op public repos

Blob

Date:: Sun Jun 11 12:18:27 2023 UTC
Message:: disable the privsep crypto engine on !OpenBSD it fails bandly at runtime on various linux distros and on freebsd. Until a fix is found, disable it so I can move forward.
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2023 Omar Polo <op@omarpolo.com>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "gmid.h"
18 
19 #include <sys/stat.h>
20 
21 #include <fcntl.h>
22 #include <limits.h>
23 #include <string.h>
24 
25 #include <openssl/pem.h>
26 
27 #include "log.h"
28 #include "proc.h"
29 
30 struct conf *
31 config_new(void)
32 {
33 	struct conf *conf;
34 
35 	conf = xcalloc(1, sizeof(*conf));
36 
37 	TAILQ_INIT(&conf->fcgi);
38 	TAILQ_INIT(&conf->hosts);
39 	TAILQ_INIT(&conf->pkis);
40 
41 	conf->port = 1965;
42 	conf->ipv6 = 0;
43 	conf->protos = TLS_PROTOCOL_TLSv1_2 | TLS_PROTOCOL_TLSv1_3;
44 
45 	init_mime(&conf->mime);
46 
47 	conf->prefork = 3;
48 
49 #ifdef __OpenBSD__
50 	conf->use_privsep_crypto = 1;
51 #endif
52 
53 	conf->sock4 = -1;
54 	conf->sock6 = -1;
55 
56 	return conf;
57 }
58 
59 void
60 config_purge(struct conf *conf)
61 {
62 	struct privsep *ps;
63 	struct fcgi *f, *tf;
64 	struct vhost *h, *th;
65 	struct location *l, *tl;
66 	struct proxy *p, *tp;
67 	struct envlist *e, *te;
68 	struct alist *a, *ta;
69 	struct pki *pki, *tpki;
70 	int use_privsep_crypto;
71 
72 	ps = conf->ps;
73 	use_privsep_crypto = conf->use_privsep_crypto;
74 
75 	if (conf->sock4 != -1) {
76 		event_del(&conf->evsock4);
77 		close(conf->sock4);
78 	}
79 
80 	if (conf->sock6 != -1) {
81 		event_del(&conf->evsock6);
82 		close(conf->sock6);
83 	}
84 
85 	free_mime(&conf->mime);
86 	TAILQ_FOREACH_SAFE(f, &conf->fcgi, fcgi, tf) {
87 		TAILQ_REMOVE(&conf->fcgi, f, fcgi);
88 		free(f);
89 	}
90 
91 	TAILQ_FOREACH_SAFE(h, &conf->hosts, vhosts, th) {
92 		free(h->cert_path);
93 		free(h->key_path);
94 		free(h->ocsp_path);
95 		free(h->cert);
96 		free(h->key);
97 		free(h->ocsp);
98 
99 		TAILQ_FOREACH_SAFE(l, &h->locations, locations, tl) {
100 			TAILQ_REMOVE(&h->locations, l, locations);
101 
102 			if (l->dirfd != -1)
103 				close(l->dirfd);
104 
105 			free(l->reqca_path);
106 			X509_STORE_free(l->reqca);
107 			free(l);
108 		}
109 
110 		TAILQ_FOREACH_SAFE(e, &h->params, envs, te) {
111 			TAILQ_REMOVE(&h->params, e, envs);
112 			free(e);
113 		}
114 
115 		TAILQ_FOREACH_SAFE(a, &h->aliases, aliases, ta) {
116 			TAILQ_REMOVE(&h->aliases, a, aliases);
117 			free(a);
118 		}
119 
120 		TAILQ_FOREACH_SAFE(p, &h->proxies, proxies, tp) {
121 			TAILQ_REMOVE(&h->proxies, p, proxies);
122 			free(p->cert_path);
123 			free(p->cert);
124 			free(p->key_path);
125 			free(p->key);
126 			free(p->reqca_path);
127 			X509_STORE_free(p->reqca);
128 			free(p);
129 		}
130 
131 		TAILQ_REMOVE(&conf->hosts, h, vhosts);
132 		free(h);
133 	}
134 
135 	TAILQ_FOREACH_SAFE(pki, &conf->pkis, pkis, tpki) {
136 		TAILQ_REMOVE(&conf->pkis, pki, pkis);
137 		free(pki->hash);
138 		EVP_PKEY_free(pki->pkey);
139 		free(pki);
140 	}
141 
142 	memset(conf, 0, sizeof(*conf));
143 
144 	conf->ps = ps;
145 	conf->use_privsep_crypto = use_privsep_crypto;
146 	conf->sock4 = conf->sock6 = -1;
147 	conf->protos = TLS_PROTOCOL_TLSv1_2 | TLS_PROTOCOL_TLSv1_3;
148 	init_mime(&conf->mime);
149 	TAILQ_INIT(&conf->fcgi);
150 	TAILQ_INIT(&conf->hosts);
151 	TAILQ_INIT(&conf->pkis);
152 }
153 
154 static int
155 config_send_file(struct privsep *ps, enum privsep_procid id, int type,
156     int fd, void *data, size_t l)
157 {
158 	int	 n, m, d;
159 
160 	n = -1;
161 	proc_range(ps, id, &n, &m);
162 	for (n = 0; n < m; ++n) {
163 		d = -1;
164 		if (fd != -1 && (d = dup(fd)) == -1)
165 			fatal("dup %d", fd);
166 		if (proc_compose_imsg(ps, id, n, type, -1, d, data, l)
167 		    == -1)
168 			return -1;
169 	}
170 
171 	if (fd != -1)
172 		close(fd);
173 	return 0;
174 }
175 
176 static int
177 config_open_send(struct privsep *ps, enum privsep_procid id, int type,
178     const char *path)
179 {
180 	int fd;
181 
182 	log_debug("sending %s", path);
183 
184 	if ((fd = open(path, O_RDONLY)) == -1)
185 		fatal("can't open %s", path);
186 
187 	return config_send_file(ps, id, type, fd, NULL, 0);
188 }
189 
190 static int
191 config_send_kp(struct privsep *ps, int cert_type, int key_type,
192     const char *cert, const char *key)
193 {
194 	struct conf *conf = ps->ps_env;
195 	int fd, d, key_target;
196 
197 	log_debug("sending %s", cert);
198 	if ((fd = open(cert, O_RDONLY)) == -1)
199 		fatal("can't open %s", cert);
200 	if ((d = dup(fd)) == -1)
201 		fatal("fd");
202 
203 	if (config_send_file(ps, PROC_SERVER, cert_type, fd, NULL, 0) == -1) {
204 		close(d);
205 		return -1;
206 	}
207 	if (conf->use_privsep_crypto &&
208 	    config_send_file(ps, PROC_CRYPTO, cert_type, d, NULL, 0) == -1)
209 		return -1;
210 
211 	log_debug("sending %s", key);
212 	if ((fd = open(key, O_RDONLY)) == -1)
213 		return -1;
214 
215 	key_target = PROC_CRYPTO;
216 	if (!conf->use_privsep_crypto)
217 		key_target = PROC_SERVER;
218 
219 	if (config_send_file(ps, key_target, key_type, fd, NULL, 0) == -1)
220 		return -1;
221 
222 	if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
223 		return -1;
224 	if (proc_flush_imsg(ps, PROC_CRYPTO, -1) == -1)
225 		return -1;
226 	return 0;
227 }
228 
229 static int
230 make_socket(int port, int family)
231 {
232 	int sock, v;
233 	struct sockaddr_in addr4;
234 	struct sockaddr_in6 addr6;
235 	struct sockaddr *addr;
236 	socklen_t len;
237 
238 	switch (family) {
239 	case AF_INET:
240 		memset(&addr4, 0, sizeof(addr4));
241 		addr4.sin_family = family;
242 		addr4.sin_port = htons(port);
243 		addr4.sin_addr.s_addr = INADDR_ANY;
244 		addr = (struct sockaddr*)&addr4;
245 		len = sizeof(addr4);
246 		break;
247 
248 	case AF_INET6:
249 		memset(&addr6, 0, sizeof(addr6));
250 		addr6.sin6_family = AF_INET6;
251 		addr6.sin6_port = htons(port);
252 		addr6.sin6_addr = in6addr_any;
253 		addr = (struct sockaddr*)&addr6;
254 		len = sizeof(addr6);
255 		break;
256 
257 	default:
258 		/* unreachable */
259 		abort();
260 	}
261 
262 	if ((sock = socket(family, SOCK_STREAM, 0)) == -1)
263 		fatal("socket");
264 
265 	v = 1;
266 	if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &v, sizeof(v)) == -1)
267 		fatal("setsockopt(SO_REUSEADDR)");
268 
269 	v = 1;
270 	if (setsockopt(sock, SOL_SOCKET, SO_REUSEPORT, &v, sizeof(v)) == -1)
271 		fatal("setsockopt(SO_REUSEPORT)");
272 
273 	mark_nonblock(sock);
274 
275 	if (bind(sock, addr, len) == -1)
276 		fatal("bind");
277 
278 	if (listen(sock, 16) == -1)
279 		fatal("listen");
280 
281 	return sock;
282 }
283 
284 static int
285 config_send_socks(struct conf *conf)
286 {
287 	struct privsep	*ps = conf->ps;
288 	int		 sock;
289 
290 	if ((sock = make_socket(conf->port, AF_INET)) == -1)
291 		return -1;
292 
293 	if (config_send_file(ps, PROC_SERVER, IMSG_RECONF_SOCK4, sock,
294 	    NULL, 0) == -1)
295 		return -1;
296 
297 	if (!conf->ipv6)
298 		return 0;
299 
300 	if ((sock = make_socket(conf->port, AF_INET6)) == -1)
301 		return -1;
302 
303 	if (config_send_file(ps, PROC_SERVER, IMSG_RECONF_SOCK6, sock,
304 	    NULL, 0) == -1)
305 		return -1;
306 
307 	return 0;
308 }
309 
310 int
311 config_send(struct conf *conf)
312 {
313 	struct privsep	*ps = conf->ps;
314 	struct etm	*m;
315 	struct fcgi	*fcgi;
316 	struct vhost	*h;
317 	struct location	*l;
318 	struct proxy	*p;
319 	struct envlist	*e;
320 	struct alist	*a;
321 	size_t		 i;
322 
323 	for (i = 0; i < conf->mime.len; ++i) {
324 		m = &conf->mime.t[i];
325 		if (proc_compose(ps, PROC_SERVER, IMSG_RECONF_MIME,
326 		    m, sizeof(*m)) == -1)
327 			return -1;
328 	}
329 
330 	if (proc_compose(ps, PROC_SERVER, IMSG_RECONF_PROTOS,
331 	    &conf->protos, sizeof(conf->protos)) == -1)
332 		return -1;
333 
334 	if (proc_compose(ps, PROC_SERVER, IMSG_RECONF_PORT,
335 	    &conf->port, sizeof(conf->port)) == -1)
336 		return -1;
337 
338 	if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
339 		return -1;
340 
341 	if (config_send_socks(conf) == -1)
342 		return -1;
343 
344 	if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
345 		return -1;
346 
347 	TAILQ_FOREACH(fcgi, &conf->fcgi, fcgi) {
348 		log_debug("sending fastcgi %s", fcgi->path);
349 		if (proc_compose(ps, PROC_SERVER, IMSG_RECONF_FCGI,
350 		    fcgi, sizeof(*fcgi)) == -1)
351 			return -1;
352 	}
353 
354 	TAILQ_FOREACH(h, &conf->hosts, vhosts) {
355 		struct vhost vcopy;
356 
357 		memcpy(&vcopy, h, sizeof(vcopy));
358 		vcopy.cert_path = NULL;
359 		vcopy.key_path = NULL;
360 		vcopy.ocsp_path = NULL;
361 
362 		log_debug("sending host %s", h->domain);
363 
364 		if (proc_compose(ps, PROC_SERVER, IMSG_RECONF_HOST,
365 		    &vcopy, sizeof(vcopy)) == -1)
366 			return -1;
367 
368 		if (config_send_kp(ps, IMSG_RECONF_CERT, IMSG_RECONF_KEY,
369 		    h->cert_path, h->key_path) == -1)
370 			return -1;
371 
372 		if (h->ocsp_path != NULL) {
373 			if (config_open_send(ps, PROC_SERVER, IMSG_RECONF_OCSP,
374 			    h->ocsp_path) == -1)
375 				return -1;
376 			if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
377 				return -1;
378 		}
379 
380 		TAILQ_FOREACH(l, &h->locations, locations) {
381 			struct location lcopy;
382 			int fd = -1;
383 
384 			memcpy(&lcopy, l, sizeof(lcopy));
385 			lcopy.reqca_path = NULL;
386 			lcopy.reqca = NULL;
387 			lcopy.dirfd = -1;
388 			memset(&lcopy.locations, 0, sizeof(lcopy.locations));
389 
390 			if (l->reqca_path != NULL &&
391 			    (fd = open(l->reqca_path, O_RDONLY)) == -1)
392 				fatal("can't open %s", l->reqca_path);
393 
394 			if (config_send_file(ps, PROC_SERVER, IMSG_RECONF_LOC,
395 			    fd, &lcopy, sizeof(lcopy)) == -1)
396 				return -1;
397 		}
398 
399 		if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
400 			return -1;
401 
402 		TAILQ_FOREACH(e, &h->params, envs) {
403 			if (proc_compose(ps, PROC_SERVER, IMSG_RECONF_ENV,
404 			    e, sizeof(*e)) == -1)
405 				return -1;
406 		}
407 
408 		if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
409 			return -1;
410 
411 		TAILQ_FOREACH(a, &h->aliases, aliases) {
412 			if (proc_compose(ps, PROC_SERVER, IMSG_RECONF_ALIAS,
413 			    a, sizeof(*a)) == -1)
414 				return -1;
415 		}
416 
417 		if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
418 			return -1;
419 
420 		TAILQ_FOREACH(p, &h->proxies, proxies) {
421 			struct proxy pcopy;
422 			int fd = -1;
423 
424 			memcpy(&pcopy, p, sizeof(pcopy));
425 			pcopy.cert_path = NULL;
426 			pcopy.cert = NULL;
427 			pcopy.certlen = 0;
428 			pcopy.key_path = NULL;
429 			pcopy.key = NULL;
430 			pcopy.keylen = 0;
431 			pcopy.reqca_path = NULL;
432 			pcopy.reqca = NULL;
433 
434 			if (p->reqca_path != NULL) {
435 				fd = open(p->reqca_path, O_RDONLY);
436 				if (fd == -1)
437 					fatal("can't open %s", p->reqca_path);
438 			}
439 
440 			if (config_send_file(ps, PROC_SERVER, IMSG_RECONF_PROXY,
441 			    fd, &pcopy, sizeof(pcopy)) == -1)
442 				return -1;
443 
444 			if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
445 				return -1;
446 
447 			if (p->cert_path == NULL || p->key_path == NULL)
448 				continue;
449 
450 			if (config_open_send(ps, PROC_SERVER,
451 			    IMSG_RECONF_PROXY_CERT, p->cert_path) == -1 ||
452 			    config_open_send(ps, PROC_SERVER,
453 			    IMSG_RECONF_PROXY_KEY, p->key_path) == -1)
454 				return -1;
455 
456 			if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
457 				return -1;
458 		}
459 
460 		if (proc_flush_imsg(ps, PROC_SERVER, -1) == -1)
461 			return -1;
462 	}
463 
464 	return 0;
465 }
466 
467 static int
468 load_file(int fd, uint8_t **data, size_t *len)
469 {
470 	struct stat	 sb;
471 	ssize_t		 r;
472 
473 	if (fstat(fd, &sb) == -1)
474 		fatal("fstat");
475 
476 	if (sb.st_size < 0 /* || sb.st_size > SIZE_MAX */) {
477 		log_warnx("file too large");
478 		close(fd);
479 		return -1;
480 	}
481 	*len = sb.st_size;
482 
483 	if ((*data = malloc(*len)) == NULL)
484 		fatal("malloc");
485 
486 	r = pread(fd, *data, *len, 0);
487 	if (r == -1 || (size_t)r != *len) {
488 		log_warn("read failed");
489 		close(fd);
490 		free(*data);
491 		return -1;
492 	}
493 
494 	close(fd);
495 	return 0;
496 }
497 
498 static int
499 config_crypto_recv_kp(struct conf *conf, struct imsg *imsg)
500 {
501 	static struct pki *pki;
502 	uint8_t *d;
503 	size_t len;
504 
505 	/* XXX: check for duplicates */
506 
507 	if (imsg->fd == -1)
508 		fatalx("no fd for imsg %d", imsg->hdr.type);
509 
510 	switch (imsg->hdr.type) {
511 	case IMSG_RECONF_CERT:
512 		if (pki != NULL)
513 			fatalx("imsg in wrong order; pki is not NULL");
514 		if ((pki = calloc(1, sizeof(*pki))) == NULL)
515 			fatal("calloc");
516 		if (load_file(imsg->fd, &d, &len) == -1)
517 			fatalx("can't load file");
518 		if ((pki->hash = ssl_pubkey_hash(d, len)) == NULL)
519 			fatalx("failed to compute cert hash");
520 		free(d);
521 		TAILQ_INSERT_TAIL(&conf->pkis, pki, pkis);
522 		break;
523 
524 	case IMSG_RECONF_KEY:
525 		if (pki == NULL)
526 			fatalx("got key without cert beforehand %d",
527 			    imsg->hdr.type);
528 		if (load_file(imsg->fd, &d, &len) == -1)
529 			fatalx("failed to load private key");
530 		if ((pki->pkey = ssl_load_pkey(d, len)) == NULL)
531 			fatalx("failed load private key");
532 		free(d);
533 		pki = NULL;
534 		break;
535 
536 	default:
537 		return -1;
538 	}
539 
540 	return 0;
541 }
542 
543 int
544 config_recv(struct conf *conf, struct imsg *imsg)
545 {
546 	static struct vhost *h;
547 	static struct proxy *p;
548 	struct privsep	*ps = conf->ps;
549 	struct etm	 m;
550 	struct fcgi	*fcgi;
551 	struct vhost	*vh, vht;
552 	struct location	*loc;
553 	struct envlist	*env;
554 	struct alist	*alias;
555 	struct proxy	*proxy;
556 	size_t		 datalen;
557 
558 	datalen = IMSG_DATA_SIZE(imsg);
559 
560 	switch (imsg->hdr.type) {
561 	case IMSG_RECONF_START:
562 		config_purge(conf);
563 		h = NULL;
564 		p = NULL;
565 		break;
566 
567 	case IMSG_RECONF_MIME:
568 		IMSG_SIZE_CHECK(imsg, &m);
569 		memcpy(&m, imsg->data, datalen);
570 		if (m.mime[sizeof(m.mime) - 1] != '\0' ||
571 		    m.ext[sizeof(m.ext) - 1] != '\0')
572 			fatal("received corrupted IMSG_RECONF_MIME");
573 		if (add_mime(&conf->mime, m.mime, m.ext) == -1)
574 			fatal("failed to add mime mapping %s -> %s",
575 			    m.mime, m.ext);
576 		break;
577 
578 	case IMSG_RECONF_PROTOS:
579 		IMSG_SIZE_CHECK(imsg, &conf->protos);
580 		memcpy(&conf->protos, imsg->data, datalen);
581 		break;
582 
583 	case IMSG_RECONF_PORT:
584 		IMSG_SIZE_CHECK(imsg, &conf->port);
585 		memcpy(&conf->port, imsg->data, datalen);
586 		break;
587 
588 	case IMSG_RECONF_SOCK4:
589 		if (conf->sock4 != -1)
590 			fatalx("socket ipv4 already recv'd");
591 		if (imsg->fd == -1)
592 			fatalx("missing socket for IMSG_RECONF_SOCK4");
593 		conf->sock4 = imsg->fd;
594 		event_set(&conf->evsock4, conf->sock4, EV_READ|EV_PERSIST,
595 		    do_accept, conf);
596 		break;
597 
598 	case IMSG_RECONF_SOCK6:
599 		if (conf->sock6 != -1)
600 			fatalx("socket ipv6 already recv'd");
601 		if (imsg->fd == -1)
602 			fatalx("missing socket for IMSG_RECONF_SOCK6");
603 		conf->sock6 = imsg->fd;
604 		event_set(&conf->evsock6, conf->sock6, EV_READ|EV_PERSIST,
605 		    do_accept, conf);
606 		break;
607 
608 	case IMSG_RECONF_FCGI:
609 		IMSG_SIZE_CHECK(imsg, fcgi);
610 		fcgi = xcalloc(1, sizeof(*fcgi));
611 		memcpy(fcgi, imsg->data, datalen);
612 		log_debug("received fcgi %s", fcgi->path);
613 		TAILQ_INSERT_TAIL(&conf->fcgi, fcgi, fcgi);
614 		break;
615 
616 	case IMSG_RECONF_HOST:
617 		IMSG_SIZE_CHECK(imsg, &vht);
618 		memcpy(&vht, imsg->data, datalen);
619 		vh = new_vhost();
620 		strlcpy(vh->domain, vht.domain, sizeof(vh->domain));
621 		h = vh;
622 		TAILQ_INSERT_TAIL(&conf->hosts, h, vhosts);
623 
624 		/* reset proxy */
625 		p = NULL;
626 		break;
627 
628 	case IMSG_RECONF_CERT:
629 		log_debug("receiving cert");
630 		if (privsep_process == PROC_CRYPTO)
631 			return config_crypto_recv_kp(conf, imsg);
632 		if (h == NULL)
633 			fatalx("recv'd cert without host");
634 		if (h->cert != NULL)
635 			fatalx("cert already received");
636 		if (imsg->fd == -1)
637 			fatalx("no fd for IMSG_RECONF_CERT");
638 		if (load_file(imsg->fd, &h->cert, &h->certlen) == -1)
639 			fatalx("failed to load cert for %s",
640 			    h->domain);
641 		break;
642 
643 	case IMSG_RECONF_KEY:
644 		log_debug("receiving key");
645 		if (privsep_process == PROC_CRYPTO)
646 			return config_crypto_recv_kp(conf, imsg);
647 		if (h == NULL)
648 			fatalx("recv'd key without host");
649 		if (h->key != NULL)
650 			fatalx("key already received");
651 		if (imsg->fd == -1)
652 			fatalx("no fd for IMSG_RECONF_KEY");
653 		if (load_file(imsg->fd, &h->key, &h->keylen) == -1)
654 			fatalx("failed to load key for %s",
655 			    h->domain);
656 		break;
657 
658 	case IMSG_RECONF_OCSP:
659 		log_debug("receiving ocsp");
660 		if (h == NULL)
661 			fatalx("recv'd ocsp without host");
662 		if (h->ocsp != NULL)
663 			fatalx("ocsp already received");
664 		if (imsg->fd == -1)
665 			fatalx("no fd for IMSG_RECONF_OCSP");
666 		if (load_file(imsg->fd, &h->ocsp, &h->ocsplen) == -1)
667 			fatalx("failed to load ocsp for %s",
668 			    h->domain);
669 		break;
670 
671 	case IMSG_RECONF_LOC:
672 		if (h == NULL)
673 			fatalx("recv'd location without host");
674 		IMSG_SIZE_CHECK(imsg, loc);
675 		loc = xcalloc(1, sizeof(*loc));
676 		memcpy(loc, imsg->data, datalen);
677 
678 		if (imsg->fd != -1) {
679 			loc->reqca = load_ca(imsg->fd);
680 			if (loc->reqca == NULL)
681 				fatalx("failed to load CA");
682 		}
683 
684 		TAILQ_INSERT_TAIL(&h->locations, loc, locations);
685 		break;
686 
687 	case IMSG_RECONF_ENV:
688 		if (h == NULL)
689 			fatalx("recv'd env without host");
690 		IMSG_SIZE_CHECK(imsg, env);
691 		env = xcalloc(1, sizeof(*env));
692 		memcpy(env, imsg->data, datalen);
693 		TAILQ_INSERT_TAIL(&h->params, env, envs);
694 		break;
695 
696 	case IMSG_RECONF_ALIAS:
697 		if (h == NULL)
698 			fatalx("recv'd alias without host");
699 		IMSG_SIZE_CHECK(imsg, alias);
700 		alias = xcalloc(1, sizeof(*alias));
701 		memcpy(alias, imsg->data, datalen);
702 		TAILQ_INSERT_TAIL(&h->aliases, alias, aliases);
703 		break;
704 
705 	case IMSG_RECONF_PROXY:
706 		log_debug("receiving proxy");
707 		if (h == NULL)
708 			fatalx("recv'd proxy without host");
709 		IMSG_SIZE_CHECK(imsg, proxy);
710 		proxy = xcalloc(1, sizeof(*proxy));
711 		memcpy(proxy, imsg->data, datalen);
712 
713 		if (imsg->fd != -1) {
714 			proxy->reqca = load_ca(imsg->fd);
715 			if (proxy->reqca == NULL)
716 				fatal("failed to load CA");
717 		}
718 
719 		TAILQ_INSERT_TAIL(&h->proxies, proxy, proxies);
720 		p = proxy;
721 		break;
722 
723 	case IMSG_RECONF_PROXY_CERT:
724 		log_debug("receiving proxy cert");
725 		if (p == NULL)
726 			fatalx("recv'd proxy cert without proxy");
727 		if (p->cert != NULL)
728 			fatalx("proxy cert already received");
729 		if (imsg->fd == -1)
730 			fatalx("no fd for IMSG_RECONF_PROXY_CERT");
731 		if (load_file(imsg->fd, &p->cert, &p->certlen) == -1)
732 			fatalx("failed to load cert for proxy %s of %s",
733 			    p->host, h->domain);
734 		break;
735 
736 	case IMSG_RECONF_PROXY_KEY:
737 		log_debug("receiving proxy key");
738 		if (p == NULL)
739 			fatalx("recv'd proxy key without proxy");
740 		if (p->key != NULL)
741 			fatalx("proxy key already received");
742 		if (imsg->fd == -1)
743 			fatalx("no fd for IMSG_RECONF_PROXY_KEY");
744 		if (load_file(imsg->fd, &p->key, &p->keylen) == -1)
745 			fatalx("failed to load key for proxy %s of %s",
746 			    p->host, h->domain);
747 		break;
748 
749 	case IMSG_RECONF_END:
750 		if (proc_compose(ps, PROC_PARENT, IMSG_RECONF_DONE,
751 		    NULL, 0) == -1)
752 			return -1;
753 		break;
754 
755 	default:
756 		return -1;
757 	}
758 
759 	return 0;
760 }