control.c revision 1.19
1/* $OpenBSD: control.c,v 1.19 2015/10/22 15:55:18 reyk Exp $ */ 2 3/* 4 * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org> 5 * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> 6 * 7 * Permission to use, copy, modify, and distribute this software for any 8 * purpose with or without fee is hereby granted, provided that the above 9 * copyright notice and this permission notice appear in all copies. 10 * 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 */ 19 20#include <sys/queue.h> 21#include <sys/stat.h> 22#include <sys/socket.h> 23#include <sys/un.h> 24#include <sys/tree.h> 25 26#include <net/if.h> 27 28#include <errno.h> 29#include <event.h> 30#include <fcntl.h> 31#include <stdlib.h> 32#include <string.h> 33#include <unistd.h> 34#include <signal.h> 35 36#include "iked.h" 37 38#define CONTROL_BACKLOG 5 39 40struct ctl_connlist ctl_conns; 41 42void 43 control_accept(int, short, void *); 44struct ctl_conn 45 *control_connbyfd(int); 46void control_close(int, struct control_sock *); 47void control_dispatch_imsg(int, short, void *); 48void control_dispatch_parent(int, short, void *); 49void control_imsg_forward(struct imsg *); 50void control_run(struct privsep *, struct privsep_proc *, void *); 51 52static struct privsep_proc procs[] = { 53 { "parent", PROC_PARENT, NULL } 54}; 55 56pid_t 57control(struct privsep *ps, struct privsep_proc *p) 58{ 59 return (proc_run(ps, p, procs, nitems(procs), control_run, NULL)); 60} 61 62void 63control_run(struct privsep *ps, struct privsep_proc *p, void *arg) 64{ 65 /* 66 * pledge in the control process: 67 * stdio - for malloc and basic I/O including events. 68 * cpath - for unlinking the control socket. 69 * unix - for the control socket. 70 */ 71 if (pledge("stdio cpath unix", NULL) == -1) 72 fatal("pledge"); 73} 74 75int 76control_init(struct privsep *ps, struct control_sock *cs) 77{ 78 struct iked *env = ps->ps_env; 79 struct sockaddr_un sun; 80 int fd; 81 mode_t old_umask, mode; 82 83 if (cs->cs_name == NULL) 84 return (0); 85 86 if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) { 87 log_warn("%s: socket", __func__); 88 return (-1); 89 } 90 91 sun.sun_family = AF_UNIX; 92 if (strlcpy(sun.sun_path, cs->cs_name, 93 sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) { 94 log_warn("%s: %s name too long", __func__, cs->cs_name); 95 close(fd); 96 return (-1); 97 } 98 99 if (unlink(cs->cs_name) == -1) 100 if (errno != ENOENT) { 101 log_warn("%s: unlink %s", __func__, cs->cs_name); 102 close(fd); 103 return (-1); 104 } 105 106 if (cs->cs_restricted) { 107 old_umask = umask(S_IXUSR|S_IXGRP|S_IXOTH); 108 mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH; 109 } else { 110 old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH); 111 mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP; 112 } 113 114 if (bind(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) { 115 log_warn("%s: bind: %s", __func__, cs->cs_name); 116 close(fd); 117 (void)umask(old_umask); 118 return (-1); 119 } 120 (void)umask(old_umask); 121 122 if (chmod(cs->cs_name, mode) == -1) { 123 log_warn("%s: chmod", __func__); 124 close(fd); 125 (void)unlink(cs->cs_name); 126 return (-1); 127 } 128 129 socket_set_blockmode(fd, BM_NONBLOCK); 130 cs->cs_fd = fd; 131 cs->cs_env = env; 132 133 return (0); 134} 135 136int 137control_listen(struct control_sock *cs) 138{ 139 if (cs->cs_name == NULL) 140 return (0); 141 142 if (listen(cs->cs_fd, CONTROL_BACKLOG) == -1) { 143 log_warn("%s: listen", __func__); 144 return (-1); 145 } 146 147 event_set(&cs->cs_ev, cs->cs_fd, EV_READ, 148 control_accept, cs); 149 event_add(&cs->cs_ev, NULL); 150 evtimer_set(&cs->cs_evt, control_accept, cs); 151 152 return (0); 153} 154 155void 156control_cleanup(struct control_sock *cs) 157{ 158 if (cs->cs_name == NULL) 159 return; 160 event_del(&cs->cs_ev); 161 event_del(&cs->cs_evt); 162 (void)unlink(cs->cs_name); 163} 164 165/* ARGSUSED */ 166void 167control_accept(int listenfd, short event, void *arg) 168{ 169 struct control_sock *cs = arg; 170 int connfd; 171 socklen_t len; 172 struct sockaddr_un sun; 173 struct ctl_conn *c; 174 175 event_add(&cs->cs_ev, NULL); 176 if ((event & EV_TIMEOUT)) 177 return; 178 179 len = sizeof(sun); 180 if ((connfd = accept(listenfd, 181 (struct sockaddr *)&sun, &len)) == -1) { 182 /* 183 * Pause accept if we are out of file descriptors, or 184 * libevent will haunt us here too. 185 */ 186 if (errno == ENFILE || errno == EMFILE) { 187 struct timeval evtpause = { 1, 0 }; 188 189 event_del(&cs->cs_ev); 190 evtimer_add(&cs->cs_evt, &evtpause); 191 } else if (errno != EWOULDBLOCK && errno != EINTR && 192 errno != ECONNABORTED) 193 log_warn("%s: accept", __func__); 194 return; 195 } 196 197 socket_set_blockmode(connfd, BM_NONBLOCK); 198 199 if ((c = calloc(1, sizeof(struct ctl_conn))) == NULL) { 200 log_warn("%s", __func__); 201 close(connfd); 202 return; 203 } 204 205 imsg_init(&c->iev.ibuf, connfd); 206 c->iev.handler = control_dispatch_imsg; 207 c->iev.events = EV_READ; 208 c->iev.data = cs; 209 event_set(&c->iev.ev, c->iev.ibuf.fd, c->iev.events, 210 c->iev.handler, c->iev.data); 211 event_add(&c->iev.ev, NULL); 212 213 TAILQ_INSERT_TAIL(&ctl_conns, c, entry); 214} 215 216struct ctl_conn * 217control_connbyfd(int fd) 218{ 219 struct ctl_conn *c; 220 221 for (c = TAILQ_FIRST(&ctl_conns); c != NULL && c->iev.ibuf.fd != fd; 222 c = TAILQ_NEXT(c, entry)) 223 ; /* nothing */ 224 225 return (c); 226} 227 228void 229control_close(int fd, struct control_sock *cs) 230{ 231 struct ctl_conn *c; 232 233 if ((c = control_connbyfd(fd)) == NULL) { 234 log_warn("%s: fd %d: not found", __func__, fd); 235 return; 236 } 237 238 msgbuf_clear(&c->iev.ibuf.w); 239 TAILQ_REMOVE(&ctl_conns, c, entry); 240 241 event_del(&c->iev.ev); 242 close(c->iev.ibuf.fd); 243 244 /* Some file descriptors are available again. */ 245 if (evtimer_pending(&cs->cs_evt, NULL)) { 246 evtimer_del(&cs->cs_evt); 247 event_add(&cs->cs_ev, NULL); 248 } 249 250 free(c); 251} 252 253/* ARGSUSED */ 254void 255control_dispatch_imsg(int fd, short event, void *arg) 256{ 257 struct control_sock *cs = arg; 258 struct iked *env = cs->cs_env; 259 struct ctl_conn *c; 260 struct imsg imsg; 261 int n, v; 262 263 if ((c = control_connbyfd(fd)) == NULL) { 264 log_warn("%s: fd %d: not found", __func__, fd); 265 return; 266 } 267 268 if (event & EV_READ) { 269 if ((n = imsg_read(&c->iev.ibuf)) == -1 || n == 0) { 270 control_close(fd, cs); 271 return; 272 } 273 } 274 if (event & EV_WRITE) { 275 if (msgbuf_write(&c->iev.ibuf.w) <= 0 && errno != EAGAIN) { 276 control_close(fd, cs); 277 return; 278 } 279 } 280 281 for (;;) { 282 if ((n = imsg_get(&c->iev.ibuf, &imsg)) == -1) { 283 control_close(fd, cs); 284 return; 285 } 286 287 if (n == 0) 288 break; 289 290 control_imsg_forward(&imsg); 291 292 switch (imsg.hdr.type) { 293 case IMSG_CTL_NOTIFY: 294 if (c->flags & CTL_CONN_NOTIFY) { 295 log_debug("%s: " 296 "client requested notify more than once", 297 __func__); 298 imsg_compose_event(&c->iev, IMSG_CTL_FAIL, 299 0, 0, -1, NULL, 0); 300 break; 301 } 302 c->flags |= CTL_CONN_NOTIFY; 303 break; 304 case IMSG_CTL_VERBOSE: 305 IMSG_SIZE_CHECK(&imsg, &v); 306 307 memcpy(&v, imsg.data, sizeof(v)); 308 log_verbose(v); 309 310 proc_forward_imsg(&env->sc_ps, &imsg, PROC_PARENT, -1); 311 proc_forward_imsg(&env->sc_ps, &imsg, PROC_IKEV2, -1); 312 break; 313 case IMSG_CTL_RELOAD: 314 case IMSG_CTL_RESET: 315 case IMSG_CTL_COUPLE: 316 case IMSG_CTL_DECOUPLE: 317 case IMSG_CTL_ACTIVE: 318 case IMSG_CTL_PASSIVE: 319 proc_forward_imsg(&env->sc_ps, &imsg, PROC_PARENT, -1); 320 break; 321 default: 322 log_debug("%s: error handling imsg %d", 323 __func__, imsg.hdr.type); 324 break; 325 } 326 imsg_free(&imsg); 327 } 328 329 imsg_event_add(&c->iev); 330} 331 332void 333control_imsg_forward(struct imsg *imsg) 334{ 335 struct ctl_conn *c; 336 337 TAILQ_FOREACH(c, &ctl_conns, entry) 338 if (c->flags & CTL_CONN_NOTIFY) 339 imsg_compose_event(&c->iev, imsg->hdr.type, 340 0, imsg->hdr.pid, -1, imsg->data, 341 imsg->hdr.len - IMSG_HEADER_SIZE); 342} 343