DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

fwknopd man page updates, added UDPSERV_SELECT_TIMEOUT config option

Browse Source
This commit is contained in:
Michael Rash
2014-09-28 22:32:20 -04:00
parent 52c9d51d7d
commit 52d34a70a2
6 changed files with 45 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configure.ac
+2 -2
View File
@@ -169,8 +169,8 @@ fi
dnl Decide whether or not to enable UDP listener mode (no libpcap dependency)
dnl
want_udp_listener=no
AC_ARG_ENABLE([udp-listener],
[AS_HELP_STRING([--enable-udp-listener],
AC_ARG_ENABLE([udp-server],
[AS_HELP_STRING([--enable-udp-server],
[Enable UDP listener mode (no libpcap dependency) @<:@default is to disable@:>@])],
[want_udp_listener=$enableval],
[])
doc/fwknopd.man.asciidoc
+21 -8
View File
@@ -308,14 +308,14 @@ See the '@sysconfdir@/fwknop/fwknopd.conf'' file for the full list and correspon
*ENABLE_TCP_SERVER* '<Y/N>'::
Enable the fwknopd TCP server. This is a "dummy" TCP server that will
accept TCP connection requests on the specified TCPSERV_PORT.
If set to "Y", fwknopd will fork off a child process to listen for, and
accept incoming TCP request. This server only accepts the
request. It does not otherwise communicate. This is only to allow the
incoming SPA over TCP packet which is detected via PCAP. The connection
is closed after 1 second regardless.
Note that fwknopd still only gets its data via pcap, so the filter
defined by PCAP_FILTER needs to be updated to include this TCP port.
accept TCP connection requests on the specified TCPSERV_PORT.
If set to "Y", fwknopd will fork off a child process to listen for, and
accept incoming TCP request. This server only accepts the
request. It does not otherwise communicate. This is only to allow the
incoming SPA over TCP packet which is detected via PCAP. The connection
is closed after 1 second regardless.
Note that fwknopd still only gets its data via pcap, so the filter
defined by PCAP_FILTER needs to be updated to include this TCP port.
*PCAP_DISPATCH_COUNT* '<count>'::
Sets the number of packets that are processed when the *pcap_dispatch()*
@@ -346,6 +346,19 @@ See the '@sysconfdir@/fwknop/fwknopd.conf'' file for the full list and correspon
Set the port number that the ``dummy'' TCP server listens on. This server
is only spawned when ``ENABLE_TCP_SERVER'' is set to ``Y''.
*ENABLE_UDP_SERVER* '<Y/N>'::
Enable the *fwknopd* UDP server. This enables *fwknopd* to acquire SPA
packets via a UDP socket directly without having to use libpcap. When this
mode is enabled, *fwknop* should be compiled with *--enable-udp-server*
(passed to the *configure* script) so that libpcap can be removed as a
dependency. As one would expect, when the UDP server is used, no incoming
packets are ever acknowledged by *fwknopd* and therefore collecting SPA
packets in this mode is a good alternative to sniffing the wire directly.
*UDPSERV_PORT* '<port>'::
Set the port number that the UDP server listens on. This server
is only spawned when ``ENABLE_UDP_SERVER'' is set to ``Y''.
*SYSLOG_IDENTITY* '<identity>'::
Override syslog identity on message logged by *fwknopd*. The defaults
are usually ok.
server/cmd_opts.h
+1
View File
@@ -59,6 +59,7 @@ static char *config_map[NUMBER_OF_CONFIG_ENTRIES] = {
"TCPSERV_PORT",
"ENABLE_UDP_SERVER",
"UDPSERV_PORT",
"UDPSERV_SELECT_TIMEOUT",
"LOCALE",
"SYSLOG_IDENTITY",
"SYSLOG_FACILITY",
server/config_init.c
+8
View File
@@ -153,6 +153,8 @@ validate_int_var_ranges(fko_srv_options_t *opts)
1, RCHK_MAX_TCPSERV_PORT);
range_check(opts, "UDPSERV_PORT", opts->config[CONF_UDPSERV_PORT],
1, RCHK_MAX_UDPSERV_PORT);
range_check(opts, "UDPSERV_PORT", opts->config[CONF_UDPSERV_SELECT_TIMEOUT],
1, RCHK_MAX_UDPSERV_SELECT_TIMEOUT);
#if FIREWALL_IPFW
range_check(opts, "IPFW_START_RULE_NUM", opts->config[CONF_IPFW_START_RULE_NUM],
@@ -820,6 +822,12 @@ validate_options(fko_srv_options_t *opts)
if(opts->config[CONF_UDPSERV_PORT] == NULL)
set_config_entry(opts, CONF_UDPSERV_PORT, DEF_UDPSERV_PORT);
/* UDP server select() timeout in microseconds
*/
if(opts->config[CONF_UDPSERV_SELECT_TIMEOUT] == NULL)
set_config_entry(opts, CONF_UDPSERV_SELECT_TIMEOUT,
DEF_UDPSERV_SELECT_TIMEOUT);
/* Syslog identity.
*/
if(opts->config[CONF_SYSLOG_IDENTITY] == NULL)
server/fwknopd_common.h
+3
View File
@@ -103,6 +103,7 @@
#define DEF_TCPSERV_PORT "62201"
#define DEF_ENABLE_UDP_SERVER "N"
#define DEF_UDPSERV_PORT "62201"
#define DEF_UDPSERV_SELECT_TIMEOUT "500000" /* half a second (in microseconds) */
#define DEF_SYSLOG_IDENTITY MY_NAME
#define DEF_SYSLOG_FACILITY "LOG_DAEMON"
@@ -115,6 +116,7 @@
#define RCHK_MAX_SNIFF_BYTES (2 << 14)
#define RCHK_MAX_TCPSERV_PORT ((2 << 16) - 1)
#define RCHK_MAX_UDPSERV_PORT ((2 << 16) - 1)
#define RCHK_MAX_UDPSERV_SELECT_TIMEOUT (2 << 22)
#define RCHK_MAX_PCAP_DISPATCH_COUNT (2 << 22)
#define RCHK_MAX_FW_TIMEOUT (2 << 22)
@@ -230,6 +232,7 @@ enum {
CONF_TCPSERV_PORT,
CONF_ENABLE_UDP_SERVER,
CONF_UDPSERV_PORT,
CONF_UDPSERV_SELECT_TIMEOUT,
CONF_LOCALE,
CONF_SYSLOG_IDENTITY,
CONF_SYSLOG_FACILITY,
server/udp_server.c
+10 -2
View File
@@ -53,7 +53,7 @@ int
run_udp_server(fko_srv_options_t *opts)
{
int s_sock, sfd_flags, selval, pkt_len;
int is_err;
int is_err, s_timeout;
fd_set sfd_set;
struct sockaddr_in saddr, caddr;
struct timeval tv;
@@ -69,6 +69,14 @@ run_udp_server(fko_srv_options_t *opts)
log_msg(LOG_ERR, "[*] Invalid max UDPSERV_PORT value.");
return -1;
}
s_timeout = strtol_wrapper(opts->config[CONF_UDPSERV_SELECT_TIMEOUT],
1, RCHK_MAX_UDPSERV_SELECT_TIMEOUT, NO_EXIT_UPON_ERR, &is_err);
if(is_err != FKO_SUCCESS)
{
log_msg(LOG_ERR, "[*] Invalid max UDPSERV_SELECT_TIMEOUT value.");
return -1;
}
log_msg(LOG_INFO, "Kicking off UDP server to listen on port %i.", port);
/* Now, let's make a UDP server
@@ -146,7 +154,7 @@ run_udp_server(fko_srv_options_t *opts)
/* Set our select timeout to (500ms by default).
*/
tv.tv_sec = 0;
tv.tv_usec = 500000;
tv.tv_usec = s_timeout;
selval = select(s_sock+1, &sfd_set, NULL, NULL, &tv);