2 * Amanda, The Advanced Maryland Automatic Network Disk Archiver
3 * Copyright (c) 1991-1999 University of Maryland at College Park
6 * Permission to use, copy, modify, distribute, and sell this software and its
7 * documentation for any purpose is hereby granted without fee, provided that
8 * the above copyright notice appear in all copies and that both that
9 * copyright notice and this permission notice appear in supporting
10 * documentation, and that the name of U.M. not be used in advertising or
11 * publicity pertaining to distribution of the software without specific,
12 * written prior permission. U.M. makes no representations about the
13 * suitability of this software for any purpose. It is provided "as is"
14 * without express or implied warranty.
16 * U.M. DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL U.M.
18 * BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
19 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
20 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
21 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23 * Authors: the Amanda Development Team. Its members are listed in a
24 * file named AUTHORS, in the root directory of this distribution.
27 * $Id: bsdudp-security.c,v 1.7 2006/07/05 13:18:20 martinea Exp $
29 * "BSD" security module
39 #include "security-util.h"
43 #undef DUMPER_SOCKET_BUFFERING
49 static void bsdudp_connect(const char *,
50 char *(*)(char *, void *),
51 void (*)(void *, security_handle_t *, security_status_t), void *, void *);
52 static void bsdudp_accept(const struct security_driver *,
53 char *(*)(char *, void *),
55 void (*)(security_handle_t *, pkt_t *),
57 static void bsdudp_close(void *);
60 * This is our interface to the outside world
62 const security_driver_t bsdudp_security_driver = {
66 sec_get_authenticated_peer_name_hostname,
79 tcpm_stream_read_sync,
80 tcpm_stream_read_cancel,
81 sec_close_connection_none,
87 * This is data local to the datagram socket. We have one datagram
88 * per process, so it is global.
90 static udp_handle_t netfd4;
91 static udp_handle_t netfd6;
92 static int not_init4 = 1;
93 static int not_init6 = 1;
95 /* generate new handles from here */
96 static unsigned int newhandle = 0;
99 * Setup and return a handle outgoing to a client
103 const char *hostname,
104 char * (*conf_fn)(char *, void *),
105 void (*fn)(void *, security_handle_t *, security_status_t),
109 struct sec_handle *bh;
111 struct timeval sequence_time;
116 struct addrinfo *res = NULL, *res_addr;
120 (void)conf_fn; /* Quiet unused parameter warning */
121 (void)datap; /* Quiet unused parameter warning */
122 assert(hostname != NULL);
124 bh = g_new0(struct sec_handle, 1);
125 bh->proto_handle=NULL;
127 security_handleinit(&bh->sech, &bsdudp_security_driver);
129 result = resolve_hostname(hostname, SOCK_DGRAM, &res, &canonname);
131 dbprintf(_("resolve_hostname(%s): %s\n"), hostname, gai_strerror(result));
132 security_seterror(&bh->sech, _("resolve_hostname(%s): %s\n"), hostname,
133 gai_strerror(result));
134 (*fn)(arg, &bh->sech, S_ERROR);
137 if (canonname == NULL) {
138 dbprintf(_("resolve_hostname(%s) did not return a canonical name\n"), hostname);
139 security_seterror(&bh->sech,
140 _("resolve_hostname(%s) did not return a canonical name\n"), hostname);
141 (*fn)(arg, &bh->sech, S_ERROR);
145 dbprintf(_("resolve_hostname(%s): no results\n"), hostname);
146 security_seterror(&bh->sech,
147 _("resolve_hostname(%s): no results\n"), hostname);
148 (*fn)(arg, &bh->sech, S_ERROR);
153 for (res_addr = res; res_addr != NULL; res_addr = res_addr->ai_next) {
155 /* IPv6 socket already bound */
156 if (res_addr->ai_addr->sa_family == AF_INET6 && not_init6 == 0) {
160 * Only init the IPv6 socket once
162 if (res_addr->ai_addr->sa_family == AF_INET6 && not_init6 == 1) {
164 dgram_zero(&netfd6.dgram);
168 result_bind = dgram_bind(&netfd6.dgram,
169 res_addr->ai_addr->sa_family, &port);
171 if (result_bind != 0) {
174 netfd6.handle = NULL;
175 netfd6.pkt.body = NULL;
176 netfd6.recv_security_ok = &bsd_recv_security_ok;
177 netfd6.prefix_packet = &bsd_prefix_packet;
179 * We must have a reserved port. Bomb if we didn't get one.
181 if (port >= IPPORT_RESERVED) {
182 security_seterror(&bh->sech,
183 _("unable to bind to a reserved port (got port %u)"),
185 (*fn)(arg, &bh->sech, S_ERROR);
196 /* IPv4 socket already bound */
197 if (res_addr->ai_addr->sa_family == AF_INET && not_init4 == 0) {
202 * Only init the IPv4 socket once
204 if (res_addr->ai_addr->sa_family == AF_INET && not_init4 == 1) {
206 dgram_zero(&netfd4.dgram);
210 result_bind = dgram_bind(&netfd4.dgram,
211 res_addr->ai_addr->sa_family, &port);
213 if (result_bind != 0) {
216 netfd4.handle = NULL;
217 netfd4.pkt.body = NULL;
218 netfd4.recv_security_ok = &bsd_recv_security_ok;
219 netfd4.prefix_packet = &bsd_prefix_packet;
221 * We must have a reserved port. Bomb if we didn't get one.
223 if (port >= IPPORT_RESERVED) {
224 security_seterror(&bh->sech,
225 "unable to bind to a reserved port (got port %u)",
227 (*fn)(arg, &bh->sech, S_ERROR);
238 if (res_addr == NULL) {
239 dbprintf(_("Can't bind a socket to connect to %s\n"), hostname);
240 security_seterror(&bh->sech,
241 _("Can't bind a socket to connect to %s\n"), hostname);
242 (*fn)(arg, &bh->sech, S_ERROR);
248 if (res_addr->ai_addr->sa_family == AF_INET6)
254 auth_debug(1, _("Resolved hostname=%s\n"), canonname);
256 service = conf_fn("client_port", datap);
257 if (!service || strlen(service) <= 1)
262 port = find_port_for_service(service, "udp");
264 security_seterror(&bh->sech, _("%s/udp unknown protocol"), service);
265 (*fn)(arg, &bh->sech, S_ERROR);
270 amanda_gettimeofday(&sequence_time);
271 sequence = (int)sequence_time.tv_sec ^ (int)sequence_time.tv_usec;
273 g_snprintf(handle,14,"000-%08x", newhandle++);
274 if (udp_inithandle(bh->udp, bh, canonname,
275 (sockaddr_union *)res_addr->ai_addr, port,
276 handle, sequence) < 0) {
277 (*fn)(arg, &bh->sech, S_ERROR);
278 amfree(bh->hostname);
281 (*fn)(arg, &bh->sech, S_OK);
286 if (res) freeaddrinfo(res);
290 * Setup to accept new incoming connections
294 const struct security_driver *driver,
295 char * (*conf_fn)(char *, void *),
298 void (*fn)(security_handle_t *, pkt_t *),
301 (void)driver; /* Quiet unused parameter warning */
302 (void)out; /* Quiet unused parameter warning */
306 assert(in >= 0 && out >= 0);
310 * We assume in and out point to the same socket, and just use
313 dgram_socket(&netfd4.dgram, in);
314 dgram_socket(&netfd6.dgram, in);
317 * Assign the function and return. When they call recvpkt later,
318 * the recvpkt callback will call this function when it discovers
319 * new incoming connections
321 netfd4.accept_fn = fn;
322 netfd4.recv_security_ok = &bsd_recv_security_ok;
323 netfd4.prefix_packet = &bsd_prefix_packet;
324 netfd4.driver = &bsdudp_security_driver;
327 udp_addref(&netfd4, &udp_netfd_read_callback);
331 * Frees a handle allocated by the above
337 struct sec_handle *bh = cookie;
339 if(bh->proto_handle == NULL) {
343 auth_debug(1, _("bsdudp: close handle '%s'\n"), bh->proto_handle);
345 udp_recvpkt_cancel(bh);
347 bh->next->prev = bh->prev;
350 if (!not_init6 && netfd6.bh_last == bh)
351 netfd6.bh_last = bh->prev;
353 netfd4.bh_last = bh->prev;
356 bh->prev->next = bh->next;
359 if (!not_init6 && netfd6.bh_first == bh)
360 netfd6.bh_first = bh->next;
362 netfd4.bh_first = bh->next;
365 amfree(bh->proto_handle);
366 amfree(bh->hostname);