summaryrefslogtreecommitdiffstats
path: root/libnetdata/socket
diff options
context:
space:
mode:
Diffstat (limited to 'libnetdata/socket')
-rw-r--r--libnetdata/socket/Makefile.am8
-rw-r--r--libnetdata/socket/README.md8
-rw-r--r--libnetdata/socket/security.c741
-rw-r--r--libnetdata/socket/security.h74
-rw-r--r--libnetdata/socket/socket.c2130
-rw-r--r--libnetdata/socket/socket.h248
6 files changed, 0 insertions, 3209 deletions
diff --git a/libnetdata/socket/Makefile.am b/libnetdata/socket/Makefile.am
deleted file mode 100644
index 161784b8..00000000
--- a/libnetdata/socket/Makefile.am
+++ /dev/null
@@ -1,8 +0,0 @@
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-AUTOMAKE_OPTIONS = subdir-objects
-MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
-
-dist_noinst_DATA = \
- README.md \
- $(NULL)
diff --git a/libnetdata/socket/README.md b/libnetdata/socket/README.md
deleted file mode 100644
index e339a071..00000000
--- a/libnetdata/socket/README.md
+++ /dev/null
@@ -1,8 +0,0 @@
-<!--
-Title: "Socket"
-custom_edit_url: https://github.com/netdata/netdata/edit/master/libnetdata/socket/README.md
-sidebar_label: "Socket"
-learn_status: "Published"
-learn_topic_type: "References"
-learn_rel_path: "Developers/libnetdata"
--->
diff --git a/libnetdata/socket/security.c b/libnetdata/socket/security.c
deleted file mode 100644
index 4deb7662..00000000
--- a/libnetdata/socket/security.c
+++ /dev/null
@@ -1,741 +0,0 @@
-#include "../libnetdata.h"
-
-#ifdef ENABLE_HTTPS
-
-SSL_CTX *netdata_ssl_exporting_ctx =NULL;
-SSL_CTX *netdata_ssl_streaming_sender_ctx =NULL;
-SSL_CTX *netdata_ssl_web_server_ctx =NULL;
-const char *netdata_ssl_security_key =NULL;
-const char *netdata_ssl_security_cert =NULL;
-const char *tls_version=NULL;
-const char *tls_ciphers=NULL;
-bool netdata_ssl_validate_certificate = true;
-bool netdata_ssl_validate_certificate_sender = true;
-
-static SOCKET_PEERS netdata_ssl_peers(NETDATA_SSL *ssl) {
- int sock_fd;
-
- if(unlikely(!ssl->conn))
- sock_fd = -1;
- else
- sock_fd = SSL_get_rfd(ssl->conn);
-
- return socket_peers(sock_fd);
-}
-
-static void netdata_ssl_log_error_queue(const char *call, NETDATA_SSL *ssl, unsigned long err) {
- nd_log_limit_static_thread_var(erl, 1, 0);
-
- if(err == SSL_ERROR_NONE)
- err = ERR_get_error();
-
- if(err == SSL_ERROR_NONE)
- return;
-
- do {
- char *code;
-
- switch (err) {
- case SSL_ERROR_SSL:
- code = "SSL_ERROR_SSL";
- ssl->state = NETDATA_SSL_STATE_FAILED;
- break;
-
- case SSL_ERROR_WANT_READ:
- code = "SSL_ERROR_WANT_READ";
- break;
-
- case SSL_ERROR_WANT_WRITE:
- code = "SSL_ERROR_WANT_WRITE";
- break;
-
- case SSL_ERROR_WANT_X509_LOOKUP:
- code = "SSL_ERROR_WANT_X509_LOOKUP";
- break;
-
- case SSL_ERROR_SYSCALL:
- code = "SSL_ERROR_SYSCALL";
- ssl->state = NETDATA_SSL_STATE_FAILED;
- break;
-
- case SSL_ERROR_ZERO_RETURN:
- code = "SSL_ERROR_ZERO_RETURN";
- break;
-
- case SSL_ERROR_WANT_CONNECT:
- code = "SSL_ERROR_WANT_CONNECT";
- break;
-
- case SSL_ERROR_WANT_ACCEPT:
- code = "SSL_ERROR_WANT_ACCEPT";
- break;
-
-#ifdef SSL_ERROR_WANT_ASYNC
- case SSL_ERROR_WANT_ASYNC:
- code = "SSL_ERROR_WANT_ASYNC";
- break;
-#endif
-
-#ifdef SSL_ERROR_WANT_ASYNC_JOB
- case SSL_ERROR_WANT_ASYNC_JOB:
- code = "SSL_ERROR_WANT_ASYNC_JOB";
- break;
-#endif
-
-#ifdef SSL_ERROR_WANT_CLIENT_HELLO_CB
- case SSL_ERROR_WANT_CLIENT_HELLO_CB:
- code = "SSL_ERROR_WANT_CLIENT_HELLO_CB";
- break;
-#endif
-
-#ifdef SSL_ERROR_WANT_RETRY_VERIFY
- case SSL_ERROR_WANT_RETRY_VERIFY:
- code = "SSL_ERROR_WANT_RETRY_VERIFY";
- break;
-#endif
-
- default:
- code = "SSL_ERROR_UNKNOWN";
- break;
- }
-
- char str[1024 + 1];
- ERR_error_string_n(err, str, 1024);
- str[1024] = '\0';
- SOCKET_PEERS peers = netdata_ssl_peers(ssl);
- nd_log_limit(&erl, NDLS_DAEMON, NDLP_ERR,
- "SSL: %s() on socket local [[%s]:%d] <-> remote [[%s]:%d], returned error %lu (%s): %s",
- call, peers.local.ip, peers.local.port, peers.peer.ip, peers.peer.port, err, code, str);
-
- } while((err = ERR_get_error()));
-}
-
-bool netdata_ssl_open_ext(NETDATA_SSL *ssl, SSL_CTX *ctx, int fd, const unsigned char *alpn_protos, unsigned int alpn_protos_len) {
- errno = 0;
- ssl->ssl_errno = 0;
-
- if(ssl->conn) {
- if(!ctx || SSL_get_SSL_CTX(ssl->conn) != ctx) {
- SSL_free(ssl->conn);
- ssl->conn = NULL;
- }
- else if (SSL_clear(ssl->conn) == 0) {
- netdata_ssl_log_error_queue("SSL_clear", ssl, SSL_ERROR_NONE);
- SSL_free(ssl->conn);
- ssl->conn = NULL;
- }
- }
-
- if(!ssl->conn) {
- if(!ctx) {
- internal_error(true, "SSL: not CTX given");
- ssl->state = NETDATA_SSL_STATE_FAILED;
- return false;
- }
-
- ssl->conn = SSL_new(ctx);
- if (!ssl->conn) {
- netdata_ssl_log_error_queue("SSL_new", ssl, SSL_ERROR_NONE);
- ssl->state = NETDATA_SSL_STATE_FAILED;
- return false;
- }
- if (alpn_protos && alpn_protos_len > 0)
- SSL_set_alpn_protos(ssl->conn, alpn_protos, alpn_protos_len);
- }
-
- if(SSL_set_fd(ssl->conn, fd) != 1) {
- netdata_ssl_log_error_queue("SSL_set_fd", ssl, SSL_ERROR_NONE);
- ssl->state = NETDATA_SSL_STATE_FAILED;
- return false;
- }
-
- ssl->state = NETDATA_SSL_STATE_INIT;
-
- ERR_clear_error();
-
- return true;
-}
-
-bool netdata_ssl_open(NETDATA_SSL *ssl, SSL_CTX *ctx, int fd) {
- return netdata_ssl_open_ext(ssl, ctx, fd, NULL, 0);
-}
-
-void netdata_ssl_close(NETDATA_SSL *ssl) {
- errno = 0;
- ssl->ssl_errno = 0;
-
- if(ssl->conn) {
- if(SSL_connection(ssl)) {
- int ret = SSL_shutdown(ssl->conn);
- if(ret == 0)
- SSL_shutdown(ssl->conn);
- }
-
- SSL_free(ssl->conn);
-
- ERR_clear_error();
- }
-
- *ssl = NETDATA_SSL_UNSET_CONNECTION;
-}
-
-static inline bool is_handshake_complete(NETDATA_SSL *ssl, const char *op) {
- nd_log_limit_static_thread_var(erl, 1, 0);
-
- if(unlikely(!ssl->conn)) {
- internal_error(true, "SSL: trying to %s on a NULL connection", op);
- return false;
- }
-
- switch(ssl->state) {
- case NETDATA_SSL_STATE_NOT_SSL: {
- SOCKET_PEERS peers = netdata_ssl_peers(ssl);
- nd_log_limit(&erl, NDLS_DAEMON, NDLP_WARNING,
- "SSL: on socket local [[%s]:%d] <-> remote [[%s]:%d], attempt to %s on non-SSL connection",
- peers.local.ip, peers.local.port, peers.peer.ip, peers.peer.port, op);
- return false;
- }
-
- case NETDATA_SSL_STATE_INIT: {
- SOCKET_PEERS peers = netdata_ssl_peers(ssl);
- nd_log_limit(&erl, NDLS_DAEMON, NDLP_WARNING,
- "SSL: on socket local [[%s]:%d] <-> remote [[%s]:%d], attempt to %s on an incomplete connection",
- peers.local.ip, peers.local.port, peers.peer.ip, peers.peer.port, op);
- return false;
- }
-
- case NETDATA_SSL_STATE_FAILED: {
- SOCKET_PEERS peers = netdata_ssl_peers(ssl);
- nd_log_limit(&erl, NDLS_DAEMON, NDLP_WARNING,
- "SSL: on socket local [[%s]:%d] <-> remote [[%s]:%d], attempt to %s on a failed connection",
- peers.local.ip, peers.local.port, peers.peer.ip, peers.peer.port, op);
- return false;
- }
-
- case NETDATA_SSL_STATE_COMPLETE: {
- return true;
- }
- }
-
- return false;
-}
-
-/*
- * netdata_ssl_read() should return the same as read():
- *
- * Positive value: The read() function succeeded and read some bytes. The exact number of bytes read is returned.
- *
- * Zero: For files and sockets, a return value of zero signifies end-of-file (EOF), meaning no more data is available
- * for reading. For sockets, this usually means the other side has closed the connection.
- *
- * -1: An error occurred. The specific error can be found by examining the errno variable.
- * EAGAIN or EWOULDBLOCK: The file descriptor is in non-blocking mode, and the read operation would block.
- * (These are often the same value, but can be different on some systems.)
- */
-
-ssize_t netdata_ssl_read(NETDATA_SSL *ssl, void *buf, size_t num) {
- errno = 0;
- ssl->ssl_errno = 0;
-
- if(unlikely(!is_handshake_complete(ssl, "read")))
- return -1;
-
- int bytes = SSL_read(ssl->conn, buf, (int)num);
-
- if(unlikely(bytes <= 0)) {
- int err = SSL_get_error(ssl->conn, bytes);
- if (err == SSL_ERROR_ZERO_RETURN) {
- ssl->ssl_errno = err;
- return 0;
- }
-
- if (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE) {
- ssl->ssl_errno = err;
- errno = EWOULDBLOCK;
- }
- else
- netdata_ssl_log_error_queue("SSL_read", ssl, err);
-
- bytes = -1; // according to read() or recv()
- }
-
- return bytes;
-}
-
-/*
- * netdata_ssl_write() should return the same as write():
- *
- * Positive value: The write() function succeeded and wrote some bytes. The exact number of bytes written is returned.
- *
- * Zero: It's technically possible for write() to return zero, indicating that zero bytes were written. However, for a
- * socket, this generally does not happen unless the size of the data to be written is zero.
- *
- * -1: An error occurred. The specific error can be found by examining the errno variable.
- * EAGAIN or EWOULDBLOCK: The file descriptor is in non-blocking mode, and the write operation would block.
- * (These are often the same value, but can be different on some systems.)
- */
-
-ssize_t netdata_ssl_write(NETDATA_SSL *ssl, const void *buf, size_t num) {
- errno = 0;
- ssl->ssl_errno = 0;
-
- if(unlikely(!is_handshake_complete(ssl, "write")))
- return -1;
-
- int bytes = SSL_write(ssl->conn, (uint8_t *)buf, (int)num);
-
- if(unlikely(bytes <= 0)) {
- int err = SSL_get_error(ssl->conn, bytes);
- if (err == SSL_ERROR_WANT_READ || err == SSL_ERROR_WANT_WRITE) {
- ssl->ssl_errno = err;
- errno = EWOULDBLOCK;
- }
- else
- netdata_ssl_log_error_queue("SSL_write", ssl, err);
-
- bytes = -1; // according to write() or send()
- }
-
- return bytes;
-}
-
-static inline bool is_handshake_initialized(NETDATA_SSL *ssl, const char *op) {
- nd_log_limit_static_thread_var(erl, 1, 0);
-
- if(unlikely(!ssl->conn)) {
- internal_error(true, "SSL: trying to %s on a NULL connection", op);
- return false;
- }
-
- switch(ssl->state) {
- case NETDATA_SSL_STATE_NOT_SSL: {
- SOCKET_PEERS peers = netdata_ssl_peers(ssl);
- nd_log_limit(&erl, NDLS_DAEMON, NDLP_WARNING,
- "SSL: on socket local [[%s]:%d] <-> remote [[%s]:%d], attempt to %s on non-SSL connection",
- peers.local.ip, peers.local.port, peers.peer.ip, peers.peer.port, op);
- return false;
- }
-
- case NETDATA_SSL_STATE_INIT: {
- return true;
- }
-
- case NETDATA_SSL_STATE_FAILED: {
- SOCKET_PEERS peers = netdata_ssl_peers(ssl);
- nd_log_limit(&erl, NDLS_DAEMON, NDLP_WARNING,
- "SSL: on socket local [[%s]:%d] <-> remote [[%s]:%d], attempt to %s on a failed connection",
- peers.local.ip, peers.local.port, peers.peer.ip, peers.peer.port, op);
- return false;
- }
-
- case NETDATA_SSL_STATE_COMPLETE: {
- SOCKET_PEERS peers = netdata_ssl_peers(ssl);
- nd_log_limit(&erl, NDLS_DAEMON, NDLP_WARNING,
- "SSL: on socket local [[%s]:%d] <-> remote [[%s]:%d], attempt to %s on an complete connection",
- peers.local.ip, peers.local.port, peers.peer.ip, peers.peer.port, op);
- return false;
- }
- }
-
- return false;
-}
-
-#define WANT_READ_WRITE_TIMEOUT_MS 10
-
-static inline bool want_read_write_should_retry(NETDATA_SSL *ssl, int err) {
- int ssl_errno = SSL_get_error(ssl->conn, err);
- if(ssl_errno == SSL_ERROR_WANT_READ || ssl_errno == SSL_ERROR_WANT_WRITE) {
- struct pollfd pfds[1] = { [0] = {
- .fd = SSL_get_rfd(ssl->conn),
- .events = (short)(((ssl_errno == SSL_ERROR_WANT_READ ) ? POLLIN : 0) |
- ((ssl_errno == SSL_ERROR_WANT_WRITE) ? POLLOUT : 0)),
- }};
-
- if(poll(pfds, 1, WANT_READ_WRITE_TIMEOUT_MS) <= 0)
- return false; // timeout (0) or error (<0)
-
- return true; // we have activity, so we should retry
- }
-
- return false; // an unknown error
-}
-
-bool netdata_ssl_connect(NETDATA_SSL *ssl) {
- errno = 0;
- ssl->ssl_errno = 0;
-
- if(unlikely(!is_handshake_initialized(ssl, "connect")))
- return false;
-
- SSL_set_connect_state(ssl->conn);
-
- int err;
- while ((err = SSL_connect(ssl->conn)) != 1) {
- if(!want_read_write_should_retry(ssl, err))
- break;
- }
-
- if (err != 1) {
- err = SSL_get_error(ssl->conn, err);
- netdata_ssl_log_error_queue("SSL_connect", ssl, err);
- ssl->state = NETDATA_SSL_STATE_FAILED;
- return false;
- }
-
- ssl->state = NETDATA_SSL_STATE_COMPLETE;
- return true;
-}
-
-bool netdata_ssl_accept(NETDATA_SSL *ssl) {
- errno = 0;
- ssl->ssl_errno = 0;
-
- if(unlikely(!is_handshake_initialized(ssl, "accept")))
- return false;
-
- SSL_set_accept_state(ssl->conn);
-
- int err;
- while ((err = SSL_accept(ssl->conn)) != 1) {
- if(!want_read_write_should_retry(ssl, err))
- break;
- }
-
- if (err != 1) {
- err = SSL_get_error(ssl->conn, err);
- netdata_ssl_log_error_queue("SSL_accept", ssl, err);
- ssl->state = NETDATA_SSL_STATE_FAILED;
- return false;
- }
-
- ssl->state = NETDATA_SSL_STATE_COMPLETE;
- return true;
-}
-
-/**
- * Info Callback
- *
- * Function used as callback for the OpenSSL Library
- *
- * @param ssl a pointer to the SSL structure of the client
- * @param where the variable with the flags set.
- * @param ret the return of the caller
- */
-static void netdata_ssl_info_callback(const SSL *ssl, int where, int ret __maybe_unused) {
- (void)ssl;
- if (where & SSL_CB_ALERT) {
- netdata_log_debug(D_WEB_CLIENT,"SSL INFO CALLBACK %s %s", SSL_alert_type_string(ret), SSL_alert_desc_string_long(ret));
- }
-}
-
-/**
- * OpenSSL Library
- *
- * Starts the openssl library for the Netdata.
- */
-void netdata_ssl_initialize_openssl() {
-
-#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
-# if (SSLEAY_VERSION_NUMBER >= OPENSSL_VERSION_097)
- OPENSSL_config(NULL);
-# endif
-
- SSL_load_error_strings();
-
- SSL_library_init();
-
-#else
-
- if (OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL) != 1) {
- netdata_log_error("SSL library cannot be initialized.");
- }
-
-#endif
-}
-
-#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_110
-/**
- * TLS version
- *
- * Returns the TLS version depending of the user input.
- *
- * @param lversion is the user input.
- *
- * @return it returns the version number.
- */
-static int netdata_ssl_select_tls_version(const char *lversion) {
- if (!strcmp(lversion, "1") || !strcmp(lversion, "1.0"))
- return TLS1_VERSION;
- else if (!strcmp(lversion, "1.1"))
- return TLS1_1_VERSION;
- else if (!strcmp(lversion, "1.2"))
- return TLS1_2_VERSION;
-#if defined(TLS1_3_VERSION)
- else if (!strcmp(lversion, "1.3"))
- return TLS1_3_VERSION;
-#endif
-
-#if defined(TLS_MAX_VERSION)
- return TLS_MAX_VERSION;
-#else
- return TLS1_2_VERSION;
-#endif
-}
-#endif
-
-/**
- * Initialize Openssl Client
- *
- * Starts the client context with TLS 1.2.
- *
- * @return It returns the context on success or NULL otherwise
- */
-SSL_CTX * netdata_ssl_create_client_ctx(unsigned long mode) {
- SSL_CTX *ctx;
-#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
- ctx = SSL_CTX_new(SSLv23_client_method());
-#else
- ctx = SSL_CTX_new(TLS_client_method());
-#endif
- if(ctx) {
-#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
- SSL_CTX_set_options (ctx,SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_COMPRESSION);
-#else
- SSL_CTX_set_min_proto_version(ctx, TLS1_VERSION);
-# if defined(TLS_MAX_VERSION)
- SSL_CTX_set_max_proto_version(ctx, TLS_MAX_VERSION);
-# elif defined(TLS1_3_VERSION)
- SSL_CTX_set_max_proto_version(ctx, TLS1_3_VERSION);
-# elif defined(TLS1_2_VERSION)
- SSL_CTX_set_max_proto_version(ctx, TLS1_2_VERSION);
-# endif
-#endif
- }
-
- if(mode)
- SSL_CTX_set_mode(ctx, mode);
-
- return ctx;
-}
-
-/**
- * Initialize OpenSSL server
- *
- * Starts the server context with TLS 1.2 and load the certificate.
- *
- * @return It returns the context on success or NULL otherwise
- */
-static SSL_CTX * netdata_ssl_create_server_ctx(unsigned long mode) {
- SSL_CTX *ctx;
- char lerror[512];
- static int netdata_id_context = 1;
-
- //TO DO: Confirm the necessity to check return for other OPENSSL function
-#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
- ctx = SSL_CTX_new(SSLv23_server_method());
- if (!ctx) {
- netdata_log_error("Cannot create a new SSL context, netdata won't encrypt communication");
- return NULL;
- }
-
- SSL_CTX_use_certificate_file(ctx, netdata_ssl_security_cert, SSL_FILETYPE_PEM);
-#else
- ctx = SSL_CTX_new(TLS_server_method());
- if (!ctx) {
- netdata_log_error("Cannot create a new SSL context, netdata won't encrypt communication");
- return NULL;
- }
-
- SSL_CTX_use_certificate_chain_file(ctx, netdata_ssl_security_cert);
-#endif
-
-#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
- SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_COMPRESSION);
-#else
- SSL_CTX_set_min_proto_version(ctx, TLS1_VERSION);
- SSL_CTX_set_max_proto_version(ctx, netdata_ssl_select_tls_version(tls_version));
-
- if(tls_ciphers && strcmp(tls_ciphers, "none") != 0) {
- if (!SSL_CTX_set_cipher_list(ctx, tls_ciphers)) {
- netdata_log_error("SSL error. cannot set the cipher list");
- }
- }
-#endif
-
- SSL_CTX_use_PrivateKey_file(ctx, netdata_ssl_security_key,SSL_FILETYPE_PEM);
-
- if (!SSL_CTX_check_private_key(ctx)) {
- ERR_error_string_n(ERR_get_error(),lerror,sizeof(lerror));
- netdata_log_error("SSL cannot check the private key: %s",lerror);
- SSL_CTX_free(ctx);
- return NULL;
- }
-
- SSL_CTX_set_session_id_context(ctx,(void*)&netdata_id_context,(unsigned int)sizeof(netdata_id_context));
- SSL_CTX_set_info_callback(ctx, netdata_ssl_info_callback);
-
-#if (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_095)
- SSL_CTX_set_verify_depth(ctx,1);
-#endif
- netdata_log_debug(D_WEB_CLIENT,"SSL GLOBAL CONTEXT STARTED\n");
-
- SSL_CTX_set_mode(ctx, mode);
-
- return ctx;
-}
-
-/**
- * Start SSL
- *
- * Call the correct function to start the SSL context.
- *
- * @param selector informs the context that must be initialized, the following list has the valid values:
- * NETDATA_SSL_CONTEXT_SERVER - the server context
- * NETDATA_SSL_CONTEXT_STREAMING - Starts the streaming context.
- * NETDATA_SSL_CONTEXT_EXPORTING - Starts the OpenTSDB context
- */
-void netdata_ssl_initialize_ctx(int selector) {
- static SPINLOCK sp = NETDATA_SPINLOCK_INITIALIZER;
- spinlock_lock(&sp);
-
- switch (selector) {
- case NETDATA_SSL_WEB_SERVER_CTX: {
- if(!netdata_ssl_web_server_ctx) {
- struct stat statbuf;
- if (stat(netdata_ssl_security_key, &statbuf) || stat(netdata_ssl_security_cert, &statbuf))
- netdata_log_info("To use encryption it is necessary to set \"ssl certificate\" and \"ssl key\" in [web] !\n");
- else {
- netdata_ssl_web_server_ctx = netdata_ssl_create_server_ctx(
- SSL_MODE_ENABLE_PARTIAL_WRITE |
- SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER |
- // SSL_MODE_AUTO_RETRY |
- 0);
-
- if(netdata_ssl_web_server_ctx && !netdata_ssl_validate_certificate)
- SSL_CTX_set_verify(netdata_ssl_web_server_ctx, SSL_VERIFY_NONE, NULL);
- }
- }
- break;
- }
-
- case NETDATA_SSL_STREAMING_SENDER_CTX: {
- if(!netdata_ssl_streaming_sender_ctx) {
- //This is necessary for the stream, because it is working sometimes with nonblock socket.
- //It returns the bitmask after to change, there is not any description of errors in the documentation
- netdata_ssl_streaming_sender_ctx = netdata_ssl_create_client_ctx(
- SSL_MODE_ENABLE_PARTIAL_WRITE |
- SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER |
- // SSL_MODE_AUTO_RETRY |
- 0
- );
-
- if(netdata_ssl_streaming_sender_ctx && !netdata_ssl_validate_certificate_sender)
- SSL_CTX_set_verify(netdata_ssl_streaming_sender_ctx, SSL_VERIFY_NONE, NULL);
- }
- break;
- }
-
- case NETDATA_SSL_EXPORTING_CTX: {
- if(!netdata_ssl_exporting_ctx) {
- netdata_ssl_exporting_ctx = netdata_ssl_create_client_ctx(0);
-
- if(netdata_ssl_exporting_ctx && !netdata_ssl_validate_certificate)
- SSL_CTX_set_verify(netdata_ssl_exporting_ctx, SSL_VERIFY_NONE, NULL);
- }
- break;
- }
- }
-
- spinlock_unlock(&sp);
-}
-
-/**
- * Clean Open SSL
- *
- * Clean all the allocated contexts from netdata.
- */
-void netdata_ssl_cleanup()
-{
- if (netdata_ssl_web_server_ctx) {
- SSL_CTX_free(netdata_ssl_web_server_ctx);
- netdata_ssl_web_server_ctx = NULL;
- }
-
- if (netdata_ssl_streaming_sender_ctx) {
- SSL_CTX_free(netdata_ssl_streaming_sender_ctx);
- netdata_ssl_streaming_sender_ctx = NULL;
- }
-
- if (netdata_ssl_exporting_ctx) {
- SSL_CTX_free(netdata_ssl_exporting_ctx);
- netdata_ssl_exporting_ctx = NULL;
- }
-
-#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
- ERR_free_strings();
-#endif
-}
-
-/**
- * Test Certificate
- *
- * Check the certificate of Netdata parent
- *
- * @param ssl is the connection structure
- *
- * @return It returns 0 on success and -1 otherwise
- */
-int security_test_certificate(SSL *ssl) {
- X509* cert = SSL_get_peer_certificate(ssl);
- int ret;
- long status;
- if (!cert) {
- return -1;
- }
-
- status = SSL_get_verify_result(ssl);
- if((X509_V_OK != status))
- {
- char error[512];
- ERR_error_string_n(ERR_get_error(), error, sizeof(error));
- netdata_log_error("SSL RFC4158 check: We have a invalid certificate, the tests result with %ld and message %s", status, error);
- ret = -1;
- } else {
- ret = 0;
- }
-
- return ret;
-}
-
-/**
- * Location for context
- *
- * Case the user give us a directory with the certificates available and
- * the Netdata parent certificate, we use this function to validate the certificate.
- *
- * @param ctx the context where the path will be set.
- * @param file the file with Netdata parent certificate.
- * @param path the directory where the certificates are stored.
- *
- * @return It returns 0 on success and -1 otherwise.
- */
-int ssl_security_location_for_context(SSL_CTX *ctx, char *file, char *path) {
- int load_custom = 1, load_default = 1;
- if (file || path) {
- if(!SSL_CTX_load_verify_locations(ctx, file, path)) {
- netdata_log_info("Netdata can not verify custom CAfile or CApath for parent's SSL certificate, so it will use the default OpenSSL configuration to validate certificates!");
- load_custom = 0;
- }
- }
-
- if(!SSL_CTX_set_default_verify_paths(ctx)) {
- netdata_log_info("Can not verify default OpenSSL configuration to validate certificates!");
- load_default = 0;
- }
-
- if (load_custom == 0 && load_default == 0)
- return -1;
-
- return 0;
-}
-#endif
diff --git a/libnetdata/socket/security.h b/libnetdata/socket/security.h
deleted file mode 100644
index fd17b6f3..00000000
--- a/libnetdata/socket/security.h
+++ /dev/null
@@ -1,74 +0,0 @@
-#ifndef NETDATA_SECURITY_H
-# define NETDATA_SECURITY_H
-
-typedef enum __attribute__((packed)) {
- NETDATA_SSL_STATE_NOT_SSL = 1, // This connection is not SSL
- NETDATA_SSL_STATE_INIT, // SSL handshake is initialized
- NETDATA_SSL_STATE_FAILED, // SSL handshake failed
- NETDATA_SSL_STATE_COMPLETE, // SSL handshake successful
-} NETDATA_SSL_STATE;
-
-#define NETDATA_SSL_WEB_SERVER_CTX 0
-#define NETDATA_SSL_STREAMING_SENDER_CTX 1
-#define NETDATA_SSL_EXPORTING_CTX 2
-
-# ifdef ENABLE_HTTPS
-
-#define OPENSSL_VERSION_095 0x00905100L
-#define OPENSSL_VERSION_097 0x0907000L
-#define OPENSSL_VERSION_110 0x10100000L
-#define OPENSSL_VERSION_111 0x10101000L
-#define OPENSSL_VERSION_300 0x30000000L
-
-# include <openssl/ssl.h>
-# include <openssl/err.h>
-# include <openssl/evp.h>
-# include <openssl/pem.h>
-# if (SSLEAY_VERSION_NUMBER >= OPENSSL_VERSION_097) && (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110)
-# include <openssl/conf.h>
-# endif
-
-#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_300
-#include <openssl/core_names.h>
-#include <openssl/decoder.h>
-#endif
-
-typedef struct netdata_ssl {
- SSL *conn; // SSL connection
- NETDATA_SSL_STATE state; // The state for SSL connection
- unsigned long ssl_errno; // The SSL errno of the last SSL call
-} NETDATA_SSL;
-
-#define NETDATA_SSL_UNSET_CONNECTION (NETDATA_SSL){ .conn = NULL, .state = NETDATA_SSL_STATE_NOT_SSL }
-
-#define SSL_connection(ssl) ((ssl)->conn && (ssl)->state != NETDATA_SSL_STATE_NOT_SSL)
-
-extern SSL_CTX *netdata_ssl_exporting_ctx;
-extern SSL_CTX *netdata_ssl_streaming_sender_ctx;
-extern SSL_CTX *netdata_ssl_web_server_ctx;
-extern const char *netdata_ssl_security_key;
-extern const char *netdata_ssl_security_cert;
-extern const char *tls_version;
-extern const char *tls_ciphers;
-extern bool netdata_ssl_validate_certificate;
-extern bool netdata_ssl_validate_certificate_sender;
-int ssl_security_location_for_context(SSL_CTX *ctx,char *file,char *path);
-
-void netdata_ssl_initialize_openssl();
-void netdata_ssl_cleanup();
-void netdata_ssl_initialize_ctx(int selector);
-int security_test_certificate(SSL *ssl);
-SSL_CTX * netdata_ssl_create_client_ctx(unsigned long mode);
-
-bool netdata_ssl_connect(NETDATA_SSL *ssl);
-bool netdata_ssl_accept(NETDATA_SSL *ssl);
-
-bool netdata_ssl_open(NETDATA_SSL *ssl, SSL_CTX *ctx, int fd);
-bool netdata_ssl_open_ext(NETDATA_SSL *ssl, SSL_CTX *ctx, int fd, const unsigned char *alpn_protos, unsigned int alpn_protos_len);
-void netdata_ssl_close(NETDATA_SSL *ssl);
-
-ssize_t netdata_ssl_read(NETDATA_SSL *ssl, void *buf, size_t num);
-ssize_t netdata_ssl_write(NETDATA_SSL *ssl, const void *buf, size_t num);
-
-# endif //ENABLE_HTTPS
-#endif //NETDATA_SECURITY_H
diff --git a/libnetdata/socket/socket.c b/libnetdata/socket/socket.c
deleted file mode 100644
index 605e8563..00000000
--- a/libnetdata/socket/socket.c
+++ /dev/null
@@ -1,2130 +0,0 @@
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-#ifndef _GNU_SOURCE
-#define _GNU_SOURCE // for POLLRDHUP
-#endif
-
-#ifndef __BSD_VISIBLE
-#define __BSD_VISIBLE // for POLLRDHUP
-#endif
-
-#include "../libnetdata.h"
-
-bool ip_to_hostname(const char *ip, char *dst, size_t dst_len) {
- if(!dst || !dst_len)
- return false;
-
- struct sockaddr_in sa;
- struct sockaddr_in6 sa6;
- struct sockaddr *sa_ptr;
- int sa_len;
-
- // Try to convert the IP address to sockaddr_in (IPv4)
- if (inet_pton(AF_INET, ip, &(sa.sin_addr)) == 1) {
- sa.sin_family = AF_INET;
- sa_ptr = (struct sockaddr *)&sa;
- sa_len = sizeof(sa);
- }
- // Try to convert the IP address to sockaddr_in6 (IPv6)
- else if (inet_pton(AF_INET6, ip, &(sa6.sin6_addr)) == 1) {
- sa6.sin6_family = AF_INET6;
- sa_ptr = (struct sockaddr *)&sa6;
- sa_len = sizeof(sa6);
- }
-
- else {
- dst[0] = '\0';
- return false;
- }
-
- // Perform the reverse lookup
- int res = getnameinfo(sa_ptr, sa_len, dst, dst_len, NULL, 0, NI_NAMEREQD);
- if(res != 0)
- return false;
-
- return true;
-}
-
-SOCKET_PEERS socket_peers(int sock_fd) {
- SOCKET_PEERS peers;
-
- if(sock_fd < 0) {
- strncpyz(peers.peer.ip, "not connected", sizeof(peers.peer.ip) - 1);
- peers.peer.port = 0;
-
- strncpyz(peers.local.ip, "not connected", sizeof(peers.local.ip) - 1);
- peers.local.port = 0;
-
- return peers;
- }
-
- struct sockaddr_storage addr;
- socklen_t addr_len = sizeof(addr);
-
- // Get peer info
- if (getpeername(sock_fd, (struct sockaddr *)&addr, &addr_len) == 0) {
- if (addr.ss_family == AF_INET) { // IPv4
- struct sockaddr_in *s = (struct sockaddr_in *)&addr;
- inet_ntop(AF_INET, &s->sin_addr, peers.peer.ip, sizeof(peers.peer.ip));
- peers.peer.port = ntohs(s->sin_port);
- }
- else { // IPv6
- struct sockaddr_in6 *s = (struct sockaddr_in6 *)&addr;
- inet_ntop(AF_INET6, &s->sin6_addr, peers.peer.ip, sizeof(peers.peer.ip));
- peers.peer.port = ntohs(s->sin6_port);
- }
- }
- else {
- strncpyz(peers.peer.ip, "unknown", sizeof(peers.peer.ip) - 1);
- peers.peer.port = 0;
- }
-
- // Get local info
- addr_len = sizeof(addr);
- if (getsockname(sock_fd, (struct sockaddr *)&addr, &addr_len) == 0) {
- if (addr.ss_family == AF_INET) { // IPv4
- struct sockaddr_in *s = (struct sockaddr_in *) &addr;
- inet_ntop(AF_INET, &s->sin_addr, peers.local.ip, sizeof(peers.local.ip));
- peers.local.port = ntohs(s->sin_port);
- } else { // IPv6
- struct sockaddr_in6 *s = (struct sockaddr_in6 *) &addr;
- inet_ntop(AF_INET6, &s->sin6_addr, peers.local.ip, sizeof(peers.local.ip));
- peers.local.port = ntohs(s->sin6_port);
- }
- }
- else {
- strncpyz(peers.local.ip, "unknown", sizeof(peers.local.ip) - 1);
- peers.local.port = 0;
- }
-
- return peers;
-}
-
-
-// --------------------------------------------------------------------------------------------------------------------
-// various library calls
-
-#ifdef __gnu_linux__
-#define LARGE_SOCK_SIZE 33554431 // don't ask why - I found it at brubeck source - I guess it is just a large number
-#else
-#define LARGE_SOCK_SIZE 4096
-#endif
-
-bool fd_is_socket(int fd) {
- int type;
- socklen_t len = sizeof(type);
- if (getsockopt(fd, SOL_SOCKET, SO_TYPE, &type, &len) == -1)
- return false;
-
- return true;
-}
-
-bool sock_has_output_error(int fd) {
- if(fd < 0) {
- //internal_error(true, "invalid socket %d", fd);
- return false;
- }
-
-// if(!fd_is_socket(fd)) {
-// //internal_error(true, "fd %d is not a socket", fd);
-// return false;
-// }
-
- short int errors = POLLERR | POLLHUP | POLLNVAL;
-
-#ifdef POLLRDHUP
- errors |= POLLRDHUP;
-#endif
-
- struct pollfd pfd = {
- .fd = fd,
- .events = POLLOUT | errors,
- .revents = 0,
- };
-
- if(poll(&pfd, 1, 0) == -1) {
- //internal_error(true, "poll() failed");
- return false;
- }
-
- return ((pfd.revents & errors) || !(pfd.revents & POLLOUT));
-}
-
-int sock_setnonblock(int fd) {
- int flags;
-
- flags = fcntl(fd, F_GETFL);
- flags |= O_NONBLOCK;
-
- int ret = fcntl(fd, F_SETFL, flags);
- if(ret < 0)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Failed to set O_NONBLOCK on socket %d",
- fd);
-
- return ret;
-}
-
-int sock_delnonblock(int fd) {
- int flags;
-
- flags = fcntl(fd, F_GETFL);
- flags &= ~O_NONBLOCK;
-
- int ret = fcntl(fd, F_SETFL, flags);
- if(ret < 0)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Failed to remove O_NONBLOCK on socket %d",
- fd);
-
- return ret;
-}
-
-int sock_setreuse(int fd, int reuse) {
- int ret = setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &reuse, sizeof(reuse));
-
- if(ret == -1)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Failed to set SO_REUSEADDR on socket %d",
- fd);
-
- return ret;
-}
-
-int sock_setreuse_port(int fd, int reuse) {
- int ret;
-
-#ifdef SO_REUSEPORT
- ret = setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &reuse, sizeof(reuse));
- if(ret == -1 && errno != ENOPROTOOPT)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "failed to set SO_REUSEPORT on socket %d",
- fd);
-#else
- ret = -1;
-#endif
-
- return ret;
-}
-
-int sock_enlarge_in(int fd) {
- int ret, bs = LARGE_SOCK_SIZE;
-
- ret = setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &bs, sizeof(bs));
-
- if(ret == -1)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Failed to set SO_RCVBUF on socket %d",
- fd);
-
- return ret;
-}
-
-int sock_enlarge_out(int fd) {
- int ret, bs = LARGE_SOCK_SIZE;
- ret = setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &bs, sizeof(bs));
-
- if(ret == -1)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Failed to set SO_SNDBUF on socket %d",
- fd);
-
- return ret;
-}
-
-
-// --------------------------------------------------------------------------------------------------------------------
-
-char *strdup_client_description(int family, const char *protocol, const char *ip, uint16_t port) {
- char buffer[100 + 1];
-
- switch(family) {
- case AF_INET:
- snprintfz(buffer, sizeof(buffer) - 1, "%s:%s:%d", protocol, ip, port);
- break;
-
- case AF_INET6:
- default:
- snprintfz(buffer, sizeof(buffer) - 1, "%s:[%s]:%d", protocol, ip, port);
- break;
-
- case AF_UNIX:
- snprintfz(buffer, sizeof(buffer) - 1, "%s:%s", protocol, ip);
- break;
- }
-
- return strdupz(buffer);
-}
-
-// --------------------------------------------------------------------------------------------------------------------
-// listening sockets
-
-int create_listen_socket_unix(const char *path, int listen_backlog) {
- int sock;
-
- sock = socket(AF_UNIX, SOCK_STREAM, 0);
- if(sock < 0) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: UNIX socket() on path '%s' failed.",
- path);
-
- return -1;
- }
-
- sock_setnonblock(sock);
- sock_enlarge_in(sock);
-
- struct sockaddr_un name;
- memset(&name, 0, sizeof(struct sockaddr_un));
- name.sun_family = AF_UNIX;
- strncpy(name.sun_path, path, sizeof(name.sun_path)-1);
-
- errno = 0;
- if (unlink(path) == -1 && errno != ENOENT)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: failed to remove existing (probably obsolete or left-over) file on UNIX socket path '%s'.",
- path);
-
- if(bind (sock, (struct sockaddr *) &name, sizeof (name)) < 0) {
- close(sock);
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: UNIX bind() on path '%s' failed.",
- path);
-
- return -1;
- }
-
- // we have to chmod this to 0777 so that the client will be able
- // to read from and write to this socket.
- if(chmod(path, 0777) == -1)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: failed to chmod() socket file '%s'.",
- path);
-
- if(listen(sock, listen_backlog) < 0) {
- close(sock);
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: UNIX listen() on path '%s' failed.",
- path);
-
- return -1;
- }
-
- return sock;
-}
-
-int create_listen_socket4(int socktype, const char *ip, uint16_t port, int listen_backlog) {
- int sock;
-
- sock = socket(AF_INET, socktype, 0);
- if(sock < 0) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: IPv4 socket() on ip '%s' port %d, socktype %d failed.",
- ip, port, socktype);
-
- return -1;
- }
-
- sock_setreuse(sock, 1);
- sock_setreuse_port(sock, 0);
- sock_setnonblock(sock);
- sock_enlarge_in(sock);
-
- struct sockaddr_in name;
- memset(&name, 0, sizeof(struct sockaddr_in));
- name.sin_family = AF_INET;
- name.sin_port = htons (port);
-
- int ret = inet_pton(AF_INET, ip, (void *)&name.sin_addr.s_addr);
- if(ret != 1) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: Failed to convert IP '%s' to a valid IPv4 address.",
- ip);
-
- close(sock);
- return -1;
- }
-
- if(bind (sock, (struct sockaddr *) &name, sizeof (name)) < 0) {
- close(sock);
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: IPv4 bind() on ip '%s' port %d, socktype %d failed.",
- ip, port, socktype);
-
- return -1;
- }
-
- if(socktype == SOCK_STREAM && listen(sock, listen_backlog) < 0) {
- close(sock);
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: IPv4 listen() on ip '%s' port %d, socktype %d failed.",
- ip, port, socktype);
-
- return -1;
- }
-
- nd_log(NDLS_DAEMON, NDLP_DEBUG,
- "LISTENER: Listening on IPv4 ip '%s' port %d, socktype %d",
- ip, port, socktype);
-
- return sock;
-}
-
-int create_listen_socket6(int socktype, uint32_t scope_id, const char *ip, int port, int listen_backlog) {
- int sock;
- int ipv6only = 1;
-
- sock = socket(AF_INET6, socktype, 0);
- if (sock < 0) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: IPv6 socket() on ip '%s' port %d, socktype %d, failed.",
- ip, port, socktype);
-
- return -1;
- }
-
- sock_setreuse(sock, 1);
- sock_setreuse_port(sock, 0);
- sock_setnonblock(sock);
- sock_enlarge_in(sock);
-
- /* IPv6 only */
- if(setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, (void*)&ipv6only, sizeof(ipv6only)) != 0)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: Cannot set IPV6_V6ONLY on ip '%s' port %d, socktype %d.",
- ip, port, socktype);
-
- struct sockaddr_in6 name;
- memset(&name, 0, sizeof(struct sockaddr_in6));
- name.sin6_family = AF_INET6;
- name.sin6_port = htons ((uint16_t) port);
- name.sin6_scope_id = scope_id;
-
- int ret = inet_pton(AF_INET6, ip, (void *)&name.sin6_addr.s6_addr);
- if(ret != 1) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: Failed to convert IP '%s' to a valid IPv6 address.",
- ip);
-
- close(sock);
- return -1;
- }
-
- name.sin6_scope_id = scope_id;
-
- if (bind (sock, (struct sockaddr *) &name, sizeof (name)) < 0) {
- close(sock);
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: IPv6 bind() on ip '%s' port %d, socktype %d failed.",
- ip, port, socktype);
-
- return -1;
- }
-
- if (socktype == SOCK_STREAM && listen(sock, listen_backlog) < 0) {
- close(sock);
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: IPv6 listen() on ip '%s' port %d, socktype %d failed.",
- ip, port, socktype);
-
- return -1;
- }
-
- nd_log(NDLS_DAEMON, NDLP_DEBUG,
- "LISTENER: Listening on IPv6 ip '%s' port %d, socktype %d",
- ip, port, socktype);
-
- return sock;
-}
-
-static inline int listen_sockets_add(LISTEN_SOCKETS *sockets, int fd, int family, int socktype, const char *protocol, const char *ip, uint16_t port, int acl_flags) {
- if(sockets->opened >= MAX_LISTEN_FDS) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: Too many listening sockets. Failed to add listening %s socket at ip '%s' port %d, protocol %s, socktype %d",
- protocol, ip, port, protocol, socktype);
-
- close(fd);
- return -1;
- }
-
- sockets->fds[sockets->opened] = fd;
- sockets->fds_types[sockets->opened] = socktype;
- sockets->fds_families[sockets->opened] = family;
- sockets->fds_names[sockets->opened] = strdup_client_description(family, protocol, ip, port);
- sockets->fds_acl_flags[sockets->opened] = acl_flags;
-
- sockets->opened++;
- return 0;
-}
-
-int listen_sockets_check_is_member(LISTEN_SOCKETS *sockets, int fd) {
- size_t i;
- for(i = 0; i < sockets->opened ;i++)
- if(sockets->fds[i] == fd) return 1;
-
- return 0;
-}
-
-static inline void listen_sockets_init(LISTEN_SOCKETS *sockets) {
- size_t i;
- for(i = 0; i < MAX_LISTEN_FDS ;i++) {
- sockets->fds[i] = -1;
- sockets->fds_names[i] = NULL;
- sockets->fds_types[i] = -1;
- }
-
- sockets->opened = 0;
- sockets->failed = 0;
-}
-
-void listen_sockets_close(LISTEN_SOCKETS *sockets) {
- size_t i;
- for(i = 0; i < sockets->opened ;i++) {
- close(sockets->fds[i]);
- sockets->fds[i] = -1;
-
- freez(sockets->fds_names[i]);
- sockets->fds_names[i] = NULL;
-
- sockets->fds_types[i] = -1;
- }
-
- sockets->opened = 0;
- sockets->failed = 0;
-}
-
-/*
- * SSL ACL
- *
- * Search the SSL acl and apply it case it is set.
- *
- * @param acl is the acl given by the user.
- */
-WEB_CLIENT_ACL socket_ssl_acl(char *acl) {
- char *ssl = strchr(acl,'^');
- if(ssl) {
- //Due the format of the SSL command it is always the last command,
- //we finish it here to avoid problems with the ACLs
- *ssl = '\0';
-#ifdef ENABLE_HTTPS
- ssl++;
- if (!strncmp("SSL=",ssl,4)) {
- ssl += 4;
- if (!strcmp(ssl,"optional")) {
- return WEB_CLIENT_ACL_SSL_OPTIONAL;
- }
- else if (!strcmp(ssl,"force")) {
- return WEB_CLIENT_ACL_SSL_FORCE;
- }
- }
-#endif
- }
-
- return WEB_CLIENT_ACL_NONE;
-}
-
-WEB_CLIENT_ACL read_acl(char *st) {
- WEB_CLIENT_ACL ret = socket_ssl_acl(st);
-
- if (!strcmp(st,"dashboard")) ret |= WEB_CLIENT_ACL_DASHBOARD;
- if (!strcmp(st,"registry")) ret |= WEB_CLIENT_ACL_REGISTRY;
- if (!strcmp(st,"badges")) ret |= WEB_CLIENT_ACL_BADGE;
- if (!strcmp(st,"management")) ret |= WEB_CLIENT_ACL_MGMT;
- if (!strcmp(st,"streaming")) ret |= WEB_CLIENT_ACL_STREAMING;
- if (!strcmp(st,"netdata.conf")) ret |= WEB_CLIENT_ACL_NETDATACONF;
-
- return ret;
-}
-
-static inline int bind_to_this(LISTEN_SOCKETS *sockets, const char *definition, uint16_t default_port, int listen_backlog) {
- int added = 0;
- WEB_CLIENT_ACL acl_flags = WEB_CLIENT_ACL_NONE;
-
- struct addrinfo hints;
- struct addrinfo *result = NULL, *rp = NULL;
-
- char buffer[strlen(definition) + 1];
- strcpy(buffer, definition);
-
- char buffer2[10 + 1];
- snprintfz(buffer2, 10, "%d", default_port);
-
- char *ip = buffer, *port = buffer2, *interface = "", *portconfig;;
-
- int protocol = IPPROTO_TCP, socktype = SOCK_STREAM;
- const char *protocol_str = "tcp";
-
- if(strncmp(ip, "tcp:", 4) == 0) {
- ip += 4;
- protocol = IPPROTO_TCP;
- socktype = SOCK_STREAM;
- protocol_str = "tcp";
- }
- else if(strncmp(ip, "udp:", 4) == 0) {
- ip += 4;
- protocol = IPPROTO_UDP;
- socktype = SOCK_DGRAM;
- protocol_str = "udp";
- }
- else if(strncmp(ip, "unix:", 5) == 0) {
- char *path = ip + 5;
- socktype = SOCK_STREAM;
- protocol_str = "unix";
- int fd = create_listen_socket_unix(path, listen_backlog);
- if (fd == -1) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: Cannot create unix socket '%s'",
- path);
-
- sockets->failed++;
- } else {
- acl_flags = WEB_CLIENT_ACL_DASHBOARD | WEB_CLIENT_ACL_REGISTRY | WEB_CLIENT_ACL_BADGE | WEB_CLIENT_ACL_MGMT | WEB_CLIENT_ACL_NETDATACONF | WEB_CLIENT_ACL_STREAMING | WEB_CLIENT_ACL_SSL_DEFAULT;
- listen_sockets_add(sockets, fd, AF_UNIX, socktype, protocol_str, path, 0, acl_flags);
- added++;
- }
- return added;
- }
-
- char *e = ip;
- if(*e == '[') {
- e = ++ip;
- while(*e && *e != ']') e++;
- if(*e == ']') {
- *e = '\0';
- e++;
- }
- }
- else {
- while(*e && *e != ':' && *e != '%' && *e != '=') e++;
- }
-
- if(*e == '%') {
- *e = '\0';
- e++;
- interface = e;
- while(*e && *e != ':' && *e != '=') e++;
- }
-
- if(*e == ':') {
- port = e + 1;
- *e = '\0';
- e++;
- while(*e && *e != '=') e++;
- }
-
- if(*e == '=') {
- *e='\0';
- e++;
- portconfig = e;
- while (*e != '\0') {
- if (*e == '|') {
- *e = '\0';
- acl_flags |= read_acl(portconfig);
- e++;
- portconfig = e;
- continue;
- }
- e++;
- }
- acl_flags |= read_acl(portconfig);
- } else {
- acl_flags = WEB_CLIENT_ACL_DASHBOARD | WEB_CLIENT_ACL_REGISTRY | WEB_CLIENT_ACL_BADGE | WEB_CLIENT_ACL_MGMT | WEB_CLIENT_ACL_NETDATACONF | WEB_CLIENT_ACL_STREAMING | WEB_CLIENT_ACL_SSL_DEFAULT;
- }
-
- //Case the user does not set the option SSL in the "bind to", but he has
- //the certificates, I must redirect, so I am assuming here the default option
- if(!(acl_flags & WEB_CLIENT_ACL_SSL_OPTIONAL) && !(acl_flags & WEB_CLIENT_ACL_SSL_FORCE)) {
- acl_flags |= WEB_CLIENT_ACL_SSL_DEFAULT;
- }
-
- uint32_t scope_id = 0;
- if(*interface) {
- scope_id = if_nametoindex(interface);
- if(!scope_id)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: Cannot find a network interface named '%s'. "
- "Continuing with limiting the network interface",
- interface);
- }
-
- if(!*ip || *ip == '*' || !strcmp(ip, "any") || !strcmp(ip, "all"))
- ip = NULL;
-
- if(!*port)
- port = buffer2;
-
- memset(&hints, 0, sizeof(hints));
- hints.ai_family = AF_UNSPEC; /* Allow IPv4 or IPv6 */
- hints.ai_socktype = socktype;
- hints.ai_flags = AI_PASSIVE; /* For wildcard IP address */
- hints.ai_protocol = protocol;
- hints.ai_canonname = NULL;
- hints.ai_addr = NULL;
- hints.ai_next = NULL;
-
- int r = getaddrinfo(ip, port, &hints, &result);
- if (r != 0) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: getaddrinfo('%s', '%s'): %s\n",
- ip, port, gai_strerror(r));
-
- return -1;
- }
-
- for (rp = result; rp != NULL; rp = rp->ai_next) {
- int fd = -1;
- int family;
-
- char rip[INET_ADDRSTRLEN + INET6_ADDRSTRLEN] = "INVALID";
- uint16_t rport = default_port;
-
- family = rp->ai_addr->sa_family;
- switch (family) {
- case AF_INET: {
- struct sockaddr_in *sin = (struct sockaddr_in *) rp->ai_addr;
- inet_ntop(AF_INET, &sin->sin_addr, rip, INET_ADDRSTRLEN);
- rport = ntohs(sin->sin_port);
- fd = create_listen_socket4(socktype, rip, rport, listen_backlog);
- break;
- }
-
- case AF_INET6: {
- struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) rp->ai_addr;
- inet_ntop(AF_INET6, &sin6->sin6_addr, rip, INET6_ADDRSTRLEN);
- rport = ntohs(sin6->sin6_port);
- fd = create_listen_socket6(socktype, scope_id, rip, rport, listen_backlog);
- break;
- }
-
- default:
- nd_log(NDLS_DAEMON, NDLP_DEBUG,
- "LISTENER: Unknown socket family %d",
- family);
-
- break;
- }
-
- if (fd == -1) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: Cannot bind to ip '%s', port %d",
- rip, rport);
-
- sockets->failed++;
- }
- else {
- listen_sockets_add(sockets, fd, family, socktype, protocol_str, rip, rport, acl_flags);
- added++;
- }
- }
-
- freeaddrinfo(result);
-
- return added;
-}
-
-int listen_sockets_setup(LISTEN_SOCKETS *sockets) {
- listen_sockets_init(sockets);
-
- sockets->backlog = (int) appconfig_get_number(sockets->config, sockets->config_section, "listen backlog", sockets->backlog);
-
- long long int old_port = sockets->default_port;
- long long int new_port = appconfig_get_number(sockets->config, sockets->config_section, "default port", sockets->default_port);
- if(new_port < 1 || new_port > 65535) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: Invalid listen port %lld given. Defaulting to %lld.",
- new_port, old_port);
-
- sockets->default_port = (uint16_t) appconfig_set_number(sockets->config, sockets->config_section, "default port", old_port);
- }
- else sockets->default_port = (uint16_t)new_port;
-
- char *s = appconfig_get(sockets->config, sockets->config_section, "bind to", sockets->default_bind_to);
- while(*s) {
- char *e = s;
-
- // skip separators, moving both s(tart) and e(nd)
- while(isspace(*e) || *e == ',') s = ++e;
-
- // move e(nd) to the first separator
- while(*e && !isspace(*e) && *e != ',') e++;
-
- // is there anything?
- if(!*s || s == e) break;
-
- char buf[e - s + 1];
- strncpyz(buf, s, e - s);
- bind_to_this(sockets, buf, sockets->default_port, sockets->backlog);
-
- s = e;
- }
-
- if(sockets->failed) {
- size_t i;
- for(i = 0; i < sockets->opened ;i++)
- nd_log(NDLS_DAEMON, NDLP_DEBUG,
- "LISTENER: Listen socket %s opened successfully.",
- sockets->fds_names[i]);
- }
-
- return (int)sockets->opened;
-}
-
-
-// --------------------------------------------------------------------------------------------------------------------
-// connect to another host/port
-
-// connect_to_this_unix()
-// path the path of the unix socket
-// timeout the timeout for establishing a connection
-
-static inline int connect_to_unix(const char *path, struct timeval *timeout) {
- int fd = socket(AF_UNIX, SOCK_STREAM, 0);
- if(fd == -1) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Failed to create UNIX socket() for '%s'",
- path);
-
- return -1;
- }
-
- if(timeout) {
- if(setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, (char *) timeout, sizeof(struct timeval)) < 0)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Failed to set timeout on UNIX socket '%s'",
- path);
- }
-
- struct sockaddr_un addr;
- memset(&addr, 0, sizeof(addr));
- addr.sun_family = AF_UNIX;
- strncpy(addr.sun_path, path, sizeof(addr.sun_path)-1);
-
- if (connect(fd, (struct sockaddr*)&addr, sizeof(addr)) == -1) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Cannot connect to UNIX socket on path '%s'.",
- path);
-
- close(fd);
- return -1;
- }
-
- nd_log(NDLS_DAEMON, NDLP_DEBUG,
- "Connected to UNIX socket on path '%s'.",
- path);
-
- return fd;
-}
-
-// connect_to_this_ip46()
-// protocol IPPROTO_TCP, IPPROTO_UDP
-// socktype SOCK_STREAM, SOCK_DGRAM
-// host the destination hostname or IP address (IPv4 or IPv6) to connect to
-// if it resolves to many IPs, all are tried (IPv4 and IPv6)
-// scope_id the if_index id of the interface to use for connecting (0 = any)
-// (used only under IPv6)
-// service the service name or port to connect to
-// timeout the timeout for establishing a connection
-
-int connect_to_this_ip46(int protocol, int socktype, const char *host, uint32_t scope_id, const char *service, struct timeval *timeout) {
- struct addrinfo hints;
- struct addrinfo *ai_head = NULL, *ai = NULL;
-
- memset(&hints, 0, sizeof(hints));
- hints.ai_family = PF_UNSPEC; /* Allow IPv4 or IPv6 */
- hints.ai_socktype = socktype;
- hints.ai_protocol = protocol;
-
- int ai_err = getaddrinfo(host, service, &hints, &ai_head);
- if (ai_err != 0) {
-
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Cannot resolve host '%s', port '%s': %s",
- host, service, gai_strerror(ai_err));
-
- return -1;
- }
-
- char hostBfr[NI_MAXHOST + 1];
- char servBfr[NI_MAXSERV + 1];
-
- ND_LOG_STACK lgs[] = {
- ND_LOG_FIELD_TXT(NDF_DST_IP, hostBfr),
- ND_LOG_FIELD_TXT(NDF_DST_PORT, servBfr),
- ND_LOG_FIELD_END(),
- };
- ND_LOG_STACK_PUSH(lgs);
-
- int fd = -1;
- for (ai = ai_head; ai != NULL && fd == -1; ai = ai->ai_next) {
-
- if (ai->ai_family == PF_INET6) {
- struct sockaddr_in6 *pSadrIn6 = (struct sockaddr_in6 *) ai->ai_addr;
- if(pSadrIn6->sin6_scope_id == 0) {
- pSadrIn6->sin6_scope_id = scope_id;
- }
- }
-
- getnameinfo(ai->ai_addr,
- ai->ai_addrlen,
- hostBfr,
- sizeof(hostBfr),
- servBfr,
- sizeof(servBfr),
- NI_NUMERICHOST | NI_NUMERICSERV);
-
- switch (ai->ai_addr->sa_family) {
- case PF_INET: {
- struct sockaddr_in *pSadrIn = (struct sockaddr_in *)ai->ai_addr;
- (void)pSadrIn;
- break;
- }
-
- case PF_INET6: {
- struct sockaddr_in6 *pSadrIn6 = (struct sockaddr_in6 *) ai->ai_addr;
- (void)pSadrIn6;
- break;
- }
-
- default: {
- // Unknown protocol family
- continue;
- }
- }
-
- fd = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
- if(fd != -1) {
- if(timeout) {
- if(setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, (char *) timeout, sizeof(struct timeval)) < 0)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Failed to set timeout on the socket to ip '%s' port '%s'",
- hostBfr, servBfr);
- }
-
- errno = 0;
- if(connect(fd, ai->ai_addr, ai->ai_addrlen) < 0) {
- if(errno == EALREADY || errno == EINPROGRESS) {
- nd_log(NDLS_DAEMON, NDLP_DEBUG,
- "Waiting for connection to ip %s port %s to be established",
- hostBfr, servBfr);
-
- // Convert 'struct timeval' to milliseconds for poll():
- int timeout_milliseconds = timeout->tv_sec * 1000 + timeout->tv_usec / 1000;
-
- struct pollfd fds[1];
- fds[0].fd = fd;
- fds[0].events = POLLOUT; // We are looking for the ability to write to the socket
-
- int ret = poll(fds, 1, timeout_milliseconds);
- if (ret > 0) {
- // poll() completed normally. We can check the revents to see what happened
- if (fds[0].revents & POLLOUT) {
- // connect() completed successfully, socket is writable.
-
- nd_log(NDLS_DAEMON, NDLP_DEBUG,
- "connect() to ip %s port %s completed successfully",
- hostBfr, servBfr);
-
- }
- else {
- // This means that the socket is in error. We will close it and set fd to -1
-
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Failed to connect to '%s', port '%s'.",
- hostBfr, servBfr);
-
- close(fd);
- fd = -1;
- }
- }
- else if (ret == 0) {
- // poll() timed out, the connection is not established within the specified timeout.
- errno = 0;
-
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Timed out while connecting to '%s', port '%s'.",
- hostBfr, servBfr);
-
- close(fd);
- fd = -1;
- }
- else { // ret < 0
- // poll() returned an error.
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Failed to connect to '%s', port '%s'. poll() returned %d",
- hostBfr, servBfr, ret);
-
- close(fd);
- fd = -1;
- }
- }
- else {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Failed to connect to '%s', port '%s'",
- hostBfr, servBfr);
-
- close(fd);
- fd = -1;
- }
- }
- }
- else
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Failed to socket() to '%s', port '%s'",
- hostBfr, servBfr);
- }
-
- freeaddrinfo(ai_head);
-
- return fd;
-}
-
-// connect_to_this()
-//
-// definition format:
-//
-// [PROTOCOL:]IP[%INTERFACE][:PORT]
-//
-// PROTOCOL = tcp or udp
-// IP = IPv4 or IPv6 IP or hostname, optionally enclosed in [] (required for IPv6)
-// INTERFACE = for IPv6 only, the network interface to use
-// PORT = port number or service name
-
-int connect_to_this(const char *definition, int default_port, struct timeval *timeout) {
- char buffer[strlen(definition) + 1];
- strcpy(buffer, definition);
-
- char default_service[10 + 1];
- snprintfz(default_service, 10, "%d", default_port);
-
- char *host = buffer, *service = default_service, *interface = "";
- int protocol = IPPROTO_TCP, socktype = SOCK_STREAM;
- uint32_t scope_id = 0;
-
- if(strncmp(host, "tcp:", 4) == 0) {
- host += 4;
- protocol = IPPROTO_TCP;
- socktype = SOCK_STREAM;
- }
- else if(strncmp(host, "udp:", 4) == 0) {
- host += 4;
- protocol = IPPROTO_UDP;
- socktype = SOCK_DGRAM;
- }
- else if(strncmp(host, "unix:", 5) == 0) {
- char *path = host + 5;
- return connect_to_unix(path, timeout);
- }
- else if(*host == '/') {
- char *path = host;
- return connect_to_unix(path, timeout);
- }
-
- char *e = host;
- if(*e == '[') {
- e = ++host;
- while(*e && *e != ']') e++;
- if(*e == ']') {
- *e = '\0';
- e++;
- }
- }
- else {
- while(*e && *e != ':' && *e != '%') e++;
- }
-
- if(*e == '%') {
- *e = '\0';
- e++;
- interface = e;
- while(*e && *e != ':') e++;
- }
-
- if(*e == ':') {
- *e = '\0';
- e++;
- service = e;
- }
-
- if(!*host) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Definition '%s' does not specify a host.",
- definition);
-
- return -1;
- }
-
- if(*interface) {
- scope_id = if_nametoindex(interface);
- if(!scope_id)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Cannot find a network interface named '%s'. Continuing with limiting the network interface",
- interface);
- }
-
- if(!*service)
- service = default_service;
-
-
- return connect_to_this_ip46(protocol, socktype, host, scope_id, service, timeout);
-}
-
-void foreach_entry_in_connection_string(const char *destination, bool (*callback)(char *entry, void *data), void *data) {
- const char *s = destination;
- while(*s) {
- const char *e = s;
-
- // skip separators, moving both s(tart) and e(nd)
- while(isspace(*e) || *e == ',') s = ++e;
-
- // move e(nd) to the first separator
- while(*e && !isspace(*e) && *e != ',') e++;
-
- // is there anything?
- if(!*s || s == e) break;
-
- char buf[e - s + 1];
- strncpyz(buf, s, e - s);
-
- if(callback(buf, data)) break;
-
- s = e;
- }
-}
-
-struct connect_to_one_of_data {
- int default_port;
- struct timeval *timeout;
- size_t *reconnects_counter;
- char *connected_to;
- size_t connected_to_size;
- int sock;
-};
-
-static bool connect_to_one_of_callback(char *entry, void *data) {
- struct connect_to_one_of_data *t = data;
-
- if(t->reconnects_counter)
- t->reconnects_counter++;
-
- t->sock = connect_to_this(entry, t->default_port, t->timeout);
- if(t->sock != -1) {
- if(t->connected_to && t->connected_to_size) {
- strncpyz(t->connected_to, entry, t->connected_to_size);
- t->connected_to[t->connected_to_size - 1] = '\0';
- }
-
- return true;
- }
-
- return false;
-}
-
-int connect_to_one_of(const char *destination, int default_port, struct timeval *timeout, size_t *reconnects_counter, char *connected_to, size_t connected_to_size) {
- struct connect_to_one_of_data t = {
- .default_port = default_port,
- .timeout = timeout,
- .reconnects_counter = reconnects_counter,
- .connected_to = connected_to,
- .connected_to_size = connected_to_size,
- .sock = -1,
- };
-
- foreach_entry_in_connection_string(destination, connect_to_one_of_callback, &t);
-
- return t.sock;
-}
-
-static bool connect_to_one_of_urls_callback(char *entry, void *data) {
- char *s = strchr(entry, '/');
- if(s) *s = '\0';
-
- return connect_to_one_of_callback(entry, data);
-}
-
-int connect_to_one_of_urls(const char *destination, int default_port, struct timeval *timeout, size_t *reconnects_counter, char *connected_to, size_t connected_to_size) {
- struct connect_to_one_of_data t = {
- .default_port = default_port,
- .timeout = timeout,
- .reconnects_counter = reconnects_counter,
- .connected_to = connected_to,
- .connected_to_size = connected_to_size,
- .sock = -1,
- };
-
- foreach_entry_in_connection_string(destination, connect_to_one_of_urls_callback, &t);
-
- return t.sock;
-}
-
-
-// --------------------------------------------------------------------------------------------------------------------
-// helpers to send/receive data in one call, in blocking mode, with a timeout
-
-#ifdef ENABLE_HTTPS
-ssize_t recv_timeout(NETDATA_SSL *ssl,int sockfd, void *buf, size_t len, int flags, int timeout) {
-#else
-ssize_t recv_timeout(int sockfd, void *buf, size_t len, int flags, int timeout) {
-#endif
-
- for(;;) {
- struct pollfd fd = {
- .fd = sockfd,
- .events = POLLIN,
- .revents = 0
- };
-
- errno = 0;
- int retval = poll(&fd, 1, timeout * 1000);
-
- if(retval == -1) {
- // failed
-
- if(errno == EINTR || errno == EAGAIN)
- continue;
-
- return -1;
- }
-
- if(!retval) {
- // timeout
- return 0;
- }
-
- if(fd.revents & POLLIN)
- break;
- }
-
-#ifdef ENABLE_HTTPS
- if (SSL_connection(ssl)) {
- return netdata_ssl_read(ssl, buf, len);
- }
-#endif
-
- return recv(sockfd, buf, len, flags);
-}
-
-#ifdef ENABLE_HTTPS
-ssize_t send_timeout(NETDATA_SSL *ssl,int sockfd, void *buf, size_t len, int flags, int timeout) {
-#else
-ssize_t send_timeout(int sockfd, void *buf, size_t len, int flags, int timeout) {
-#endif
-
- for(;;) {
- struct pollfd fd = {
- .fd = sockfd,
- .events = POLLOUT,
- .revents = 0
- };
-
- errno = 0;
- int retval = poll(&fd, 1, timeout * 1000);
-
- if(retval == -1) {
- // failed
-
- if(errno == EINTR || errno == EAGAIN)
- continue;
-
- return -1;
- }
-
- if(!retval) {
- // timeout
- return 0;
- }
-
- if(fd.revents & POLLOUT) break;
- }
-
-#ifdef ENABLE_HTTPS
- if(ssl->conn) {
- if (SSL_connection(ssl)) {
- return netdata_ssl_write(ssl, buf, len);
- }
- else {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "cannot write to SSL connection - connection is not ready.");
-
- return -1;
- }
- }
-#endif
- return send(sockfd, buf, len, flags);
-}
-
-
-// --------------------------------------------------------------------------------------------------------------------
-// accept4() replacement for systems that do not have one
-
-#ifndef HAVE_ACCEPT4
-int accept4(int sock, struct sockaddr *addr, socklen_t *addrlen, int flags) {
- int fd = accept(sock, addr, addrlen);
- int newflags = 0;
-
- if (fd < 0) return fd;
-
- if (flags & SOCK_NONBLOCK) {
- newflags |= O_NONBLOCK;
- flags &= ~SOCK_NONBLOCK;
- }
-
-#ifdef SOCK_CLOEXEC
-#ifdef O_CLOEXEC
- if (flags & SOCK_CLOEXEC) {
- newflags |= O_CLOEXEC;
- flags &= ~SOCK_CLOEXEC;
- }
-#endif
-#endif
-
- if (flags) {
- close(fd);
- errno = EINVAL;
- return -1;
- }
-
- if (fcntl(fd, F_SETFL, newflags) < 0) {
- int saved_errno = errno;
- close(fd);
- errno = saved_errno;
- return -1;
- }
-
- return fd;
-}
-#endif
-
-/*
- * ---------------------------------------------------------------------------------------------------------------------
- * connection_allowed() - if there is an access list then check the connection matches a pattern.
- * Numeric patterns are checked against the IP address first, only if they
- * do not match is the hostname resolved (reverse-DNS) and checked. If the
- * hostname matches then we perform forward DNS resolution to check the IP
- * is really associated with the DNS record. This call is repeatable: the
- * web server may check more refined matches against the connection. Will
- * update the client_host if uninitialized - ensure the hostsize is the number
- * of *writable* bytes (i.e. be aware of the strdup used to compact the pollinfo).
- */
-int connection_allowed(int fd, char *client_ip, char *client_host, size_t hostsize, SIMPLE_PATTERN *access_list,
- const char *patname, int allow_dns)
-{
- if (!access_list)
- return 1;
- if (simple_pattern_matches(access_list, client_ip))
- return 1;
- // If the hostname is unresolved (and needed) then attempt the DNS lookups.
- //if (client_host[0]==0 && simple_pattern_is_potential_name(access_list))
- if (client_host[0]==0 && allow_dns)
- {
- struct sockaddr_storage sadr;
- socklen_t addrlen = sizeof(sadr);
- int err = getpeername(fd, (struct sockaddr*)&sadr, &addrlen);
- if (err != 0 ||
- (err = getnameinfo((struct sockaddr *)&sadr, addrlen, client_host, (socklen_t)hostsize,
- NULL, 0, NI_NAMEREQD)) != 0) {
-
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Incoming %s on '%s' does not match a numeric pattern, and host could not be resolved (err=%s)",
- patname, client_ip, gai_strerror(err));
-
- if (hostsize >= 8)
- strcpy(client_host,"UNKNOWN");
- return 0;
- }
- struct addrinfo *addr_infos = NULL;
- if (getaddrinfo(client_host, NULL, NULL, &addr_infos) !=0 ) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: cannot validate hostname '%s' from '%s' by resolving it",
- client_host, client_ip);
-
- if (hostsize >= 8)
- strcpy(client_host,"UNKNOWN");
- return 0;
- }
- struct addrinfo *scan = addr_infos;
- int validated = 0;
- while (scan) {
- char address[INET6_ADDRSTRLEN];
- address[0] = 0;
- switch (scan->ai_addr->sa_family) {
- case AF_INET:
- inet_ntop(AF_INET, &((struct sockaddr_in*)(scan->ai_addr))->sin_addr, address, INET6_ADDRSTRLEN);
- break;
- case AF_INET6:
- inet_ntop(AF_INET6, &((struct sockaddr_in6*)(scan->ai_addr))->sin6_addr, address, INET6_ADDRSTRLEN);
- break;
- }
- if (!strcmp(client_ip, address)) {
- validated = 1;
- break;
- }
- scan = scan->ai_next;
- }
- if (!validated) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: Cannot validate '%s' as ip of '%s', not listed in DNS",
- client_ip, client_host);
-
- if (hostsize >= 8)
- strcpy(client_host,"UNKNOWN");
- }
- if (addr_infos!=NULL)
- freeaddrinfo(addr_infos);
- }
- if (!simple_pattern_matches(access_list, client_host))
- return 0;
-
- return 1;
-}
-
-// --------------------------------------------------------------------------------------------------------------------
-// accept_socket() - accept a socket and store client IP and port
-int accept_socket(int fd, int flags, char *client_ip, size_t ipsize, char *client_port, size_t portsize,
- char *client_host, size_t hostsize, SIMPLE_PATTERN *access_list, int allow_dns) {
- struct sockaddr_storage sadr;
- socklen_t addrlen = sizeof(sadr);
-
- int nfd = accept4(fd, (struct sockaddr *)&sadr, &addrlen, flags);
- if (likely(nfd >= 0)) {
- if (getnameinfo((struct sockaddr *)&sadr, addrlen, client_ip, (socklen_t)ipsize,
- client_port, (socklen_t)portsize, NI_NUMERICHOST | NI_NUMERICSERV) != 0) {
-
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "LISTENER: cannot getnameinfo() on received client connection.");
-
- strncpyz(client_ip, "UNKNOWN", ipsize);
- strncpyz(client_port, "UNKNOWN", portsize);
- }
- if (!strcmp(client_ip, "127.0.0.1") || !strcmp(client_ip, "::1")) {
- strncpyz(client_ip, "localhost", ipsize);
- }
-
-#ifdef __FreeBSD__
- if(((struct sockaddr *)&sadr)->sa_family == AF_LOCAL)
- strncpyz(client_ip, "localhost", ipsize);
-#endif
-
- client_ip[ipsize - 1] = '\0';
- client_port[portsize - 1] = '\0';
-
- switch (((struct sockaddr *)&sadr)->sa_family) {
- case AF_UNIX:
- // netdata_log_debug(D_LISTENER, "New UNIX domain web client from %s on socket %d.", client_ip, fd);
- // set the port - certain versions of libc return garbage on unix sockets
- strncpyz(client_port, "UNIX", portsize);
- break;
-
- case AF_INET:
- // netdata_log_debug(D_LISTENER, "New IPv4 web client from %s port %s on socket %d.", client_ip, client_port, fd);
- break;
-
- case AF_INET6:
- if (strncmp(client_ip, "::ffff:", 7) == 0) {
- memmove(client_ip, &client_ip[7], strlen(&client_ip[7]) + 1);
- // netdata_log_debug(D_LISTENER, "New IPv4 web client from %s port %s on socket %d.", client_ip, client_port, fd);
- }
- // else
- // netdata_log_debug(D_LISTENER, "New IPv6 web client from %s port %s on socket %d.", client_ip, client_port, fd);
- break;
-
- default:
- // netdata_log_debug(D_LISTENER, "New UNKNOWN web client from %s port %s on socket %d.", client_ip, client_port, fd);
- break;
- }
- if (!connection_allowed(nfd, client_ip, client_host, hostsize, access_list, "connection", allow_dns)) {
- errno = 0;
- nd_log(NDLS_DAEMON, NDLP_WARNING,
- "Permission denied for client '%s', port '%s'",
- client_ip, client_port);
-
- close(nfd);
- nfd = -1;
- errno = EPERM;
- }
- }
-#ifdef HAVE_ACCEPT4
- else if (errno == ENOSYS)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Netdata has been compiled with the assumption that the system has the accept4() call, but it is not here. "
- "Recompile netdata like this: ./configure --disable-accept4 ...");
-#endif
-
- return nfd;
-}
-
-
-// --------------------------------------------------------------------------------------------------------------------
-// poll() based listener
-// this should be the fastest possible listener for up to 100 sockets
-// above 100, an epoll() interface is needed on Linux
-
-#define POLL_FDS_INCREASE_STEP 10
-
-inline POLLINFO *poll_add_fd(POLLJOB *p
- , int fd
- , int socktype
- , WEB_CLIENT_ACL port_acl
- , uint32_t flags
- , const char *client_ip
- , const char *client_port
- , const char *client_host
- , void *(*add_callback)(POLLINFO * /*pi*/, short int * /*events*/, void * /*data*/)
- , void (*del_callback)(POLLINFO * /*pi*/)
- , int (*rcv_callback)(POLLINFO * /*pi*/, short int * /*events*/)
- , int (*snd_callback)(POLLINFO * /*pi*/, short int * /*events*/)
- , void *data
-) {
- if(unlikely(fd < 0)) return NULL;
-
- //if(p->limit && p->used >= p->limit) {
- // nd_log(NDLS_DAEMON, NDLP_WARNING, "Max sockets limit reached (%zu sockets), dropping connection", p->used);
- // close(fd);
- // return NULL;
- //}
-
- if(unlikely(!p->first_free)) {
- size_t new_slots = p->slots + POLL_FDS_INCREASE_STEP;
-
- p->fds = reallocz(p->fds, sizeof(struct pollfd) * new_slots);
- p->inf = reallocz(p->inf, sizeof(POLLINFO) * new_slots);
-
- // reset all the newly added slots
- ssize_t i;
- for(i = new_slots - 1; i >= (ssize_t)p->slots ; i--) {
- p->fds[i].fd = -1;
- p->fds[i].events = 0;
- p->fds[i].revents = 0;
-
- p->inf[i].p = p;
- p->inf[i].slot = (size_t)i;
- p->inf[i].flags = 0;
- p->inf[i].socktype = -1;
- p->inf[i].port_acl = -1;
-
- p->inf[i].client_ip = NULL;
- p->inf[i].client_port = NULL;
- p->inf[i].client_host = NULL;
- p->inf[i].del_callback = p->del_callback;
- p->inf[i].rcv_callback = p->rcv_callback;
- p->inf[i].snd_callback = p->snd_callback;
- p->inf[i].data = NULL;
-
- // link them so that the first free will be earlier in the array
- // (we loop decrementing i)
- p->inf[i].next = p->first_free;
- p->first_free = &p->inf[i];
- }
-
- p->slots = new_slots;
- }
-
- POLLINFO *pi = p->first_free;
- p->first_free = p->first_free->next;
-
- struct pollfd *pf = &p->fds[pi->slot];
- pf->fd = fd;
- pf->events = POLLIN;
- pf->revents = 0;
-
- pi->fd = fd;
- pi->p = p;
- pi->socktype = socktype;
- pi->port_acl = port_acl;
- pi->flags = flags;
- pi->next = NULL;
- pi->client_ip = strdupz(client_ip);
- pi->client_port = strdupz(client_port);
- pi->client_host = strdupz(client_host);
-
- pi->del_callback = del_callback;
- pi->rcv_callback = rcv_callback;
- pi->snd_callback = snd_callback;
-
- pi->connected_t = now_boottime_sec();
- pi->last_received_t = 0;
- pi->last_sent_t = 0;
- pi->last_sent_t = 0;
- pi->recv_count = 0;
- pi->send_count = 0;
-
- netdata_thread_disable_cancelability();
- p->used++;
- if(unlikely(pi->slot > p->max))
- p->max = pi->slot;
-
- if(pi->flags & POLLINFO_FLAG_CLIENT_SOCKET) {
- pi->data = add_callback(pi, &pf->events, data);
- }
-
- if(pi->flags & POLLINFO_FLAG_SERVER_SOCKET) {
- p->min = pi->slot;
- }
- netdata_thread_enable_cancelability();
-
- return pi;
-}
-
-inline void poll_close_fd(POLLINFO *pi) {
- POLLJOB *p = pi->p;
-
- struct pollfd *pf = &p->fds[pi->slot];
-
- if(unlikely(pf->fd == -1)) return;
-
- netdata_thread_disable_cancelability();
-
- if(pi->flags & POLLINFO_FLAG_CLIENT_SOCKET) {
- pi->del_callback(pi);
-
- if(likely(!(pi->flags & POLLINFO_FLAG_DONT_CLOSE))) {
- if(close(pf->fd) == -1)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "Failed to close() poll_events() socket %d",
- pf->fd);
- }
- }
-
- pf->fd = -1;
- pf->events = 0;
- pf->revents = 0;
-
- pi->fd = -1;
- pi->socktype = -1;
- pi->flags = 0;
- pi->data = NULL;
-
- pi->del_callback = NULL;
- pi->rcv_callback = NULL;
- pi->snd_callback = NULL;
-
- freez(pi->client_ip);
- pi->client_ip = NULL;
-
- freez(pi->client_port);
- pi->client_port = NULL;
-
- freez(pi->client_host);
- pi->client_host = NULL;
-
- pi->next = p->first_free;
- p->first_free = pi;
-
- p->used--;
- if(unlikely(p->max == pi->slot)) {
- p->max = p->min;
- ssize_t i;
- for(i = (ssize_t)pi->slot; i > (ssize_t)p->min ;i--) {
- if (unlikely(p->fds[i].fd != -1)) {
- p->max = (size_t)i;
- break;
- }
- }
- }
- netdata_thread_enable_cancelability();
-}
-
-void *poll_default_add_callback(POLLINFO *pi, short int *events, void *data) {
- (void)pi;
- (void)events;
- (void)data;
-
- return NULL;
-}
-
-void poll_default_del_callback(POLLINFO *pi) {
- if(pi->data)
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "POLLFD: internal error: del_callback_default() called with data pointer - possible memory leak");
-}
-
-int poll_default_rcv_callback(POLLINFO *pi, short int *events) {
- *events |= POLLIN;
-
- char buffer[1024 + 1];
-
- ssize_t rc;
- do {
- rc = recv(pi->fd, buffer, 1024, MSG_DONTWAIT);
- if (rc < 0) {
- // read failed
- if (errno != EWOULDBLOCK && errno != EAGAIN) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "POLLFD: poll_default_rcv_callback(): recv() failed with %zd.",
- rc);
-
- return -1;
- }
- } else if (rc) {
- // data received
- nd_log(NDLS_DAEMON, NDLP_WARNING,
- "POLLFD: internal error: poll_default_rcv_callback() is discarding %zd bytes received on socket %d",
- rc, pi->fd);
- }
- } while (rc != -1);
-
- return 0;
-}
-
-int poll_default_snd_callback(POLLINFO *pi, short int *events) {
- *events &= ~POLLOUT;
-
- nd_log(NDLS_DAEMON, NDLP_WARNING,
- "POLLFD: internal error: poll_default_snd_callback(): nothing to send on socket %d",
- pi->fd);
-
- return 0;
-}
-
-void poll_default_tmr_callback(void *timer_data) {
- (void)timer_data;
-}
-
-static void poll_events_cleanup(void *data) {
- POLLJOB *p = (POLLJOB *)data;
-
- size_t i;
- for(i = 0 ; i <= p->max ; i++) {
- POLLINFO *pi = &p->inf[i];
- poll_close_fd(pi);
- }
-
- freez(p->fds);
- freez(p->inf);
-}
-
-static int poll_process_error(POLLINFO *pi, struct pollfd *pf, short int revents) {
- ND_LOG_STACK lgs[] = {
- ND_LOG_FIELD_TXT(NDF_SRC_IP, pi->client_ip),
- ND_LOG_FIELD_TXT(NDF_SRC_PORT, pi->client_port),
- ND_LOG_FIELD_END(),
- };
- ND_LOG_STACK_PUSH(lgs);
-
- nd_log(NDLS_DAEMON, NDLP_DEBUG,
- "POLLFD: LISTENER: received %s %s %s on socket at slot %zu (fd %d) client '%s' port '%s' expecting %s %s %s, having %s %s %s"
- , revents & POLLERR ? "POLLERR" : ""
- , revents & POLLHUP ? "POLLHUP" : ""
- , revents & POLLNVAL ? "POLLNVAL" : ""
- , pi->slot
- , pi->fd
- , pi->client_ip ? pi->client_ip : "<undefined-ip>"
- , pi->client_port ? pi->client_port : "<undefined-port>"
- , pf->events & POLLIN ? "POLLIN" : "", pf->events & POLLOUT ? "POLLOUT" : "", pf->events & POLLPRI ? "POLLPRI" : ""
- , revents & POLLIN ? "POLLIN" : "", revents & POLLOUT ? "POLLOUT" : "", revents & POLLPRI ? "POLLPRI" : ""
- );
-
- pf->events = 0;
- poll_close_fd(pi);
- return 1;
-}
-
-static inline int poll_process_send(POLLJOB *p, POLLINFO *pi, struct pollfd *pf, time_t now) {
- pi->last_sent_t = now;
- pi->send_count++;
-
- pf->events = 0;
-
- // remember the slot, in case we need to close it later
- // the callback may manipulate the socket list and our pf and pi pointers may be invalid after that call
- size_t slot = pi->slot;
-
- if (unlikely(pi->snd_callback(pi, &pf->events) == -1))
- poll_close_fd(&p->inf[slot]);
-
- // IMPORTANT:
- // pf and pi may be invalid below this point, they may have been reallocated.
-
- return 1;
-}
-
-static inline int poll_process_tcp_read(POLLJOB *p, POLLINFO *pi, struct pollfd *pf, time_t now) {
- pi->last_received_t = now;
- pi->recv_count++;
-
- pf->events = 0;
-
- // remember the slot, in case we need to close it later
- // the callback may manipulate the socket list and our pf and pi pointers may be invalid after that call
- size_t slot = pi->slot;
-
- if (pi->rcv_callback(pi, &pf->events) == -1)
- poll_close_fd(&p->inf[slot]);
-
- // IMPORTANT:
- // pf and pi may be invalid below this point, they may have been reallocated.
-
- return 1;
-}
-
-static inline int poll_process_udp_read(POLLINFO *pi, struct pollfd *pf, time_t now __maybe_unused) {
- pi->last_received_t = now;
- pi->recv_count++;
-
- // TODO: access_list is not applied to UDP
- // but checking the access list on every UDP packet will destroy
- // performance, especially for statsd.
-
- pf->events = 0;
- if(pi->rcv_callback(pi, &pf->events) == -1)
- return 0;
-
- // IMPORTANT:
- // pf and pi may be invalid below this point, they may have been reallocated.
-
- return 1;
-}
-
-static int poll_process_new_tcp_connection(POLLJOB *p, POLLINFO *pi, struct pollfd *pf, time_t now) {
- pi->last_received_t = now;
- pi->recv_count++;
-
- char client_ip[INET6_ADDRSTRLEN] = "";
- char client_port[NI_MAXSERV] = "";
- char client_host[NI_MAXHOST] = "";
-
- int nfd = accept_socket(
- pf->fd,SOCK_NONBLOCK,
- client_ip, INET6_ADDRSTRLEN, client_port,NI_MAXSERV, client_host, NI_MAXHOST,
- p->access_list, p->allow_dns
- );
-
- if (unlikely(nfd < 0)) {
- // accept failed
-
- if(unlikely(errno == EMFILE)) {
- nd_log_limit_static_global_var(erl, 10, 1000);
- nd_log_limit(&erl, NDLS_DAEMON, NDLP_ERR,
- "POLLFD: LISTENER: too many open files - used by this thread %zu, max for this thread %zu",
- p->used, p->limit);
- }
- else if(unlikely(errno != EWOULDBLOCK && errno != EAGAIN))
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "POLLFD: LISTENER: accept() failed.");
-
- }
- else {
- // accept ok
-
- poll_add_fd(p
- , nfd
- , SOCK_STREAM
- , pi->port_acl
- , POLLINFO_FLAG_CLIENT_SOCKET
- , client_ip
- , client_port
- , client_host
- , p->add_callback
- , p->del_callback
- , p->rcv_callback
- , p->snd_callback
- , NULL
- );
-
- // IMPORTANT:
- // pf and pi may be invalid below this point, they may have been reallocated.
-
- return 1;
- }
-
- return 0;
-}
-
-void poll_events(LISTEN_SOCKETS *sockets
- , void *(*add_callback)(POLLINFO * /*pi*/, short int * /*events*/, void * /*data*/)
- , void (*del_callback)(POLLINFO * /*pi*/)
- , int (*rcv_callback)(POLLINFO * /*pi*/, short int * /*events*/)
- , int (*snd_callback)(POLLINFO * /*pi*/, short int * /*events*/)
- , void (*tmr_callback)(void * /*timer_data*/)
- , bool (*check_to_stop_callback)(void)
- , SIMPLE_PATTERN *access_list
- , int allow_dns
- , void *data
- , time_t tcp_request_timeout_seconds
- , time_t tcp_idle_timeout_seconds
- , time_t timer_milliseconds
- , void *timer_data
- , size_t max_tcp_sockets
-) {
- if(!sockets || !sockets->opened) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "POLLFD: internal error: no listening sockets are opened");
- return;
- }
-
- if(timer_milliseconds <= 0) timer_milliseconds = 0;
-
- int retval;
-
- POLLJOB p = {
- .slots = 0,
- .used = 0,
- .max = 0,
- .limit = max_tcp_sockets,
- .fds = NULL,
- .inf = NULL,
- .first_free = NULL,
-
- .complete_request_timeout = tcp_request_timeout_seconds,
- .idle_timeout = tcp_idle_timeout_seconds,
- .checks_every = (tcp_idle_timeout_seconds / 3) + 1,
-
- .access_list = access_list,
- .allow_dns = allow_dns,
-
- .timer_milliseconds = timer_milliseconds,
- .timer_data = timer_data,
-
- .add_callback = add_callback?add_callback:poll_default_add_callback,
- .del_callback = del_callback?del_callback:poll_default_del_callback,
- .rcv_callback = rcv_callback?rcv_callback:poll_default_rcv_callback,
- .snd_callback = snd_callback?snd_callback:poll_default_snd_callback,
- .tmr_callback = tmr_callback?tmr_callback:poll_default_tmr_callback
- };
-
- size_t i;
- for(i = 0; i < sockets->opened ;i++) {
-
- POLLINFO *pi = poll_add_fd(&p
- , sockets->fds[i]
- , sockets->fds_types[i]
- , sockets->fds_acl_flags[i]
- , POLLINFO_FLAG_SERVER_SOCKET
- , (sockets->fds_names[i])?sockets->fds_names[i]:"UNKNOWN"
- , ""
- , ""
- , p.add_callback
- , p.del_callback
- , p.rcv_callback
- , p.snd_callback
- , NULL
- );
-
- pi->data = data;
- nd_log(NDLS_DAEMON, NDLP_DEBUG,
- "POLLFD: LISTENER: listening on '%s'",
- (sockets->fds_names[i])?sockets->fds_names[i]:"UNKNOWN");
- }
-
- int listen_sockets_active = 1;
-
- int timeout_ms = 1000; // in milliseconds
- time_t last_check = now_boottime_sec();
-
- usec_t timer_usec = timer_milliseconds * USEC_PER_MS;
- usec_t now_usec = 0, next_timer_usec = 0, last_timer_usec = 0;
- (void)last_timer_usec;
-
- if(unlikely(timer_usec)) {
- now_usec = now_boottime_usec();
- next_timer_usec = now_usec - (now_usec % timer_usec) + timer_usec;
- }
-
- netdata_thread_cleanup_push(poll_events_cleanup, &p);
-
- while(!check_to_stop_callback()) {
- if(unlikely(timer_usec)) {
- now_usec = now_boottime_usec();
-
- if(unlikely(timer_usec && now_usec >= next_timer_usec)) {
- last_timer_usec = now_usec;
- p.tmr_callback(p.timer_data);
- now_usec = now_boottime_usec();
- next_timer_usec = now_usec - (now_usec % timer_usec) + timer_usec;
- }
-
- usec_t dt_usec = next_timer_usec - now_usec;
- if(dt_usec < 1000 * USEC_PER_MS)
- timeout_ms = 1000;
- else
- timeout_ms = (int)(dt_usec / USEC_PER_MS);
- }
-
- // enable or disable the TCP listening sockets, based on the current number of sockets used and the limit set
- if((listen_sockets_active && (p.limit && p.used >= p.limit)) || (!listen_sockets_active && (!p.limit || p.used < p.limit))) {
- listen_sockets_active = !listen_sockets_active;
-
- nd_log(NDLS_DAEMON, NDLP_DEBUG,
- "%s listening sockets (used TCP sockets %zu, max allowed for this worker %zu)",
- (listen_sockets_active)?"ENABLING":"DISABLING", p.used, p.limit);
-
- for (i = 0; i <= p.max; i++) {
- if(p.inf[i].flags & POLLINFO_FLAG_SERVER_SOCKET && p.inf[i].socktype == SOCK_STREAM) {
- p.fds[i].events = (short int) ((listen_sockets_active) ? POLLIN : 0);
- }
- }
- }
-
- retval = poll(p.fds, p.max + 1, timeout_ms);
- time_t now = now_boottime_sec();
-
- if(unlikely(retval == -1)) {
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "POLLFD: LISTENER: poll() failed while waiting on %zu sockets.",
- p.max + 1);
-
- break;
- }
- else if(unlikely(!retval)) {
- // timeout
- ;
- }
- else {
- POLLINFO *pi;
- struct pollfd *pf;
- size_t idx, processed = 0;
- short int revents;
-
- // keep fast lookup arrays per function
- // to avoid looping through the entire list every time
- size_t sends[p.max + 1], sends_max = 0;
- size_t reads[p.max + 1], reads_max = 0;
- size_t conns[p.max + 1], conns_max = 0;
- size_t udprd[p.max + 1], udprd_max = 0;
-
- for (i = 0; i <= p.max; i++) {
- pi = &p.inf[i];
- pf = &p.fds[i];
- revents = pf->revents;
-
- if(unlikely(revents == 0 || pf->fd == -1))
- continue;
-
- if (unlikely(revents & (POLLERR|POLLHUP|POLLNVAL))) {
- // something is wrong to one of our sockets
-
- pf->revents = 0;
- processed += poll_process_error(pi, pf, revents);
- }
- else if (likely(revents & POLLOUT)) {
- // a client is ready to receive data
-
- sends[sends_max++] = i;
- }
- else if (likely(revents & (POLLIN|POLLPRI))) {
- if (pi->flags & POLLINFO_FLAG_CLIENT_SOCKET) {
- // a client sent data to us
-
- reads[reads_max++] = i;
- }
- else if (pi->flags & POLLINFO_FLAG_SERVER_SOCKET) {
- // something is coming to our server sockets
-
- if(pi->socktype == SOCK_DGRAM) {
- // UDP receive, directly on our listening socket
-
- udprd[udprd_max++] = i;
- }
- else if(pi->socktype == SOCK_STREAM) {
- // new TCP connection
-
- conns[conns_max++] = i;
- }
- else
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "POLLFD: LISTENER: server slot %zu (fd %d) connection from %s port %s using unhandled socket type %d."
- , i
- , pi->fd
- , pi->client_ip ? pi->client_ip : "<undefined-ip>"
- , pi->client_port ? pi->client_port : "<undefined-port>"
- , pi->socktype
- );
- }
- else
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "POLLFD: LISTENER: client slot %zu (fd %d) data from %s port %s using flags %08X is neither client nor server."
- , i
- , pi->fd
- , pi->client_ip ? pi->client_ip : "<undefined-ip>"
- , pi->client_port ? pi->client_port : "<undefined-port>"
- , pi->flags
- );
- }
- else
- nd_log(NDLS_DAEMON, NDLP_ERR,
- "POLLFD: LISTENER: socket slot %zu (fd %d) client %s port %s unhandled event id %d."
- , i
- , pi->fd
- , pi->client_ip ? pi->client_ip : "<undefined-ip>"
- , pi->client_port ? pi->client_port : "<undefined-port>"
- , revents
- );
- }
-
- // process sends
- for (idx = 0; idx < sends_max; idx++) {
- i = sends[idx];
- pi = &p.inf[i];
- pf = &p.fds[i];
- pf->revents = 0;
- processed += poll_process_send(&p, pi, pf, now);
- }
-
- // process UDP reads
- for (idx = 0; idx < udprd_max; idx++) {
- i = udprd[idx];
- pi = &p.inf[i];
- pf = &p.fds[i];
- pf->revents = 0;
- processed += poll_process_udp_read(pi, pf, now);
- }
-
- // process TCP reads
- for (idx = 0; idx < reads_max; idx++) {
- i = reads[idx];
- pi = &p.inf[i];
- pf = &p.fds[i];
- pf->revents = 0;
- processed += poll_process_tcp_read(&p, pi, pf, now);
- }
-
- if(!processed && (!p.limit || p.used < p.limit)) {
- // nothing processed above (rcv, snd) and we have room for another TCP connection
- // so, accept one TCP connection
- for (idx = 0; idx < conns_max; idx++) {
- i = conns[idx];
- pi = &p.inf[i];
- pf = &p.fds[i];
- pf->revents = 0;
- if (poll_process_new_tcp_connection(&p, pi, pf, now))
- break;
- }
- }
- }
-
- if(unlikely(p.checks_every > 0 && now - last_check > p.checks_every)) {
- last_check = now;
-
- // cleanup old sockets
- for(i = 0; i <= p.max; i++) {
- POLLINFO *pi = &p.inf[i];
-
- if(likely(pi->flags & POLLINFO_FLAG_CLIENT_SOCKET)) {
- if (unlikely(pi->send_count == 0 && p.complete_request_timeout > 0 && (now - pi->connected_t) >= p.complete_request_timeout)) {
- nd_log(NDLS_DAEMON, NDLP_DEBUG,
- "POLLFD: LISTENER: client slot %zu (fd %d) from %s port %s has not sent a complete request in %zu seconds - closing it. "
- , i
- , pi->fd
- , pi->client_ip ? pi->client_ip : "<undefined-ip>"
- , pi->client_port ? pi->client_port : "<undefined-port>"
- , (size_t) p.complete_request_timeout
- );
- poll_close_fd(pi);
- }
- else if(unlikely(pi->recv_count && p.idle_timeout > 0 && now - ((pi->last_received_t > pi->last_sent_t) ? pi->last_received_t : pi->last_sent_t) >= p.idle_timeout )) {
- nd_log(NDLS_DAEMON, NDLP_DEBUG,
- "POLLFD: LISTENER: client slot %zu (fd %d) from %s port %s is idle for more than %zu seconds - closing it. "
- , i
- , pi->fd
- , pi->client_ip ? pi->client_ip : "<undefined-ip>"
- , pi->client_port ? pi->client_port : "<undefined-port>"
- , (size_t) p.idle_timeout
- );
- poll_close_fd(pi);
- }
- }
- }
- }
- }
-
- netdata_thread_cleanup_pop(1);
-}
diff --git a/libnetdata/socket/socket.h b/libnetdata/socket/socket.h
deleted file mode 100644
index e4ca08d4..00000000
--- a/libnetdata/socket/socket.h
+++ /dev/null
@@ -1,248 +0,0 @@
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-#ifndef NETDATA_SOCKET_H
-#define NETDATA_SOCKET_H
-
-#include "../libnetdata.h"
-
-#ifndef MAX_LISTEN_FDS
-#define MAX_LISTEN_FDS 50
-#endif
-
-typedef enum web_client_acl {
- WEB_CLIENT_ACL_NONE = (0),
- WEB_CLIENT_ACL_NOCHECK = (1 << 0), // Don't check anything - this should work on all channels
- WEB_CLIENT_ACL_DASHBOARD = (1 << 1),
- WEB_CLIENT_ACL_REGISTRY = (1 << 2),
- WEB_CLIENT_ACL_BADGE = (1 << 3),
- WEB_CLIENT_ACL_MGMT = (1 << 4),
- WEB_CLIENT_ACL_STREAMING = (1 << 5),
- WEB_CLIENT_ACL_NETDATACONF = (1 << 6),
- WEB_CLIENT_ACL_SSL_OPTIONAL = (1 << 7),
- WEB_CLIENT_ACL_SSL_FORCE = (1 << 8),
- WEB_CLIENT_ACL_SSL_DEFAULT = (1 << 9),
- WEB_CLIENT_ACL_ACLK = (1 << 10),
- WEB_CLIENT_ACL_WEBRTC = (1 << 11),
- WEB_CLIENT_ACL_BEARER_OPTIONAL = (1 << 12), // allow unprotected access if bearer is not enabled in netdata
- WEB_CLIENT_ACL_BEARER_REQUIRED = (1 << 13), // allow access only if a valid bearer is used
-} WEB_CLIENT_ACL;
-
-#define WEB_CLIENT_ACL_DASHBOARD_ACLK_WEBRTC (WEB_CLIENT_ACL_DASHBOARD | WEB_CLIENT_ACL_ACLK | WEB_CLIENT_ACL_WEBRTC | WEB_CLIENT_ACL_BEARER_OPTIONAL)
-#define WEB_CLIENT_ACL_ACLK_WEBRTC_DASHBOARD_WITH_BEARER (WEB_CLIENT_ACL_DASHBOARD | WEB_CLIENT_ACL_ACLK | WEB_CLIENT_ACL_WEBRTC | WEB_CLIENT_ACL_BEARER_REQUIRED)
-
-#ifdef NETDATA_DEV_MODE
-#define ACL_DEV_OPEN_ACCESS WEB_CLIENT_ACL_NOCHECK
-#else
-#define ACL_DEV_OPEN_ACCESS 0
-#endif
-
-#define WEB_CLIENT_ACL_ALL 0xFFFF
-
-#define web_client_can_access_dashboard(w) ((w)->acl & WEB_CLIENT_ACL_DASHBOARD)
-#define web_client_can_access_registry(w) ((w)->acl & WEB_CLIENT_ACL_REGISTRY)
-#define web_client_can_access_badges(w) ((w)->acl & WEB_CLIENT_ACL_BADGE)
-#define web_client_can_access_mgmt(w) ((w)->acl & WEB_CLIENT_ACL_MGMT)
-#define web_client_can_access_stream(w) ((w)->acl & WEB_CLIENT_ACL_STREAMING)
-#define web_client_can_access_netdataconf(w) ((w)->acl & WEB_CLIENT_ACL_NETDATACONF)
-#define web_client_is_using_ssl_optional(w) ((w)->port_acl & WEB_CLIENT_ACL_SSL_OPTIONAL)
-#define web_client_is_using_ssl_force(w) ((w)->port_acl & WEB_CLIENT_ACL_SSL_FORCE)
-#define web_client_is_using_ssl_default(w) ((w)->port_acl & WEB_CLIENT_ACL_SSL_DEFAULT)
-
-typedef struct listen_sockets {
- struct config *config; // the config file to use
- const char *config_section; // the netdata configuration section to read settings from
- const char *default_bind_to; // the default bind to configuration string
- uint16_t default_port; // the default port to use
- int backlog; // the default listen backlog to use
-
- size_t opened; // the number of sockets opened
- size_t failed; // the number of sockets attempted to open, but failed
- int fds[MAX_LISTEN_FDS]; // the open sockets
- char *fds_names[MAX_LISTEN_FDS]; // descriptions for the open sockets
- int fds_types[MAX_LISTEN_FDS]; // the socktype for the open sockets (SOCK_STREAM, SOCK_DGRAM)
- int fds_families[MAX_LISTEN_FDS]; // the family of the open sockets (AF_UNIX, AF_INET, AF_INET6)
- WEB_CLIENT_ACL fds_acl_flags[MAX_LISTEN_FDS]; // the acl to apply to the open sockets (dashboard, badges, streaming, netdata.conf, management)
-} LISTEN_SOCKETS;
-
-char *strdup_client_description(int family, const char *protocol, const char *ip, uint16_t port);
-
-int listen_sockets_setup(LISTEN_SOCKETS *sockets);
-void listen_sockets_close(LISTEN_SOCKETS *sockets);
-
-void foreach_entry_in_connection_string(const char *destination, bool (*callback)(char *entry, void *data), void *data);
-int connect_to_this_ip46(int protocol, int socktype, const char *host, uint32_t scope_id, const char *service, struct timeval *timeout);
-int connect_to_this(const char *definition, int default_port, struct timeval *timeout);
-int connect_to_one_of(const char *destination, int default_port, struct timeval *timeout, size_t *reconnects_counter, char *connected_to, size_t connected_to_size);
-int connect_to_one_of_urls(const char *destination, int default_port, struct timeval *timeout, size_t *reconnects_counter, char *connected_to, size_t connected_to_size);
-
-
-#ifdef ENABLE_HTTPS
-ssize_t recv_timeout(NETDATA_SSL *ssl,int sockfd, void *buf, size_t len, int flags, int timeout);
-ssize_t send_timeout(NETDATA_SSL *ssl,int sockfd, void *buf, size_t len, int flags, int timeout);
-#else
-ssize_t recv_timeout(int sockfd, void *buf, size_t len, int flags, int timeout);
-ssize_t send_timeout(int sockfd, void *buf, size_t len, int flags, int timeout);
-#endif
-
-bool fd_is_socket(int fd);
-bool sock_has_output_error(int fd);
-
-int sock_setnonblock(int fd);
-int sock_delnonblock(int fd);
-int sock_setreuse(int fd, int reuse);
-int sock_setreuse_port(int fd, int reuse);
-int sock_enlarge_in(int fd);
-int sock_enlarge_out(int fd);
-
-int connection_allowed(int fd, char *client_ip, char *client_host, size_t hostsize,
- SIMPLE_PATTERN *access_list, const char *patname, int allow_dns);
-int accept_socket(int fd, int flags, char *client_ip, size_t ipsize, char *client_port, size_t portsize,
- char *client_host, size_t hostsize, SIMPLE_PATTERN *access_list, int allow_dns);
-
-#ifndef HAVE_ACCEPT4
-int accept4(int sock, struct sockaddr *addr, socklen_t *addrlen, int flags);
-
-#ifndef SOCK_NONBLOCK
-#define SOCK_NONBLOCK 00004000
-#endif /* #ifndef SOCK_NONBLOCK */
-
-#ifndef SOCK_CLOEXEC
-#define SOCK_CLOEXEC 02000000
-#endif /* #ifndef SOCK_CLOEXEC */
-
-#endif /* #ifndef HAVE_ACCEPT4 */
-
-
-// ----------------------------------------------------------------------------
-// poll() based listener
-
-#define POLLINFO_FLAG_SERVER_SOCKET 0x00000001
-#define POLLINFO_FLAG_CLIENT_SOCKET 0x00000002
-#define POLLINFO_FLAG_DONT_CLOSE 0x00000004
-
-typedef struct poll POLLJOB;
-
-typedef struct pollinfo {
- POLLJOB *p; // the parent
- size_t slot; // the slot id
-
- int fd; // the file descriptor
- int socktype; // the client socket type
- WEB_CLIENT_ACL port_acl; // the access lists permitted on this web server port (it's -1 for client sockets)
- char *client_ip; // Max INET6_ADDRSTRLEN bytes
- char *client_port; // Max NI_MAXSERV bytes
- char *client_host; // Max NI_MAXHOST bytes
-
- time_t connected_t; // the time the socket connected
- time_t last_received_t; // the time the socket last received data
- time_t last_sent_t; // the time the socket last sent data
-
- size_t recv_count; // the number of times the socket was ready for inbound traffic
- size_t send_count; // the number of times the socket was ready for outbound traffic
-
- uint32_t flags; // internal flags
-
- // callbacks for this socket
- void (*del_callback)(struct pollinfo *pi);
- int (*rcv_callback)(struct pollinfo *pi, short int *events);
- int (*snd_callback)(struct pollinfo *pi, short int *events);
-
- // the user data
- void *data;
-
- // linking of free pollinfo structures
- // for quickly finding the next available
- // this is like a stack, it grows and shrinks
- // (with gaps - lower empty slots are preferred)
- struct pollinfo *next;
-} POLLINFO;
-
-struct poll {
- size_t slots;
- size_t used;
- size_t min;
- size_t max;
-
- size_t limit;
-
- time_t complete_request_timeout;
- time_t idle_timeout;
- time_t checks_every;
-
- time_t timer_milliseconds;
- void *timer_data;
-
- struct pollfd *fds;
- struct pollinfo *inf;
- struct pollinfo *first_free;
-
- SIMPLE_PATTERN *access_list;
- int allow_dns;
-
- void *(*add_callback)(POLLINFO *pi, short int *events, void *data);
- void (*del_callback)(POLLINFO *pi);
- int (*rcv_callback)(POLLINFO *pi, short int *events);
- int (*snd_callback)(POLLINFO *pi, short int *events);
- void (*tmr_callback)(void *timer_data);
-};
-
-#define pollinfo_from_slot(p, slot) (&((p)->inf[(slot)]))
-
-int poll_default_snd_callback(POLLINFO *pi, short int *events);
-int poll_default_rcv_callback(POLLINFO *pi, short int *events);
-void poll_default_del_callback(POLLINFO *pi);
-void *poll_default_add_callback(POLLINFO *pi, short int *events, void *data);
-
-POLLINFO *poll_add_fd(POLLJOB *p
- , int fd
- , int socktype
- , WEB_CLIENT_ACL port_acl
- , uint32_t flags
- , const char *client_ip
- , const char *client_port
- , const char *client_host
- , void *(*add_callback)(POLLINFO *pi, short int *events, void *data)
- , void (*del_callback)(POLLINFO *pi)
- , int (*rcv_callback)(POLLINFO *pi, short int *events)
- , int (*snd_callback)(POLLINFO *pi, short int *events)
- , void *data
-);
-void poll_close_fd(POLLINFO *pi);
-
-void poll_events(LISTEN_SOCKETS *sockets
- , void *(*add_callback)(POLLINFO *pi, short int *events, void *data)
- , void (*del_callback)(POLLINFO *pi)
- , int (*rcv_callback)(POLLINFO *pi, short int *events)
- , int (*snd_callback)(POLLINFO *pi, short int *events)
- , void (*tmr_callback)(void *timer_data)
- , bool (*check_to_stop_callback)(void)
- , SIMPLE_PATTERN *access_list
- , int allow_dns
- , void *data
- , time_t tcp_request_timeout_seconds
- , time_t tcp_idle_timeout_seconds
- , time_t timer_milliseconds
- , void *timer_data
- , size_t max_tcp_sockets
-);
-
-#ifndef INET6_ADDRSTRLEN
-#define INET6_ADDRSTRLEN 46
-#endif
-
-typedef struct socket_peers {
- struct {
- char ip[INET6_ADDRSTRLEN];
- int port;
- } local;
-
- struct {
- char ip[INET6_ADDRSTRLEN];
- int port;
- } peer;
-} SOCKET_PEERS;
-
-SOCKET_PEERS socket_peers(int sock_fd);
-bool ip_to_hostname(const char *ip, char *dst, size_t dst_len);
-
-#endif //NETDATA_SOCKET_H
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-14 12:15:46 +0000