1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/types.h>
18 #include <sys/queue.h>
19 #include <sys/socket.h>
20 #include <sys/uio.h>
21 
22 #include <errno.h>
23 #include <event.h>
24 #include <siphash.h>
25 #include <stdint.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <string.h>
29 #include <imsg.h>
30 #include <limits.h>
31 #include <sha1.h>
32 #include <signal.h>
33 #include <unistd.h>
34 
35 #include "got_error.h"
36 
37 #include "gotd.h"
38 #include "log.h"
39 #include "listen.h"
40 
41 #ifndef nitems
42 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
43 #endif
44 
45 struct gotd_listen_client {
46 	STAILQ_ENTRY(gotd_listen_client)	 entry;
47 	uint32_t			 id;
48 	int				 fd;
49 	uid_t				 euid;
50 };
51 STAILQ_HEAD(gotd_listen_clients, gotd_listen_client);
52 
53 static struct gotd_listen_clients gotd_listen_clients[GOTD_CLIENT_TABLE_SIZE];
54 static SIPHASH_KEY clients_hash_key;
55 static volatile int listen_client_cnt;
56 static int inflight;
57 
58 struct gotd_uid_connection_counter {
59 	STAILQ_ENTRY(gotd_uid_connection_counter) entry;
60 	uid_t euid;
61 	int nconnections;
62 };
63 STAILQ_HEAD(gotd_client_uids, gotd_uid_connection_counter);
64 static struct gotd_client_uids gotd_client_uids[GOTD_CLIENT_TABLE_SIZE];
65 static SIPHASH_KEY uid_hash_key;
66 
67 static struct {
68 	pid_t pid;
69 	const char *title;
70 	int fd;
71 	struct gotd_imsgev iev;
72 	struct gotd_imsgev pause;
73 	struct gotd_uid_connection_limit *connection_limits;
74 	size_t nconnection_limits;
75 } gotd_listen;
76 
77 static int inflight;
78 
79 static void listen_shutdown(void);
80 
81 static void
82 listen_sighdlr(int sig, short event, void *arg)
83 {
84 	/*
85 	 * Normal signal handler rules don't apply because libevent
86 	 * decouples for us.
87 	 */
88 
89 	switch (sig) {
90 	case SIGHUP:
91 		break;
92 	case SIGUSR1:
93 		break;
94 	case SIGTERM:
95 	case SIGINT:
96 		listen_shutdown();
97 		/* NOTREACHED */
98 		break;
99 	default:
100 		fatalx("unexpected signal");
101 	}
102 }
103 
104 static uint64_t
105 client_hash(uint32_t client_id)
106 {
107 	return SipHash24(&clients_hash_key, &client_id, sizeof(client_id));
108 }
109 
110 static void
111 add_client(struct gotd_listen_client *client)
112 {
113 	uint64_t slot = client_hash(client->id) % nitems(gotd_listen_clients);
114 	STAILQ_INSERT_HEAD(&gotd_listen_clients[slot], client, entry);
115 	listen_client_cnt++;
116 }
117 
118 static struct gotd_listen_client *
119 find_client(uint32_t client_id)
120 {
121 	uint64_t slot;
122 	struct gotd_listen_client *c;
123 
124 	slot = client_hash(client_id) % nitems(gotd_listen_clients);
125 	STAILQ_FOREACH(c, &gotd_listen_clients[slot], entry) {
126 		if (c->id == client_id)
127 			return c;
128 	}
129 
130 	return NULL;
131 }
132 
133 static uint32_t
134 get_client_id(void)
135 {
136 	int duplicate = 0;
137 	uint32_t id;
138 
139 	do {
140 		id = arc4random();
141 		duplicate = (find_client(id) != NULL);
142 	} while (duplicate || id == 0);
143 
144 	return id;
145 }
146 
147 static uint64_t
148 uid_hash(uid_t euid)
149 {
150 	return SipHash24(&uid_hash_key, &euid, sizeof(euid));
151 }
152 
153 static void
154 add_uid_connection_counter(struct gotd_uid_connection_counter *counter)
155 {
156 	uint64_t slot = uid_hash(counter->euid) % nitems(gotd_client_uids);
157 	STAILQ_INSERT_HEAD(&gotd_client_uids[slot], counter, entry);
158 }
159 
160 static void
161 remove_uid_connection_counter(struct gotd_uid_connection_counter *counter)
162 {
163 	uint64_t slot = uid_hash(counter->euid) % nitems(gotd_client_uids);
164 	STAILQ_REMOVE(&gotd_client_uids[slot], counter,
165 	    gotd_uid_connection_counter, entry);
166 }
167 
168 static struct gotd_uid_connection_counter *
169 find_uid_connection_counter(uid_t euid)
170 {
171 	uint64_t slot;
172 	struct gotd_uid_connection_counter *c;
173 
174 	slot = uid_hash(euid) % nitems(gotd_client_uids);
175 	STAILQ_FOREACH(c, &gotd_client_uids[slot], entry) {
176 		if (c->euid == euid)
177 			return c;
178 	}
179 
180 	return NULL;
181 }
182 
183 struct gotd_uid_connection_limit *
184 gotd_find_uid_connection_limit(struct gotd_uid_connection_limit *limits,
185     size_t nlimits, uid_t uid)
186 {
187 	/* This array is always sorted to allow for binary search. */
188 	int i, left = 0, right = nlimits - 1;
189 
190 	while (left <= right) {
191 		i = ((left + right) / 2);
192 		if (limits[i].uid == uid)
193 			return &limits[i];
194 		if (limits[i].uid > uid)
195 			left = i + 1;
196 		else
197 			right = i - 1;
198 	}
199 
200 	return NULL;
201 }
202 
203 static const struct got_error *
204 disconnect(struct gotd_listen_client *client)
205 {
206 	struct gotd_uid_connection_counter *counter;
207 	uint64_t slot;
208 	int client_fd;
209 
210 	log_debug("client on fd %d disconnecting", client->fd);
211 
212 	slot = client_hash(client->id) % nitems(gotd_listen_clients);
213 	STAILQ_REMOVE(&gotd_listen_clients[slot], client,
214 	    gotd_listen_client, entry);
215 
216 	counter = find_uid_connection_counter(client->euid);
217 	if (counter) {
218 		if (counter->nconnections > 0)
219 			counter->nconnections--;
220 		if (counter->nconnections == 0) {
221 			remove_uid_connection_counter(counter);
222 			free(counter);
223 		}
224 	}
225 
226 	client_fd = client->fd;
227 	free(client);
228 	inflight--;
229 	listen_client_cnt--;
230 	if (close(client_fd) == -1)
231 		return got_error_from_errno("close");
232 
233 	return NULL;
234 }
235 
236 static int
237 accept_reserve(int fd, struct sockaddr *addr, socklen_t *addrlen,
238     int reserve, volatile int *counter)
239 {
240 	int ret;
241 
242 	if (getdtablecount() + reserve +
243 	    ((*counter + 1) * GOTD_FD_NEEDED) >= getdtablesize()) {
244 		log_debug("inflight fds exceeded");
245 		errno = EMFILE;
246 		return -1;
247 	}
248 
249 	if ((ret = accept4(fd, addr, addrlen,
250 	    SOCK_NONBLOCK | SOCK_CLOEXEC)) > -1) {
251 		(*counter)++;
252 	}
253 
254 	return ret;
255 }
256 
257 static void
258 gotd_accept_paused(int fd, short event, void *arg)
259 {
260 	event_add(&gotd_listen.iev.ev, NULL);
261 }
262 
263 static void
264 gotd_accept(int fd, short event, void *arg)
265 {
266 	struct gotd_imsgev *iev = arg;
267 	struct sockaddr_storage ss;
268 	struct timeval backoff;
269 	socklen_t len;
270 	int s = -1;
271 	struct gotd_listen_client *client = NULL;
272 	struct gotd_uid_connection_counter *counter = NULL;
273 	struct gotd_imsg_connect iconn;
274 	uid_t euid;
275 	gid_t egid;
276 
277 	backoff.tv_sec = 1;
278 	backoff.tv_usec = 0;
279 
280 	if (event_add(&gotd_listen.iev.ev, NULL) == -1) {
281 		log_warn("event_add");
282 		return;
283 	}
284 	if (event & EV_TIMEOUT)
285 		return;
286 
287 	len = sizeof(ss);
288 
289 	/* Other backoff conditions apart from EMFILE/ENFILE? */
290 	s = accept_reserve(fd, (struct sockaddr *)&ss, &len, GOTD_FD_RESERVE,
291 	    &inflight);
292 	if (s == -1) {
293 		switch (errno) {
294 		case EINTR:
295 		case EWOULDBLOCK:
296 		case ECONNABORTED:
297 			return;
298 		case EMFILE:
299 		case ENFILE:
300 			event_del(&gotd_listen.iev.ev);
301 			evtimer_add(&gotd_listen.pause.ev, &backoff);
302 			return;
303 		default:
304 			log_warn("accept");
305 			return;
306 		}
307 	}
308 
309 	if (listen_client_cnt >= GOTD_MAXCLIENTS)
310 		goto err;
311 
312 	if (getpeereid(s, &euid, &egid) == -1) {
313 		log_warn("getpeerid");
314 		goto err;
315 	}
316 
317 	counter = find_uid_connection_counter(euid);
318 	if (counter == NULL) {
319 		counter = calloc(1, sizeof(*counter));
320 		if (counter == NULL) {
321 			log_warn("%s: calloc", __func__);
322 			goto err;
323 		}
324 		counter->euid = euid;
325 		counter->nconnections = 1;
326 		add_uid_connection_counter(counter);
327 	} else {
328 		int max_connections = GOTD_MAX_CONN_PER_UID;
329 		struct gotd_uid_connection_limit *limit;
330 
331 		limit = gotd_find_uid_connection_limit(
332 		    gotd_listen.connection_limits,
333 		    gotd_listen.nconnection_limits, euid);
334 		if (limit)
335 			max_connections = limit->max_connections;
336 
337 		if (counter->nconnections >= max_connections) {
338 			log_warnx("maximum connections exceeded for uid %d",
339 			    euid);
340 			goto err;
341 		}
342 		counter->nconnections++;
343 	}
344 
345 	client = calloc(1, sizeof(*client));
346 	if (client == NULL) {
347 		log_warn("%s: calloc", __func__);
348 		goto err;
349 	}
350 	client->id = get_client_id();
351 	client->fd = s;
352 	client->euid = euid;
353 	s = -1;
354 	add_client(client);
355 	log_debug("%s: new client connected on fd %d uid %d gid %d", __func__,
356 	    client->fd, euid, egid);
357 
358 	memset(&iconn, 0, sizeof(iconn));
359 	iconn.client_id = client->id;
360 	iconn.euid = euid;
361 	iconn.egid = egid;
362 	s = dup(client->fd);
363 	if (s == -1) {
364 		log_warn("%s: dup", __func__);
365 		goto err;
366 	}
367 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_CONNECT, PROC_LISTEN, s,
368 	    &iconn, sizeof(iconn)) == -1) {
369 		log_warn("imsg compose CONNECT");
370 		goto err;
371 	}
372 
373 	return;
374 err:
375 	inflight--;
376 	if (client)
377 		disconnect(client);
378 	if (s != -1)
379 		close(s);
380 }
381 
382 static const struct got_error *
383 recv_disconnect(struct imsg *imsg)
384 {
385 	struct gotd_imsg_disconnect idisconnect;
386 	size_t datalen;
387 	struct gotd_listen_client *client = NULL;
388 
389 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
390 	if (datalen != sizeof(idisconnect))
391 		return got_error(GOT_ERR_PRIVSEP_LEN);
392 	memcpy(&idisconnect, imsg->data, sizeof(idisconnect));
393 
394 	log_debug("client disconnecting");
395 
396 	client = find_client(idisconnect.client_id);
397 	if (client == NULL)
398 		return got_error(GOT_ERR_CLIENT_ID);
399 
400 	return disconnect(client);
401 }
402 
403 static void
404 listen_dispatch(int fd, short event, void *arg)
405 {
406 	const struct got_error *err = NULL;
407 	struct gotd_imsgev *iev = arg;
408 	struct imsgbuf *ibuf = &iev->ibuf;
409 	struct imsg imsg;
410 	ssize_t n;
411 	int shut = 0;
412 
413 	if (event & EV_READ) {
414 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
415 			fatal("imsg_read error");
416 		if (n == 0)	/* Connection closed. */
417 			shut = 1;
418 	}
419 
420 	if (event & EV_WRITE) {
421 		n = msgbuf_write(&ibuf->w);
422 		if (n == -1 && errno != EAGAIN)
423 			fatal("msgbuf_write");
424 		if (n == 0)	/* Connection closed. */
425 			shut = 1;
426 	}
427 
428 	for (;;) {
429 		if ((n = imsg_get(ibuf, &imsg)) == -1)
430 			fatal("%s: imsg_get", __func__);
431 		if (n == 0)	/* No more messages. */
432 			break;
433 
434 		switch (imsg.hdr.type) {
435 		case GOTD_IMSG_DISCONNECT:
436 			err = recv_disconnect(&imsg);
437 			if (err)
438 				log_warnx("%s: disconnect: %s",
439 				    gotd_listen.title, err->msg);
440 			break;
441 		default:
442 			log_debug("%s: unexpected imsg %d", gotd_listen.title,
443 			    imsg.hdr.type);
444 			break;
445 		}
446 
447 		imsg_free(&imsg);
448 	}
449 
450 	if (!shut) {
451 		gotd_imsg_event_add(iev);
452 	} else {
453 		/* This pipe is dead. Remove its event handler */
454 		event_del(&iev->ev);
455 		event_loopexit(NULL);
456 	}
457 }
458 
459 void
460 listen_main(const char *title, int gotd_socket,
461     struct gotd_uid_connection_limit *connection_limits,
462     size_t nconnection_limits)
463 {
464 	struct gotd_imsgev iev;
465 	struct event evsigint, evsigterm, evsighup, evsigusr1;
466 
467 	arc4random_buf(&clients_hash_key, sizeof(clients_hash_key));
468 	arc4random_buf(&uid_hash_key, sizeof(uid_hash_key));
469 
470 	gotd_listen.title = title;
471 	gotd_listen.pid = getpid();
472 	gotd_listen.fd = gotd_socket;
473 	gotd_listen.connection_limits = connection_limits;
474 	gotd_listen.nconnection_limits = nconnection_limits;
475 
476 	signal_set(&evsigint, SIGINT, listen_sighdlr, NULL);
477 	signal_set(&evsigterm, SIGTERM, listen_sighdlr, NULL);
478 	signal_set(&evsighup, SIGHUP, listen_sighdlr, NULL);
479 	signal_set(&evsigusr1, SIGUSR1, listen_sighdlr, NULL);
480 	signal(SIGPIPE, SIG_IGN);
481 
482 	signal_add(&evsigint, NULL);
483 	signal_add(&evsigterm, NULL);
484 	signal_add(&evsighup, NULL);
485 	signal_add(&evsigusr1, NULL);
486 
487 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
488 	iev.handler = listen_dispatch;
489 	iev.events = EV_READ;
490 	iev.handler_arg = NULL;
491 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, listen_dispatch, &iev);
492 	if (event_add(&iev.ev, NULL) == -1)
493 		fatalx("event add");
494 
495 	event_set(&gotd_listen.iev.ev, gotd_listen.fd, EV_READ | EV_PERSIST,
496 	    gotd_accept, &iev);
497 	if (event_add(&gotd_listen.iev.ev, NULL))
498 		fatalx("event add");
499 	evtimer_set(&gotd_listen.pause.ev, gotd_accept_paused, NULL);
500 
501 	event_dispatch();
502 
503 	listen_shutdown();
504 }
505 
506 static void
507 listen_shutdown(void)
508 {
509 	log_debug("%s: shutting down", gotd_listen.title);
510 
511 	free(gotd_listen.connection_limits);
512 	if (gotd_listen.fd != -1)
513 		close(gotd_listen.fd);
514 
515 	exit(0);
516 }