constification
[exim.git] / src / src / ip.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2014 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions for doing things with sockets. With the advent of IPv6 this has
9 got messier, so that it's worth pulling out the code into separate functions
10 that other parts of Exim can call, expecially as there are now several
11 different places in the code where sockets are used. */
12
13
14 #include "exim.h"
15
16
17 /*************************************************
18 * Create a socket *
19 *************************************************/
20
21 /* Socket creation happens in a number of places so it's packaged here for
22 convenience.
23
24 Arguments:
25 type SOCK_DGRAM or SOCK_STREAM
26 af AF_INET or AF_INET6
27
28 Returns: socket number or -1 on failure
29 */
30
31 int
32 ip_socket(int type, int af)
33 {
34 int sock = socket(af, type, 0);
35 if (sock < 0)
36 log_write(0, LOG_MAIN, "IPv%c socket creation failed: %s",
37 (af == AF_INET6)? '6':'4', strerror(errno));
38 return sock;
39 }
40
41
42
43
44 #if HAVE_IPV6
45 /*************************************************
46 * Convert printing address to numeric *
47 *************************************************/
48
49 /* This function converts the textual form of an IP address into a numeric form
50 in an appropriate structure in an IPv6 environment. The getaddrinfo() function
51 can (apparently) handle more complicated addresses (e.g. those containing
52 scopes) than inet_pton() in some environments. We use hints to tell it that the
53 input must be a numeric address.
54
55 However, apparently some operating systems (or libraries) don't support
56 getaddrinfo(), so there is a build-time option to revert to inet_pton() (which
57 does not support scopes).
58
59 Arguments:
60 address textual form of the address
61 addr where to copy back the answer
62
63 Returns: nothing - failure provokes a panic-die
64 */
65
66 static void
67 ip_addrinfo(const uschar *address, struct sockaddr_in6 *saddr)
68 {
69 #ifdef IPV6_USE_INET_PTON
70
71 if (inet_pton(AF_INET6, CCS address, &saddr->sin6_addr) != 1)
72 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to parse \"%s\" as an "
73 "IP address", address);
74 saddr->sin6_family = AF_INET6;
75
76 #else
77
78 int rc;
79 struct addrinfo hints, *res;
80 memset(&hints, 0, sizeof(hints));
81 hints.ai_family = AF_INET6;
82 hints.ai_socktype = SOCK_STREAM;
83 hints.ai_flags = AI_NUMERICHOST;
84 if ((rc = getaddrinfo(CCS address, NULL, &hints, &res)) != 0 || res == NULL)
85 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to parse \"%s\" as an "
86 "IP address: %s", address,
87 (rc == 0)? "NULL result returned" : gai_strerror(rc));
88 memcpy(saddr, res->ai_addr, res->ai_addrlen);
89 freeaddrinfo(res);
90
91 #endif
92 }
93 #endif /* HAVE_IPV6 */
94
95
96 /*************************************************
97 * Bind socket to interface and port *
98 *************************************************/
99
100 /* This function binds a socket to a local interface address and port. For a
101 wildcard IPv6 bind, the address is ":".
102
103 Arguments:
104 sock the socket
105 af AF_INET or AF_INET6 - the socket type
106 address the IP address, in text form
107 port the IP port (host order)
108
109 Returns: the result of bind()
110 */
111
112 int
113 ip_bind(int sock, int af, uschar *address, int port)
114 {
115 int s_len;
116 union sockaddr_46 sin;
117 memset(&sin, 0, sizeof(sin));
118
119 /* Setup code when using an IPv6 socket. The wildcard address is ":", to
120 ensure an IPv6 socket is used. */
121
122 #if HAVE_IPV6
123 if (af == AF_INET6)
124 {
125 if (address[0] == ':' && address[1] == 0)
126 {
127 sin.v6.sin6_family = AF_INET6;
128 sin.v6.sin6_addr = in6addr_any;
129 }
130 else
131 {
132 ip_addrinfo(address, &sin.v6); /* Panic-dies on error */
133 }
134 sin.v6.sin6_port = htons(port);
135 s_len = sizeof(sin.v6);
136 }
137 else
138 #else /* HAVE_IPv6 */
139 af = af; /* Avoid compiler warning */
140 #endif /* HAVE_IPV6 */
141
142 /* Setup code when using IPv4 socket. The wildcard address is "". */
143
144 {
145 sin.v4.sin_family = AF_INET;
146 sin.v4.sin_port = htons(port);
147 s_len = sizeof(sin.v4);
148 if (address[0] == 0)
149 sin.v4.sin_addr.s_addr = (S_ADDR_TYPE)INADDR_ANY;
150 else
151 sin.v4.sin_addr.s_addr = (S_ADDR_TYPE)inet_addr(CS address);
152 }
153
154 /* Now we can call the bind() function */
155
156 return bind(sock, (struct sockaddr *)&sin, s_len);
157 }
158
159
160
161 /*************************************************
162 * Connect socket to remote host *
163 *************************************************/
164
165 /* This function connects a socket to a remote address and port. The socket may
166 or may not have previously been bound to a local interface. The socket is not
167 closed, even in cases of error. It is expected that the calling function, which
168 created the socket, will be the one that closes it.
169
170 Arguments:
171 sock the socket
172 af AF_INET6 or AF_INET for the socket type
173 address the remote address, in text form
174 port the remote port
175 timeout a timeout (zero for indefinite timeout)
176
177 Returns: 0 on success; -1 on failure, with errno set
178 */
179
180 int
181 ip_connect(int sock, int af, const uschar *address, int port, int timeout)
182 {
183 struct sockaddr_in s_in4;
184 struct sockaddr *s_ptr;
185 int s_len, rc, save_errno;
186
187 /* For an IPv6 address, use an IPv6 sockaddr structure. */
188
189 #if HAVE_IPV6
190 struct sockaddr_in6 s_in6;
191 if (af == AF_INET6)
192 {
193 memset(&s_in6, 0, sizeof(s_in6));
194 ip_addrinfo(address, &s_in6); /* Panic-dies on error */
195 s_in6.sin6_port = htons(port);
196 s_ptr = (struct sockaddr *)&s_in6;
197 s_len = sizeof(s_in6);
198 }
199 else
200 #else /* HAVE_IPV6 */
201 af = af; /* Avoid compiler warning */
202 #endif /* HAVE_IPV6 */
203
204 /* For an IPv4 address, use an IPv4 sockaddr structure, even on a system with
205 IPv6 support. */
206
207 {
208 memset(&s_in4, 0, sizeof(s_in4));
209 s_in4.sin_family = AF_INET;
210 s_in4.sin_port = htons(port);
211 s_in4.sin_addr.s_addr = (S_ADDR_TYPE)inet_addr(CCS address);
212 s_ptr = (struct sockaddr *)&s_in4;
213 s_len = sizeof(s_in4);
214 }
215
216 /* If no connection timeout is set, just call connect() without setting a
217 timer, thereby allowing the inbuilt OS timeout to operate. */
218
219 sigalrm_seen = FALSE;
220 if (timeout > 0) alarm(timeout);
221 rc = connect(sock, s_ptr, s_len);
222 save_errno = errno;
223 alarm(0);
224
225 /* There is a testing facility for simulating a connection timeout, as I
226 can't think of any other way of doing this. It converts a connection refused
227 into a timeout if the timeout is set to 999999. */
228
229 if (running_in_test_harness)
230 {
231 if (save_errno == ECONNREFUSED && timeout == 999999)
232 {
233 rc = -1;
234 save_errno = EINTR;
235 sigalrm_seen = TRUE;
236 }
237 }
238
239 /* Success */
240
241 if (rc >= 0) return 0;
242
243 /* A failure whose error code is "Interrupted system call" is in fact
244 an externally applied timeout if the signal handler has been run. */
245
246 errno = (save_errno == EINTR && sigalrm_seen)? ETIMEDOUT : save_errno;
247 return -1;
248 }
249
250
251
252 /*************************************************
253 * Create connected socket to remote host *
254 *************************************************/
255
256 /* Create a socket and connect to host (name or number, ipv6 ok)
257 at one of port-range.
258
259 Arguments:
260 type SOCK_DGRAM or SOCK_STREAM
261 af AF_INET6 or AF_INET for the socket type
262 address the remote address, in text form
263 portlo,porthi the remote port range
264 timeout a timeout
265 connhost if not NULL, host_item filled in with connection details
266 errstr pointer for allocated string on error
267
268 Return:
269 socket fd, or -1 on failure (having allocated an error string)
270 */
271 int
272 ip_connectedsocket(int type, const uschar * hostname, int portlo, int porthi,
273 int timeout, host_item * connhost, uschar ** errstr)
274 {
275 int namelen, port;
276 host_item shost;
277 host_item *h;
278 int af = 0, fd, fd4 = -1, fd6 = -1;
279
280 shost.next = NULL;
281 shost.address = NULL;
282 shost.port = portlo;
283 shost.mx = -1;
284
285 namelen = Ustrlen(hostname);
286
287 /* Anything enclosed in [] must be an IP address. */
288
289 if (hostname[0] == '[' &&
290 hostname[namelen - 1] == ']')
291 {
292 uschar * host = string_copy(hostname);
293 host[namelen - 1] = 0;
294 host++;
295 if (string_is_ip_address(host, NULL) == 0)
296 {
297 *errstr = string_sprintf("malformed IP address \"%s\"", hostname);
298 return -1;
299 }
300 shost.name = shost.address = host;
301 }
302
303 /* Otherwise check for an unadorned IP address */
304
305 else if (string_is_ip_address(hostname, NULL) != 0)
306 shost.name = shost.address = string_copy(hostname);
307
308 /* Otherwise lookup IP address(es) from the name */
309
310 else
311 {
312 shost.name = string_copy(hostname);
313 if (host_find_byname(&shost, NULL, HOST_FIND_QUALIFY_SINGLE, NULL,
314 FALSE) != HOST_FOUND)
315 {
316 *errstr = string_sprintf("no IP address found for host %s", shost.name);
317 return -1;
318 }
319 }
320
321 /* Try to connect to the server - test each IP till one works */
322
323 for (h = &shost; h != NULL; h = h->next)
324 {
325 fd = (Ustrchr(h->address, ':') != 0)
326 ? (fd6 < 0) ? (fd6 = ip_socket(type, af = AF_INET6)) : fd6
327 : (fd4 < 0) ? (fd4 = ip_socket(type, af = AF_INET )) : fd4;
328
329 if (fd < 0)
330 {
331 *errstr = string_sprintf("failed to create socket: %s", strerror(errno));
332 goto bad;
333 }
334
335 for(port = portlo; port <= porthi; port++)
336 if (ip_connect(fd, af, h->address, port, timeout) == 0)
337 {
338 if (fd != fd6) close(fd6);
339 if (fd != fd4) close(fd4);
340 if (connhost) {
341 h->port = port;
342 *connhost = *h;
343 connhost->next = NULL;
344 }
345 return fd;
346 }
347 }
348
349 *errstr = string_sprintf("failed to connect to any address for %s: %s",
350 hostname, strerror(errno));
351
352 bad:
353 close(fd4); close(fd6); return -1;
354 }
355
356
357 int
358 ip_tcpsocket(const uschar * hostport, uschar ** errstr, int tmo)
359 {
360 int scan;
361 uschar hostname[256];
362 unsigned int portlow, porthigh;
363
364 /* extract host and port part */
365 scan = sscanf(CS hostport, "%255s %u-%u", hostname, &portlow, &porthigh);
366 if ( scan != 3 ) {
367 if ( scan != 2 ) {
368 *errstr = string_sprintf("invalid socket '%s'", hostport);
369 return -1;
370 }
371 porthigh = portlow;
372 }
373
374 return ip_connectedsocket(SOCK_STREAM, hostname, portlow, porthigh,
375 tmo, NULL, errstr);
376 }
377
378 int
379 ip_unixsocket(const uschar * path, uschar ** errstr)
380 {
381 int sock;
382 struct sockaddr_un server;
383
384 if ((sock = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
385 *errstr = US"can't open UNIX socket.";
386 return -1;
387 }
388
389 server.sun_family = AF_UNIX;
390 Ustrncpy(server.sun_path, path, sizeof(server.sun_path)-1);
391 server.sun_path[sizeof(server.sun_path)-1] = '\0';
392 if (connect(sock, (struct sockaddr *) &server, sizeof(server)) < 0) {
393 int err = errno;
394 (void)close(sock);
395 *errstr = string_sprintf("unable to connect to UNIX socket (%s): %s",
396 path, strerror(err));
397 return -1;
398 }
399 return sock;
400 }
401
402 int
403 ip_streamsocket(const uschar * spec, uschar ** errstr, int tmo)
404 {
405 return *spec == '/'
406 ? ip_unixsocket(spec, errstr) : ip_tcpsocket(spec, errstr, tmo);
407 }
408
409 /*************************************************
410 * Set keepalive on a socket *
411 *************************************************/
412
413 /* Can be called for both incoming and outgoing sockets.
414
415 Arguments:
416 sock the socket
417 address the remote host address, for failure logging
418 torf true for outgoing connection, false for incoming
419
420 Returns: nothing
421 */
422
423 void
424 ip_keepalive(int sock, const uschar *address, BOOL torf)
425 {
426 int fodder = 1;
427 if (setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
428 (uschar *)(&fodder), sizeof(fodder)) != 0)
429 log_write(0, LOG_MAIN, "setsockopt(SO_KEEPALIVE) on connection %s %s "
430 "failed: %s", torf? "to":"from", address, strerror(errno));
431 }
432
433
434
435 /*************************************************
436 * Receive from a socket with timeout *
437 *************************************************/
438
439 /*
440 Arguments:
441 fd the file descriptor
442 timeout the timeout, seconds
443 Returns: TRUE => ready for i/o
444 FALSE => timed out, or other error
445 */
446 BOOL
447 fd_ready(int fd, int timeout)
448 {
449 fd_set select_inset;
450 struct timeval tv;
451 time_t start_recv = time(NULL);
452 int rc;
453
454 if (timeout <= 0)
455 {
456 errno = ETIMEDOUT;
457 return FALSE;
458 }
459 /* Wait until the socket is ready */
460
461 for (;;)
462 {
463 FD_ZERO (&select_inset);
464 FD_SET (fd, &select_inset);
465 tv.tv_sec = timeout;
466 tv.tv_usec = 0;
467
468 /*DEBUG(D_transport) debug_printf("waiting for data on fd\n");*/
469 rc = select(fd + 1, (SELECT_ARG2_TYPE *)&select_inset, NULL, NULL, &tv);
470
471 /* If some interrupt arrived, just retry. We presume this to be rare,
472 but it can happen (e.g. the SIGUSR1 signal sent by exiwhat causes
473 select() to exit).
474
475 Aug 2004: Somebody set up a cron job that ran exiwhat every 2 minutes, making
476 the interrupt not at all rare. Since the timeout is typically more than 2
477 minutes, the effect was to block the timeout completely. To prevent this
478 happening again, we do an explicit time test. */
479
480 if (rc < 0 && errno == EINTR)
481 {
482 DEBUG(D_transport) debug_printf("EINTR while waiting for socket data\n");
483 if (time(NULL) - start_recv < timeout) continue;
484 DEBUG(D_transport) debug_printf("total wait time exceeds timeout\n");
485 }
486
487 /* Handle a timeout, and treat any other select error as a timeout, including
488 an EINTR when we have been in this loop for longer than timeout. */
489
490 if (rc <= 0)
491 {
492 errno = ETIMEDOUT;
493 return FALSE;
494 }
495
496 /* If the socket is ready, break out of the loop. */
497
498 if (FD_ISSET(fd, &select_inset)) break;
499 }
500 return TRUE;
501 }
502
503 /* The timeout is implemented using select(), and we loop to cover select()
504 getting interrupted, and the possibility of select() returning with a positive
505 result but no ready descriptor. Is this in fact possible?
506
507 Arguments:
508 sock the socket
509 buffer to read into
510 bufsize the buffer size
511 timeout the timeout
512
513 Returns: > 0 => that much data read
514 <= 0 on error or EOF; errno set - zero for EOF
515 */
516
517 int
518 ip_recv(int sock, uschar *buffer, int buffsize, int timeout)
519 {
520 int rc;
521
522 if (!fd_ready(sock, timeout))
523 return -1;
524
525 /* The socket is ready, read from it (via TLS if it's active). On EOF (i.e.
526 close down of the connection), set errno to zero; otherwise leave it alone. */
527
528 #ifdef SUPPORT_TLS
529 if (tls_out.active == sock)
530 rc = tls_read(FALSE, buffer, buffsize);
531 else if (tls_in.active == sock)
532 rc = tls_read(TRUE, buffer, buffsize);
533 else
534 #endif
535 rc = recv(sock, buffer, buffsize, 0);
536
537 if (rc > 0) return rc;
538 if (rc == 0) errno = 0;
539 return -1;
540 }
541
542
543
544
545 /*************************************************
546 * Lookup address family of potential socket *
547 *************************************************/
548
549 /* Given a file-descriptor, check to see if it's a socket and, if so,
550 return the address family; detects IPv4 vs IPv6. If not a socket then
551 return -1.
552
553 The value 0 is typically AF_UNSPEC, which should not be seen on a connected
554 fd. If the return is -1, the errno will be from getsockname(); probably
555 ENOTSOCK or ECONNRESET.
556
557 Arguments: socket-or-not fd
558 Returns: address family or -1
559 */
560
561 int
562 ip_get_address_family(int fd)
563 {
564 struct sockaddr_storage ss;
565 socklen_t sslen = sizeof(ss);
566
567 if (getsockname(fd, (struct sockaddr *) &ss, &sslen) < 0)
568 return -1;
569
570 return (int) ss.ss_family;
571 }
572
573
574
575
576 /*************************************************
577 * Lookup DSCP settings for a socket *
578 *************************************************/
579
580 struct dscp_name_tableentry {
581 const uschar *name;
582 int value;
583 };
584 /* Keep both of these tables sorted! */
585 static struct dscp_name_tableentry dscp_table[] = {
586 #ifdef IPTOS_DSCP_AF11
587 { CUS"af11", IPTOS_DSCP_AF11 },
588 { CUS"af12", IPTOS_DSCP_AF12 },
589 { CUS"af13", IPTOS_DSCP_AF13 },
590 { CUS"af21", IPTOS_DSCP_AF21 },
591 { CUS"af22", IPTOS_DSCP_AF22 },
592 { CUS"af23", IPTOS_DSCP_AF23 },
593 { CUS"af31", IPTOS_DSCP_AF31 },
594 { CUS"af32", IPTOS_DSCP_AF32 },
595 { CUS"af33", IPTOS_DSCP_AF33 },
596 { CUS"af41", IPTOS_DSCP_AF41 },
597 { CUS"af42", IPTOS_DSCP_AF42 },
598 { CUS"af43", IPTOS_DSCP_AF43 },
599 { CUS"ef", IPTOS_DSCP_EF },
600 #endif
601 #ifdef IPTOS_LOWCOST
602 { CUS"lowcost", IPTOS_LOWCOST },
603 #endif
604 { CUS"lowdelay", IPTOS_LOWDELAY },
605 #ifdef IPTOS_MINCOST
606 { CUS"mincost", IPTOS_MINCOST },
607 #endif
608 { CUS"reliability", IPTOS_RELIABILITY },
609 { CUS"throughput", IPTOS_THROUGHPUT }
610 };
611 static int dscp_table_size =
612 sizeof(dscp_table) / sizeof(struct dscp_name_tableentry);
613
614 /* DSCP values change by protocol family, and so do the options used for
615 setsockopt(); this utility does all the lookups. It takes an unexpanded
616 option string, expands it, strips off affix whitespace, then checks if it's
617 a number. If all of what's left is a number, then that's how the option will
618 be parsed and success/failure is a range check. If it's not all a number,
619 then it must be a supported keyword.
620
621 Arguments:
622 dscp_name a string, so far unvalidated
623 af address_family in use
624 level setsockopt level to use
625 optname setsockopt name to use
626 dscp_value value for dscp_name
627
628 Returns: TRUE if okay to setsockopt(), else FALSE
629
630 *level and *optname may be set even if FALSE is returned
631 */
632
633 BOOL
634 dscp_lookup(const uschar *dscp_name, int af,
635 int *level, int *optname, int *dscp_value)
636 {
637 uschar *dscp_lookup, *p;
638 int first, last;
639 long rawlong;
640
641 if (af == AF_INET)
642 {
643 *level = IPPROTO_IP;
644 *optname = IP_TOS;
645 }
646 #if HAVE_IPV6 && defined(IPV6_TCLASS)
647 else if (af == AF_INET6)
648 {
649 *level = IPPROTO_IPV6;
650 *optname = IPV6_TCLASS;
651 }
652 #endif
653 else
654 {
655 DEBUG(D_transport)
656 debug_printf("Unhandled address family %d in dscp_lookup()\n", af);
657 return FALSE;
658 }
659 if (!dscp_name)
660 {
661 DEBUG(D_transport)
662 debug_printf("[empty DSCP]\n");
663 return FALSE;
664 }
665 dscp_lookup = expand_string(US dscp_name);
666 if (dscp_lookup == NULL || *dscp_lookup == '\0')
667 return FALSE;
668
669 p = dscp_lookup + Ustrlen(dscp_lookup) - 1;
670 while (isspace(*p)) *p-- = '\0';
671 while (isspace(*dscp_lookup) && dscp_lookup < p) dscp_lookup++;
672 if (*dscp_lookup == '\0')
673 return FALSE;
674
675 rawlong = Ustrtol(dscp_lookup, &p, 0);
676 if (p != dscp_lookup && *p == '\0')
677 {
678 /* We have six bits available, which will end up shifted to fit in 0xFC mask.
679 RFC 2597 defines the values unshifted. */
680 if (rawlong < 0 || rawlong > 0x3F)
681 {
682 DEBUG(D_transport)
683 debug_printf("DSCP value %ld out of range, ignored.\n", rawlong);
684 return FALSE;
685 }
686 *dscp_value = rawlong << 2;
687 return TRUE;
688 }
689
690 first = 0;
691 last = dscp_table_size;
692 while (last > first)
693 {
694 int middle = (first + last)/2;
695 int c = Ustrcmp(dscp_lookup, dscp_table[middle].name);
696 if (c == 0)
697 {
698 *dscp_value = dscp_table[middle].value;
699 return TRUE;
700 }
701 else if (c > 0)
702 {
703 first = middle + 1;
704 }
705 else
706 {
707 last = middle;
708 }
709 }
710 return FALSE;
711 }
712
713 void
714 dscp_list_to_stream(FILE *stream)
715 {
716 int i;
717 for (i=0; i < dscp_table_size; ++i)
718 fprintf(stream, "%s\n", dscp_table[i].name);
719 }
720
721
722 /* End of ip.c */