emo
/
ndhc
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
ndhc/arp.c

760 lines
25 KiB
C
Raw Permalink Normal View History

Relicense as MIT. It's a lot more common than BSD 2-clause it is both compatible and nearly identical in effect.
2022-02-07 06:35:29 +05:30
// Copyright 2010-2018 Nicholas J. Kain <njkain at gmail dot com>
// SPDX-License-Identifier: MIT
Have sockd apply BPF filters to ARP sockets.
2014-04-06 07:09:27 +05:30
#include <stdbool.h>
Make sure our assigned address is unique on our segment by using arp.
2010-11-16 06:36:50 +05:30
#include <unistd.h>
Move timeout and arp handling code out to arpping.c and timeout.c.
2010-12-24 20:02:58 +05:30
#include <stdlib.h>
Make sure our assigned address is unique on our segment by using arp.
2010-11-16 06:36:50 +05:30
#include <string.h>
Rather than use a single cs.timeout value, track individual timeouts for every ARP state and for the current DHCP state.
2011-07-11 20:09:36 +05:30
#include <limits.h>
Make sure our assigned address is unique on our segment by using arp.
2010-11-16 06:36:50 +05:30
#include <netinet/if_ether.h>
Move timeout and arp handling code out to arpping.c and timeout.c.
2010-12-24 20:02:58 +05:30
#include <arpa/inet.h>
Rewrite the ARP ping code to properly use modern interfaces. In detail: - Use AF_PACKET and SOCK_RAW rather than the decade-deprecated SOCK_PACKET interface. - Separate out socket creation code into a subfunction. - Use C99 initializers for packet and address structures. - Cosmetic cleanups.
2011-06-25 22:32:56 +05:30
#include <linux/if_packet.h>
Define a BPF for ARP-listening raw sockets that discriminates by ethernet frame protocol type field, ARP hardware type field, ARP protocol type field, ARP hardware address length field, and ARP protocol address length field.
2011-07-01 10:25:35 +05:30
#include <linux/filter.h>
Make sure our assigned address is unique on our segment by using arp.
2010-11-16 06:36:50 +05:30
#include <errno.h>
Update to latest ncmlib changes.
2014-03-31 02:32:48 +05:30
#include "nk/log.h"
#include "nk/io.h"
Rename arpping.[ch] to arp.[ch].
2010-12-24 20:28:47 +05:30
#include "arp.h"
Centralize DHCP timeout, packet reciept, and user-demanded action handling into state.[ch]. Remove timeout.c.
2011-06-30 09:17:31 +05:30
#include "state.h"
Rename packet.[ch] to dhcp.[ch].
2011-07-02 13:21:44 +05:30
#include "dhcp.h"
Move timeout and arp handling code out to arpping.c and timeout.c.
2010-12-24 20:02:58 +05:30
#include "sys.h"
Rename script.[ch] to ifchange.[ch].
2010-12-24 20:42:41 +05:30
#include "ifchange.h"
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
#include "options.h"
Add support for writing lease files.
2011-04-20 02:07:43 +05:30
#include "leasefile.h"
Introduce a ndhc-sockd daemon that separates out the remaining elevated capabilities from the ndhc master process. Privsep is now complete. The only notable improvement from before is that exploitation of ndhc would only allow an attacker to open raw sockets, bind sockets to ports < port 1024, and create broadcast sockets on the interface that ndhc is performing dhcp on rather than on all interfaces. However, this seems like a worthwhile change; note that it was already impossible for an attacker to sniff packets on any interfaces (as that requires CAP_NET_ADMIN, which was always separated to ifch).
2014-04-04 13:42:25 +05:30
#include "sockd.h"
Add error handling for un-notified carrier downs when sending packets. If a packet send failed because the carrier went down without a netlink notification, then assume the hardware carrier was lost while the machine was suspended (eg, ethernet cable pulled during suspend). Simulate a netlink carrier down event and freeze the dhcp state machine until a netlink carrier up event is received. The ARP code is not yet handling this issue everywhere, but the window of opportunity for it to happen there is much shorter.
2015-02-14 15:50:04 +05:30
#include "netlink.h"
Make sure our assigned address is unique on our segment by using arp.
2010-11-16 06:36:50 +05:30
Make arp code more robust and refactor it a bit. Handle failure to create arp sockets more gracefully. Add initial support for retransmitting arp requests if no reply is met after a certain number of spurious packets.
2011-03-31 12:02:34 +05:30
#define ARP_MSG_SIZE 0x2a
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
#define ARP_RETRANS_DELAY 5000 // ms
Give up on fingerprinting relay agent/server if it doesn't reply. Try to send/wait three times; then if there's no response, then assume that the relay agent is ignoring or firewalled from receiving ARP requests.
2020-10-19 12:37:23 +05:30
#define ARP_MAX_TRIES 3
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
Enable active defense of IP address / lease, as described in RFC5227.
2011-07-05 22:33:55 +05:30
// From RFC5227
Build with -Wstrict-overflow=5 and fix revealed warnings. Some of these are actual bugs, but none are security-sensitive.
2022-08-10 21:02:30 +05:30
unsigned arp_probe_wait = 1000; // initial random delay (ms)
unsigned arp_probe_num = 3; // number of probe packets
unsigned arp_probe_min = 1000; // minimum delay until repeated probe (ms)
unsigned arp_probe_max = 2000; // maximum delay until repeated probe (ms)
Enable active defense of IP address / lease, as described in RFC5227.
2011-07-05 22:33:55 +05:30
#define ANNOUNCE_WAIT 2000 // delay before announcing
#define ANNOUNCE_NUM 2 // number of Announcement packets
#define ANNOUNCE_INTERVAL 2000 // time between Announcement packets
#define MAX_CONFLICTS 10 // max conflicts before rate-limiting
#define RATE_LIMIT_INTERVAL 60000 // delay between successive attempts
#define DEFEND_INTERVAL 10000 // minimum interval between defensive ARPs
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
static struct arp_data garp = {
arp: Handle initial gateway query asynchronously and retry failures. The gateway/router MAC fingerprinting could perhaps be done more robustly in the face of suspend or carrier loss, but the time window in which things could get confused is very small and I would rather just rely on supervisor respawn in that case. Even this case I don't think I've ever seen.
2017-02-24 18:09:14 +05:30
.wake_ts = { -1, -1, -1, -1, -1, -1, -1 },
Fix some c99 struct initializer uninitialized member warnings that clang detects and GCC misses.
2015-02-14 09:55:42 +05:30
.send_stats = {{0,0},{0,0},{0,0}},
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
.last_conflict_ts = 0,
.gw_check_initpings = 0,
.arp_check_start_ts = 0,
.total_conflicts = 0,
.probe_wait_time = 0,
.using_bpf = false,
.relentless_def = false,
.router_replied = false,
.server_replied = false,
};
Only perform arpreply_clear() after consuming an arp packet in handle_arp_response() and when opening a new arp fd. Do not clear the arpreply buffer and offset on ARP state transitions. Only perform ARP collision probing when binding a new lease from the DS_REQUESTING state, or if we have renewed or rebound a lease with a different IP than we had before. Resequence the arp_dhcp_packet memcpy() in arp_check() so that the current IP address is ARP checked rather than the previous one.
2011-07-06 18:56:07 +05:30
Parse config options with ragel and support a configuration file.
2014-04-15 00:36:31 +05:30
void set_arp_relentless_def(bool v) { garp.relentless_def = v; }
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
static void arp_min_close_fd(struct client_state_t *cs)
reinit_shared_deconfig() was not fully resetting arp state.
2017-02-27 22:00:35 +05:30
{
if (cs->arpFd < 0)
return;
close(cs->arpFd);
cs->arpFd = -1;
cs->arp_is_defense = false;
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
static void arp_close_fd(struct client_state_t *cs)
reinit_shared_deconfig() was not fully resetting arp state.
2017-02-27 22:00:35 +05:30
{
arp_min_close_fd(cs);
for (int i = 0; i < AS_MAX; ++i)
garp.wake_ts[i] = -1;
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
void arp_reset_state(struct client_state_t *cs)
Send probe requests in COLLISION_CHECK state in a way that is compliant with RFC5227. Rate-limiting is also supported. Keep ARP stats per packet send type rather than per ARP state. Use the new stats to replace last_def_ts. Multiple triggers of arp_gw_check from interface-up-events in quick succession could cause the dhcpState to become corrupt. Fix by making the ARP_GW_CHECK be level triggered rather than edge triggered. Make the timeout calculations in the ARP retransmission code much more accurate. Close the ARP fd if we give up on lease defense and go back to requesting a new lease. Do a second arp_announcement() after finding the default GW's hwaddr. Clean up frenew to sanely handle the various ARP checking events. Now renew signals will be ignored during these states. It was particularly insane before if a renew signal were received during DS_COLLISION_CHECK. If the hardware link carrier goes down, do not sleep. Just keep working. Only go to sleep if the user explicitly deconfigures the interface. This change is far more sane for non-mobile hosts, and still works fine with roaming machines: the important thing is the gw hardware address checking that is triggered when the interface comes back up.
2011-07-06 01:10:57 +05:30
{
reinit_shared_deconfig() was not fully resetting arp state.
2017-02-27 22:00:35 +05:30
arp_close_fd(cs);
arp: Take extra care to preserve last received ARP packet.
2017-04-10 18:59:36 +05:30
memset(&garp.reply, 0, sizeof garp.reply);
reinit_shared_deconfig() was not fully resetting arp state.
2017-02-27 22:00:35 +05:30
garp.last_conflict_ts = 0;
garp.gw_check_initpings = 0;
garp.arp_check_start_ts = 0;
garp.total_conflicts = 0;
garp.probe_wait_time = 0;
garp.server_replied = false;
garp.router_replied = false;
Send probe requests in COLLISION_CHECK state in a way that is compliant with RFC5227. Rate-limiting is also supported. Keep ARP stats per packet send type rather than per ARP state. Use the new stats to replace last_def_ts. Multiple triggers of arp_gw_check from interface-up-events in quick succession could cause the dhcpState to become corrupt. Fix by making the ARP_GW_CHECK be level triggered rather than edge triggered. Make the timeout calculations in the ARP retransmission code much more accurate. Close the ARP fd if we give up on lease defense and go back to requesting a new lease. Do a second arp_announcement() after finding the default GW's hwaddr. Clean up frenew to sanely handle the various ARP checking events. Now renew signals will be ignored during these states. It was particularly insane before if a renew signal were received during DS_COLLISION_CHECK. If the hardware link carrier goes down, do not sleep. Just keep working. Only go to sleep if the user explicitly deconfigures the interface. This change is far more sane for non-mobile hosts, and still works fine with roaming machines: the important thing is the gw hardware address checking that is triggered when the interface comes back up.
2011-07-06 01:10:57 +05:30
for (int i = 0; i < ASEND_MAX; ++i) {
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.send_stats[i].ts = 0;
garp.send_stats[i].count = 0;
Send probe requests in COLLISION_CHECK state in a way that is compliant with RFC5227. Rate-limiting is also supported. Keep ARP stats per packet send type rather than per ARP state. Use the new stats to replace last_def_ts. Multiple triggers of arp_gw_check from interface-up-events in quick succession could cause the dhcpState to become corrupt. Fix by making the ARP_GW_CHECK be level triggered rather than edge triggered. Make the timeout calculations in the ARP retransmission code much more accurate. Close the ARP fd if we give up on lease defense and go back to requesting a new lease. Do a second arp_announcement() after finding the default GW's hwaddr. Clean up frenew to sanely handle the various ARP checking events. Now renew signals will be ignored during these states. It was particularly insane before if a renew signal were received during DS_COLLISION_CHECK. If the hardware link carrier goes down, do not sleep. Just keep working. Only go to sleep if the user explicitly deconfigures the interface. This change is far more sane for non-mobile hosts, and still works fine with roaming machines: the important thing is the gw hardware address checking that is triggered when the interface comes back up.
2011-07-06 01:10:57 +05:30
}
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
static int get_arp_basic_socket(struct client_state_t *cs)
Make sure our assigned address is unique on our segment by using arp.
2010-11-16 06:36:50 +05:30
{
Have sockd apply BPF filters to ARP sockets.
2014-04-06 07:09:27 +05:30
char resp;
int fd = request_sockd_fd("a", 1, &resp);
switch (resp) {
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
case 'A': garp.using_bpf = true; break;
case 'a': garp.using_bpf = false; break;
Have sockd apply BPF filters to ARP sockets.
2014-04-06 07:09:27 +05:30
default: suicide("%s: (%s) expected a or A sockd reply but got %c",
client_config.interface, __func__, resp);
}
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
cs->arp_is_defense = false;
Have sockd apply BPF filters to ARP sockets.
2014-04-06 07:09:27 +05:30
return fd;
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
}
Define a BPF for ARP-listening raw sockets that discriminates by ethernet frame protocol type field, ARP hardware type field, ARP protocol type field, ARP hardware address length field, and ARP protocol address length field.
2011-07-01 10:25:35 +05:30
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
static int get_arp_defense_socket(struct client_state_t *cs)
Introduce a ndhc-sockd daemon that separates out the remaining elevated capabilities from the ndhc master process. Privsep is now complete. The only notable improvement from before is that exploitation of ndhc would only allow an attacker to open raw sockets, bind sockets to ports < port 1024, and create broadcast sockets on the interface that ndhc is performing dhcp on rather than on all interfaces. However, this seems like a worthwhile change; note that it was already impossible for an attacker to sniff packets on any interfaces (as that requires CAP_NET_ADMIN, which was always separated to ifch).
2014-04-04 13:42:25 +05:30
{
Have sockd apply BPF filters to ARP sockets.
2014-04-06 07:09:27 +05:30
char buf[32];
size_t buflen = 0;
buf[0] = 'd';
buflen += 1;
memcpy(buf + buflen, &cs->clientAddr, sizeof cs->clientAddr);
buflen += sizeof cs->clientAddr;
memcpy(buf + buflen, client_config.arp, 6);
buflen += 6;
char resp;
int fd = request_sockd_fd(buf, buflen, &resp);
switch (resp) {
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
case 'D': garp.using_bpf = true; break;
case 'd': garp.using_bpf = false; break;
Have sockd apply BPF filters to ARP sockets.
2014-04-06 07:09:27 +05:30
default: suicide("%s: (%s) expected d or D sockd reply but got %c",
client_config.interface, __func__, resp);
}
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
cs->arp_is_defense = true;
Have sockd apply BPF filters to ARP sockets.
2014-04-06 07:09:27 +05:30
return fd;
Introduce a ndhc-sockd daemon that separates out the remaining elevated capabilities from the ndhc master process. Privsep is now complete. The only notable improvement from before is that exploitation of ndhc would only allow an attacker to open raw sockets, bind sockets to ports < port 1024, and create broadcast sockets on the interface that ndhc is performing dhcp on rather than on all interfaces. However, this seems like a worthwhile change; note that it was already impossible for an attacker to sniff packets on any interfaces (as that requires CAP_NET_ADMIN, which was always separated to ifch).
2014-04-04 13:42:25 +05:30
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
static int arp_open_fd(struct client_state_t *cs, bool defense)
If sending on the arp fd fails, then re-open the arp fd and restore arp state to what it was before closing the fd. It may allow the client to continue working in the face of error, as arp functionality is not critical for simply holding a lease.
2011-07-05 08:05:53 +05:30
{
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
if (cs->arpFd >= 0 && defense == cs->arp_is_defense)
return 0;
Rather than use a single cs.timeout value, track individual timeouts for every ARP state and for the current DHCP state.
2011-07-11 20:09:36 +05:30
arp_min_close_fd(cs);
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
cs->arpFd = defense ? get_arp_defense_socket(cs)
: get_arp_basic_socket(cs);
if (cs->arpFd < 0) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: (%s) Failed to create socket: %s",
client_config.interface, __func__, strerror(errno));
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return -1;
}
return 0;
If sending on the arp fd fails, then re-open the arp fd and restore arp state to what it was before closing the fd. It may allow the client to continue working in the face of error, as arp functionality is not critical for simply holding a lease.
2011-07-05 08:05:53 +05:30
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
static int arp_send(struct client_state_t *cs,
struct arpMsg *arp)
Rewrite the ARP ping code to properly use modern interfaces. In detail: - Use AF_PACKET and SOCK_RAW rather than the decade-deprecated SOCK_PACKET interface. - Separate out socket creation code into a subfunction. - Use C99 initializers for packet and address structures. - Cosmetic cleanups.
2011-06-25 22:32:56 +05:30
{
Add error handling for un-notified carrier downs when sending packets. If a packet send failed because the carrier went down without a netlink notification, then assume the hardware carrier was lost while the machine was suspended (eg, ethernet cable pulled during suspend). Simulate a netlink carrier down event and freeze the dhcp state machine until a netlink carrier up event is received. The ARP code is not yet handling this issue everywhere, but the window of opportunity for it to happen there is much shorter.
2015-02-14 15:50:04 +05:30
int ret = -1;
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
struct sockaddr_ll addr = {
.sll_family = AF_PACKET,
.sll_ifindex = client_config.ifindex,
.sll_halen = 6,
};
memcpy(addr.sll_addr, client_config.arp, 6);
arp.c: Check for < 0 for invalid fds and function errors instead of == -1.
2014-04-06 15:24:21 +05:30
if (cs->arpFd < 0) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: arp: Send attempted when no ARP fd is open.",
client_config.interface);
Add error handling for un-notified carrier downs when sending packets. If a packet send failed because the carrier went down without a netlink notification, then assume the hardware carrier was lost while the machine was suspended (eg, ethernet cable pulled during suspend). Simulate a netlink carrier down event and freeze the dhcp state machine until a netlink carrier up event is received. The ARP code is not yet handling this issue everywhere, but the window of opportunity for it to happen there is much shorter.
2015-02-14 15:50:04 +05:30
return ret;
If sending on the arp fd fails, then re-open the arp fd and restore arp state to what it was before closing the fd. It may allow the client to continue working in the face of error, as arp functionality is not critical for simply holding a lease.
2011-07-05 08:05:53 +05:30
}
Rename check_carrier() to carrier_isup() and use bool return.
2017-01-12 15:55:15 +05:30
if (!carrier_isup()) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: (%s) carrier down; sendto would fail",
client_config.interface, __func__);
Add error handling for un-notified carrier downs when sending packets. If a packet send failed because the carrier went down without a netlink notification, then assume the hardware carrier was lost while the machine was suspended (eg, ethernet cable pulled during suspend). Simulate a netlink carrier down event and freeze the dhcp state machine until a netlink carrier up event is received. The ARP code is not yet handling this issue everywhere, but the window of opportunity for it to happen there is much shorter.
2015-02-14 15:50:04 +05:30
ret = -99;
Check for carrier before sendto() or write() on interface fd. Linux will quietly proceed as if the data were sent even if the carrier is down and nothing actually happened. There is still a tiny race condition where the carrier could drop between the check and the actual write, but we really can't do anything about that and it is a very small race.
2015-02-14 08:23:15 +05:30
goto carrier_down;
}
Add error handling for un-notified carrier downs when sending packets. If a packet send failed because the carrier went down without a netlink notification, then assume the hardware carrier was lost while the machine was suspended (eg, ethernet cable pulled during suspend). Simulate a netlink carrier down event and freeze the dhcp state machine until a netlink carrier up event is received. The ARP code is not yet handling this issue everywhere, but the window of opportunity for it to happen there is much shorter.
2015-02-14 15:50:04 +05:30
ret = safe_sendto(cs->arpFd, (const char *)arp, sizeof *arp, 0,
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
(struct sockaddr *)&addr, sizeof addr);
Add error handling for un-notified carrier downs when sending packets. If a packet send failed because the carrier went down without a netlink notification, then assume the hardware carrier was lost while the machine was suspended (eg, ethernet cable pulled during suspend). Simulate a netlink carrier down event and freeze the dhcp state machine until a netlink carrier up event is received. The ARP code is not yet handling this issue everywhere, but the window of opportunity for it to happen there is much shorter.
2015-02-14 15:50:04 +05:30
if (ret < 0 || (size_t)ret != sizeof *arp) {
if (ret < 0)
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: (%s) sendto failed: %s",
client_config.interface, __func__, strerror(errno));
Use safe_sendto where necessary, and check for short writes. Also, change many log_lines to log_errors, mostly in ifset.c.
2014-04-07 13:45:02 +05:30
else
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: (%s) sendto short write: %d < %zu",
client_config.interface, __func__, ret, sizeof *arp);
Check for carrier before sendto() or write() on interface fd. Linux will quietly proceed as if the data were sent even if the carrier is down and nothing actually happened. There is still a tiny race condition where the carrier could drop between the check and the actual write, but we really can't do anything about that and it is a very small race.
2015-02-14 08:23:15 +05:30
carrier_down:
Add error handling for un-notified carrier downs when sending packets. If a packet send failed because the carrier went down without a netlink notification, then assume the hardware carrier was lost while the machine was suspended (eg, ethernet cable pulled during suspend). Simulate a netlink carrier down event and freeze the dhcp state machine until a netlink carrier up event is received. The ARP code is not yet handling this issue everywhere, but the window of opportunity for it to happen there is much shorter.
2015-02-14 15:50:04 +05:30
return ret;
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
}
return 0;
}
Rewrite the ARP ping code to properly use modern interfaces. In detail: - Use AF_PACKET and SOCK_RAW rather than the decade-deprecated SOCK_PACKET interface. - Separate out socket creation code into a subfunction. - Use C99 initializers for packet and address structures. - Cosmetic cleanups.
2011-06-25 22:32:56 +05:30
Refactor the common ARP structure fields between arp sending functions into the BASE_ARPMSG() macro to make it more obvious what is shared. Resequence the gateway arp address print and the arp state change to AS_DEFENSE so that the debug prints are less confusing. No other change.
2011-07-05 05:49:30 +05:30
#define BASE_ARPMSG() struct arpMsg arp = { \
.h_proto = htons(ETH_P_ARP), \
.htype = htons(ARPHRD_ETHER), \
.ptype = htons(ETH_P_IP), \
.hlen = 6, .plen = 4, \
Fix warnings in arp.c.
2014-03-11 04:55:06 +05:30
.operation = htons(ARPOP_REQUEST), \
.smac = {0}, \
}; \
Refactor the common ARP structure fields between arp sending functions into the BASE_ARPMSG() macro to make it more obvious what is shared. Resequence the gateway arp address print and the arp state change to AS_DEFENSE so that the debug prints are less confusing. No other change.
2011-07-05 05:49:30 +05:30
memcpy(arp.h_source, client_config.arp, 6); \
memset(arp.h_dest, 0xff, 6); \
memcpy(arp.smac, client_config.arp, 6)
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
// Returns 0 on success, -1 on failure.
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
static int arp_ping(struct client_state_t *cs, uint32_t test_ip)
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
{
Refactor the common ARP structure fields between arp sending functions into the BASE_ARPMSG() macro to make it more obvious what is shared. Resequence the gateway arp address print and the arp state change to AS_DEFENSE so that the debug prints are less confusing. No other change.
2011-07-05 05:49:30 +05:30
BASE_ARPMSG();
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
memcpy(arp.sip4, &cs->clientAddr, sizeof cs->clientAddr);
Refactor the common ARP structure fields between arp sending functions into the BASE_ARPMSG() macro to make it more obvious what is shared. Resequence the gateway arp address print and the arp state change to AS_DEFENSE so that the debug prints are less confusing. No other change.
2011-07-05 05:49:30 +05:30
memcpy(arp.dip4, &test_ip, sizeof test_ip);
Add error handling for un-notified carrier downs when sending packets. If a packet send failed because the carrier went down without a netlink notification, then assume the hardware carrier was lost while the machine was suspended (eg, ethernet cable pulled during suspend). Simulate a netlink carrier down event and freeze the dhcp state machine until a netlink carrier up event is received. The ARP code is not yet handling this issue everywhere, but the window of opportunity for it to happen there is much shorter.
2015-02-14 15:50:04 +05:30
int r = arp_send(cs, &arp);
if (r < 0)
return r;
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.send_stats[ASEND_GW_PING].count++;
garp.send_stats[ASEND_GW_PING].ts = curms();
Send probe requests in COLLISION_CHECK state in a way that is compliant with RFC5227. Rate-limiting is also supported. Keep ARP stats per packet send type rather than per ARP state. Use the new stats to replace last_def_ts. Multiple triggers of arp_gw_check from interface-up-events in quick succession could cause the dhcpState to become corrupt. Fix by making the ARP_GW_CHECK be level triggered rather than edge triggered. Make the timeout calculations in the ARP retransmission code much more accurate. Close the ARP fd if we give up on lease defense and go back to requesting a new lease. Do a second arp_announcement() after finding the default GW's hwaddr. Clean up frenew to sanely handle the various ARP checking events. Now renew signals will be ignored during these states. It was particularly insane before if a renew signal were received during DS_COLLISION_CHECK. If the hardware link carrier goes down, do not sleep. Just keep working. Only go to sleep if the user explicitly deconfigures the interface. This change is far more sane for non-mobile hosts, and still works fine with roaming machines: the important thing is the gw hardware address checking that is triggered when the interface comes back up.
2011-07-06 01:10:57 +05:30
return 0;
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
}
Rewrite the ARP ping code to properly use modern interfaces. In detail: - Use AF_PACKET and SOCK_RAW rather than the decade-deprecated SOCK_PACKET interface. - Separate out socket creation code into a subfunction. - Use C99 initializers for packet and address structures. - Cosmetic cleanups.
2011-06-25 22:32:56 +05:30
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
// Returns 0 on success, -1 on failure.
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
static int arp_ip_anon_ping(struct client_state_t *cs,
Mark pointer arguments that cannot ever be null as [static 1]. Also constify some cases, too.
2015-02-14 09:44:08 +05:30
uint32_t test_ip)
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
{
Refactor the common ARP structure fields between arp sending functions into the BASE_ARPMSG() macro to make it more obvious what is shared. Resequence the gateway arp address print and the arp state change to AS_DEFENSE so that the debug prints are less confusing. No other change.
2011-07-05 05:49:30 +05:30
BASE_ARPMSG();
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
memcpy(arp.dip4, &test_ip, sizeof test_ip);
arp.c: Make logging messages print the associated interface name.
2014-04-07 14:13:21 +05:30
log_line("%s: arp: Probing for hosts that may conflict with our lease...",
client_config.interface);
Add error handling for un-notified carrier downs when sending packets. If a packet send failed because the carrier went down without a netlink notification, then assume the hardware carrier was lost while the machine was suspended (eg, ethernet cable pulled during suspend). Simulate a netlink carrier down event and freeze the dhcp state machine until a netlink carrier up event is received. The ARP code is not yet handling this issue everywhere, but the window of opportunity for it to happen there is much shorter.
2015-02-14 15:50:04 +05:30
int r = arp_send(cs, &arp);
if (r < 0)
return r;
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.send_stats[ASEND_COLLISION_CHECK].count++;
garp.send_stats[ASEND_COLLISION_CHECK].ts = curms();
Send probe requests in COLLISION_CHECK state in a way that is compliant with RFC5227. Rate-limiting is also supported. Keep ARP stats per packet send type rather than per ARP state. Use the new stats to replace last_def_ts. Multiple triggers of arp_gw_check from interface-up-events in quick succession could cause the dhcpState to become corrupt. Fix by making the ARP_GW_CHECK be level triggered rather than edge triggered. Make the timeout calculations in the ARP retransmission code much more accurate. Close the ARP fd if we give up on lease defense and go back to requesting a new lease. Do a second arp_announcement() after finding the default GW's hwaddr. Clean up frenew to sanely handle the various ARP checking events. Now renew signals will be ignored during these states. It was particularly insane before if a renew signal were received during DS_COLLISION_CHECK. If the hardware link carrier goes down, do not sleep. Just keep working. Only go to sleep if the user explicitly deconfigures the interface. This change is far more sane for non-mobile hosts, and still works fine with roaming machines: the important thing is the gw hardware address checking that is triggered when the interface comes back up.
2011-07-06 01:10:57 +05:30
return 0;
Make sure our assigned address is unique on our segment by using arp.
2010-11-16 06:36:50 +05:30
}
Move timeout and arp handling code out to arpping.c and timeout.c.
2010-12-24 20:02:58 +05:30
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
static int arp_announcement(struct client_state_t *cs)
Send an ARP announcement after getting a new lease.
2011-07-02 15:18:24 +05:30
{
Refactor the common ARP structure fields between arp sending functions into the BASE_ARPMSG() macro to make it more obvious what is shared. Resequence the gateway arp address print and the arp state change to AS_DEFENSE so that the debug prints are less confusing. No other change.
2011-07-05 05:49:30 +05:30
BASE_ARPMSG();
Send an ARP announcement after getting a new lease.
2011-07-02 15:18:24 +05:30
memcpy(arp.sip4, &cs->clientAddr, 4);
memcpy(arp.dip4, &cs->clientAddr, 4);
Add error handling for un-notified carrier downs when sending packets. If a packet send failed because the carrier went down without a netlink notification, then assume the hardware carrier was lost while the machine was suspended (eg, ethernet cable pulled during suspend). Simulate a netlink carrier down event and freeze the dhcp state machine until a netlink carrier up event is received. The ARP code is not yet handling this issue everywhere, but the window of opportunity for it to happen there is much shorter.
2015-02-14 15:50:04 +05:30
int r = arp_send(cs, &arp);
if (r < 0)
return r;
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.send_stats[ASEND_ANNOUNCE].count++;
garp.send_stats[ASEND_ANNOUNCE].ts = curms();
Send probe requests in COLLISION_CHECK state in a way that is compliant with RFC5227. Rate-limiting is also supported. Keep ARP stats per packet send type rather than per ARP state. Use the new stats to replace last_def_ts. Multiple triggers of arp_gw_check from interface-up-events in quick succession could cause the dhcpState to become corrupt. Fix by making the ARP_GW_CHECK be level triggered rather than edge triggered. Make the timeout calculations in the ARP retransmission code much more accurate. Close the ARP fd if we give up on lease defense and go back to requesting a new lease. Do a second arp_announcement() after finding the default GW's hwaddr. Clean up frenew to sanely handle the various ARP checking events. Now renew signals will be ignored during these states. It was particularly insane before if a renew signal were received during DS_COLLISION_CHECK. If the hardware link carrier goes down, do not sleep. Just keep working. Only go to sleep if the user explicitly deconfigures the interface. This change is far more sane for non-mobile hosts, and still works fine with roaming machines: the important thing is the gw hardware address checking that is triggered when the interface comes back up.
2011-07-06 01:10:57 +05:30
return 0;
Send an ARP announcement after getting a new lease.
2011-07-02 15:18:24 +05:30
}
Refactor the common ARP structure fields between arp sending functions into the BASE_ARPMSG() macro to make it more obvious what is shared. Resequence the gateway arp address print and the arp state change to AS_DEFENSE so that the debug prints are less confusing. No other change.
2011-07-05 05:49:30 +05:30
#undef BASE_ARPMSG
Send an ARP announcement after getting a new lease.
2011-07-02 15:18:24 +05:30
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
// Checks to see if there is another host that has our assigned IP.
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_check(struct client_state_t *cs,
struct dhcpmsg *packet)
Move timeout and arp handling code out to arpping.c and timeout.c.
2010-12-24 20:02:58 +05:30
{
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
memcpy(&garp.dhcp_packet, packet, sizeof (struct dhcpmsg));
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
if (arp_open_fd(cs, false) < 0)
return -1;
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (arp_ip_anon_ping(cs, garp.dhcp_packet.yiaddr) < 0)
Make arp code more robust and refactor it a bit. Handle failure to create arp sockets more gracefully. Add initial support for retransmitting arp requests if no reply is met after a certain number of spurious packets.
2011-03-31 12:02:34 +05:30
return -1;
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.arp_check_start_ts = garp.send_stats[ASEND_COLLISION_CHECK].ts;
garp.probe_wait_time = arp_probe_wait;
garp.wake_ts[AS_COLLISION_CHECK] = garp.arp_check_start_ts
+ garp.probe_wait_time;
Make arp code more robust and refactor it a bit. Handle failure to create arp sockets more gracefully. Add initial support for retransmitting arp requests if no reply is met after a certain number of spurious packets.
2011-03-31 12:02:34 +05:30
return 0;
Move timeout and arp handling code out to arpping.c and timeout.c.
2010-12-24 20:02:58 +05:30
}
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
// Confirms that we're still on the fingerprinted network.
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_gw_check(struct client_state_t *cs)
If physical link state changes to UP and a lease is bound, check to see if the currently assigned gateway/router still replies to ARP queries. If so, keep the lease. If not, get a new lease. Save the IP address of the current gateway/router. Remove an outdated check for a buggy compiler. Fix a typo in the previous commit that caused timeouts to be 1000x faster than they should be.
2011-03-31 05:43:48 +05:30
{
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
if (arp_open_fd(cs, false) < 0)
return -1;
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.gw_check_initpings = garp.send_stats[ASEND_GW_PING].count;
garp.server_replied = false;
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
cs->check_fingerprint = true;
Add error handling for un-notified carrier downs in ifup_action.
2015-02-14 16:07:06 +05:30
int r;
if ((r = arp_ping(cs, cs->srcAddr)) < 0)
return r;
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
if (cs->routerAddr) {
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.router_replied = false;
Add error handling for un-notified carrier downs in ifup_action.
2015-02-14 16:07:06 +05:30
if ((r = arp_ping(cs, cs->routerAddr)) < 0)
return r;
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
} else
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.router_replied = true;
garp.wake_ts[AS_GW_CHECK] =
garp.send_stats[ASEND_GW_PING].ts + ARP_RETRANS_DELAY + 250;
Make arp code more robust and refactor it a bit. Handle failure to create arp sockets more gracefully. Add initial support for retransmitting arp requests if no reply is met after a certain number of spurious packets.
2011-03-31 12:02:34 +05:30
return 0;
If physical link state changes to UP and a lease is bound, check to see if the currently assigned gateway/router still replies to ARP queries. If so, keep the lease. If not, get a new lease. Save the IP address of the current gateway/router. Remove an outdated check for a buggy compiler. Fix a typo in the previous commit that caused timeouts to be 1000x faster than they should be.
2011-03-31 05:43:48 +05:30
}
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
// Gathers the fingerprinting info for the associated network.
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
static int arp_get_gw_hwaddr(struct client_state_t *cs)
Fetch the gateway hardware address after receiving a router option in a DHCP lease. Be more aggressive about closing old arp file descriptors. Check the ARP headers to make sure that received ARP packets are addressed to our machine. Whatever bug may have existed before doesn't exist on modern Linux kernels, if it ever did. Use the stored gateway hardware address to validate a restored link in the DS_ARP_GW_CHECK state. If an ARP message is received while we are in a state that does not expect ARP messages, close the ARP socket and log a message.
2011-03-31 08:47:27 +05:30
{
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
if (arp_open_fd(cs, false) < 0)
return -1;
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
if (cs->routerAddr)
arp.c: Make logging messages print the associated interface name.
2014-04-07 14:13:21 +05:30
log_line("%s: arp: Searching for dhcp server and gw addresses...",
client_config.interface);
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
else
arp.c: Make logging messages print the associated interface name.
2014-04-07 14:13:21 +05:30
log_line("%s: arp: Searching for dhcp server address...",
client_config.interface);
Give up on fingerprinting relay agent/server if it doesn't reply. Try to send/wait three times; then if there's no response, then assume that the relay agent is ignoring or firewalled from receiving ARP requests.
2020-10-19 12:37:23 +05:30
cs->server_arp_state = ARP_QUERY;
++cs->server_arp_sent;
Improve fingerprinting to support DHCP relay agents. Mostly reverts the previous commit and instead teaches ndhc to properly handle the case when it is communicating with a DHCP relay agent on its local segment rather than directly with a DHCP server.
2015-02-13 09:58:54 +05:30
if (arp_ping(cs, cs->srcAddr) < 0)
Make arp code more robust and refactor it a bit. Handle failure to create arp sockets more gracefully. Add initial support for retransmitting arp requests if no reply is met after a certain number of spurious packets.
2011-03-31 12:02:34 +05:30
return -1;
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
if (cs->routerAddr) {
Give up on fingerprinting router/gateway if it doesn't reply.
2020-10-19 13:55:15 +05:30
cs->router_arp_state = ARP_QUERY;
++cs->router_arp_sent;
arp.c: Check for < 0 for invalid fds and function errors instead of == -1.
2014-04-06 15:24:21 +05:30
if (arp_ping(cs, cs->routerAddr) < 0)
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
return -1;
Give up on fingerprinting router/gateway if it doesn't reply.
2020-10-19 13:55:15 +05:30
} else cs->router_arp_state = ARP_FAILED;
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.wake_ts[AS_GW_QUERY] =
garp.send_stats[ASEND_GW_PING].ts + ARP_RETRANS_DELAY + 250;
Make arp code more robust and refactor it a bit. Handle failure to create arp sockets more gracefully. Add initial support for retransmitting arp requests if no reply is met after a certain number of spurious packets.
2011-03-31 12:02:34 +05:30
return 0;
Fetch the gateway hardware address after receiving a router option in a DHCP lease. Be more aggressive about closing old arp file descriptors. Check the ARP headers to make sure that received ARP packets are addressed to our machine. Whatever bug may have existed before doesn't exist on modern Linux kernels, if it ever did. Use the stored gateway hardware address to validate a restored link in the DS_ARP_GW_CHECK state. If an ARP message is received while we are in a state that does not expect ARP messages, close the ARP socket and log a message.
2011-03-31 08:47:27 +05:30
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_set_defense_mode(struct client_state_t *cs)
Handle DS_REBINDING and DS_RENEWING states just like DS_BOUND when the hardware link returns after having been lost. Make the timeout action for DS_BOUND_GW_CHECK perform ARP retransmissions rather than just sending a single query.
2011-07-06 01:27:11 +05:30
{
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return arp_open_fd(cs, true);
Move timeout and arp handling code out to arpping.c and timeout.c.
2010-12-24 20:02:58 +05:30
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
static int arp_gw_success(struct client_state_t *cs)
If physical link state changes to UP and a lease is bound, check to see if the currently assigned gateway/router still replies to ARP queries. If so, keep the lease. If not, get a new lease. Save the IP address of the current gateway/router. Remove an outdated check for a buggy compiler. Fix a typo in the previous commit that caused timeouts to be 1000x faster than they should be.
2011-03-31 05:43:48 +05:30
{
arp.c: Make logging messages print the associated interface name.
2014-04-07 14:13:21 +05:30
log_line("%s: arp: Network seems unchanged. Resuming normal operation.",
client_config.interface);
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
if (arp_open_fd(cs, true) < 0)
return ARPR_FAIL;
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.wake_ts[AS_GW_CHECK] = -1;
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
if (arp_announcement(cs) < 0)
return ARPR_FAIL;
return ARPR_FREE;
If physical link state changes to UP and a lease is bound, check to see if the currently assigned gateway/router still replies to ARP queries. If so, keep the lease. If not, get a new lease. Save the IP address of the current gateway/router. Remove an outdated check for a buggy compiler. Fix a typo in the previous commit that caused timeouts to be 1000x faster than they should be.
2011-03-31 05:43:48 +05:30
}
Keep track of whether the ARP BPF has been successfully installed. If it has, then don't perform redundant checks in ARP validation.
2011-07-01 12:31:29 +05:30
// ARP validation functions that will be performed by the BPF if it is
// installed.
static int arp_validate_bpf(struct arpMsg *am)
More strictly validate ARP responses from remote servers.
2011-05-31 20:31:08 +05:30
{
Print explicit warning messages when ARP packets fail in arp_validate().
2011-06-02 20:11:34 +05:30
if (am->h_proto != htons(ETH_P_ARP)) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: arp: IP header does not indicate ARP protocol",
client_config.interface);
More strictly validate ARP responses from remote servers.
2011-05-31 20:31:08 +05:30
return 0;
Print explicit warning messages when ARP packets fail in arp_validate().
2011-06-02 20:11:34 +05:30
}
if (am->htype != htons(ARPHRD_ETHER)) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: arp: ARP hardware type field invalid",
client_config.interface);
More strictly validate ARP responses from remote servers.
2011-05-31 20:31:08 +05:30
return 0;
Print explicit warning messages when ARP packets fail in arp_validate().
2011-06-02 20:11:34 +05:30
}
if (am->ptype != htons(ETH_P_IP)) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: arp: ARP protocol type field invalid",
client_config.interface);
More strictly validate ARP responses from remote servers.
2011-05-31 20:31:08 +05:30
return 0;
Print explicit warning messages when ARP packets fail in arp_validate().
2011-06-02 20:11:34 +05:30
}
if (am->hlen != 6) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: arp: ARP hardware address length invalid",
client_config.interface);
More strictly validate ARP responses from remote servers.
2011-05-31 20:31:08 +05:30
return 0;
Print explicit warning messages when ARP packets fail in arp_validate().
2011-06-02 20:11:34 +05:30
}
if (am->plen != 4) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: arp: ARP protocol address length invalid",
client_config.interface);
More strictly validate ARP responses from remote servers.
2011-05-31 20:31:08 +05:30
return 0;
Print explicit warning messages when ARP packets fail in arp_validate().
2011-06-02 20:11:34 +05:30
}
Keep track of whether the ARP BPF has been successfully installed. If it has, then don't perform redundant checks in ARP validation.
2011-07-01 12:31:29 +05:30
return 1;
}
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
// ARP validation functions that will be performed by the BPF if it is
// installed.
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
static int arp_validate_bpf_defense(struct client_state_t *cs,
struct arpMsg *am)
Keep track of whether the ARP BPF has been successfully installed. If it has, then don't perform redundant checks in ARP validation.
2011-07-01 12:31:29 +05:30
{
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
if (memcmp(am->sip4, &cs->clientAddr, 4))
return 0;
if (!memcmp(am->smac, client_config.arp, 6))
More strictly validate ARP responses from remote servers.
2011-05-31 20:31:08 +05:30
return 0;
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
return 1;
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
static int arp_is_query_reply(struct arpMsg *am)
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
{
Keep track of whether the ARP BPF has been successfully installed. If it has, then don't perform redundant checks in ARP validation.
2011-07-01 12:31:29 +05:30
if (am->operation != htons(ARPOP_REPLY))
More strictly validate ARP responses from remote servers.
2011-05-31 20:31:08 +05:30
return 0;
Keep track of whether the ARP BPF has been successfully installed. If it has, then don't perform redundant checks in ARP validation.
2011-07-01 12:31:29 +05:30
if (memcmp(am->h_dest, client_config.arp, 6))
return 0;
if (memcmp(am->dmac, client_config.arp, 6))
More strictly validate ARP responses from remote servers.
2011-05-31 20:31:08 +05:30
return 0;
return 1;
}
Build with -Wstrict-overflow=5 and fix revealed warnings. Some of these are actual bugs, but none are security-sensitive.
2022-08-10 21:02:30 +05:30
static unsigned arp_gen_probe_wait(struct client_state_t *cs)
Send probe requests in COLLISION_CHECK state in a way that is compliant with RFC5227. Rate-limiting is also supported. Keep ARP stats per packet send type rather than per ARP state. Use the new stats to replace last_def_ts. Multiple triggers of arp_gw_check from interface-up-events in quick succession could cause the dhcpState to become corrupt. Fix by making the ARP_GW_CHECK be level triggered rather than edge triggered. Make the timeout calculations in the ARP retransmission code much more accurate. Close the ARP fd if we give up on lease defense and go back to requesting a new lease. Do a second arp_announcement() after finding the default GW's hwaddr. Clean up frenew to sanely handle the various ARP checking events. Now renew signals will be ignored during these states. It was particularly insane before if a renew signal were received during DS_COLLISION_CHECK. If the hardware link carrier goes down, do not sleep. Just keep working. Only go to sleep if the user explicitly deconfigures the interface. This change is far more sane for non-mobile hosts, and still works fine with roaming machines: the important thing is the gw hardware address checking that is triggered when the interface comes back up.
2011-07-06 01:10:57 +05:30
{
Build with -Wstrict-overflow=5 and fix revealed warnings. Some of these are actual bugs, but none are security-sensitive.
2022-08-10 21:02:30 +05:30
unsigned range = arp_probe_max - arp_probe_min;
Compile cleanly with -Wsign-conversion. I didn't notice anything that worried me.
2018-02-09 13:09:46 +05:30
if (range < 1000) range = 1000;
Send probe requests in COLLISION_CHECK state in a way that is compliant with RFC5227. Rate-limiting is also supported. Keep ARP stats per packet send type rather than per ARP state. Use the new stats to replace last_def_ts. Multiple triggers of arp_gw_check from interface-up-events in quick succession could cause the dhcpState to become corrupt. Fix by making the ARP_GW_CHECK be level triggered rather than edge triggered. Make the timeout calculations in the ARP retransmission code much more accurate. Close the ARP fd if we give up on lease defense and go back to requesting a new lease. Do a second arp_announcement() after finding the default GW's hwaddr. Clean up frenew to sanely handle the various ARP checking events. Now renew signals will be ignored during these states. It was particularly insane before if a renew signal were received during DS_COLLISION_CHECK. If the hardware link carrier goes down, do not sleep. Just keep working. Only go to sleep if the user explicitly deconfigures the interface. This change is far more sane for non-mobile hosts, and still works fine with roaming machines: the important thing is the gw hardware address checking that is triggered when the interface comes back up.
2011-07-06 01:10:57 +05:30
// This is not a uniform distribution but it doesn't matter here.
Build with -Wstrict-overflow=5 and fix revealed warnings. Some of these are actual bugs, but none are security-sensitive.
2022-08-10 21:02:30 +05:30
return arp_probe_min + nk_random_u32(&cs->rnd_state) % range;
Send probe requests in COLLISION_CHECK state in a way that is compliant with RFC5227. Rate-limiting is also supported. Keep ARP stats per packet send type rather than per ARP state. Use the new stats to replace last_def_ts. Multiple triggers of arp_gw_check from interface-up-events in quick succession could cause the dhcpState to become corrupt. Fix by making the ARP_GW_CHECK be level triggered rather than edge triggered. Make the timeout calculations in the ARP retransmission code much more accurate. Close the ARP fd if we give up on lease defense and go back to requesting a new lease. Do a second arp_announcement() after finding the default GW's hwaddr. Clean up frenew to sanely handle the various ARP checking events. Now renew signals will be ignored during these states. It was particularly insane before if a renew signal were received during DS_COLLISION_CHECK. If the hardware link carrier goes down, do not sleep. Just keep working. Only go to sleep if the user explicitly deconfigures the interface. This change is far more sane for non-mobile hosts, and still works fine with roaming machines: the important thing is the gw hardware address checking that is triggered when the interface comes back up.
2011-07-06 01:10:57 +05:30
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_defense_timeout(struct client_state_t *cs, long long nowts)
Perform timeout-based ARP retransmission for AS_GW_CHECK and AS_GW_QUERY.
2011-07-05 20:37:42 +05:30
{
Fix warnings in arp.c.
2014-03-11 04:55:06 +05:30
(void)nowts; // Suppress warning; parameter necessary but unused.
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
int ret = 0;
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (garp.wake_ts[AS_DEFENSE] != -1) {
arp.c: Make logging messages print the associated interface name.
2014-04-07 14:13:21 +05:30
log_line("%s: arp: Defending our lease IP.", client_config.interface);
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.wake_ts[AS_DEFENSE] = -1;
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
ret = arp_announcement(cs);
Enable active defense of IP address / lease, as described in RFC5227.
2011-07-05 22:33:55 +05:30
}
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ret;
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_gw_check_timeout(struct client_state_t *cs, long long nowts)
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
{
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
if (garp.send_stats[ASEND_GW_PING].count >= garp.gw_check_initpings + 6) {
if (garp.router_replied && !garp.server_replied)
log_line("%s: arp: DHCP agent didn't reply. Getting new lease.",
client_config.interface);
else if (!garp.router_replied && garp.server_replied)
log_line("%s: arp: Gateway didn't reply. Getting new lease.",
client_config.interface);
else
log_line("%s: arp: DHCP agent and gateway didn't reply. Getting new lease.",
client_config.interface);
garp.wake_ts[AS_GW_CHECK] = -1;
return ARPR_CONFLICT;
}
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
long long rtts = garp.send_stats[ASEND_GW_PING].ts + ARP_RETRANS_DELAY;
Optimize timeout calculations so that curms() is called fewer times and the timeout intervals are a bit more exact.
2011-07-11 18:29:50 +05:30
if (nowts < rtts) {
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.wake_ts[AS_GW_CHECK] = rtts;
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_OK;
Send probe requests in COLLISION_CHECK state in a way that is compliant with RFC5227. Rate-limiting is also supported. Keep ARP stats per packet send type rather than per ARP state. Use the new stats to replace last_def_ts. Multiple triggers of arp_gw_check from interface-up-events in quick succession could cause the dhcpState to become corrupt. Fix by making the ARP_GW_CHECK be level triggered rather than edge triggered. Make the timeout calculations in the ARP retransmission code much more accurate. Close the ARP fd if we give up on lease defense and go back to requesting a new lease. Do a second arp_announcement() after finding the default GW's hwaddr. Clean up frenew to sanely handle the various ARP checking events. Now renew signals will be ignored during these states. It was particularly insane before if a renew signal were received during DS_COLLISION_CHECK. If the hardware link carrier goes down, do not sleep. Just keep working. Only go to sleep if the user explicitly deconfigures the interface. This change is far more sane for non-mobile hosts, and still works fine with roaming machines: the important thing is the gw hardware address checking that is triggered when the interface comes back up.
2011-07-06 01:10:57 +05:30
}
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (!garp.router_replied) {
arp.c: Make logging messages print the associated interface name.
2014-04-07 14:13:21 +05:30
log_line("%s: arp: Still waiting for gateway to reply to arp ping...",
client_config.interface);
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
if (arp_ping(cs, cs->routerAddr) < 0) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: arp: Failed to send ARP ping in retransmission.",
client_config.interface);
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_FAIL;
}
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
}
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (!garp.server_replied) {
Improve fingerprinting to support DHCP relay agents. Mostly reverts the previous commit and instead teaches ndhc to properly handle the case when it is communicating with a DHCP relay agent on its local segment rather than directly with a DHCP server.
2015-02-13 09:58:54 +05:30
log_line("%s: arp: Still waiting for DHCP agent to reply to arp ping...",
arp.c: Make logging messages print the associated interface name.
2014-04-07 14:13:21 +05:30
client_config.interface);
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
if (arp_ping(cs, cs->srcAddr) < 0) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: arp: Failed to send ARP ping in retransmission.",
client_config.interface);
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_FAIL;
}
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
}
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.wake_ts[AS_GW_CHECK] =
garp.send_stats[ASEND_GW_PING].ts + ARP_RETRANS_DELAY;
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_OK;
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_gw_query_timeout(struct client_state_t *cs, long long nowts)
Support networks with relay agents that have the DHCP server on a different segment. The network fingerprinting would never complete if the DHCP server was on a different segment before this change, since it would be impossible for the ARP messages sent by ndhc to ever reach the DHCP server (and vice-versa). Now just give up trying to find the hardware address after two tries and assume that the DHCP server cannot be reached by ARP. An alternative would be to fingerprint the relay agent instead, but to do so would require a lot more work as the giaddr field is only meaningful in the client->server message path, not in the server->client path. Thus it would require gathering the source IP for DHCP replies sent by unicast or broadcast and ferrying along this information to the ARP checking code where it would be used in place of the DHCP server address. This is entirely possible to do, but is quite a bit more work.
2015-02-13 07:19:40 +05:30
{
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
long long rtts = garp.send_stats[ASEND_GW_PING].ts + ARP_RETRANS_DELAY;
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
if (nowts < rtts) {
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.wake_ts[AS_GW_QUERY] = rtts;
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_OK;
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
}
Give up on fingerprinting router/gateway if it doesn't reply.
2020-10-19 13:55:15 +05:30
if (cs->router_arp_state == ARP_QUERY) {
if (cs->router_arp_sent >= ARP_MAX_TRIES) {
log_line("%s: arp: Gateway is ignoring ARPs.",
client_config.interface);
cs->router_arp_state = ARP_FAILED;
return ARPR_OK;
}
arp.c: Make logging messages print the associated interface name.
2014-04-07 14:13:21 +05:30
log_line("%s: arp: Still looking for gateway hardware address...",
client_config.interface);
Give up on fingerprinting router/gateway if it doesn't reply.
2020-10-19 13:55:15 +05:30
++cs->router_arp_sent;
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
if (arp_ping(cs, cs->routerAddr) < 0) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: arp: Failed to send ARP ping in retransmission.",
client_config.interface);
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_FAIL;
}
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
}
Give up on fingerprinting relay agent/server if it doesn't reply. Try to send/wait three times; then if there's no response, then assume that the relay agent is ignoring or firewalled from receiving ARP requests.
2020-10-19 12:37:23 +05:30
if (cs->server_arp_state == ARP_QUERY) {
if (cs->server_arp_sent >= ARP_MAX_TRIES) {
log_line("%s: arp: DHCP agent is ignoring ARPs.",
client_config.interface);
cs->server_arp_state = ARP_FAILED;
return ARPR_OK;
}
Improve fingerprinting to support DHCP relay agents. Mostly reverts the previous commit and instead teaches ndhc to properly handle the case when it is communicating with a DHCP relay agent on its local segment rather than directly with a DHCP server.
2015-02-13 09:58:54 +05:30
log_line("%s: arp: Still looking for DHCP agent hardware address...",
arp.c: Make logging messages print the associated interface name.
2014-04-07 14:13:21 +05:30
client_config.interface);
Give up on fingerprinting relay agent/server if it doesn't reply. Try to send/wait three times; then if there's no response, then assume that the relay agent is ignoring or firewalled from receiving ARP requests.
2020-10-19 12:37:23 +05:30
++cs->server_arp_sent;
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
if (arp_ping(cs, cs->srcAddr) < 0) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: arp: Failed to send ARP ping in retransmission.",
client_config.interface);
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_FAIL;
}
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
}
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.wake_ts[AS_GW_QUERY] =
garp.send_stats[ASEND_GW_PING].ts + ARP_RETRANS_DELAY;
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_OK;
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_collision_timeout(struct client_state_t *cs, long long nowts)
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
{
Build with -Wstrict-overflow=5 and fix revealed warnings. Some of these are actual bugs, but none are security-sensitive.
2022-08-10 21:02:30 +05:30
if (nowts - garp.arp_check_start_ts >= ANNOUNCE_WAIT ||
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
garp.send_stats[ASEND_COLLISION_CHECK].count >= arp_probe_num)
{
char clibuf[INET_ADDRSTRLEN];
struct in_addr temp_addr = {.s_addr = garp.dhcp_packet.yiaddr};
inet_ntop(AF_INET, &temp_addr, clibuf, sizeof clibuf);
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: Lease of %s obtained. Lease time is %u seconds.",
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
client_config.interface, clibuf, cs->lease);
cs->clientAddr = garp.dhcp_packet.yiaddr;
Rename client_state_t init variable to program_init. Easier to grep. No functional change.
2017-01-19 15:35:35 +05:30
cs->program_init = false;
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
garp.last_conflict_ts = 0;
garp.wake_ts[AS_COLLISION_CHECK] = -1;
if (ifchange_bind(cs, &garp.dhcp_packet) < 0) {
arp: Fix case where changing interface properties consistently fails. If changing interface properties fails after getting a lease, it is possible under some strange conditions for the failure to be persistent. This seems to happen if the carrier cycles off and on several times during ndhc initialization. Since this issue is very hard to replicate, the most conservative thing to do here is to simply have ndhc suicide itself so it can be respawned by a process supervisor. Logs of the issue in practice: (carrier is down while the daemon is started here, it seems) 16:57:09.638979845 ndhc-ifch seccomp filter installed. Please disable seccomp if you 16:57:09.638989136 Discovering DHCP servers... 16:57:09.638991371 (send_dhcp_raw) carrier down; sendto would fail 16:57:09.638993318 Failed to send a discover request packet. ... 16:57:13.636519925 Discovering DHCP servers... 16:57:13.651462476 Received IP offer: X from server Y via Z ... 16:57:13.912592571 wan0: Gateway router set to: A 16:57:13.912607463 wan0: arp: Searching for dhcp server and gw addresses... 16:57:14.635532676 wan0: Carrier down. 17:04:32.983897760 wan0: arp: Still looking for gateway hardware address... 17:04:32.984158226 wan0: arp: Still looking for DHCP agent hardware address... 17:04:32.984781255 wan0: Interface is back. Revalidating lease... 17:04:32.985585501 wan0: arp: Gateway hardware address B 17:04:32.985590436 wan0: arp: DHCP agent hardware address C 17:04:38.234857403 wan0: arp: Still waiting for gateway to reply to arp ping... 17:04:38.235109016 wan0: arp: Still waiting for DHCP agent to reply to arp ping... 16:57:24.165620224 wan0: arp: Still waiting for gateway to reply to arp ping... 16:57:29.169621070 wan0: arp: DHCP agent and gateway didn't reply. Getting new lease. 16:57:29.217710616 wan0: Discovering DHCP servers... 16:57:29.249645130 wan0: Received IP offer: X from server Y via Z 16:57:29.249657203 wan0: Sending a selection request for X... 16:57:29.285632973 wan0: Received ACK: X from server Y via Z 16:57:29.297717159 wan0: arp: Probing for hosts that may conflict with our lease... 16:57:29.360249458 wan0: arp: Probing for hosts that may conflict with our lease... 16:57:29.435114526 wan0: arp: Probing for hosts that may conflict with our lease... 16:57:29.500473345 wan0: Lease of X obtained. Lease time is D seconds. 16:57:29.500485894 wan0: Failed to set the interface IP address and properties! ... And the final two errors repeat. Restarting ndhc by hand instantly fixes the issue. So there's a lot going on -- bizzare clock skew, and carrier flickering on and off.
2015-10-29 05:50:21 +05:30
suicide("%s: Failed to set the interface IP address and properties!",
client_config.interface);
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
}
cs->routerAddr = get_option_router(&garp.dhcp_packet);
stop_dhcp_listen(cs);
write_leasefile(temp_addr);
arp: If first ARP announce fails, rely on the second announce. The previous approach would desynchronize the state machine if the carrier is paused after receiving the lease but before sending the announce, since we have received a lease already. This change is an improvement but is still not ideal.
2017-02-24 15:27:33 +05:30
return ARPR_FREE;
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
}
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
long long rtts = garp.send_stats[ASEND_COLLISION_CHECK].ts +
garp.probe_wait_time;
Optimize timeout calculations so that curms() is called fewer times and the timeout intervals are a bit more exact.
2011-07-11 18:29:50 +05:30
if (nowts < rtts) {
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.wake_ts[AS_COLLISION_CHECK] = rtts;
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_OK;
Perform timeout-based ARP retransmission for AS_GW_CHECK and AS_GW_QUERY.
2011-07-05 20:37:42 +05:30
}
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
if (arp_ip_anon_ping(cs, garp.dhcp_packet.yiaddr) < 0) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: arp: Failed to send ARP ping in retransmission.",
client_config.interface);
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_FAIL;
}
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.probe_wait_time = arp_gen_probe_wait(cs);
garp.wake_ts[AS_COLLISION_CHECK] =
garp.send_stats[ASEND_COLLISION_CHECK].ts + garp.probe_wait_time;
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_OK;
Perform timeout-based ARP retransmission for AS_GW_CHECK and AS_GW_QUERY.
2011-07-05 20:37:42 +05:30
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_query_gateway(struct client_state_t *cs)
Handle carrier interruptions in arp_collision_timeout() better. Still not ideal; we need to note and retry these errors, but these changes are preparatory and do not introduce regressions.
2017-02-24 16:06:05 +05:30
{
arp: Handle initial gateway query asynchronously and retry failures. The gateway/router MAC fingerprinting could perhaps be done more robustly in the face of suspend or carrier loss, but the time window in which things could get confused is very small and I would rather just rely on supervisor respawn in that case. Even this case I don't think I've ever seen.
2017-02-24 18:09:14 +05:30
if (cs->sent_gw_query) {
garp.wake_ts[AS_QUERY_GW_SEND] = -1;
return ARPR_OK;
}
Handle carrier interruptions in arp_collision_timeout() better. Still not ideal; we need to note and retry these errors, but these changes are preparatory and do not introduce regressions.
2017-02-24 16:06:05 +05:30
if (arp_get_gw_hwaddr(cs) < 0) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: (%s) Failed to send request to get gateway and agent hardware addresses: %s",
client_config.interface, __func__, strerror(errno));
arp: Handle initial gateway query asynchronously and retry failures. The gateway/router MAC fingerprinting could perhaps be done more robustly in the face of suspend or carrier loss, but the time window in which things could get confused is very small and I would rather just rely on supervisor respawn in that case. Even this case I don't think I've ever seen.
2017-02-24 18:09:14 +05:30
garp.wake_ts[AS_QUERY_GW_SEND] = curms() + ARP_RETRANS_DELAY;
Handle carrier interruptions in arp_collision_timeout() better. Still not ideal; we need to note and retry these errors, but these changes are preparatory and do not introduce regressions.
2017-02-24 16:06:05 +05:30
return ARPR_FAIL;
}
arp: Handle initial gateway query asynchronously and retry failures. The gateway/router MAC fingerprinting could perhaps be done more robustly in the face of suspend or carrier loss, but the time window in which things could get confused is very small and I would rather just rely on supervisor respawn in that case. Even this case I don't think I've ever seen.
2017-02-24 18:09:14 +05:30
cs->sent_gw_query = true;
Make fingerprinting more robust with rapid carrier state changes. The existing code tracked the fingerprinting completion state with a bool, which is insufficient; what is required is a tristate (none|inprogress|done) where the inprogress state reverts to none on carrier down, but done state stays done on carrier down.
2020-10-27 23:44:18 +05:30
if (cs->fp_state == FPRINT_NONE)
cs->fp_state = FPRINT_INPROGRESS;
arp: Handle initial gateway query asynchronously and retry failures. The gateway/router MAC fingerprinting could perhaps be done more robustly in the face of suspend or carrier loss, but the time window in which things could get confused is very small and I would rather just rely on supervisor respawn in that case. Even this case I don't think I've ever seen.
2017-02-24 18:09:14 +05:30
garp.wake_ts[AS_QUERY_GW_SEND] = -1;
Handle carrier interruptions in arp_collision_timeout() better. Still not ideal; we need to note and retry these errors, but these changes are preparatory and do not introduce regressions.
2017-02-24 16:06:05 +05:30
return ARPR_OK;
}
arp: Handle initial gateway query asynchronously and retry failures. The gateway/router MAC fingerprinting could perhaps be done more robustly in the face of suspend or carrier loss, but the time window in which things could get confused is very small and I would rather just rely on supervisor respawn in that case. Even this case I don't think I've ever seen.
2017-02-24 18:09:14 +05:30
// 1 == not yet time, 0 == timed out, success, -1 == timed out, failure
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_query_gateway_timeout(struct client_state_t *cs, long long nowts)
arp: Handle initial gateway query asynchronously and retry failures. The gateway/router MAC fingerprinting could perhaps be done more robustly in the face of suspend or carrier loss, but the time window in which things could get confused is very small and I would rather just rely on supervisor respawn in that case. Even this case I don't think I've ever seen.
2017-02-24 18:09:14 +05:30
{
long long rtts = garp.wake_ts[AS_QUERY_GW_SEND];
if (rtts == -1) return 0;
if (nowts < rtts) return 1;
return arp_query_gateway(cs) == ARPR_OK ? 0 : -1;
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_announce(struct client_state_t *cs)
Handle carrier interruptions in arp_collision_timeout() better. Still not ideal; we need to note and retry these errors, but these changes are preparatory and do not introduce regressions.
2017-02-24 16:06:05 +05:30
{
arp: Handle initial announcement asynchronously and retry failures. We need to send two ARP announcements, so these are now done via a timeout callback so that failures can be handled properly.
2017-02-24 16:57:15 +05:30
if (cs->sent_first_announce && cs->sent_second_announce) {
garp.wake_ts[AS_ANNOUNCE] = -1;
return ARPR_OK;
}
Handle carrier interruptions in arp_collision_timeout() better. Still not ideal; we need to note and retry these errors, but these changes are preparatory and do not introduce regressions.
2017-02-24 16:06:05 +05:30
if (arp_announcement(cs) < 0) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: (%s) Failed to send ARP announcement: %s",
client_config.interface, __func__, strerror(errno));
arp: Handle initial announcement asynchronously and retry failures. We need to send two ARP announcements, so these are now done via a timeout callback so that failures can be handled properly.
2017-02-24 16:57:15 +05:30
garp.wake_ts[AS_ANNOUNCE] = curms() + ARP_RETRANS_DELAY ;
Handle carrier interruptions in arp_collision_timeout() better. Still not ideal; we need to note and retry these errors, but these changes are preparatory and do not introduce regressions.
2017-02-24 16:06:05 +05:30
return ARPR_FAIL;
}
arp: Handle initial announcement asynchronously and retry failures. We need to send two ARP announcements, so these are now done via a timeout callback so that failures can be handled properly.
2017-02-24 16:57:15 +05:30
if (!cs->sent_first_announce)
cs->sent_first_announce = true;
else if (!cs->sent_second_announce)
cs->sent_second_announce = true;
if (!cs->sent_first_announce || !cs->sent_second_announce)
garp.wake_ts[AS_ANNOUNCE] = curms() + ARP_RETRANS_DELAY;
else
garp.wake_ts[AS_ANNOUNCE] = -1;
Handle carrier interruptions in arp_collision_timeout() better. Still not ideal; we need to note and retry these errors, but these changes are preparatory and do not introduce regressions.
2017-02-24 16:06:05 +05:30
return ARPR_OK;
}
arp: Handle initial announcement asynchronously and retry failures. We need to send two ARP announcements, so these are now done via a timeout callback so that failures can be handled properly.
2017-02-24 16:57:15 +05:30
// 1 == not yet time, 0 == timed out, success, -1 == timed out, failure
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_announce_timeout(struct client_state_t *cs, long long nowts)
arp: Handle initial announcement asynchronously and retry failures. We need to send two ARP announcements, so these are now done via a timeout callback so that failures can be handled properly.
2017-02-24 16:57:15 +05:30
{
long long rtts = garp.wake_ts[AS_ANNOUNCE];
if (rtts == -1) return 0;
if (nowts < rtts) return 1;
return arp_announce(cs) == ARPR_OK ? 0 : -1;
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_do_defense(struct client_state_t *cs)
Enable active defense of IP address / lease, as described in RFC5227.
2011-07-05 22:33:55 +05:30
{
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
// Even though the BPF will usually catch this case, sometimes there are
// packets still in the socket buffer that arrived before the defense
// BPF was installed, so it's necessary to check here.
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (!arp_validate_bpf_defense(cs, &garp.reply))
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_OK;
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: arp: Detected a peer attempting to use our IP!", client_config.interface);
Rather than use a single cs.timeout value, track individual timeouts for every ARP state and for the current DHCP state.
2011-07-11 20:09:36 +05:30
long long nowts = curms();
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.wake_ts[AS_DEFENSE] = -1;
if (!garp.last_conflict_ts ||
nowts - garp.last_conflict_ts < DEFEND_INTERVAL) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: arp: Defending our lease IP.", client_config.interface);
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
if (arp_announcement(cs) < 0)
return ARPR_FAIL;
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
} else if (!garp.relentless_def) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: arp: Conflicting peer is persistent. Requesting new lease.",
client_config.interface);
Enable active defense of IP address / lease, as described in RFC5227.
2011-07-05 22:33:55 +05:30
send_release(cs);
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_CONFLICT;
Enable active defense of IP address / lease, as described in RFC5227.
2011-07-05 22:33:55 +05:30
} else {
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.wake_ts[AS_DEFENSE] =
garp.send_stats[ASEND_ANNOUNCE].ts + DEFEND_INTERVAL;
Enable active defense of IP address / lease, as described in RFC5227.
2011-07-05 22:33:55 +05:30
}
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.total_conflicts++;
garp.last_conflict_ts = nowts;
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_OK;
Enable active defense of IP address / lease, as described in RFC5227.
2011-07-05 22:33:55 +05:30
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_do_gw_query(struct client_state_t *cs)
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
{
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
if (!arp_is_query_reply(&garp.reply))
return ARPR_OK;
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (!memcmp(garp.reply.sip4, &cs->routerAddr, 4)) {
memcpy(cs->routerArp, garp.reply.smac, 6);
arp.c: Make logging messages print the associated interface name.
2014-04-07 14:13:21 +05:30
log_line("%s: arp: Gateway hardware address %02x:%02x:%02x:%02x:%02x:%02x",
client_config.interface, cs->routerArp[0], cs->routerArp[1],
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
cs->routerArp[2], cs->routerArp[3],
cs->routerArp[4], cs->routerArp[5]);
Give up on fingerprinting router/gateway if it doesn't reply.
2020-10-19 13:55:15 +05:30
cs->router_arp_state = ARP_FOUND;
Improve fingerprinting to support DHCP relay agents. Mostly reverts the previous commit and instead teaches ndhc to properly handle the case when it is communicating with a DHCP relay agent on its local segment rather than directly with a DHCP server.
2015-02-13 09:58:54 +05:30
if (cs->routerAddr == cs->srcAddr)
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
goto server_is_router;
Give up on fingerprinting relay agent/server if it doesn't reply. Try to send/wait three times; then if there's no response, then assume that the relay agent is ignoring or firewalled from receiving ARP requests.
2020-10-19 12:37:23 +05:30
if (cs->server_arp_state != ARP_QUERY) {
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
garp.wake_ts[AS_GW_QUERY] = -1;
if (arp_open_fd(cs, true) < 0)
return ARPR_FAIL;
return ARPR_FREE;
}
return ARPR_OK;
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
}
Improve fingerprinting to support DHCP relay agents. Mostly reverts the previous commit and instead teaches ndhc to properly handle the case when it is communicating with a DHCP relay agent on its local segment rather than directly with a DHCP server.
2015-02-13 09:58:54 +05:30
if (!memcmp(garp.reply.sip4, &cs->srcAddr, 4)) {
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
server_is_router:
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
memcpy(cs->serverArp, garp.reply.smac, 6);
Improve fingerprinting to support DHCP relay agents. Mostly reverts the previous commit and instead teaches ndhc to properly handle the case when it is communicating with a DHCP relay agent on its local segment rather than directly with a DHCP server.
2015-02-13 09:58:54 +05:30
log_line("%s: arp: DHCP agent hardware address %02x:%02x:%02x:%02x:%02x:%02x",
arp.c: Make logging messages print the associated interface name.
2014-04-07 14:13:21 +05:30
client_config.interface, cs->serverArp[0], cs->serverArp[1],
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
cs->serverArp[2], cs->serverArp[3],
cs->serverArp[4], cs->serverArp[5]);
Give up on fingerprinting relay agent/server if it doesn't reply. Try to send/wait three times; then if there's no response, then assume that the relay agent is ignoring or firewalled from receiving ARP requests.
2020-10-19 12:37:23 +05:30
cs->server_arp_state = ARP_FOUND;
Give up on fingerprinting router/gateway if it doesn't reply.
2020-10-19 13:55:15 +05:30
if (cs->router_arp_state != ARP_QUERY) {
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
garp.wake_ts[AS_GW_QUERY] = -1;
if (arp_open_fd(cs, true) < 0)
return ARPR_FAIL;
return ARPR_FREE;
}
return ARPR_OK;
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
}
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_OK;
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_do_collision_check(struct client_state_t *cs)
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
{
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (!arp_is_query_reply(&garp.reply))
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_OK;
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
// If this packet was sent from our lease IP, and does not have a
// MAC address matching our own (the latter check guards against stupid
// hubs or repeaters), then it's a conflict and thus a failure.
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (!memcmp(garp.reply.sip4, &garp.dhcp_packet.yiaddr, 4) &&
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
!memcmp(client_config.arp, garp.reply.smac, 6))
{
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
garp.total_conflicts++;
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
garp.wake_ts[AS_COLLISION_CHECK] = -1;
log_line("%s: arp: Offered address is in use. Declining.",
client_config.interface);
int r = send_decline(cs, garp.dhcp_packet.yiaddr);
if (r < 0) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: Failed to send a decline notice packet.",
client_config.interface);
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_FAIL;
}
return ARPR_CONFLICT;
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
}
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_OK;
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
int arp_do_gw_check(struct client_state_t *cs)
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
{
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (!arp_is_query_reply(&garp.reply))
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_OK;
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (!memcmp(garp.reply.sip4, &cs->routerAddr, 4)) {
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
// Success only if the router/gw MAC matches stored value
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (!memcmp(cs->routerArp, garp.reply.smac, 6)) {
garp.router_replied = true;
Improve fingerprinting to support DHCP relay agents. Mostly reverts the previous commit and instead teaches ndhc to properly handle the case when it is communicating with a DHCP relay agent on its local segment rather than directly with a DHCP server.
2015-02-13 09:58:54 +05:30
if (cs->routerAddr == cs->srcAddr)
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
goto server_is_router;
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (garp.server_replied)
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return arp_gw_success(cs); // FREE or FAIL
return ARPR_OK;
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
}
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
log_line("%s: arp: Gateway is different. Getting a new lease.",
client_config.interface);
garp.wake_ts[AS_GW_CHECK] = -1;
return ARPR_CONFLICT;
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
}
Improve fingerprinting to support DHCP relay agents. Mostly reverts the previous commit and instead teaches ndhc to properly handle the case when it is communicating with a DHCP relay agent on its local segment rather than directly with a DHCP server.
2015-02-13 09:58:54 +05:30
if (!memcmp(garp.reply.sip4, &cs->srcAddr, 4)) {
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
server_is_router:
// Success only if the server MAC matches stored value
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (!memcmp(cs->serverArp, garp.reply.smac, 6)) {
garp.server_replied = true;
if (garp.router_replied)
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return arp_gw_success(cs); // FREE or FAIL
return ARPR_OK;
Record the MAC address of the DHCP server and use it to identify the network when the hardware link carrier is dropped and comes back. Also, don't assume that all networks have a default gateway. Guard against spurious arp defense attempts that might be triggered by packets that are still in the socket buffer from before the BPF was changed. Split apart the AS_GW_CHECK and AS_GW_QUERY timeout handlers. Cosmetic cleanups in state.c.
2011-07-11 22:54:59 +05:30
}
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
log_line("%s: arp: DHCP agent is different. Getting a new lease.",
client_config.interface);
garp.wake_ts[AS_GW_CHECK] = -1;
return ARPR_CONFLICT;
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
}
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
return ARPR_OK;
Separate event state gathering from action dispatch in main epoll loop. This is the first step towards using coroutines.
2015-02-15 17:08:03 +05:30
}
Replace mostly obsolete -[static 1] with reliable old *-. This notation originally had the sole advantage of implying that the pointer was non-NULL, but it has seen little use and now clang presents warnings about it in certain contexts.
2022-01-12 09:05:19 +05:30
bool arp_packet_get(struct client_state_t *cs)
Move timeout and arp handling code out to arpping.c and timeout.c.
2010-12-24 20:02:58 +05:30
{
Use poll() instead of epoll() for ndhc-master.
2020-10-20 15:24:00 +05:30
if (cs->arpFd < 0)
return false;
arp: Take extra care to preserve last received ARP packet.
2017-04-10 18:59:36 +05:30
struct arpMsg amsg;
Make sure that all safe_* return values use ssize_t.
2014-04-06 15:54:13 +05:30
ssize_t r = 0;
arp: Remove reply_offset, and keep previous ARP packet after epoll. ARP packets aren't split across multiple receive events, so reply_offset is pointless, and we implicitly assume that the previous ARP packet data is still available after a forced sleep.
2017-04-10 18:26:11 +05:30
size_t bytes_read = 0;
arp: Take extra care to preserve last received ARP packet.
2017-04-10 18:59:36 +05:30
if (bytes_read < sizeof amsg) {
r = safe_read(cs->arpFd, (char *)&amsg + bytes_read,
sizeof amsg - bytes_read);
Separate event state gathering from action dispatch in main epoll loop. This is the first step towards using coroutines.
2015-02-15 17:08:03 +05:30
if (r == 0)
Fix the return values of dhcp_packet_get and arp_packet_get. This corrects a bug where stale dhcp packets would get reprocessed, causing very bad behavior; an issue that was introduced in the coroutine conversion.
2015-02-18 21:32:13 +05:30
return false;
arp.c: If the safe_read that fetches arp responses encounters a return of -1 with errno == EAGAIN or EWOULDBLOCK, then report the error, as it should never happen given that the function is called only once after polling for ready-reads. Further, the old code was buggy; it would subtract from the arpreply_offset the return value of -1 in that case, which is just wrong.
2014-04-06 15:32:03 +05:30
if (r < 0) {
Simplify logging and fix some format specifiers.
2020-11-25 07:32:51 +05:30
log_line("%s: (%s) ARP response read failed: %s",
client_config.interface, __func__, strerror(errno));
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
// Timeouts will trigger anyway without being forced.
arp_min_close_fd(cs);
if (arp_open_fd(cs, cs->arp_is_defense) < 0)
suicide("%s: (%s) Failed to reopen ARP fd: %s",
client_config.interface, __func__, strerror(errno));
Fix the return values of dhcp_packet_get and arp_packet_get. This corrects a bug where stale dhcp packets would get reprocessed, causing very bad behavior; an issue that was introduced in the coroutine conversion.
2015-02-18 21:32:13 +05:30
return false;
Separate event state gathering from action dispatch in main epoll loop. This is the first step towards using coroutines.
2015-02-15 17:08:03 +05:30
}
arp: Remove reply_offset, and keep previous ARP packet after epoll. ARP packets aren't split across multiple receive events, so reply_offset is pointless, and we implicitly assume that the previous ARP packet data is still available after a forced sleep.
2017-04-10 18:26:11 +05:30
bytes_read += (size_t)r;
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
}
Fix a problem where, when ndhc is waiting for an arp packet, an arp packet is received that is discarded by ndhc's basic checks and provokes a busy loop in the main program loop because epoll_wait() constantly sees data that is never drained from the socket buffer since arp_offset exceeds the maximum size of an ARP packet and would overflow the packet buffer.
2011-06-29 09:20:36 +05:30
arp: Remove reply_offset, and keep previous ARP packet after epoll. ARP packets aren't split across multiple receive events, so reply_offset is pointless, and we implicitly assume that the previous ARP packet data is still available after a forced sleep.
2017-04-10 18:26:11 +05:30
if (bytes_read < ARP_MSG_SIZE)
Fix the return values of dhcp_packet_get and arp_packet_get. This corrects a bug where stale dhcp packets would get reprocessed, causing very bad behavior; an issue that was introduced in the coroutine conversion.
2015-02-18 21:32:13 +05:30
return false;
Make arp code more robust and refactor it a bit. Handle failure to create arp sockets more gracefully. Add initial support for retransmitting arp requests if no reply is met after a certain number of spurious packets.
2011-03-31 12:02:34 +05:30
Massive overhaul to arp.c in preparation for adding address defense: Use a separate state machine for the arp handling. It's loosely coupled to the dhcp code, and is thus much easier to reason about than the previous approach that made the arp code use the dhcp state. Add a BPF and C emulation of the BPF for RFC5227-style address defense. Allow switchable BPF filters for the arp socket. Fix a regression introduced in the arp announcement commit. Contrary to RFC5227, the 'h_dest' field in the ARP packet should be set to all 0xff for wildcard semantics, not all 0x00. Keep track of the millisecond timestamp of the most recent ARP packet that has been sent as well as the total number of packets that have been sent in the current ARP state. Use these values to implement time-based ARP retransmit. When querying the default gateway/router, use ARP packets that have the source IP set to the client lease IP rather than 0.0.0.0. Combine common code in the arp sending functions into arp_send(). Resequence the arp_announcement() in arp_success() so that it happens after the interface is configured by ifchange() / ifchd. Get rid of layering hack in ifchange.c to set the router address in the client state. Do it in the proper place in arp.c. Add an early exit before ifchd_cmd() in ifchange.c. This change prevents sending a ':' to ifchd for a string type option with no string content.
2011-07-05 05:37:16 +05:30
// Emulate the BPF filters if they are not in use.
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (!garp.using_bpf &&
arp: Take extra care to preserve last received ARP packet.
2017-04-10 18:59:36 +05:30
(!arp_validate_bpf(&amsg) ||
Use a coroutine instead of several callback state machines. This change makes it much easier to reason about ndhc's behavior and properly handle errors. It is a very large changeset, but there is no way to make this sort of change incrementally. Lease acquisition is tested to work. It is highly likely that some bugs were both introduced and squashed here. Some obvious code cleanups will quickly follow.
2015-02-18 16:01:13 +05:30
(cs->arp_is_defense &&
arp: Take extra care to preserve last received ARP packet.
2017-04-10 18:59:36 +05:30
!arp_validate_bpf_defense(cs, &amsg)))) {
Fix the return values of dhcp_packet_get and arp_packet_get. This corrects a bug where stale dhcp packets would get reprocessed, causing very bad behavior; an issue that was introduced in the coroutine conversion.
2015-02-18 21:32:13 +05:30
return false;
Fix a problem where, when ndhc is waiting for an arp packet, an arp packet is received that is discarded by ndhc's basic checks and provokes a busy loop in the main program loop because epoll_wait() constantly sees data that is never drained from the socket buffer since arp_offset exceeds the maximum size of an ARP packet and would overflow the packet buffer.
2011-06-29 09:20:36 +05:30
}
arp: Take extra care to preserve last received ARP packet.
2017-04-10 18:59:36 +05:30
memcpy(&garp.reply, &amsg, sizeof garp.reply);
Fix the return values of dhcp_packet_get and arp_packet_get. This corrects a bug where stale dhcp packets would get reprocessed, causing very bad behavior; an issue that was introduced in the coroutine conversion.
2015-02-18 21:32:13 +05:30
return true;
Refactor the ARP code to be similar to the dhcp code -- timeout functions and packet response functions are handled by an array of function pointers indexed by ARP state. Split arp_retransmit() apart into simpler functions. Fix a typo in renewing_timeout() that would result in too-short timeouts that would soak cpu. Call handle_arp_timeout() from the timeout_action() function rather than having explicit hooks in various <dhcpstate>_timeout() functions. Make the function pointer arrays static const.
2011-07-11 14:39:38 +05:30
}
Rather than use a single cs.timeout value, track individual timeouts for every ARP state and for the current DHCP state.
2011-07-11 20:09:36 +05:30
Track pending events in time by using absolute times rather than relative timeouts.
2011-07-11 21:01:27 +05:30
long long arp_get_wake_ts(void)
Rather than use a single cs.timeout value, track individual timeouts for every ARP state and for the current DHCP state.
2011-07-11 20:09:36 +05:30
{
Track pending events in time by using absolute times rather than relative timeouts.
2011-07-11 21:01:27 +05:30
long long mt = -1;
Rather than use a single cs.timeout value, track individual timeouts for every ARP state and for the current DHCP state.
2011-07-11 20:09:36 +05:30
for (int i = 0; i < AS_MAX; ++i) {
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (garp.wake_ts[i] < 0)
Rather than use a single cs.timeout value, track individual timeouts for every ARP state and for the current DHCP state.
2011-07-11 20:09:36 +05:30
continue;
Consolidate all of the global static variables in arp.c into a single struct, and use booleans where appropriate.
2014-04-07 07:42:31 +05:30
if (mt < 0 || mt > garp.wake_ts[i])
mt = garp.wake_ts[i];
Rather than use a single cs.timeout value, track individual timeouts for every ARP state and for the current DHCP state.
2011-07-11 20:09:36 +05:30
}
Track pending events in time by using absolute times rather than relative timeouts.
2011-07-11 21:01:27 +05:30
return mt;
Rather than use a single cs.timeout value, track individual timeouts for every ARP state and for the current DHCP state.
2011-07-11 20:09:36 +05:30
}