Use our hostname/TID port when sending a request, not our next_hop
authorJennifer Richards <jennifer@painless-security.com>
Fri, 25 May 2018 15:59:57 +0000 (11:59 -0400)
committerJennifer Richards <jennifer@painless-security.com>
Fri, 25 May 2018 15:59:57 +0000 (11:59 -0400)
Before this, we set the next_hop to ourselves for local routes, then
simply forwarded the next_hop to our peers in update messages. That is
incorrect - we need to fill in our own hostname/TID port every time, not
send the next_hop we forward to.

Also fixes a few port name / signed int changes that really belonged in
the previous commit.

tr/tr_main.c
tr/tr_trp.c
trp/trp_route.c
trp/trps.c

index ba738c7..73c429e 100644 (file)
@@ -310,6 +310,9 @@ int main(int argc, char *argv[])
     return 1;
   }
 
+  /* tell the trps which port the tid server listens on */
+  tr->trps->tids_port = tr->tids->tids_port;
+
   /* install TRP handler events */
   tr_debug("Initializing Dynamic Trust Router Protocol events.");
   if (TRP_SUCCESS != tr_trps_event_init(ev_base, tr)) {
index eeb354c..c525f54 100644 (file)
@@ -710,8 +710,6 @@ static void *tr_trpc_thread(void *arg)
  * @param realm IDP realm whose routes should be generated
  * @param trust_router hostname for TRP connections to us
  * @param trust_router_port TRP port of our trust router
- * @param next_hop hostname for TID connections to us
- * @param next_hop_port TID port of our trust router
  * @param n_routes (output) the number of routes in the returned array
  * @return Pointer to an array of pointers to routes
  */
@@ -719,8 +717,6 @@ static TRP_ROUTE **tr_make_local_routes(TALLOC_CTX *mem_ctx,
                                         TR_IDP_REALM *realm,
                                         const char *trust_router,
                                         int trust_router_port,
-                                        const char *next_hop,
-                                        int next_hop_port,
                                         size_t *n_routes)
 {
   TALLOC_CTX *tmp_ctx=talloc_new(NULL);
@@ -751,8 +747,8 @@ static TRP_ROUTE **tr_make_local_routes(TALLOC_CTX *mem_ctx,
     trp_route_set_metric(new_entry, 0);
     trp_route_set_trust_router(new_entry, tr_new_name(trust_router));
     trp_route_set_trust_router_port(new_entry, trust_router_port);
-    trp_route_set_next_hop(new_entry, tr_new_name(next_hop));
-    trp_route_set_next_hop_port(new_entry, next_hop_port);
+    trp_route_set_next_hop(new_entry, tr_new_name("")); /* no next hop */
+    trp_route_set_next_hop_port(new_entry, -1); /* no next hop */
     trp_route_set_local(new_entry, 1);
     entries[ii]=new_entry;
   }
@@ -834,13 +830,7 @@ TRP_RC tr_add_local_routes(TRPS_INSTANCE *trps, TR_CFG *cfg)
   size_t ii=0;
 
   for (cur=cfg->ctable->idp_realms; cur!=NULL; cur=cur->next) {
-    local_routes=tr_make_local_routes(tmp_ctx,
-                                      cur,
-                                      cfg->internal->hostname,
-                                      cfg->internal->trps_port,
-                                      cfg->internal->hostname,
-                                      cfg->internal->tids_port,
-                                      &n_routes);
+    local_routes= tr_make_local_routes(tmp_ctx, cur, cfg->internal->hostname, cfg->internal->trps_port, &n_routes);
     for (ii=0; ii<n_routes; ii++)
       trps_add_route(trps, local_routes[ii]);
 
index 19d7e22..d552e01 100644 (file)
@@ -176,7 +176,6 @@ unsigned int trp_route_get_metric(TRP_ROUTE *entry)
   return entry->metric;
 }
 
-/* TODO: set the hostname and port for the next hop. Currently assume default TID port. --jlr */
 void trp_route_set_next_hop(TRP_ROUTE *entry, TR_NAME *next_hop)
 {
   if (entry->next_hop!=NULL)
index 9305e7a..171c7ae 100644 (file)
@@ -69,7 +69,7 @@ TRPS_INSTANCE *trps_new (TALLOC_CTX *mem_ctx)
   TRPS_INSTANCE *trps=talloc(mem_ctx, TRPS_INSTANCE);
   if (trps!=NULL)  {
     trps->hostname=NULL;
-    trps->port=0;
+    trps->trps_port=0;
     trps->cookie=NULL;
     trps->conn=NULL;
     trps->trpc=NULL;
@@ -196,7 +196,7 @@ TR_NAME *trps_dup_label(TRPS_INSTANCE *trps)
 {
   TALLOC_CTX *tmp_ctx=talloc_new(NULL);
   TR_NAME *label=NULL;
-  char *s=talloc_asprintf(tmp_ctx, "%s:%u", trps->hostname, trps->port);
+  char *s=talloc_asprintf(tmp_ctx, "%s:%u", trps->hostname, trps->trps_port);
   if (s==NULL)
     goto cleanup;
   label=tr_new_name(s);
@@ -383,7 +383,7 @@ int trps_get_listener(TRPS_INSTANCE *trps,
                       TRPS_MSG_FUNC msg_handler,
                       TRP_AUTH_FUNC auth_handler,
                       const char *hostname,
-                      unsigned int port,
+                      int port,
                       void *cookie,
                       int *fd_out,
                       size_t max_fd)
@@ -418,7 +418,7 @@ int trps_get_listener(TRPS_INSTANCE *trps,
     trps->msg_handler = msg_handler;
     trps->auth_handler = auth_handler;
     trps->hostname = talloc_strdup(trps, hostname);
-    trps->port = port;
+    trps->trps_port = port;
     trps->cookie = cookie;
   }
 
@@ -1373,14 +1373,19 @@ static TRP_INFOREC *trps_route_to_inforec(TALLOC_CTX *mem_ctx, TRPS_INSTANCE *tr
                                                               trp_route_get_peer(route)));
     }
 
-    /* Note that we leave the next hop empty since the recipient fills that in.
-     * This is where we add the link cost (currently always 1) to the next peer. */
+    /*
+     * This is where we add the link cost (currently always 1) to the next peer.
+     *
+     * Here, set next_hop to our TID address/port rather than passing along our own
+     * next_hop. That is the one *we* use to forward requests. We are advertising
+     * ourselves as a hop for our peers.
+     */
     if ((TRP_SUCCESS != trp_inforec_set_trust_router(rec,
                                                      trp_route_dup_trust_router(route),
                                                      trp_route_get_trust_router_port(route)))
         ||(TRP_SUCCESS != trp_inforec_set_next_hop(rec,
-                                                   trp_route_dup_next_hop(route),
-                                                   trp_route_get_next_hop_port(route)))
+                                                   tr_new_name(trps->hostname),
+                                                   trps->tids_port))
         ||(TRP_SUCCESS != trp_inforec_set_metric(rec,
                                                  trps_metric_add(trp_route_get_metric(route),
                                                                  linkcost)))