From 52d34a70a21d4e6d019d3a94bb84448051f87c29 Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Sun, 28 Sep 2014 22:32:20 -0400 Subject: [PATCH] fwknopd man page updates, added UDPSERV_SELECT_TIMEOUT config option --- configure.ac | 4 ++-- doc/fwknopd.man.asciidoc | 29 +++++++++++++++++++++-------- server/cmd_opts.h | 1 + server/config_init.c | 8 ++++++++ server/fwknopd_common.h | 3 +++ server/udp_server.c | 12 ++++++++++-- 6 files changed, 45 insertions(+), 12 deletions(-) diff --git a/configure.ac b/configure.ac index 20cb80dc..055316dd 100644 --- a/configure.ac +++ b/configure.ac @@ -169,8 +169,8 @@ fi dnl Decide whether or not to enable UDP listener mode (no libpcap dependency) dnl want_udp_listener=no -AC_ARG_ENABLE([udp-listener], - [AS_HELP_STRING([--enable-udp-listener], +AC_ARG_ENABLE([udp-server], + [AS_HELP_STRING([--enable-udp-server], [Enable UDP listener mode (no libpcap dependency) @<:@default is to disable@:>@])], [want_udp_listener=$enableval], []) diff --git a/doc/fwknopd.man.asciidoc b/doc/fwknopd.man.asciidoc index f9d57010..07f00d1f 100644 --- a/doc/fwknopd.man.asciidoc +++ b/doc/fwknopd.man.asciidoc @@ -308,14 +308,14 @@ See the '@sysconfdir@/fwknop/fwknopd.conf'' file for the full list and correspon *ENABLE_TCP_SERVER* '':: Enable the fwknopd TCP server. This is a "dummy" TCP server that will - accept TCP connection requests on the specified TCPSERV_PORT. - If set to "Y", fwknopd will fork off a child process to listen for, and - accept incoming TCP request. This server only accepts the - request. It does not otherwise communicate. This is only to allow the - incoming SPA over TCP packet which is detected via PCAP. The connection - is closed after 1 second regardless. - Note that fwknopd still only gets its data via pcap, so the filter - defined by PCAP_FILTER needs to be updated to include this TCP port. + accept TCP connection requests on the specified TCPSERV_PORT. + If set to "Y", fwknopd will fork off a child process to listen for, and + accept incoming TCP request. This server only accepts the + request. It does not otherwise communicate. This is only to allow the + incoming SPA over TCP packet which is detected via PCAP. The connection + is closed after 1 second regardless. + Note that fwknopd still only gets its data via pcap, so the filter + defined by PCAP_FILTER needs to be updated to include this TCP port. *PCAP_DISPATCH_COUNT* '':: Sets the number of packets that are processed when the *pcap_dispatch()* @@ -346,6 +346,19 @@ See the '@sysconfdir@/fwknop/fwknopd.conf'' file for the full list and correspon Set the port number that the ``dummy'' TCP server listens on. This server is only spawned when ``ENABLE_TCP_SERVER'' is set to ``Y''. +*ENABLE_UDP_SERVER* '':: + Enable the *fwknopd* UDP server. This enables *fwknopd* to acquire SPA + packets via a UDP socket directly without having to use libpcap. When this + mode is enabled, *fwknop* should be compiled with *--enable-udp-server* + (passed to the *configure* script) so that libpcap can be removed as a + dependency. As one would expect, when the UDP server is used, no incoming + packets are ever acknowledged by *fwknopd* and therefore collecting SPA + packets in this mode is a good alternative to sniffing the wire directly. + +*UDPSERV_PORT* '':: + Set the port number that the UDP server listens on. This server + is only spawned when ``ENABLE_UDP_SERVER'' is set to ``Y''. + *SYSLOG_IDENTITY* '':: Override syslog identity on message logged by *fwknopd*. The defaults are usually ok. diff --git a/server/cmd_opts.h b/server/cmd_opts.h index b432d50e..f4cd7833 100644 --- a/server/cmd_opts.h +++ b/server/cmd_opts.h @@ -59,6 +59,7 @@ static char *config_map[NUMBER_OF_CONFIG_ENTRIES] = { "TCPSERV_PORT", "ENABLE_UDP_SERVER", "UDPSERV_PORT", + "UDPSERV_SELECT_TIMEOUT", "LOCALE", "SYSLOG_IDENTITY", "SYSLOG_FACILITY", diff --git a/server/config_init.c b/server/config_init.c index 7ee64c4a..9fc0e446 100644 --- a/server/config_init.c +++ b/server/config_init.c @@ -153,6 +153,8 @@ validate_int_var_ranges(fko_srv_options_t *opts) 1, RCHK_MAX_TCPSERV_PORT); range_check(opts, "UDPSERV_PORT", opts->config[CONF_UDPSERV_PORT], 1, RCHK_MAX_UDPSERV_PORT); + range_check(opts, "UDPSERV_PORT", opts->config[CONF_UDPSERV_SELECT_TIMEOUT], + 1, RCHK_MAX_UDPSERV_SELECT_TIMEOUT); #if FIREWALL_IPFW range_check(opts, "IPFW_START_RULE_NUM", opts->config[CONF_IPFW_START_RULE_NUM], @@ -820,6 +822,12 @@ validate_options(fko_srv_options_t *opts) if(opts->config[CONF_UDPSERV_PORT] == NULL) set_config_entry(opts, CONF_UDPSERV_PORT, DEF_UDPSERV_PORT); + /* UDP server select() timeout in microseconds + */ + if(opts->config[CONF_UDPSERV_SELECT_TIMEOUT] == NULL) + set_config_entry(opts, CONF_UDPSERV_SELECT_TIMEOUT, + DEF_UDPSERV_SELECT_TIMEOUT); + /* Syslog identity. */ if(opts->config[CONF_SYSLOG_IDENTITY] == NULL) diff --git a/server/fwknopd_common.h b/server/fwknopd_common.h index c3d11602..fd0636c0 100644 --- a/server/fwknopd_common.h +++ b/server/fwknopd_common.h @@ -103,6 +103,7 @@ #define DEF_TCPSERV_PORT "62201" #define DEF_ENABLE_UDP_SERVER "N" #define DEF_UDPSERV_PORT "62201" +#define DEF_UDPSERV_SELECT_TIMEOUT "500000" /* half a second (in microseconds) */ #define DEF_SYSLOG_IDENTITY MY_NAME #define DEF_SYSLOG_FACILITY "LOG_DAEMON" @@ -115,6 +116,7 @@ #define RCHK_MAX_SNIFF_BYTES (2 << 14) #define RCHK_MAX_TCPSERV_PORT ((2 << 16) - 1) #define RCHK_MAX_UDPSERV_PORT ((2 << 16) - 1) +#define RCHK_MAX_UDPSERV_SELECT_TIMEOUT (2 << 22) #define RCHK_MAX_PCAP_DISPATCH_COUNT (2 << 22) #define RCHK_MAX_FW_TIMEOUT (2 << 22) @@ -230,6 +232,7 @@ enum { CONF_TCPSERV_PORT, CONF_ENABLE_UDP_SERVER, CONF_UDPSERV_PORT, + CONF_UDPSERV_SELECT_TIMEOUT, CONF_LOCALE, CONF_SYSLOG_IDENTITY, CONF_SYSLOG_FACILITY, diff --git a/server/udp_server.c b/server/udp_server.c index 89af5308..3dde17be 100644 --- a/server/udp_server.c +++ b/server/udp_server.c @@ -53,7 +53,7 @@ int run_udp_server(fko_srv_options_t *opts) { int s_sock, sfd_flags, selval, pkt_len; - int is_err; + int is_err, s_timeout; fd_set sfd_set; struct sockaddr_in saddr, caddr; struct timeval tv; @@ -69,6 +69,14 @@ run_udp_server(fko_srv_options_t *opts) log_msg(LOG_ERR, "[*] Invalid max UDPSERV_PORT value."); return -1; } + s_timeout = strtol_wrapper(opts->config[CONF_UDPSERV_SELECT_TIMEOUT], + 1, RCHK_MAX_UDPSERV_SELECT_TIMEOUT, NO_EXIT_UPON_ERR, &is_err); + if(is_err != FKO_SUCCESS) + { + log_msg(LOG_ERR, "[*] Invalid max UDPSERV_SELECT_TIMEOUT value."); + return -1; + } + log_msg(LOG_INFO, "Kicking off UDP server to listen on port %i.", port); /* Now, let's make a UDP server @@ -146,7 +154,7 @@ run_udp_server(fko_srv_options_t *opts) /* Set our select timeout to (500ms by default). */ tv.tv_sec = 0; - tv.tv_usec = 500000; + tv.tv_usec = s_timeout; selval = select(s_sock+1, &sfd_set, NULL, NULL, &tv);