2 * Copyright (C) 2013-2019 Red Hat Inc.
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions are
8 * * Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
11 * * Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
15 * * Neither the name of Red Hat nor the names of its contributors may be
16 * used to endorse or promote products derived from this software without
17 * specific prior written permission.
19 * THIS SOFTWARE IS PROVIDED BY RED HAT AND CONTRIBUTORS ''AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
21 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
22 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RED HAT OR
23 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
24 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
25 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
26 * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
27 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
29 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
43 #include "byte-swapping.h"
46 /* Maximum number of client options we allow before giving up. */
47 #define MAX_NR_OPTIONS 32
49 /* Maximum length of any option data (bytes). */
50 #define MAX_OPTION_LENGTH 4096
52 /* Receive newstyle options. */
54 send_newstyle_option_reply (struct connection
*conn
,
55 uint32_t option
, uint32_t reply
)
57 struct fixed_new_option_reply fixed_new_option_reply
;
59 fixed_new_option_reply
.magic
= htobe64 (NBD_REP_MAGIC
);
60 fixed_new_option_reply
.option
= htobe32 (option
);
61 fixed_new_option_reply
.reply
= htobe32 (reply
);
62 fixed_new_option_reply
.replylen
= htobe32 (0);
65 &fixed_new_option_reply
,
66 sizeof fixed_new_option_reply
, 0) == -1) {
67 /* The protocol document says that the client is allowed to simply
68 * drop the connection after sending NBD_OPT_ABORT, or may read
71 if (option
== NBD_OPT_ABORT
)
72 debug ("write: %s: %m", name_of_nbd_opt (option
));
74 nbdkit_error ("write: %s: %m", name_of_nbd_opt (option
));
82 send_newstyle_option_reply_exportname (struct connection
*conn
,
83 uint32_t option
, uint32_t reply
,
84 const char *exportname
)
86 struct fixed_new_option_reply fixed_new_option_reply
;
87 size_t name_len
= strlen (exportname
);
90 fixed_new_option_reply
.magic
= htobe64 (NBD_REP_MAGIC
);
91 fixed_new_option_reply
.option
= htobe32 (option
);
92 fixed_new_option_reply
.reply
= htobe32 (reply
);
93 fixed_new_option_reply
.replylen
= htobe32 (name_len
+ sizeof (len
));
96 &fixed_new_option_reply
,
97 sizeof fixed_new_option_reply
, SEND_MORE
) == -1) {
98 nbdkit_error ("write: %s: %m", name_of_nbd_opt (option
));
102 len
= htobe32 (name_len
);
103 if (conn
->send (conn
, &len
, sizeof len
, SEND_MORE
) == -1) {
104 nbdkit_error ("write: %s: %s: %m",
105 name_of_nbd_opt (option
), "sending length");
108 if (conn
->send (conn
, exportname
, name_len
, 0) == -1) {
109 nbdkit_error ("write: %s: %s: %m",
110 name_of_nbd_opt (option
), "sending export name");
118 send_newstyle_option_reply_info_export (struct connection
*conn
,
119 uint32_t option
, uint32_t reply
,
122 struct fixed_new_option_reply fixed_new_option_reply
;
123 struct fixed_new_option_reply_info_export export
;
125 fixed_new_option_reply
.magic
= htobe64 (NBD_REP_MAGIC
);
126 fixed_new_option_reply
.option
= htobe32 (option
);
127 fixed_new_option_reply
.reply
= htobe32 (reply
);
128 fixed_new_option_reply
.replylen
= htobe32 (sizeof export
);
129 export
.info
= htobe16 (info
);
130 export
.exportsize
= htobe64 (conn
->exportsize
);
131 export
.eflags
= htobe16 (conn
->eflags
);
133 if (conn
->send (conn
,
134 &fixed_new_option_reply
,
135 sizeof fixed_new_option_reply
, SEND_MORE
) == -1 ||
136 conn
->send (conn
, &export
, sizeof export
, 0) == -1) {
137 nbdkit_error ("write: %s: %m", name_of_nbd_opt (option
));
145 send_newstyle_option_reply_meta_context (struct connection
*conn
,
146 uint32_t option
, uint32_t reply
,
150 struct fixed_new_option_reply fixed_new_option_reply
;
151 struct fixed_new_option_reply_meta_context context
;
152 const size_t namelen
= strlen (name
);
154 debug ("newstyle negotiation: %s: replying with %s id %d",
155 name_of_nbd_opt (option
), name
, context_id
);
156 fixed_new_option_reply
.magic
= htobe64 (NBD_REP_MAGIC
);
157 fixed_new_option_reply
.option
= htobe32 (option
);
158 fixed_new_option_reply
.reply
= htobe32 (reply
);
159 fixed_new_option_reply
.replylen
= htobe32 (sizeof context
+ namelen
);
160 context
.context_id
= htobe32 (context_id
);
162 if (conn
->send (conn
,
163 &fixed_new_option_reply
,
164 sizeof fixed_new_option_reply
, SEND_MORE
) == -1 ||
165 conn
->send (conn
, &context
, sizeof context
, SEND_MORE
) == -1 ||
166 conn
->send (conn
, name
, namelen
, 0) == -1) {
167 nbdkit_error ("write: %s: %m", name_of_nbd_opt (option
));
174 /* Sub-function during negotiate_handshake_newstyle, to uniformly handle
175 * a client hanging up on a message boundary.
177 static int __attribute__ ((format (printf
, 4, 5)))
178 conn_recv_full (struct connection
*conn
, void *buf
, size_t len
,
179 const char *fmt
, ...)
181 int r
= conn
->recv (conn
, buf
, len
);
185 va_start (args
, fmt
);
186 nbdkit_verror (fmt
, args
);
191 /* During negotiation, client EOF on message boundary is less
192 * severe than failure in the middle of the buffer. */
193 debug ("client closed input socket, closing connection");
199 /* Sub-function of negotiate_handshake_newstyle_options below. It
200 * must be called on all non-error paths out of the options for-loop
204 finish_newstyle_options (struct connection
*conn
)
208 r
= backend
->get_size (backend
, conn
);
212 nbdkit_error (".get_size function returned invalid value "
216 conn
->exportsize
= (uint64_t) r
;
218 if (protocol_compute_eflags (conn
, &conn
->eflags
) < 0)
221 debug ("newstyle negotiation: flags: export 0x%x", conn
->eflags
);
226 negotiate_handshake_newstyle_options (struct connection
*conn
)
228 struct new_option new_option
;
233 char data
[MAX_OPTION_LENGTH
+1];
234 struct new_handshake_finish handshake_finish
;
237 for (nr_options
= 0; nr_options
< MAX_NR_OPTIONS
; ++nr_options
) {
238 if (conn_recv_full (conn
, &new_option
, sizeof new_option
,
239 "reading option: conn->recv: %m") == -1)
242 version
= be64toh (new_option
.version
);
243 if (version
!= NEW_VERSION
) {
244 nbdkit_error ("unknown option version %" PRIx64
245 ", expecting %" PRIx64
,
246 version
, NEW_VERSION
);
250 /* There is a maximum option length we will accept, regardless
251 * of the option type.
253 optlen
= be32toh (new_option
.optlen
);
254 if (optlen
> MAX_OPTION_LENGTH
) {
255 nbdkit_error ("client option data too long (%" PRIu32
")", optlen
);
259 option
= be32toh (new_option
.option
);
260 optname
= name_of_nbd_opt (option
);
262 /* In --tls=require / FORCEDTLS mode the only options allowed
263 * before TLS negotiation are NBD_OPT_ABORT and NBD_OPT_STARTTLS.
265 if (tls
== 2 && !conn
->using_tls
&&
266 !(option
== NBD_OPT_ABORT
|| option
== NBD_OPT_STARTTLS
)) {
267 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ERR_TLS_REQD
))
273 case NBD_OPT_EXPORT_NAME
:
274 if (conn_recv_full (conn
, data
, optlen
,
275 "read: %s: %m", name_of_nbd_opt (option
)) == -1)
277 /* Apart from printing it, ignore the export name. */
279 debug ("newstyle negotiation: %s: "
280 "client requested export '%s' (ignored)",
281 name_of_nbd_opt (option
), data
);
283 /* We have to finish the handshake by sending handshake_finish. */
284 if (finish_newstyle_options (conn
) == -1)
287 memset (&handshake_finish
, 0, sizeof handshake_finish
);
288 handshake_finish
.exportsize
= htobe64 (conn
->exportsize
);
289 handshake_finish
.eflags
= htobe16 (conn
->eflags
);
291 if (conn
->send (conn
,
293 (conn
->cflags
& NBD_FLAG_NO_ZEROES
)
294 ? offsetof (struct new_handshake_finish
, zeroes
)
295 : sizeof handshake_finish
, 0) == -1) {
296 nbdkit_error ("write: %s: %m", optname
);
302 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ACK
) == -1)
304 debug ("client sent %s to abort the connection",
305 name_of_nbd_opt (option
));
310 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ERR_INVALID
)
313 if (conn_recv_full (conn
, data
, optlen
,
314 "read: %s: %m", name_of_nbd_opt (option
)) == -1)
319 /* Send back the exportname. */
320 debug ("newstyle negotiation: %s: advertising export '%s'",
321 name_of_nbd_opt (option
), exportname
);
322 if (send_newstyle_option_reply_exportname (conn
, option
, NBD_REP_SERVER
,
326 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ACK
) == -1)
330 case NBD_OPT_STARTTLS
:
332 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ERR_INVALID
)
335 if (conn_recv_full (conn
, data
, optlen
,
336 "read: %s: %m", name_of_nbd_opt (option
)) == -1)
341 if (tls
== 0) { /* --tls=off (NOTLS mode). */
343 #define NO_TLS_REPLY NBD_REP_ERR_POLICY
345 #define NO_TLS_REPLY NBD_REP_ERR_UNSUP
347 if (send_newstyle_option_reply (conn
, option
, NO_TLS_REPLY
) == -1)
350 else /* --tls=on or --tls=require */ {
351 /* We can't upgrade to TLS twice on the same connection. */
352 if (conn
->using_tls
) {
353 if (send_newstyle_option_reply (conn
, option
,
354 NBD_REP_ERR_INVALID
) == -1)
359 /* We have to send the (unencrypted) reply before starting
362 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ACK
) == -1)
365 /* Upgrade the connection to TLS. Also performs access control. */
366 if (crypto_negotiate_tls (conn
, conn
->sockin
, conn
->sockout
) == -1)
368 conn
->using_tls
= true;
369 debug ("using TLS on this connection");
375 if (conn_recv_full (conn
, data
, optlen
,
376 "read: %s: %m", optname
) == -1)
379 if (optlen
< 6) { /* 32 bit export length + 16 bit nr info */
380 debug ("newstyle negotiation: %s option length < 6", optname
);
382 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ERR_INVALID
)
389 uint32_t exportnamelen
;
393 CLEANUP_FREE
char *requested_exportname
= NULL
;
395 /* Validate the name length and number of INFO requests. */
396 memcpy (&exportnamelen
, &data
[0], 4);
397 exportnamelen
= be32toh (exportnamelen
);
398 if (exportnamelen
> optlen
-6 /* NB optlen >= 6, see above */) {
399 debug ("newstyle negotiation: %s: export name too long", optname
);
400 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ERR_INVALID
)
405 memcpy (&nrinfos
, &data
[exportnamelen
+4], 2);
406 nrinfos
= be16toh (nrinfos
);
407 if (optlen
!= 4 + exportnamelen
+ 2 + 2*nrinfos
) {
408 debug ("newstyle negotiation: %s: "
409 "number of information requests incorrect", optname
);
410 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ERR_INVALID
)
416 /* As with NBD_OPT_EXPORT_NAME we print the export name and then
419 requested_exportname
= malloc (exportnamelen
+1);
420 if (requested_exportname
== NULL
) {
421 nbdkit_error ("malloc: %m");
424 memcpy (requested_exportname
, &data
[4], exportnamelen
);
425 requested_exportname
[exportnamelen
] = '\0';
426 debug ("newstyle negotiation: %s: "
427 "client requested export '%s' (ignored)",
428 optname
, requested_exportname
);
430 /* The spec is confusing, but it is required that we send back
431 * NBD_INFO_EXPORT, even if the client did not request it!
432 * qemu client in particular does not request this, but will
433 * fail if we don't send it.
435 if (finish_newstyle_options (conn
) == -1)
438 if (send_newstyle_option_reply_info_export (conn
, option
,
440 NBD_INFO_EXPORT
) == -1)
443 /* For now we ignore all other info requests (but we must
444 * ignore NBD_INFO_EXPORT if it was requested, because we
445 * replied already above). Therefore this loop doesn't do
446 * much at the moment.
448 for (i
= 0; i
< nrinfos
; ++i
) {
449 memcpy (&info
, &data
[4 + exportnamelen
+ 2 + i
*2], 2);
450 info
= be16toh (info
);
452 case NBD_INFO_EXPORT
: /* ignore - reply sent above */ break;
454 debug ("newstyle negotiation: %s: "
455 "ignoring NBD_INFO_* request %u (%s)",
456 optname
, (unsigned) info
, name_of_nbd_info (info
));
462 /* Unlike NBD_OPT_EXPORT_NAME, NBD_OPT_GO sends back an ACK
465 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ACK
) == -1)
470 case NBD_OPT_STRUCTURED_REPLY
:
472 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ERR_INVALID
)
475 if (conn_recv_full (conn
, data
, optlen
,
476 "read: %s: %m", name_of_nbd_opt (option
)) == -1)
481 debug ("newstyle negotiation: %s: client requested structured replies",
482 name_of_nbd_opt (option
));
485 /* Must fail with ERR_UNSUP for qemu 4.2 to remain happy;
486 * but failing with ERR_POLICY would have been nicer.
488 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ERR_UNSUP
) == -1)
490 debug ("newstyle negotiation: %s: structured replies are disabled",
491 name_of_nbd_opt (option
));
495 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ACK
) == -1)
498 conn
->structured_replies
= true;
501 case NBD_OPT_LIST_META_CONTEXT
:
502 case NBD_OPT_SET_META_CONTEXT
:
505 uint32_t exportnamelen
;
510 if (conn_recv_full (conn
, data
, optlen
, "read: %s: %m", optname
) == -1)
513 /* Note that we support base:allocation whether or not the plugin
514 * supports can_extents.
516 if (!conn
->structured_replies
) {
517 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ERR_INVALID
)
523 /* Minimum length of the option payload is:
524 * 32 bit export name length followed by empty export name
525 * + 32 bit number of queries followed by no queries
530 opt_meta_invalid_option_len
:
531 debug ("newstyle negotiation: %s: invalid option length: %s",
534 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ERR_INVALID
)
540 /* Discard the export name. */
541 memcpy (&exportnamelen
, &data
[0], 4);
542 exportnamelen
= be32toh (exportnamelen
);
543 opt_index
= 4 + exportnamelen
;
545 /* Read the number of queries. */
546 what
= "reading number of queries";
547 if (opt_index
+4 > optlen
)
548 goto opt_meta_invalid_option_len
;
549 memcpy (&nr_queries
, &data
[opt_index
], 4);
550 nr_queries
= be32toh (nr_queries
);
553 /* for LIST: nr_queries == 0 means return all meta contexts
554 * for SET: nr_queries == 0 means reset all contexts
556 debug ("newstyle negotiation: %s: %s count: %d", optname
,
557 option
== NBD_OPT_LIST_META_CONTEXT
? "query" : "set",
559 if (nr_queries
== 0) {
560 if (option
== NBD_OPT_SET_META_CONTEXT
)
561 conn
->meta_context_base_allocation
= false;
563 if (send_newstyle_option_reply_meta_context
564 (conn
, option
, NBD_REP_META_CONTEXT
,
565 0, "base:allocation") == -1)
569 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ACK
) == -1)
573 /* Read and answer each query. */
574 while (nr_queries
> 0) {
575 what
= "reading query string length";
576 if (opt_index
+4 > optlen
)
577 goto opt_meta_invalid_option_len
;
578 memcpy (&querylen
, &data
[opt_index
], 4);
579 querylen
= be32toh (querylen
);
581 what
= "reading query string";
582 if (opt_index
+ querylen
> optlen
)
583 goto opt_meta_invalid_option_len
;
585 debug ("newstyle negotiation: %s: %s %.*s",
587 option
== NBD_OPT_LIST_META_CONTEXT
? "query" : "set",
588 (int) querylen
, &data
[opt_index
]);
590 /* For LIST, "base:" returns all supported contexts in the
591 * base namespace. We only support "base:allocation".
593 if (option
== NBD_OPT_LIST_META_CONTEXT
&&
595 strncmp (&data
[opt_index
], "base:", 5) == 0) {
596 if (send_newstyle_option_reply_meta_context
597 (conn
, option
, NBD_REP_META_CONTEXT
,
598 0, "base:allocation") == -1)
601 /* "base:allocation" requested by name. */
602 else if (querylen
== 15 &&
603 strncmp (&data
[opt_index
], "base:allocation", 15) == 0) {
604 if (send_newstyle_option_reply_meta_context
605 (conn
, option
, NBD_REP_META_CONTEXT
,
606 option
== NBD_OPT_SET_META_CONTEXT
607 ? base_allocation_id
: 0,
608 "base:allocation") == -1)
610 if (option
== NBD_OPT_SET_META_CONTEXT
)
611 conn
->meta_context_base_allocation
= true;
613 /* Every other query must be ignored. */
615 opt_index
+= querylen
;
618 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ACK
) == -1)
621 debug ("newstyle negotiation: %s: reply complete", optname
);
626 /* Unknown option. */
627 if (send_newstyle_option_reply (conn
, option
, NBD_REP_ERR_UNSUP
) == -1)
629 if (conn_recv_full (conn
, data
, optlen
,
630 "reading unknown option data: conn->recv: %m") == -1)
634 /* Note, since it's not very clear from the protocol doc, that the
635 * client must send NBD_OPT_EXPORT_NAME or NBD_OPT_GO last, and
636 * that ends option negotiation.
638 if (option
== NBD_OPT_EXPORT_NAME
|| option
== NBD_OPT_GO
)
642 if (nr_options
>= MAX_NR_OPTIONS
) {
643 nbdkit_error ("client exceeded maximum number of options (%d)",
648 /* In --tls=require / FORCEDTLS mode, we must have upgraded to TLS
649 * by the time we finish option negotiation. If not, give up.
651 if (tls
== 2 && !conn
->using_tls
) {
652 nbdkit_error ("non-TLS client tried to connect in --tls=require mode");
660 protocol_handshake_newstyle (struct connection
*conn
)
662 struct new_handshake handshake
;
665 gflags
= NBD_FLAG_FIXED_NEWSTYLE
| NBD_FLAG_NO_ZEROES
;
667 debug ("newstyle negotiation: flags: global 0x%x", gflags
);
669 memcpy (handshake
.nbdmagic
, "NBDMAGIC", 8);
670 handshake
.version
= htobe64 (NEW_VERSION
);
671 handshake
.gflags
= htobe16 (gflags
);
673 if (conn
->send (conn
, &handshake
, sizeof handshake
, 0) == -1) {
674 nbdkit_error ("write: %s: %m", "sending newstyle handshake");
678 /* Client now sends us its 32 bit flags word ... */
679 if (conn_recv_full (conn
, &conn
->cflags
, sizeof conn
->cflags
,
680 "reading initial client flags: conn->recv: %m") == -1)
682 conn
->cflags
= be32toh (conn
->cflags
);
683 /* ... which we check for accuracy. */
684 debug ("newstyle negotiation: client flags: 0x%x", conn
->cflags
);
685 if (conn
->cflags
& ~gflags
) {
686 nbdkit_error ("client requested unknown flags 0x%x", conn
->cflags
);
690 /* Receive newstyle options. */
691 if (negotiate_handshake_newstyle_options (conn
) == -1)