd < 0)
 330     {
 331     *errstr = string_sprintf("failed to create socket: %s", strerror(errno));
 332     goto bad;
 333     }
 334
 335   for(port = portlo; port <= porthi; port++)
 336     if (ip_connect(fd, af, h->address, port, timeout) == 0)
 337       {
 338       if (fd != fd6) close(fd6);
 339       if (fd != fd4) close(fd4);
 340       if (connhost) {
 341         h->port = port;
 342         *connhost = *h;
 343         connhost->next = NULL;
 344         }
 345       return fd;
 346       }
 347   }
 348
 349 *errstr = string_sprintf("failed to connect to any address for %s: %s",
 350   hostname, strerror(errno));
 351
 352 bad:
 353   close(fd4); close(fd6); return -1;
 354 }
 355
 356
 357 /*************************************************
 358 *         Set keepalive on a socket              *
 359 *************************************************/
 360
 361 /* Can be called for both incoming and outgoing sockets.
 362
 363 Arguments:
 364   sock       the socket
 365   address    the remote host address, for failure logging
 366   torf       true for outgoing connection, false for incoming
 367
 368 Returns:     nothing
 369 */
 370
 371 void
 372 ip_keepalive(int sock, uschar *address, BOOL torf)
 373 {
 374 int fodder = 1;
 375 if (setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
 376     (uschar *)(&fodder), sizeof(fodder)) != 0)
 377   log_write(0, LOG_MAIN, "setsockopt(SO_KEEPALIVE) on connection %s %s "
 378     "failed: %s", torf? "to":"from", address, strerror(errno));
 379 }
 380
 381
 382
 383 /*************************************************
 384 *         Receive from a socket with timeout     *
 385 *************************************************/
 386
 387 /*
 388 Arguments:
 389   fd          the file descriptor
 390   timeout     the timeout, seconds
 391 Returns:      TRUE => ready for i/o
 392               FALSE => timed out, or other error
 393 */
 394 BOOL
 395 fd_ready(int fd, int timeout)
 396 {
 397 fd_set select_inset;
 398 struct timeval tv;
 399 time_t start_recv = time(NULL);
 400 int rc;
 401
 402 if (timeout <= 0)
 403   {
 404   errno = ETIMEDOUT;
 405   return FALSE;
 406   }
 407 /* Wait until the socket is ready */
 408
 409 for (;;)
 410   {
 411   FD_ZERO (&select_inset);
 412   FD_SET (fd, &select_inset);
 413   tv.tv_sec = timeout;
 414   tv.tv_usec = 0;
 415
 416   /*DEBUG(D_transport) debug_printf("waiting for data on fd\n");*/
 417   rc = select(fd + 1, (SELECT_ARG2_TYPE *)&select_inset, NULL, NULL, &tv);
 418
 419   /* If some interrupt arrived, just retry. We presume this to be rare,
 420   but it can happen (e.g. the SIGUSR1 signal sent by exiwhat causes
 421   select() to exit).
 422
 423   Aug 2004: Somebody set up a cron job that ran exiwhat every 2 minutes, making
 424   the interrupt not at all rare. Since the timeout is typically more than 2
 425   minutes, the effect was to block the timeout completely. To prevent this
 426   happening again, we do an explicit time test. */
 427
 428   if (rc < 0 && errno == EINTR)
 429     {
 430     DEBUG(D_transport) debug_printf("EINTR while waiting for socket data\n");
 431     if (time(NULL) - start_recv < timeout) continue;
 432     DEBUG(D_transport) debug_printf("total wait time exceeds timeout\n");
 433     }
 434
 435   /* Handle a timeout, and treat any other select error as a timeout, including
 436   an EINTR when we have been in this loop for longer than timeout. */
 437
 438   if (rc <= 0)
 439     {
 440     errno = ETIMEDOUT;
 441     return FALSE;
 442     }
 443
 444   /* If the socket is ready, break out of the loop. */
 445
 446   if (FD_ISSET(fd, &select_inset)) break;
 447   }
 448 return TRUE;
 449 }
 450
 451 /* The timeout is implemented using select(), and we loop to cover select()
 452 getting interrupted, and the possibility of select() returning with a positive
 453 result but no ready descriptor. Is this in fact possible?
 454
 455 Arguments:
 456   sock        the socket
 457   buffer      to read into
 458   bufsize     the buffer size
 459   timeout     the timeout
 460
 461 Returns:      > 0 => that much data read
 462               <= 0 on error or EOF; errno set - zero for EOF
 463 */
 464
 465 int
 466 ip_recv(int sock, uschar *buffer, int buffsize, int timeout)
 467 {
 468 int rc;
 469
 470 if (!fd_ready(sock, timeout))
 471   return -1;
 472
 473 /* The socket is ready, read from it (via TLS if it's active). On EOF (i.e.
 474 close down of the connection), set errno to zero; otherwise leave it alone. */
 475
 476 #ifdef SUPPORT_TLS
 477 if (tls_out.active == sock)
 478   rc = tls_read(FALSE, buffer, buffsize);
 479 else if (tls_in.active == sock)
 480   rc = tls_read(TRUE, buffer, buffsize);
 481 else
 482 #endif
 483   rc = recv(sock, buffer, buffsize, 0);
 484
 485 if (rc > 0) return rc;
 486 if (rc == 0) errno = 0;
 487 return -1;
 488 }
 489
 490
 491
 492
 493 /*************************************************
 494 *    Lookup address family of potential socket   *
 495 *************************************************/
 496
 497 /* Given a file-descriptor, check to see if it's a socket and, if so,
 498 return the address family; detects IPv4 vs IPv6.  If not a socket then
 499 return -1.
 500
 501 The value 0 is typically AF_UNSPEC, which should not be seen on a connected
 502 fd.  If the return is -1, the errno will be from getsockname(); probably
 503 ENOTSOCK or ECONNRESET.
 504
 505 Arguments:     socket-or-not fd
 506 Returns:       address family or -1
 507 */
 508
 509 int
 510 ip_get_address_family(int fd)
 511 {
 512 struct sockaddr_storage ss;
 513 socklen_t sslen = sizeof(ss);
 514
 515 if (getsockname(fd, (struct sockaddr *) &ss, &sslen) < 0)
 516   return -1;
 517
 518 return (int) ss.ss_family;
 519 }
 520
 521
 522
 523
 524 /*************************************************
 525 *       Lookup DSCP settings for a socket        *
 526 *************************************************/
 527
 528 struct dscp_name_tableentry {
 529   const uschar *name;
 530   int value;
 531 };
 532 /* Keep both of these tables sorted! */
 533 static struct dscp_name_tableentry dscp_table[] = {
 534 #ifdef IPTOS_DSCP_AF11
 535     { CUS"af11", IPTOS_DSCP_AF11 },
 536     { CUS"af12", IPTOS_DSCP_AF12 },
 537     { CUS"af13", IPTOS_DSCP_AF13 },
 538     { CUS"af21", IPTOS_DSCP_AF21 },
 539     { CUS"af22", IPTOS_DSCP_AF22 },
 540     { CUS"af23", IPTOS_DSCP_AF23 },
 541     { CUS"af31", IPTOS_DSCP_AF31 },
 542     { CUS"af32", IPTOS_DSCP_AF32 },
 543     { CUS"af33", IPTOS_DSCP_AF33 },
 544     { CUS"af41", IPTOS_DSCP_AF41 },
 545     { CUS"af42", IPTOS_DSCP_AF42 },
 546     { CUS"af43", IPTOS_DSCP_AF43 },
 547     { CUS"ef", IPTOS_DSCP_EF },
 548 #endif
 549 #ifdef IPTOS_LOWCOST
 550     { CUS"lowcost", IPTOS_LOWCOST },
 551 #endif
 552     { CUS"lowdelay", IPTOS_LOWDELAY },
 553 #ifdef IPTOS_MINCOST
 554     { CUS"mincost", IPTOS_MINCOST },
 555 #endif
 556     { CUS"reliability", IPTOS_RELIABILITY },
 557     { CUS"throughput", IPTOS_THROUGHPUT }
 558 };
 559 static int dscp_table_size =
 560   sizeof(dscp_table) / sizeof(struct dscp_name_tableentry);
 561
 562 /* DSCP values change by protocol family, and so do the options used for
 563 setsockopt(); this utility does all the lookups.  It takes an unexpanded
 564 option string, expands it, strips off affix whitespace, then checks if it's
 565 a number.  If all of what's left is a number, then that's how the option will
 566 be parsed and success/failure is a range check.  If it's not all a number,
 567 then it must be a supported keyword.
 568
 569 Arguments:
 570   dscp_name   a string, so far unvalidated
 571   af          address_family in use
 572   level       setsockopt level to use
 573   optname     setsockopt name to use
 574   dscp_value  value for dscp_name
 575
 576 Returns: TRUE if okay to setsockopt(), else FALSE
 577
 578 *level and *optname may be set even if FALSE is returned
 579 */
 580
 581 BOOL
 582 dscp_lookup(const uschar *dscp_name, int af,
 583     int *level, int *optname, int *dscp_value)
 584 {
 585 uschar *dscp_lookup, *p;
 586 int first, last;
 587 long rawlong;
 588
 589 if (af == AF_INET)
 590   {
 591   *level = IPPROTO_IP;
 592   *optname = IP_TOS;
 593   }
 594 #if HAVE_IPV6 && defined(IPV6_TCLASS)
 595 else if (af == AF_INET6)
 596   {
 597   *level = IPPROTO_IPV6;
 598   *optname = IPV6_TCLASS;
 599   }
 600 #endif
 601 else
 602   {
 603   DEBUG(D_transport)
 604     debug_printf("Unhandled address family %d in dscp_lookup()\n", af);
 605   return FALSE;
 606   }
 607 if (!dscp_name)
 608   {
 609   DEBUG(D_transport)
 610     debug_printf("[empty DSCP]\n");
 611   return FALSE;
 612   }
 613 dscp_lookup = expand_string(US dscp_name);
 614 if (dscp_lookup == NULL || *dscp_lookup == '\0')
 615   return FALSE;
 616
 617 p = dscp_lookup + Ustrlen(dscp_lookup) - 1;
 618 while (isspace(*p)) *p-- = '\0';
 619 while (isspace(*dscp_lookup) && dscp_lookup < p) dscp_lookup++;
 620 if (*dscp_lookup == '\0')
 621   return FALSE;
 622
 623 rawlong = Ustrtol(dscp_lookup, &p, 0);
 624 if (p != dscp_lookup && *p == '\0')
 625   {
 626   /* We have six bits available, which will end up shifted to fit in 0xFC mask.
 627   RFC 2597 defines the values unshifted. */
 628   if (rawlong < 0 || rawlong > 0x3F)
 629     {
 630     DEBUG(D_transport)
 631       debug_printf("DSCP value %ld out of range, ignored.\n", rawlong);
 632     return FALSE;
 633     }
 634   *dscp_value = rawlong << 2;
 635   return TRUE;
 636   }
 637
 638 first = 0;
 639 last = dscp_table_size;
 640 while (last > first)
 641   {
 642   int middle = (first + last)/2;
 643   int c = Ustrcmp(dscp_lookup, dscp_table[middle].name);
 644   if (c == 0)
 645     {
 646     *dscp_value = dscp_table[middle].value;
 647     return TRUE;
 648     }
 649   else if (c > 0)
 650     {
 651     first = middle + 1;
 652     }
 653   else
 654     {
 655     last = middle;
 656     }
 657   }
 658 return FALSE;
 659 }
 660
 661 void
 662 dscp_list_to_stream(FILE *stream)
 663 {
 664 int i;
 665 for (i=0; i < dscp_table_size; ++i)
 666   fprintf(stream, "%s\n", dscp_table[i].name);
 667 }
 668
 669
 670 /* End of ip.c */