113 lines
2.9 KiB
C++
Executable File
113 lines
2.9 KiB
C++
Executable File
#include "stdafx.h"
|
|
#include "desc_p2p.h"
|
|
#include "protocol.h"
|
|
#include "p2p.h"
|
|
#include "config.h"
|
|
|
|
DESC_P2P::~DESC_P2P()
|
|
{
|
|
}
|
|
|
|
void DESC_P2P::Destroy()
|
|
{
|
|
if (m_sock == INVALID_SOCKET) {
|
|
return;
|
|
}
|
|
|
|
P2P_MANAGER::instance().UnregisterAcceptor(this);
|
|
|
|
fdwatch_del_fd(m_lpFdw, m_sock);
|
|
|
|
sys_log(0, "SYSTEM: closing p2p socket. DESC #%d", m_sock);
|
|
|
|
socket_close(m_sock);
|
|
m_sock = INVALID_SOCKET;
|
|
|
|
// Chain up to base class Destroy()
|
|
DESC::Destroy();
|
|
}
|
|
|
|
bool DESC_P2P::Setup(LPFDWATCH fdw, socket_t fd, const char * host, WORD wPort)
|
|
{
|
|
m_lpFdw = fdw;
|
|
m_stHost = host;
|
|
m_wPort = wPort;
|
|
m_sock = fd;
|
|
|
|
if (!(m_lpOutputBuffer = buffer_new(1024 * 1024)))
|
|
return false;
|
|
|
|
if (!(m_lpInputBuffer = buffer_new(1024 * 1024)))
|
|
return false;
|
|
|
|
fdwatch_add_fd(m_lpFdw, m_sock, this, FDW_READ, false);
|
|
|
|
m_iMinInputBufferLen = 1024 * 1024;
|
|
|
|
#ifdef ENABLE_PORT_SECURITY
|
|
#if defined(__linux__)
|
|
/* ### LINUX-BLOCK-BEGIN (desc_p2p.cpp: p2p peer allowlist) #############
|
|
* The upstream test encodes "every core of this server runs on the machine
|
|
* whose address is g_szPublicIP", which is precisely the assumption a
|
|
* container layout breaks: cores in sibling containers each have their own
|
|
* address, so every p2p connection between them is refused and the channel
|
|
* silently never forms.
|
|
*
|
|
* g_setP2PAllowIP is additive and empty by default, so with neither
|
|
* P2P_ALLOW_IP nor M2_P2P_ALLOW_IP configured the condition below is the
|
|
* upstream condition, unchanged. Keeping it an explicit allowlist rather
|
|
* than a flag that switches the check off means a Docker deployment still
|
|
* states exactly which peers it trusts.
|
|
*
|
|
* (Cores sharing one network namespace -- all channel cores in one container,
|
|
* the common layout -- need none of this: they reach each other on
|
|
* g_szPublicIP and the source address matches, exactly as on one host.)
|
|
* ### LINUX-BLOCK-END (desc_p2p.cpp: p2p peer allowlist) ############### */
|
|
if (strcmp(host, g_szPublicIP) && !g_setP2PAllowIP.count(host)) // refuse if remote host != public ip (only the same machine must be able to connect in here)
|
|
#else
|
|
if (strcmp(host, g_szPublicIP)) // refuse if remote host != public ip (only the same machine must be able to connect in here)
|
|
#endif
|
|
{
|
|
sys_log(0, "PORT_SECURITY: new p2p connection from [%s] to [%s] fd: %d BLOCKED", host, g_szPublicIP, m_sock);
|
|
SetPhase(PHASE_CLOSE);
|
|
return true;
|
|
}
|
|
#endif
|
|
|
|
SetPhase(PHASE_P2P);
|
|
|
|
sys_log(0, "SYSTEM: new p2p connection from [%s] fd: %d", host, m_sock);
|
|
return true;
|
|
}
|
|
|
|
void DESC_P2P::SetPhase(int iPhase)
|
|
{
|
|
static CInputP2P s_inputP2P;
|
|
|
|
switch (iPhase)
|
|
{
|
|
case PHASE_P2P:
|
|
sys_log(1, "PHASE_P2P");
|
|
|
|
if (m_lpInputBuffer)
|
|
buffer_reset(m_lpInputBuffer);
|
|
|
|
if (m_lpOutputBuffer)
|
|
buffer_reset(m_lpOutputBuffer);
|
|
|
|
m_pInputProcessor = &s_inputP2P;
|
|
break;
|
|
|
|
case PHASE_CLOSE:
|
|
m_pInputProcessor = NULL;
|
|
break;
|
|
|
|
default:
|
|
sys_err("DESC_P2P::SetPhase : Unknown phase");
|
|
break;
|
|
}
|
|
|
|
m_iPhase = iPhase;
|
|
}
|
|
|