2 8d1b399b 2021-07-22 op * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3 8d1b399b 2021-07-22 op * Copyright (c) 2018 Florian Obser <florian@openbsd.org>
4 8d1b399b 2021-07-22 op * Copyright (c) 2004, 2005 Claudio Jeker <claudio@openbsd.org>
5 8d1b399b 2021-07-22 op * Copyright (c) 2004 Esben Norby <norby@openbsd.org>
6 8d1b399b 2021-07-22 op * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
8 8d1b399b 2021-07-22 op * Permission to use, copy, modify, and distribute this software for any
9 8d1b399b 2021-07-22 op * purpose with or without fee is hereby granted, provided that the above
10 8d1b399b 2021-07-22 op * copyright notice and this permission notice appear in all copies.
12 8d1b399b 2021-07-22 op * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 8d1b399b 2021-07-22 op * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 8d1b399b 2021-07-22 op * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 8d1b399b 2021-07-22 op * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 8d1b399b 2021-07-22 op * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 8d1b399b 2021-07-22 op * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 8d1b399b 2021-07-22 op * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 8d1b399b 2021-07-22 op #include "compat.h"
23 8d1b399b 2021-07-22 op #include <sys/socket.h>
25 8850afbc 2021-07-25 op #include <endian.h>
26 8d1b399b 2021-07-22 op #include <errno.h>
27 8d1b399b 2021-07-22 op #include <inttypes.h>
28 8d1b399b 2021-07-22 op #include <pwd.h>
29 8d1b399b 2021-07-22 op #include <signal.h>
30 8d1b399b 2021-07-22 op #include <stdio.h>
31 8d1b399b 2021-07-22 op #include <stdlib.h>
32 8d1b399b 2021-07-22 op #include <string.h>
33 8d1b399b 2021-07-22 op #include <syslog.h>
34 8d1b399b 2021-07-22 op #include <unistd.h>
36 8d1b399b 2021-07-22 op #include "control.h"
37 8d1b399b 2021-07-22 op #include "kamid.h"
38 8d1b399b 2021-07-22 op #include "listener.h"
39 8d1b399b 2021-07-22 op #include "log.h"
40 8d1b399b 2021-07-22 op #include "sandbox.h"
41 8d1b399b 2021-07-22 op #include "utils.h"
43 8d1b399b 2021-07-22 op static struct kd_conf *listener_conf;
44 8d1b399b 2021-07-22 op static struct imsgev *iev_main;
46 8d1b399b 2021-07-22 op static void listener_sig_handler(int, short, void *);
47 06a84967 2021-07-22 op ATTR_DEAD void listener_shutdown(void);
49 8d1b399b 2021-07-22 op SPLAY_HEAD(clients_tree_id, client) clients;
51 8d1b399b 2021-07-22 op struct client {
54 aeb5a578 2021-07-28 op uint32_t msize;
57 8d1b399b 2021-07-22 op struct tls *ctx;
58 8d1b399b 2021-07-22 op struct event event;
59 8d1b399b 2021-07-22 op struct imsgev iev;
60 8d1b399b 2021-07-22 op struct bufferevent *bev;
61 8d1b399b 2021-07-22 op SPLAY_ENTRY(client) sp_entry;
64 8d1b399b 2021-07-22 op static void listener_imsg_event_add(struct imsgev *, void *);
65 8d1b399b 2021-07-22 op static void listener_dispatch_client(int, short, void *);
66 8d1b399b 2021-07-22 op static int listener_imsg_compose_client(struct client *, int,
67 8d1b399b 2021-07-22 op uint32_t, const void *, uint16_t);
69 8d1b399b 2021-07-22 op static void apply_config(struct kd_conf *);
70 8d1b399b 2021-07-22 op static void handle_accept(int, short, void *);
72 8d1b399b 2021-07-22 op static void handle_handshake(int, short, void *);
73 8d1b399b 2021-07-22 op static void client_read(struct bufferevent *, void *);
74 8d1b399b 2021-07-22 op static void client_write(struct bufferevent *, void *);
75 8d1b399b 2021-07-22 op static void client_error(struct bufferevent *, short, void *);
76 8d1b399b 2021-07-22 op static void client_tls_readcb(int, short, void *);
77 8d1b399b 2021-07-22 op static void client_tls_writecb(int, short, void *);
78 8d1b399b 2021-07-22 op static void close_conn(struct client *);
79 8d1b399b 2021-07-22 op static void handle_close(int, short, void *);
81 8d1b399b 2021-07-22 op static inline int
82 8d1b399b 2021-07-22 op clients_tree_cmp(struct client *a, struct client *b)
84 8d1b399b 2021-07-22 op if (a->id == b->id)
86 8d1b399b 2021-07-22 op else if (a->id < b->id)
92 8d1b399b 2021-07-22 op SPLAY_PROTOTYPE(clients_tree_id, client, sp_entry, clients_tree_cmp);
93 8d1b399b 2021-07-22 op SPLAY_GENERATE(clients_tree_id, client, sp_entry, clients_tree_cmp)
96 8d1b399b 2021-07-22 op listener_sig_handler(int sig, short event, void *d)
99 8d1b399b 2021-07-22 op * Normal signal handler rules don't apply because libevent
100 8d1b399b 2021-07-22 op * decouples for us.
103 8d1b399b 2021-07-22 op switch (sig) {
105 8d1b399b 2021-07-22 op case SIGTERM:
106 8d1b399b 2021-07-22 op listener_shutdown();
108 8d1b399b 2021-07-22 op fatalx("unexpected signal %d", sig);
113 8d1b399b 2021-07-22 op listener(int debug, int verbose)
115 8d1b399b 2021-07-22 op struct event ev_sigint, ev_sigterm;
116 8d1b399b 2021-07-22 op struct passwd *pw;
118 8d1b399b 2021-07-22 op /* listener_conf = config_new_empty(); */
120 8d1b399b 2021-07-22 op log_init(debug, LOG_DAEMON);
121 8d1b399b 2021-07-22 op log_setverbose(verbose);
123 8d1b399b 2021-07-22 op if ((pw = getpwnam(KD_USER)) == NULL)
124 8d1b399b 2021-07-22 op fatal("getpwnam");
126 8d1b399b 2021-07-22 op if (chroot(pw->pw_dir) == -1)
127 8d1b399b 2021-07-22 op fatal("chroot");
128 8d1b399b 2021-07-22 op if (chdir("/") == -1)
129 8d1b399b 2021-07-22 op fatal("chdir(\"/\")");
131 8d1b399b 2021-07-22 op setproctitle("listener");
132 8d1b399b 2021-07-22 op log_procinit("listener");
134 8d1b399b 2021-07-22 op if (setgroups(1, &pw->pw_gid) ||
135 8d1b399b 2021-07-22 op setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
136 8d1b399b 2021-07-22 op setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))
137 8d1b399b 2021-07-22 op fatal("can't drop privileges");
139 8d1b399b 2021-07-22 op event_init();
141 8d1b399b 2021-07-22 op /* Setup signal handlers(s). */
142 8d1b399b 2021-07-22 op signal_set(&ev_sigint, SIGINT, listener_sig_handler, NULL);
143 8d1b399b 2021-07-22 op signal_set(&ev_sigterm, SIGTERM, listener_sig_handler, NULL);
145 8d1b399b 2021-07-22 op signal_add(&ev_sigint, NULL);
146 8d1b399b 2021-07-22 op signal_add(&ev_sigterm, NULL);
148 8d1b399b 2021-07-22 op signal(SIGPIPE, SIG_IGN);
149 8d1b399b 2021-07-22 op signal(SIGHUP, SIG_IGN);
151 8d1b399b 2021-07-22 op /* Setup pipe and event handler to the main process. */
152 8d1b399b 2021-07-22 op if ((iev_main = malloc(sizeof(*iev_main))) == NULL)
155 8d1b399b 2021-07-22 op imsg_init(&iev_main->ibuf, 3);
156 8d1b399b 2021-07-22 op iev_main->handler = listener_dispatch_main;
158 8d1b399b 2021-07-22 op /* Setup event handlers. */
159 8d1b399b 2021-07-22 op iev_main->events = EV_READ;
160 8d1b399b 2021-07-22 op event_set(&iev_main->ev, iev_main->ibuf.fd, iev_main->events,
161 8d1b399b 2021-07-22 op iev_main->handler, iev_main);
162 8d1b399b 2021-07-22 op event_add(&iev_main->ev, NULL);
164 8d1b399b 2021-07-22 op sandbox_listener();
165 8d1b399b 2021-07-22 op event_dispatch();
166 8d1b399b 2021-07-22 op listener_shutdown();
169 06a84967 2021-07-22 op ATTR_DEAD void
170 8d1b399b 2021-07-22 op listener_shutdown(void)
172 8d1b399b 2021-07-22 op msgbuf_clear(&iev_main->ibuf.w);
173 8d1b399b 2021-07-22 op close(iev_main->ibuf.fd);
175 8d1b399b 2021-07-22 op config_clear(listener_conf);
177 8d1b399b 2021-07-22 op free(iev_main);
179 8d1b399b 2021-07-22 op log_info("listener exiting");
184 8d1b399b 2021-07-22 op listener_receive_config(struct imsg *imsg, struct kd_conf **nconf,
185 8d1b399b 2021-07-22 op struct kd_pki_conf **pki)
187 8d1b399b 2021-07-22 op struct kd_listen_conf *listen;
190 8d1b399b 2021-07-22 op switch (imsg->hdr.type) {
191 8d1b399b 2021-07-22 op case IMSG_RECONF_CONF:
192 8d1b399b 2021-07-22 op if (*nconf != NULL)
193 8d1b399b 2021-07-22 op fatalx("%s: IMSG_RECONF_CONF already in "
194 8d1b399b 2021-07-22 op "progress", __func__);
196 8d1b399b 2021-07-22 op if (listener_conf != NULL)
197 8d1b399b 2021-07-22 op fatalx("%s: don't know how reload the "
198 8d1b399b 2021-07-22 op "configuration yet", __func__);
200 8d1b399b 2021-07-22 op if (IMSG_DATA_SIZE(*imsg) != sizeof(struct kd_conf))
201 8d1b399b 2021-07-22 op fatalx("%s: IMSG_RECONF_CONF wrong length: %lu",
202 8d1b399b 2021-07-22 op __func__, IMSG_DATA_SIZE(*imsg));
203 8d1b399b 2021-07-22 op if ((*nconf = malloc(sizeof(**nconf))) == NULL)
205 8d1b399b 2021-07-22 op memcpy(*nconf, imsg->data, sizeof(**nconf));
206 8d1b399b 2021-07-22 op memset(&(*nconf)->pki_head, 0, sizeof((*nconf)->pki_head));
207 8d1b399b 2021-07-22 op memset(&(*nconf)->table_head, 0, sizeof((*nconf)->table_head));
208 8d1b399b 2021-07-22 op memset(&(*nconf)->listen_head, 0, sizeof((*nconf)->listen_head));
210 8d1b399b 2021-07-22 op case IMSG_RECONF_PKI:
211 8d1b399b 2021-07-22 op if (*nconf == NULL)
212 8d1b399b 2021-07-22 op fatalx("%s: IMSG_RECONF_PKI without "
213 8d1b399b 2021-07-22 op "IMSG_RECONF_CONF", __func__);
214 8d1b399b 2021-07-22 op *pki = xcalloc(1, sizeof(**pki));
215 8d1b399b 2021-07-22 op t = imsg->data;
216 8d1b399b 2021-07-22 op t[IMSG_DATA_SIZE(*imsg)-1] = '\0';
217 8d1b399b 2021-07-22 op strlcpy((*pki)->name, t, sizeof((*pki)->name));
219 8d1b399b 2021-07-22 op case IMSG_RECONF_PKI_CERT:
220 8d1b399b 2021-07-22 op if (*pki == NULL)
221 8d1b399b 2021-07-22 op fatalx("%s: IMSG_RECONF_PKI_CERT without "
222 8d1b399b 2021-07-22 op "IMSG_RECONF_PKI", __func__);
223 8d1b399b 2021-07-22 op (*pki)->certlen = IMSG_DATA_SIZE(*imsg);
224 8d1b399b 2021-07-22 op (*pki)->cert = xmemdup(imsg->data, (*pki)->certlen);
226 8d1b399b 2021-07-22 op case IMSG_RECONF_PKI_KEY:
227 8d1b399b 2021-07-22 op if (*pki == NULL)
228 8d1b399b 2021-07-22 op fatalx("%s: IMSG_RECONF_PKI_KEY without "
229 8d1b399b 2021-07-22 op "IMSG_RECONF_PKI", __func__);
230 8d1b399b 2021-07-22 op (*pki)->keylen = IMSG_DATA_SIZE(*imsg);
231 8d1b399b 2021-07-22 op (*pki)->key = xmemdup(imsg->data, (*pki)->keylen);
232 c25feded 2021-07-26 op STAILQ_INSERT_HEAD(&(*nconf)->pki_head, *pki, entry);
235 8d1b399b 2021-07-22 op case IMSG_RECONF_LISTEN:
236 8d1b399b 2021-07-22 op if (*nconf == NULL)
237 8d1b399b 2021-07-22 op fatalx("%s: IMSG_RECONF_LISTEN without "
238 8d1b399b 2021-07-22 op "IMSG_RECONF_CONF", __func__);
239 8d1b399b 2021-07-22 op if (IMSG_DATA_SIZE(*imsg) != sizeof(*listen))
240 8d1b399b 2021-07-22 op fatalx("%s: IMSG_RECONF_LISTEN wrong length: %lu",
241 8d1b399b 2021-07-22 op __func__, IMSG_DATA_SIZE(*imsg));
242 8d1b399b 2021-07-22 op listen = xcalloc(1, sizeof(*listen));
243 8d1b399b 2021-07-22 op memcpy(listen, imsg->data, sizeof(*listen));
244 8d1b399b 2021-07-22 op memset(&listen->entry, 0, sizeof(listen->entry));
245 8d1b399b 2021-07-22 op if ((listen->fd = imsg->fd) == -1)
246 8d1b399b 2021-07-22 op fatalx("%s: IMSG_RECONF_LISTEN no fd",
248 8d1b399b 2021-07-22 op listen->auth_table = NULL;
249 8d1b399b 2021-07-22 op memset(&listen->ev, 0, sizeof(listen->ev));
250 c25feded 2021-07-26 op STAILQ_INSERT_HEAD(&(*nconf)->listen_head, listen, entry);
252 8d1b399b 2021-07-22 op case IMSG_RECONF_END:
253 8d1b399b 2021-07-22 op if (*nconf == NULL)
254 8d1b399b 2021-07-22 op fatalx("%s: IMSG_RECONF_END without "
255 8d1b399b 2021-07-22 op "IMSG_RECONF_CONF", __func__);
256 8d1b399b 2021-07-22 op /* merge_config(listener_conf, nconf); */
257 8d1b399b 2021-07-22 op apply_config(*nconf);
258 8d1b399b 2021-07-22 op *nconf = NULL;
263 fccfa871 2021-07-23 op static inline struct kd_listen_conf *
264 fccfa871 2021-07-23 op listen_by_id(uint32_t id)
266 fccfa871 2021-07-23 op struct kd_listen_conf *l;
268 c25feded 2021-07-26 op STAILQ_FOREACH(l, &listener_conf->listen_head, entry) {
269 fccfa871 2021-07-23 op if (l->id == id)
276 8d1b399b 2021-07-22 op listener_dispatch_main(int fd, short event, void *d)
278 8d1b399b 2021-07-22 op static struct kd_conf *nconf;
279 8d1b399b 2021-07-22 op static struct kd_pki_conf *pki;
280 fccfa871 2021-07-23 op struct kd_listen_conf *listen;
281 8d1b399b 2021-07-22 op struct client *client, find;
282 8d1b399b 2021-07-22 op struct imsg imsg;
283 8d1b399b 2021-07-22 op struct imsgev *iev = d;
284 8d1b399b 2021-07-22 op struct imsgbuf *ibuf;
286 8d1b399b 2021-07-22 op int shut = 0;
288 8d1b399b 2021-07-22 op ibuf = &iev->ibuf;
290 8d1b399b 2021-07-22 op if (event & EV_READ) {
291 8d1b399b 2021-07-22 op if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
292 8d1b399b 2021-07-22 op fatal("imsg_read error");
293 8d1b399b 2021-07-22 op if (n == 0) /* Connection closed. */
296 8d1b399b 2021-07-22 op if (event & EV_WRITE) {
297 8d1b399b 2021-07-22 op if ((n = msgbuf_write(&ibuf->w)) == -1 && errno != EAGAIN)
298 8d1b399b 2021-07-22 op fatal("msgbuf_write");
299 8d1b399b 2021-07-22 op if (n == 0) /* Connection closed. */
304 8d1b399b 2021-07-22 op if ((n = imsg_get(ibuf, &imsg)) == -1)
305 8d1b399b 2021-07-22 op fatal("%s: imsg_get error", __func__);
306 8d1b399b 2021-07-22 op if (n == 0) /* No more messages. */
309 8d1b399b 2021-07-22 op switch (imsg.hdr.type) {
310 8d1b399b 2021-07-22 op case IMSG_CONTROLFD:
311 8d1b399b 2021-07-22 op if ((fd = imsg.fd) == -1)
312 8d1b399b 2021-07-22 op fatalx("%s: expected to receive imsg "
313 8d1b399b 2021-07-22 op "control fd but didn't receive any",
315 8d1b399b 2021-07-22 op /* Listen on control socket. */
316 8d1b399b 2021-07-22 op control_listen(fd);
318 8d1b399b 2021-07-22 op case IMSG_RECONF_CONF:
319 8d1b399b 2021-07-22 op case IMSG_RECONF_PKI:
320 8d1b399b 2021-07-22 op case IMSG_RECONF_PKI_CERT:
321 8d1b399b 2021-07-22 op case IMSG_RECONF_PKI_KEY:
322 8d1b399b 2021-07-22 op case IMSG_RECONF_LISTEN:
323 8d1b399b 2021-07-22 op case IMSG_RECONF_END:
324 8d1b399b 2021-07-22 op listener_receive_config(&imsg, &nconf, &pki);
326 8d1b399b 2021-07-22 op case IMSG_AUTH:
327 8d1b399b 2021-07-22 op find.id = imsg.hdr.peerid;
328 8d1b399b 2021-07-22 op client = SPLAY_FIND(clients_tree_id, &clients, &find);
329 8d1b399b 2021-07-22 op if (client == NULL) {
330 bd434b78 2021-07-26 op if (imsg.fd != -1)
331 8d1b399b 2021-07-22 op close(imsg.fd);
334 8d1b399b 2021-07-22 op if (imsg.fd == -1) {
335 7de040bc 2021-07-26 op log_info("got fd = -1, auth failed?");
336 8d1b399b 2021-07-22 op close_conn(client);
339 8d1b399b 2021-07-22 op imsg_init(&client->iev.ibuf, imsg.fd);
340 8d1b399b 2021-07-22 op client->iev.events = EV_READ;
341 8d1b399b 2021-07-22 op client->iev.handler = listener_dispatch_client;
342 8d1b399b 2021-07-22 op event_set(&client->iev.ev, client->iev.ibuf.fd,
343 8d1b399b 2021-07-22 op client->iev.events, client->iev.handler, client);
344 8d1b399b 2021-07-22 op listener_imsg_compose_client(client, IMSG_AUTH,
345 adce5c38 2021-07-28 op client->id, imsg.data, IMSG_DATA_SIZE(imsg));
347 8d1b399b 2021-07-22 op case IMSG_AUTH_DIR:
348 8d1b399b 2021-07-22 op find.id = imsg.hdr.peerid;
349 8d1b399b 2021-07-22 op client = SPLAY_FIND(clients_tree_id, &clients, &find);
350 8d1b399b 2021-07-22 op if (client == NULL) {
351 8d1b399b 2021-07-22 op log_info("got AUTH_DIR but client gone");
355 8d1b399b 2021-07-22 op listener_imsg_compose_client(client, IMSG_AUTH_DIR,
356 8d1b399b 2021-07-22 op 0, imsg.data, IMSG_DATA_SIZE(imsg));
358 8d1b399b 2021-07-22 op client->bev = bufferevent_new(client->fd,
359 8d1b399b 2021-07-22 op client_read, client_write, client_error,
361 8d1b399b 2021-07-22 op if (client->bev == NULL) {
362 8d1b399b 2021-07-22 op log_info("failed to allocate client buffer");
363 8d1b399b 2021-07-22 op close_conn(client);
367 2d96e64d 2021-07-28 op #if HAVE_EVENT2
368 2d96e64d 2021-07-28 op evbuffer_unfreeze(client->bev->input, 0);
369 2d96e64d 2021-07-28 op evbuffer_unfreeze(client->bev->output, 1);
372 fccfa871 2021-07-23 op listen = listen_by_id(client->lid);
373 fccfa871 2021-07-23 op if (listen->flags & L_TLS) {
374 fccfa871 2021-07-23 op event_set(&client->bev->ev_read, client->fd,
375 fccfa871 2021-07-23 op EV_READ, client_tls_readcb, client->bev);
376 fccfa871 2021-07-23 op event_set(&client->bev->ev_write, client->fd,
377 fccfa871 2021-07-23 op EV_WRITE, client_tls_writecb, client->bev);
381 8850afbc 2021-07-25 op * Read or write at least a header before
382 8850afbc 2021-07-25 op * firing the callbacks. High watermark of 0
383 8850afbc 2021-07-25 op * to never stop reading/writing; probably to
384 8850afbc 2021-07-25 op * be revisited.
386 67bfdd45 2021-07-27 op /* bufferevent_setwatermark(client->bev, EV_READ|EV_WRITE, */
387 67bfdd45 2021-07-27 op /* sizeof(struct np_msg_header), 0); */
388 8d1b399b 2021-07-22 op bufferevent_enable(client->bev, EV_READ|EV_WRITE);
392 8d1b399b 2021-07-22 op log_debug("%s: unexpected imsg %d", __func__,
393 8d1b399b 2021-07-22 op imsg.hdr.type);
396 8d1b399b 2021-07-22 op imsg_free(&imsg);
400 8d1b399b 2021-07-22 op listener_imsg_event_add(iev, d);
402 8d1b399b 2021-07-22 op /* This pipe is dead. Remove its event handler. */
403 8d1b399b 2021-07-22 op event_del(&iev->ev);
404 8d1b399b 2021-07-22 op log_warnx("pipe closed, shutting down...");
405 8d1b399b 2021-07-22 op event_loopexit(NULL);
410 8d1b399b 2021-07-22 op listener_imsg_compose_main(int type, uint32_t peerid, const void *data,
411 8d1b399b 2021-07-22 op uint16_t datalen)
413 8d1b399b 2021-07-22 op return imsg_compose_event(iev_main, type, peerid, 0, -1, data,
418 8d1b399b 2021-07-22 op listener_imsg_event_add(struct imsgev *iev, void *d)
420 8d1b399b 2021-07-22 op iev->events = EV_READ;
421 8d1b399b 2021-07-22 op if (iev->ibuf.w.queued)
422 8d1b399b 2021-07-22 op iev->events |= EV_WRITE;
424 8d1b399b 2021-07-22 op event_del(&iev->ev);
425 8d1b399b 2021-07-22 op event_set(&iev->ev, iev->ibuf.fd, iev->events, iev->handler, d);
426 8d1b399b 2021-07-22 op event_add(&iev->ev, NULL);
430 8d1b399b 2021-07-22 op listener_dispatch_client(int fd, short event, void *d)
432 8d1b399b 2021-07-22 op struct client find, *client = d;
433 8d1b399b 2021-07-22 op struct imsg imsg;
434 8d1b399b 2021-07-22 op struct imsgev *iev;
435 8d1b399b 2021-07-22 op struct imsgbuf *ibuf;
437 8d1b399b 2021-07-22 op int r, shut = 0;
439 8d1b399b 2021-07-22 op iev = &client->iev;
440 8d1b399b 2021-07-22 op ibuf = &iev->ibuf;
442 8d1b399b 2021-07-22 op if (event & EV_READ) {
443 8d1b399b 2021-07-22 op if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
444 8d1b399b 2021-07-22 op fatal("imsg_read error");
445 8d1b399b 2021-07-22 op if (n == 0) /* Connection closed */
449 8d1b399b 2021-07-22 op if (event & EV_WRITE) {
450 8d1b399b 2021-07-22 op if ((n = msgbuf_write(&ibuf->w)) == -1 && errno != EAGAIN)
451 8d1b399b 2021-07-22 op fatal("msgbuf_write");
452 8d1b399b 2021-07-22 op if (n == 0) /* Connection closed. */
457 8d1b399b 2021-07-22 op if ((n = imsg_get(ibuf, &imsg)) == -1)
458 8d1b399b 2021-07-22 op fatal("%s: imsg_get error", __func__);
459 8d1b399b 2021-07-22 op if (n == 0) /* No more messages. */
462 8d1b399b 2021-07-22 op switch (imsg.hdr.type) {
463 8d1b399b 2021-07-22 op case IMSG_BUF:
464 8d1b399b 2021-07-22 op find.id = imsg.hdr.peerid;
465 8d1b399b 2021-07-22 op client = SPLAY_FIND(clients_tree_id, &clients, &find);
466 8d1b399b 2021-07-22 op if (client == NULL) {
467 8d1b399b 2021-07-22 op log_info("got IMSG_BUF but client (%d) gone",
468 8d1b399b 2021-07-22 op imsg.hdr.peerid);
471 8d1b399b 2021-07-22 op r = bufferevent_write(client->bev, imsg.data,
472 8d1b399b 2021-07-22 op IMSG_DATA_SIZE(imsg));
473 8d1b399b 2021-07-22 op if (r == -1) {
474 8d1b399b 2021-07-22 op log_warn("%s: bufferevent_write failed",
476 8d1b399b 2021-07-22 op close_conn(client);
481 5c485996 2021-07-28 op case IMSG_MSIZE:
482 5c485996 2021-07-28 op if (IMSG_DATA_SIZE(imsg) != sizeof(client->msize))
483 5c485996 2021-07-28 op fatal("IMSG_MSIZE size mismatch: "
484 5c485996 2021-07-28 op "got %zu want %zu", IMSG_DATA_SIZE(imsg),
485 5c485996 2021-07-28 op sizeof(client->msize));
487 5c485996 2021-07-28 op memcpy(&client->msize, imsg.data,
488 5c485996 2021-07-28 op sizeof(client->msize));
490 5c485996 2021-07-28 op if (client->msize == 0)
491 5c485996 2021-07-28 op fatal("IMSG_MSIZE got msize = 0");
495 5c485996 2021-07-28 op case IMSG_CLOSE:
497 5c485996 2021-07-28 op * Both EVBUFFER_READ or EVBUFFER_WRITE should
500 5c485996 2021-07-28 op client_error(client->bev, EVBUFFER_READ, client);
504 8d1b399b 2021-07-22 op log_debug("%s: unexpected imsg %d", __func__,
505 8d1b399b 2021-07-22 op imsg.hdr.type);
508 8d1b399b 2021-07-22 op imsg_free(&imsg);
512 8d1b399b 2021-07-22 op listener_imsg_event_add(iev, d);
514 8d1b399b 2021-07-22 op /* This pipe is dead. Remove its handler */
515 8d1b399b 2021-07-22 op log_debug("client proc vanished");
516 8d1b399b 2021-07-22 op close_conn(client);
521 8d1b399b 2021-07-22 op listener_imsg_compose_client(struct client *client, int type,
522 8d1b399b 2021-07-22 op uint32_t peerid, const void *data, uint16_t len)
526 8d1b399b 2021-07-22 op if ((ret = imsg_compose(&client->iev.ibuf, type, peerid, 0, -1,
527 8d1b399b 2021-07-22 op data, len)) != -1)
528 8d1b399b 2021-07-22 op listener_imsg_event_add(&client->iev, client);
533 8d1b399b 2021-07-22 op static inline struct kd_pki_conf *
534 8d1b399b 2021-07-22 op pki_by_name(const char *name)
536 8d1b399b 2021-07-22 op struct kd_pki_conf *pki;
538 c25feded 2021-07-26 op STAILQ_FOREACH(pki, &listener_conf->pki_head, entry) {
539 8d1b399b 2021-07-22 op if (!strcmp(name, pki->name))
547 8d1b399b 2021-07-22 op apply_config(struct kd_conf *conf)
549 8d1b399b 2021-07-22 op struct kd_pki_conf *pki;
550 8d1b399b 2021-07-22 op struct kd_listen_conf *listen;
552 8d1b399b 2021-07-22 op listener_conf = conf;
554 8d1b399b 2021-07-22 op /* prepare the various tls_config */
555 c25feded 2021-07-26 op STAILQ_FOREACH(pki, &listener_conf->pki_head, entry) {
556 8d1b399b 2021-07-22 op if ((pki->tlsconf = tls_config_new()) == NULL)
557 8d1b399b 2021-07-22 op fatal("tls_config_new");
558 8d1b399b 2021-07-22 op tls_config_verify_client_optional(pki->tlsconf);
559 8d1b399b 2021-07-22 op tls_config_insecure_noverifycert(pki->tlsconf);
560 8d1b399b 2021-07-22 op if (tls_config_set_keypair_mem(pki->tlsconf,
561 8d1b399b 2021-07-22 op pki->cert, pki->certlen,
562 8d1b399b 2021-07-22 op pki->key, pki->keylen) == -1)
563 8d1b399b 2021-07-22 op fatalx("tls_config_set_keypair_mem: %s",
564 8d1b399b 2021-07-22 op tls_config_error(pki->tlsconf));
567 8d1b399b 2021-07-22 op /* prepare and kickoff the listeners */
568 c25feded 2021-07-26 op STAILQ_FOREACH(listen, &listener_conf->listen_head, entry) {
569 8d1b399b 2021-07-22 op if ((listen->ctx = tls_server()) == NULL)
570 8d1b399b 2021-07-22 op fatal("tls_server");
572 8d1b399b 2021-07-22 op pki = pki_by_name(listen->pki);
573 8d1b399b 2021-07-22 op if (tls_configure(listen->ctx, pki->tlsconf) == -1)
574 8d1b399b 2021-07-22 op fatalx("tls_configure: %s",
575 8d1b399b 2021-07-22 op tls_config_error(pki->tlsconf));
577 8d1b399b 2021-07-22 op event_set(&listen->ev, listen->fd, EV_READ|EV_PERSIST,
578 8d1b399b 2021-07-22 op handle_accept, listen);
579 8d1b399b 2021-07-22 op event_add(&listen->ev, NULL);
583 8d1b399b 2021-07-22 op static inline void
584 8d1b399b 2021-07-22 op yield_r(struct client *c, void (*fn)(int, short, void *))
586 8d1b399b 2021-07-22 op if (event_pending(&c->event, EV_WRITE|EV_READ, NULL))
587 8d1b399b 2021-07-22 op event_del(&c->event);
588 8d1b399b 2021-07-22 op event_set(&c->event, c->fd, EV_READ, fn, c);
589 8d1b399b 2021-07-22 op event_add(&c->event, NULL);
592 8d1b399b 2021-07-22 op static inline void
593 8d1b399b 2021-07-22 op yield_w(struct client *c, void (*fn)(int, short, void *))
595 8d1b399b 2021-07-22 op if (event_pending(&c->event, EV_WRITE|EV_READ, NULL))
596 8d1b399b 2021-07-22 op event_del(&c->event);
597 8d1b399b 2021-07-22 op event_set(&c->event, c->fd, EV_WRITE, fn, c);
598 8d1b399b 2021-07-22 op event_add(&c->event, NULL);
601 8d1b399b 2021-07-22 op static inline uint32_t
602 8d1b399b 2021-07-22 op random_id(void)
604 52ef585b 2021-07-23 op #if HAVE_ARC4RANDOM
605 9398fd28 2021-07-23 op # define RANDID() arc4random()
607 53dd4db6 2021-07-23 op /* not as pretty as a random id */
608 53dd4db6 2021-07-23 op static uint32_t counter = 0;
609 9398fd28 2021-07-23 op # define RANDID() counter++
612 9398fd28 2021-07-23 op struct client find, *res;
615 9398fd28 2021-07-23 op find.id = RANDID();
616 8d1b399b 2021-07-22 op res = SPLAY_FIND(clients_tree_id, &clients, &find);
617 8d1b399b 2021-07-22 op if (res == NULL)
618 8d1b399b 2021-07-22 op return find.id;
621 9398fd28 2021-07-23 op #undef RANDID
625 8d1b399b 2021-07-22 op handle_accept(int fd, short ev, void *data)
627 8d1b399b 2021-07-22 op struct kd_listen_conf *listen = data;
628 8d1b399b 2021-07-22 op struct client *c;
631 8d1b399b 2021-07-22 op if ((s = accept(fd, NULL, NULL)) == -1) {
632 8d1b399b 2021-07-22 op log_warn("accept");
636 8d1b399b 2021-07-22 op c = xcalloc(1, sizeof(*c));
637 aeb5a578 2021-07-28 op c->msize = MSIZE9P;
638 0ca6718e 2021-07-22 op c->lid = listen->id;
639 8d1b399b 2021-07-22 op c->iev.ibuf.fd = -1;
641 8d1b399b 2021-07-22 op if (tls_accept_socket(listen->ctx, &c->ctx, s) == -1) {
642 8d1b399b 2021-07-22 op log_warnx("tls_accept_socket: %s",
643 8d1b399b 2021-07-22 op tls_error(listen->ctx));
650 8d1b399b 2021-07-22 op c->id = random_id();
652 8d1b399b 2021-07-22 op SPLAY_INSERT(clients_tree_id, &clients, c);
654 8d1b399b 2021-07-22 op /* initialize the event */
655 8d1b399b 2021-07-22 op event_set(&c->event, c->fd, EV_READ, NULL, NULL);
657 8d1b399b 2021-07-22 op yield_r(c, handle_handshake);
661 8d1b399b 2021-07-22 op handle_handshake(int fd, short ev, void *data)
663 8d1b399b 2021-07-22 op struct client *c = data;
664 0ca6718e 2021-07-22 op struct kd_auth_req auth;
666 8d1b399b 2021-07-22 op const char *hash;
668 8d1b399b 2021-07-22 op switch (r = tls_handshake(c->ctx)) {
669 8d1b399b 2021-07-22 op case TLS_WANT_POLLIN:
670 8d1b399b 2021-07-22 op yield_r(c, handle_handshake);
672 8d1b399b 2021-07-22 op case TLS_WANT_POLLOUT:
673 8d1b399b 2021-07-22 op yield_w(c, handle_handshake);
676 8d1b399b 2021-07-22 op log_debug("handhsake failed: %s", tls_error(c->ctx));
677 8d1b399b 2021-07-22 op close_conn(c);
681 8d1b399b 2021-07-22 op if ((hash = tls_peer_cert_hash(c->ctx)) == NULL) {
682 8d1b399b 2021-07-22 op log_warnx("client didn't provide certificate");
683 8d1b399b 2021-07-22 op close_conn(c);
687 0ca6718e 2021-07-22 op memset(&auth, 0, sizeof(auth));
688 0ca6718e 2021-07-22 op auth.listen_id = c->lid;
689 0ca6718e 2021-07-22 op strlcpy(auth.hash, hash, sizeof(auth.hash));
690 0ca6718e 2021-07-22 op log_debug("sending hash %s", auth.hash);
692 8d1b399b 2021-07-22 op listener_imsg_compose_main(IMSG_AUTH_TLS, c->id,
693 0ca6718e 2021-07-22 op &auth, sizeof(auth));
697 8d1b399b 2021-07-22 op client_read(struct bufferevent *bev, void *d)
699 8d1b399b 2021-07-22 op struct client *client = d;
700 8d1b399b 2021-07-22 op struct evbuffer *src = EVBUFFER_INPUT(bev);
701 8850afbc 2021-07-25 op uint32_t len;
704 8850afbc 2021-07-25 op if (EVBUFFER_LENGTH(src) < 4)
707 8850afbc 2021-07-25 op memcpy(&len, EVBUFFER_DATA(src), sizeof(len));
708 8850afbc 2021-07-25 op len = le32toh(len);
709 133a47ac 2021-07-28 op log_debug("expecting a message %"PRIu32" bytes long "
710 133a47ac 2021-07-28 op "(of wich %zu already read)",
711 133a47ac 2021-07-28 op len, EVBUFFER_LENGTH(src));
713 4bc78402 2021-08-01 op if (len < HEADERSIZE) {
714 4bc78402 2021-08-01 op log_warnx("invalid message size %d (too low)", len);
715 4bc78402 2021-08-01 op client_error(bev, EVBUFFER_READ, client);
719 aeb5a578 2021-07-28 op if (len > client->msize) {
720 aeb5a578 2021-07-28 op log_warnx("incoming message bigger than msize "
721 aeb5a578 2021-07-28 op "(%"PRIu32" vs %"PRIu32")", len, client->msize);
722 aeb5a578 2021-07-28 op client_error(bev, EVBUFFER_READ, client);
726 8850afbc 2021-07-25 op if (len > EVBUFFER_LENGTH(src))
729 8850afbc 2021-07-25 op listener_imsg_compose_client(client, IMSG_BUF, client->id,
730 8850afbc 2021-07-25 op EVBUFFER_DATA(src), len);
731 8850afbc 2021-07-25 op evbuffer_drain(src, len);
736 8d1b399b 2021-07-22 op client_write(struct bufferevent *bev, void *d)
739 8d1b399b 2021-07-22 op * here we can do some fancy logic like deciding when to call
741 8d1b399b 2021-07-22 op * (*bev->errorcb)(bev, EVBUFFER_WRITE, bev->cbarg)
743 8d1b399b 2021-07-22 op * to signal the end of the transaction.
750 8d1b399b 2021-07-22 op client_error(struct bufferevent *bev, short err, void *d)
752 8d1b399b 2021-07-22 op struct client *client = d;
753 8d1b399b 2021-07-22 op struct evbuffer *buf;
755 8d1b399b 2021-07-22 op if (err & EVBUFFER_ERROR) {
756 8d1b399b 2021-07-22 op if (errno == EFBIG) {
757 8d1b399b 2021-07-22 op bufferevent_enable(bev, EV_READ);
760 8d1b399b 2021-07-22 op log_debug("buffer event error");
761 8d1b399b 2021-07-22 op close_conn(client);
765 8d1b399b 2021-07-22 op if (err & EVBUFFER_EOF) {
766 8d1b399b 2021-07-22 op close_conn(client);
770 8d1b399b 2021-07-22 op if (err & (EVBUFFER_READ|EVBUFFER_WRITE)) {
771 8d1b399b 2021-07-22 op bufferevent_disable(bev, EV_READ|EV_WRITE);
772 8d1b399b 2021-07-22 op client->done = 1;
774 8d1b399b 2021-07-22 op buf = EVBUFFER_OUTPUT(client->bev);
775 8d1b399b 2021-07-22 op if (EVBUFFER_LENGTH(buf) != 0) {
776 8d1b399b 2021-07-22 op /* finish writing all the data first */
777 8d1b399b 2021-07-22 op bufferevent_enable(client->bev, EV_WRITE);
781 8d1b399b 2021-07-22 op close_conn(client);
785 8d1b399b 2021-07-22 op log_warnx("unknown event error, closing client connection");
786 8d1b399b 2021-07-22 op close_conn(client);
790 8d1b399b 2021-07-22 op client_tls_readcb(int fd, short event, void *d)
792 8d1b399b 2021-07-22 op struct bufferevent *bufev = d;
793 8d1b399b 2021-07-22 op struct client *client = bufev->cbarg;
794 77694967 2021-07-26 op char buf[IBUF_READ_SIZE];
795 8d1b399b 2021-07-22 op int what = EVBUFFER_READ;
796 8d1b399b 2021-07-22 op int howmuch = IBUF_READ_SIZE;
800 8d1b399b 2021-07-22 op if (event == EV_TIMEOUT) {
801 8d1b399b 2021-07-22 op what |= EVBUFFER_TIMEOUT;
805 8d1b399b 2021-07-22 op if (bufev->wm_read.high != 0)
806 8d1b399b 2021-07-22 op howmuch = MIN(sizeof(buf), bufev->wm_read.high);
808 8d1b399b 2021-07-22 op switch (ret = tls_read(client->ctx, buf, howmuch)) {
809 8d1b399b 2021-07-22 op case TLS_WANT_POLLIN:
810 8d1b399b 2021-07-22 op case TLS_WANT_POLLOUT:
813 8d1b399b 2021-07-22 op what |= EVBUFFER_ERROR;
818 8d1b399b 2021-07-22 op if (len == 0) {
819 8d1b399b 2021-07-22 op what |= EVBUFFER_EOF;
823 2d96e64d 2021-07-28 op if (evbuffer_add(bufev->input, buf, len) == -1) {
824 8d1b399b 2021-07-22 op what |= EVBUFFER_ERROR;
828 8d1b399b 2021-07-22 op event_add(&bufev->ev_read, NULL);
830 8d1b399b 2021-07-22 op len = EVBUFFER_LENGTH(bufev->input);
831 8d1b399b 2021-07-22 op if (bufev->wm_read.low != 0 && len < bufev->wm_read.low)
833 8d1b399b 2021-07-22 op if (bufev->wm_read.high != 0 && len > bufev->wm_read.high) {
835 8d1b399b 2021-07-22 op * here we could implement some read pressure
840 8d1b399b 2021-07-22 op if (bufev->readcb != NULL)
841 8d1b399b 2021-07-22 op (*bufev->readcb)(bufev, bufev->cbarg);
846 8d1b399b 2021-07-22 op event_add(&bufev->ev_read, NULL);
850 8d1b399b 2021-07-22 op (*bufev->errorcb)(bufev, what, bufev->cbarg);
854 8d1b399b 2021-07-22 op client_tls_writecb(int fd, short event, void *d)
856 8d1b399b 2021-07-22 op struct bufferevent *bufev = d;
857 8d1b399b 2021-07-22 op struct client *client = bufev->cbarg;
860 8d1b399b 2021-07-22 op short what = EVBUFFER_WRITE;
862 8d1b399b 2021-07-22 op if (event == EV_TIMEOUT) {
863 8d1b399b 2021-07-22 op what |= EVBUFFER_TIMEOUT;
867 8d1b399b 2021-07-22 op if (EVBUFFER_LENGTH(bufev->output) != 0) {
868 8d1b399b 2021-07-22 op ret = tls_write(client->ctx,
869 8d1b399b 2021-07-22 op EVBUFFER_DATA(bufev->output),
870 8d1b399b 2021-07-22 op EVBUFFER_LENGTH(bufev->output));
871 8d1b399b 2021-07-22 op switch (ret) {
872 8d1b399b 2021-07-22 op case TLS_WANT_POLLIN:
873 8d1b399b 2021-07-22 op case TLS_WANT_POLLOUT:
876 8d1b399b 2021-07-22 op what |= EVBUFFER_ERROR;
880 8d1b399b 2021-07-22 op evbuffer_drain(bufev->output, len);
883 8d1b399b 2021-07-22 op if (EVBUFFER_LENGTH(bufev->output) != 0)
884 8d1b399b 2021-07-22 op event_add(&bufev->ev_write, NULL);
886 8d1b399b 2021-07-22 op if (bufev->writecb != NULL &&
887 8d1b399b 2021-07-22 op EVBUFFER_LENGTH(bufev->output) <= bufev->wm_write.low)
888 8d1b399b 2021-07-22 op (*bufev->writecb)(bufev, bufev->cbarg);
892 8d1b399b 2021-07-22 op event_add(&bufev->ev_write, NULL);
896 8d1b399b 2021-07-22 op (*bufev->errorcb)(bufev, what, bufev->cbarg);
900 8d1b399b 2021-07-22 op close_conn(struct client *c)
902 8d1b399b 2021-07-22 op log_debug("closing connection");
904 8d1b399b 2021-07-22 op if (c->iev.ibuf.fd != -1) {
905 8d1b399b 2021-07-22 op listener_imsg_compose_client(c, IMSG_CONN_GONE, 0, NULL, 0);
906 8d1b399b 2021-07-22 op imsg_flush(&c->iev.ibuf);
907 8d1b399b 2021-07-22 op msgbuf_clear(&c->iev.ibuf.w);
908 8d1b399b 2021-07-22 op event_del(&c->iev.ev);
909 8d1b399b 2021-07-22 op close(c->iev.ibuf.fd);
912 8d1b399b 2021-07-22 op handle_close(c->fd, 0, c);
916 8d1b399b 2021-07-22 op handle_close(int fd, short ev, void *d)
918 8d1b399b 2021-07-22 op struct client *c = d;
920 8d1b399b 2021-07-22 op switch (tls_close(c->ctx)) {
921 8d1b399b 2021-07-22 op case TLS_WANT_POLLIN:
922 8d1b399b 2021-07-22 op yield_r(c, handle_close);
924 8d1b399b 2021-07-22 op case TLS_WANT_POLLOUT:
925 8d1b399b 2021-07-22 op yield_w(c, handle_close);
929 8d1b399b 2021-07-22 op event_del(&c->event);
930 8d1b399b 2021-07-22 op tls_free(c->ctx);
931 8d1b399b 2021-07-22 op close(c->fd);
