diff options
Diffstat (limited to 'shared/n-acd/src/n-acd.c')
| -rw-r--r-- | shared/n-acd/src/n-acd.c | 1027 |
1 files changed, 0 insertions, 1027 deletions
diff --git a/shared/n-acd/src/n-acd.c b/shared/n-acd/src/n-acd.c deleted file mode 100644 index c1d92865..00000000 --- a/shared/n-acd/src/n-acd.c +++ /dev/null @@ -1,1027 +0,0 @@ -/* - * IPv4 Address Conflict Detection - * - * This file contains the main context initialization and management functions, - * as well as a bunch of utilities used through the n-acd modules. - */ - -/** - * DOC: IPv4 Address Conflict Detection - * - * The `n-acd` project implements the IPv4 Address Conflict Detection protocol - * as defined in RFC-5227. The protocol originates in the IPv4 Link Local - * Address selection but was later on generalized and resulted in `ACD`. The - * idea is to use `ARP` to query a link for an address to see whether it - * already exists on the network, as well as defending an address that is in - * use on a network interface. Furthermore, `ACD` provides passive diagnostics - * for administrators, as it will detect address conflicts automatically, which - * then can be logged or shown to a user. - * - * The main context object of `n-acd` is the `NAcd` structure. It is a passive - * ref-counted context object which drives `ACD` probes running on it. A - * context is specific to a linux network device and transport. If multiple - * network devices are used, then separate `NAcd` contexts must be deployed. - * - * The `NAcdProbe` object drives a single `ACD` state-machine. A probe is - * created on an `NAcd` context by providing an address to probe for. The probe - * will then raise notifications whether the address conflict detection found - * something, or whether the address is ready to be used. Optionally, the probe - * will then enter into passive mode and defend the address as long as it is - * kept active. - * - * Note that the `n-acd` project only implements the networking protocol. It - * never queries or modifies network interfaces. It completely relies on the - * API user to react to notifications and update network interfaces - * respectively. `n-acd` uses an event-mechanism on every context object. All - * events raise by any probe or operation on a given context will queue all - * events on that context object. The event-queue can then be drained by the - * API user. All events are properly asynchronous and designed in a way that no - * synchronous reaction to any event is required. That is, the events are - * carefully designed to allow forwarding via IPC (or even networks) to a - * controller that handles them and specifies how to react. Furthermore, none - * of the function calls of `n-acd` require synchronous error handling. - * Instead, functions only ever return values on fatal errors. Everything else - * is queued as events, thus guaranteeing that synchronous handling of return - * values is not required. Exceptions are functions that do not affect internal - * state or do not have an associated context object. - */ - -#include <assert.h> -#include <c-list.h> -#include <c-rbtree.h> -#include <c-siphash.h> -#include <c-stdaux.h> -#include <endian.h> -#include <errno.h> -#include <inttypes.h> -#include <limits.h> -#include <linux/if_packet.h> -#include <netinet/if_ether.h> -#include <netinet/in.h> -#include <stdlib.h> -#include <string.h> -#include <sys/auxv.h> -#include <sys/epoll.h> -#include <sys/socket.h> -#include <sys/types.h> -#include <unistd.h> -#include "n-acd.h" -#include "n-acd-private.h" - -enum { - N_ACD_EPOLL_TIMER, - N_ACD_EPOLL_SOCKET, -}; - -static int n_acd_get_random(unsigned int *random) { - uint8_t hash_seed[] = { - 0x3a, 0x0c, 0xa6, 0xdd, 0x44, 0xef, 0x5f, 0x7a, - 0x5e, 0xd7, 0x25, 0x37, 0xbf, 0x4e, 0x80, 0xa1, - }; - CSipHash hash = C_SIPHASH_NULL; - struct timespec ts; - const uint8_t *p; - int r; - - /* - * We need random jitter for all timeouts when handling ARP probes. Use - * AT_RANDOM to get a seed for rand_r(3p), if available (should always - * be available on linux). See the time-out scheduler for details. - * Additionally, we include the current time in the seed. This avoids - * using the same jitter in case you run multiple ACD engines in the - * same process. Lastly, the seed is hashed with SipHash24 to avoid - * exposing the value of AT_RANDOM on the network. - */ - c_siphash_init(&hash, hash_seed); - - p = (const uint8_t *)getauxval(AT_RANDOM); - if (p) - c_siphash_append(&hash, p, 16); - - r = clock_gettime(CLOCK_MONOTONIC, &ts); - if (r < 0) - return -c_errno(); - - c_siphash_append(&hash, (const uint8_t *)&ts.tv_sec, sizeof(ts.tv_sec)); - c_siphash_append(&hash, (const uint8_t *)&ts.tv_nsec, sizeof(ts.tv_nsec)); - - *random = c_siphash_finalize(&hash); - return 0; -} - -static int n_acd_socket_new(int *fdp, int fd_bpf_prog, NAcdConfig *config) { - const struct sockaddr_ll address = { - .sll_family = AF_PACKET, - .sll_protocol = htobe16(ETH_P_ARP), - .sll_ifindex = config->ifindex, - .sll_halen = ETH_ALEN, - .sll_addr = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, - }; - int r, s = -1; - - s = socket(PF_PACKET, SOCK_DGRAM | SOCK_CLOEXEC | SOCK_NONBLOCK, 0); - if (s < 0) { - r = -c_errno(); - goto error; - } - - if (fd_bpf_prog >= 0) { - r = setsockopt(s, SOL_SOCKET, SO_ATTACH_BPF, &fd_bpf_prog, sizeof(fd_bpf_prog)); - if (r < 0) { - r = -c_errno(); - goto error; - } - } - - r = bind(s, (struct sockaddr *)&address, sizeof(address)); - if (r < 0) { - r = -c_errno(); - goto error; - } - - *fdp = s; - s = -1; - return 0; - -error: - if (s >= 0) - close(s); - return r; -} - -/** - * n_acd_config_new() - create configuration object - * @configp: output argument for new configuration - * - * This creates a new configuration object and provides it to the caller. The - * object is fully owned by the caller upon function return. - * - * A configuration object is a passive structure that is used to collect - * information that is then passed to a constructor or other function. A - * configuration never validates the data, but it is up to the consumer of a - * configuration to do that. - * - * Return: 0 on success, negative error code on failure. - */ -_c_public_ int n_acd_config_new(NAcdConfig **configp) { - _c_cleanup_(n_acd_config_freep) NAcdConfig *config = NULL; - - config = malloc(sizeof(*config)); - if (!config) - return -ENOMEM; - - *config = (NAcdConfig)N_ACD_CONFIG_NULL(*config); - - *configp = config; - config = NULL; - return 0; -} - -/** - * n_acd_config_free() - destroy configuration object - * @config: configuration to operate on, or NULL - * - * This destroys the configuration object @config. If @config is NULL, this is - * a no-op. - * - * Return: NULL is returned. - */ -_c_public_ NAcdConfig *n_acd_config_free(NAcdConfig *config) { - if (!config) - return NULL; - - free(config); - - return NULL; -} - -/** - * n_acd_config_set_ifindex() - set ifindex property - * @config: configuration to operate on - * @ifindex: ifindex to set - * - * This sets the @ifindex property of the configuration object. Any previous - * value is overwritten. - * - * A valid ifindex is a 32bit integer greater than 0. Any other value is - * treated as unspecified. - * - * The ifindex corresponds to the interface index provided by the linux kernel. - * It specifies the network device to be used. - */ -_c_public_ void n_acd_config_set_ifindex(NAcdConfig *config, int ifindex) { - config->ifindex = ifindex; -} - -/** - * n_acd_config_set_transport() - set transport property - * @config: configuration to operate on - * @transport: transport to set - * - * This specifies the transport to use. A transport must be one of the - * `N_ACD_TRANSPORT_*` identifiers. It selects which transport protocol `n-acd` - * will run on. - */ -_c_public_ void n_acd_config_set_transport(NAcdConfig *config, unsigned int transport) { - config->transport = transport; -} - -/** - * n_acd_config_set_mac() - set mac property - * @config: configuration to operate on - * @mac: mac to set - * - * This specifies the hardware address (also referred to as `MAC Address`) to - * use. Any hardware address can be specified. It is the caller's - * responsibility to make sure the address can actually be used. - * - * The address in @mac is copied into @config. It does not have to be retained - * by the caller. - */ -_c_public_ void n_acd_config_set_mac(NAcdConfig *config, const uint8_t *mac, size_t n_mac) { - /* - * We truncate the address at the maximum we support. We still remember - * the original length, so any consumer of this configuration can then - * complain about an unsupported address length. This allows us to - * avoid a memory allocation here and having to return `int`. - */ - config->n_mac = n_mac; - memcpy(config->mac, mac, n_mac > ETH_ALEN ? ETH_ALEN : n_mac); -} - -int n_acd_event_node_new(NAcdEventNode **nodep) { - NAcdEventNode *node; - - node = malloc(sizeof(*node)); - if (!node) - return -ENOMEM; - - *node = (NAcdEventNode)N_ACD_EVENT_NODE_NULL(*node); - - *nodep = node; - return 0; -} - -NAcdEventNode *n_acd_event_node_free(NAcdEventNode *node) { - if (!node) - return NULL; - - c_list_unlink(&node->probe_link); - c_list_unlink(&node->acd_link); - free(node); - - return NULL; -} - -int n_acd_ensure_bpf_map_space(NAcd *acd) { - NAcdProbe *probe; - _c_cleanup_(c_closep) int fd_map = -1, fd_prog = -1; - size_t max_map; - int r; - - if (acd->n_bpf_map < acd->max_bpf_map) - return 0; - - max_map = 2 * acd->max_bpf_map; - - r = n_acd_bpf_map_create(&fd_map, max_map); - if (r) - return r; - - c_rbtree_for_each_entry(probe, &acd->ip_tree, ip_node) { - r = n_acd_bpf_map_add(fd_map, &probe->ip); - if (r) - return r; - } - - r = n_acd_bpf_compile(&fd_prog, fd_map, (struct ether_addr*) acd->mac); - if (r) - return r; - - if (fd_prog >= 0) { - r = setsockopt(acd->fd_socket, SOL_SOCKET, SO_ATTACH_BPF, &fd_prog, sizeof(fd_prog)); - if (r) - return -c_errno(); - } - - if (acd->fd_bpf_map >= 0) - close(acd->fd_bpf_map); - acd->fd_bpf_map = fd_map; - fd_map = -1; - acd->max_bpf_map = max_map; - return 0; -} - -/** - * n_acd_new() - create a new ACD context - * @acdp: output argument for new context object - * @config: configuration parameters - * - * Create a new ACD context and return it in @acdp. The configuration @config - * must be initialized by the caller and must specify a valid network - * interface, transport mechanism, as well as hardware address compatible with - * the selected transport. The configuration is copied into the context. The - * @config object thus does not have to be retained by the caller. - * - * Return: 0 on success, negative error code on failure. - */ -_c_public_ int n_acd_new(NAcd **acdp, NAcdConfig *config) { - _c_cleanup_(n_acd_unrefp) NAcd *acd = NULL; - _c_cleanup_(c_closep) int fd_bpf_prog = -1; - struct epoll_event eevent; - int r; - - if (config->ifindex <= 0 || - config->transport != N_ACD_TRANSPORT_ETHERNET || - config->n_mac != ETH_ALEN || - !memcmp(config->mac, (uint8_t[ETH_ALEN]){ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, ETH_ALEN)) - return N_ACD_E_INVALID_ARGUMENT; - - acd = malloc(sizeof(*acd)); - if (!acd) - return -ENOMEM; - - *acd = (NAcd)N_ACD_NULL(*acd); - acd->ifindex = config->ifindex; - memcpy(acd->mac, config->mac, ETH_ALEN); - - r = n_acd_get_random(&acd->seed); - if (r) - return r; - - acd->fd_epoll = epoll_create1(EPOLL_CLOEXEC); - if (acd->fd_epoll < 0) - return -c_errno(); - - r = timer_init(&acd->timer); - if (r < 0) - return r; - - acd->max_bpf_map = 8; - - r = n_acd_bpf_map_create(&acd->fd_bpf_map, acd->max_bpf_map); - if (r) - return r; - - r = n_acd_bpf_compile(&fd_bpf_prog, acd->fd_bpf_map, (struct ether_addr*) acd->mac); - if (r) - return r; - - r = n_acd_socket_new(&acd->fd_socket, fd_bpf_prog, config); - if (r) - return r; - - eevent = (struct epoll_event){ - .events = EPOLLIN, - .data.u32 = N_ACD_EPOLL_TIMER, - }; - r = epoll_ctl(acd->fd_epoll, EPOLL_CTL_ADD, acd->timer.fd, &eevent); - if (r < 0) - return -c_errno(); - - eevent = (struct epoll_event){ - .events = EPOLLIN, - .data.u32 = N_ACD_EPOLL_SOCKET, - }; - r = epoll_ctl(acd->fd_epoll, EPOLL_CTL_ADD, acd->fd_socket, &eevent); - if (r < 0) - return -c_errno(); - - *acdp = acd; - acd = NULL; - return 0; -} - -static void n_acd_free_internal(NAcd *acd) { - NAcdEventNode *node, *t_node; - - if (!acd) - return; - - c_list_for_each_entry_safe(node, t_node, &acd->event_list, acd_link) - n_acd_event_node_free(node); - - c_assert(c_rbtree_is_empty(&acd->ip_tree)); - - if (acd->fd_socket >= 0) { - c_assert(acd->fd_epoll >= 0); - epoll_ctl(acd->fd_epoll, EPOLL_CTL_DEL, acd->fd_socket, NULL); - close(acd->fd_socket); - acd->fd_socket = -1; - } - - if (acd->fd_bpf_map >= 0) { - close(acd->fd_bpf_map); - acd->fd_bpf_map = -1; - } - - if (acd->timer.fd >= 0) { - c_assert(acd->fd_epoll >= 0); - epoll_ctl(acd->fd_epoll, EPOLL_CTL_DEL, acd->timer.fd, NULL); - timer_deinit(&acd->timer); - } - - if (acd->fd_epoll >= 0) { - close(acd->fd_epoll); - acd->fd_epoll = -1; - } - - free(acd); -} - -/** - * n_acd_ref() - acquire reference - * @acd: context to operate on, or NULL - * - * This acquires a single reference to the context specified as @acd. If @acd - * is NULL, this is a no-op. - * - * Return: @acd is returned. - */ -_c_public_ NAcd *n_acd_ref(NAcd *acd) { - if (acd) - ++acd->n_refs; - return acd; -} - -/** - * n_acd_unref() - release reference - * @acd: context to operate on, or NULL - * - * This releases a single reference to the context @acd. If this is the last - * reference, the context is torn down and deallocated. - * - * Return: NULL is returned. - */ -_c_public_ NAcd *n_acd_unref(NAcd *acd) { - if (acd && !--acd->n_refs) - n_acd_free_internal(acd); - return NULL; -} - -int n_acd_raise(NAcd *acd, NAcdEventNode **nodep, unsigned int event) { - NAcdEventNode *node; - int r; - - r = n_acd_event_node_new(&node); - if (r) - return r; - - node->event.event = event; - c_list_link_tail(&acd->event_list, &node->acd_link); - - if (nodep) - *nodep = node; - return 0; -} - -int n_acd_send(NAcd *acd, const struct in_addr *tpa, const struct in_addr *spa) { - struct sockaddr_ll address = { - .sll_family = AF_PACKET, - .sll_protocol = htobe16(ETH_P_ARP), - .sll_ifindex = acd->ifindex, - .sll_halen = ETH_ALEN, - .sll_addr = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, - }; - struct ether_arp arp = { - .ea_hdr = { - .ar_hrd = htobe16(ARPHRD_ETHER), - .ar_pro = htobe16(ETHERTYPE_IP), - .ar_hln = sizeof(acd->mac), - .ar_pln = sizeof(uint32_t), - .ar_op = htobe16(ARPOP_REQUEST), - }, - }; - ssize_t l; - int r; - - memcpy(arp.arp_sha, acd->mac, sizeof(acd->mac)); - memcpy(arp.arp_tpa, &tpa->s_addr, sizeof(uint32_t)); - - if (spa) - memcpy(arp.arp_spa, &spa->s_addr, sizeof(spa->s_addr)); - - l = sendto(acd->fd_socket, - &arp, - sizeof(arp), - MSG_NOSIGNAL, - (struct sockaddr *)&address, - sizeof(address)); - if (l < 0) { - if (errno == EAGAIN || errno == ENOBUFS) { - /* - * We never maintain outgoing queues. We rely on the - * network device to do that for us. In case the queues - * are full, or the kernel refuses to queue the packet - * for other reasons, we must tell our caller that the - * packet was dropped. - */ - return N_ACD_E_DROPPED; - } else if (errno == ENETDOWN || errno == ENXIO) { - /* - * These errors happen if the network device went down - * or was actually removed. We always propagate this as - * event, so the user can react accordingly (similarly - * to the recvmmsg(2) handler). In case the user does - * not immediately react, we also tell our caller that - * the packet was dropped, so we don't erroneously - * treat this as success. - */ - - r = n_acd_raise(acd, NULL, N_ACD_EVENT_DOWN); - if (r) - return r; - - return N_ACD_E_DROPPED; - } - - /* - * Random network error. We treat this as fatal and propagate - * the error, so it is noticed and can be investigated. - */ - return -c_errno(); - } else if (l != (ssize_t)sizeof(arp)) { - /* - * Ugh, the kernel modified the packet. This is unexpected. We - * consider the packet lost. - */ - return N_ACD_E_DROPPED; - } - - return 0; -} - -/** - * n_acd_get_fd() - get pollable file descriptor - * @acd: context object to operate on - * @fdp: output argument for file descriptor - * - * This returns the backing file-descriptor of the context object @acd. The - * file-descriptor is owned by @acd and valid as long as @acd is. The - * file-descriptor never changes, so it can be cached by the caller as long as - * they hold a reference to @acd. - * - * The file-descriptor is internal to the @acd context and should not be - * modified by the caller. It is only exposed to allow the caller to poll on - * it. Whenever the file-descriptor polls readable, n_acd_dispatch() should be - * called. - * - * Currently, the file-descriptor is an epoll-fd. - */ -_c_public_ void n_acd_get_fd(NAcd *acd, int *fdp) { - *fdp = acd->fd_epoll; -} - -static int n_acd_handle_timeout(NAcd *acd) { - NAcdProbe *probe; - uint64_t now; - int r; - - /* - * Read the current time once, and handle all timeouts that triggered - * before the current time. Rereading the current time in each loop - * might risk creating a live-lock, and the fact that we read the - * time after reading the timer guarantees that the timeout which - * woke us up is handled. - * - * When there are no more timeouts to handle at the given time, we - * rearm the timer to potentially wake us up again in the future. - */ - timer_now(&acd->timer, &now); - - for (;;) { - Timeout *timeout; - - r = timer_pop_timeout(&acd->timer, now, &timeout); - if (r < 0) { - return r; - } else if (!timeout) { - /* - * There are no more timeouts pending before @now. Rearm - * the timer to fire again at the next timeout. - */ - timer_rearm(&acd->timer); - break; - } - - probe = (void *)timeout - offsetof(NAcdProbe, timeout); - r = n_acd_probe_handle_timeout(probe); - if (r) - return r; - } - - return 0; -} - -static int n_acd_handle_packet(NAcd *acd, struct ether_arp *packet) { - bool hard_conflict; - NAcdProbe *probe; - uint32_t addr; - CRBNode *node; - int r; - - /* - * We are interested in 2 kinds of ARP messages: - * - * 1) Someone who is *NOT* us sends *ANY* ARP message with our IP - * address as sender. This is never good, because it implies an - * address conflict. - * We call this a hard-conflict. - * - * 2) Someone who is *NOT* us sends an ARP REQUEST without any sender - * IP, but our IP as target. This implies someone else performs an - * ARP Probe with our address. This also implies a conflict, but - * one that can be resolved by responding to the probe. - * We call this a soft-conflict. - * - * We are never interested in any other ARP message. The kernel already - * deals with everything else, hence, we can silently ignore those. - * - * Now, we simply check whether a sender-address is set. This allows us - * to distinguish both cases. We then check further conditions, so we - * can bail out early if neither is the case. - * - * Lastly, we perform a lookup in our probe-set to check whether the - * address actually matches, so we can let these probes dispatch the - * message. Note that we allow duplicate probes, so we need to dispatch - * each matching probe, not just one. - */ - - if (memcmp(packet->arp_spa, (uint8_t[4]){ }, sizeof(packet->arp_spa))) { - memcpy(&addr, packet->arp_spa, sizeof(addr)); - hard_conflict = true; - } else if (packet->ea_hdr.ar_op == htobe16(ARPOP_REQUEST)) { - memcpy(&addr, packet->arp_tpa, sizeof(addr)); - hard_conflict = false; - } else { - /* - * The BPF filter will not let through any other packet. - */ - return -EIO; - } - - /* Find top-most node that matches @addr. */ - node = acd->ip_tree.root; - while (node) { - probe = c_rbnode_entry(node, NAcdProbe, ip_node); - if (addr < probe->ip.s_addr) - node = node->left; - else if (addr > probe->ip.s_addr) - node = node->right; - else - break; - } - - /* - * If the address is unknown, we drop the package. This might happen if - * the kernel queued the packet and passed the BPF filter, but we - * modified the set before dequeuing the message. - */ - if (!node) - return 0; - - /* Forward to left-most child that still matches @addr. */ - while (node->left && addr == c_rbnode_entry(node->left, - NAcdProbe, - ip_node)->ip.s_addr) - node = node->left; - - /* Iterate all matching entries in-order. */ - do { - probe = c_rbnode_entry(node, NAcdProbe, ip_node); - - r = n_acd_probe_handle_packet(probe, packet, hard_conflict); - if (r) - return r; - - node = c_rbnode_next(node); - } while (node && addr == c_rbnode_entry(node, - NAcdProbe, - ip_node)->ip.s_addr); - - return 0; -} - -static int n_acd_dispatch_timer(NAcd *acd, struct epoll_event *event) { - int r; - - if (event->events & (EPOLLHUP | EPOLLERR)) { - /* - * There is no way to handle either gracefully. If we ignored - * them, we would busy-loop, so lets rather forward the error - * to the caller. - */ - return -EIO; - } - - if (event->events & EPOLLIN) { - r = timer_read(&acd->timer); - if (r <= 0) - return r; - - c_assert(r == TIMER_E_TRIGGERED); - - /* - * A timer triggered, handle all pending timeouts at a given - * point in time. There can only be a finite number of pending - * timeouts, any new ones will be in the future, so not handled - * now, but guaranteed to wake us up again when they do trigger. - */ - r = n_acd_handle_timeout(acd); - if (r) - return r; - } - - return 0; -} - -static bool n_acd_packet_is_valid(NAcd *acd, void *packet, size_t n_packet) { - struct ether_arp *arp; - - /* - * The eBPF filter will ensure that this function always returns true, however, - * this allows the eBPF filter to be an optional optimization which is necessary - * on older kernels. - * - * See comments in n-acd-bpf.c for details. - */ - - if (n_packet != sizeof(*arp)) - return false; - - arp = packet; - - if (arp->arp_hrd != htobe16(ARPHRD_ETHER)) - return false; - - if (arp->arp_pro != htobe16(ETHERTYPE_IP)) - return false; - - if (arp->arp_hln != sizeof(struct ether_addr)) - return false; - - if (arp->arp_pln != sizeof(struct in_addr)) - return false; - - if (!memcmp(arp->arp_sha, acd->mac, sizeof(struct ether_addr))) - return false; - - if (memcmp(arp->arp_spa, &((struct in_addr) { INADDR_ANY }), sizeof(struct in_addr))) { - if (arp->arp_op != htobe16(ARPOP_REQUEST) && arp->arp_op != htobe16(ARPOP_REPLY)) - return false; - } else if (arp->arp_op != htobe16(ARPOP_REQUEST)) { - return false; - } - - return true; -} - -static int n_acd_dispatch_socket(NAcd *acd, struct epoll_event *event) { - const size_t n_batch = 8; - struct mmsghdr msgs[n_batch]; - struct iovec iovecs[n_batch]; - struct ether_arp data[n_batch]; - size_t i; - int r, n; - - for (i = 0; i < n_batch; ++i) { - iovecs[i].iov_base = data + i; - iovecs[i].iov_len = sizeof(data[i]); - msgs[i].msg_hdr = (struct msghdr){ - .msg_iov = iovecs + i, - .msg_iovlen = 1, - }; - } - - /* - * We always directly call into recvmmsg(2), regardless which EPOLL* - * event is signalled. On sockets, the recv(2)-family of syscalls does - * a suitable job of handling all possible scenarios and telling us - * about it. Hence, lets take the easy route and always ask the kernel - * about the current state. - */ - n = recvmmsg(acd->fd_socket, msgs, n_batch, 0, NULL); - if (n < 0) { - if (errno == ENETDOWN) { - /* - * We get ENETDOWN if the network-device goes down or - * is removed. This error is temporary and only queued - * once. Subsequent reads will simply return EAGAIN - * until the device is up again and has data queued. - * Usually, the caller should tear down all probes when - * an interface goes down, but we leave it up to the - * caller to decide what to do. We propagate the code - * and continue. - */ - return n_acd_raise(acd, NULL, N_ACD_EVENT_DOWN); - } else if (errno == EAGAIN) { - /* - * There is no more data queued and we did not get - * preempted. Everything is good to go. - * As a safety-net against busy-looping, we do check - * for HUP/ERR. Neither should be set, since they imply - * error-dequeue behavior on all socket calls. Lets - * fail hard if we trigger it, so we can investigate. - */ - if (event->events & (EPOLLHUP | EPOLLERR)) - return -EIO; - - return 0; - } else { - /* - * Something went wrong. Propagate the error-code, so - * this can be investigated. - */ - return -c_errno(); - } - } else if (n >= (ssize_t)n_batch) { - /* - * If all buffers were filled with data, we cannot be sure that - * there is nothing left to read. But to avoid starvation, we - * cannot loop on this condition. Instead, we mark the context - * as preempted so the caller can call us again. - * Note that in level-triggered event-loops this condition can - * be neglected, but in edge-triggered event-loops it is - * crucial to forward this information. - * - * On the other hand, there are several conditions where the - * kernel might return less batches than requested, but was - * still preempted. However, all of those cases require the - * preemption to have triggered a wakeup *after* we entered - * recvmmsg(). Hence, even if we did not recognize the - * preemption, an edge must have triggered and as such we will - * handle the event on the next turn. - */ - acd->preempted = true; - } - - for (i = 0; (ssize_t)i < n; ++i) { - if (!n_acd_packet_is_valid(acd, data + i, msgs[i].msg_len)) - continue; - /* - * Handle the packet. Bail out if something went wrong. Note - * that this must be fatal errors, since we discard all other - * packets that follow. - */ - r = n_acd_handle_packet(acd, data + i); - if (r) - return r; - } - - return 0; -} - -/** - * n_acd_dispatch() - dispatch context - * @acd: context object to operate on - * - * This dispatches the internal state-machine of all probes and operations - * running on the context @acd. - * - * Any outside effect or event triggered by this dispatcher will be queued on - * the event-queue of @acd. Whenever the dispatcher returns, the caller is - * required to drain the event-queue via n_acd_pop_event() until it is empty. - * - * This function dispatches as many events as possible up to a static limit to - * prevent stalling execution. If the static limit is reached, this function - * will return with N_ACD_E_PREEMPTED, otherwise 0 is returned. In most cases - * preemption can be ignored, because level-triggered event notification - * handles it automatically. However, in case of edge-triggered event - * mechanisms, the caller must make sure to call the dispatcher again. - * - * Return: 0 on success, N_ACD_E_PREEMPTED on preemption, negative error code - * on failure. - */ -_c_public_ int n_acd_dispatch(NAcd *acd) { - struct epoll_event events[2]; - int n, i, r = 0; - - n = epoll_wait(acd->fd_epoll, events, sizeof(events) / sizeof(*events), 0); - if (n < 0) { - /* Linux never returns EINTR if `timeout == 0'. */ - return -c_errno(); - } - - acd->preempted = false; - - for (i = 0; i < n; ++i) { - switch (events[i].data.u32) { - case N_ACD_EPOLL_TIMER: - r = n_acd_dispatch_timer(acd, events + i); - break; - case N_ACD_EPOLL_SOCKET: - r = n_acd_dispatch_socket(acd, events + i); - break; - default: - c_assert(0); - r = 0; - break; - } - - if (r) - return r; - } - - return acd->preempted ? N_ACD_E_PREEMPTED : 0; -} - -/** - * n_acd_pop_event() - get the next pending event - * @acd: context object to operate on - * @eventp: output argument for the event - * - * Returns a pointer to the next pending event. The event is still owend by - * the context, and is only valid until the next call to n_acd_pop_event() - * or until the owning object is freed (either the ACD context or the indicated - * probe object). - * - * An event either originates on the ACD context, or one of the configured - * probes. If the event-type has a 'probe' pointer, it originated on the - * indicated probe (which is *never* NULL), otherwise it originated on the - * context. - * - * Users must call this function repeatedly until either an error is returned, - * or the event-pointer is NULL. Wakeups on the epoll-fd are only guaranteed - * for each batch of events. Hence, it is the callers responsibility to drain - * the event-queue somehow after each call to n_acd_dispatch(). Note that - * events can only be added by n_acd_dispatch(), hence, you cannot live-lock - * when draining the event queue. - * - * The possible events are: - * * N_ACD_EVENT_READY: A configured IP address was probed successfully - * and is ready to be used. Once configured on the - * interface, the caller must call n_acd_announce() - * to announce and start defending the address. - * * N_ACD_EVENT_USED: Someone is already using the IP address being - * probed. The probe is put into stopped state and - * should be freed by the caller. - * * N_ACD_EVENT_DEFENDED: A conflict was detected for an announced IP - * address, and the engine attempted to defend it. - * This is purely informational, and no action is - * required by the caller. - * * N_ACD_EVENT_CONFLICT: A conflict was detected for an announced IP - * address, and the probe was not able to defend - * it (according to the configured policy). The - * probe halted, the caller must stop using - * the address immediately, and should free the probe. - * * N_ACD_EVENT_DOWN: The specified network interface was put down. The - * user is recommended to free *ALL* probes and - * recreate them as soon as the interface is up again. - * Note that this event is purely informational. The - * probes will continue running, but all packets will - * be blackholed, and no network packets are received, - * until the network is back up again. Hence, from an - * operational perspective, the legitimacy of the ACD - * probes is lost and the user better re-probes all - * addresses. - * - * Returns: 0 on success, negative error code on failure. The popped event is - * returned in @eventp. If no event is pending, NULL is placed in - * @eventp and 0 is returned. If an error is returned, @eventp is left - * untouched. - */ -_c_public_ int n_acd_pop_event(NAcd *acd, NAcdEvent **eventp) { - NAcdEventNode *node, *t_node; - - c_list_for_each_entry_safe(node, t_node, &acd->event_list, acd_link) { - if (node->is_public) { - n_acd_event_node_free(node); - continue; - } - - node->is_public = true; - *eventp = &node->event; - return 0; - } - - *eventp = NULL; - return 0; -} - -/** - * n_acd_probe() - start new probe - * @acd: context object to operate on - * @probep: output argument for new probe - * @config: probe configuration - * - * This creates a new probe on the context @acd and returns the probe in - * @probep. The configuration @config must provide valid probe parameters. At - * least a valid IP address must be provided through the configuration. - * - * This function does not reject duplicate probes for the same address. It is - * the caller's decision whether duplicates are allowed or not. But note that - * duplicate probes on the same context will not conflict each other. That is, - * running a probe for the same address twice on the same context will not - * cause them to consider each other a duplicate. - * - * Probes are rather lightweight objects. They do not create any - * file-descriptors or other kernel objects. Probes always re-use the - * infrastructure provided by the context object @acd. This allows running many - * probes simultaneously without exhausting resources. - * - * Return: 0 on success, N_ACD_E_INVALID_ARGUMENT on invalid configuration - * parameters, negative error code on failure. - */ -_c_public_ int n_acd_probe(NAcd *acd, NAcdProbe **probep, NAcdProbeConfig *config) { - return n_acd_probe_new(probep, acd, config); -} |