2 * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3 * Copyright (c) 2018 Florian Obser <florian@openbsd.org>
4 * Copyright (c) 2005 Claudio Jeker <claudio@openbsd.org>
5 * Copyright (c) 2004 Esben Norby <norby@openbsd.org>
6 * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
8 * Permission to use, copy, modify, and distribute this software for any
9 * purpose with or without fee is hereby granted, provided that the above
10 * copyright notice and this permission notice appear in all copies.
12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 #include <sys/socket.h>
22 #include <sys/types.h>
23 #include <sys/queue.h>
27 #include <arpa/inet.h>
28 #include <netinet/in.h>
58 const char *saved_argv0;
59 static int debug, nflag;
62 __dead void usage(void);
64 void main_sig_handler(int, short, void *);
65 void main_dispatch_listener(int, short, void *);
66 int main_reload(void);
67 int main_imsg_send_config(struct kd_conf *);
68 void main_dispatch_listener(int, short, void *);
69 __dead void main_shutdown(void);
71 static pid_t start_child(enum kd_process, int, int, int);
73 struct kd_conf *main_conf;
74 static struct imsgev *iev_listener;
82 fprintf(stderr, "usage: %s [-dnv] [-f file] [-s socket]\n",
88 main(int argc, char **argv)
90 struct event ev_sigint, ev_sigterm, ev_sighup;
92 int listener_flag = 0, client_flag = 0;
93 int pipe_main2listener[2];
97 conffile = KD_CONF_FILE;
100 log_init(1, LOG_DAEMON); /* Log to stderr until deamonized. */
103 saved_argv0 = argv[0];
104 if (saved_argv0 == NULL)
105 saved_argv0 = "kamid";
107 while ((ch = getopt(argc, argv, "D:df:nsT:v")) != -1) {
110 if (cmdline_symset(optarg) == -1)
111 log_warnx("could not parse macro definition %s",
135 fatalx("invalid process spec %c", *optarg);
148 if (argc > 0 || (listener_flag && client_flag))
152 client(debug, verbose);
153 else if (listener_flag)
154 listener(debug, verbose);
156 if ((main_conf = parse_config(conffile)) == NULL)
160 fprintf(stderr, "configuration OK\n");
164 /* Check for root privileges. */
166 fatalx("need root privileges");
168 /* Check for assigned daemon user. */
169 if (getpwnam(KD_USER) == NULL)
170 fatalx("unknown user %s", KD_USER);
172 log_init(debug, LOG_DAEMON);
173 log_setverbose(verbose);
180 if (socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC | SOCK_NONBLOCK,
181 PF_UNSPEC, pipe_main2listener) == -1)
182 fatal("main2listener socketpair");
184 /* Start children. */
185 listener_pid = start_child(PROC_LISTENER, pipe_main2listener[1],
188 log_procinit("main");
192 /* Setup signal handler */
193 signal_set(&ev_sigint, SIGINT, main_sig_handler, NULL);
194 signal_set(&ev_sigterm, SIGTERM, main_sig_handler, NULL);
195 signal_set(&ev_sighup, SIGHUP, main_sig_handler, NULL);
197 signal_add(&ev_sigint, NULL);
198 signal_add(&ev_sigterm, NULL);
199 signal_add(&ev_sighup, NULL);
201 signal(SIGCHLD, SIG_IGN);
202 signal(SIGPIPE, SIG_IGN);
204 if ((iev_listener = malloc(sizeof(*iev_listener))) == NULL)
206 imsg_init(&iev_listener->ibuf, pipe_main2listener[0]);
207 iev_listener->handler = main_dispatch_listener;
209 /* Setup event handlers for pipes to listener. */
210 iev_listener->events = EV_READ;
211 event_set(&iev_listener->ev, iev_listener->ibuf.fd,
212 iev_listener->events, iev_listener->handler, iev_listener);
213 event_add(&iev_listener->ev, NULL);
215 if ((control_fd = control_init(csock)) == -1)
216 fatalx("control socket setup failed");
218 main_imsg_compose_listener(IMSG_CONTROLFD, control_fd, 0,
220 main_imsg_send_config(main_conf);
231 main_sig_handler(int sig, short event, void *arg)
234 * Normal signal handler rules don't apply because libevent
244 if (main_reload() == -1)
245 log_warnx("configuration reload failed");
247 log_debug("configuration reloaded");
250 fatalx("unexpected signal %d", sig);
254 static inline struct table *
255 auth_table_by_id(uint32_t id)
257 struct kd_listen_conf *listen;
259 STAILQ_FOREACH(listen, &main_conf->listen_head, entry) {
260 if (listen->id == id)
261 return listen->auth_table;
267 static inline struct table *
268 virtual_table_by_id(uint32_t id)
270 struct kd_listen_conf *listen;
272 STAILQ_FOREACH(listen, &main_conf->listen_head, entry) {
273 if (listen->id == id)
274 return listen->virtual_table;
280 static inline struct table *
281 userdata_table_by_id(uint32_t id)
283 struct kd_listen_conf *listen;
285 STAILQ_FOREACH(listen, &main_conf->listen_head, entry) {
286 if (listen->id == id)
287 return listen->userdata_table;
294 do_auth_tls(struct imsg *imsg)
296 char *username = NULL, *user = NULL, *home = NULL, *local_user;
298 struct table *auth, *virt, *userdata;
299 struct kd_auth_req kauth;
300 int p[2], free_home = 1;
302 if (sizeof(kauth) != IMSG_DATA_SIZE(*imsg))
303 fatal("wrong size for IMSG_AUTH_TLS: "
304 "got %lu; want %lu", IMSG_DATA_SIZE(*imsg),
306 memcpy(&kauth, imsg->data, sizeof(kauth));
308 if (memmem(kauth.hash, sizeof(kauth.hash), "", 1) == NULL)
309 fatal("non NUL-terminated hash received");
311 log_debug("tls id=%u hash=%s", kauth.listen_id, kauth.hash);
313 if ((auth = auth_table_by_id(kauth.listen_id)) == NULL)
314 fatal("request for invalid listener id %d", imsg->hdr.pid);
316 virt = virtual_table_by_id(kauth.listen_id);
317 userdata = userdata_table_by_id(kauth.listen_id);
319 if (table_lookup(auth, kauth.hash, &username) == -1) {
320 log_warnx("login failed for hash %s", kauth.hash);
324 if (virt != NULL && table_lookup(virt, username, &user) == -1) {
325 log_warnx("virtual lookup failed for user %s", username);
330 local_user = user != NULL ? user : username;
333 log_debug("virtual user %s matched local user %s",
336 log_debug("matched local user %s", username);
338 if (userdata != NULL && table_lookup(userdata, username, &home)
340 log_warnx("userdata lookup failed for user %s", username);
342 } else if (userdata == NULL) {
343 if ((pw = getpwnam(local_user)) == NULL) {
344 log_warnx("getpwnam(%s) failed", local_user);
353 log_debug("matched home %s for virtual user %s",
356 log_debug("matched home %s for local user %s",
359 if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
363 start_child(PROC_CLIENTCONN, p[1], debug, verbose);
365 main_imsg_compose_listener(IMSG_AUTH, p[0], imsg->hdr.peerid,
366 local_user, strlen(local_user)+1);
367 main_imsg_compose_listener(IMSG_AUTH_DIR, -1, imsg->hdr.peerid,
368 home, strlen(home)+1);
381 main_imsg_compose_listener(IMSG_AUTH, -1, imsg->hdr.peerid,
386 main_dispatch_listener(int fd, short event, void *d)
388 struct imsgev *iev = d;
389 struct imsgbuf *ibuf;
396 if (event & EV_READ) {
397 if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
398 fatal("imsg_read error");
399 if (n == 0) /* Connection closed. */
402 if (event & EV_WRITE) {
403 if ((n = msgbuf_write(&ibuf->w)) == -1 && errno != EAGAIN)
404 fatal("msgbuf_write");
405 if (n == 0) /* Connection closed. */
410 if ((n = imsg_get(ibuf, &imsg)) == -1)
412 if (n == 0) /* No more messages. */
415 switch (imsg.hdr.type) {
420 log_debug("%s: error handling imsg %d", __func__,
429 /* This pipe is dead. Remove its event handler. */
431 event_loopexit(NULL);
438 struct kd_conf *xconf;
440 if ((xconf = parse_config(conffile)) == NULL)
443 if (main_imsg_send_config(xconf) == -1)
446 merge_config(main_conf, xconf);
452 make_socket_for(struct kd_listen_conf *l)
454 struct sockaddr_in addr4;
458 memset(&addr4, 0, sizeof(addr4));
459 addr4.sin_family = AF_INET;
460 addr4.sin_port = htons(l->port);
461 addr4.sin_addr.s_addr = INADDR_ANY;
463 if ((fd = socket(AF_INET, SOCK_STREAM, 0)) == -1)
467 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &v, sizeof(v)) == -1)
468 fatal("setsockopt(SO_REUSEADDR)");
471 if (setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &v, sizeof(v)) == -1)
472 fatal("setsockopt(SO_REUSEPORT)");
475 if (bind(fd, (struct sockaddr *)&addr4, len) == -1)
476 fatal("bind(%s, %d)", l->iface, l->port);
478 if (listen(fd, 16) == -1)
479 fatal("l(%s, %d)", l->iface, l->port);
485 main_imsg_send_config(struct kd_conf *xconf)
487 struct kd_pki_conf *pki;
488 struct kd_listen_conf *listen;
490 #define SEND(type, fd, data, len) do { \
491 if (main_imsg_compose_listener(type, fd, 0, data, len) \
496 /* Send fixed part of config to children. */
497 SEND(IMSG_RECONF_CONF, -1, xconf, sizeof(*xconf));
499 STAILQ_FOREACH(pki, &xconf->pki_head, entry) {
500 log_debug("sending pki %s", pki->name);
501 SEND(IMSG_RECONF_PKI, -1, pki->name, sizeof(pki->name));
502 SEND(IMSG_RECONF_PKI_CERT, -1, pki->cert, pki->certlen);
503 SEND(IMSG_RECONF_PKI_KEY, -1, pki->key, pki->keylen);
506 STAILQ_FOREACH(listen, &xconf->listen_head, entry) {
507 log_debug("sending listen on port %d", listen->port);
508 SEND(IMSG_RECONF_LISTEN, make_socket_for(listen), listen,
512 SEND(IMSG_RECONF_END, -1, NULL, 0);
519 merge_config(struct kd_conf *conf, struct kd_conf *xconf)
527 config_new_empty(void)
529 struct kd_conf *xconf;
531 if ((xconf = calloc(1, sizeof(*xconf))) == NULL)
534 /* set default values */
540 config_clear(struct kd_conf *conf)
542 struct kd_conf *xconf;
544 /* Merge current config with an empty one. */
545 xconf = config_new_empty();
546 merge_config(conf, xconf);
558 config_clear(main_conf);
560 log_debug("waiting for children to terminate");
564 if (errno != EINTR && errno != ECHILD)
566 } else if (WIFSIGNALED(status))
567 log_warnx("%s terminated; signal %d",
568 (pid == listener_pid) ? "logger" : "clientconn",
570 } while (pid != -1 || (pid == -1 && errno == EINTR));
574 log_info("terminating");
579 start_child(enum kd_process p, int fd, int debug, int verbose)
585 switch (pid = fork()) {
587 fatal("cannot fork");
596 if (dup2(fd, 3) == -1)
597 fatal("cannot setup imsg fd");
598 } else if (fcntl(F_SETFD, 0) == -1)
599 fatal("cannot setup imsg fd");
601 argv[argc++] = saved_argv0;
604 fatalx("Can not start main process");
606 argv[argc++] = "-Tl";
608 case PROC_CLIENTCONN:
609 argv[argc++] = "-Tc";
619 execvp(saved_argv0, (char *const *)argv);
624 main_imsg_compose_listener(int type, int fd, uint32_t peerid,
625 const void *data, uint16_t datalen)
628 return imsg_compose_event(iev_listener, type, peerid, 0,