[patch 0/4] Add authentication_timeout - Perdition-users - lists.vergenet.net

List overview All Threads
Download

[patch 0/4] Add authentication_timeout

rpm .spec modification

[ANNOUNCE] perdition 1.18-rc1

Simon Horman

5 Sep 2009 5 Sep '09

6:29 a.m.

This series of patches implements an authentication_timeout configuration option and relegates the existing timeout option to only being used after authentication has occured. As suggested by Christian Balzer.

Reply

Show replies by date

Simon Horman

5 Sep 5 Sep

6:29 a.m.

New subject: [patch 1/4] io: Add error status to io_t

Cc: Christian Balzer <chibi(a)gol.com> Signed-off-by: Simon Horman <horms(a)verge.net.au> Index: perdition/perdition/io.c =================================================================== --- perdition.orig/perdition/io.c 2009-09-05 15:04:30.000000000 +1000 +++ perdition/perdition/io.c 2009-09-05 16:22:03.000000000 +1000 @@ -69,6 +69,7 @@ struct io_t_struct { io_type_t type; __io_data_t data; char *name; + enum io_err err; }; @@ -102,6 +103,8 @@ static io_t *__io_create(const char *nam io->name = NULL; } + io->err = io_err_none; + return(io); } @@ -255,29 +258,29 @@ ssize_t io_write(io_t *io, const void *b case io_type_fd: if((bytes=write(io->data.d_fd->write, buf, count))<0){ VANESSA_LOGGER_DEBUG_ERRNO("write"); - return(-1); + goto err; } - break; + return bytes; #ifdef WITH_SSL_SUPPORT case io_type_ssl: if((bytes=(ssize_t)SSL_write(io->data.d_ssl->ssl, buf, (int)count))<=0){ if(bytes < 0) { __IO_READ_WRITE_SSL_ERROR("SSL_write", io->data.d_ssl->ssl, bytes); + goto err; } - else { - - return(0); - } + else + return 0; } - break; + return bytes; #endif /* WITH_SSL_SUPPORT */ default: VANESSA_LOGGER_DEBUG("unknown io type"); - bytes=-1; - break; + goto err; } - - return(bytes); + +err: + io->err = io_err_other; + return -1; } @@ -299,28 +302,29 @@ ssize_t io_read(io_t *io, void *buf, siz case io_type_fd: if((bytes=read(io->data.d_fd->read, buf, count))<0){ VANESSA_LOGGER_DEBUG_ERRNO("read"); - return(-1); + goto err; } - break; + return bytes; #ifdef WITH_SSL_SUPPORT case io_type_ssl: if((bytes=(ssize_t)SSL_read(io->data.d_ssl->ssl, buf, (int)count))<=0){ if(bytes < 0) { __IO_READ_WRITE_SSL_ERROR("SSL_read", io->data.d_ssl->ssl, bytes); + goto err; } - else { - return(0); - } + else + return 0; } - break; + return bytes; #endif /* WITH_SSL_SUPPORT */ default: VANESSA_LOGGER_DEBUG("unknown io type"); - bytes=-1; - break; + goto err; } - - return(bytes); + +err: + io->err = io_err_other; + return -1; } @@ -334,24 +338,21 @@ ssize_t io_read(io_t *io, void *buf, siz **********************************************************************/ int io_get_rfd(io_t *io){ - int fd; - switch(io->type){ case io_type_fd: - fd=io->data.d_fd->read; - break; + return io->data.d_fd->read; #ifdef WITH_SSL_SUPPORT case io_type_ssl: - fd=io->data.d_ssl->read; - break; + return io->data.d_ssl->read; #endif /* WITH_SSL_SUPPORT */ default: VANESSA_LOGGER_DEBUG("unknown io type"); - fd=-1; - break; + goto err; } - - return(fd); + +err: + io->err = io_err_other; + return -1; } @@ -365,24 +366,21 @@ int io_get_rfd(io_t *io){ **********************************************************************/ int io_get_wfd(io_t *io){ - int fd; - switch(io->type){ case io_type_fd: - fd=io->data.d_fd->write; - break; + return io->data.d_fd->write; #ifdef WITH_SSL_SUPPORT case io_type_ssl: - fd=io->data.d_ssl->write; - break; + return io->data.d_ssl->write; #endif /* WITH_SSL_SUPPORT */ default: VANESSA_LOGGER_DEBUG("unknown io type"); - fd=-1; - break; + goto err; } - - return(fd); + +err: + io->err = io_err_other; + return -1; } @@ -412,6 +410,20 @@ const char *io_get_name(io_t *io){ } +/********************************************************************** + * io_get_err + * Get error status of an io + * pre: io: io_t to get the err of + * post: none + * return: error status of the io + **********************************************************************/ + +enum io_err io_get_err(io_t *io) +{ + return io->err; +} + + #ifdef WITH_SSL_SUPPORT /********************************************************************** * io_get_ssl @@ -431,6 +443,7 @@ SSL *io_get_ssl(io_t *io){ break; default: ssl=NULL; + io->err = io_err_other; break; } @@ -467,11 +480,11 @@ int io_close(io_t *io){ if(close(read_fd)){ VANESSA_LOGGER_DEBUG_ERRNO("close 1"); - return(-1); + goto err; } if(read_fd!=write_fd && close(write_fd)){ VANESSA_LOGGER_DEBUG_ERRNO("close 2 %d %d"); - return(-1); + goto err; } break;; @@ -490,10 +503,14 @@ int io_close(io_t *io){ #endif /* WITH_SSL_SUPPORT */ default: VANESSA_LOGGER_DEBUG("Unknown io type"); - return(-1); + goto err; } return(0); + +err: + io->err = io_err_other; + return -1; } @@ -527,9 +544,11 @@ static int __io_pipe_read(int fd, void * io=io_select_get(s, fd); if(io == NULL) { VANESSA_LOGGER_DEBUG("io_select_get"); - return(-1); + goto err; } + io->err = io_err_none; + bytes = io_read(io, buf, count); if(opt.connection_logging && bytes > 0) { @@ -537,7 +556,7 @@ static int __io_pipe_read(int fd, void * dump_str = VANESSA_LOGGER_DUMP(buf, bytes, 0); if(!dump_str) { VANESSA_LOGGER_DEBUG("VANESSA_LOGGER_DUMP"); - return(-1); + goto err; } VANESSA_LOGGER_LOG_UNSAFE(LOG_DEBUG, "%s \"%s\"", str_null_safe(io_get_name(io)), dump_str); @@ -545,6 +564,11 @@ static int __io_pipe_read(int fd, void * } return(bytes); + +err: + if (io->err == io_err_none) + io->err = io_err_other; + return -1; } @@ -573,7 +597,7 @@ ssize_t io_pipe(io_t *io_a, io_t *io_b, s = io_select_create(); if(s == NULL) { VANESSA_LOGGER_DEBUG("io_select_create"); - return(-1); + goto err; } s->log = log; @@ -581,7 +605,7 @@ ssize_t io_pipe(io_t *io_a, io_t *io_b, if(io_select_add(s, io_a) == NULL || io_select_add(s, io_b) == NULL) { VANESSA_LOGGER_DEBUG("io_select_add"); io_select_destroy(s); - return(-1); + goto err; } if((bytes=vanessa_socket_pipe_func(io_get_rfd(io_a), io_get_wfd(io_a), @@ -589,9 +613,22 @@ ssize_t io_pipe(io_t *io_a, io_t *io_b, idle_timeout, return_a_read_bytes, return_b_read_bytes, __io_pipe_read, __io_pipe_write, io_select, (void *)s))<0){ VANESSA_LOGGER_DEBUG("vanessa_socket_pipe_func"); + if (bytes == 1) { + /* timeout */ + io_a->err = io_err_timeout; + io_b->err = io_err_timeout; + } + goto err; } io_select_destroy(s); return(bytes); + +err: + if (io_a->err != io_err_none && io_b->err != io_err_none) { + io_a->err = io_err_other; + io_b->err = io_err_other; + } + return -1; } Index: perdition/perdition/io.h =================================================================== --- perdition.orig/perdition/io.h 2009-09-05 15:04:30.000000000 +1000 +++ perdition/perdition/io.h 2009-09-05 16:22:03.000000000 +1000 @@ -46,6 +46,11 @@ typedef enum { io_type_none } io_type_t; +enum io_err { + io_err_none, + io_err_other, + io_err_timeout +}; /********************************************************************** * io_create_fd @@ -166,6 +171,17 @@ io_type_t io_get_type(io_t *io); const char *io_get_name(io_t *io); +/********************************************************************** + * io_get_err + * Get error status of an io + * pre: io: io_t to setget the err of + * post: none + * return: error status of the io + **********************************************************************/ + +enum io_err io_get_err(io_t *io); + + #ifdef WITH_SSL_SUPPORT /********************************************************************** * io_get_ssl

Reply

Simon Horman

6:29 a.m.

New subject: [patch 2/4] io: Add timeout parameter to io_read()

Cc: Christian Balzer <chibi(a)gol.com> Signed-off-by: Simon Horman <horms(a)verge.net.au> Index: perdition/perdition/io.c =================================================================== --- perdition.orig/perdition/io.c 2009-09-05 15:47:51.000000000 +1000 +++ perdition/perdition/io.c 2009-09-05 15:56:14.000000000 +1000 @@ -290,12 +290,14 @@ err: * pre: io: io_t to read from * buf: buffer to read * count: maximum number of bytes to read + * timeout: idle timeout in seconds, 0 for no timeout * post: up to count bytes are read from io into buf * return: Number of bytes read * -1 on error **********************************************************************/ -ssize_t io_read(io_t *io, void *buf, size_t count){ +ssize_t __io_read(io_t *io, void *buf, size_t count) +{ ssize_t bytes=0; switch(io->type){ @@ -328,6 +330,98 @@ err: } +ssize_t io_read(io_t *io, void *buf, size_t count, long timeout) +{ + io_select_t *s = NULL; + struct timeval tv; + fd_set except_template; + fd_set read_template; + int bytes_read; + int status; + int return_status = -1; + int rfd; + + io->err = io_err_none; + + rfd = io_get_rfd(io); + if (rfd < 0) { + VANESSA_LOGGER_DEBUG("io_get_rfd"); + goto err; + } + + s = io_select_create(); + if (s == NULL) { + VANESSA_LOGGER_DEBUG("io_select_create"); + goto err; + } + + if (!io_select_add(s, io)) { + VANESSA_LOGGER_DEBUG("io_select_add"); + goto err_free; + } + + while (1) { + FD_ZERO(&read_template); + FD_SET(rfd, &read_template); + FD_ZERO(&except_template); + FD_SET(rfd, &except_template); + tv.tv_sec = timeout; + tv.tv_usec = 0; + + status = io_select(FD_SETSIZE, &read_template, NULL, + &except_template, timeout ? &tv : NULL, s); + if (status < 0) { + if (errno != EINTR) { + VANESSA_LOGGER_DEBUG_ERRNO("select"); + goto err_free; + } + continue; /* Ignore EINTR */ + } + else if (FD_ISSET(rfd, &except_template)){ + VANESSA_LOGGER_DEBUG("error on file descriptor"); + goto err_free; + } + else if (!status) { + VANESSA_LOGGER_DEBUG("idle timeout"); + io->err = io_err_timeout; + goto err_free; + } + + /* If we get this far fd must be ready for reading */ + bytes_read = __io_read(io, buf, count); + if (bytes_read < 0) { + if (errno != EINTR) { + VANESSA_LOGGER_DEBUG_ERRNO("error reading " + "input"); + goto err_free; + } + continue; /* Ignore EINTR */ + } + + break; + } + + return_status = bytes_read; +err_free: + io_select_destroy(s); +err: + if (return_status < 0 && io->err == io_err_none) + io->err = io_err_other; + return return_status; +} + + +/********************************************************************** + * io_get_err + * Get error status of an io + * pre: io: io_t to get the err of + * post: none + * return: error status of the io + **********************************************************************/ + +void io_set_err(io_t *io, enum io_err err); + + /********************************************************************** * io_get_rfd * Get the file descriptor that is being used for reading @@ -549,7 +643,7 @@ static int __io_pipe_read(int fd, void * io->err = io_err_none; - bytes = io_read(io, buf, count); + bytes = __io_read(io, buf, count); if(opt.connection_logging && bytes > 0) { char *dump_str; Index: perdition/perdition/io.h =================================================================== --- perdition.orig/perdition/io.h 2009-09-05 15:47:51.000000000 +1000 +++ perdition/perdition/io.h 2009-09-05 15:56:04.000000000 +1000 @@ -117,12 +117,13 @@ ssize_t io_write(io_t *io, const void *b * pre: io: io_t to read from * buf: buffer to read * count: maximum number of bytes to read + * timeout: idle timeout in seconds, 0 for no timeout * post: up to count bytes are read from io into buf * return: Number of bytes read * -1 on error **********************************************************************/ -ssize_t io_read(io_t *io, void *buf, size_t count); +ssize_t io_read(io_t *io, void *buf, size_t count, long timeout); /********************************************************************** Index: perdition/perdition/token.c =================================================================== --- perdition.orig/perdition/token.c 2009-09-05 15:47:51.000000000 +1000 +++ perdition/perdition/token.c 2009-09-05 15:56:04.000000000 +1000 @@ -215,88 +215,30 @@ static int token_fill_buffer(io_t *io, c static int __token_fill_buffer(io_t *io, const options_t *opt, const char *log_str){ - io_select_t *s = NULL; - struct timeval timeout; - fd_set except_template; - fd_set read_template; - int bytes_read; - int status; - int return_status = -1; - int fd; - - if((fd=io_get_rfd(io))<0){ - VANESSA_LOGGER_DEBUG_UNSAFE("io_get_rfd %d", fd); - return(-1); - } - - s = io_select_create(); - if(s == NULL) { - VANESSA_LOGGER_DEBUG("io_select_create"); - goto leave; - } - - if(io_select_add(s, io) == NULL) { - VANESSA_LOGGER_DEBUG("io_select_add"); - goto leave; - } - - while(1){ - FD_ZERO(&read_template); - FD_SET(fd, &read_template); - FD_ZERO(&except_template); - FD_SET(fd, &except_template); - timeout.tv_sec=opt->timeout; - timeout.tv_usec=0; - - status=io_select( - FD_SETSIZE, - &read_template, - NULL, - &except_template, - opt->timeout?&timeout:NULL, - s - ); - if(status<0){ - if(errno!=EINTR){ - VANESSA_LOGGER_DEBUG_ERRNO("select"); - goto leave; - } - continue; /* Ignore EINTR */ - } - else if(FD_ISSET(fd, &except_template)){ - VANESSA_LOGGER_DEBUG("error on file descriptor"); - goto leave; - } - else if(status==0){ - VANESSA_LOGGER_DEBUG("idle timeout"); - goto leave; - } + int bytes_read; + char *dump_buf; - /*If we get this far fd must be ready for reading*/ - if((bytes_read=io_read( - io, - token_read_buffer, - MAX_LINE_LENGTH-1 - ))<0){ - VANESSA_LOGGER_DEBUG_ERRNO("error reading input"); - goto leave; - } + bytes_read = io_read(io, token_read_buffer, MAX_LINE_LENGTH-1, + opt->timeout); + if (bytes_read < 0) { + VANESSA_LOGGER_DEBUG_ERRNO("error reading input"); + return -1; + } - token_read_offset=0; - token_read_bytes=bytes_read; - if(opt->connection_logging){ - char *dump_buf; - dump_buf = VANESSA_LOGGER_DUMP(token_read_buffer, bytes_read, 0); - VANESSA_LOGGER_DEBUG_RAW_UNSAFE("%s \"%s\"", log_str, dump_buf); - free(dump_buf); - } - break; - } + token_read_offset = 0; + token_read_bytes = bytes_read; + if (opt->connection_logging) { + dump_buf = VANESSA_LOGGER_DUMP(token_read_buffer, + bytes_read, 0); + if (!dump_buf) { + VANESSA_LOGGER_DEBUG("VANESSA_LOGGER_DUMP"); + return -1; + } + VANESSA_LOGGER_DEBUG_RAW_UNSAFE("%s \"%s\"", log_str, dump_buf); + free(dump_buf); + } - return_status = bytes_read; -leave: - io_select_destroy(s); - return(return_status); + return bytes_read; }

Reply

Simon Horman

6:29 a.m.

New subject: [patch 3/4] io: Add timeout to io_t

Cc: Christian Balzer <chibi(a)gol.com> Signed-off-by: Simon Horman <horms(a)verge.net.au> Index: perdition/perdition/io.c =================================================================== --- perdition.orig/perdition/io.c 2009-09-05 15:48:22.000000000 +1000 +++ perdition/perdition/io.c 2009-09-05 15:48:37.000000000 +1000 @@ -31,6 +31,7 @@ #include <unistd.h> #include <stdlib.h> #include <vanessa_socket.h> +#include <limits.h> #include "io.h" #include "io_select.h" @@ -70,6 +71,7 @@ struct io_t_struct { __io_data_t data; char *name; enum io_err err; + long timeout; }; @@ -290,7 +292,6 @@ err: * pre: io: io_t to read from * buf: buffer to read * count: maximum number of bytes to read - * timeout: idle timeout in seconds, 0 for no timeout * post: up to count bytes are read from io into buf * return: Number of bytes read * -1 on error @@ -330,7 +331,7 @@ err: } -ssize_t io_read(io_t *io, void *buf, size_t count, long timeout) +ssize_t io_read(io_t *io, void *buf, size_t count) { io_select_t *s = NULL; struct timeval tv; @@ -365,11 +366,12 @@ ssize_t io_read(io_t *io, void *buf, siz FD_SET(rfd, &read_template); FD_ZERO(&except_template); FD_SET(rfd, &except_template); - tv.tv_sec = timeout; + tv.tv_sec = io->timeout; tv.tv_usec = 0; status = io_select(FD_SETSIZE, &read_template, NULL, - &except_template, timeout ? &tv : NULL, s); + &except_template, io->timeout ? &tv : NULL, + s); if (status < 0) { if (errno != EINTR) { VANESSA_LOGGER_DEBUG_ERRNO("select"); @@ -423,6 +425,35 @@ void io_set_err(io_t *io, enum io_err er /********************************************************************** + * io_get_timoeut + * Get the idle timeout of an io + * pre: io: io_t to get the idle timeout of + * post: none + * return: timeout in seconds + **********************************************************************/ + +long io_get_timeout(io_t *io) +{ + return io->timeout; +} + + +/********************************************************************** + * io_set_timoeut + * Set the idle timeout of an io + * pre: io: io_t to set the idle timeout of + * timeout: timeout in seconds, 0 for no timeout + * post: idle timeout of the io_t is set + * return: none + **********************************************************************/ + +void io_set_timeout(io_t *io, long timeout) +{ + io->timeout = timeout; +} + + +/********************************************************************** * io_get_rfd * Get the file descriptor that is being used for reading * pre: io: io_t to get read file descriptor of @@ -615,17 +646,13 @@ err: * io_b: the other io_t * buffer: allocated buffer to read data into * buffer_length: size of buffer in bytes - * idle_timeout: timeout in seconds to wait for input - * timeout of 0 = infinite timeout * return_a_read_bytes: Pointer to int where number * of bytes read from a will be recorded. * return_b_read_bytes: Pointer to int where number * of bytes read from b will be recorded. * post: bytes are read from io_a and written to io_b and vice versa - * return: -1 on error - * 1 on idle timeout + * return: -1 on error, including idle timeout * 0 otherwise (one of io_a or io_b closes gracefully) - * **********************************************************************/ static int __io_pipe_read(int fd, void *buf, size_t count, void *data){ @@ -683,10 +710,26 @@ static int __io_pipe_write(int fd, const ssize_t io_pipe(io_t *io_a, io_t *io_b, unsigned char *buffer, - int buffer_length, int idle_timeout, int *return_a_read_bytes, + int buffer_length, int *return_a_read_bytes, int *return_b_read_bytes, timed_log_t *log){ int bytes; io_select_t *s; + long timeout; + + if (io_a->timeout && io_b->timeout) + timeout = io_a->timeout < io_b->timeout ? io_a->timeout : + io_b->timeout; + else if (io_a->timeout) + timeout = io_a->timeout; + else if (io_b->timeout) + timeout = io_b->timeout; + else + timeout = 0; + + /* Cap timeout at INT_MAX, as vanessa_socket_pipe_func() takes + * an integer as the timeout argument */ + if (timeout > INT_MAX) + timeout = INT_MAX; s = io_select_create(); if(s == NULL) { @@ -704,7 +747,7 @@ ssize_t io_pipe(io_t *io_a, io_t *io_b, if((bytes=vanessa_socket_pipe_func(io_get_rfd(io_a), io_get_wfd(io_a), io_get_rfd(io_b), io_get_wfd(io_b), buffer, buffer_length, - idle_timeout, return_a_read_bytes, return_b_read_bytes, + timeout, return_a_read_bytes, return_b_read_bytes, __io_pipe_read, __io_pipe_write, io_select, (void *)s))<0){ VANESSA_LOGGER_DEBUG("vanessa_socket_pipe_func"); if (bytes == 1) { Index: perdition/perdition/io.h =================================================================== --- perdition.orig/perdition/io.h 2009-09-05 15:48:01.000000000 +1000 +++ perdition/perdition/io.h 2009-09-05 15:48:37.000000000 +1000 @@ -117,13 +117,12 @@ ssize_t io_write(io_t *io, const void *b * pre: io: io_t to read from * buf: buffer to read * count: maximum number of bytes to read - * timeout: idle timeout in seconds, 0 for no timeout * post: up to count bytes are read from io into buf * return: Number of bytes read * -1 on error **********************************************************************/ -ssize_t io_read(io_t *io, void *buf, size_t count, long timeout); +ssize_t io_read(io_t *io, void *buf, size_t count); /********************************************************************** @@ -183,6 +182,41 @@ const char *io_get_name(io_t *io); enum io_err io_get_err(io_t *io); +/********************************************************************** + * io_get_timoeut + * Get the idle timeout of an io + * pre: io: io_t to get the idle timeout of + * post: none + * return: timeout in seconds + **********************************************************************/ + +long io_get_timeout(io_t *io); + + +/********************************************************************** + * io_set_timoeut + * Set the idle timeout of an io + * pre: io: io_t to set the idle timeout of + * timeout: timeout in seconds, 0 for no timeout + * post: idle timeout of the io_t is set + * return: none + **********************************************************************/ + +void io_set_timeout(io_t *io, long timeout); + + +/********************************************************************** + * io_set_timoeut + * Set the idle timeout of io + * pre: io: io_t to set the idle timeout of + * timeout: timeout in seconds, 0 for no timeout + * post: idle timeout of the io_t is set + * return: none + **********************************************************************/ + +void io_set_timeout(io_t *io, long timeout); + + #ifdef WITH_SSL_SUPPORT /********************************************************************** * io_get_ssl @@ -218,21 +252,17 @@ int io_close(io_t *io); * io_b: the other io_t * buffer: allocated buffer to read data into * buffer_length: size of buffer in bytes - * idle_timeout: timeout in seconds to wait for input - * timeout of 0 = infinite timeout * return_a_read_bytes: Pointer to int where number * of bytes read from a will be recorded. * return_b_read_bytes: Pointer to int where number * of bytes read from b will be recorded. * post: bytes are read from io_a and written to io_b and vice versa - * return: -1 on error - * 1 on idle timeout + * return: -1 on error, including idle timeout * 0 otherwise (one of io_a or io_b closes gracefully) - * **********************************************************************/ ssize_t io_pipe( io_t *io_a, io_t *io_b, unsigned char *buffer, - int buffer_length, int idle_timeout, int *return_a_read_bytes, + int buffer_length, int *return_a_read_bytes, int *return_b_read_bytes, timed_log_t *log); #endif /* _PERDITION_IO_H */ Index: perdition/perdition/perdition.c =================================================================== --- perdition.orig/perdition/perdition.c 2009-09-05 15:47:46.000000000 +1000 +++ perdition/perdition/perdition.c 2009-09-05 15:48:37.000000000 +1000 @@ -577,6 +577,7 @@ int main (int argc, char **argv, char ** VANESSA_LOGGER_ERR("Fatal error setting IO. Exiting."); perdition_exit_cleanly(-1); } + io_set_timeout(client_io, opt.timeout); namelen = sizeof(*peername); if (getpeername(0, (struct sockaddr *)peername, &namelen)) { @@ -611,6 +612,7 @@ int main (int argc, char **argv, char ** VANESSA_LOGGER_ERR("Fatal error setting IO. Exiting."); perdition_exit_cleanly(-1); } + io_set_timeout(client_io, opt.timeout); } /* A child process, or process handling an inetd connection @@ -698,9 +700,15 @@ int main (int argc, char **argv, char ** token_flush(); if(status<0){ VANESSA_LOGGER_DEBUG("protocol->in_get_pw"); - VANESSA_LOGGER_ERR_UNSAFE("Fatal Error reading authentication " - "information from client \"%s\": " - "Exiting child", from_to_host_str); + if (io_get_err(client_io) == io_err_timeout) + VANESSA_LOGGER_ERR_UNSAFE("Fatal Error: Timeout reading " + "authentication information from " + "client \"%s\": Exiting child", + from_to_host_str); + else + VANESSA_LOGGER_ERR_UNSAFE("Fatal Error reading authentication " + "information from client \"%s\": " + "Exiting child", from_to_host_str); perdition_exit_cleanly(-1); } else if(status == 1){ @@ -841,6 +849,7 @@ int main (int argc, char **argv, char ** VANESSA_LOGGER_ERR("Fatal error setting IO. Exiting."); perdition_exit_cleanly(-1); } + io_set_timeout(server_io, opt.timeout); #ifdef WITH_SSL_SUPPORT if(opt.ssl_mode & SSL_MODE_SSL_OUTGOING) { @@ -932,7 +941,11 @@ int main (int argc, char **argv, char ** } else if(status<0){ VANESSA_LOGGER_DEBUG_UNSAFE("protocol->out_authenticate %d", status); - VANESSA_LOGGER_ERR("Fatal error authenticating user. Exiting child."); + if (io_get_err(client_io) == io_err_timeout) + VANESSA_LOGGER_ERR("Fatal error: Timeout authenticating user. " + "Exiting child."); + else + VANESSA_LOGGER_ERR("Fatal error authenticating user. Exiting child."); perdition_exit_cleanly(-1); } @@ -971,10 +984,14 @@ int main (int argc, char **argv, char ** } /*Let the client talk to the real server*/ - if(io_pipe(server_io, client_io, buffer, BUFFER_SIZE, opt.timeout, + if(io_pipe(server_io, client_io, buffer, BUFFER_SIZE, &bytes_written, &bytes_read, &auth_log)<0){ VANESSA_LOGGER_DEBUG("vanessa_socket_pipe"); - VANESSA_LOGGER_ERR("Fatal error piping data. Exiting child."); + if (io_get_err(client_io) == io_err_timeout) + VANESSA_LOGGER_ERR("Fatal error: Timeout piping data. " + "Exiting child."); + else + VANESSA_LOGGER_ERR("Fatal error piping data. Exiting child."); perdition_exit_cleanly(-1); } Index: perdition/perdition/token.c =================================================================== --- perdition.orig/perdition/token.c 2009-09-05 15:48:01.000000000 +1000 +++ perdition/perdition/token.c 2009-09-05 15:48:37.000000000 +1000 @@ -218,8 +218,7 @@ static int __token_fill_buffer(io_t *io, int bytes_read; char *dump_buf; - bytes_read = io_read(io, token_read_buffer, MAX_LINE_LENGTH-1, - opt->timeout); + bytes_read = io_read(io, token_read_buffer, MAX_LINE_LENGTH-1); if (bytes_read < 0) { VANESSA_LOGGER_DEBUG_ERRNO("error reading input"); return -1; Index: perdition/perdition/ssl.c =================================================================== --- perdition.orig/perdition/ssl.c 2009-09-05 15:47:46.000000000 +1000 +++ perdition/perdition/ssl.c 2009-09-05 15:48:37.000000000 +1000 @@ -926,6 +926,7 @@ static io_t *__perdition_ssl_connection( goto bail; } + io_set_timeout(new_io, io_get_timeout(io)); io_destroy(io); io = NULL;

Reply

Simon Horman

6:29 a.m.

New subject: [patch 4/4] io: Add authenticate_timeout configuration option

This separates the pre and post authentication timeouts. Cc: Christian Balzer <chibi(a)gol.com> Signed-off-by: Simon Horman <horms(a)verge.net.au> Index: perdition/perdition/options.c =================================================================== --- perdition.orig/perdition/options.c 2009-09-05 15:02:34.000000000 +1000 +++ perdition/perdition/options.c 2009-09-05 15:58:22.000000000 +1000 @@ -355,6 +355,8 @@ int options(int argc, char **argv, flag_ { {"add_domain", 'A', POPT_ARG_STRING, NULL, 'A'}, {"authenticate_in", 'a', POPT_ARG_NONE, NULL, 'a'}, + {"authenticate_timeout", '\0', POPT_ARG_STRING, NULL, + TAG_AUTHENTICATE_TIMEOUT}, {"no_bind_banner", 'B', POPT_ARG_NONE, NULL, 'B'}, {"bind_address", 'b', POPT_ARG_STRING, NULL, 'b'}, {"connection_logging", 'C', POPT_ARG_NONE, NULL, 'C'}, @@ -444,6 +446,8 @@ int options(int argc, char **argv, flag_ #ifdef WITH_PAM_SUPPORT opt_i(&(opt.authenticate_in), DEFAULT_AUTHENTICATE_IN, &i, 0, OPT_NOT_SET); #endif /* WITH_PAM_SUPPORT */ + opt_i(&(opt.authenticate_timeout), DEFAULT_AUTHENTICATE_TIMEOUT, + &i, 0, OPT_NOT_SET); opt_i(&(opt.no_bind_banner), DEFAULT_NO_BIND_BANNER, &i, 0, OPT_NOT_SET); opt_i(&(opt.client_server_specification), @@ -586,7 +590,13 @@ int options(int argc, char **argv, flag_ poptFreeContext(context); return(-1); } -#endif /* WITH_PAM_SUPPORT */ +#endif + case TAG_AUTHENTICATE_TIMEOUT: + if(!vanessa_socket_str_is_digit(optarg) && f&OPT_ERR) + usage(-1); + opt_i(&(opt.authenticate_timeout), atoi(optarg), &(opt.mask2), + MASK2_AUTHENTICATE_TIMEOUT, f); + break; case 'B': opt_i(&(opt.no_bind_banner), 1, &(opt.mask), MASK_NO_BIND_BANNER, f); break; @@ -1094,6 +1104,7 @@ int log_options_str(char *str, size_t n) #ifdef WITH_PAM_SUPPORT "authenticate_in=%s, " #endif /* WITH_PAM_SUPPORT */ + "authenticate_timeout=%d, " "bind_address=\"%s\", " "capability=\"%s\", " "client_server_specification=%s, " @@ -1151,6 +1162,7 @@ int log_options_str(char *str, size_t n) #ifdef WITH_PAM_SUPPORT BIN_OPT_STR(opt.authenticate_in), #endif /* WITH_PAM_SUPPORT */ + opt.authenticate_timeout, OPT_STR(bind_address), OPT_STR(opt.capability), BIN_OPT_STR(opt.client_server_specification), @@ -1298,6 +1310,9 @@ void usage(int exit_status){ " -a|--authenticate_in:\n" " User is authenticated by perdition before connection to real-server.\n" #endif /* WITH_PAM_SUPPORT */ + " --authenticate_timeout:\n" + " Timeout used during authentication phase.\n" + " Zero for infinite timeout. (default %d)\n" " -B|--no_bind_banner:\n" " Use uname to generate banner of even if bind_address is in effect.\n" " -b|--bind_address SERVER[,SERVER...]:\n" @@ -1379,7 +1394,8 @@ void usage(int exit_status){ " Allow domain portion of username to be striped in given state(s).\n" " (default \"\")\n" " -t|--timeout SECONDS:\n" - " Idle timeout. Zero for infinite timeout. (default %d)\n" + " Idle timeout for post-authentication phase.\n" + " Zero for infinite timeout. (default %d)\n" " -u|--username USERNAME:\n" " User to run as. (default \"%s\")\n" " -U|--username_from_database:\n" @@ -1451,6 +1467,7 @@ void usage(int exit_status){ " be used unless noted otherwise.\n" " See the perdition(8) man page for more details.\n", VERSION, + DEFAULT_AUTHENTICATE_TIMEOUT, OPT_STR(DEFAULT_BIND_ADDRESS), DEFAULT_CONNECT_RELOG, OPT_STR(DEFAULT_DOMAIN_DELIMITER), Index: perdition/perdition/options.h =================================================================== --- perdition.orig/perdition/options.h 2009-09-05 15:02:34.000000000 +1000 +++ perdition/perdition/options.h 2009-09-05 15:58:22.000000000 +1000 @@ -139,6 +139,7 @@ #define DEFAULT_STRIP_DOMAIN STATE_NONE #define DEFAULT_SERVER_RESP_LINE 0 #define DEFAULT_TIMEOUT 1800 /*in seconds*/ +#define DEFAULT_AUTHENTICATE_TIMEOUT DEFAULT_TIMEOUT #ifdef WITH_USER #define DEFAULT_USERNAME WITH_USER #else @@ -179,6 +180,7 @@ typedef struct { unsigned int add_domain_strip_depth; #ifdef WITH_PAM_SUPPORT int authenticate_in; + int authenticate_timeout; #endif /* WITH_PAM_SUPPORT */ vanessa_dynamic_array_t *bind_address; char *capability; @@ -277,6 +279,7 @@ typedef struct { #define MASK2_PID_FILE (flag_t) 0x00000002 #define MASK2_EXPLICIT_DOMAIN (flag_t) 0x00000004 #define MASK2_LOG_PASSWD (flag_t) 0x00000008 +#define MASK2_AUTHENTICATE_TIMEOUT (flag_t) 0x00000010 #ifdef WITH_SSL_SUPPORT /* options_t.ssl_mask entries */ @@ -325,6 +328,7 @@ typedef struct { #define TAG_SSL_OUTGOING_CIPHERS (int) 147 #define TAG_SSL_NO_CERT_VERIFY (int) 148 #define TAG_SSL_NO_CN_VERIFY (int) 149 +#define TAG_AUTHENTICATE_TIMEOUT (int) 150 /*Flag values for options()*/ Index: perdition/perdition/perdition.8 =================================================================== --- perdition.orig/perdition/perdition.8 2009-09-05 15:02:34.000000000 +1000 +++ perdition/perdition/perdition.8 2009-09-05 15:58:22.000000000 +1000 @@ -103,6 +103,10 @@ e.g. all,2 .sp (the default value for add_domain is "") .TP +.B \-\-authenticate_timeout: +Idle timeout in seconds used while the user is unauthenticated. Zero for +infinite timeout. +.TP .B \-a, \-\-authenticate_in: User is authenticated by perdition before connection to back-end server is made. Only available if perdition is compiled with pam @@ -352,7 +356,7 @@ will be striped off in given state(s).Se description of the states. .TP .B \-t, \-\-timeout SECONDS: -Idle timeout. Zero for infinite timeout. +Idle timeout for post-authentication phase. Zero for infinite timeout. .br (default 1800) .TP @@ -672,11 +676,14 @@ POP3 user james(a)other.host .fi .SH IDLE TIMEOUTS -If there is no input from the client or back\-end server for greater than -timeout seconds then the connection is closed. The default timeout is 1800 -seconds and can be specified on the command line with the \-t|\-\-timeout -option. A time out of 0 means that timeouts are disabled and clients and -back\-end servers can idle indefinitely. +Perdition allows two idle timeouts to be configured. \-\-authentication_timeout +is used before the user has been successfully authenticated with the +back-end server. And after that \-\-timeout is used. + +The default value for both timeouts is is 1800. +A timeout value of 0 means that the timeouts are disabled and clients and +back\-end servers can idle indefinitely, though in practice a TCP timeout +will be in effect. .SH LOOP DETECTION The greeting that perdition displays when accepting an incoming connection is "+OK POP3 Ready <hostname>" or "* OK IMAP4 Ready <hostname>" in POP3 and Index: perdition/perdition/perdition.c =================================================================== --- perdition.orig/perdition/perdition.c 2009-09-05 15:58:26.000000000 +1000 +++ perdition/perdition/perdition.c 2009-09-05 16:00:54.000000000 +1000 @@ -577,7 +577,7 @@ int main (int argc, char **argv, char ** VANESSA_LOGGER_ERR("Fatal error setting IO. Exiting."); perdition_exit_cleanly(-1); } - io_set_timeout(client_io, opt.timeout); + io_set_timeout(client_io, opt.authenticate_timeout); namelen = sizeof(*peername); if (getpeername(0, (struct sockaddr *)peername, &namelen)) { @@ -612,7 +612,7 @@ int main (int argc, char **argv, char ** VANESSA_LOGGER_ERR("Fatal error setting IO. Exiting."); perdition_exit_cleanly(-1); } - io_set_timeout(client_io, opt.timeout); + io_set_timeout(client_io, opt.authenticate_timeout); } /* A child process, or process handling an inetd connection @@ -849,7 +849,7 @@ int main (int argc, char **argv, char ** VANESSA_LOGGER_ERR("Fatal error setting IO. Exiting."); perdition_exit_cleanly(-1); } - io_set_timeout(server_io, opt.timeout); + io_set_timeout(server_io, opt.authenticate_timeout); #ifdef WITH_SSL_SUPPORT if(opt.ssl_mode & SSL_MODE_SSL_OUTGOING) { @@ -984,6 +984,8 @@ int main (int argc, char **argv, char ** } /*Let the client talk to the real server*/ + io_set_timeout(client_io, opt.timeout); + io_set_timeout(server_io, opt.timeout); if(io_pipe(server_io, client_io, buffer, BUFFER_SIZE, &bytes_written, &bytes_read, &auth_log)<0){ VANESSA_LOGGER_DEBUG("vanessa_socket_pipe");

Reply

5351

days inactive

5351

days old

perdition-users@vergenet.net

Manage subscription

4 comments

1 participants

tags (0)

participants (1)

Simon Horman