control.c revision 1.17
1/* $OpenBSD: control.c,v 1.17 2015/10/19 11:25:35 reyk Exp $ */ 2 3/* 4 * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org> 5 * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> 6 * 7 * Permission to use, copy, modify, and distribute this software for any 8 * purpose with or without fee is hereby granted, provided that the above 9 * copyright notice and this permission notice appear in all copies. 10 * 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 */ 19 20#include <sys/queue.h> 21#include <sys/stat.h> 22#include <sys/socket.h> 23#include <sys/un.h> 24#include <sys/tree.h> 25 26#include <net/if.h> 27 28#include <errno.h> 29#include <event.h> 30#include <fcntl.h> 31#include <stdlib.h> 32#include <string.h> 33#include <unistd.h> 34#include <signal.h> 35 36#include "iked.h" 37 38#define CONTROL_BACKLOG 5 39 40struct ctl_connlist ctl_conns; 41 42void 43 control_accept(int, short, void *); 44struct ctl_conn 45 *control_connbyfd(int); 46void control_close(int, struct control_sock *); 47void control_dispatch_imsg(int, short, void *); 48void control_imsg_forward(struct imsg *); 49 50int 51control_init(struct privsep *ps, struct control_sock *cs) 52{ 53 struct iked *env = ps->ps_env; 54 struct sockaddr_un sun; 55 int fd; 56 mode_t old_umask, mode; 57 58 if (cs->cs_name == NULL) 59 return (0); 60 61 if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) { 62 log_warn("%s: socket", __func__); 63 return (-1); 64 } 65 66 sun.sun_family = AF_UNIX; 67 if (strlcpy(sun.sun_path, cs->cs_name, 68 sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) { 69 log_warn("%s: %s name too long", __func__, cs->cs_name); 70 close(fd); 71 return (-1); 72 } 73 74 if (unlink(cs->cs_name) == -1) 75 if (errno != ENOENT) { 76 log_warn("%s: unlink %s", __func__, cs->cs_name); 77 close(fd); 78 return (-1); 79 } 80 81 if (cs->cs_restricted) { 82 old_umask = umask(S_IXUSR|S_IXGRP|S_IXOTH); 83 mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH; 84 } else { 85 old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH); 86 mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP; 87 } 88 89 if (bind(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) { 90 log_warn("%s: bind: %s", __func__, cs->cs_name); 91 close(fd); 92 (void)umask(old_umask); 93 return (-1); 94 } 95 (void)umask(old_umask); 96 97 if (chmod(cs->cs_name, mode) == -1) { 98 log_warn("%s: chmod", __func__); 99 close(fd); 100 (void)unlink(cs->cs_name); 101 return (-1); 102 } 103 104 socket_set_blockmode(fd, BM_NONBLOCK); 105 cs->cs_fd = fd; 106 cs->cs_env = env; 107 108 return (0); 109} 110 111int 112control_listen(struct control_sock *cs) 113{ 114 if (cs->cs_name == NULL) 115 return (0); 116 117 if (listen(cs->cs_fd, CONTROL_BACKLOG) == -1) { 118 log_warn("%s: listen", __func__); 119 return (-1); 120 } 121 122 event_set(&cs->cs_ev, cs->cs_fd, EV_READ, 123 control_accept, cs); 124 event_add(&cs->cs_ev, NULL); 125 evtimer_set(&cs->cs_evt, control_accept, cs); 126 127 return (0); 128} 129 130void 131control_cleanup(struct control_sock *cs) 132{ 133 if (cs->cs_name == NULL) 134 return; 135 event_del(&cs->cs_ev); 136 event_del(&cs->cs_evt); 137 (void)unlink(cs->cs_name); 138} 139 140/* ARGSUSED */ 141void 142control_accept(int listenfd, short event, void *arg) 143{ 144 struct control_sock *cs = arg; 145 int connfd; 146 socklen_t len; 147 struct sockaddr_un sun; 148 struct ctl_conn *c; 149 150 event_add(&cs->cs_ev, NULL); 151 if ((event & EV_TIMEOUT)) 152 return; 153 154 len = sizeof(sun); 155 if ((connfd = accept(listenfd, 156 (struct sockaddr *)&sun, &len)) == -1) { 157 /* 158 * Pause accept if we are out of file descriptors, or 159 * libevent will haunt us here too. 160 */ 161 if (errno == ENFILE || errno == EMFILE) { 162 struct timeval evtpause = { 1, 0 }; 163 164 event_del(&cs->cs_ev); 165 evtimer_add(&cs->cs_evt, &evtpause); 166 } else if (errno != EWOULDBLOCK && errno != EINTR && 167 errno != ECONNABORTED) 168 log_warn("%s: accept", __func__); 169 return; 170 } 171 172 socket_set_blockmode(connfd, BM_NONBLOCK); 173 174 if ((c = calloc(1, sizeof(struct ctl_conn))) == NULL) { 175 log_warn("%s", __func__); 176 close(connfd); 177 return; 178 } 179 180 imsg_init(&c->iev.ibuf, connfd); 181 c->iev.handler = control_dispatch_imsg; 182 c->iev.events = EV_READ; 183 c->iev.data = cs; 184 event_set(&c->iev.ev, c->iev.ibuf.fd, c->iev.events, 185 c->iev.handler, c->iev.data); 186 event_add(&c->iev.ev, NULL); 187 188 TAILQ_INSERT_TAIL(&ctl_conns, c, entry); 189} 190 191struct ctl_conn * 192control_connbyfd(int fd) 193{ 194 struct ctl_conn *c; 195 196 for (c = TAILQ_FIRST(&ctl_conns); c != NULL && c->iev.ibuf.fd != fd; 197 c = TAILQ_NEXT(c, entry)) 198 ; /* nothing */ 199 200 return (c); 201} 202 203void 204control_close(int fd, struct control_sock *cs) 205{ 206 struct ctl_conn *c; 207 208 if ((c = control_connbyfd(fd)) == NULL) { 209 log_warn("%s: fd %d: not found", __func__, fd); 210 return; 211 } 212 213 msgbuf_clear(&c->iev.ibuf.w); 214 TAILQ_REMOVE(&ctl_conns, c, entry); 215 216 event_del(&c->iev.ev); 217 close(c->iev.ibuf.fd); 218 219 /* Some file descriptors are available again. */ 220 if (evtimer_pending(&cs->cs_evt, NULL)) { 221 evtimer_del(&cs->cs_evt); 222 event_add(&cs->cs_ev, NULL); 223 } 224 225 free(c); 226} 227 228/* ARGSUSED */ 229void 230control_dispatch_imsg(int fd, short event, void *arg) 231{ 232 struct control_sock *cs = arg; 233 struct iked *env = cs->cs_env; 234 struct ctl_conn *c; 235 struct imsg imsg; 236 int n, v; 237 238 if ((c = control_connbyfd(fd)) == NULL) { 239 log_warn("%s: fd %d: not found", __func__, fd); 240 return; 241 } 242 243 if (event & EV_READ) { 244 if ((n = imsg_read(&c->iev.ibuf)) == -1 || n == 0) { 245 control_close(fd, cs); 246 return; 247 } 248 } 249 if (event & EV_WRITE) { 250 if (msgbuf_write(&c->iev.ibuf.w) <= 0 && errno != EAGAIN) { 251 control_close(fd, cs); 252 return; 253 } 254 } 255 256 for (;;) { 257 if ((n = imsg_get(&c->iev.ibuf, &imsg)) == -1) { 258 control_close(fd, cs); 259 return; 260 } 261 262 if (n == 0) 263 break; 264 265 control_imsg_forward(&imsg); 266 267 switch (imsg.hdr.type) { 268 case IMSG_CTL_NOTIFY: 269 if (c->flags & CTL_CONN_NOTIFY) { 270 log_debug("%s: " 271 "client requested notify more than once", 272 __func__); 273 imsg_compose_event(&c->iev, IMSG_CTL_FAIL, 274 0, 0, -1, NULL, 0); 275 break; 276 } 277 c->flags |= CTL_CONN_NOTIFY; 278 break; 279 case IMSG_CTL_VERBOSE: 280 IMSG_SIZE_CHECK(&imsg, &v); 281 282 memcpy(&v, imsg.data, sizeof(v)); 283 log_verbose(v); 284 285 proc_forward_imsg(&env->sc_ps, &imsg, PROC_PARENT, -1); 286 proc_forward_imsg(&env->sc_ps, &imsg, PROC_IKEV2, -1); 287 break; 288 case IMSG_CTL_RELOAD: 289 case IMSG_CTL_RESET: 290 case IMSG_CTL_COUPLE: 291 case IMSG_CTL_DECOUPLE: 292 case IMSG_CTL_ACTIVE: 293 case IMSG_CTL_PASSIVE: 294 proc_forward_imsg(&env->sc_ps, &imsg, PROC_PARENT, -1); 295 break; 296 default: 297 log_debug("%s: error handling imsg %d", 298 __func__, imsg.hdr.type); 299 break; 300 } 301 imsg_free(&imsg); 302 } 303 304 imsg_event_add(&c->iev); 305} 306 307void 308control_imsg_forward(struct imsg *imsg) 309{ 310 struct ctl_conn *c; 311 312 TAILQ_FOREACH(c, &ctl_conns, entry) 313 if (c->flags & CTL_CONN_NOTIFY) 314 imsg_compose(&c->iev.ibuf, imsg->hdr.type, 315 0, imsg->hdr.pid, -1, imsg->data, 316 imsg->hdr.len - IMSG_HEADER_SIZE); 317} 318