a8230a149d64e76cab2ee76e09597fd95281fc79
[exim.git] / src / src / ip.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2016 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions for doing things with sockets. With the advent of IPv6 this has
9 got messier, so that it's worth pulling out the code into separate functions
10 that other parts of Exim can call, expecially as there are now several
11 different places in the code where sockets are used. */
12
13
14 #include "exim.h"
15
16
17 /*************************************************
18 * Create a socket *
19 *************************************************/
20
21 /* Socket creation happens in a number of places so it's packaged here for
22 convenience.
23
24 Arguments:
25 type SOCK_DGRAM or SOCK_STREAM
26 af AF_INET or AF_INET6
27
28 Returns: socket number or -1 on failure
29 */
30
31 int
32 ip_socket(int type, int af)
33 {
34 int sock = socket(af, type, 0);
35 if (sock < 0)
36 log_write(0, LOG_MAIN, "IPv%c socket creation failed: %s",
37 (af == AF_INET6)? '6':'4', strerror(errno));
38 return sock;
39 }
40
41
42
43
44 #if HAVE_IPV6
45 /*************************************************
46 * Convert printing address to numeric *
47 *************************************************/
48
49 /* This function converts the textual form of an IP address into a numeric form
50 in an appropriate structure in an IPv6 environment. The getaddrinfo() function
51 can (apparently) handle more complicated addresses (e.g. those containing
52 scopes) than inet_pton() in some environments. We use hints to tell it that the
53 input must be a numeric address.
54
55 However, apparently some operating systems (or libraries) don't support
56 getaddrinfo(), so there is a build-time option to revert to inet_pton() (which
57 does not support scopes).
58
59 Arguments:
60 address textual form of the address
61 addr where to copy back the answer
62
63 Returns: nothing - failure provokes a panic-die
64 */
65
66 static void
67 ip_addrinfo(const uschar *address, struct sockaddr_in6 *saddr)
68 {
69 #ifdef IPV6_USE_INET_PTON
70
71 if (inet_pton(AF_INET6, CCS address, &saddr->sin6_addr) != 1)
72 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to parse \"%s\" as an "
73 "IP address", address);
74 saddr->sin6_family = AF_INET6;
75
76 #else
77
78 int rc;
79 struct addrinfo hints, *res;
80 memset(&hints, 0, sizeof(hints));
81 hints.ai_family = AF_INET6;
82 hints.ai_socktype = SOCK_STREAM;
83 hints.ai_flags = AI_NUMERICHOST;
84 if ((rc = getaddrinfo(CCS address, NULL, &hints, &res)) != 0 || res == NULL)
85 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to parse \"%s\" as an "
86 "IP address: %s", address,
87 (rc == 0)? "NULL result returned" : gai_strerror(rc));
88 memcpy(saddr, res->ai_addr, res->ai_addrlen);
89 freeaddrinfo(res);
90
91 #endif
92 }
93 #endif /* HAVE_IPV6 */
94
95
96 /*************************************************
97 * Bind socket to interface and port *
98 *************************************************/
99
100 int
101 ip_addr(void * sin_, int af, const uschar * address, int port)
102 {
103 union sockaddr_46 * sin = sin_;
104 memset(sin, 0, sizeof(*sin));
105
106 /* Setup code when using an IPv6 socket. The wildcard address is ":", to
107 ensure an IPv6 socket is used. */
108
109 #if HAVE_IPV6
110 if (af == AF_INET6)
111 {
112 if (address[0] == ':' && address[1] == 0)
113 {
114 sin->v6.sin6_family = AF_INET6;
115 sin->v6.sin6_addr = in6addr_any;
116 }
117 else
118 ip_addrinfo(address, &sin->v6); /* Panic-dies on error */
119 sin->v6.sin6_port = htons(port);
120 return sizeof(sin->v6);
121 }
122 else
123 #else /* HAVE_IPv6 */
124 af = af; /* Avoid compiler warning */
125 #endif /* HAVE_IPV6 */
126
127 /* Setup code when using IPv4 socket. The wildcard address is "". */
128
129 {
130 sin->v4.sin_family = AF_INET;
131 sin->v4.sin_port = htons(port);
132 sin->v4.sin_addr.s_addr = address[0] == 0
133 ? (S_ADDR_TYPE)INADDR_ANY
134 : (S_ADDR_TYPE)inet_addr(CS address);
135 return sizeof(sin->v4);
136 }
137 }
138
139
140
141 /* This function binds a socket to a local interface address and port. For a
142 wildcard IPv6 bind, the address is ":".
143
144 Arguments:
145 sock the socket
146 af AF_INET or AF_INET6 - the socket type
147 address the IP address, in text form
148 port the IP port (host order)
149
150 Returns: the result of bind()
151 */
152
153 int
154 ip_bind(int sock, int af, uschar *address, int port)
155 {
156 union sockaddr_46 sin;
157 int s_len = ip_addr(&sin, af, address, port);
158 return bind(sock, (struct sockaddr *)&sin, s_len);
159 }
160
161
162
163 /*************************************************
164 * Connect socket to remote host *
165 *************************************************/
166
167 /* This function connects a socket to a remote address and port. The socket may
168 or may not have previously been bound to a local interface. The socket is not
169 closed, even in cases of error. It is expected that the calling function, which
170 created the socket, will be the one that closes it.
171
172 Arguments:
173 sock the socket
174 af AF_INET6 or AF_INET for the socket type
175 address the remote address, in text form
176 port the remote port
177 timeout a timeout (zero for indefinite timeout)
178 fastopen TRUE iff TCP_FASTOPEN can be used
179
180 Returns: 0 on success; -1 on failure, with errno set
181 */
182
183 int
184 ip_connect(int sock, int af, const uschar *address, int port, int timeout,
185 BOOL fastopen)
186 {
187 struct sockaddr_in s_in4;
188 struct sockaddr *s_ptr;
189 int s_len, rc, save_errno;
190
191 /* For an IPv6 address, use an IPv6 sockaddr structure. */
192
193 #if HAVE_IPV6
194 struct sockaddr_in6 s_in6;
195 if (af == AF_INET6)
196 {
197 memset(&s_in6, 0, sizeof(s_in6));
198 ip_addrinfo(address, &s_in6); /* Panic-dies on error */
199 s_in6.sin6_port = htons(port);
200 s_ptr = (struct sockaddr *)&s_in6;
201 s_len = sizeof(s_in6);
202 }
203 else
204 #else /* HAVE_IPV6 */
205 af = af; /* Avoid compiler warning */
206 #endif /* HAVE_IPV6 */
207
208 /* For an IPv4 address, use an IPv4 sockaddr structure, even on a system with
209 IPv6 support. */
210
211 {
212 memset(&s_in4, 0, sizeof(s_in4));
213 s_in4.sin_family = AF_INET;
214 s_in4.sin_port = htons(port);
215 s_in4.sin_addr.s_addr = (S_ADDR_TYPE)inet_addr(CCS address);
216 s_ptr = (struct sockaddr *)&s_in4;
217 s_len = sizeof(s_in4);
218 }
219
220 /* If no connection timeout is set, just call connect() without setting a
221 timer, thereby allowing the inbuilt OS timeout to operate. */
222
223 callout_address = string_sprintf("[%s]:%d", address, port);
224 sigalrm_seen = FALSE;
225 if (timeout > 0) alarm(timeout);
226
227 #if defined(TCP_FASTOPEN) && defined(MSG_FASTOPEN)
228 /* TCP Fast Open, if the system has a cookie from a previous call to
229 this peer, can send data in the SYN packet. The peer can send data
230 before it gets our ACK of its SYN,ACK - the latter is useful for
231 the SMTP banner. Is there any usage where the former might be?
232 We might extend the ip_connect() args for data if so. For now,
233 connect in FASTOPEN mode but with zero data.
234 */
235
236 if (fastopen)
237 {
238 if ( (rc = sendto(sock, NULL, 0, MSG_FASTOPEN, s_ptr, s_len)) < 0
239 && errno == EOPNOTSUPP
240 )
241 {
242 log_write(0, LOG_MAIN|LOG_PANIC,
243 "Tried TCP Fast Open but apparently not enabled by sysctl");
244 rc = connect(sock, s_ptr, s_len);
245 }
246 }
247 else
248 #endif
249 rc = connect(sock, s_ptr, s_len);
250
251 save_errno = errno;
252 alarm(0);
253
254 /* There is a testing facility for simulating a connection timeout, as I
255 can't think of any other way of doing this. It converts a connection refused
256 into a timeout if the timeout is set to 999999. */
257
258 if (running_in_test_harness && save_errno == ECONNREFUSED && timeout == 999999)
259 {
260 rc = -1;
261 save_errno = EINTR;
262 sigalrm_seen = TRUE;
263 }
264
265 /* Success */
266
267 if (rc >= 0)
268 return 0;
269
270 /* A failure whose error code is "Interrupted system call" is in fact
271 an externally applied timeout if the signal handler has been run. */
272
273 errno = save_errno == EINTR && sigalrm_seen ? ETIMEDOUT : save_errno;
274 return -1;
275 }
276
277
278
279 /*************************************************
280 * Create connected socket to remote host *
281 *************************************************/
282
283 /* Create a socket and connect to host (name or number, ipv6 ok)
284 at one of port-range.
285
286 Arguments:
287 type SOCK_DGRAM or SOCK_STREAM
288 af AF_INET6 or AF_INET for the socket type
289 address the remote address, in text form
290 portlo,porthi the remote port range
291 timeout a timeout
292 connhost if not NULL, host_item filled in with connection details
293 errstr pointer for allocated string on error
294
295 Return:
296 socket fd, or -1 on failure (having allocated an error string)
297 */
298 int
299 ip_connectedsocket(int type, const uschar * hostname, int portlo, int porthi,
300 int timeout, host_item * connhost, uschar ** errstr)
301 {
302 int namelen, port;
303 host_item shost;
304 host_item *h;
305 int af = 0, fd, fd4 = -1, fd6 = -1;
306
307 shost.next = NULL;
308 shost.address = NULL;
309 shost.port = portlo;
310 shost.mx = -1;
311
312 namelen = Ustrlen(hostname);
313
314 /* Anything enclosed in [] must be an IP address. */
315
316 if (hostname[0] == '[' &&
317 hostname[namelen - 1] == ']')
318 {
319 uschar * host = string_copyn(hostname+1, namelen-2);
320 if (string_is_ip_address(host, NULL) == 0)
321 {
322 *errstr = string_sprintf("malformed IP address \"%s\"", hostname);
323 return -1;
324 }
325 shost.name = shost.address = host;
326 }
327
328 /* Otherwise check for an unadorned IP address */
329
330 else if (string_is_ip_address(hostname, NULL) != 0)
331 shost.name = shost.address = string_copyn(hostname, namelen);
332
333 /* Otherwise lookup IP address(es) from the name */
334
335 else
336 {
337 shost.name = string_copyn(hostname, namelen);
338 if (host_find_byname(&shost, NULL, HOST_FIND_QUALIFY_SINGLE,
339 NULL, FALSE) != HOST_FOUND)
340 {
341 *errstr = string_sprintf("no IP address found for host %s", shost.name);
342 return -1;
343 }
344 }
345
346 /* Try to connect to the server - test each IP till one works */
347
348 for (h = &shost; h; h = h->next)
349 {
350 fd = Ustrchr(h->address, ':') != 0
351 ? fd6 < 0 ? (fd6 = ip_socket(type, af = AF_INET6)) : fd6
352 : fd4 < 0 ? (fd4 = ip_socket(type, af = AF_INET )) : fd4;
353
354 if (fd < 0)
355 {
356 *errstr = string_sprintf("failed to create socket: %s", strerror(errno));
357 goto bad;
358 }
359
360 for(port = portlo; port <= porthi; port++)
361 if (ip_connect(fd, af, h->address, port, timeout, type == SOCK_STREAM) == 0)
362 {
363 if (fd != fd6) close(fd6);
364 if (fd != fd4) close(fd4);
365 if (connhost)
366 {
367 h->port = port;
368 *connhost = *h;
369 connhost->next = NULL;
370 }
371 return fd;
372 }
373 }
374
375 *errstr = string_sprintf("failed to connect to any address for %s: %s",
376 hostname, strerror(errno));
377
378 bad:
379 close(fd4); close(fd6); return -1;
380 }
381
382
383 int
384 ip_tcpsocket(const uschar * hostport, uschar ** errstr, int tmo)
385 {
386 int scan;
387 uschar hostname[256];
388 unsigned int portlow, porthigh;
389
390 /* extract host and port part */
391 scan = sscanf(CS hostport, "%255s %u-%u", hostname, &portlow, &porthigh);
392 if (scan != 3)
393 {
394 if (scan != 2)
395 {
396 *errstr = string_sprintf("invalid socket '%s'", hostport);
397 return -1;
398 }
399 porthigh = portlow;
400 }
401
402 return ip_connectedsocket(SOCK_STREAM, hostname, portlow, porthigh,
403 tmo, NULL, errstr);
404 }
405
406 int
407 ip_unixsocket(const uschar * path, uschar ** errstr)
408 {
409 int sock;
410 struct sockaddr_un server;
411
412 if ((sock = socket(AF_UNIX, SOCK_STREAM, 0)) < 0)
413 {
414 *errstr = US"can't open UNIX socket.";
415 return -1;
416 }
417
418 callout_address = string_copy(path);
419 server.sun_family = AF_UNIX;
420 Ustrncpy(server.sun_path, path, sizeof(server.sun_path)-1);
421 server.sun_path[sizeof(server.sun_path)-1] = '\0';
422 if (connect(sock, (struct sockaddr *) &server, sizeof(server)) < 0)
423 {
424 int err = errno;
425 (void)close(sock);
426 *errstr = string_sprintf("unable to connect to UNIX socket (%s): %s",
427 path, strerror(err));
428 return -1;
429 }
430 return sock;
431 }
432
433 int
434 ip_streamsocket(const uschar * spec, uschar ** errstr, int tmo)
435 {
436 return *spec == '/'
437 ? ip_unixsocket(spec, errstr) : ip_tcpsocket(spec, errstr, tmo);
438 }
439
440 /*************************************************
441 * Set keepalive on a socket *
442 *************************************************/
443
444 /* Can be called for both incoming and outgoing sockets.
445
446 Arguments:
447 sock the socket
448 address the remote host address, for failure logging
449 torf true for outgoing connection, false for incoming
450
451 Returns: nothing
452 */
453
454 void
455 ip_keepalive(int sock, const uschar *address, BOOL torf)
456 {
457 int fodder = 1;
458 if (setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
459 (uschar *)(&fodder), sizeof(fodder)) != 0)
460 log_write(0, LOG_MAIN, "setsockopt(SO_KEEPALIVE) on connection %s %s "
461 "failed: %s", torf? "to":"from", address, strerror(errno));
462 }
463
464
465
466 /*************************************************
467 * Receive from a socket with timeout *
468 *************************************************/
469
470 /*
471 Arguments:
472 fd the file descriptor
473 timeout the timeout, seconds
474 Returns: TRUE => ready for i/o
475 FALSE => timed out, or other error
476 */
477 BOOL
478 fd_ready(int fd, int timeout)
479 {
480 fd_set select_inset;
481 time_t start_recv = time(NULL);
482 int time_left = timeout;
483 int rc;
484
485 if (time_left <= 0)
486 {
487 errno = ETIMEDOUT;
488 return FALSE;
489 }
490 /* Wait until the socket is ready */
491
492 do
493 {
494 struct timeval tv = { time_left, 0 };
495 FD_ZERO (&select_inset);
496 FD_SET (fd, &select_inset);
497
498 /*DEBUG(D_transport) debug_printf("waiting for data on fd\n");*/
499 rc = select(fd + 1, (SELECT_ARG2_TYPE *)&select_inset, NULL, NULL, &tv);
500
501 /* If some interrupt arrived, just retry. We presume this to be rare,
502 but it can happen (e.g. the SIGUSR1 signal sent by exiwhat causes
503 select() to exit).
504
505 Aug 2004: Somebody set up a cron job that ran exiwhat every 2 minutes, making
506 the interrupt not at all rare. Since the timeout is typically more than 2
507 minutes, the effect was to block the timeout completely. To prevent this
508 happening again, we do an explicit time test and adjust the timeout
509 accordingly */
510
511 if (rc < 0 && errno == EINTR)
512 {
513 DEBUG(D_transport) debug_printf("EINTR while waiting for socket data\n");
514
515 /* Watch out, 'continue' jumps to the condition, not to the loops top */
516 time_left = timeout - (time(NULL) - start_recv);
517 if (time_left > 0) continue;
518 }
519
520 if (rc <= 0)
521 {
522 errno = ETIMEDOUT;
523 return FALSE;
524 }
525
526 /* Checking the FD_ISSET is not enough, if we're interrupted, the
527 select_inset may still contain the 'input'. */
528 }
529 while (rc < 0 || !FD_ISSET(fd, &select_inset));
530 return TRUE;
531 }
532
533 /* The timeout is implemented using select(), and we loop to cover select()
534 getting interrupted, and the possibility of select() returning with a positive
535 result but no ready descriptor. Is this in fact possible?
536
537 Arguments:
538 sock the socket
539 buffer to read into
540 bufsize the buffer size
541 timeout the timeout
542
543 Returns: > 0 => that much data read
544 <= 0 on error or EOF; errno set - zero for EOF
545 */
546
547 int
548 ip_recv(int sock, uschar *buffer, int buffsize, int timeout)
549 {
550 int rc;
551
552 if (!fd_ready(sock, timeout))
553 return -1;
554
555 /* The socket is ready, read from it (via TLS if it's active). On EOF (i.e.
556 close down of the connection), set errno to zero; otherwise leave it alone. */
557
558 #ifdef SUPPORT_TLS
559 if (tls_out.active == sock)
560 rc = tls_read(FALSE, buffer, buffsize);
561 else if (tls_in.active == sock)
562 rc = tls_read(TRUE, buffer, buffsize);
563 else
564 #endif
565 rc = recv(sock, buffer, buffsize, 0);
566
567 if (rc > 0) return rc;
568 if (rc == 0) errno = 0;
569 return -1;
570 }
571
572
573
574
575 /*************************************************
576 * Lookup address family of potential socket *
577 *************************************************/
578
579 /* Given a file-descriptor, check to see if it's a socket and, if so,
580 return the address family; detects IPv4 vs IPv6. If not a socket then
581 return -1.
582
583 The value 0 is typically AF_UNSPEC, which should not be seen on a connected
584 fd. If the return is -1, the errno will be from getsockname(); probably
585 ENOTSOCK or ECONNRESET.
586
587 Arguments: socket-or-not fd
588 Returns: address family or -1
589 */
590
591 int
592 ip_get_address_family(int fd)
593 {
594 struct sockaddr_storage ss;
595 socklen_t sslen = sizeof(ss);
596
597 if (getsockname(fd, (struct sockaddr *) &ss, &sslen) < 0)
598 return -1;
599
600 return (int) ss.ss_family;
601 }
602
603
604
605
606 /*************************************************
607 * Lookup DSCP settings for a socket *
608 *************************************************/
609
610 struct dscp_name_tableentry {
611 const uschar *name;
612 int value;
613 };
614 /* Keep both of these tables sorted! */
615 static struct dscp_name_tableentry dscp_table[] = {
616 #ifdef IPTOS_DSCP_AF11
617 { CUS"af11", IPTOS_DSCP_AF11 },
618 { CUS"af12", IPTOS_DSCP_AF12 },
619 { CUS"af13", IPTOS_DSCP_AF13 },
620 { CUS"af21", IPTOS_DSCP_AF21 },
621 { CUS"af22", IPTOS_DSCP_AF22 },
622 { CUS"af23", IPTOS_DSCP_AF23 },
623 { CUS"af31", IPTOS_DSCP_AF31 },
624 { CUS"af32", IPTOS_DSCP_AF32 },
625 { CUS"af33", IPTOS_DSCP_AF33 },
626 { CUS"af41", IPTOS_DSCP_AF41 },
627 { CUS"af42", IPTOS_DSCP_AF42 },
628 { CUS"af43", IPTOS_DSCP_AF43 },
629 { CUS"ef", IPTOS_DSCP_EF },
630 #endif
631 #ifdef IPTOS_LOWCOST
632 { CUS"lowcost", IPTOS_LOWCOST },
633 #endif
634 { CUS"lowdelay", IPTOS_LOWDELAY },
635 #ifdef IPTOS_MINCOST
636 { CUS"mincost", IPTOS_MINCOST },
637 #endif
638 { CUS"reliability", IPTOS_RELIABILITY },
639 { CUS"throughput", IPTOS_THROUGHPUT }
640 };
641 static int dscp_table_size =
642 sizeof(dscp_table) / sizeof(struct dscp_name_tableentry);
643
644 /* DSCP values change by protocol family, and so do the options used for
645 setsockopt(); this utility does all the lookups. It takes an unexpanded
646 option string, expands it, strips off affix whitespace, then checks if it's
647 a number. If all of what's left is a number, then that's how the option will
648 be parsed and success/failure is a range check. If it's not all a number,
649 then it must be a supported keyword.
650
651 Arguments:
652 dscp_name a string, so far unvalidated
653 af address_family in use
654 level setsockopt level to use
655 optname setsockopt name to use
656 dscp_value value for dscp_name
657
658 Returns: TRUE if okay to setsockopt(), else FALSE
659
660 *level and *optname may be set even if FALSE is returned
661 */
662
663 BOOL
664 dscp_lookup(const uschar *dscp_name, int af,
665 int *level, int *optname, int *dscp_value)
666 {
667 uschar *dscp_lookup, *p;
668 int first, last;
669 long rawlong;
670
671 if (af == AF_INET)
672 {
673 *level = IPPROTO_IP;
674 *optname = IP_TOS;
675 }
676 #if HAVE_IPV6 && defined(IPV6_TCLASS)
677 else if (af == AF_INET6)
678 {
679 *level = IPPROTO_IPV6;
680 *optname = IPV6_TCLASS;
681 }
682 #endif
683 else
684 {
685 DEBUG(D_transport)
686 debug_printf("Unhandled address family %d in dscp_lookup()\n", af);
687 return FALSE;
688 }
689 if (!dscp_name)
690 {
691 DEBUG(D_transport)
692 debug_printf("[empty DSCP]\n");
693 return FALSE;
694 }
695 dscp_lookup = expand_string(US dscp_name);
696 if (dscp_lookup == NULL || *dscp_lookup == '\0')
697 return FALSE;
698
699 p = dscp_lookup + Ustrlen(dscp_lookup) - 1;
700 while (isspace(*p)) *p-- = '\0';
701 while (isspace(*dscp_lookup) && dscp_lookup < p) dscp_lookup++;
702 if (*dscp_lookup == '\0')
703 return FALSE;
704
705 rawlong = Ustrtol(dscp_lookup, &p, 0);
706 if (p != dscp_lookup && *p == '\0')
707 {
708 /* We have six bits available, which will end up shifted to fit in 0xFC mask.
709 RFC 2597 defines the values unshifted. */
710 if (rawlong < 0 || rawlong > 0x3F)
711 {
712 DEBUG(D_transport)
713 debug_printf("DSCP value %ld out of range, ignored.\n", rawlong);
714 return FALSE;
715 }
716 *dscp_value = rawlong << 2;
717 return TRUE;
718 }
719
720 first = 0;
721 last = dscp_table_size;
722 while (last > first)
723 {
724 int middle = (first + last)/2;
725 int c = Ustrcmp(dscp_lookup, dscp_table[middle].name);
726 if (c == 0)
727 {
728 *dscp_value = dscp_table[middle].value;
729 return TRUE;
730 }
731 else if (c > 0)
732 first = middle + 1;
733 else
734 last = middle;
735 }
736 return FALSE;
737 }
738
739 void
740 dscp_list_to_stream(FILE *stream)
741 {
742 int i;
743 for (i=0; i < dscp_table_size; ++i)
744 fprintf(stream, "%s\n", dscp_table[i].name);
745 }
746
747
748 /* End of ip.c */
749 /* vi: aw ai sw=2
750 */