1 /* SPDX-License-Identifier: BSD-2-Clause */ 2 /* 3 * dhcpcd - DHCP client daemon 4 * Copyright (c) 2006-2023 Roy Marples <roy@marples.name> 5 * All rights reserved 6 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/socket.h> 30 #include <sys/stat.h> 31 #include <sys/uio.h> 32 #include <sys/un.h> 33 34 #include <errno.h> 35 #include <fcntl.h> 36 #include <stdio.h> 37 #include <stdlib.h> 38 #include <string.h> 39 #include <time.h> 40 #include <unistd.h> 41 42 #include "config.h" 43 #include "common.h" 44 #include "dhcpcd.h" 45 #include "control.h" 46 #include "eloop.h" 47 #include "if.h" 48 #include "logerr.h" 49 #include "privsep.h" 50 51 #ifndef SUN_LEN 52 #define SUN_LEN(su) \ 53 (sizeof(*(su)) - sizeof((su)->sun_path) + strlen((su)->sun_path)) 54 #endif 55 56 static void control_handle_data(void *, unsigned short); 57 58 static void 59 control_queue_free(struct fd_list *fd) 60 { 61 struct fd_data *fdp; 62 63 while ((fdp = TAILQ_FIRST(&fd->queue))) { 64 TAILQ_REMOVE(&fd->queue, fdp, next); 65 if (fdp->data_size != 0) 66 free(fdp->data); 67 free(fdp); 68 } 69 70 #ifdef CTL_FREE_LIST 71 while ((fdp = TAILQ_FIRST(&fd->free_queue))) { 72 TAILQ_REMOVE(&fd->free_queue, fdp, next); 73 if (fdp->data_size != 0) 74 free(fdp->data); 75 free(fdp); 76 } 77 #endif 78 } 79 80 void 81 control_free(struct fd_list *fd) 82 { 83 84 #ifdef PRIVSEP 85 if (fd->ctx->ps_control_client == fd) 86 fd->ctx->ps_control_client = NULL; 87 #endif 88 89 eloop_event_delete(fd->ctx->eloop, fd->fd); 90 close(fd->fd); 91 TAILQ_REMOVE(&fd->ctx->control_fds, fd, next); 92 control_queue_free(fd); 93 free(fd); 94 } 95 96 static void 97 control_hangup(struct fd_list *fd) 98 { 99 100 #ifdef PRIVSEP 101 if (IN_PRIVSEP(fd->ctx)) { 102 if (ps_ctl_sendeof(fd) == -1) 103 logerr(__func__); 104 } 105 #endif 106 control_free(fd); 107 } 108 109 static void 110 control_handle_read(struct fd_list *fd) 111 { 112 char buffer[1024]; 113 ssize_t bytes; 114 115 bytes = read(fd->fd, buffer, sizeof(buffer) - 1); 116 if (bytes == -1) { 117 logerr(__func__); 118 control_hangup(fd); 119 return; 120 } 121 122 #ifdef PRIVSEP 123 if (IN_PRIVSEP(fd->ctx)) { 124 ssize_t err; 125 126 fd->flags |= FD_SENDLEN; 127 err = ps_ctl_handleargs(fd, buffer, (size_t)bytes); 128 fd->flags &= ~FD_SENDLEN; 129 if (err == -1) { 130 logerr(__func__); 131 return; 132 } 133 if (err == 1 && 134 ps_ctl_sendargs(fd, buffer, (size_t)bytes) == -1) { 135 logerr(__func__); 136 control_free(fd); 137 } 138 return; 139 } 140 #endif 141 142 control_recvdata(fd, buffer, (size_t)bytes); 143 } 144 145 static void 146 control_handle_write(struct fd_list *fd) 147 { 148 struct iovec iov[2]; 149 int iov_len; 150 struct fd_data *data; 151 152 data = TAILQ_FIRST(&fd->queue); 153 154 if (data->data_flags & FD_SENDLEN) { 155 iov[0].iov_base = &data->data_len; 156 iov[0].iov_len = sizeof(size_t); 157 iov[1].iov_base = data->data; 158 iov[1].iov_len = data->data_len; 159 iov_len = 2; 160 } else { 161 iov[0].iov_base = data->data; 162 iov[0].iov_len = data->data_len; 163 iov_len = 1; 164 } 165 166 if (writev(fd->fd, iov, iov_len) == -1) { 167 if (errno != EPIPE && errno != ENOTCONN) { 168 // We don't get ELE_HANGUP for some reason 169 logerr("%s: write", __func__); 170 } 171 control_hangup(fd); 172 return; 173 } 174 175 TAILQ_REMOVE(&fd->queue, data, next); 176 #ifdef CTL_FREE_LIST 177 TAILQ_INSERT_TAIL(&fd->free_queue, data, next); 178 #else 179 if (data->data_size != 0) 180 free(data->data); 181 free(data); 182 #endif 183 184 if (TAILQ_FIRST(&fd->queue) != NULL) 185 return; 186 187 #ifdef PRIVSEP 188 if (IN_PRIVSEP_SE(fd->ctx) && !(fd->flags & FD_LISTEN)) { 189 if (ps_ctl_sendeof(fd) == -1) 190 logerr(__func__); 191 } 192 #endif 193 194 /* Done sending data, stop watching write to fd */ 195 if (eloop_event_add(fd->ctx->eloop, fd->fd, ELE_READ, 196 control_handle_data, fd) == -1) 197 logerr("%s: eloop_event_add", __func__); 198 } 199 200 201 static void 202 control_handle_data(void *arg, unsigned short events) 203 { 204 struct fd_list *fd = arg; 205 206 if (!(events & (ELE_READ | ELE_WRITE | ELE_HANGUP))) 207 logerrx("%s: unexpected event 0x%04x", __func__, events); 208 209 if (events & ELE_WRITE && !(events & ELE_HANGUP)) 210 control_handle_write(fd); 211 if (events & ELE_READ) 212 control_handle_read(fd); 213 if (events & ELE_HANGUP) 214 control_hangup(fd); 215 } 216 217 void 218 control_recvdata(struct fd_list *fd, char *data, size_t len) 219 { 220 char *p = data, *e; 221 char *argvp[255], **ap; 222 int argc; 223 224 /* Each command is \n terminated 225 * Each argument is NULL separated */ 226 while (len != 0) { 227 argc = 0; 228 ap = argvp; 229 while (len != 0) { 230 if (*p == '\0') { 231 p++; 232 len--; 233 continue; 234 } 235 e = memchr(p, '\0', len); 236 if (e == NULL) { 237 errno = EINVAL; 238 logerrx("%s: no terminator", __func__); 239 return; 240 } 241 if ((size_t)argc >= sizeof(argvp) / sizeof(argvp[0])) { 242 errno = ENOBUFS; 243 logerrx("%s: no arg buffer", __func__); 244 return; 245 } 246 *ap++ = p; 247 argc++; 248 e++; 249 len -= (size_t)(e - p); 250 p = e; 251 e--; 252 if (*(--e) == '\n') { 253 *e = '\0'; 254 break; 255 } 256 } 257 if (argc == 0) { 258 logerrx("%s: no args", __func__); 259 continue; 260 } 261 *ap = NULL; 262 if (dhcpcd_handleargs(fd->ctx, fd, argc, argvp) == -1) { 263 logerr(__func__); 264 if (errno != EINTR && errno != EAGAIN) { 265 control_free(fd); 266 return; 267 } 268 } 269 } 270 } 271 272 struct fd_list * 273 control_new(struct dhcpcd_ctx *ctx, int fd, unsigned int flags) 274 { 275 struct fd_list *l; 276 277 l = malloc(sizeof(*l)); 278 if (l == NULL) 279 return NULL; 280 281 l->ctx = ctx; 282 l->fd = fd; 283 l->flags = flags; 284 TAILQ_INIT(&l->queue); 285 #ifdef CTL_FREE_LIST 286 TAILQ_INIT(&l->free_queue); 287 #endif 288 TAILQ_INSERT_TAIL(&ctx->control_fds, l, next); 289 return l; 290 } 291 292 static void 293 control_handle1(struct dhcpcd_ctx *ctx, int lfd, unsigned int fd_flags, 294 unsigned short events) 295 { 296 struct sockaddr_un run; 297 socklen_t len; 298 struct fd_list *l; 299 int fd, flags; 300 301 if (events != ELE_READ) 302 logerrx("%s: unexpected event 0x%04x", __func__, events); 303 304 len = sizeof(run); 305 if ((fd = accept(lfd, (struct sockaddr *)&run, &len)) == -1) 306 goto error; 307 if ((flags = fcntl(fd, F_GETFD, 0)) == -1 || 308 fcntl(fd, F_SETFD, flags | FD_CLOEXEC) == -1) 309 goto error; 310 if ((flags = fcntl(fd, F_GETFL, 0)) == -1 || 311 fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) 312 goto error; 313 314 #ifdef PRIVSEP 315 if (IN_PRIVSEP(ctx) && !IN_PRIVSEP_SE(ctx)) 316 ; 317 else 318 #endif 319 fd_flags |= FD_SENDLEN; 320 321 l = control_new(ctx, fd, fd_flags); 322 if (l == NULL) 323 goto error; 324 325 if (eloop_event_add(ctx->eloop, l->fd, ELE_READ, 326 control_handle_data, l) == -1) 327 logerr("%s: eloop_event_add", __func__); 328 return; 329 330 error: 331 logerr(__func__); 332 if (fd != -1) 333 close(fd); 334 } 335 336 static void 337 control_handle(void *arg, unsigned short events) 338 { 339 struct dhcpcd_ctx *ctx = arg; 340 341 control_handle1(ctx, ctx->control_fd, 0, events); 342 } 343 344 static void 345 control_handle_unpriv(void *arg, unsigned short events) 346 { 347 struct dhcpcd_ctx *ctx = arg; 348 349 control_handle1(ctx, ctx->control_unpriv_fd, FD_UNPRIV, events); 350 } 351 352 static int 353 make_path(char *path, size_t len, const char *ifname, sa_family_t family, 354 bool unpriv) 355 { 356 const char *per; 357 const char *sunpriv; 358 359 switch(family) { 360 case AF_INET: 361 per = "-4"; 362 break; 363 case AF_INET6: 364 per = "-6"; 365 break; 366 default: 367 per = ""; 368 break; 369 } 370 if (unpriv) 371 sunpriv = ifname ? ".unpriv" : "unpriv."; 372 else 373 sunpriv = ""; 374 return snprintf(path, len, CONTROLSOCKET, 375 ifname ? ifname : "", ifname ? per : "", 376 sunpriv, ifname ? "." : ""); 377 } 378 379 static int 380 make_sock(struct sockaddr_un *sa, const char *ifname, sa_family_t family, 381 bool unpriv) 382 { 383 int fd; 384 385 if ((fd = xsocket(AF_UNIX, SOCK_STREAM | SOCK_CXNB, 0)) == -1) 386 return -1; 387 memset(sa, 0, sizeof(*sa)); 388 sa->sun_family = AF_UNIX; 389 make_path(sa->sun_path, sizeof(sa->sun_path), ifname, family, unpriv); 390 return fd; 391 } 392 393 #define S_PRIV (S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP) 394 #define S_UNPRIV (S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH) 395 396 static int 397 control_start1(struct dhcpcd_ctx *ctx, const char *ifname, sa_family_t family, 398 mode_t fmode) 399 { 400 struct sockaddr_un sa; 401 int fd; 402 socklen_t len; 403 404 fd = make_sock(&sa, ifname, family, (fmode & S_UNPRIV) == S_UNPRIV); 405 if (fd == -1) 406 return -1; 407 408 len = (socklen_t)SUN_LEN(&sa); 409 unlink(sa.sun_path); 410 if (bind(fd, (struct sockaddr *)&sa, len) == -1 || 411 chmod(sa.sun_path, fmode) == -1 || 412 (ctx->control_group && 413 chown(sa.sun_path, geteuid(), ctx->control_group) == -1) || 414 listen(fd, sizeof(ctx->control_fds)) == -1) 415 { 416 close(fd); 417 unlink(sa.sun_path); 418 return -1; 419 } 420 421 #ifdef PRIVSEP_RIGHTS 422 if (IN_PRIVSEP(ctx) && ps_rights_limit_fd_fctnl(fd) == -1) { 423 close(fd); 424 unlink(sa.sun_path); 425 return -1; 426 } 427 #endif 428 429 if ((fmode & S_UNPRIV) == S_UNPRIV) 430 strlcpy(ctx->control_sock_unpriv, sa.sun_path, 431 sizeof(ctx->control_sock_unpriv)); 432 else 433 strlcpy(ctx->control_sock, sa.sun_path, 434 sizeof(ctx->control_sock)); 435 return fd; 436 } 437 438 int 439 control_start(struct dhcpcd_ctx *ctx, const char *ifname, sa_family_t family) 440 { 441 int fd; 442 443 #ifdef PRIVSEP 444 if (IN_PRIVSEP_SE(ctx)) { 445 make_path(ctx->control_sock, sizeof(ctx->control_sock), 446 ifname, family, false); 447 make_path(ctx->control_sock_unpriv, 448 sizeof(ctx->control_sock_unpriv), 449 ifname, family, true); 450 return 0; 451 } 452 #endif 453 454 if ((fd = control_start1(ctx, ifname, family, S_PRIV)) == -1) 455 return -1; 456 457 ctx->control_fd = fd; 458 if (eloop_event_add(ctx->eloop, fd, ELE_READ, 459 control_handle, ctx) == -1) 460 logerr("%s: eloop_event_add", __func__); 461 462 if ((fd = control_start1(ctx, ifname, family, S_UNPRIV)) != -1) { 463 ctx->control_unpriv_fd = fd; 464 if (eloop_event_add(ctx->eloop, fd, ELE_READ, 465 control_handle_unpriv, ctx) == -1) 466 logerr("%s: eloop_event_add", __func__); 467 } 468 return ctx->control_fd; 469 } 470 471 static int 472 control_unlink(struct dhcpcd_ctx *ctx, const char *file) 473 { 474 int retval = 0; 475 476 errno = 0; 477 #ifdef PRIVSEP 478 if (IN_PRIVSEP(ctx)) 479 retval = (int)ps_root_unlink(ctx, file); 480 else 481 #else 482 UNUSED(ctx); 483 #endif 484 retval = unlink(file); 485 486 return retval == -1 && errno != ENOENT ? -1 : 0; 487 } 488 489 int 490 control_stop(struct dhcpcd_ctx *ctx) 491 { 492 int retval = 0; 493 struct fd_list *l; 494 495 while ((l = TAILQ_FIRST(&ctx->control_fds)) != NULL) { 496 control_free(l); 497 } 498 499 #ifdef PRIVSEP 500 if (IN_PRIVSEP_SE(ctx)) { 501 if (ctx->control_sock[0] != '\0' && 502 ps_root_unlink(ctx, ctx->control_sock) == -1) 503 retval = -1; 504 if (ctx->control_sock_unpriv[0] != '\0' && 505 ps_root_unlink(ctx, ctx->control_sock_unpriv) == -1) 506 retval = -1; 507 return retval; 508 } else if (ctx->options & DHCPCD_FORKED) 509 return retval; 510 #endif 511 512 if (ctx->control_fd != -1) { 513 eloop_event_delete(ctx->eloop, ctx->control_fd); 514 close(ctx->control_fd); 515 ctx->control_fd = -1; 516 if (control_unlink(ctx, ctx->control_sock) == -1) 517 retval = -1; 518 } 519 520 if (ctx->control_unpriv_fd != -1) { 521 eloop_event_delete(ctx->eloop, ctx->control_unpriv_fd); 522 close(ctx->control_unpriv_fd); 523 ctx->control_unpriv_fd = -1; 524 if (control_unlink(ctx, ctx->control_sock_unpriv) == -1) 525 retval = -1; 526 } 527 528 return retval; 529 } 530 531 int 532 control_open(const char *ifname, sa_family_t family, bool unpriv) 533 { 534 struct sockaddr_un sa; 535 int fd; 536 537 if ((fd = make_sock(&sa, ifname, family, unpriv)) != -1) { 538 socklen_t len; 539 540 len = (socklen_t)SUN_LEN(&sa); 541 if (connect(fd, (struct sockaddr *)&sa, len) == -1) { 542 close(fd); 543 fd = -1; 544 } 545 } 546 return fd; 547 } 548 549 ssize_t 550 control_send(struct dhcpcd_ctx *ctx, int argc, char * const *argv) 551 { 552 char buffer[1024]; 553 int i; 554 size_t len, l; 555 556 if (argc > 255) { 557 errno = ENOBUFS; 558 return -1; 559 } 560 len = 0; 561 for (i = 0; i < argc; i++) { 562 l = strlen(argv[i]) + 1; 563 if (len + l > sizeof(buffer)) { 564 errno = ENOBUFS; 565 return -1; 566 } 567 memcpy(buffer + len, argv[i], l); 568 len += l; 569 } 570 return write(ctx->control_fd, buffer, len); 571 } 572 573 int 574 control_queue(struct fd_list *fd, void *data, size_t data_len) 575 { 576 struct fd_data *d; 577 unsigned short events; 578 579 if (data_len == 0) { 580 errno = EINVAL; 581 return -1; 582 } 583 584 #ifdef CTL_FREE_LIST 585 struct fd_data *df; 586 587 d = NULL; 588 TAILQ_FOREACH(df, &fd->free_queue, next) { 589 if (d == NULL || d->data_size < df->data_size) { 590 d = df; 591 if (d->data_size <= data_len) 592 break; 593 } 594 } 595 if (d != NULL) 596 TAILQ_REMOVE(&fd->free_queue, d, next); 597 else 598 #endif 599 { 600 d = calloc(1, sizeof(*d)); 601 if (d == NULL) 602 return -1; 603 } 604 605 if (d->data_size == 0) 606 d->data = NULL; 607 if (d->data_size < data_len) { 608 void *nbuf = realloc(d->data, data_len); 609 if (nbuf == NULL) { 610 free(d->data); 611 free(d); 612 return -1; 613 } 614 d->data = nbuf; 615 d->data_size = data_len; 616 } 617 memcpy(d->data, data, data_len); 618 d->data_len = data_len; 619 d->data_flags = fd->flags & FD_SENDLEN; 620 621 TAILQ_INSERT_TAIL(&fd->queue, d, next); 622 events = ELE_WRITE; 623 if (fd->flags & FD_LISTEN) 624 events |= ELE_READ; 625 return eloop_event_add(fd->ctx->eloop, fd->fd, events, 626 control_handle_data, fd); 627 } 628