op public repos

Blob

Date:: Mon Feb 12 22:03:47 2024 UTC
Message:: augment some code paths with some logging
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2021, 2024 Omar Polo <op@omarpolo.com>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "compat.h"
18 
19 #include <sys/mman.h>
20 #include <sys/types.h>
21 #include <sys/socket.h>
22 #include <sys/stat.h>
23 
24 #include <netinet/in.h>
25 
26 #include <assert.h>
27 #include <ctype.h>
28 #include <errno.h>
29 #include <netdb.h>
30 #include <stdarg.h>
31 #include <stdio.h>
32 #include <stdlib.h>
33 #include <string.h>
34 #include <tls.h>
35 #include <unistd.h>
36 
37 #include <openssl/err.h>
38 
39 #if HAVE_ASR_RUN
40 # include <asr.h>
41 #endif
42 
43 #include "telescope.h"
44 #include "utils.h"
45 
46 static struct imsgev		*iev_ui;
47 
48 /* a pending request */
49 struct req {
50 	uint32_t		 id;
51 	int			 proto;
52 	int			 fd;
53 	struct tls		*ctx;
54 	char			*host;
55 	char			*port;
56 	char			*req;
57 	size_t			 len;
58 	void			*ccert;
59 	size_t			 ccert_len;
60 	int			 ccert_fd;
61 	int			 done_header;
62 	struct bufferevent	*bev;
63 
64 	struct addrinfo		*servinfo, *p;
65 #if HAVE_ASR_RUN
66 	struct addrinfo		 hints;
67 	struct event_asr	*asrev;
68 #endif
69 
70 	TAILQ_ENTRY(req)	 reqs;
71 };
72 
73 static struct req	*req_by_id(uint32_t);
74 
75 static void	 die(void) __attribute__((__noreturn__));
76 
77 static void	 try_to_connect(int, short, void*);
78 
79 #if HAVE_ASR_RUN
80 static void	 query_done(struct asr_result*, void*);
81 #endif
82 static void	 conn_towards(struct req*);
83 
84 static void	 close_with_err(struct req*, const char*);
85 static void	 close_with_errf(struct req*, const char*, ...)
86     __attribute__((format(printf, 2, 3)));
87 
88 static void	 net_tls_handshake(int, short, void *);
89 static void	 net_tls_readcb(int, short, void *);
90 static void	 net_tls_writecb(int, short, void *);
91 
92 static int	 gemini_parse_reply(struct req *, const char *, size_t);
93 
94 static void	 net_ready(struct req *req);
95 static void	 net_read(struct bufferevent *, void *);
96 static void	 net_write(struct bufferevent *, void *);
97 static void	 net_error(struct bufferevent *, short, void *);
98 
99 static void	 handle_dispatch_imsg(int, short, void*);
100 
101 static int	 net_send_ui(int, uint32_t, const void *, uint16_t);
102 
103 /* TODO: making this customizable */
104 struct timeval timeout_for_handshake = { 5, 0 };
105 
106 typedef void (*statefn)(int, short, void*);
107 
108 TAILQ_HEAD(, req) reqhead;
109 
110 static inline void
111 yield_r(struct req *req, statefn fn, struct timeval *tv)
112 {
113 	event_once(req->fd, EV_READ, fn, req, tv);
114 }
115 
116 static inline void
117 yield_w(struct req *req, statefn fn, struct timeval *tv)
118 {
119 	event_once(req->fd, EV_WRITE, fn, req, tv);
120 }
121 
122 static struct req *
123 req_by_id(uint32_t id)
124 {
125 	struct req *r;
126 
127 	TAILQ_FOREACH(r, &reqhead, reqs) {
128 		if (r->id == id)
129 			return r;
130 	}
131 
132 	return NULL;
133 }
134 
135 static void __attribute__((__noreturn__))
136 die(void)
137 {
138 	abort(); 		/* TODO */
139 }
140 
141 static void
142 try_to_connect(int fd, short ev, void *d)
143 {
144 	struct req	*req = d;
145 	int		 error = 0;
146 	socklen_t	 len = sizeof(error);
147 
148 again:
149 	if (req->p == NULL)
150 		goto err;
151 
152 	if (req->fd != -1) {
153 		if (getsockopt(req->fd, SOL_SOCKET, SO_ERROR, &error,
154 		    &len) == -1)
155 			goto err;
156 		if (error != 0) {
157 			errno = error;
158 			goto err;
159 		}
160 		goto done;
161 	}
162 
163 	req->fd = socket(req->p->ai_family, req->p->ai_socktype,
164 	    req->p->ai_protocol);
165 	if (req->fd == -1) {
166 		req->p = req->p->ai_next;
167 		goto again;
168 	}
169 
170 	if (!mark_nonblock_cloexec(req->fd))
171 		goto err;
172 	if (connect(req->fd, req->p->ai_addr, req->p->ai_addrlen) == 0)
173 		goto done;
174 	yield_w(req, try_to_connect, NULL);
175 	return;
176 
177 err:
178 	freeaddrinfo(req->servinfo);
179 	close_with_errf(req, "failed to connect to %s", req->host);
180 	return;
181 
182 done:
183 	freeaddrinfo(req->servinfo);
184 
185 	switch (req->proto) {
186 	case PROTO_FINGER:
187 	case PROTO_GOPHER:
188 		/* finger and gopher don't have a header nor TLS */
189 		req->done_header = 1;
190 		net_ready(req);
191 		break;
192 
193 	case PROTO_GEMINI: {
194 		struct tls_config *conf;
195 
196 		if ((conf = tls_config_new()) == NULL)
197 			die();
198 
199 		tls_config_insecure_noverifycert(conf);
200 		tls_config_insecure_noverifyname(conf);
201 
202 		if (req->ccert && tls_config_set_keypair_mem(conf,
203 		    req->ccert, req->ccert_len, req->ccert, req->ccert_len)
204 		    == -1) {
205 			close_with_errf(req, "failed to load keypair: %s",
206 			    tls_config_error(conf));
207 			tls_config_free(conf);
208 			return;
209 		}
210 
211 		/* prepare tls */
212 		if ((req->ctx = tls_client()) == NULL) {
213 			close_with_errf(req, "tls_client: %s",
214 			    strerror(errno));
215 			tls_config_free(conf);
216 			return;
217 		}
218 
219 		if (tls_configure(req->ctx, conf) == -1) {
220 			close_with_errf(req, "tls_configure: %s",
221 			    tls_error(req->ctx));
222 			tls_config_free(conf);
223 			return;
224 		}
225 		tls_config_free(conf);
226 
227 		if (tls_connect_socket(req->ctx, req->fd, req->host)
228 		    == -1) {
229 			close_with_errf(req, "tls_connect_socket: %s",
230 			    tls_error(req->ctx));
231 			return;
232 		}
233 		yield_w(req, net_tls_handshake, &timeout_for_handshake);
234 		break;
235 	}
236 
237 	default:
238 		die();
239 	}
240 }
241 
242 #if HAVE_ASR_RUN
243 static void
244 query_done(struct asr_result *res, void *d)
245 {
246 	struct req	*req = d;
247 
248 	req->asrev = NULL;
249 	if (res->ar_gai_errno != 0) {
250 		close_with_errf(req, "failed to resolve %s: %s",
251 		    req->host, gai_strerror(res->ar_gai_errno));
252 		return;
253 	}
254 
255 	req->fd = -1;
256 	req->servinfo = res->ar_addrinfo;
257 	req->p = res->ar_addrinfo;
258 	try_to_connect(0, 0, req);
259 }
260 
261 static void
262 conn_towards(struct req *req)
263 {
264 	struct asr_query	*q;
265 
266 	req->hints.ai_family = AF_UNSPEC;
267 	req->hints.ai_socktype = SOCK_STREAM;
268 	q = getaddrinfo_async(req->host, req->port, &req->hints,
269 	    NULL);
270 	req->asrev = event_asr_run(q, query_done, req);
271 }
272 #else
273 static void
274 conn_towards(struct req *req)
275 {
276 	struct addrinfo	 hints;
277 	int		 status;
278 
279 	memset(&hints, 0, sizeof(hints));
280 	hints.ai_family = AF_UNSPEC;
281 	hints.ai_socktype = SOCK_STREAM;
282 
283 	if ((status = getaddrinfo(req->host, req->port, &hints,
284 	    &req->servinfo))) {
285 		close_with_errf(req, "failed to resolve %s: %s",
286 		    req->host, gai_strerror(status));
287 		return;
288 	}
289 
290 	req->fd = -1;
291 	req->p = req->servinfo;
292 	try_to_connect(0, 0, req);
293 }
294 #endif
295 
296 static void
297 ssl_error(const char *where)
298 {
299 	unsigned long	 code;
300 	char		 errbuf[256];
301 
302 	fprintf(stderr, "failure(s) in %s:\n", where);
303 	while ((code = ERR_get_error()) != 0) {
304 		ERR_error_string_n(code, errbuf, sizeof(errbuf));
305 		fprintf(stderr, "- %s\n", errbuf);
306 	}
307 }
308 
309 static void
310 close_conn(int fd, short ev, void *d)
311 {
312 	struct req	*req = d;
313 
314 #if HAVE_ASR_RUN
315 	if (req->asrev != NULL)
316 		event_asr_abort(req->asrev);
317 #endif
318 
319 	if (req->bev != NULL) {
320 		bufferevent_free(req->bev);
321 		req->bev = NULL;
322 	}
323 
324 	if (req->ctx != NULL) {
325 		switch (tls_close(req->ctx)) {
326 		case TLS_WANT_POLLIN:
327 			yield_r(req, close_conn, NULL);
328 			return;
329 		case TLS_WANT_POLLOUT:
330 			yield_w(req, close_conn, NULL);
331 			return;
332 		case -1:
333 			ssl_error("tls_close");
334 		}
335 
336 		tls_free(req->ctx);
337 		req->ctx = NULL;
338 	}
339 
340 	if (req->ccert != NULL) {
341 		munmap(req->ccert, req->ccert_len);
342 		close(req->ccert_fd);
343 	}
344 
345 	free(req->host);
346 	free(req->port);
347 	free(req->req);
348 
349 	TAILQ_REMOVE(&reqhead, req, reqs);
350 	if (req->fd != -1)
351 		close(req->fd);
352 	free(req);
353 }
354 
355 static void
356 close_with_err(struct req *req, const char *err)
357 {
358 	net_send_ui(IMSG_ERR, req->id, err, strlen(err)+1);
359 	close_conn(0, 0, req);
360 }
361 
362 static void
363 close_with_errf(struct req *req, const char *fmt, ...)
364 {
365 	va_list	 ap;
366 	char	*s;
367 
368 	va_start(ap, fmt);
369 	if (vasprintf(&s, fmt, ap) == -1)
370 		abort();
371 	va_end(ap);
372 
373 	close_with_err(req, s);
374 	free(s);
375 }
376 
377 static void
378 net_tls_handshake(int fd, short event, void *d)
379 {
380 	struct req	*req = d;
381 	const char	*hash;
382 
383 	if (event == EV_TIMEOUT) {
384 		close_with_err(req, "Timeout loading page");
385 		return;
386 	}
387 
388 	switch (tls_handshake(req->ctx)) {
389 	case TLS_WANT_POLLIN:
390 		yield_r(req, net_tls_handshake, NULL);
391 		return;
392 	case TLS_WANT_POLLOUT:
393 		yield_w(req, net_tls_handshake, NULL);
394 		return;
395 	case -1:
396 		ssl_error("tls_handshake");
397 	}
398 
399 	hash = tls_peer_cert_hash(req->ctx);
400 	if (hash == NULL) {
401 		ssl_error("tls_peer_cert_hash");
402 		close_with_errf(req, "handshake failed: %s",
403 		    tls_error(req->ctx));
404 		return;
405 	}
406 	net_send_ui(IMSG_CHECK_CERT, req->id, hash, strlen(hash)+1);
407 }
408 
409 static void
410 net_tls_readcb(int fd, short event, void *d)
411 {
412 	struct bufferevent	*bufev = d;
413 	struct req		*req = bufev->cbarg;
414 	char			 buf[IBUF_READ_SIZE];
415 	int			 what = EVBUFFER_READ;
416 	int			 howmuch = IBUF_READ_SIZE;
417 	int			 res;
418 	ssize_t			 ret;
419 	size_t			 len;
420 
421 	if (event == EV_TIMEOUT) {
422 		what |= EVBUFFER_TIMEOUT;
423 		goto err;
424 	}
425 
426 	if (bufev->wm_read.high != 0)
427 		howmuch = MIN(sizeof(buf), bufev->wm_read.high);
428 
429 	switch (ret = tls_read(req->ctx, buf, howmuch)) {
430 	case TLS_WANT_POLLIN:
431 	case TLS_WANT_POLLOUT:
432 		goto retry;
433 	case -1:
434 		ssl_error("tls_read");
435 		what |= EVBUFFER_ERROR;
436 		goto err;
437 	}
438 	len = ret;
439 
440 	if (len == 0) {
441 		what |= EVBUFFER_EOF;
442 		goto err;
443 	}
444 
445 	res = evbuffer_add(bufev->input, buf, len);
446 	if (res == -1) {
447 		what |= EVBUFFER_ERROR;
448 		goto err;
449 	}
450 
451 	event_add(&bufev->ev_read, NULL);
452 
453 	len = EVBUFFER_LENGTH(bufev->input);
454 	if (bufev->wm_read.low != 0 && len < bufev->wm_read.low)
455 		return;
456 
457 	if (bufev->readcb != NULL)
458 		(*bufev->readcb)(bufev, bufev->cbarg);
459 	return;
460 
461 retry:
462 	event_add(&bufev->ev_read, NULL);
463 	return;
464 
465 err:
466 	(*bufev->errorcb)(bufev, what, bufev->cbarg);
467 }
468 
469 static void
470 net_tls_writecb(int fd, short event, void *d)
471 {
472 	struct bufferevent	*bufev = d;
473 	struct req		*req = bufev->cbarg;
474 	ssize_t			 ret;
475 	size_t			 len;
476 	short			 what = EVBUFFER_WRITE;
477 
478 	if (event & EV_TIMEOUT) {
479 		what |= EVBUFFER_TIMEOUT;
480 		goto err;
481 	}
482 
483 	if (EVBUFFER_LENGTH(bufev->output) != 0) {
484 		ret = tls_write(req->ctx, EVBUFFER_DATA(bufev->output),
485 		    EVBUFFER_LENGTH(bufev->output));
486 		switch (ret) {
487 		case TLS_WANT_POLLIN:
488 		case TLS_WANT_POLLOUT:
489 			goto retry;
490 		case -1:
491 			ssl_error("tls_write");
492 			what |= EVBUFFER_ERROR;
493 			goto err;
494 		}
495 		len = ret;
496 
497 		evbuffer_drain(bufev->output, len);
498 	}
499 
500 	if (EVBUFFER_LENGTH(bufev->output) != 0)
501 		event_add(&bufev->ev_write, NULL);
502 
503 	if (bufev->writecb != NULL &&
504 	    EVBUFFER_LENGTH(bufev->output) <= bufev->wm_write.low)
505 		(*bufev->writecb)(bufev, bufev->cbarg);
506 	return;
507 
508 retry:
509 	event_add(&bufev->ev_write, NULL);
510 	return;
511 
512 err:
513 	(*bufev->errorcb)(bufev, what, bufev->cbarg);
514 }
515 
516 static int
517 gemini_parse_reply(struct req *req, const char *header, size_t len)
518 {
519 	struct ibuf	*ibuf;
520 	int		 code;
521 	const char	*t;
522 
523 	if (len < 4)
524 		return 0;
525 
526 	if (!isdigit(header[0]) || !isdigit(header[1]))
527 		return 0;
528 
529 	code = (header[0] - '0')*10 + (header[1] - '0');
530 	if (header[2] != ' ')
531 		return 0;
532 
533 	t = header + 3;
534 	len = strlen(t) + 1;
535 
536 	if ((ibuf = imsg_create(&iev_ui->ibuf, IMSG_REPLY, req->id, 0,
537 	    sizeof(code) + len)) == NULL)
538 		die();
539 	if (imsg_add(ibuf, &code, sizeof(code)) == -1 ||
540 	    imsg_add(ibuf, t, len) == -1)
541 		die();
542 	imsg_close(&iev_ui->ibuf, ibuf);
543 	imsg_event_add(iev_ui);
544 
545 	bufferevent_disable(req->bev, EV_READ|EV_WRITE);
546 
547 	return code;
548 }
549 
550 /* called when we're ready to read/write */
551 static void
552 net_ready(struct req *req)
553 {
554 	req->bev = bufferevent_new(req->fd, net_read, net_write, net_error,
555 	    req);
556 	if (req->bev == NULL)
557 		die();
558 
559 #if HAVE_EVENT2
560 	evbuffer_unfreeze(req->bev->input, 0);
561 	evbuffer_unfreeze(req->bev->output, 1);
562 #endif
563 
564 	/* setup tls i/o layer */
565 	if (req->ctx != NULL) {
566 		event_set(&req->bev->ev_read, req->fd, EV_READ,
567 		    net_tls_readcb, req->bev);
568 		event_set(&req->bev->ev_write, req->fd, EV_WRITE,
569 		    net_tls_writecb, req->bev);
570 	}
571 
572 	/* TODO: adjust watermarks */
573 	bufferevent_setwatermark(req->bev, EV_WRITE, 1, 0);
574 	bufferevent_setwatermark(req->bev, EV_READ,  1, 0);
575 
576 	bufferevent_enable(req->bev, EV_READ|EV_WRITE);
577 
578 	bufferevent_write(req->bev, req->req, req->len);
579 }
580 
581 /* called after a read has been done */
582 static void
583 net_read(struct bufferevent *bev, void *d)
584 {
585 	static char	 buf[4096];
586 	struct req	*req = d;
587 	struct evbuffer	*src = EVBUFFER_INPUT(bev);
588 	size_t		 len;
589 	int		 r;
590 	char		*header;
591 
592 	if (!req->done_header) {
593 		header = evbuffer_readln(src, &len, EVBUFFER_EOL_CRLF_STRICT);
594 		if (header == NULL && EVBUFFER_LENGTH(src) >= 1024) {
595 			(*bev->errorcb)(bev, EVBUFFER_READ, bev->cbarg);
596 			return;
597 		}
598 		if (header == NULL)
599 			return;
600 		r = gemini_parse_reply(req, header, len);
601 		free(header);
602 		req->done_header = 1;
603 		if (r == 0) {
604 			(*bev->errorcb)(bev, EVBUFFER_READ, bev->cbarg);
605 			return;
606 		}
607 		if (r < 20 || r >= 30) {
608 			close_conn(0, 0, req);
609 			return;
610 		}
611 	}
612 
613 	/*
614 	 * Split data into chunks before sending.  imsg can't handle
615 	 * message that are "too big".
616 	 */
617 	for (;;) {
618 		if ((len = bufferevent_read(bev, buf, sizeof(buf))) == 0)
619 			break;
620 		net_send_ui(IMSG_BUF, req->id, buf, len);
621 	}
622 }
623 
624 /* called after a write has been done */
625 static void
626 net_write(struct bufferevent *bev, void *d)
627 {
628 	struct evbuffer	*dst = EVBUFFER_OUTPUT(bev);
629 
630 	if (EVBUFFER_LENGTH(dst) == 0)
631 		(*bev->errorcb)(bev, EVBUFFER_WRITE, bev->cbarg);
632 }
633 
634 static void
635 net_error(struct bufferevent *bev, short error, void *d)
636 {
637 	struct req	*req = d;
638 	struct evbuffer	*src;
639 
640 	if (error & EVBUFFER_TIMEOUT) {
641 		close_with_err(req, "Timeout loading page");
642 		return;
643 	}
644 
645 	if (error & EVBUFFER_ERROR) {
646 		close_with_errf(req, "%s error (0x%x)",
647 		    (error & EVBUFFER_READ) ? "read" : "write", error);
648 		return;
649 	}
650 
651 	if (error & EVBUFFER_EOF) {
652 		/* EOF and no header */
653 		if (!req->done_header) {
654 			close_with_err(req, "protocol error");
655 			return;
656 		}
657 
658 		src = EVBUFFER_INPUT(req->bev);
659 		if (EVBUFFER_LENGTH(src) != 0)
660 			net_send_ui(IMSG_BUF, req->id, EVBUFFER_DATA(src),
661 			    EVBUFFER_LENGTH(src));
662 		net_send_ui(IMSG_EOF, req->id, NULL, 0);
663 		close_conn(0, 0, req);
664 		return;
665 	}
666 
667 	if (error & EVBUFFER_WRITE) {
668 		/* finished sending request */
669 		bufferevent_disable(bev, EV_WRITE);
670 		return;
671 	}
672 
673 	if (error & EVBUFFER_READ) {
674 		close_with_err(req, "protocol error");
675 		return;
676 	}
677 
678 	close_with_errf(req, "unknown event error %x", error);
679 }
680 
681 static int
682 load_cert(struct imsg *imsg, struct req *req)
683 {
684 	struct stat	 sb;
685 	int		 fd;
686 
687 	if ((fd = imsg_get_fd(imsg)) == -1)
688 		return (0);
689 
690 	if (fstat(fd, &sb) == -1)
691 		return (-1);
692 
693 #if 0
694 	if (sb.st_size >= (off_t)SIZE_MAX) {
695 		close(fd);
696 		return (-1);
697 	}
698 #endif
699 
700 	req->ccert = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
701 	if (req->ccert == MAP_FAILED) {
702 		req->ccert = NULL;
703 		close(fd);
704 		return (-1);
705 	}
706 
707 	req->ccert_len = sb.st_size;
708 	req->ccert_fd = fd;
709 
710 	return (0);
711 }
712 
713 static void
714 handle_dispatch_imsg(int fd, short event, void *d)
715 {
716 	struct imsgev	*iev = d;
717 	struct imsgbuf	*ibuf = &iev->ibuf;
718 	struct imsg	 imsg;
719 	struct req	*req;
720 	struct get_req	 r;
721 	ssize_t		 n;
722 	int		 certok;
723 
724 	if (event & EV_READ) {
725 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
726 			err(1, "imsg_read");
727 		if (n == 0)
728 			err(1, "connection closed");
729 	}
730 	if (event & EV_WRITE) {
731 		if ((n = msgbuf_write(&ibuf->w)) == -1 && errno != EAGAIN)
732 			err(1, "msgbuf_write");
733 		if (n == 0)
734 			err(1, "connection closed");
735 	}
736 
737 	for (;;) {
738 		if ((n = imsg_get(ibuf, &imsg)) == -1)
739 			err(1, "imsg_get");
740 		if (n == 0)
741 			break;
742 		switch (imsg_get_type(&imsg)) {
743 		case IMSG_GET:
744 			if (imsg_get_data(&imsg, &r, sizeof(r)) == -1 ||
745 			    r.host[sizeof(r.host) - 1] != '\0' ||
746 			    r.port[sizeof(r.port) - 1] != '\0' ||
747 			    r.req[sizeof(r.req) - 1] != '\0')
748 				die();
749 			if (r.proto != PROTO_FINGER &&
750 			    r.proto != PROTO_GEMINI &&
751 			    r.proto != PROTO_GOPHER)
752 				die();
753 
754 			if ((req = calloc(1, sizeof(*req))) == NULL)
755 				die();
756 
757 			req->ccert_fd = -1;
758 			req->id = imsg_get_id(&imsg);
759 			TAILQ_INSERT_HEAD(&reqhead, req, reqs);
760 
761 			if ((req->host = strdup(r.host)) == NULL)
762 				die();
763 			if ((req->port = strdup(r.port)) == NULL)
764 				die();
765 			if ((req->req = strdup(r.req)) == NULL)
766 				die();
767 			if (load_cert(&imsg, req) == -1)
768 				die();
769 
770 			req->len = strlen(req->req);
771 
772 			req->proto = r.proto;
773 			conn_towards(req);
774 			break;
775 
776 		case IMSG_CERT_STATUS:
777 			if ((req = req_by_id(imsg_get_id(&imsg))) == NULL)
778 				break;
779 
780 			if (imsg_get_data(&imsg, &certok, sizeof(certok)) ==
781 			    -1)
782 				die();
783 			if (certok)
784 				net_ready(req);
785 			else
786 				close_conn(0, 0, req);
787 			break;
788 
789 		case IMSG_PROCEED:
790 			if ((req = req_by_id(imsg_get_id(&imsg))) == NULL)
791 				break;
792 			bufferevent_enable(req->bev, EV_READ);
793 			break;
794 
795 		case IMSG_STOP:
796 			if ((req = req_by_id(imsg_get_id(&imsg))) == NULL)
797 				break;
798 			close_conn(0, 0, req);
799 			break;
800 
801 		case IMSG_QUIT:
802 			event_loopbreak();
803 			imsg_free(&imsg);
804 			return;
805 
806 		default:
807 			errx(1, "got unknown imsg %d", imsg_get_type(&imsg));
808 		}
809 
810 		imsg_free(&imsg);
811 	}
812 
813 	imsg_event_add(iev);
814 }
815 
816 static int
817 net_send_ui(int type, uint32_t peerid, const void *data,
818     uint16_t datalen)
819 {
820 	return imsg_compose_event(iev_ui, type, peerid, 0, -1,
821 	    data, datalen);
822 }
823 
824 int
825 net_main(void)
826 {
827 	setproctitle("net");
828 
829 	TAILQ_INIT(&reqhead);
830 
831 	event_init();
832 
833 	/* Setup pipe and event handler to the main process */
834 	if ((iev_ui = malloc(sizeof(*iev_ui))) == NULL)
835 		die();
836 	imsg_init(&iev_ui->ibuf, 3);
837 	iev_ui->handler = handle_dispatch_imsg;
838 	iev_ui->events = EV_READ;
839 	event_set(&iev_ui->ev, iev_ui->ibuf.fd, iev_ui->events,
840 	    iev_ui->handler, iev_ui);
841 	event_add(&iev_ui->ev, NULL);
842 
843 	sandbox_net_process();
844 
845 	event_dispatch();
846 
847 	msgbuf_clear(&iev_ui->ibuf.w);
848 	close(iev_ui->ibuf.fd);
849 	free(iev_ui);
850 
851 	return 0;
852 }