xref: /onnv-gate/usr/src/cmd/ipf/svc/ipfd.c (revision 8823:000507e9108d)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * This file delivers svc.ipfd, the daemon that monitors changes to
 * firewall capable services and requests IPfilter configuration update
 * on behalf of the service. Essentially, the daemon listens for
 * service changes and forks the program that update a service's
 * IPfilter configuration.
 *
 * - A firewall capable SMF service can restrict network access to its
 *   service by providing a firewall policy that can be translated into
 *   a set of IPfilter rules. The mentioned firewall policy is stored in
 *   firewall_config and firewall_context property groups. If one of these
 *   two property groups exist, the service is considered to be firewall
 *   capable.
 *
 * - A request to update service's IPfilter configuration is made for
 *   actions that affect service's configuration or running state. The
 *   actions are:
 *	- enable/disable
 *	- refresh/restart
 *	- maintenance/clear maintenance
 *
 * Lacking a generic SMF mechanism to observe service state changes, the
 * daemon observe change events by listening to changes to 'general',
 * 'general_ovr', and 'restarter_actions' property groups. This is not a
 * stable interface and should be replaced when a SMF supported mechanism
 * becomes available.
 *
 * - The program responsible for updating service's IPfilter configuration
 *   is /lib/svc/method/ipfilter. This program is called as:
 *
 *   /lib/svc/method/ipfilter fw_update fmri
 *
 *   where fmri the instance fmri of the service to be updated.
 */

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <assert.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <umem.h>
#include <libscf.h>
#include <libscf_priv.h>
#include <signal.h>
#include <string.h>
#include <syslog.h>

#define	IPFILTER_FMRI		"svc:/network/ipfilter:default"
#define	RPCBIND_FMRI		"svc:/network/rpc/bind:default"
#define	IPF_UPDATE_CMD		"/lib/svc/method/ipfilter"

#define	SCF_SNAPSHOT_RUNNING	"running"
#define	SCF_PG_FW_CONTEXT	"firewall_context"
#define	SCF_PG_FW_CONFIG	"firewall_config"
#define	SCF_PG_REFRESH		"refresh"
#define	SCF_PG_INETD		"inetd"

#define	SCF_PROPERTY_ISRPC	"isrpc"

#define	MAX_RETRY		7
#define	DEV_NULL		"/dev/null"

static scf_handle_t *h;
static ssize_t max_scf_fmri_size;
static ssize_t max_scf_name_size;

static scf_instance_t *inst;
static scf_snapshot_t *snap;
static scf_propertygroup_t *scratch_pg;
static scf_property_t *scratch_prop;
static scf_value_t *scratch_v;

static char *scratch_fmri;
static char *scratch_name;

static const char *all_props[] = {
	SCF_PROPERTY_REFRESH, SCF_PROPERTY_RESTART, SCF_PROPERTY_MAINT_ON,
	SCF_PROPERTY_MAINT_ON_IMMEDIATE, SCF_PROPERTY_MAINT_ON_IMMTEMP,
	SCF_PROPERTY_MAINT_ON_TEMPORARY, SCF_PROPERTY_MAINT_OFF
};
#define	ALL_PROPS_CNT		7

static const char *maint_props[] = {
	SCF_PROPERTY_REFRESH, SCF_PROPERTY_RESTART, SCF_PROPERTY_MAINT_OFF };
#define	MAINT_PROPS_CNT		3

static int ipfilter_update(const char *);

static int
daemonize_self(void)
{
	pid_t pid;
	int fd;

	(void) close(STDIN_FILENO);

	if ((fd = open(DEV_NULL, O_RDONLY)) == -1) {
		(void) printf("Could not open /dev/null: %s\n",
		    strerror(errno));
	} else if (fd != STDIN_FILENO) {
		(void) dup2(fd, STDIN_FILENO);
		(void) close(fd);
	}
	(void) dup2(STDERR_FILENO, STDOUT_FILENO);
	closefrom(3);

	if ((pid = fork1()) < 0) {
		(void) printf("fork() failed: %s\n", strerror(errno));
		return (1);
	}

	if (pid != 0)
		exit(0);

	(void) setsid();
	(void) chdir("/");

	return (0);
}

static void
repository_rebind(scf_handle_t *hndl)
{
	int c = 0;

	(void) scf_handle_unbind(hndl);
	while ((scf_handle_bind(hndl)) != 0) {
		if (c > MAX_RETRY) {
			syslog(LOG_ERR | LOG_DAEMON, "Repository access "
			    "unavailable. Couldn't bind handle: %s\n",
			    scf_strerror(scf_error()));
			syslog(LOG_ERR | LOG_DAEMON, "Service specific"
			    "IPfilter configuration may not be updated "
			    "properly\n");

			exit(1);
		} else {
			c++;
		}

		(void) sleep(1);
	}
}

static void
repository_notify_setup(scf_handle_t *h)
{
	for (;;) {
		if (_scf_notify_add_pgtype(h, SCF_GROUP_FRAMEWORK) ==
		    SCF_SUCCESS)
			break;

		switch (scf_error()) {
		case SCF_ERROR_CONNECTION_BROKEN:
			repository_rebind(h);
			break;

		case SCF_ERROR_NO_RESOURCES:
			(void) sleep(1);
			break;

		default:
			syslog(LOG_ERR | LOG_DAEMON,
			    "Abort: Couldn't set up repository notification "
			    "for pg type %s: %s\n", SCF_GROUP_FRAMEWORK,
			    scf_strerror(scf_error()));
			abort();
		}
	}
}

/*
 * If the repository connection is lost, rebind and re-setup repository
 * notification. During the repository connection outage, services that
 * changed states wouldn't get the corresponding firewall update. To make
 * we're not out of sync, update the entire system firewall configuration,
 * invoke ipfilter_update(IPFILTER_FMRI).
 */
static void
repository_setup()
{
	repository_rebind(h);
	repository_notify_setup(h);
	if (ipfilter_update(IPFILTER_FMRI) == -1) {
		syslog(LOG_ERR | LOG_DAEMON,
		    "Failed to reconfigure system firewall.\n");
	}
}

static int
pg_get_prop_value(const scf_propertygroup_t *pg, const char *pname,
    scf_value_t *v)
{
	if (pg == NULL || pname == NULL || v == NULL)
		return (-1);

	if (scf_pg_get_property(pg, pname, scratch_prop) == -1 ||
	    scf_property_get_value(scratch_prop, v) == -1) {
		switch (scf_error()) {
		case SCF_ERROR_NOT_FOUND:
		case SCF_ERROR_DELETED:
			break;

		default:
			syslog(LOG_ERR | LOG_DAEMON,
			    "scf_pg_get_property failed for %s: %s\n",
			    pname, scf_strerror(scf_error()));
		}
		return (-1);
	}
	return (0);
}

static int
is_correct_event(const char *fmri, const scf_propertygroup_t *pg,
    const boolean_t isrpc)
{
	char *state = NULL;
	const char **proplist = all_props;
	int prop_cnt = ALL_PROPS_CNT;

	int i, ret = 0;

	if (scf_pg_get_name(pg, scratch_name, max_scf_name_size) < 0) {
		syslog(LOG_ERR | LOG_DAEMON, "scf_pg_get_name failed: %s\n",
		    scf_strerror(scf_error()));
		return (-1);
	}

	/*
	 * We care about enable, disable, and refresh since that's
	 * when we activate, deactivate, or change firewall policy.
	 *
	 *  - enable/disable -> change in "general" or "general_ovr"
	 *  - refresh/restart -> change in "restarter_actions"
	 */
	if (strcmp(scratch_name, SCF_PG_GENERAL) == 0 ||
	    strcmp(scratch_name, SCF_PG_GENERAL_OVR) == 0) {
		syslog(LOG_DEBUG | LOG_DAEMON, "Action: %s", scratch_name);
		return (1);
	}

	if ((state = smf_get_state(fmri)) == NULL) {
		syslog(LOG_ERR | LOG_DAEMON, "smf_get_state failed for %s: "
		    "%s\n", fmri, scf_strerror(scf_error()));
		return (-1);
	}

	syslog(LOG_DEBUG | LOG_DAEMON, "%s STATE: %s \n", fmri, state);
	if (strcmp(state, SCF_STATE_STRING_MAINT) == 0) {
		proplist = maint_props;
		prop_cnt = MAINT_PROPS_CNT;
	}

	/*
	 * Only concerned with refresh, restart, and maint on|off actions.
	 * RPC services are restarted whenever rpc/bind restarts so it's
	 * an automatic valid event for RPC services.
	 */
	if (isrpc) {
		ret = 1;
		goto out;
	} else if (strcmp(scratch_name, SCF_PG_RESTARTER_ACTIONS) == 0) {
		for (i = 0; i < prop_cnt; i++) {
			if (pg_get_prop_value(pg, proplist[i],
			    scratch_v) == 0) {
				syslog(LOG_DEBUG | LOG_DAEMON, "Action: %s/%s",
				    scratch_name, proplist[i]);

				ret = 1;
				goto out;
			}
		}
	}

out:
	if (state)
		free(state);

	return (ret);
}

static int
ipfilter_update(const char *fmri)
{
	pid_t pid;
	int status, ret = 0;

	syslog(LOG_DEBUG | LOG_DAEMON, "ipfilter_update: %s\n", fmri);

	/*
	 * Start refresh in another process
	 */
	if ((pid = fork1()) < 0) {
		syslog(LOG_ERR | LOG_DAEMON, "Couldn't fork to refresh "
		    "ipfilter for %s: %s", fmri, strerror(errno));
		ret = 1;
		goto out;
	}

	if (pid == 0) {
		if (execl(IPF_UPDATE_CMD, IPF_UPDATE_CMD, "fw_update", fmri,
		    NULL) == -1)
			syslog(LOG_ERR | LOG_DAEMON, "execl() failed for "
			    "%s: %s", fmri, strerror(errno));

		exit(1);
	}

	/*
	 * Parent - only one update at a time.
	 */
	(void) wait(&status);
	if (!WIFEXITED(status) || WEXITSTATUS(status) != 0)
		ret = 1;

out:
	if (ret == 1)
		syslog(LOG_ERR | LOG_DAEMON, "Firewall update failed "
		    "for: %s\n", fmri);

	return (ret);
}

/*
 * Determine whether a given instance is a RPC service. Repository and
 * libscf errors are treated as if the service isn't an RPC service,
 * returning B_FALSE to indicate validation failure.
 */
static boolean_t
service_is_rpc(const scf_instance_t *inst)
{
	scf_snapshot_t *lsnap = NULL;
	uint8_t	isrpc;

	if (scf_instance_get_snapshot(inst, SCF_SNAPSHOT_RUNNING, snap) != 0) {
		syslog(LOG_DEBUG | LOG_DAEMON,
		    "Could not get running snapshot, using editing value\n");
	} else {
		lsnap = snap;
	}

	if (scf_instance_get_pg_composed(inst, lsnap, SCF_PG_INETD,
	    scratch_pg) == -1) {
		switch (scf_error()) {
		case SCF_ERROR_NOT_FOUND:
		case SCF_ERROR_DELETED:
			break;

		default:
			syslog(LOG_ERR | LOG_DAEMON,
			    "scf_instance_get_pg_composed failed: %s\n",
			    scf_strerror(scf_error()));
			return (B_FALSE);
		}

		if (scf_instance_get_pg_composed(inst, lsnap,
		    SCF_PG_FW_CONTEXT, scratch_pg) == -1) {
			switch (scf_error()) {
			case SCF_ERROR_NOT_FOUND:
			case SCF_ERROR_DELETED:
				break;

			default:
				syslog(LOG_ERR | LOG_DAEMON,
				    "scf_instance_get_pg_composed failed: %s\n",
				    scf_strerror(scf_error()));
			}
			return (B_FALSE);
		}
	}

	if (pg_get_prop_value(scratch_pg, SCF_PROPERTY_ISRPC, scratch_v) == -1)
		return (B_FALSE);

	if (scf_value_get_boolean(scratch_v, &isrpc) == -1) {
		syslog(LOG_ERR | LOG_DAEMON, "scf_value_get_boolean failed: "
		    "%s\n", scf_strerror(scf_error()));
		return (B_FALSE);
	}

	if (isrpc)
		return (B_TRUE);
	else
		return (B_FALSE);
}

static int
instance_has_firewall(scf_instance_t *inst)
{
	scf_snapshot_t *lsnap = NULL;

	if (scf_instance_get_snapshot(inst, SCF_SNAPSHOT_RUNNING, snap) == -1) {
		switch (scf_error()) {
		case SCF_ERROR_CONNECTION_BROKEN:
			syslog(LOG_ERR | LOG_DAEMON,
			    "scf_instance_get_snapshot failed: %s\n",
			    scf_strerror(scf_error()));
			repository_setup();
			return (-1);

		case SCF_ERROR_DELETED:
		default:
			/*
			 * If running snapshot is not available for
			 * other reasons, fall back to current values.
			 */
			syslog(LOG_DEBUG | LOG_DAEMON, "Could not get "
			    "running snapshot, using current value\n");
		}
	} else {
		lsnap = snap;
	}

	/*
	 * Update service's IPfilter configuration if either
	 * SCF_PG_FW_CONTEXT or SCF_PG_FW_CONFIG exists.
	 */
	if (scf_instance_get_pg_composed(inst, lsnap, SCF_PG_FW_CONTEXT,
	    scratch_pg) == 0) {
		return (1);
	} else {
		switch (scf_error()) {
		case SCF_ERROR_NOT_FOUND:
		case SCF_ERROR_DELETED:
			break;

		case SCF_ERROR_CONNECTION_BROKEN:
			repository_setup();
			/* FALLTHROUGH */
		default:
			syslog(LOG_ERR | LOG_DAEMON,
			    "scf_instance_get_pg_composed failed: %s\n",
			    scf_strerror(scf_error()));
			return (-1);
		}
	}

	if (scf_instance_get_pg_composed(inst, lsnap, SCF_PG_FW_CONFIG,
	    scratch_pg) == -1) {
		/*
		 * It's either a non-firewall service or a failure to
		 * read firewall pg, just continue and listen for
		 * future events.
		 */
		switch (scf_error()) {
		case SCF_ERROR_NOT_FOUND:
		case SCF_ERROR_DELETED:
			return (0);

		case SCF_ERROR_CONNECTION_BROKEN:
			repository_setup();
			/* FALLTHROUGH */
		default:
			syslog(LOG_ERR | LOG_DAEMON,
			    "scf_instance_get_pg_composed failed: %s\n",
			    scf_strerror(scf_error()));
			return (-1);
		}
	}
	return (1);
}

static int
repository_event_process(scf_propertygroup_t *pg)
{
	boolean_t isrpc = B_FALSE;
	int res;

	/*
	 * Figure out it's a firewall capable instance and call ipfilter_update
	 * if it is.
	 */
	if (scf_pg_get_parent_instance(pg, inst) == -1) {
		/* Not an error if pg doesn't belong to a valid instance */
		if (scf_error() == SCF_ERROR_CONSTRAINT_VIOLATED) {
			return (0);
		}

		syslog(LOG_ERR | LOG_DAEMON, "scf_pg_get_parent_instance "
		    "failed: %s\n", scf_strerror(scf_error()));

		if (scf_error() == SCF_ERROR_CONNECTION_BROKEN)
			repository_setup();

		return (1);
	}

	if (scf_instance_to_fmri(inst, scratch_fmri, max_scf_fmri_size) == -1) {
		syslog(LOG_ERR | LOG_DAEMON, "scf_instance_to_fmri "
		    "failed: %s\n", scf_strerror(scf_error()));

		if (scf_error() == SCF_ERROR_CONNECTION_BROKEN)
			repository_setup();

		return (1);
	}

	if (strcmp(scratch_fmri, IPFILTER_FMRI) == 0) {
		return (0);
	}

	isrpc = service_is_rpc(inst);

	/*
	 * If it's not an event we're interested in, returns success.
	 */
	res = is_correct_event(scratch_fmri, pg, isrpc);
	if (res == -1) {
		syslog(LOG_ERR | LOG_DAEMON,
		    "is_correct_event failed for %s.\n", scratch_fmri);
		return (1);
	} else if (res == 0) {
		return (0);
	}

	/*
	 * Proceed only if instance has firewall policy.
	 */
	res = instance_has_firewall(inst);
	if (res == -1) {
		syslog(LOG_ERR | LOG_DAEMON,
		    "instance_has_firewall failed for %s.\n", scratch_fmri);
		return (1);
	} else if (res == 0) {
		return (0);
	}

	if (ipfilter_update(scratch_fmri) == -1) {
		return (1);
	}

	return (0);
}

static int
repository_event_wait()
{
	scf_propertygroup_t *pg;
	char *fmri, *scratch;
	const char *inst_name, *pg_name;
	ssize_t res;

	if ((fmri = umem_alloc(max_scf_fmri_size, UMEM_DEFAULT)) == NULL) {
		syslog(LOG_ERR | LOG_DAEMON, "Out of memory");
		return (1);
	}

	if ((scratch = umem_alloc(max_scf_fmri_size, UMEM_DEFAULT)) == NULL) {
		syslog(LOG_ERR | LOG_DAEMON, "Out of memory");
		return (1);
	}

	if ((pg = scf_pg_create(h)) == NULL) {
		syslog(LOG_ERR | LOG_DAEMON, "scf_pg_create failed: %s\n",
		    scf_strerror(scf_error()));
		return (1);
	}

	repository_notify_setup(h);

	for (;;) {
		/*
		 * Calling _scf_notify_wait which will block this thread
		 * until it's notified of a framework event.
		 *
		 * Note: fmri is only set on delete events.
		 */
		res = _scf_notify_wait(pg, fmri, max_scf_fmri_size);
		if (res < 0) {
			syslog(LOG_ERR | LOG_DAEMON, "_scf_notify_wait "
			    "failed: %s\n", scf_strerror(scf_error()));
			repository_setup();
		} else if (res == 0) {
			if (repository_event_process(pg))
				syslog(LOG_ERR | LOG_DAEMON, "Service may have "
				    "incorrect IPfilter configuration\n");
		} else {
			/*
			 * The received event is a deletion of a service,
			 * instance or pg. If it's a deletion of an instance,
			 * update the instance's IPfilter configuration.
			 */
			syslog(LOG_DEBUG | LOG_DAEMON, "Deleted: %s", fmri);

			(void) strlcpy(scratch, fmri, max_scf_fmri_size);
			if (scf_parse_svc_fmri(scratch, NULL, NULL, &inst_name,
			    &pg_name, NULL) != SCF_SUCCESS)
				continue;

			if (inst_name != NULL && pg_name == NULL) {
				(void) ipfilter_update(fmri);
			}
		}
	}

	/*NOTREACHED*/
}

int
main()
{
	if (daemonize_self() == 1)
		return (1);

	max_scf_fmri_size = scf_limit(SCF_LIMIT_MAX_FMRI_LENGTH) + 1;
	max_scf_name_size = scf_limit(SCF_LIMIT_MAX_NAME_LENGTH) + 1;

	assert(max_scf_fmri_size > 0);
	assert(max_scf_name_size > 0);

	if ((h = scf_handle_create(SCF_VERSION)) == NULL) {
		syslog(LOG_ERR | LOG_DAEMON, "scf_handle_create failed: %s\n",
		    scf_strerror(scf_error()));
		return (1);
	}

	repository_rebind(h);

	scratch_fmri = umem_alloc(max_scf_fmri_size, UMEM_DEFAULT);
	scratch_name = umem_alloc(max_scf_name_size, UMEM_DEFAULT);

	if (scratch_fmri == NULL || scratch_name == NULL) {
		syslog(LOG_ERR | LOG_DAEMON, "Out of memory");
		return (1);
	}

	inst = scf_instance_create(h);
	snap = scf_snapshot_create(h);
	scratch_pg = scf_pg_create(h);
	scratch_prop = scf_property_create(h);
	scratch_v = scf_value_create(h);

	if (inst == NULL || snap == NULL || scratch_pg == NULL ||
	    scratch_prop == NULL || scratch_v == NULL) {
		syslog(LOG_ERR | LOG_DAEMON, "Initialization failed: %s\n",
		    scf_strerror(scf_error()));
		return (1);
	}

	return (repository_event_wait());
}