diff options
| -rwxr-xr-x | PICA_node.c | 39 | ||||
| -rwxr-xr-x | PICA_nodeaddrlist.c | 25 | ||||
| -rwxr-xr-x | PICA_nodeaddrlist.h | 2 | ||||
| -rw-r--r-- | PICA_nodeconfig.c | 1 | ||||
| -rw-r--r-- | PICA_nodeconfig.h | 2 | ||||
| -rw-r--r-- | pica-node.conf | 7 | ||||
| -rw-r--r-- | pica-node.conf.5 | 5 |
7 files changed, 76 insertions, 5 deletions
diff --git a/PICA_node.c b/PICA_node.c index 22e9f07..62dde61 100755 --- a/PICA_node.c +++ b/PICA_node.c @@ -635,10 +635,18 @@ switch (buf[0]) if (nodelink_search_by_ipv4addr(na_ipv4.addr, na_ipv4.port)) //connection with this node is already established { - PICA_debug3("disconnecting node %.16s:%hu - connection with this node is already established", inet_ntoa(*(struct in_addr*)&na_ipv4.addr), ntohs(na_ipv4.port)); + PICA_debug1("disconnecting node %.16s:%hu - connection with this node is already established", inet_ntoa(*(struct in_addr*)&na_ipv4.addr), ntohs(na_ipv4.port)); return 0; } + if (nodecfg.disable_reserved_addrs && PICA_is_reserved_addr_ipv4(na_ipv4.addr)) + { + PICA_debug1("disconnecting node %.16s:%hu - private IP ranges are rejected by node configuration", + inet_ntoa(*(struct in_addr*)&na_ipv4.addr), ntohs(na_ipv4.port) + ); + return 0; + } + sprintf(na.addr,"%.16s",inet_ntoa(*(struct in_addr*)&na_ipv4.addr)); na.port = ntohs(na_ipv4.port); @@ -769,6 +777,7 @@ while(listleft) //char addr[256]; struct newconn nc; struct nodelink *nlp; + int skip_save = 0; memset(na.addr,0,256); memset(&nc,0,sizeof(struct newconn)); @@ -793,12 +802,20 @@ while(listleft) // PICA_debug1("LINKED NODE:%s\n",inet_ntoa(*(struct in_addr*)&na_ipv4.addr)); // } + PICA_debug3("NODELIST item %.16s:%hu", inet_ntoa(*(struct in_addr*)&na_ipv4.addr), ntohs(na_ipv4.port)); - + if (nodecfg.disable_reserved_addrs && PICA_is_reserved_addr_ipv4(na_ipv4.addr)) + { + skip_save = 1; + PICA_debug1("Received NODELIST item %.16s:%hu is in private range, skipping", + inet_ntoa(*(struct in_addr*)&na_ipv4.addr), ntohs(na_ipv4.port) + ); + } listleft-=PICA_PROTO_NODELIST_ITEM_IPV4_SIZE; break; } - PICA_nodeaddr_save(nodecfg.nodes_db_file, &na);//CONF filename + if (!skip_save) + PICA_nodeaddr_save(nodecfg.nodes_db_file, &na);//CONF filename } } @@ -2907,6 +2924,12 @@ while(nap) PICA_debug3("Skipping self address %.255s port %u", nap->addr, nap->port); skip = 1; } + + if (nodecfg.disable_reserved_addrs && INADDR_NONE != inet_addr(nap->addr) && PICA_is_reserved_addr_ipv4(inet_addr(nap->addr))) + { + PICA_debug3("Skipping IP from private range %.255s port %u", nap->addr, nap->port); + skip = 1; + } nl = nodelink_list_head; //check if connection to node with current address is already established @@ -2958,16 +2981,24 @@ PICA_debug1("nodecfg.config_file = %s", nodecfg.config_file); PICA_debug1("nodecfg.announced_addr = %s",nodecfg.announced_addr); PICA_debug1("nodecfg.listen_port = %s",nodecfg.listen_port); PICA_debug1("nodecfg.nodes_db_file = %s",nodecfg.nodes_db_file); +PICA_debug1("nodecfg.disable_reserved_addrs = %s", nodecfg.disable_reserved_addrs ? "yes" : "no"); if (!PICA_node_init()) return -1; if (INADDR_NONE == inet_addr(nodecfg.announced_addr) || INADDR_ANY == inet_addr(nodecfg.announced_addr)) { - PICA_fatal("announced_addr (%.16s) is invalid or not configured. Please set correct public IP address of your pica-node instance in config file", + PICA_fatal("announced_addr (%.16s) is invalid or not configured. Please set correct public IP address of your pica-node instance in config file.", nodecfg.announced_addr ); } + +if (nodecfg.disable_reserved_addrs && PICA_is_reserved_addr_ipv4(inet_addr(nodecfg.announced_addr))) + { + PICA_fatal("announced_addr (%.16s) is in private range and is unacceptable for global Internet. Private ranges are disabled by node configuration.", + nodecfg.announced_addr + ); + } PICA_node_joinskynet(nodecfg.nodes_db_file, nodecfg.announced_addr);//CONF-CONF имя файла с адресами узлов, свой адрес diff --git a/PICA_nodeaddrlist.c b/PICA_nodeaddrlist.c index df91230..6e262f9 100755 --- a/PICA_nodeaddrlist.c +++ b/PICA_nodeaddrlist.c @@ -6,12 +6,37 @@ #include "PICA_log.h" +#define PREFIX4 htonl(0xf0000000U) +#define PREFIX8 htonl(0xff000000U) +#define PREFIX12 htonl(0xfff00000U) +#define PREFIX16 htonl(0xffff0000U) +#define PREFIX24 htonl(0xffffff00U) + +#define MAKEIP(a, b, c, d) (htonl( (a&0xFF) << 24 | (b&0xFF) << 16 | (c&0xFF) << 8 | (d&0xFF) )) + struct cb_param { struct PICA_nodeaddr **n_addr; int *N; }; +int PICA_is_reserved_addr_ipv4(in_addr_t addr) +{ + if ((addr & PREFIX8) == 0 //0.0.0.0/8 + || (addr & PREFIX8) == MAKEIP(10, 0, 0, 0) //10.0.0.0/8 + || (addr & PREFIX8) == MAKEIP(127, 0, 0, 0)//127.0.0.0/8 + || (addr & PREFIX16) == MAKEIP(169, 254, 0, 0) //169.254.0.0/16 + || (addr & PREFIX12) == MAKEIP(172, 16, 0, 0) //172.16.0.0/12 + || (addr & PREFIX16) == MAKEIP(192, 168, 0, 0) //192.168.0.0/16 + || (addr & PREFIX4) == MAKEIP(224, 0, 0, 0) //224.0.0.0/4 + || (addr & PREFIX4) == MAKEIP(240, 0, 0, 0) //240.0.0.0/4 + || addr == INADDR_BROADCAST + ) + return 1; + +return 0; +} + static int nodeaddr_load_sqlite_cb(void *p, int argc, char **argv, char **ColName) { struct cb_param *cp = (struct cb_param*)p; diff --git a/PICA_nodeaddrlist.h b/PICA_nodeaddrlist.h index 0cfd771..7200cc7 100755 --- a/PICA_nodeaddrlist.h +++ b/PICA_nodeaddrlist.h @@ -49,6 +49,8 @@ in_port_t port;//номер порта - host byte order struct PICA_nodeaddr *next; }; +int PICA_is_reserved_addr_ipv4(in_addr_t); + int PICA_nodeaddr_list_load(const char* dbfilename,struct PICA_nodeaddr **list_head); int PICA_nodeaddr_save(const char* dbfilename, struct PICA_nodeaddr *naddr); int PICA_nodeaddr_update(const char* dbfilename, struct PICA_nodeaddr *naddr, int is_alive); diff --git a/PICA_nodeconfig.c b/PICA_nodeconfig.c index d89d91b..3e7e851 100644 --- a/PICA_nodeconfig.c +++ b/PICA_nodeconfig.c @@ -21,6 +21,7 @@ nodecfg.announced_addr = strdup(iniparser_getstring(d, "pica-node:announced_addr nodecfg.listen_port = strdup(iniparser_getstring(d, "pica-node:listen_port", PICA_NODECONFIG_DEF_LISTEN_PORT)); nodecfg.nodes_db_file = strdup(iniparser_getstring(d, "pica-node:nodes_db_file", PICA_NODECONFIG_DEF_NODES_DB_FILE)); nodecfg.CA_cert_file = strdup(iniparser_getstring(d, "pica-node:CA_cert_file", PICA_NODECONFIG_DEF_CA_CERT_FILE)); +nodecfg.disable_reserved_addrs = iniparser_getboolean(d, "pica-node:disable_reserved_addrs", 1); iniparser_freedict(d); diff --git a/PICA_nodeconfig.h b/PICA_nodeconfig.h index 9790256..2c63cc3 100644 --- a/PICA_nodeconfig.h +++ b/PICA_nodeconfig.h @@ -27,6 +27,8 @@ char *listen_port; char *nodes_db_file; char *config_file; char *CA_cert_file; +int disable_reserved_addrs; +//int conn_speed_limit; }; extern struct nodeconfig nodecfg; diff --git a/pica-node.conf b/pica-node.conf index 883c91b..55e847d 100644 --- a/pica-node.conf +++ b/pica-node.conf @@ -31,4 +31,9 @@ # #CA_cert_file = "/usr/share/pica-node/CA.pem"; - +#Disables usage of node addresses from reserved IP ranges. Default is "yes". Only global routable Internet +#addresses are accepted. +#Set to "no" if you want +#to test or use pica-node in private network, on local loopback address, etc +# +#disable_reserved_addrs = yes diff --git a/pica-node.conf.5 b/pica-node.conf.5 index 634bd3f..f0c7ff2 100644 --- a/pica-node.conf.5 +++ b/pica-node.conf.5 @@ -36,6 +36,11 @@ The default is .I CA_cert_file Specifies the path to CA certificate in .pem format. The default is .I /usr/share/pica-node/CA.pem +.TP +.I disable_reserved_addrs +Disables usage of reserved IP ranges (127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16 and others). +If such address is received from other node or is set as "announced_addr" value, it will be +rejected. This option can be set to "yes" or "no". Default is "yes". .SH AUTHOR Anton Sviridenko (anton (at) picapica.im, anton (at) picapica.ge) .SH SEE ALSO |