1 /* $OpenBSD: control.c,v 1.15 2014/06/03 06:25:47 yasuoka Exp $ */ 2 3 /* 4 * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org> 5 * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> 6 * 7 * Permission to use, copy, modify, and distribute this software for any 8 * purpose with or without fee is hereby granted, provided that the above 9 * copyright notice and this permission notice appear in all copies. 10 * 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 */ 19 20 #include <sys/queue.h> 21 #include <sys/param.h> 22 #include <sys/stat.h> 23 #include <sys/socket.h> 24 #include <sys/un.h> 25 #include <sys/tree.h> 26 27 #include <net/if.h> 28 29 #include <errno.h> 30 #include <event.h> 31 #include <fcntl.h> 32 #include <stdlib.h> 33 #include <string.h> 34 #include <unistd.h> 35 #include <signal.h> 36 37 #include "iked.h" 38 39 #define CONTROL_BACKLOG 5 40 41 struct ctl_connlist ctl_conns; 42 43 void 44 control_accept(int, short, void *); 45 struct ctl_conn 46 *control_connbyfd(int); 47 void control_close(int, struct control_sock *); 48 void control_dispatch_imsg(int, short, void *); 49 void control_imsg_forward(struct imsg *); 50 51 int 52 control_init(struct privsep *ps, struct control_sock *cs) 53 { 54 struct iked *env = ps->ps_env; 55 struct sockaddr_un sun; 56 int fd; 57 mode_t old_umask, mode; 58 59 if (cs->cs_name == NULL) 60 return (0); 61 62 if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) { 63 log_warn("%s: socket", __func__); 64 return (-1); 65 } 66 67 sun.sun_family = AF_UNIX; 68 if (strlcpy(sun.sun_path, cs->cs_name, 69 sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) { 70 log_warn("%s: %s name too long", __func__, cs->cs_name); 71 close(fd); 72 return (-1); 73 } 74 75 if (unlink(cs->cs_name) == -1) 76 if (errno != ENOENT) { 77 log_warn("%s: unlink %s", __func__, cs->cs_name); 78 close(fd); 79 return (-1); 80 } 81 82 if (cs->cs_restricted) { 83 old_umask = umask(S_IXUSR|S_IXGRP|S_IXOTH); 84 mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH; 85 } else { 86 old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH); 87 mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP; 88 } 89 90 if (bind(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) { 91 log_warn("%s: bind: %s", __func__, cs->cs_name); 92 close(fd); 93 (void)umask(old_umask); 94 return (-1); 95 } 96 (void)umask(old_umask); 97 98 if (chmod(cs->cs_name, mode) == -1) { 99 log_warn("%s: chmod", __func__); 100 close(fd); 101 (void)unlink(cs->cs_name); 102 return (-1); 103 } 104 105 socket_set_blockmode(fd, BM_NONBLOCK); 106 cs->cs_fd = fd; 107 cs->cs_env = env; 108 109 return (0); 110 } 111 112 int 113 control_listen(struct control_sock *cs) 114 { 115 if (cs->cs_name == NULL) 116 return (0); 117 118 if (listen(cs->cs_fd, CONTROL_BACKLOG) == -1) { 119 log_warn("%s: listen", __func__); 120 return (-1); 121 } 122 123 event_set(&cs->cs_ev, cs->cs_fd, EV_READ, 124 control_accept, cs); 125 event_add(&cs->cs_ev, NULL); 126 evtimer_set(&cs->cs_evt, control_accept, cs); 127 128 return (0); 129 } 130 131 void 132 control_cleanup(struct control_sock *cs) 133 { 134 if (cs->cs_name == NULL) 135 return; 136 event_del(&cs->cs_ev); 137 event_del(&cs->cs_evt); 138 (void)unlink(cs->cs_name); 139 } 140 141 /* ARGSUSED */ 142 void 143 control_accept(int listenfd, short event, void *arg) 144 { 145 struct control_sock *cs = arg; 146 int connfd; 147 socklen_t len; 148 struct sockaddr_un sun; 149 struct ctl_conn *c; 150 151 event_add(&cs->cs_ev, NULL); 152 if ((event & EV_TIMEOUT)) 153 return; 154 155 len = sizeof(sun); 156 if ((connfd = accept(listenfd, 157 (struct sockaddr *)&sun, &len)) == -1) { 158 /* 159 * Pause accept if we are out of file descriptors, or 160 * libevent will haunt us here too. 161 */ 162 if (errno == ENFILE || errno == EMFILE) { 163 struct timeval evtpause = { 1, 0 }; 164 165 event_del(&cs->cs_ev); 166 evtimer_add(&cs->cs_evt, &evtpause); 167 } else if (errno != EWOULDBLOCK && errno != EINTR && 168 errno != ECONNABORTED) 169 log_warn("%s: accept", __func__); 170 return; 171 } 172 173 socket_set_blockmode(connfd, BM_NONBLOCK); 174 175 if ((c = calloc(1, sizeof(struct ctl_conn))) == NULL) { 176 log_warn("%s", __func__); 177 close(connfd); 178 return; 179 } 180 181 imsg_init(&c->iev.ibuf, connfd); 182 c->iev.handler = control_dispatch_imsg; 183 c->iev.events = EV_READ; 184 c->iev.data = cs; 185 event_set(&c->iev.ev, c->iev.ibuf.fd, c->iev.events, 186 c->iev.handler, c->iev.data); 187 event_add(&c->iev.ev, NULL); 188 189 TAILQ_INSERT_TAIL(&ctl_conns, c, entry); 190 } 191 192 struct ctl_conn * 193 control_connbyfd(int fd) 194 { 195 struct ctl_conn *c; 196 197 for (c = TAILQ_FIRST(&ctl_conns); c != NULL && c->iev.ibuf.fd != fd; 198 c = TAILQ_NEXT(c, entry)) 199 ; /* nothing */ 200 201 return (c); 202 } 203 204 void 205 control_close(int fd, struct control_sock *cs) 206 { 207 struct ctl_conn *c; 208 209 if ((c = control_connbyfd(fd)) == NULL) { 210 log_warn("%s: fd %d: not found", __func__, fd); 211 return; 212 } 213 214 msgbuf_clear(&c->iev.ibuf.w); 215 TAILQ_REMOVE(&ctl_conns, c, entry); 216 217 event_del(&c->iev.ev); 218 close(c->iev.ibuf.fd); 219 220 /* Some file descriptors are available again. */ 221 if (evtimer_pending(&cs->cs_evt, NULL)) { 222 evtimer_del(&cs->cs_evt); 223 event_add(&cs->cs_ev, NULL); 224 } 225 226 free(c); 227 } 228 229 /* ARGSUSED */ 230 void 231 control_dispatch_imsg(int fd, short event, void *arg) 232 { 233 struct control_sock *cs = arg; 234 struct iked *env = cs->cs_env; 235 struct ctl_conn *c; 236 struct imsg imsg; 237 int n, v; 238 239 if ((c = control_connbyfd(fd)) == NULL) { 240 log_warn("%s: fd %d: not found", __func__, fd); 241 return; 242 } 243 244 if (event & EV_READ) { 245 if ((n = imsg_read(&c->iev.ibuf)) == -1 || n == 0) { 246 control_close(fd, cs); 247 return; 248 } 249 } 250 if (event & EV_WRITE) { 251 if (msgbuf_write(&c->iev.ibuf.w) <= 0 && errno != EAGAIN) { 252 control_close(fd, cs); 253 return; 254 } 255 } 256 257 for (;;) { 258 if ((n = imsg_get(&c->iev.ibuf, &imsg)) == -1) { 259 control_close(fd, cs); 260 return; 261 } 262 263 if (n == 0) 264 break; 265 266 control_imsg_forward(&imsg); 267 268 switch (imsg.hdr.type) { 269 case IMSG_CTL_NOTIFY: 270 if (c->flags & CTL_CONN_NOTIFY) { 271 log_debug("%s: " 272 "client requested notify more than once", 273 __func__); 274 imsg_compose_event(&c->iev, IMSG_CTL_FAIL, 275 0, 0, -1, NULL, 0); 276 break; 277 } 278 c->flags |= CTL_CONN_NOTIFY; 279 break; 280 case IMSG_CTL_VERBOSE: 281 IMSG_SIZE_CHECK(&imsg, &v); 282 283 memcpy(&v, imsg.data, sizeof(v)); 284 log_verbose(v); 285 286 proc_forward_imsg(&env->sc_ps, &imsg, PROC_PARENT, -1); 287 proc_forward_imsg(&env->sc_ps, &imsg, PROC_IKEV2, -1); 288 proc_forward_imsg(&env->sc_ps, &imsg, PROC_IKEV1, -1); 289 break; 290 case IMSG_CTL_RELOAD: 291 case IMSG_CTL_RESET: 292 case IMSG_CTL_COUPLE: 293 case IMSG_CTL_DECOUPLE: 294 case IMSG_CTL_ACTIVE: 295 case IMSG_CTL_PASSIVE: 296 proc_forward_imsg(&env->sc_ps, &imsg, PROC_PARENT, -1); 297 break; 298 default: 299 log_debug("%s: error handling imsg %d", 300 __func__, imsg.hdr.type); 301 break; 302 } 303 imsg_free(&imsg); 304 } 305 306 imsg_event_add(&c->iev); 307 } 308 309 void 310 control_imsg_forward(struct imsg *imsg) 311 { 312 struct ctl_conn *c; 313 314 TAILQ_FOREACH(c, &ctl_conns, entry) 315 if (c->flags & CTL_CONN_NOTIFY) 316 imsg_compose(&c->iev.ibuf, imsg->hdr.type, 317 0, imsg->hdr.pid, -1, imsg->data, 318 imsg->hdr.len - IMSG_HEADER_SIZE); 319 } 320