2 c68baad2 2023-06-06 op * Copyright (c) 2023 Omar Polo <op@omarpolo.com>
4 c68baad2 2023-06-06 op * Permission to use, copy, modify, and distribute this software for any
5 c68baad2 2023-06-06 op * purpose with or without fee is hereby granted, provided that the above
6 c68baad2 2023-06-06 op * copyright notice and this permission notice appear in all copies.
8 c68baad2 2023-06-06 op * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 c68baad2 2023-06-06 op * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 c68baad2 2023-06-06 op * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 c68baad2 2023-06-06 op * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 c68baad2 2023-06-06 op * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 c68baad2 2023-06-06 op * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 c68baad2 2023-06-06 op * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 c68baad2 2023-06-06 op #include "gmid.h"
19 c26f2460 2023-06-08 op #include <sys/stat.h>
21 c26f2460 2023-06-08 op #include <fcntl.h>
22 c26f2460 2023-06-08 op #include <limits.h>
23 c68baad2 2023-06-06 op #include <string.h>
25 86693a33 2023-06-11 op #include <openssl/pem.h>
27 c26f2460 2023-06-08 op #include "log.h"
28 c26f2460 2023-06-08 op #include "proc.h"
31 af1dab18 2023-06-09 op config_new(void)
33 af1dab18 2023-06-09 op struct conf *conf;
35 af1dab18 2023-06-09 op conf = xcalloc(1, sizeof(*conf));
37 af1dab18 2023-06-09 op TAILQ_INIT(&conf->fcgi);
38 af1dab18 2023-06-09 op TAILQ_INIT(&conf->hosts);
39 86693a33 2023-06-11 op TAILQ_INIT(&conf->pkis);
41 af1dab18 2023-06-09 op conf->port = 1965;
42 af1dab18 2023-06-09 op conf->ipv6 = 0;
43 af1dab18 2023-06-09 op conf->protos = TLS_PROTOCOL_TLSv1_2 | TLS_PROTOCOL_TLSv1_3;
45 af1dab18 2023-06-09 op init_mime(&conf->mime);
47 af1dab18 2023-06-09 op conf->prefork = 3;
49 af1dab18 2023-06-09 op conf->sock4 = -1;
50 af1dab18 2023-06-09 op conf->sock6 = -1;
56 af1dab18 2023-06-09 op config_purge(struct conf *conf)
58 c26f2460 2023-06-08 op struct privsep *ps;
59 5d22294a 2023-06-09 op struct fcgi *f, *tf;
60 c68baad2 2023-06-06 op struct vhost *h, *th;
61 c68baad2 2023-06-06 op struct location *l, *tl;
62 c68baad2 2023-06-06 op struct proxy *p, *tp;
63 c68baad2 2023-06-06 op struct envlist *e, *te;
64 c68baad2 2023-06-06 op struct alist *a, *ta;
65 86693a33 2023-06-11 op struct pki *pki, *tpki;
67 af1dab18 2023-06-09 op ps = conf->ps;
69 af1dab18 2023-06-09 op if (conf->sock4 != -1) {
70 af1dab18 2023-06-09 op event_del(&conf->evsock4);
71 af1dab18 2023-06-09 op close(conf->sock4);
74 af1dab18 2023-06-09 op if (conf->sock6 != -1) {
75 af1dab18 2023-06-09 op event_del(&conf->evsock6);
76 af1dab18 2023-06-09 op close(conf->sock6);
79 af1dab18 2023-06-09 op free_mime(&conf->mime);
80 af1dab18 2023-06-09 op TAILQ_FOREACH_SAFE(f, &conf->fcgi, fcgi, tf) {
81 af1dab18 2023-06-09 op TAILQ_REMOVE(&conf->fcgi, f, fcgi);
85 af1dab18 2023-06-09 op TAILQ_FOREACH_SAFE(h, &conf->hosts, vhosts, th) {
86 1c6967b3 2023-06-08 op free(h->cert_path);
87 1c6967b3 2023-06-08 op free(h->key_path);
88 1c6967b3 2023-06-08 op free(h->ocsp_path);
89 c26f2460 2023-06-08 op free(h->cert);
91 c26f2460 2023-06-08 op free(h->ocsp);
93 c68baad2 2023-06-06 op TAILQ_FOREACH_SAFE(l, &h->locations, locations, tl) {
94 c68baad2 2023-06-06 op TAILQ_REMOVE(&h->locations, l, locations);
96 c68baad2 2023-06-06 op if (l->dirfd != -1)
97 c68baad2 2023-06-06 op close(l->dirfd);
99 deadd9e1 2023-06-09 op free(l->reqca_path);
100 deadd9e1 2023-06-09 op X509_STORE_free(l->reqca);
104 c68baad2 2023-06-06 op TAILQ_FOREACH_SAFE(e, &h->params, envs, te) {
105 c68baad2 2023-06-06 op TAILQ_REMOVE(&h->params, e, envs);
109 c68baad2 2023-06-06 op TAILQ_FOREACH_SAFE(a, &h->aliases, aliases, ta) {
110 c68baad2 2023-06-06 op TAILQ_REMOVE(&h->aliases, a, aliases);
114 c68baad2 2023-06-06 op TAILQ_FOREACH_SAFE(p, &h->proxies, proxies, tp) {
115 c68baad2 2023-06-06 op TAILQ_REMOVE(&h->proxies, p, proxies);
116 deadd9e1 2023-06-09 op free(p->cert_path);
117 deadd9e1 2023-06-09 op free(p->cert);
118 deadd9e1 2023-06-09 op free(p->key_path);
119 deadd9e1 2023-06-09 op free(p->key);
120 deadd9e1 2023-06-09 op free(p->reqca_path);
121 deadd9e1 2023-06-09 op X509_STORE_free(p->reqca);
125 af1dab18 2023-06-09 op TAILQ_REMOVE(&conf->hosts, h, vhosts);
129 86693a33 2023-06-11 op TAILQ_FOREACH_SAFE(pki, &conf->pkis, pkis, tpki) {
130 86693a33 2023-06-11 op TAILQ_REMOVE(&conf->pkis, pki, pkis);
131 86693a33 2023-06-11 op free(pki->hash);
132 86693a33 2023-06-11 op EVP_PKEY_free(pki->pkey);
136 af1dab18 2023-06-09 op memset(conf, 0, sizeof(*conf));
138 af1dab18 2023-06-09 op conf->ps = ps;
139 af1dab18 2023-06-09 op conf->sock4 = conf->sock6 = -1;
140 af1dab18 2023-06-09 op conf->protos = TLS_PROTOCOL_TLSv1_2 | TLS_PROTOCOL_TLSv1_3;
141 af1dab18 2023-06-09 op init_mime(&conf->mime);
142 af1dab18 2023-06-09 op TAILQ_INIT(&conf->fcgi);
143 af1dab18 2023-06-09 op TAILQ_INIT(&conf->hosts);
144 86693a33 2023-06-11 op TAILQ_INIT(&conf->pkis);
148 2e880a57 2023-06-10 op config_send_file(struct privsep *ps, enum privsep_procid id, int type,
149 2e880a57 2023-06-10 op int fd, void *data, size_t l)
154 c26f2460 2023-06-08 op proc_range(ps, id, &n, &m);
155 c26f2460 2023-06-08 op for (n = 0; n < m; ++n) {
157 deadd9e1 2023-06-09 op if (fd != -1 && (d = dup(fd)) == -1)
158 deadd9e1 2023-06-09 op fatal("dup %d", fd);
159 deadd9e1 2023-06-09 op if (proc_compose_imsg(ps, id, n, type, -1, d, data, l)
164 deadd9e1 2023-06-09 op if (fd != -1)
170 2e880a57 2023-06-10 op config_open_send(struct privsep *ps, enum privsep_procid id, int type,
171 2e880a57 2023-06-10 op const char *path)
175 deadd9e1 2023-06-09 op log_debug("sending %s", path);
177 deadd9e1 2023-06-09 op if ((fd = open(path, O_RDONLY)) == -1)
178 deadd9e1 2023-06-09 op fatal("can't open %s", path);
180 2e880a57 2023-06-10 op return config_send_file(ps, id, type, fd, NULL, 0);
184 86693a33 2023-06-11 op config_send_kp(struct privsep *ps, int cert_type, int key_type,
185 86693a33 2023-06-11 op const char *cert, const char *key)
189 86693a33 2023-06-11 op log_debug("sending %s", cert);
190 86693a33 2023-06-11 op if ((fd = open(cert, O_RDONLY)) == -1)
191 86693a33 2023-06-11 op fatal("can't open %s", cert);
192 86693a33 2023-06-11 op if ((d = dup(fd)) == -1)
195 86693a33 2023-06-11 op if (config_send_file(ps, PROC_SERVER, cert_type, fd, NULL, 0) == -1) {
199 86693a33 2023-06-11 op if (config_send_file(ps, PROC_CRYPTO, cert_type, d, NULL, 0) == -1)
202 86693a33 2023-06-11 op log_debug("sending %s", key);
203 86693a33 2023-06-11 op if ((fd = open(key, O_RDONLY)) == -1)
205 86693a33 2023-06-11 op if (config_send_file(ps, PROC_CRYPTO, key_type, fd, NULL, 0) == -1)
208 86693a33 2023-06-11 op if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
210 86693a33 2023-06-11 op if (proc_flush_imsg(ps, PROC_CRYPTO, -1) == -1)
216 4f4937f0 2023-06-08 op make_socket(int port, int family)
219 4f4937f0 2023-06-08 op struct sockaddr_in addr4;
220 4f4937f0 2023-06-08 op struct sockaddr_in6 addr6;
221 4f4937f0 2023-06-08 op struct sockaddr *addr;
222 4f4937f0 2023-06-08 op socklen_t len;
224 4f4937f0 2023-06-08 op switch (family) {
225 4f4937f0 2023-06-08 op case AF_INET:
226 4f4937f0 2023-06-08 op memset(&addr4, 0, sizeof(addr4));
227 4f4937f0 2023-06-08 op addr4.sin_family = family;
228 4f4937f0 2023-06-08 op addr4.sin_port = htons(port);
229 4f4937f0 2023-06-08 op addr4.sin_addr.s_addr = INADDR_ANY;
230 4f4937f0 2023-06-08 op addr = (struct sockaddr*)&addr4;
231 4f4937f0 2023-06-08 op len = sizeof(addr4);
234 4f4937f0 2023-06-08 op case AF_INET6:
235 4f4937f0 2023-06-08 op memset(&addr6, 0, sizeof(addr6));
236 4f4937f0 2023-06-08 op addr6.sin6_family = AF_INET6;
237 4f4937f0 2023-06-08 op addr6.sin6_port = htons(port);
238 4f4937f0 2023-06-08 op addr6.sin6_addr = in6addr_any;
239 4f4937f0 2023-06-08 op addr = (struct sockaddr*)&addr6;
240 4f4937f0 2023-06-08 op len = sizeof(addr6);
244 4f4937f0 2023-06-08 op /* unreachable */
248 4f4937f0 2023-06-08 op if ((sock = socket(family, SOCK_STREAM, 0)) == -1)
249 4f4937f0 2023-06-08 op fatal("socket");
252 4f4937f0 2023-06-08 op if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &v, sizeof(v)) == -1)
253 4f4937f0 2023-06-08 op fatal("setsockopt(SO_REUSEADDR)");
256 4f4937f0 2023-06-08 op if (setsockopt(sock, SOL_SOCKET, SO_REUSEPORT, &v, sizeof(v)) == -1)
257 4f4937f0 2023-06-08 op fatal("setsockopt(SO_REUSEPORT)");
259 4f4937f0 2023-06-08 op mark_nonblock(sock);
261 4f4937f0 2023-06-08 op if (bind(sock, addr, len) == -1)
262 4f4937f0 2023-06-08 op fatal("bind");
264 4f4937f0 2023-06-08 op if (listen(sock, 16) == -1)
265 4f4937f0 2023-06-08 op fatal("listen");
271 c26f2460 2023-06-08 op config_send_socks(struct conf *conf)
273 c26f2460 2023-06-08 op struct privsep *ps = conf->ps;
276 c26f2460 2023-06-08 op if ((sock = make_socket(conf->port, AF_INET)) == -1)
279 2e880a57 2023-06-10 op if (config_send_file(ps, PROC_SERVER, IMSG_RECONF_SOCK4, sock,
280 2e880a57 2023-06-10 op NULL, 0) == -1)
283 c26f2460 2023-06-08 op if (!conf->ipv6)
286 c26f2460 2023-06-08 op if ((sock = make_socket(conf->port, AF_INET6)) == -1)
289 2e880a57 2023-06-10 op if (config_send_file(ps, PROC_SERVER, IMSG_RECONF_SOCK6, sock,
290 2e880a57 2023-06-10 op NULL, 0) == -1)
297 e45334e6 2023-06-09 op config_send(struct conf *conf)
299 c26f2460 2023-06-08 op struct privsep *ps = conf->ps;
300 c26f2460 2023-06-08 op struct etm *m;
301 5d22294a 2023-06-09 op struct fcgi *fcgi;
302 c26f2460 2023-06-08 op struct vhost *h;
303 c26f2460 2023-06-08 op struct location *l;
304 c26f2460 2023-06-08 op struct proxy *p;
305 c26f2460 2023-06-08 op struct envlist *e;
306 c26f2460 2023-06-08 op struct alist *a;
309 c26f2460 2023-06-08 op for (i = 0; i < conf->mime.len; ++i) {
310 c26f2460 2023-06-08 op m = &conf->mime.t[i];
311 c26f2460 2023-06-08 op if (proc_compose(ps, PROC_SERVER, IMSG_RECONF_MIME,
312 c26f2460 2023-06-08 op m, sizeof(*m)) == -1)
316 c26f2460 2023-06-08 op if (proc_compose(ps, PROC_SERVER, IMSG_RECONF_PROTOS,
317 c26f2460 2023-06-08 op &conf->protos, sizeof(conf->protos)) == -1)
320 c26f2460 2023-06-08 op if (proc_compose(ps, PROC_SERVER, IMSG_RECONF_PORT,
321 c26f2460 2023-06-08 op &conf->port, sizeof(conf->port)) == -1)
324 c26f2460 2023-06-08 op if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
327 c26f2460 2023-06-08 op if (config_send_socks(conf) == -1)
330 c26f2460 2023-06-08 op if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
333 5d22294a 2023-06-09 op TAILQ_FOREACH(fcgi, &conf->fcgi, fcgi) {
334 5d22294a 2023-06-09 op log_debug("sending fastcgi %s", fcgi->path);
335 c26f2460 2023-06-08 op if (proc_compose(ps, PROC_SERVER, IMSG_RECONF_FCGI,
336 5d22294a 2023-06-09 op fcgi, sizeof(*fcgi)) == -1)
340 e45334e6 2023-06-09 op TAILQ_FOREACH(h, &conf->hosts, vhosts) {
341 1c6967b3 2023-06-08 op struct vhost vcopy;
343 1c6967b3 2023-06-08 op memcpy(&vcopy, h, sizeof(vcopy));
344 1c6967b3 2023-06-08 op vcopy.cert_path = NULL;
345 1c6967b3 2023-06-08 op vcopy.key_path = NULL;
346 1c6967b3 2023-06-08 op vcopy.ocsp_path = NULL;
348 c26f2460 2023-06-08 op log_debug("sending host %s", h->domain);
350 c26f2460 2023-06-08 op if (proc_compose(ps, PROC_SERVER, IMSG_RECONF_HOST,
351 1c6967b3 2023-06-08 op &vcopy, sizeof(vcopy)) == -1)
354 86693a33 2023-06-11 op if (config_send_kp(ps, IMSG_RECONF_CERT, IMSG_RECONF_KEY,
355 86693a33 2023-06-11 op h->cert_path, h->key_path) == -1)
358 1c6967b3 2023-06-08 op if (h->ocsp_path != NULL) {
359 15e60fdf 2023-06-11 op if (config_open_send(ps, PROC_SERVER, IMSG_RECONF_OCSP,
360 15e60fdf 2023-06-11 op h->ocsp_path) == -1)
362 15e60fdf 2023-06-11 op if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
366 c26f2460 2023-06-08 op TAILQ_FOREACH(l, &h->locations, locations) {
367 deadd9e1 2023-06-09 op struct location lcopy;
370 deadd9e1 2023-06-09 op memcpy(&lcopy, l, sizeof(lcopy));
371 deadd9e1 2023-06-09 op lcopy.reqca_path = NULL;
372 deadd9e1 2023-06-09 op lcopy.reqca = NULL;
373 deadd9e1 2023-06-09 op lcopy.dirfd = -1;
374 deadd9e1 2023-06-09 op memset(&lcopy.locations, 0, sizeof(lcopy.locations));
376 deadd9e1 2023-06-09 op if (l->reqca_path != NULL &&
377 deadd9e1 2023-06-09 op (fd = open(l->reqca_path, O_RDONLY)) == -1)
378 deadd9e1 2023-06-09 op fatal("can't open %s", l->reqca_path);
380 2e880a57 2023-06-10 op if (config_send_file(ps, PROC_SERVER, IMSG_RECONF_LOC,
381 2e880a57 2023-06-10 op fd, &lcopy, sizeof(lcopy)) == -1)
385 c26f2460 2023-06-08 op if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
388 c26f2460 2023-06-08 op TAILQ_FOREACH(e, &h->params, envs) {
389 c26f2460 2023-06-08 op if (proc_compose(ps, PROC_SERVER, IMSG_RECONF_ENV,
390 c26f2460 2023-06-08 op e, sizeof(*e)) == -1)
394 c26f2460 2023-06-08 op if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
397 c26f2460 2023-06-08 op TAILQ_FOREACH(a, &h->aliases, aliases) {
398 c26f2460 2023-06-08 op if (proc_compose(ps, PROC_SERVER, IMSG_RECONF_ALIAS,
399 c26f2460 2023-06-08 op a, sizeof(*a)) == -1)
403 c26f2460 2023-06-08 op if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
406 c26f2460 2023-06-08 op TAILQ_FOREACH(p, &h->proxies, proxies) {
407 deadd9e1 2023-06-09 op struct proxy pcopy;
410 deadd9e1 2023-06-09 op memcpy(&pcopy, p, sizeof(pcopy));
411 deadd9e1 2023-06-09 op pcopy.cert_path = NULL;
412 deadd9e1 2023-06-09 op pcopy.cert = NULL;
413 deadd9e1 2023-06-09 op pcopy.certlen = 0;
414 deadd9e1 2023-06-09 op pcopy.key_path = NULL;
415 deadd9e1 2023-06-09 op pcopy.key = NULL;
416 deadd9e1 2023-06-09 op pcopy.keylen = 0;
417 deadd9e1 2023-06-09 op pcopy.reqca_path = NULL;
418 deadd9e1 2023-06-09 op pcopy.reqca = NULL;
420 deadd9e1 2023-06-09 op if (p->reqca_path != NULL) {
421 deadd9e1 2023-06-09 op fd = open(p->reqca_path, O_RDONLY);
422 deadd9e1 2023-06-09 op if (fd == -1)
423 deadd9e1 2023-06-09 op fatal("can't open %s", p->reqca_path);
426 2e880a57 2023-06-10 op if (config_send_file(ps, PROC_SERVER, IMSG_RECONF_PROXY,
427 2e880a57 2023-06-10 op fd, &pcopy, sizeof(pcopy)) == -1)
430 86693a33 2023-06-11 op if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
433 86693a33 2023-06-11 op if (p->cert_path == NULL || p->key_path == NULL)
436 86693a33 2023-06-11 op if (config_open_send(ps, PROC_SERVER,
437 86693a33 2023-06-11 op IMSG_RECONF_PROXY_CERT, p->cert_path) == -1 ||
438 2e880a57 2023-06-10 op config_open_send(ps, PROC_SERVER,
439 2e880a57 2023-06-10 op IMSG_RECONF_PROXY_KEY, p->key_path) == -1)
442 deadd9e1 2023-06-09 op if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
446 c26f2460 2023-06-08 op if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
454 c26f2460 2023-06-08 op load_file(int fd, uint8_t **data, size_t *len)
456 c26f2460 2023-06-08 op struct stat sb;
459 c26f2460 2023-06-08 op if (fstat(fd, &sb) == -1)
460 c26f2460 2023-06-08 op fatal("fstat");
462 c26f2460 2023-06-08 op if (sb.st_size < 0 /* || sb.st_size > SIZE_MAX */) {
463 c26f2460 2023-06-08 op log_warnx("file too large");
467 c26f2460 2023-06-08 op *len = sb.st_size;
469 c26f2460 2023-06-08 op if ((*data = malloc(*len)) == NULL)
470 c26f2460 2023-06-08 op fatal("malloc");
472 4ad573d0 2023-06-11 op r = pread(fd, *data, *len, 0);
473 4ad573d0 2023-06-11 op if (r == -1 || (size_t)r != *len) {
474 4ad573d0 2023-06-11 op log_warn("read failed");
485 86693a33 2023-06-11 op config_crypto_recv_kp(struct conf *conf, struct imsg *imsg)
487 86693a33 2023-06-11 op static struct pki *pki;
491 86693a33 2023-06-11 op /* XXX: check for duplicates */
493 86693a33 2023-06-11 op if (imsg->fd == -1)
494 86693a33 2023-06-11 op fatalx("no fd for imsg %d", imsg->hdr.type);
496 86693a33 2023-06-11 op switch (imsg->hdr.type) {
497 86693a33 2023-06-11 op case IMSG_RECONF_CERT:
498 86693a33 2023-06-11 op if (pki != NULL)
499 86693a33 2023-06-11 op fatalx("imsg in wrong order; pki is not NULL");
500 86693a33 2023-06-11 op if ((pki = calloc(1, sizeof(*pki))) == NULL)
501 86693a33 2023-06-11 op fatal("calloc");
502 86693a33 2023-06-11 op if (load_file(imsg->fd, &d, &len) == -1)
503 86693a33 2023-06-11 op fatalx("can't load file");
504 86693a33 2023-06-11 op if ((pki->hash = ssl_pubkey_hash(d, len)) == NULL)
505 86693a33 2023-06-11 op fatalx("failed to compute cert hash");
507 86693a33 2023-06-11 op TAILQ_INSERT_TAIL(&conf->pkis, pki, pkis);
510 86693a33 2023-06-11 op case IMSG_RECONF_KEY:
511 86693a33 2023-06-11 op if (pki == NULL)
512 86693a33 2023-06-11 op fatalx("got key without cert beforehand %d",
513 86693a33 2023-06-11 op imsg->hdr.type);
514 86693a33 2023-06-11 op if (load_file(imsg->fd, &d, &len) == -1)
515 86693a33 2023-06-11 op fatalx("failed to load private key");
516 86693a33 2023-06-11 op if ((pki->pkey = ssl_load_pkey(d, len)) == NULL)
517 86693a33 2023-06-11 op fatalx("failed load private key");
530 c26f2460 2023-06-08 op config_recv(struct conf *conf, struct imsg *imsg)
532 c26f2460 2023-06-08 op static struct vhost *h;
533 deadd9e1 2023-06-09 op static struct proxy *p;
534 c26f2460 2023-06-08 op struct privsep *ps = conf->ps;
535 c26f2460 2023-06-08 op struct etm m;
536 5d22294a 2023-06-09 op struct fcgi *fcgi;
537 c26f2460 2023-06-08 op struct vhost *vh, vht;
538 c26f2460 2023-06-08 op struct location *loc;
539 c26f2460 2023-06-08 op struct envlist *env;
540 c26f2460 2023-06-08 op struct alist *alias;
541 c26f2460 2023-06-08 op struct proxy *proxy;
542 5d22294a 2023-06-09 op size_t datalen;
544 c26f2460 2023-06-08 op datalen = IMSG_DATA_SIZE(imsg);
546 c26f2460 2023-06-08 op switch (imsg->hdr.type) {
547 c26f2460 2023-06-08 op case IMSG_RECONF_START:
548 af1dab18 2023-06-09 op config_purge(conf);
553 c26f2460 2023-06-08 op case IMSG_RECONF_MIME:
554 c26f2460 2023-06-08 op IMSG_SIZE_CHECK(imsg, &m);
555 c26f2460 2023-06-08 op memcpy(&m, imsg->data, datalen);
556 c26f2460 2023-06-08 op if (m.mime[sizeof(m.mime) - 1] != '\0' ||
557 c26f2460 2023-06-08 op m.ext[sizeof(m.ext) - 1] != '\0')
558 c26f2460 2023-06-08 op fatal("received corrupted IMSG_RECONF_MIME");
559 c26f2460 2023-06-08 op if (add_mime(&conf->mime, m.mime, m.ext) == -1)
560 c26f2460 2023-06-08 op fatal("failed to add mime mapping %s -> %s",
561 c26f2460 2023-06-08 op m.mime, m.ext);
564 c26f2460 2023-06-08 op case IMSG_RECONF_PROTOS:
565 c26f2460 2023-06-08 op IMSG_SIZE_CHECK(imsg, &conf->protos);
566 c26f2460 2023-06-08 op memcpy(&conf->protos, imsg->data, datalen);
569 c26f2460 2023-06-08 op case IMSG_RECONF_PORT:
570 c26f2460 2023-06-08 op IMSG_SIZE_CHECK(imsg, &conf->port);
571 c26f2460 2023-06-08 op memcpy(&conf->port, imsg->data, datalen);
574 c26f2460 2023-06-08 op case IMSG_RECONF_SOCK4:
575 c26f2460 2023-06-08 op if (conf->sock4 != -1)
576 c26f2460 2023-06-08 op fatalx("socket ipv4 already recv'd");
577 c26f2460 2023-06-08 op if (imsg->fd == -1)
578 c26f2460 2023-06-08 op fatalx("missing socket for IMSG_RECONF_SOCK4");
579 c26f2460 2023-06-08 op conf->sock4 = imsg->fd;
580 c26f2460 2023-06-08 op event_set(&conf->evsock4, conf->sock4, EV_READ|EV_PERSIST,
581 af1dab18 2023-06-09 op do_accept, conf);
584 c26f2460 2023-06-08 op case IMSG_RECONF_SOCK6:
585 c26f2460 2023-06-08 op if (conf->sock6 != -1)
586 c26f2460 2023-06-08 op fatalx("socket ipv6 already recv'd");
587 c26f2460 2023-06-08 op if (imsg->fd == -1)
588 c26f2460 2023-06-08 op fatalx("missing socket for IMSG_RECONF_SOCK6");
589 c26f2460 2023-06-08 op conf->sock6 = imsg->fd;
590 c26f2460 2023-06-08 op event_set(&conf->evsock6, conf->sock6, EV_READ|EV_PERSIST,
591 af1dab18 2023-06-09 op do_accept, conf);
594 c26f2460 2023-06-08 op case IMSG_RECONF_FCGI:
595 5d22294a 2023-06-09 op IMSG_SIZE_CHECK(imsg, fcgi);
596 5d22294a 2023-06-09 op fcgi = xcalloc(1, sizeof(*fcgi));
597 5d22294a 2023-06-09 op memcpy(fcgi, imsg->data, datalen);
598 5d22294a 2023-06-09 op log_debug("received fcgi %s", fcgi->path);
599 5d22294a 2023-06-09 op TAILQ_INSERT_TAIL(&conf->fcgi, fcgi, fcgi);
602 c26f2460 2023-06-08 op case IMSG_RECONF_HOST:
603 c26f2460 2023-06-08 op IMSG_SIZE_CHECK(imsg, &vht);
604 c26f2460 2023-06-08 op memcpy(&vht, imsg->data, datalen);
605 c26f2460 2023-06-08 op vh = new_vhost();
606 c26f2460 2023-06-08 op strlcpy(vh->domain, vht.domain, sizeof(vh->domain));
608 e45334e6 2023-06-09 op TAILQ_INSERT_TAIL(&conf->hosts, h, vhosts);
610 deadd9e1 2023-06-09 op /* reset proxy */
614 c26f2460 2023-06-08 op case IMSG_RECONF_CERT:
615 c26f2460 2023-06-08 op log_debug("receiving cert");
616 86693a33 2023-06-11 op if (privsep_process == PROC_CRYPTO)
617 86693a33 2023-06-11 op return config_crypto_recv_kp(conf, imsg);
618 c26f2460 2023-06-08 op if (h == NULL)
619 c26f2460 2023-06-08 op fatalx("recv'd cert without host");
620 c26f2460 2023-06-08 op if (h->cert != NULL)
621 c26f2460 2023-06-08 op fatalx("cert already received");
622 c26f2460 2023-06-08 op if (imsg->fd == -1)
623 c26f2460 2023-06-08 op fatalx("no fd for IMSG_RECONF_CERT");
624 c26f2460 2023-06-08 op if (load_file(imsg->fd, &h->cert, &h->certlen) == -1)
625 c26f2460 2023-06-08 op fatalx("failed to load cert for %s",
629 c26f2460 2023-06-08 op case IMSG_RECONF_KEY:
630 c26f2460 2023-06-08 op log_debug("receiving key");
631 86693a33 2023-06-11 op if (privsep_process == PROC_CRYPTO)
632 86693a33 2023-06-11 op return config_crypto_recv_kp(conf, imsg);
633 c26f2460 2023-06-08 op if (h == NULL)
634 c26f2460 2023-06-08 op fatalx("recv'd key without host");
635 c26f2460 2023-06-08 op if (h->key != NULL)
636 c26f2460 2023-06-08 op fatalx("key already received");
637 c26f2460 2023-06-08 op if (imsg->fd == -1)
638 c26f2460 2023-06-08 op fatalx("no fd for IMSG_RECONF_KEY");
639 c26f2460 2023-06-08 op if (load_file(imsg->fd, &h->key, &h->keylen) == -1)
640 c26f2460 2023-06-08 op fatalx("failed to load key for %s",
644 c26f2460 2023-06-08 op case IMSG_RECONF_OCSP:
645 c26f2460 2023-06-08 op log_debug("receiving ocsp");
646 c26f2460 2023-06-08 op if (h == NULL)
647 c26f2460 2023-06-08 op fatalx("recv'd ocsp without host");
648 c26f2460 2023-06-08 op if (h->ocsp != NULL)
649 c26f2460 2023-06-08 op fatalx("ocsp already received");
650 c26f2460 2023-06-08 op if (imsg->fd == -1)
651 c26f2460 2023-06-08 op fatalx("no fd for IMSG_RECONF_OCSP");
652 c26f2460 2023-06-08 op if (load_file(imsg->fd, &h->ocsp, &h->ocsplen) == -1)
653 c26f2460 2023-06-08 op fatalx("failed to load ocsp for %s",
657 c26f2460 2023-06-08 op case IMSG_RECONF_LOC:
658 c26f2460 2023-06-08 op if (h == NULL)
659 c26f2460 2023-06-08 op fatalx("recv'd location without host");
660 c26f2460 2023-06-08 op IMSG_SIZE_CHECK(imsg, loc);
661 c26f2460 2023-06-08 op loc = xcalloc(1, sizeof(*loc));
662 c26f2460 2023-06-08 op memcpy(loc, imsg->data, datalen);
664 deadd9e1 2023-06-09 op if (imsg->fd != -1) {
665 deadd9e1 2023-06-09 op loc->reqca = load_ca(imsg->fd);
666 deadd9e1 2023-06-09 op if (loc->reqca == NULL)
667 deadd9e1 2023-06-09 op fatalx("failed to load CA");
670 c26f2460 2023-06-08 op TAILQ_INSERT_TAIL(&h->locations, loc, locations);
673 c26f2460 2023-06-08 op case IMSG_RECONF_ENV:
674 c26f2460 2023-06-08 op if (h == NULL)
675 c26f2460 2023-06-08 op fatalx("recv'd env without host");
676 c26f2460 2023-06-08 op IMSG_SIZE_CHECK(imsg, env);
677 c26f2460 2023-06-08 op env = xcalloc(1, sizeof(*env));
678 c26f2460 2023-06-08 op memcpy(env, imsg->data, datalen);
679 c26f2460 2023-06-08 op TAILQ_INSERT_TAIL(&h->params, env, envs);
682 c26f2460 2023-06-08 op case IMSG_RECONF_ALIAS:
683 c26f2460 2023-06-08 op if (h == NULL)
684 c26f2460 2023-06-08 op fatalx("recv'd alias without host");
685 c26f2460 2023-06-08 op IMSG_SIZE_CHECK(imsg, alias);
686 c26f2460 2023-06-08 op alias = xcalloc(1, sizeof(*alias));
687 c26f2460 2023-06-08 op memcpy(alias, imsg->data, datalen);
688 c26f2460 2023-06-08 op TAILQ_INSERT_TAIL(&h->aliases, alias, aliases);
691 c26f2460 2023-06-08 op case IMSG_RECONF_PROXY:
692 c26f2460 2023-06-08 op log_debug("receiving proxy");
693 c26f2460 2023-06-08 op if (h == NULL)
694 c26f2460 2023-06-08 op fatalx("recv'd proxy without host");
695 c26f2460 2023-06-08 op IMSG_SIZE_CHECK(imsg, proxy);
696 c26f2460 2023-06-08 op proxy = xcalloc(1, sizeof(*proxy));
697 c26f2460 2023-06-08 op memcpy(proxy, imsg->data, datalen);
699 deadd9e1 2023-06-09 op if (imsg->fd != -1) {
700 deadd9e1 2023-06-09 op proxy->reqca = load_ca(imsg->fd);
701 deadd9e1 2023-06-09 op if (proxy->reqca == NULL)
702 deadd9e1 2023-06-09 op fatal("failed to load CA");
705 c26f2460 2023-06-08 op TAILQ_INSERT_TAIL(&h->proxies, proxy, proxies);
709 deadd9e1 2023-06-09 op case IMSG_RECONF_PROXY_CERT:
710 deadd9e1 2023-06-09 op log_debug("receiving proxy cert");
711 deadd9e1 2023-06-09 op if (p == NULL)
712 deadd9e1 2023-06-09 op fatalx("recv'd proxy cert without proxy");
713 deadd9e1 2023-06-09 op if (p->cert != NULL)
714 deadd9e1 2023-06-09 op fatalx("proxy cert already received");
715 deadd9e1 2023-06-09 op if (imsg->fd == -1)
716 deadd9e1 2023-06-09 op fatalx("no fd for IMSG_RECONF_PROXY_CERT");
717 deadd9e1 2023-06-09 op if (load_file(imsg->fd, &p->cert, &p->certlen) == -1)
718 deadd9e1 2023-06-09 op fatalx("failed to load cert for proxy %s of %s",
719 deadd9e1 2023-06-09 op p->host, h->domain);
722 deadd9e1 2023-06-09 op case IMSG_RECONF_PROXY_KEY:
723 deadd9e1 2023-06-09 op log_debug("receiving proxy key");
724 deadd9e1 2023-06-09 op if (p == NULL)
725 deadd9e1 2023-06-09 op fatalx("recv'd proxy key without proxy");
726 deadd9e1 2023-06-09 op if (p->key != NULL)
727 deadd9e1 2023-06-09 op fatalx("proxy key already received");
728 deadd9e1 2023-06-09 op if (imsg->fd == -1)
729 deadd9e1 2023-06-09 op fatalx("no fd for IMSG_RECONF_PROXY_KEY");
730 deadd9e1 2023-06-09 op if (load_file(imsg->fd, &p->key, &p->keylen) == -1)
731 deadd9e1 2023-06-09 op fatalx("failed to load key for proxy %s of %s",
732 deadd9e1 2023-06-09 op p->host, h->domain);
735 c26f2460 2023-06-08 op case IMSG_RECONF_END:
736 c26f2460 2023-06-08 op if (proc_compose(ps, PROC_PARENT, IMSG_RECONF_DONE,
737 c26f2460 2023-06-08 op NULL, 0) == -1)
