vrr/nDPId
2
0
Fork 0
mirror of https://github.com/utoni/nDPId.git synced 2026-10-16 11:49:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add nPDIsrvd Distributor I/O Error check
Some checks are pending
ArchLinux PKGBUILD / build (push) Waiting to run
Details
FreeBSD Build / Build and Test (push) Waiting to run
Details
Build OpenWrt Packages / build (armsr-armv8) (push) Waiting to run
Details
Build OpenWrt Packages / build (malta-be) (push) Waiting to run
Details
Build OpenWrt Packages / build (ramips-mt7621) (push) Waiting to run
Details
Build OpenWrt Packages / build (x86-64) (push) Waiting to run
Details
RPM Build / build (push) Waiting to run
Details
Build / macOS-14 cc (push) Waiting to run
Details
Build / ubuntu-latest clang (push) Waiting to run
Details
Build / ubuntu-latest clang-1 (push) Waiting to run
Details
Build / ubuntu-22.04 clang-12 (push) Waiting to run
Details
Build / ubuntu-latest gcc (push) Waiting to run
Details
Build / ubuntu-latest gcc-1 (push) Waiting to run
Details
Build / ubuntu-latest gcc-2 (push) Waiting to run
Details
Build / ubuntu-22.04 gcc-10 (push) Waiting to run
Details
Build / ubuntu-22.04 gcc-9 (push) Waiting to run
Details
SonarQube Scan / Build and analyze (push) Waiting to run
Details

Browse source 
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
This commit is contained in:
Toni Uhlig 2026-10-09 10:20:31 +02:00
parent 65fb7c2185
commit a9666db012
No known key found for this signature in database
GPG key ID: 22C5333D922537D2
1 changed files with 98 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

173
nDPIsrvd.c
View file

@ -1804,6 +1804,13 @@ static int handle_incoming_data(struct nio * const io, int index, struct remote_
continue;
}
#ifndef NO_MAIN
/* I/O Error checking does not work reliably within nDPId-test */
if (nio_has_error(io, index) == NIO_SUCCESS) {
disconnect_client(io, &remotes.desc[i]);
continue;
}
#endif
if (nio_can_output(io, index) == NIO_SUCCESS) {
continue;
}
@ -1844,6 +1851,95 @@ static int handle_incoming_data(struct nio * const io, int index, struct remote_
return 0;
}
#ifdef ENABLE_CRYPTO
static int handle_crypto_handshake(struct nio * const io, struct ncrypt_entity * const crypt_ent,
struct remote_desc * const current)
{
errno = 0;
int rv = ncrypt_on_accept(&ncrypt_ctx, current->fd, crypt_ent);
if (rv != NCRYPT_SUCCESS) {
if (rv == NCRYPT_WANT_READ) {
return set_in_event(io, current);
}
if (rv == NCRYPT_WANT_WRITE) {
return set_out_event(io, current);
}
logger_nDPIsrvd(current, "TLS connection from", "failed with: %s",
(rv != NCRYPT_SUCCESS ?
ncrypt_strerror(rv) : strerror(errno)));
disconnect_client(io, current);
return 1;
}
if (current->sock_type == COLLECTOR_IN &&
current->event_collector_in.ncrypt_entity.is_collector == 0)
{
logger_nDPIsrvd(current, "TLS ACL denial from", "not a collector");
disconnect_client(io, current);
return 1;
}
if (current->sock_type == DISTRIBUTOR_IN &&
current->event_distributor_in.ncrypt_entity.is_distributor == 0)
{
logger_nDPIsrvd(current, "TLS ACL denial from", "not a distributor");
disconnect_client(io, current);
return 1;
}
ncrypt_set_handshake(crypt_ent);
return 0;
}
static int handle_crypto_read(struct nio * const io, int index, struct remote_desc * const current)
{
ssize_t bytes_read;
char garbage = 0;
if (nio_can_output(io, index) == NIO_SUCCESS)
{
return handle_outgoing_data(io, current);
}
while ((bytes_read = ncrypt_read(&current->event_distributor_in.ncrypt_entity,
&garbage, sizeof(garbage))) < 0
&& errno == EINTR)
{
// Retry if interrupted by a signal.
}
int saved_errno = errno;
if (bytes_read < 0) {
int ncrypt_errno = ncrypt_last_error(&current->event_distributor_in.ncrypt_entity);
if (ncrypt_errno == NCRYPT_WANT_READ || saved_errno == EAGAIN)
{
return set_in_event(io, current);
}
else if (ncrypt_errno == NCRYPT_WANT_WRITE)
{
return set_out_event(io, current);
}
else
{
logger_nDPIsrvd(current, "Distributor TLS connection", "failed during read with: %s (%s)",
ncrypt_strerror(ncrypt_errno),
(saved_errno == 0 ? "TLS Error" : strerror(saved_errno)));
disconnect_client(io, current);
return 1;
}
}
if (bytes_read == 0) {
disconnect_client(io, current);
return 1;
}
if (bytes_read > 0) {
logger_nDPIsrvd(current, "Received data from", "who is not allowed to send us some.");
disconnect_client(io, current);
return 1;
}
return 0;
}
#endif
static int handle_data_event(struct nio * const io, int index)
{
struct remote_desc * const current = (struct remote_desc *)nio_get_ptr(io, index);
@ -1879,85 +1975,12 @@ static int handle_data_event(struct nio * const io, int index)
}
if (ncrypt_handshake_done(crypt_ent) == 0) {
errno = 0;
int rv = ncrypt_on_accept(&ncrypt_ctx, current->fd, crypt_ent);
if (rv != NCRYPT_SUCCESS) {
if (rv == NCRYPT_WANT_READ) {
return set_in_event(io, current);
}
if (rv == NCRYPT_WANT_WRITE) {
return set_out_event(io, current);
}
logger_nDPIsrvd(current, "TLS connection from", "failed with: %s",
(rv != NCRYPT_SUCCESS ?
ncrypt_strerror(rv) : strerror(errno)));
disconnect_client(io, current);
return 1;
}
if (current->sock_type == COLLECTOR_IN &&
current->event_collector_in.ncrypt_entity.is_collector == 0)
{
logger_nDPIsrvd(current, "TLS ACL denial from", "not a collector");
disconnect_client(io, current);
return 1;
}
if (current->sock_type == DISTRIBUTOR_IN &&
current->event_distributor_in.ncrypt_entity.is_distributor == 0)
{
logger_nDPIsrvd(current, "TLS ACL denial from", "not a distributor");
disconnect_client(io, current);
return 1;
}
ncrypt_set_handshake(crypt_ent);
return 0;
return handle_crypto_handshake(io, crypt_ent, current);
}
if (current->sock_type == DISTRIBUTOR_IN)
{
ssize_t bytes_read;
char garbage = 0;
if (nio_can_output(io, index) == NIO_SUCCESS)
{
return handle_outgoing_data(io, current);
}
while ((bytes_read = ncrypt_read(&current->event_distributor_in.ncrypt_entity,
&garbage, sizeof(garbage))) < 0 &&
errno == EINTR)
{
// Retry if interrupted by a signal.
}
int saved_errno = errno;
if (bytes_read < 0) {
int ncrypt_errno = ncrypt_last_error(&current->event_distributor_in.ncrypt_entity);
if (ncrypt_errno == NCRYPT_WANT_READ || saved_errno == EAGAIN)
{
return set_in_event(io, current);
}
else if (ncrypt_errno == NCRYPT_WANT_WRITE)
{
return set_out_event(io, current);
}
else
{
logger_nDPIsrvd(current, "Distributor TLS connection", "failed during read with: %s (%s)",
ncrypt_strerror(ncrypt_errno),
(saved_errno == 0 ? "TLS Error" : strerror(saved_errno)));
disconnect_client(io, current);
return 1;
}
}
if (bytes_read == 0) {
disconnect_client(io, current);
return 1;
}
if (bytes_read > 0) {
logger_nDPIsrvd(current, "Received data from", "who is not allowed to send us some.");
disconnect_client(io, current);
return 1;
}
return 0;
return handle_crypto_read(io, index, current);
}
}
#endif