ubus/ubusd.h

104 lines
2.8 KiB
C
Raw Normal View History

2011-06-17 16:35:11 +02:00
/*
* Copyright (C) 2011-2014 Felix Fietkau <nbd@openwrt.org>
2011-06-17 16:35:11 +02:00
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License version 2.1
* as published by the Free Software Foundation
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*/
2010-12-06 03:51:58 +01:00
#ifndef __UBUSD_H
#define __UBUSD_H
#include <libubox/list.h>
#include <libubox/uloop.h>
#include <libubox/blobmsg.h>
#include "ubus_common.h"
#include "ubusd_id.h"
#include "ubusd_obj.h"
#include "ubusmsg.h"
#include "ubusd_acl.h"
2010-12-06 03:51:58 +01:00
#define UBUS_OBJ_HASH_BITS 4
#define UBUS_CLIENT_MAX_TXQ_LEN UBUS_MAX_MSGLEN
2010-12-06 03:51:58 +01:00
extern struct blob_buf b;
2010-12-06 03:51:58 +01:00
struct ubus_msg_buf {
uint32_t refcount; /* ~0: uses external data buffer */
struct ubus_msghdr hdr;
struct blob_attr *data;
int fd;
2010-12-06 03:51:58 +01:00
int len;
};
ubusd: convert tx_queue to linked list ubusd maintains a per-client tx_queue containing references to message buffers that have not been sent yet (due to the socket blocking). This is a fixed-size, 64-element queue. When more than 64 elements are queued, subsequent elements are simply dropped. Thus, a client that is waiting for those messages will block indefinitely. In particular, this happens when more than +- 250 objects are registered on the bus and either "ubus list" or "ubus wait_for" is called. The responses to these requests consist of a message buffer per object. Since in practice, ubusd will not yield between the sends of these message buffers, the client has no time to process them and eventually the output socket blocks. After 64 more objects, the rest is dropped, including the final message that indicates termination. Thus, the client waits indefinitely for the termination message. To solve this, turn the tx_queue into a variable-sized linked list instead of a fixed-size queue. To maintain the linked list, an additional structure ubus_msg_buf_list is created. It is not possible to add the linked list to ubus_msg_buf, because that is shared between clients. Note that this infinite tx_queue opens the door to a DoS attack. You can open a client and a server connection, then send messages from the client to the server without ever reading anything on the server side. This will eventually lead to an out-of-memory. However, such a DoS already existed anyway, it just requires opening multiple server connections and filling up the fixed-size queue on each one. To protect against such DoS attacks, we'd need to: - keep a global maximum queue size that applies to all rx and tx queues together; - stop reading from any connection when the maximum is reached; - close any connection when it hasn't become writeable after some timeout. Fixes: https://bugs.openwrt.org/index.php?do=details&task_id=1525 Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-03-25 22:45:01 +01:00
struct ubus_msg_buf_list {
struct list_head list;
struct ubus_msg_buf *msg;
};
2010-12-06 03:51:58 +01:00
struct ubus_client {
struct ubus_id id;
struct uloop_fd sock;
struct blob_buf b;
2010-12-06 03:51:58 +01:00
uid_t uid;
gid_t gid;
char *user;
char *group;
2011-02-05 20:50:08 +01:00
struct list_head objects;
ubusd: convert tx_queue to linked list ubusd maintains a per-client tx_queue containing references to message buffers that have not been sent yet (due to the socket blocking). This is a fixed-size, 64-element queue. When more than 64 elements are queued, subsequent elements are simply dropped. Thus, a client that is waiting for those messages will block indefinitely. In particular, this happens when more than +- 250 objects are registered on the bus and either "ubus list" or "ubus wait_for" is called. The responses to these requests consist of a message buffer per object. Since in practice, ubusd will not yield between the sends of these message buffers, the client has no time to process them and eventually the output socket blocks. After 64 more objects, the rest is dropped, including the final message that indicates termination. Thus, the client waits indefinitely for the termination message. To solve this, turn the tx_queue into a variable-sized linked list instead of a fixed-size queue. To maintain the linked list, an additional structure ubus_msg_buf_list is created. It is not possible to add the linked list to ubus_msg_buf, because that is shared between clients. Note that this infinite tx_queue opens the door to a DoS attack. You can open a client and a server connection, then send messages from the client to the server without ever reading anything on the server side. This will eventually lead to an out-of-memory. However, such a DoS already existed anyway, it just requires opening multiple server connections and filling up the fixed-size queue on each one. To protect against such DoS attacks, we'd need to: - keep a global maximum queue size that applies to all rx and tx queues together; - stop reading from any connection when the maximum is reached; - close any connection when it hasn't become writeable after some timeout. Fixes: https://bugs.openwrt.org/index.php?do=details&task_id=1525 Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-03-25 22:45:01 +01:00
struct list_head tx_queue;
unsigned int txq_ofs;
unsigned int txq_len;
2011-02-05 20:50:08 +01:00
struct ubus_msg_buf *pending_msg;
struct ubus_msg_buf *retmsg;
2011-02-05 20:50:08 +01:00
int pending_msg_offset;
int pending_msg_fd;
2010-12-06 03:51:58 +01:00
struct {
struct ubus_msghdr hdr;
struct blob_attr data;
} hdrbuf;
};
struct ubus_path {
struct list_head list;
const char name[];
};
extern const char *ubusd_acl_dir;
2010-12-06 03:51:58 +01:00
struct ubus_msg_buf *ubus_msg_new(void *data, int len, bool shared);
void ubus_msg_send(struct ubus_client *cl, struct ubus_msg_buf *ub);
ssize_t ubus_msg_writev(int fd, struct ubus_msg_buf *ub, size_t offset);
2010-12-06 03:51:58 +01:00
void ubus_msg_free(struct ubus_msg_buf *ub);
ubusd: convert tx_queue to linked list ubusd maintains a per-client tx_queue containing references to message buffers that have not been sent yet (due to the socket blocking). This is a fixed-size, 64-element queue. When more than 64 elements are queued, subsequent elements are simply dropped. Thus, a client that is waiting for those messages will block indefinitely. In particular, this happens when more than +- 250 objects are registered on the bus and either "ubus list" or "ubus wait_for" is called. The responses to these requests consist of a message buffer per object. Since in practice, ubusd will not yield between the sends of these message buffers, the client has no time to process them and eventually the output socket blocks. After 64 more objects, the rest is dropped, including the final message that indicates termination. Thus, the client waits indefinitely for the termination message. To solve this, turn the tx_queue into a variable-sized linked list instead of a fixed-size queue. To maintain the linked list, an additional structure ubus_msg_buf_list is created. It is not possible to add the linked list to ubus_msg_buf, because that is shared between clients. Note that this infinite tx_queue opens the door to a DoS attack. You can open a client and a server connection, then send messages from the client to the server without ever reading anything on the server side. This will eventually lead to an out-of-memory. However, such a DoS already existed anyway, it just requires opening multiple server connections and filling up the fixed-size queue on each one. To protect against such DoS attacks, we'd need to: - keep a global maximum queue size that applies to all rx and tx queues together; - stop reading from any connection when the maximum is reached; - close any connection when it hasn't become writeable after some timeout. Fixes: https://bugs.openwrt.org/index.php?do=details&task_id=1525 Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-03-25 22:45:01 +01:00
void ubus_msg_list_free(struct ubus_msg_buf_list *ubl);
struct blob_attr **ubus_parse_msg(struct blob_attr *msg, size_t len);
2010-12-06 03:51:58 +01:00
struct ubus_client *ubusd_proto_new_client(int fd, uloop_fd_handler cb);
void ubusd_proto_receive_message(struct ubus_client *cl, struct ubus_msg_buf *ub);
void ubusd_proto_free_client(struct ubus_client *cl);
void ubus_proto_send_msg_from_blob(struct ubus_client *cl, struct ubus_msg_buf *ub,
uint8_t type);
2010-12-06 03:51:58 +01:00
typedef struct ubus_msg_buf *(*event_fill_cb)(void *priv, const char *id);
void ubusd_event_init(void);
void ubusd_event_cleanup_object(struct ubus_object *obj);
void ubusd_send_obj_event(struct ubus_object *obj, bool add);
int ubusd_send_event(struct ubus_client *cl, const char *id,
event_fill_cb fill_cb, void *cb_priv);
void ubusd_acl_init(void);
2010-12-06 03:51:58 +01:00
void ubusd_monitor_init(void);
void ubusd_monitor_message(struct ubus_client *cl, struct ubus_msg_buf *ub, bool send);
void ubusd_monitor_disconnect(struct ubus_client *cl);
2010-12-06 03:51:58 +01:00
#endif