1 /* $OpenBSD: control.c,v 1.46 2014/07/11 16:39:10 krw Exp $ */ 2 3 /* 4 * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 #include <sys/queue.h> 20 #include <sys/param.h> 21 #include <sys/stat.h> 22 #include <sys/socket.h> 23 #include <sys/un.h> 24 25 #include <net/if.h> 26 27 #include <errno.h> 28 #include <event.h> 29 #include <fcntl.h> 30 #include <stdlib.h> 31 #include <string.h> 32 #include <unistd.h> 33 #include <signal.h> 34 35 #include <openssl/ssl.h> 36 37 #include "relayd.h" 38 39 #define CONTROL_BACKLOG 5 40 41 struct ctl_connlist ctl_conns; 42 43 void control_accept(int, short, void *); 44 void control_close(int, struct control_sock *); 45 46 int 47 control_init(struct privsep *ps, struct control_sock *cs) 48 { 49 struct relayd *env = ps->ps_env; 50 struct sockaddr_un sun; 51 int fd; 52 mode_t old_umask, mode; 53 54 if (cs->cs_name == NULL) 55 return (0); 56 57 if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) { 58 log_warn("%s: socket", __func__); 59 return (-1); 60 } 61 62 sun.sun_family = AF_UNIX; 63 if (strlcpy(sun.sun_path, cs->cs_name, 64 sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) { 65 log_warn("%s: %s name too long", __func__, cs->cs_name); 66 close(fd); 67 return (-1); 68 } 69 70 if (unlink(cs->cs_name) == -1) 71 if (errno != ENOENT) { 72 log_warn("%s: unlink %s", __func__, cs->cs_name); 73 close(fd); 74 return (-1); 75 } 76 77 if (cs->cs_restricted) { 78 old_umask = umask(S_IXUSR|S_IXGRP|S_IXOTH); 79 mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH; 80 } else { 81 old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH); 82 mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP; 83 } 84 85 if (bind(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) { 86 log_warn("%s: bind: %s", __func__, cs->cs_name); 87 close(fd); 88 (void)umask(old_umask); 89 return (-1); 90 } 91 (void)umask(old_umask); 92 93 if (chmod(cs->cs_name, mode) == -1) { 94 log_warn("%s: chmod", __func__); 95 close(fd); 96 (void)unlink(cs->cs_name); 97 return (-1); 98 } 99 100 socket_set_blockmode(fd, BM_NONBLOCK); 101 cs->cs_fd = fd; 102 cs->cs_env = env; 103 104 return (0); 105 } 106 107 int 108 control_listen(struct control_sock *cs) 109 { 110 if (cs->cs_name == NULL) 111 return (0); 112 113 if (listen(cs->cs_fd, CONTROL_BACKLOG) == -1) { 114 log_warn("%s: listen", __func__); 115 return (-1); 116 } 117 118 event_set(&cs->cs_ev, cs->cs_fd, EV_READ, 119 control_accept, cs); 120 event_add(&cs->cs_ev, NULL); 121 evtimer_set(&cs->cs_evt, control_accept, cs); 122 123 return (0); 124 } 125 126 void 127 control_cleanup(struct control_sock *cs) 128 { 129 if (cs->cs_name == NULL) 130 return; 131 event_del(&cs->cs_ev); 132 event_del(&cs->cs_evt); 133 (void)unlink(cs->cs_name); 134 } 135 136 /* ARGSUSED */ 137 void 138 control_accept(int listenfd, short event, void *arg) 139 { 140 int connfd; 141 socklen_t len; 142 struct sockaddr_un sun; 143 struct ctl_conn *c; 144 struct control_sock *cs = arg; 145 146 event_add(&cs->cs_ev, NULL); 147 if ((event & EV_TIMEOUT)) 148 return; 149 150 len = sizeof(sun); 151 if ((connfd = accept(listenfd, 152 (struct sockaddr *)&sun, &len)) == -1) { 153 /* 154 * Pause accept if we are out of file descriptors, or 155 * libevent will haunt us here too. 156 */ 157 if (errno == ENFILE || errno == EMFILE) { 158 struct timeval evtpause = { 1, 0 }; 159 160 event_del(&cs->cs_ev); 161 evtimer_add(&cs->cs_evt, &evtpause); 162 } else if (errno != EWOULDBLOCK && errno != EINTR && 163 errno != ECONNABORTED) 164 log_warn("%s: accept", __func__); 165 return; 166 } 167 168 socket_set_blockmode(connfd, BM_NONBLOCK); 169 170 if ((c = calloc(1, sizeof(struct ctl_conn))) == NULL) { 171 close(connfd); 172 log_warn("%s: calloc", __func__); 173 return; 174 } 175 176 imsg_init(&c->iev.ibuf, connfd); 177 c->iev.handler = control_dispatch_imsg; 178 c->iev.events = EV_READ; 179 c->iev.data = cs; /* proc.c cheats (reuses the handler) */ 180 event_set(&c->iev.ev, c->iev.ibuf.fd, c->iev.events, 181 c->iev.handler, cs); 182 event_add(&c->iev.ev, NULL); 183 184 TAILQ_INSERT_TAIL(&ctl_conns, c, entry); 185 } 186 187 struct ctl_conn * 188 control_connbyfd(int fd) 189 { 190 struct ctl_conn *c; 191 192 for (c = TAILQ_FIRST(&ctl_conns); c != NULL && c->iev.ibuf.fd != fd; 193 c = TAILQ_NEXT(c, entry)) 194 ; /* nothing */ 195 196 return (c); 197 } 198 199 void 200 control_close(int fd, struct control_sock *cs) 201 { 202 struct ctl_conn *c; 203 204 if ((c = control_connbyfd(fd)) == NULL) { 205 log_warn("%s: fd %d not found", __func__, fd); 206 return; 207 } 208 209 msgbuf_clear(&c->iev.ibuf.w); 210 TAILQ_REMOVE(&ctl_conns, c, entry); 211 212 event_del(&c->iev.ev); 213 close(c->iev.ibuf.fd); 214 215 /* Some file descriptors are available again. */ 216 if (evtimer_pending(&cs->cs_evt, NULL)) { 217 evtimer_del(&cs->cs_evt); 218 event_add(&cs->cs_ev, NULL); 219 } 220 221 free(c); 222 } 223 224 /* ARGSUSED */ 225 void 226 control_dispatch_imsg(int fd, short event, void *arg) 227 { 228 struct control_sock *cs = arg; 229 struct ctl_conn *c; 230 struct imsg imsg; 231 struct ctl_id id; 232 int n; 233 int verbose; 234 struct relayd *env = cs->cs_env; 235 236 if ((c = control_connbyfd(fd)) == NULL) { 237 log_warn("%s: fd %d not found", __func__, fd); 238 return; 239 } 240 241 if (event & EV_READ) { 242 if ((n = imsg_read(&c->iev.ibuf)) == -1 || n == 0) { 243 control_close(fd, cs); 244 return; 245 } 246 } 247 248 if (event & EV_WRITE) { 249 if (msgbuf_write(&c->iev.ibuf.w) <= 0 && errno != EAGAIN) { 250 control_close(fd, cs); 251 return; 252 } 253 } 254 255 for (;;) { 256 if ((n = imsg_get(&c->iev.ibuf, &imsg)) == -1) { 257 control_close(fd, cs); 258 return; 259 } 260 261 if (n == 0) 262 break; 263 264 if (c->waiting) { 265 log_debug("%s: unexpected imsg %d", 266 __func__, imsg.hdr.type); 267 imsg_free(&imsg); 268 control_close(fd, cs); 269 return; 270 } 271 272 switch (imsg.hdr.type) { 273 case IMSG_CTL_SHOW_SUM: 274 show(c); 275 break; 276 case IMSG_CTL_SESSION: 277 show_sessions(c); 278 break; 279 case IMSG_CTL_RDR_DISABLE: 280 if (imsg.hdr.len != IMSG_HEADER_SIZE + sizeof(id)) 281 fatalx("invalid imsg header len"); 282 memcpy(&id, imsg.data, sizeof(id)); 283 if (disable_rdr(c, &id)) 284 imsg_compose_event(&c->iev, IMSG_CTL_FAIL, 285 0, 0, -1, NULL, 0); 286 else { 287 memcpy(imsg.data, &id, sizeof(id)); 288 control_imsg_forward(&imsg); 289 imsg_compose_event(&c->iev, IMSG_CTL_OK, 290 0, 0, -1, NULL, 0); 291 } 292 break; 293 case IMSG_CTL_RDR_ENABLE: 294 if (imsg.hdr.len != IMSG_HEADER_SIZE + sizeof(id)) 295 fatalx("invalid imsg header len"); 296 memcpy(&id, imsg.data, sizeof(id)); 297 if (enable_rdr(c, &id)) 298 imsg_compose_event(&c->iev, IMSG_CTL_FAIL, 299 0, 0, -1, NULL, 0); 300 else { 301 memcpy(imsg.data, &id, sizeof(id)); 302 control_imsg_forward(&imsg); 303 imsg_compose_event(&c->iev, IMSG_CTL_OK, 304 0, 0, -1, NULL, 0); 305 } 306 break; 307 case IMSG_CTL_TABLE_DISABLE: 308 if (imsg.hdr.len != IMSG_HEADER_SIZE + sizeof(id)) 309 fatalx("invalid imsg header len"); 310 memcpy(&id, imsg.data, sizeof(id)); 311 if (disable_table(c, &id)) 312 imsg_compose_event(&c->iev, IMSG_CTL_FAIL, 313 0, 0, -1, NULL, 0); 314 else { 315 memcpy(imsg.data, &id, sizeof(id)); 316 control_imsg_forward(&imsg); 317 imsg_compose_event(&c->iev, IMSG_CTL_OK, 318 0, 0, -1, NULL, 0); 319 } 320 break; 321 case IMSG_CTL_TABLE_ENABLE: 322 if (imsg.hdr.len != IMSG_HEADER_SIZE + sizeof(id)) 323 fatalx("invalid imsg header len"); 324 memcpy(&id, imsg.data, sizeof(id)); 325 if (enable_table(c, &id)) 326 imsg_compose_event(&c->iev, IMSG_CTL_FAIL, 327 0, 0, -1, NULL, 0); 328 else { 329 memcpy(imsg.data, &id, sizeof(id)); 330 control_imsg_forward(&imsg); 331 imsg_compose_event(&c->iev, IMSG_CTL_OK, 332 0, 0, -1, NULL, 0); 333 } 334 break; 335 case IMSG_CTL_HOST_DISABLE: 336 if (imsg.hdr.len != IMSG_HEADER_SIZE + sizeof(id)) 337 fatalx("invalid imsg header len"); 338 memcpy(&id, imsg.data, sizeof(id)); 339 if (disable_host(c, &id, NULL)) 340 imsg_compose_event(&c->iev, IMSG_CTL_FAIL, 341 0, 0, -1, NULL, 0); 342 else { 343 memcpy(imsg.data, &id, sizeof(id)); 344 control_imsg_forward(&imsg); 345 imsg_compose_event(&c->iev, IMSG_CTL_OK, 346 0, 0, -1, NULL, 0); 347 } 348 break; 349 case IMSG_CTL_HOST_ENABLE: 350 if (imsg.hdr.len != IMSG_HEADER_SIZE + sizeof(id)) 351 fatalx("invalid imsg header len"); 352 memcpy(&id, imsg.data, sizeof(id)); 353 if (enable_host(c, &id, NULL)) 354 imsg_compose_event(&c->iev, IMSG_CTL_FAIL, 355 0, 0, -1, NULL, 0); 356 else { 357 memcpy(imsg.data, &id, sizeof(id)); 358 control_imsg_forward(&imsg); 359 imsg_compose_event(&c->iev, IMSG_CTL_OK, 360 0, 0, -1, NULL, 0); 361 } 362 break; 363 case IMSG_CTL_SHUTDOWN: 364 case IMSG_CTL_RELOAD: 365 proc_forward_imsg(env->sc_ps, &imsg, PROC_PARENT, -1); 366 break; 367 case IMSG_CTL_POLL: 368 proc_compose_imsg(env->sc_ps, PROC_HCE, -1, 369 IMSG_CTL_POLL, -1, NULL, 0); 370 imsg_compose_event(&c->iev, IMSG_CTL_OK, 371 0, 0, -1, NULL, 0); 372 break; 373 case IMSG_CTL_NOTIFY: 374 if (c->flags & CTL_CONN_NOTIFY) { 375 log_debug("%s: " 376 "client requested notify more than once", 377 __func__); 378 imsg_compose_event(&c->iev, IMSG_CTL_FAIL, 379 0, 0, -1, NULL, 0); 380 break; 381 } 382 c->flags |= CTL_CONN_NOTIFY; 383 break; 384 case IMSG_CTL_VERBOSE: 385 IMSG_SIZE_CHECK(&imsg, &verbose); 386 387 memcpy(&verbose, imsg.data, sizeof(verbose)); 388 389 proc_forward_imsg(env->sc_ps, &imsg, PROC_PARENT, -1); 390 proc_forward_imsg(env->sc_ps, &imsg, PROC_HCE, -1); 391 proc_forward_imsg(env->sc_ps, &imsg, PROC_RELAY, -1); 392 393 memcpy(imsg.data, &verbose, sizeof(verbose)); 394 control_imsg_forward(&imsg); 395 log_verbose(verbose); 396 break; 397 default: 398 log_debug("%s: error handling imsg %d", 399 __func__, imsg.hdr.type); 400 break; 401 } 402 imsg_free(&imsg); 403 } 404 405 imsg_event_add(&c->iev); 406 } 407 408 void 409 control_imsg_forward(struct imsg *imsg) 410 { 411 struct ctl_conn *c; 412 413 TAILQ_FOREACH(c, &ctl_conns, entry) 414 if (c->flags & CTL_CONN_NOTIFY) 415 imsg_compose_event(&c->iev, imsg->hdr.type, 416 0, imsg->hdr.pid, -1, imsg->data, 417 imsg->hdr.len - IMSG_HEADER_SIZE); 418 } 419 420 void 421 socket_set_blockmode(int fd, enum blockmodes bm) 422 { 423 int flags; 424 425 if ((flags = fcntl(fd, F_GETFL, 0)) == -1) 426 fatal("fcntl F_GETFL"); 427 428 if (bm == BM_NONBLOCK) 429 flags |= O_NONBLOCK; 430 else 431 flags &= ~O_NONBLOCK; 432 433 if ((flags = fcntl(fd, F_SETFL, flags)) == -1) 434 fatal("fcntl F_SETFL"); 435 } 436