1 8d1b399b 2021-07-22 op /*
  2 8d1b399b 2021-07-22 op  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
  3 8d1b399b 2021-07-22 op  * Copyright (c) 2018 Florian Obser <florian@openbsd.org>
  4 8d1b399b 2021-07-22 op  * Copyright (c) 2004, 2005 Claudio Jeker <claudio@openbsd.org>
  5 8d1b399b 2021-07-22 op  * Copyright (c) 2004 Esben Norby <norby@openbsd.org>
  6 8d1b399b 2021-07-22 op  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
  7 8d1b399b 2021-07-22 op  *
  8 8d1b399b 2021-07-22 op  * Permission to use, copy, modify, and distribute this software for any
  9 8d1b399b 2021-07-22 op  * purpose with or without fee is hereby granted, provided that the above
 10 8d1b399b 2021-07-22 op  * copyright notice and this permission notice appear in all copies.
 11 8d1b399b 2021-07-22 op  *
 12 8d1b399b 2021-07-22 op  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 13 8d1b399b 2021-07-22 op  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 14 8d1b399b 2021-07-22 op  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 15 8d1b399b 2021-07-22 op  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 16 8d1b399b 2021-07-22 op  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 17 8d1b399b 2021-07-22 op  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 18 8d1b399b 2021-07-22 op  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 19 8d1b399b 2021-07-22 op  */
 20 8d1b399b 2021-07-22 op 
 21 8d1b399b 2021-07-22 op #include "compat.h"
 22 8d1b399b 2021-07-22 op 
 23 8d1b399b 2021-07-22 op #include <sys/socket.h>
 24 8d1b399b 2021-07-22 op #include <sys/tree.h>
 25 8d1b399b 2021-07-22 op 
 26 8d1b399b 2021-07-22 op #include <errno.h>
 27 8d1b399b 2021-07-22 op #include <inttypes.h>
 28 8d1b399b 2021-07-22 op #include <pwd.h>
 29 8d1b399b 2021-07-22 op #include <signal.h>
 30 8d1b399b 2021-07-22 op #include <stdio.h>
 31 8d1b399b 2021-07-22 op #include <stdlib.h>
 32 8d1b399b 2021-07-22 op #include <string.h>
 33 8d1b399b 2021-07-22 op #include <syslog.h>
 34 8d1b399b 2021-07-22 op #include <unistd.h>
 35 8d1b399b 2021-07-22 op 
 36 8d1b399b 2021-07-22 op #include "control.h"
 37 8d1b399b 2021-07-22 op #include "kamid.h"
 38 8d1b399b 2021-07-22 op #include "listener.h"
 39 8d1b399b 2021-07-22 op #include "log.h"
 40 8d1b399b 2021-07-22 op #include "sandbox.h"
 41 8d1b399b 2021-07-22 op #include "utils.h"
 42 8d1b399b 2021-07-22 op 
 43 8d1b399b 2021-07-22 op #define MIN(a, b) ((a) < (b) ? (a) : (b))
 44 8d1b399b 2021-07-22 op 
 45 8d1b399b 2021-07-22 op static struct kd_conf	*listener_conf;
 46 8d1b399b 2021-07-22 op static struct imsgev	*iev_main;
 47 8d1b399b 2021-07-22 op 
 48 8d1b399b 2021-07-22 op static void	listener_sig_handler(int, short, void *);
 49 8d1b399b 2021-07-22 op __dead void	listener_shutdown(void);
 50 8d1b399b 2021-07-22 op 
 51 8d1b399b 2021-07-22 op SPLAY_HEAD(clients_tree_id, client) clients;
 52 8d1b399b 2021-07-22 op 
 53 8d1b399b 2021-07-22 op struct client {
 54 8d1b399b 2021-07-22 op 	uint32_t		 id;
 55 8d1b399b 2021-07-22 op 	int			 fd;
 56 8d1b399b 2021-07-22 op 	int			 done;
 57 8d1b399b 2021-07-22 op 	struct tls		*ctx;
 58 8d1b399b 2021-07-22 op 	struct event		 event;
 59 8d1b399b 2021-07-22 op 	struct imsgev		 iev;
 60 8d1b399b 2021-07-22 op 	struct bufferevent	*bev;
 61 8d1b399b 2021-07-22 op 	SPLAY_ENTRY(client)	 sp_entry;
 62 8d1b399b 2021-07-22 op };
 63 8d1b399b 2021-07-22 op 
 64 8d1b399b 2021-07-22 op static void	listener_imsg_event_add(struct imsgev *, void *);
 65 8d1b399b 2021-07-22 op static void	listener_dispatch_client(int, short, void *);
 66 8d1b399b 2021-07-22 op static int	listener_imsg_compose_client(struct client *, int,
 67 8d1b399b 2021-07-22 op     uint32_t, const void *, uint16_t);
 68 8d1b399b 2021-07-22 op 
 69 8d1b399b 2021-07-22 op static void	apply_config(struct kd_conf *);
 70 8d1b399b 2021-07-22 op static void	handle_accept(int, short, void *);
 71 8d1b399b 2021-07-22 op 
 72 8d1b399b 2021-07-22 op static void	handle_handshake(int, short, void *);
 73 8d1b399b 2021-07-22 op static void	client_read(struct bufferevent *, void *);
 74 8d1b399b 2021-07-22 op static void	client_write(struct bufferevent *, void *);
 75 8d1b399b 2021-07-22 op static void	client_error(struct bufferevent *, short, void *);
 76 8d1b399b 2021-07-22 op static void	client_tls_readcb(int, short, void *);
 77 8d1b399b 2021-07-22 op static void	client_tls_writecb(int, short, void *);
 78 8d1b399b 2021-07-22 op static void	close_conn(struct client *);
 79 8d1b399b 2021-07-22 op static void	handle_close(int, short, void *);
 80 8d1b399b 2021-07-22 op 
 81 8d1b399b 2021-07-22 op static inline int
 82 8d1b399b 2021-07-22 op clients_tree_cmp(struct client *a, struct client *b)
 83 8d1b399b 2021-07-22 op {
 84 8d1b399b 2021-07-22 op 	if (a->id == b->id)
 85 8d1b399b 2021-07-22 op 		return 0;
 86 8d1b399b 2021-07-22 op 	else if (a->id < b->id)
 87 8d1b399b 2021-07-22 op 		return -1;
 88 8d1b399b 2021-07-22 op 	else
 89 8d1b399b 2021-07-22 op 		return +1;
 90 8d1b399b 2021-07-22 op }
 91 8d1b399b 2021-07-22 op 
 92 8d1b399b 2021-07-22 op SPLAY_PROTOTYPE(clients_tree_id, client, sp_entry, clients_tree_cmp);
 93 8d1b399b 2021-07-22 op SPLAY_GENERATE(clients_tree_id, client, sp_entry, clients_tree_cmp)
 94 8d1b399b 2021-07-22 op 
 95 8d1b399b 2021-07-22 op static void
 96 8d1b399b 2021-07-22 op listener_sig_handler(int sig, short event, void *d)
 97 8d1b399b 2021-07-22 op {
 98 8d1b399b 2021-07-22 op 	/*
 99 8d1b399b 2021-07-22 op 	 * Normal signal handler rules don't apply because libevent
100 8d1b399b 2021-07-22 op 	 * decouples for us.
101 8d1b399b 2021-07-22 op 	 */
102 8d1b399b 2021-07-22 op 
103 8d1b399b 2021-07-22 op 	switch (sig) {
104 8d1b399b 2021-07-22 op 	case SIGINT:
105 8d1b399b 2021-07-22 op 	case SIGTERM:
106 8d1b399b 2021-07-22 op 		listener_shutdown();
107 8d1b399b 2021-07-22 op 	default:
108 8d1b399b 2021-07-22 op 		fatalx("unexpected signal %d", sig);
109 8d1b399b 2021-07-22 op 	}
110 8d1b399b 2021-07-22 op }
111 8d1b399b 2021-07-22 op 
112 8d1b399b 2021-07-22 op void
113 8d1b399b 2021-07-22 op listener(int debug, int verbose)
114 8d1b399b 2021-07-22 op {
115 8d1b399b 2021-07-22 op 	struct event		 ev_sigint, ev_sigterm;
116 8d1b399b 2021-07-22 op 	struct passwd		*pw;
117 8d1b399b 2021-07-22 op 
118 8d1b399b 2021-07-22 op 	/* listener_conf = config_new_empty(); */
119 8d1b399b 2021-07-22 op 
120 8d1b399b 2021-07-22 op 	log_init(debug, LOG_DAEMON);
121 8d1b399b 2021-07-22 op 	log_setverbose(verbose);
122 8d1b399b 2021-07-22 op 
123 8d1b399b 2021-07-22 op 	if ((pw = getpwnam(KD_USER)) == NULL)
124 8d1b399b 2021-07-22 op 		fatal("getpwnam");
125 8d1b399b 2021-07-22 op 
126 8d1b399b 2021-07-22 op 	if (chroot(pw->pw_dir) == -1)
127 8d1b399b 2021-07-22 op 		fatal("chroot");
128 8d1b399b 2021-07-22 op 	if (chdir("/") == -1)
129 8d1b399b 2021-07-22 op 		fatal("chdir(\"/\")");
130 8d1b399b 2021-07-22 op 
131 8d1b399b 2021-07-22 op 	setproctitle("listener");
132 8d1b399b 2021-07-22 op 	log_procinit("listener");
133 8d1b399b 2021-07-22 op 
134 8d1b399b 2021-07-22 op 	if (setgroups(1, &pw->pw_gid) ||
135 8d1b399b 2021-07-22 op 	    setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
136 8d1b399b 2021-07-22 op 	    setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))
137 8d1b399b 2021-07-22 op 		fatal("can't drop privileges");
138 8d1b399b 2021-07-22 op 
139 8d1b399b 2021-07-22 op 	event_init();
140 8d1b399b 2021-07-22 op 
141 8d1b399b 2021-07-22 op 	/* Setup signal handlers(s). */
142 8d1b399b 2021-07-22 op 	signal_set(&ev_sigint, SIGINT, listener_sig_handler, NULL);
143 8d1b399b 2021-07-22 op 	signal_set(&ev_sigterm, SIGTERM, listener_sig_handler, NULL);
144 8d1b399b 2021-07-22 op 
145 8d1b399b 2021-07-22 op 	signal_add(&ev_sigint, NULL);
146 8d1b399b 2021-07-22 op 	signal_add(&ev_sigterm, NULL);
147 8d1b399b 2021-07-22 op 
148 8d1b399b 2021-07-22 op 	signal(SIGPIPE, SIG_IGN);
149 8d1b399b 2021-07-22 op 	signal(SIGHUP, SIG_IGN);
150 8d1b399b 2021-07-22 op 
151 8d1b399b 2021-07-22 op 	/* Setup pipe and event handler to the main process. */
152 8d1b399b 2021-07-22 op 	if ((iev_main = malloc(sizeof(*iev_main))) == NULL)
153 8d1b399b 2021-07-22 op 		fatal(NULL);
154 8d1b399b 2021-07-22 op 
155 8d1b399b 2021-07-22 op 	imsg_init(&iev_main->ibuf, 3);
156 8d1b399b 2021-07-22 op 	iev_main->handler = listener_dispatch_main;
157 8d1b399b 2021-07-22 op 
158 8d1b399b 2021-07-22 op 	/* Setup event handlers. */
159 8d1b399b 2021-07-22 op 	iev_main->events = EV_READ;
160 8d1b399b 2021-07-22 op 	event_set(&iev_main->ev, iev_main->ibuf.fd, iev_main->events,
161 8d1b399b 2021-07-22 op 	    iev_main->handler, iev_main);
162 8d1b399b 2021-07-22 op 	event_add(&iev_main->ev, NULL);
163 8d1b399b 2021-07-22 op 
164 8d1b399b 2021-07-22 op 	sandbox_listener();
165 8d1b399b 2021-07-22 op 	event_dispatch();
166 8d1b399b 2021-07-22 op 	listener_shutdown();
167 8d1b399b 2021-07-22 op }
168 8d1b399b 2021-07-22 op 
169 8d1b399b 2021-07-22 op __dead void
170 8d1b399b 2021-07-22 op listener_shutdown(void)
171 8d1b399b 2021-07-22 op {
172 8d1b399b 2021-07-22 op 	msgbuf_clear(&iev_main->ibuf.w);
173 8d1b399b 2021-07-22 op 	close(iev_main->ibuf.fd);
174 8d1b399b 2021-07-22 op 
175 8d1b399b 2021-07-22 op 	config_clear(listener_conf);
176 8d1b399b 2021-07-22 op 
177 8d1b399b 2021-07-22 op 	free(iev_main);
178 8d1b399b 2021-07-22 op 
179 8d1b399b 2021-07-22 op 	log_info("listener exiting");
180 8d1b399b 2021-07-22 op 	exit(0);
181 8d1b399b 2021-07-22 op }
182 8d1b399b 2021-07-22 op 
183 8d1b399b 2021-07-22 op static void
184 8d1b399b 2021-07-22 op listener_receive_config(struct imsg *imsg, struct kd_conf **nconf,
185 8d1b399b 2021-07-22 op     struct kd_pki_conf **pki)
186 8d1b399b 2021-07-22 op {
187 8d1b399b 2021-07-22 op 	struct kd_listen_conf *listen;
188 8d1b399b 2021-07-22 op 	char *t;
189 8d1b399b 2021-07-22 op 
190 8d1b399b 2021-07-22 op 	switch (imsg->hdr.type) {
191 8d1b399b 2021-07-22 op 	case IMSG_RECONF_CONF:
192 8d1b399b 2021-07-22 op 		if (*nconf != NULL)
193 8d1b399b 2021-07-22 op 			fatalx("%s: IMSG_RECONF_CONF already in "
194 8d1b399b 2021-07-22 op 			    "progress", __func__);
195 8d1b399b 2021-07-22 op 
196 8d1b399b 2021-07-22 op 		if (listener_conf != NULL)
197 8d1b399b 2021-07-22 op 			fatalx("%s: don't know how reload the "
198 8d1b399b 2021-07-22 op 			    "configuration yet", __func__);
199 8d1b399b 2021-07-22 op 
200 8d1b399b 2021-07-22 op 		if (IMSG_DATA_SIZE(*imsg) != sizeof(struct kd_conf))
201 8d1b399b 2021-07-22 op 			fatalx("%s: IMSG_RECONF_CONF wrong length: %lu",
202 8d1b399b 2021-07-22 op 			    __func__, IMSG_DATA_SIZE(*imsg));
203 8d1b399b 2021-07-22 op 		if ((*nconf = malloc(sizeof(**nconf))) == NULL)
204 8d1b399b 2021-07-22 op 			fatal(NULL);
205 8d1b399b 2021-07-22 op 		memcpy(*nconf, imsg->data, sizeof(**nconf));
206 8d1b399b 2021-07-22 op 		memset(&(*nconf)->pki_head, 0, sizeof((*nconf)->pki_head));
207 8d1b399b 2021-07-22 op 		memset(&(*nconf)->table_head, 0, sizeof((*nconf)->table_head));
208 8d1b399b 2021-07-22 op 		memset(&(*nconf)->listen_head, 0, sizeof((*nconf)->listen_head));
209 8d1b399b 2021-07-22 op 		break;
210 8d1b399b 2021-07-22 op 	case IMSG_RECONF_PKI:
211 8d1b399b 2021-07-22 op 		if (*nconf == NULL)
212 8d1b399b 2021-07-22 op 			fatalx("%s: IMSG_RECONF_PKI without "
213 8d1b399b 2021-07-22 op 			    "IMSG_RECONF_CONF", __func__);
214 8d1b399b 2021-07-22 op 		*pki = xcalloc(1, sizeof(**pki));
215 8d1b399b 2021-07-22 op 		t = imsg->data;
216 8d1b399b 2021-07-22 op 		t[IMSG_DATA_SIZE(*imsg)-1] = '\0';
217 8d1b399b 2021-07-22 op 		strlcpy((*pki)->name, t, sizeof((*pki)->name));
218 8d1b399b 2021-07-22 op 		break;
219 8d1b399b 2021-07-22 op 	case IMSG_RECONF_PKI_CERT:
220 8d1b399b 2021-07-22 op 		if (*pki == NULL)
221 8d1b399b 2021-07-22 op 			fatalx("%s: IMSG_RECONF_PKI_CERT without "
222 8d1b399b 2021-07-22 op 			    "IMSG_RECONF_PKI", __func__);
223 8d1b399b 2021-07-22 op 		(*pki)->certlen = IMSG_DATA_SIZE(*imsg);
224 8d1b399b 2021-07-22 op 		(*pki)->cert = xmemdup(imsg->data, (*pki)->certlen);
225 8d1b399b 2021-07-22 op 		break;
226 8d1b399b 2021-07-22 op 	case IMSG_RECONF_PKI_KEY:
227 8d1b399b 2021-07-22 op 		if (*pki == NULL)
228 8d1b399b 2021-07-22 op 			fatalx("%s: IMSG_RECONF_PKI_KEY without "
229 8d1b399b 2021-07-22 op 			    "IMSG_RECONF_PKI", __func__);
230 8d1b399b 2021-07-22 op 		(*pki)->keylen = IMSG_DATA_SIZE(*imsg);
231 8d1b399b 2021-07-22 op 		(*pki)->key = xmemdup(imsg->data, (*pki)->keylen);
232 8d1b399b 2021-07-22 op 		SIMPLEQ_INSERT_HEAD(&(*nconf)->pki_head, *pki, entry);
233 8d1b399b 2021-07-22 op 		pki = NULL;
234 8d1b399b 2021-07-22 op 		break;
235 8d1b399b 2021-07-22 op 	case IMSG_RECONF_LISTEN:
236 8d1b399b 2021-07-22 op 		if (*nconf == NULL)
237 8d1b399b 2021-07-22 op 			fatalx("%s: IMSG_RECONF_LISTEN without "
238 8d1b399b 2021-07-22 op 			    "IMSG_RECONF_CONF", __func__);
239 8d1b399b 2021-07-22 op 		if (IMSG_DATA_SIZE(*imsg) != sizeof(*listen))
240 8d1b399b 2021-07-22 op 			fatalx("%s: IMSG_RECONF_LISTEN wrong length: %lu",
241 8d1b399b 2021-07-22 op 			    __func__, IMSG_DATA_SIZE(*imsg));
242 8d1b399b 2021-07-22 op 		listen = xcalloc(1, sizeof(*listen));
243 8d1b399b 2021-07-22 op 		memcpy(listen, imsg->data, sizeof(*listen));
244 8d1b399b 2021-07-22 op 		memset(&listen->entry, 0, sizeof(listen->entry));
245 8d1b399b 2021-07-22 op 		if ((listen->fd = imsg->fd) == -1)
246 8d1b399b 2021-07-22 op 			fatalx("%s: IMSG_RECONF_LISTEN no fd",
247 8d1b399b 2021-07-22 op 			    __func__);
248 8d1b399b 2021-07-22 op 		listen->auth_table = NULL;
249 8d1b399b 2021-07-22 op 		memset(&listen->ev, 0, sizeof(listen->ev));
250 8d1b399b 2021-07-22 op 		SIMPLEQ_INSERT_HEAD(&(*nconf)->listen_head, listen, entry);
251 8d1b399b 2021-07-22 op 		break;
252 8d1b399b 2021-07-22 op 	case IMSG_RECONF_END:
253 8d1b399b 2021-07-22 op 		if (*nconf == NULL)
254 8d1b399b 2021-07-22 op 			fatalx("%s: IMSG_RECONF_END without "
255 8d1b399b 2021-07-22 op 			    "IMSG_RECONF_CONF", __func__);
256 8d1b399b 2021-07-22 op 		/* merge_config(listener_conf, nconf); */
257 8d1b399b 2021-07-22 op 		apply_config(*nconf);
258 8d1b399b 2021-07-22 op 		*nconf = NULL;
259 8d1b399b 2021-07-22 op 		break;
260 8d1b399b 2021-07-22 op 	}
261 8d1b399b 2021-07-22 op }
262 8d1b399b 2021-07-22 op 
263 8d1b399b 2021-07-22 op void
264 8d1b399b 2021-07-22 op listener_dispatch_main(int fd, short event, void *d)
265 8d1b399b 2021-07-22 op {
266 8d1b399b 2021-07-22 op 	static struct kd_conf		*nconf;
267 8d1b399b 2021-07-22 op 	static struct kd_pki_conf	*pki;
268 8d1b399b 2021-07-22 op 	struct client			*client, find;
269 8d1b399b 2021-07-22 op 	struct imsg			 imsg;
270 8d1b399b 2021-07-22 op 	struct imsgev			*iev = d;
271 8d1b399b 2021-07-22 op 	struct imsgbuf			*ibuf;
272 8d1b399b 2021-07-22 op 	ssize_t				 n;
273 8d1b399b 2021-07-22 op 	int				 shut = 0;
274 8d1b399b 2021-07-22 op 
275 8d1b399b 2021-07-22 op 	ibuf = &iev->ibuf;
276 8d1b399b 2021-07-22 op 
277 8d1b399b 2021-07-22 op 	if (event & EV_READ) {
278 8d1b399b 2021-07-22 op 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
279 8d1b399b 2021-07-22 op 			fatal("imsg_read error");
280 8d1b399b 2021-07-22 op 		if (n == 0)	/* Connection closed. */
281 8d1b399b 2021-07-22 op 			shut = 1;
282 8d1b399b 2021-07-22 op 	}
283 8d1b399b 2021-07-22 op 	if (event & EV_WRITE) {
284 8d1b399b 2021-07-22 op 		if ((n = msgbuf_write(&ibuf->w)) == -1 && errno != EAGAIN)
285 8d1b399b 2021-07-22 op 			fatal("msgbuf_write");
286 8d1b399b 2021-07-22 op 		if (n == 0)	/* Connection closed. */
287 8d1b399b 2021-07-22 op 			shut = 1;
288 8d1b399b 2021-07-22 op 	}
289 8d1b399b 2021-07-22 op 
290 8d1b399b 2021-07-22 op 	for (;;) {
291 8d1b399b 2021-07-22 op 		if ((n = imsg_get(ibuf, &imsg)) == -1)
292 8d1b399b 2021-07-22 op 			fatal("%s: imsg_get error", __func__);
293 8d1b399b 2021-07-22 op 		if (n == 0)	/* No more messages. */
294 8d1b399b 2021-07-22 op 			break;
295 8d1b399b 2021-07-22 op 
296 8d1b399b 2021-07-22 op 		switch (imsg.hdr.type) {
297 8d1b399b 2021-07-22 op 		case IMSG_CONTROLFD:
298 8d1b399b 2021-07-22 op 			if ((fd = imsg.fd) == -1)
299 8d1b399b 2021-07-22 op 				fatalx("%s: expected to receive imsg "
300 8d1b399b 2021-07-22 op 				    "control fd but didn't receive any",
301 8d1b399b 2021-07-22 op 				    __func__);
302 8d1b399b 2021-07-22 op 			/* Listen on control socket. */
303 8d1b399b 2021-07-22 op 			control_listen(fd);
304 8d1b399b 2021-07-22 op 			break;
305 8d1b399b 2021-07-22 op 		case IMSG_RECONF_CONF:
306 8d1b399b 2021-07-22 op 		case IMSG_RECONF_PKI:
307 8d1b399b 2021-07-22 op 		case IMSG_RECONF_PKI_CERT:
308 8d1b399b 2021-07-22 op 		case IMSG_RECONF_PKI_KEY:
309 8d1b399b 2021-07-22 op 		case IMSG_RECONF_LISTEN:
310 8d1b399b 2021-07-22 op 		case IMSG_RECONF_END:
311 8d1b399b 2021-07-22 op 			listener_receive_config(&imsg, &nconf, &pki);
312 8d1b399b 2021-07-22 op 			break;
313 8d1b399b 2021-07-22 op 		case IMSG_AUTH:
314 8d1b399b 2021-07-22 op 			find.id = imsg.hdr.peerid;
315 8d1b399b 2021-07-22 op 			client = SPLAY_FIND(clients_tree_id, &clients, &find);
316 8d1b399b 2021-07-22 op 			if (client == NULL) {
317 8d1b399b 2021-07-22 op 				if (imsg.fd == -1)
318 8d1b399b 2021-07-22 op 					close(imsg.fd);
319 8d1b399b 2021-07-22 op 				break;
320 8d1b399b 2021-07-22 op 			}
321 8d1b399b 2021-07-22 op 			if (imsg.fd == -1) {
322 8d1b399b 2021-07-22 op 				close_conn(client);
323 8d1b399b 2021-07-22 op 				break;
324 8d1b399b 2021-07-22 op 			}
325 8d1b399b 2021-07-22 op 			imsg_init(&client->iev.ibuf, imsg.fd);
326 8d1b399b 2021-07-22 op 			client->iev.events = EV_READ;
327 8d1b399b 2021-07-22 op 			client->iev.handler = listener_dispatch_client;
328 8d1b399b 2021-07-22 op 			event_set(&client->iev.ev, client->iev.ibuf.fd,
329 8d1b399b 2021-07-22 op 			    client->iev.events, client->iev.handler, client);
330 8d1b399b 2021-07-22 op 			listener_imsg_compose_client(client, IMSG_AUTH,
331 8d1b399b 2021-07-22 op 			    0, imsg.data, IMSG_DATA_SIZE(imsg));
332 8d1b399b 2021-07-22 op 			break;
333 8d1b399b 2021-07-22 op 		case IMSG_AUTH_DIR:
334 8d1b399b 2021-07-22 op 			find.id = imsg.hdr.peerid;
335 8d1b399b 2021-07-22 op 			client = SPLAY_FIND(clients_tree_id, &clients, &find);
336 8d1b399b 2021-07-22 op 			if (client == NULL) {
337 8d1b399b 2021-07-22 op 				log_info("got AUTH_DIR but client gone");
338 8d1b399b 2021-07-22 op 				break;
339 8d1b399b 2021-07-22 op 			}
340 8d1b399b 2021-07-22 op 			listener_imsg_compose_client(client, IMSG_AUTH_DIR,
341 8d1b399b 2021-07-22 op 			    0, imsg.data, IMSG_DATA_SIZE(imsg));
342 8d1b399b 2021-07-22 op 			client->bev = bufferevent_new(client->fd,
343 8d1b399b 2021-07-22 op 			    client_read, client_write, client_error,
344 8d1b399b 2021-07-22 op 			    client);
345 8d1b399b 2021-07-22 op 			if (client->bev == NULL) {
346 8d1b399b 2021-07-22 op 				log_info("failed to allocate client buffer");
347 8d1b399b 2021-07-22 op 				close_conn(client);
348 8d1b399b 2021-07-22 op 				return;
349 8d1b399b 2021-07-22 op 			}
350 8d1b399b 2021-07-22 op 			event_set(&client->bev->ev_read, client->fd, EV_READ,
351 8d1b399b 2021-07-22 op 			    client_tls_readcb, client->bev);
352 8d1b399b 2021-07-22 op 			event_set(&client->bev->ev_write, client->fd, EV_WRITE,
353 8d1b399b 2021-07-22 op 			    client_tls_writecb, client->bev);
354 8d1b399b 2021-07-22 op 
355 8d1b399b 2021-07-22 op 			/* TODO: adjust watermarks */
356 8d1b399b 2021-07-22 op                         bufferevent_setwatermark(client->bev, EV_WRITE, 1, 0);
357 8d1b399b 2021-07-22 op 			bufferevent_setwatermark(client->bev, EV_READ,  1, 0);
358 8d1b399b 2021-07-22 op 
359 8d1b399b 2021-07-22 op 			bufferevent_enable(client->bev, EV_READ|EV_WRITE);
360 8d1b399b 2021-07-22 op 			break;
361 8d1b399b 2021-07-22 op 		default:
362 8d1b399b 2021-07-22 op 			log_debug("%s: unexpected imsg %d", __func__,
363 8d1b399b 2021-07-22 op 			    imsg.hdr.type);
364 8d1b399b 2021-07-22 op 			break;
365 8d1b399b 2021-07-22 op 		}
366 8d1b399b 2021-07-22 op 		imsg_free(&imsg);
367 8d1b399b 2021-07-22 op 	}
368 8d1b399b 2021-07-22 op 
369 8d1b399b 2021-07-22 op 	if (!shut)
370 8d1b399b 2021-07-22 op 		listener_imsg_event_add(iev, d);
371 8d1b399b 2021-07-22 op 	else {
372 8d1b399b 2021-07-22 op 		/* This pipe is dead.  Remove its event handler. */
373 8d1b399b 2021-07-22 op 		event_del(&iev->ev);
374 8d1b399b 2021-07-22 op 		log_warnx("pipe closed, shutting down...");
375 8d1b399b 2021-07-22 op 		event_loopexit(NULL);
376 8d1b399b 2021-07-22 op 	}
377 8d1b399b 2021-07-22 op }
378 8d1b399b 2021-07-22 op 
379 8d1b399b 2021-07-22 op int
380 8d1b399b 2021-07-22 op listener_imsg_compose_main(int type, uint32_t peerid, const void *data,
381 8d1b399b 2021-07-22 op     uint16_t datalen)
382 8d1b399b 2021-07-22 op {
383 8d1b399b 2021-07-22 op 	return imsg_compose_event(iev_main, type, peerid, 0, -1, data,
384 8d1b399b 2021-07-22 op 		datalen);
385 8d1b399b 2021-07-22 op }
386 8d1b399b 2021-07-22 op 
387 8d1b399b 2021-07-22 op static void
388 8d1b399b 2021-07-22 op listener_imsg_event_add(struct imsgev *iev, void *d)
389 8d1b399b 2021-07-22 op {
390 8d1b399b 2021-07-22 op 	iev->events = EV_READ;
391 8d1b399b 2021-07-22 op 	if (iev->ibuf.w.queued)
392 8d1b399b 2021-07-22 op 		iev->events |= EV_WRITE;
393 8d1b399b 2021-07-22 op 
394 8d1b399b 2021-07-22 op 	event_del(&iev->ev);
395 8d1b399b 2021-07-22 op 	event_set(&iev->ev, iev->ibuf.fd, iev->events, iev->handler, d);
396 8d1b399b 2021-07-22 op 	event_add(&iev->ev, NULL);
397 8d1b399b 2021-07-22 op }
398 8d1b399b 2021-07-22 op 
399 8d1b399b 2021-07-22 op static void
400 8d1b399b 2021-07-22 op listener_dispatch_client(int fd, short event, void *d)
401 8d1b399b 2021-07-22 op {
402 8d1b399b 2021-07-22 op         struct client	 find, *client = d;
403 8d1b399b 2021-07-22 op 	struct imsg	 imsg;
404 8d1b399b 2021-07-22 op 	struct imsgev	*iev;
405 8d1b399b 2021-07-22 op 	struct imsgbuf	*ibuf;
406 8d1b399b 2021-07-22 op 	ssize_t		 n;
407 8d1b399b 2021-07-22 op 	int		 r, shut = 0;
408 8d1b399b 2021-07-22 op 
409 8d1b399b 2021-07-22 op 	iev = &client->iev;
410 8d1b399b 2021-07-22 op 	ibuf = &iev->ibuf;
411 8d1b399b 2021-07-22 op 
412 8d1b399b 2021-07-22 op 	if (event & EV_READ) {
413 8d1b399b 2021-07-22 op 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
414 8d1b399b 2021-07-22 op 			fatal("imsg_read error");
415 8d1b399b 2021-07-22 op 		if (n == 0)	/* Connection closed */
416 8d1b399b 2021-07-22 op 			shut = 1;
417 8d1b399b 2021-07-22 op 	}
418 8d1b399b 2021-07-22 op 
419 8d1b399b 2021-07-22 op 	if (event & EV_WRITE) {
420 8d1b399b 2021-07-22 op 		if ((n = msgbuf_write(&ibuf->w)) == -1 && errno != EAGAIN)
421 8d1b399b 2021-07-22 op 			fatal("msgbuf_write");
422 8d1b399b 2021-07-22 op 		if (n == 0)	/* Connection closed. */
423 8d1b399b 2021-07-22 op 			shut = 1;
424 8d1b399b 2021-07-22 op 	}
425 8d1b399b 2021-07-22 op 
426 8d1b399b 2021-07-22 op 	for (;;) {
427 8d1b399b 2021-07-22 op 		if ((n = imsg_get(ibuf, &imsg)) == -1)
428 8d1b399b 2021-07-22 op 			fatal("%s: imsg_get error", __func__);
429 8d1b399b 2021-07-22 op 		if (n == 0)	/* No more messages. */
430 8d1b399b 2021-07-22 op 			break;
431 8d1b399b 2021-07-22 op 
432 8d1b399b 2021-07-22 op 		switch (imsg.hdr.type) {
433 8d1b399b 2021-07-22 op 		case IMSG_BUF:
434 8d1b399b 2021-07-22 op 			find.id = imsg.hdr.peerid;
435 8d1b399b 2021-07-22 op 			client = SPLAY_FIND(clients_tree_id, &clients, &find);
436 8d1b399b 2021-07-22 op 			if (client == NULL) {
437 8d1b399b 2021-07-22 op 				log_info("got IMSG_BUF but client (%d) gone",
438 8d1b399b 2021-07-22 op 				    imsg.hdr.peerid);
439 8d1b399b 2021-07-22 op 				break;
440 8d1b399b 2021-07-22 op 			}
441 8d1b399b 2021-07-22 op 			r = bufferevent_write(client->bev, imsg.data,
442 8d1b399b 2021-07-22 op 			    IMSG_DATA_SIZE(imsg));
443 8d1b399b 2021-07-22 op 			if (r == -1) {
444 8d1b399b 2021-07-22 op 				log_warn("%s: bufferevent_write failed",
445 8d1b399b 2021-07-22 op 				    __func__);
446 8d1b399b 2021-07-22 op 				close_conn(client);
447 8d1b399b 2021-07-22 op 				break;
448 8d1b399b 2021-07-22 op 			}
449 8d1b399b 2021-07-22 op 			break;
450 8d1b399b 2021-07-22 op 		default:
451 8d1b399b 2021-07-22 op 			log_debug("%s: unexpected imsg %d", __func__,
452 8d1b399b 2021-07-22 op 			    imsg.hdr.type);
453 8d1b399b 2021-07-22 op 			break;
454 8d1b399b 2021-07-22 op 		}
455 8d1b399b 2021-07-22 op 		imsg_free(&imsg);
456 8d1b399b 2021-07-22 op 	}
457 8d1b399b 2021-07-22 op 
458 8d1b399b 2021-07-22 op 	if (!shut)
459 8d1b399b 2021-07-22 op 		listener_imsg_event_add(iev, d);
460 8d1b399b 2021-07-22 op 	else {
461 8d1b399b 2021-07-22 op 		/* This pipe is dead.  Remove its handler */
462 8d1b399b 2021-07-22 op 		log_debug("client proc vanished");
463 8d1b399b 2021-07-22 op                 close_conn(client);
464 8d1b399b 2021-07-22 op 	}
465 8d1b399b 2021-07-22 op }
466 8d1b399b 2021-07-22 op 
467 8d1b399b 2021-07-22 op static int
468 8d1b399b 2021-07-22 op listener_imsg_compose_client(struct client *client, int type,
469 8d1b399b 2021-07-22 op     uint32_t peerid, const void *data, uint16_t len)
470 8d1b399b 2021-07-22 op {
471 8d1b399b 2021-07-22 op 	int ret;
472 8d1b399b 2021-07-22 op 
473 8d1b399b 2021-07-22 op 	if ((ret = imsg_compose(&client->iev.ibuf, type, peerid, 0, -1,
474 8d1b399b 2021-07-22 op 	    data, len)) != -1)
475 8d1b399b 2021-07-22 op 		listener_imsg_event_add(&client->iev, client);
476 8d1b399b 2021-07-22 op 
477 8d1b399b 2021-07-22 op 	return ret;
478 8d1b399b 2021-07-22 op }
479 8d1b399b 2021-07-22 op 
480 8d1b399b 2021-07-22 op static inline struct kd_pki_conf *
481 8d1b399b 2021-07-22 op pki_by_name(const char *name)
482 8d1b399b 2021-07-22 op {
483 8d1b399b 2021-07-22 op         struct kd_pki_conf *pki;
484 8d1b399b 2021-07-22 op 
485 8d1b399b 2021-07-22 op 	SIMPLEQ_FOREACH(pki, &listener_conf->pki_head, entry) {
486 8d1b399b 2021-07-22 op 		if (!strcmp(name, pki->name))
487 8d1b399b 2021-07-22 op 			return pki;
488 8d1b399b 2021-07-22 op 	}
489 8d1b399b 2021-07-22 op 
490 8d1b399b 2021-07-22 op 	return NULL;
491 8d1b399b 2021-07-22 op }
492 8d1b399b 2021-07-22 op 
493 8d1b399b 2021-07-22 op static void
494 8d1b399b 2021-07-22 op apply_config(struct kd_conf *conf)
495 8d1b399b 2021-07-22 op {
496 8d1b399b 2021-07-22 op 	struct kd_pki_conf *pki;
497 8d1b399b 2021-07-22 op 	struct kd_listen_conf *listen;
498 8d1b399b 2021-07-22 op 
499 8d1b399b 2021-07-22 op 	listener_conf = conf;
500 8d1b399b 2021-07-22 op 
501 8d1b399b 2021-07-22 op 	/* prepare the various tls_config */
502 8d1b399b 2021-07-22 op 	SIMPLEQ_FOREACH(pki, &listener_conf->pki_head, entry) {
503 8d1b399b 2021-07-22 op 		if ((pki->tlsconf = tls_config_new()) == NULL)
504 8d1b399b 2021-07-22 op 			fatal("tls_config_new");
505 8d1b399b 2021-07-22 op 		tls_config_verify_client_optional(pki->tlsconf);
506 8d1b399b 2021-07-22 op 		tls_config_insecure_noverifycert(pki->tlsconf);
507 8d1b399b 2021-07-22 op 		if (tls_config_set_keypair_mem(pki->tlsconf,
508 8d1b399b 2021-07-22 op 		    pki->cert, pki->certlen,
509 8d1b399b 2021-07-22 op 		    pki->key, pki->keylen) == -1)
510 8d1b399b 2021-07-22 op 			fatalx("tls_config_set_keypair_mem: %s",
511 8d1b399b 2021-07-22 op 			    tls_config_error(pki->tlsconf));
512 8d1b399b 2021-07-22 op 	}
513 8d1b399b 2021-07-22 op 
514 8d1b399b 2021-07-22 op 	/* prepare and kickoff the listeners */
515 8d1b399b 2021-07-22 op 	SIMPLEQ_FOREACH(listen, &listener_conf->listen_head, entry) {
516 8d1b399b 2021-07-22 op 		if ((listen->ctx = tls_server()) == NULL)
517 8d1b399b 2021-07-22 op 			fatal("tls_server");
518 8d1b399b 2021-07-22 op 
519 8d1b399b 2021-07-22 op 		pki = pki_by_name(listen->pki);
520 8d1b399b 2021-07-22 op 		if (tls_configure(listen->ctx, pki->tlsconf) == -1)
521 8d1b399b 2021-07-22 op 			fatalx("tls_configure: %s",
522 8d1b399b 2021-07-22 op 			    tls_config_error(pki->tlsconf));
523 8d1b399b 2021-07-22 op 
524 8d1b399b 2021-07-22 op 		event_set(&listen->ev, listen->fd, EV_READ|EV_PERSIST,
525 8d1b399b 2021-07-22 op 		    handle_accept, listen);
526 8d1b399b 2021-07-22 op 		event_add(&listen->ev, NULL);
527 8d1b399b 2021-07-22 op 	}
528 8d1b399b 2021-07-22 op }
529 8d1b399b 2021-07-22 op 
530 8d1b399b 2021-07-22 op static inline void
531 8d1b399b 2021-07-22 op yield_r(struct client *c, void (*fn)(int, short, void *))
532 8d1b399b 2021-07-22 op {
533 8d1b399b 2021-07-22 op 	if (event_pending(&c->event, EV_WRITE|EV_READ, NULL))
534 8d1b399b 2021-07-22 op 		event_del(&c->event);
535 8d1b399b 2021-07-22 op 	event_set(&c->event, c->fd, EV_READ, fn, c);
536 8d1b399b 2021-07-22 op 	event_add(&c->event, NULL);
537 8d1b399b 2021-07-22 op }
538 8d1b399b 2021-07-22 op 
539 8d1b399b 2021-07-22 op static inline void
540 8d1b399b 2021-07-22 op yield_w(struct client *c, void (*fn)(int, short, void *))
541 8d1b399b 2021-07-22 op {
542 8d1b399b 2021-07-22 op 	if (event_pending(&c->event, EV_WRITE|EV_READ, NULL))
543 8d1b399b 2021-07-22 op 		event_del(&c->event);
544 8d1b399b 2021-07-22 op 	event_set(&c->event, c->fd, EV_WRITE, fn, c);
545 8d1b399b 2021-07-22 op 	event_add(&c->event, NULL);
546 8d1b399b 2021-07-22 op }
547 8d1b399b 2021-07-22 op 
548 8d1b399b 2021-07-22 op static inline uint32_t
549 8d1b399b 2021-07-22 op random_id(void)
550 8d1b399b 2021-07-22 op {
551 8d1b399b 2021-07-22 op 	struct client find, *res;
552 8d1b399b 2021-07-22 op 
553 8d1b399b 2021-07-22 op 	for (;;) {
554 8d1b399b 2021-07-22 op 		find.id = arc4random();
555 8d1b399b 2021-07-22 op 		res = SPLAY_FIND(clients_tree_id, &clients, &find);
556 8d1b399b 2021-07-22 op 		if (res == NULL)
557 8d1b399b 2021-07-22 op 			return find.id;
558 8d1b399b 2021-07-22 op 	}
559 8d1b399b 2021-07-22 op }
560 8d1b399b 2021-07-22 op 
561 8d1b399b 2021-07-22 op static void
562 8d1b399b 2021-07-22 op handle_accept(int fd, short ev, void *data)
563 8d1b399b 2021-07-22 op {
564 8d1b399b 2021-07-22 op 	struct kd_listen_conf *listen = data;
565 8d1b399b 2021-07-22 op 	struct client *c;
566 8d1b399b 2021-07-22 op 	int s;
567 8d1b399b 2021-07-22 op 
568 8d1b399b 2021-07-22 op 	if ((s = accept(fd, NULL, NULL)) == -1) {
569 8d1b399b 2021-07-22 op 		log_warn("accept");
570 8d1b399b 2021-07-22 op 		return;
571 8d1b399b 2021-07-22 op 	}
572 8d1b399b 2021-07-22 op 
573 8d1b399b 2021-07-22 op 	c = xcalloc(1, sizeof(*c));
574 8d1b399b 2021-07-22 op 	c->iev.ibuf.fd = -1;
575 8d1b399b 2021-07-22 op 
576 8d1b399b 2021-07-22 op 	if (tls_accept_socket(listen->ctx, &c->ctx, s) == -1) {
577 8d1b399b 2021-07-22 op 		log_warnx("tls_accept_socket: %s",
578 8d1b399b 2021-07-22 op 		    tls_error(listen->ctx));
579 8d1b399b 2021-07-22 op 		free(c);
580 8d1b399b 2021-07-22 op 		close(s);
581 8d1b399b 2021-07-22 op 		return;
582 8d1b399b 2021-07-22 op 	}
583 8d1b399b 2021-07-22 op 
584 8d1b399b 2021-07-22 op 	c->fd = s;
585 8d1b399b 2021-07-22 op 	c->id = random_id();
586 8d1b399b 2021-07-22 op 
587 8d1b399b 2021-07-22 op 	SPLAY_INSERT(clients_tree_id, &clients, c);
588 8d1b399b 2021-07-22 op 
589 8d1b399b 2021-07-22 op 	/* initialize the event */
590 8d1b399b 2021-07-22 op 	event_set(&c->event, c->fd, EV_READ, NULL, NULL);
591 8d1b399b 2021-07-22 op 
592 8d1b399b 2021-07-22 op 	yield_r(c, handle_handshake);
593 8d1b399b 2021-07-22 op }
594 8d1b399b 2021-07-22 op 
595 8d1b399b 2021-07-22 op static void
596 8d1b399b 2021-07-22 op handle_handshake(int fd, short ev, void *data)
597 8d1b399b 2021-07-22 op {
598 8d1b399b 2021-07-22 op 	struct client *c = data;
599 8d1b399b 2021-07-22 op 	ssize_t r;
600 8d1b399b 2021-07-22 op 	const char *hash;
601 8d1b399b 2021-07-22 op 
602 8d1b399b 2021-07-22 op 	switch (r = tls_handshake(c->ctx)) {
603 8d1b399b 2021-07-22 op 	case TLS_WANT_POLLIN:
604 8d1b399b 2021-07-22 op 		yield_r(c, handle_handshake);
605 8d1b399b 2021-07-22 op 		return;
606 8d1b399b 2021-07-22 op 	case TLS_WANT_POLLOUT:
607 8d1b399b 2021-07-22 op 		yield_w(c, handle_handshake);
608 8d1b399b 2021-07-22 op 		return;
609 8d1b399b 2021-07-22 op 	case -1:
610 8d1b399b 2021-07-22 op 		log_debug("handhsake failed: %s", tls_error(c->ctx));
611 8d1b399b 2021-07-22 op 		close_conn(c);
612 8d1b399b 2021-07-22 op 		return;
613 8d1b399b 2021-07-22 op 	}
614 8d1b399b 2021-07-22 op 
615 8d1b399b 2021-07-22 op 	if ((hash = tls_peer_cert_hash(c->ctx)) == NULL) {
616 8d1b399b 2021-07-22 op 		log_warnx("client didn't provide certificate");
617 8d1b399b 2021-07-22 op 		close_conn(c);
618 8d1b399b 2021-07-22 op 		return;
619 8d1b399b 2021-07-22 op 	}
620 8d1b399b 2021-07-22 op 
621 8d1b399b 2021-07-22 op 	listener_imsg_compose_main(IMSG_AUTH_TLS, c->id,
622 8d1b399b 2021-07-22 op 	    hash, strlen(hash)+1);
623 8d1b399b 2021-07-22 op }
624 8d1b399b 2021-07-22 op 
625 8d1b399b 2021-07-22 op static void
626 8d1b399b 2021-07-22 op client_read(struct bufferevent *bev, void *d)
627 8d1b399b 2021-07-22 op {
628 8d1b399b 2021-07-22 op 	struct client	*client = d;
629 8d1b399b 2021-07-22 op 	struct evbuffer	*src = EVBUFFER_INPUT(bev);
630 8d1b399b 2021-07-22 op 	char		 buf[BUFSIZ];
631 8d1b399b 2021-07-22 op 	size_t		 len;
632 8d1b399b 2021-07-22 op 
633 8d1b399b 2021-07-22 op 	if (!EVBUFFER_LENGTH(src))
634 8d1b399b 2021-07-22 op 		return;
635 8d1b399b 2021-07-22 op 
636 8d1b399b 2021-07-22 op 	len = bufferevent_read(bev, buf, sizeof(buf));
637 8d1b399b 2021-07-22 op 	if (len == 0) {
638 8d1b399b 2021-07-22 op 		(*bev->errorcb)(bev, EVBUFFER_READ, bev->cbarg);
639 8d1b399b 2021-07-22 op 		return;
640 8d1b399b 2021-07-22 op 	}
641 8d1b399b 2021-07-22 op 
642 8d1b399b 2021-07-22 op 	listener_imsg_compose_client(client, IMSG_BUF, client->id, buf, len);
643 8d1b399b 2021-07-22 op }
644 8d1b399b 2021-07-22 op 
645 8d1b399b 2021-07-22 op static void
646 8d1b399b 2021-07-22 op client_write(struct bufferevent *bev, void *d)
647 8d1b399b 2021-07-22 op {
648 8d1b399b 2021-07-22 op 	/*
649 8d1b399b 2021-07-22 op 	 * here we can do some fancy logic like deciding when to call
650 8d1b399b 2021-07-22 op 	 *
651 8d1b399b 2021-07-22 op 	 *	(*bev->errorcb)(bev, EVBUFFER_WRITE, bev->cbarg)
652 8d1b399b 2021-07-22 op 	 *
653 8d1b399b 2021-07-22 op 	 * to signal the end of the transaction.
654 8d1b399b 2021-07-22 op 	 */
655 8d1b399b 2021-07-22 op 
656 8d1b399b 2021-07-22 op 	return;
657 8d1b399b 2021-07-22 op }
658 8d1b399b 2021-07-22 op 
659 8d1b399b 2021-07-22 op static void
660 8d1b399b 2021-07-22 op client_error(struct bufferevent *bev, short err, void *d)
661 8d1b399b 2021-07-22 op {
662 8d1b399b 2021-07-22 op 	struct client	*client = d;
663 8d1b399b 2021-07-22 op 	struct evbuffer	*buf;
664 8d1b399b 2021-07-22 op 
665 8d1b399b 2021-07-22 op         if (err & EVBUFFER_ERROR) {
666 8d1b399b 2021-07-22 op 		if (errno == EFBIG) {
667 8d1b399b 2021-07-22 op 			bufferevent_enable(bev, EV_READ);
668 8d1b399b 2021-07-22 op 			return;
669 8d1b399b 2021-07-22 op 		}
670 8d1b399b 2021-07-22 op 		log_debug("buffer event error");
671 8d1b399b 2021-07-22 op                 close_conn(client);
672 8d1b399b 2021-07-22 op 		return;
673 8d1b399b 2021-07-22 op 	}
674 8d1b399b 2021-07-22 op 
675 8d1b399b 2021-07-22 op 	if (err & EVBUFFER_EOF) {
676 8d1b399b 2021-07-22 op                 close_conn(client);
677 8d1b399b 2021-07-22 op 		return;
678 8d1b399b 2021-07-22 op 	}
679 8d1b399b 2021-07-22 op 
680 8d1b399b 2021-07-22 op 	if (err & (EVBUFFER_READ|EVBUFFER_WRITE)) {
681 8d1b399b 2021-07-22 op 		bufferevent_disable(bev, EV_READ|EV_WRITE);
682 8d1b399b 2021-07-22 op 		client->done = 1;
683 8d1b399b 2021-07-22 op 
684 8d1b399b 2021-07-22 op 		buf = EVBUFFER_OUTPUT(client->bev);
685 8d1b399b 2021-07-22 op 		if (EVBUFFER_LENGTH(buf) != 0) {
686 8d1b399b 2021-07-22 op 			/* finish writing all the data first */
687 8d1b399b 2021-07-22 op 			bufferevent_enable(client->bev, EV_WRITE);
688 8d1b399b 2021-07-22 op 			return;
689 8d1b399b 2021-07-22 op 		}
690 8d1b399b 2021-07-22 op 
691 8d1b399b 2021-07-22 op 		close_conn(client);
692 8d1b399b 2021-07-22 op 		return;
693 8d1b399b 2021-07-22 op 	}
694 8d1b399b 2021-07-22 op 
695 8d1b399b 2021-07-22 op 	log_warnx("unknown event error, closing client connection");
696 8d1b399b 2021-07-22 op 	close_conn(client);
697 8d1b399b 2021-07-22 op }
698 8d1b399b 2021-07-22 op 
699 8d1b399b 2021-07-22 op static void
700 8d1b399b 2021-07-22 op client_tls_readcb(int fd, short event, void *d)
701 8d1b399b 2021-07-22 op {
702 8d1b399b 2021-07-22 op 	struct bufferevent	*bufev = d;
703 8d1b399b 2021-07-22 op 	struct client		*client = bufev->cbarg;
704 8d1b399b 2021-07-22 op 	char			 buf[BUFSIZ];
705 8d1b399b 2021-07-22 op 	int			 what = EVBUFFER_READ;
706 8d1b399b 2021-07-22 op 	int			 howmuch = IBUF_READ_SIZE;
707 8d1b399b 2021-07-22 op 	ssize_t			 ret;
708 8d1b399b 2021-07-22 op 	size_t			 len;
709 8d1b399b 2021-07-22 op 
710 8d1b399b 2021-07-22 op 	if (event == EV_TIMEOUT) {
711 8d1b399b 2021-07-22 op 		what |= EVBUFFER_TIMEOUT;
712 8d1b399b 2021-07-22 op 		goto err;
713 8d1b399b 2021-07-22 op 	}
714 8d1b399b 2021-07-22 op 
715 8d1b399b 2021-07-22 op 	if (bufev->wm_read.high != 0)
716 8d1b399b 2021-07-22 op 		howmuch = MIN(sizeof(buf), bufev->wm_read.high);
717 8d1b399b 2021-07-22 op 
718 8d1b399b 2021-07-22 op         switch (ret = tls_read(client->ctx, buf, howmuch)) {
719 8d1b399b 2021-07-22 op 	case TLS_WANT_POLLIN:
720 8d1b399b 2021-07-22 op 	case TLS_WANT_POLLOUT:
721 8d1b399b 2021-07-22 op 		goto retry;
722 8d1b399b 2021-07-22 op 	case -1:
723 8d1b399b 2021-07-22 op 		what |= EVBUFFER_ERROR;
724 8d1b399b 2021-07-22 op 		goto err;
725 8d1b399b 2021-07-22 op 	}
726 8d1b399b 2021-07-22 op 	len = ret;
727 8d1b399b 2021-07-22 op 
728 8d1b399b 2021-07-22 op 	if (len == 0) {
729 8d1b399b 2021-07-22 op 		what |= EVBUFFER_EOF;
730 8d1b399b 2021-07-22 op 		goto err;
731 8d1b399b 2021-07-22 op 	}
732 8d1b399b 2021-07-22 op 
733 8d1b399b 2021-07-22 op 	if (evbuffer_add(bufev->input, buf, len) == -1) {
734 8d1b399b 2021-07-22 op 		what |= EVBUFFER_ERROR;
735 8d1b399b 2021-07-22 op 		goto err;
736 8d1b399b 2021-07-22 op 	}
737 8d1b399b 2021-07-22 op 
738 8d1b399b 2021-07-22 op 	event_add(&bufev->ev_read, NULL);
739 8d1b399b 2021-07-22 op 
740 8d1b399b 2021-07-22 op 	len = EVBUFFER_LENGTH(bufev->input);
741 8d1b399b 2021-07-22 op 	if (bufev->wm_read.low != 0 && len < bufev->wm_read.low)
742 8d1b399b 2021-07-22 op 		return;
743 8d1b399b 2021-07-22 op 	if (bufev->wm_read.high != 0 && len > bufev->wm_read.high) {
744 8d1b399b 2021-07-22 op 		/*
745 8d1b399b 2021-07-22 op 		 * here we could implement some read pressure
746 8d1b399b 2021-07-22 op 		 * mechanism.
747 8d1b399b 2021-07-22 op 		 */
748 8d1b399b 2021-07-22 op 	}
749 8d1b399b 2021-07-22 op 
750 8d1b399b 2021-07-22 op 	if (bufev->readcb != NULL)
751 8d1b399b 2021-07-22 op 		(*bufev->readcb)(bufev, bufev->cbarg);
752 8d1b399b 2021-07-22 op 
753 8d1b399b 2021-07-22 op 	return;
754 8d1b399b 2021-07-22 op 
755 8d1b399b 2021-07-22 op retry:
756 8d1b399b 2021-07-22 op 	event_add(&bufev->ev_read, NULL);
757 8d1b399b 2021-07-22 op 	return;
758 8d1b399b 2021-07-22 op 
759 8d1b399b 2021-07-22 op err:
760 8d1b399b 2021-07-22 op 	(*bufev->errorcb)(bufev, what, bufev->cbarg);
761 8d1b399b 2021-07-22 op }
762 8d1b399b 2021-07-22 op 
763 8d1b399b 2021-07-22 op static void
764 8d1b399b 2021-07-22 op client_tls_writecb(int fd, short event, void *d)
765 8d1b399b 2021-07-22 op {
766 8d1b399b 2021-07-22 op 	struct bufferevent	*bufev = d;
767 8d1b399b 2021-07-22 op 	struct client		*client = bufev->cbarg;
768 8d1b399b 2021-07-22 op 	ssize_t			 ret;
769 8d1b399b 2021-07-22 op 	size_t			 len;
770 8d1b399b 2021-07-22 op 	short			 what = EVBUFFER_WRITE;
771 8d1b399b 2021-07-22 op 
772 8d1b399b 2021-07-22 op 	if (event == EV_TIMEOUT) {
773 8d1b399b 2021-07-22 op 		what |= EVBUFFER_TIMEOUT;
774 8d1b399b 2021-07-22 op 		goto err;
775 8d1b399b 2021-07-22 op 	}
776 8d1b399b 2021-07-22 op 
777 8d1b399b 2021-07-22 op 	if (EVBUFFER_LENGTH(bufev->output) != 0) {
778 8d1b399b 2021-07-22 op 		ret = tls_write(client->ctx,
779 8d1b399b 2021-07-22 op 		    EVBUFFER_DATA(bufev->output),
780 8d1b399b 2021-07-22 op 		    EVBUFFER_LENGTH(bufev->output));
781 8d1b399b 2021-07-22 op 		switch (ret) {
782 8d1b399b 2021-07-22 op 		case TLS_WANT_POLLIN:
783 8d1b399b 2021-07-22 op 		case TLS_WANT_POLLOUT:
784 8d1b399b 2021-07-22 op 			goto retry;
785 8d1b399b 2021-07-22 op 		case -1:
786 8d1b399b 2021-07-22 op 			what |= EVBUFFER_ERROR;
787 8d1b399b 2021-07-22 op 			goto err;
788 8d1b399b 2021-07-22 op 		}
789 8d1b399b 2021-07-22 op 		len = ret;
790 8d1b399b 2021-07-22 op 		evbuffer_drain(bufev->output, len);
791 8d1b399b 2021-07-22 op 	}
792 8d1b399b 2021-07-22 op 
793 8d1b399b 2021-07-22 op 	if (EVBUFFER_LENGTH(bufev->output) != 0)
794 8d1b399b 2021-07-22 op 		event_add(&bufev->ev_write, NULL);
795 8d1b399b 2021-07-22 op 
796 8d1b399b 2021-07-22 op 	if (bufev->writecb != NULL &&
797 8d1b399b 2021-07-22 op 	    EVBUFFER_LENGTH(bufev->output) <= bufev->wm_write.low)
798 8d1b399b 2021-07-22 op 		(*bufev->writecb)(bufev, bufev->cbarg);
799 8d1b399b 2021-07-22 op 	return;
800 8d1b399b 2021-07-22 op 
801 8d1b399b 2021-07-22 op retry:
802 8d1b399b 2021-07-22 op 	event_add(&bufev->ev_write, NULL);
803 8d1b399b 2021-07-22 op 	return;
804 8d1b399b 2021-07-22 op 
805 8d1b399b 2021-07-22 op err:
806 8d1b399b 2021-07-22 op 	(*bufev->errorcb)(bufev, what, bufev->cbarg);
807 8d1b399b 2021-07-22 op }
808 8d1b399b 2021-07-22 op 
809 8d1b399b 2021-07-22 op static void
810 8d1b399b 2021-07-22 op close_conn(struct client *c)
811 8d1b399b 2021-07-22 op {
812 8d1b399b 2021-07-22 op 	log_debug("closing connection");
813 8d1b399b 2021-07-22 op 
814 8d1b399b 2021-07-22 op 	if (c->iev.ibuf.fd != -1) {
815 8d1b399b 2021-07-22 op 		listener_imsg_compose_client(c, IMSG_CONN_GONE, 0, NULL, 0);
816 8d1b399b 2021-07-22 op 		imsg_flush(&c->iev.ibuf);
817 8d1b399b 2021-07-22 op 		msgbuf_clear(&c->iev.ibuf.w);
818 8d1b399b 2021-07-22 op 		event_del(&c->iev.ev);
819 8d1b399b 2021-07-22 op 		close(c->iev.ibuf.fd);
820 8d1b399b 2021-07-22 op 	}
821 8d1b399b 2021-07-22 op 
822 8d1b399b 2021-07-22 op 	handle_close(c->fd, 0, c);
823 8d1b399b 2021-07-22 op }
824 8d1b399b 2021-07-22 op 
825 8d1b399b 2021-07-22 op static void
826 8d1b399b 2021-07-22 op handle_close(int fd, short ev, void *d)
827 8d1b399b 2021-07-22 op {
828 8d1b399b 2021-07-22 op 	struct client *c = d;
829 8d1b399b 2021-07-22 op 
830 8d1b399b 2021-07-22 op 	switch (tls_close(c->ctx)) {
831 8d1b399b 2021-07-22 op 	case TLS_WANT_POLLIN:
832 8d1b399b 2021-07-22 op 		yield_r(c, handle_close);
833 8d1b399b 2021-07-22 op 		return;
834 8d1b399b 2021-07-22 op 	case TLS_WANT_POLLOUT:
835 8d1b399b 2021-07-22 op 		yield_w(c, handle_close);
836 8d1b399b 2021-07-22 op 		return;
837 8d1b399b 2021-07-22 op 	}
838 8d1b399b 2021-07-22 op 
839 8d1b399b 2021-07-22 op 	event_del(&c->event);
840 8d1b399b 2021-07-22 op 	tls_free(c->ctx);
841 8d1b399b 2021-07-22 op 	close(c->fd);
842 8d1b399b 2021-07-22 op 	free(c);
843 8d1b399b 2021-07-22 op }