1 /* SPDX-License-Identifier: BSD-2-Clause */ 2 /* 3 * dhcpcd - DHCP client daemon 4 * Copyright (c) 2006-2021 Roy Marples <roy@marples.name> 5 * All rights reserved 6 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/socket.h> 30 #include <sys/stat.h> 31 #include <sys/uio.h> 32 #include <sys/un.h> 33 34 #include <errno.h> 35 #include <fcntl.h> 36 #include <stdio.h> 37 #include <stdlib.h> 38 #include <string.h> 39 #include <time.h> 40 #include <unistd.h> 41 42 #include "config.h" 43 #include "common.h" 44 #include "dhcpcd.h" 45 #include "control.h" 46 #include "eloop.h" 47 #include "if.h" 48 #include "logerr.h" 49 #include "privsep.h" 50 51 #ifndef SUN_LEN 52 #define SUN_LEN(su) \ 53 (sizeof(*(su)) - sizeof((su)->sun_path) + strlen((su)->sun_path)) 54 #endif 55 56 static void 57 control_queue_free(struct fd_list *fd) 58 { 59 struct fd_data *fdp; 60 61 while ((fdp = TAILQ_FIRST(&fd->queue))) { 62 TAILQ_REMOVE(&fd->queue, fdp, next); 63 if (fdp->data_size != 0) 64 free(fdp->data); 65 free(fdp); 66 } 67 68 #ifdef CTL_FREE_LIST 69 while ((fdp = TAILQ_FIRST(&fd->free_queue))) { 70 TAILQ_REMOVE(&fd->free_queue, fdp, next); 71 if (fdp->data_size != 0) 72 free(fdp->data); 73 free(fdp); 74 } 75 #endif 76 } 77 78 void 79 control_free(struct fd_list *fd) 80 { 81 82 #ifdef PRIVSEP 83 if (fd->ctx->ps_control_client == fd) 84 fd->ctx->ps_control_client = NULL; 85 #endif 86 87 if (eloop_event_remove_writecb(fd->ctx->eloop, fd->fd) == -1) 88 logerr(__func__); 89 TAILQ_REMOVE(&fd->ctx->control_fds, fd, next); 90 control_queue_free(fd); 91 free(fd); 92 } 93 94 void 95 control_delete(struct fd_list *fd) 96 { 97 98 #ifdef PRIVSEP 99 if (IN_PRIVSEP_SE(fd->ctx)) 100 return; 101 #endif 102 103 eloop_event_delete(fd->ctx->eloop, fd->fd); 104 close(fd->fd); 105 control_free(fd); 106 } 107 108 static void 109 control_handle_data(void *arg) 110 { 111 struct fd_list *fd = arg; 112 char buffer[1024]; 113 ssize_t bytes; 114 115 bytes = read(fd->fd, buffer, sizeof(buffer) - 1); 116 117 if (bytes == -1 || bytes == 0) { 118 /* Control was closed or there was an error. 119 * Remove it from our list. */ 120 control_delete(fd); 121 return; 122 } 123 124 #ifdef PRIVSEP 125 if (IN_PRIVSEP(fd->ctx)) { 126 ssize_t err; 127 128 fd->flags |= FD_SENDLEN; 129 err = ps_ctl_handleargs(fd, buffer, (size_t)bytes); 130 fd->flags &= ~FD_SENDLEN; 131 if (err == -1) { 132 logerr(__func__); 133 return; 134 } 135 if (err == 1 && 136 ps_ctl_sendargs(fd, buffer, (size_t)bytes) == -1) { 137 logerr(__func__); 138 control_delete(fd); 139 } 140 return; 141 } 142 #endif 143 144 control_recvdata(fd, buffer, (size_t)bytes); 145 } 146 147 void 148 control_recvdata(struct fd_list *fd, char *data, size_t len) 149 { 150 char *p = data, *e; 151 char *argvp[255], **ap; 152 int argc; 153 154 /* Each command is \n terminated 155 * Each argument is NULL separated */ 156 while (len != 0) { 157 argc = 0; 158 ap = argvp; 159 while (len != 0) { 160 if (*p == '\0') { 161 p++; 162 len--; 163 continue; 164 } 165 e = memchr(p, '\0', len); 166 if (e == NULL) { 167 errno = EINVAL; 168 logerrx("%s: no terminator", __func__); 169 return; 170 } 171 if ((size_t)argc >= sizeof(argvp) / sizeof(argvp[0])) { 172 errno = ENOBUFS; 173 logerrx("%s: no arg buffer", __func__); 174 return; 175 } 176 *ap++ = p; 177 argc++; 178 e++; 179 len -= (size_t)(e - p); 180 p = e; 181 e--; 182 if (*(--e) == '\n') { 183 *e = '\0'; 184 break; 185 } 186 } 187 if (argc == 0) { 188 logerrx("%s: no args", __func__); 189 continue; 190 } 191 *ap = NULL; 192 if (dhcpcd_handleargs(fd->ctx, fd, argc, argvp) == -1) { 193 logerr(__func__); 194 if (errno != EINTR && errno != EAGAIN) { 195 control_delete(fd); 196 return; 197 } 198 } 199 } 200 } 201 202 struct fd_list * 203 control_new(struct dhcpcd_ctx *ctx, int fd, unsigned int flags) 204 { 205 struct fd_list *l; 206 207 l = malloc(sizeof(*l)); 208 if (l == NULL) 209 return NULL; 210 211 l->ctx = ctx; 212 l->fd = fd; 213 l->flags = flags; 214 TAILQ_INIT(&l->queue); 215 #ifdef CTL_FREE_LIST 216 TAILQ_INIT(&l->free_queue); 217 #endif 218 TAILQ_INSERT_TAIL(&ctx->control_fds, l, next); 219 return l; 220 } 221 222 static void 223 control_handle1(struct dhcpcd_ctx *ctx, int lfd, unsigned int fd_flags) 224 { 225 struct sockaddr_un run; 226 socklen_t len; 227 struct fd_list *l; 228 int fd, flags; 229 230 len = sizeof(run); 231 if ((fd = accept(lfd, (struct sockaddr *)&run, &len)) == -1) 232 goto error; 233 if ((flags = fcntl(fd, F_GETFD, 0)) == -1 || 234 fcntl(fd, F_SETFD, flags | FD_CLOEXEC) == -1) 235 goto error; 236 if ((flags = fcntl(fd, F_GETFL, 0)) == -1 || 237 fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) 238 goto error; 239 240 #ifdef PRIVSEP 241 if (IN_PRIVSEP(ctx) && !IN_PRIVSEP_SE(ctx)) 242 ; 243 else 244 #endif 245 fd_flags |= FD_SENDLEN; 246 247 l = control_new(ctx, fd, fd_flags); 248 if (l == NULL) 249 goto error; 250 251 if (eloop_event_add(ctx->eloop, l->fd, control_handle_data, l) == -1) 252 logerr(__func__); 253 return; 254 255 error: 256 logerr(__func__); 257 if (fd != -1) 258 close(fd); 259 } 260 261 static void 262 control_handle(void *arg) 263 { 264 struct dhcpcd_ctx *ctx = arg; 265 266 control_handle1(ctx, ctx->control_fd, 0); 267 } 268 269 static void 270 control_handle_unpriv(void *arg) 271 { 272 struct dhcpcd_ctx *ctx = arg; 273 274 control_handle1(ctx, ctx->control_unpriv_fd, FD_UNPRIV); 275 } 276 277 static int 278 make_path(char *path, size_t len, const char *ifname, sa_family_t family, 279 bool unpriv) 280 { 281 const char *per; 282 const char *sunpriv; 283 284 switch(family) { 285 case AF_INET: 286 per = "-4"; 287 break; 288 case AF_INET6: 289 per = "-6"; 290 break; 291 default: 292 per = ""; 293 break; 294 } 295 if (unpriv) 296 sunpriv = ifname ? ".unpriv" : "unpriv."; 297 else 298 sunpriv = ""; 299 return snprintf(path, len, CONTROLSOCKET, 300 ifname ? ifname : "", ifname ? per : "", 301 sunpriv, ifname ? "." : ""); 302 } 303 304 static int 305 make_sock(struct sockaddr_un *sa, const char *ifname, sa_family_t family, 306 bool unpriv) 307 { 308 int fd; 309 310 if ((fd = xsocket(AF_UNIX, SOCK_STREAM | SOCK_CXNB, 0)) == -1) 311 return -1; 312 memset(sa, 0, sizeof(*sa)); 313 sa->sun_family = AF_UNIX; 314 make_path(sa->sun_path, sizeof(sa->sun_path), ifname, family, unpriv); 315 return fd; 316 } 317 318 #define S_PRIV (S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP) 319 #define S_UNPRIV (S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH) 320 321 static int 322 control_start1(struct dhcpcd_ctx *ctx, const char *ifname, sa_family_t family, 323 mode_t fmode) 324 { 325 struct sockaddr_un sa; 326 int fd; 327 socklen_t len; 328 329 fd = make_sock(&sa, ifname, family, (fmode & S_UNPRIV) == S_UNPRIV); 330 if (fd == -1) 331 return -1; 332 333 len = (socklen_t)SUN_LEN(&sa); 334 unlink(sa.sun_path); 335 if (bind(fd, (struct sockaddr *)&sa, len) == -1 || 336 chmod(sa.sun_path, fmode) == -1 || 337 (ctx->control_group && 338 chown(sa.sun_path, geteuid(), ctx->control_group) == -1) || 339 listen(fd, sizeof(ctx->control_fds)) == -1) 340 { 341 close(fd); 342 unlink(sa.sun_path); 343 return -1; 344 } 345 346 #ifdef PRIVSEP_RIGHTS 347 if (IN_PRIVSEP(ctx) && ps_rights_limit_fd_fctnl(fd) == -1) { 348 close(fd); 349 unlink(sa.sun_path); 350 return -1; 351 } 352 #endif 353 354 if ((fmode & S_UNPRIV) == S_UNPRIV) 355 strlcpy(ctx->control_sock_unpriv, sa.sun_path, 356 sizeof(ctx->control_sock_unpriv)); 357 else 358 strlcpy(ctx->control_sock, sa.sun_path, 359 sizeof(ctx->control_sock)); 360 return fd; 361 } 362 363 int 364 control_start(struct dhcpcd_ctx *ctx, const char *ifname, sa_family_t family) 365 { 366 int fd; 367 368 #ifdef PRIVSEP 369 if (IN_PRIVSEP_SE(ctx)) { 370 make_path(ctx->control_sock, sizeof(ctx->control_sock), 371 ifname, family, false); 372 make_path(ctx->control_sock_unpriv, 373 sizeof(ctx->control_sock_unpriv), 374 ifname, family, true); 375 return 0; 376 } 377 #endif 378 379 if ((fd = control_start1(ctx, ifname, family, S_PRIV)) == -1) 380 return -1; 381 382 ctx->control_fd = fd; 383 eloop_event_add(ctx->eloop, fd, control_handle, ctx); 384 385 if ((fd = control_start1(ctx, ifname, family, S_UNPRIV)) != -1) { 386 ctx->control_unpriv_fd = fd; 387 eloop_event_add(ctx->eloop, fd, control_handle_unpriv, ctx); 388 } 389 return ctx->control_fd; 390 } 391 392 static int 393 control_unlink(struct dhcpcd_ctx *ctx, const char *file) 394 { 395 int retval = 0; 396 397 errno = 0; 398 #ifdef PRIVSEP 399 if (IN_PRIVSEP(ctx)) 400 retval = (int)ps_root_unlink(ctx, file); 401 else 402 #else 403 UNUSED(ctx); 404 #endif 405 retval = unlink(file); 406 407 return retval == -1 && errno != ENOENT ? -1 : 0; 408 } 409 410 int 411 control_stop(struct dhcpcd_ctx *ctx) 412 { 413 int retval = 0; 414 struct fd_list *l; 415 416 while ((l = TAILQ_FIRST(&ctx->control_fds)) != NULL) { 417 control_free(l); 418 } 419 420 #ifdef PRIVSEP 421 if (IN_PRIVSEP_SE(ctx)) { 422 if (ps_root_unlink(ctx, ctx->control_sock) == -1) 423 retval = -1; 424 if (ps_root_unlink(ctx, ctx->control_sock_unpriv) == -1) 425 retval = -1; 426 return retval; 427 } else if (ctx->options & DHCPCD_FORKED) 428 return retval; 429 #endif 430 431 if (ctx->control_fd != -1) { 432 eloop_event_delete(ctx->eloop, ctx->control_fd); 433 close(ctx->control_fd); 434 ctx->control_fd = -1; 435 if (control_unlink(ctx, ctx->control_sock) == -1) 436 retval = -1; 437 } 438 439 if (ctx->control_unpriv_fd != -1) { 440 eloop_event_delete(ctx->eloop, ctx->control_unpriv_fd); 441 close(ctx->control_unpriv_fd); 442 ctx->control_unpriv_fd = -1; 443 if (control_unlink(ctx, ctx->control_sock_unpriv) == -1) 444 retval = -1; 445 } 446 447 return retval; 448 } 449 450 int 451 control_open(const char *ifname, sa_family_t family, bool unpriv) 452 { 453 struct sockaddr_un sa; 454 int fd; 455 456 if ((fd = make_sock(&sa, ifname, family, unpriv)) != -1) { 457 socklen_t len; 458 459 len = (socklen_t)SUN_LEN(&sa); 460 if (connect(fd, (struct sockaddr *)&sa, len) == -1) { 461 close(fd); 462 fd = -1; 463 } 464 } 465 return fd; 466 } 467 468 ssize_t 469 control_send(struct dhcpcd_ctx *ctx, int argc, char * const *argv) 470 { 471 char buffer[1024]; 472 int i; 473 size_t len, l; 474 475 if (argc > 255) { 476 errno = ENOBUFS; 477 return -1; 478 } 479 len = 0; 480 for (i = 0; i < argc; i++) { 481 l = strlen(argv[i]) + 1; 482 if (len + l > sizeof(buffer)) { 483 errno = ENOBUFS; 484 return -1; 485 } 486 memcpy(buffer + len, argv[i], l); 487 len += l; 488 } 489 return write(ctx->control_fd, buffer, len); 490 } 491 492 static void 493 control_writeone(void *arg) 494 { 495 struct fd_list *fd; 496 struct iovec iov[2]; 497 int iov_len; 498 struct fd_data *data; 499 500 fd = arg; 501 data = TAILQ_FIRST(&fd->queue); 502 503 if (data->data_flags & FD_SENDLEN) { 504 iov[0].iov_base = &data->data_len; 505 iov[0].iov_len = sizeof(size_t); 506 iov[1].iov_base = data->data; 507 iov[1].iov_len = data->data_len; 508 iov_len = 2; 509 } else { 510 iov[0].iov_base = data->data; 511 iov[0].iov_len = data->data_len; 512 iov_len = 1; 513 } 514 515 if (writev(fd->fd, iov, iov_len) == -1) { 516 logerr("%s: write", __func__); 517 control_delete(fd); 518 return; 519 } 520 521 TAILQ_REMOVE(&fd->queue, data, next); 522 #ifdef CTL_FREE_LIST 523 TAILQ_INSERT_TAIL(&fd->free_queue, data, next); 524 #else 525 if (data->data_size != 0) 526 free(data->data); 527 free(data); 528 #endif 529 530 if (TAILQ_FIRST(&fd->queue) != NULL) 531 return; 532 533 if (eloop_event_remove_writecb(fd->ctx->eloop, fd->fd) == -1) 534 logerr(__func__); 535 #ifdef PRIVSEP 536 if (IN_PRIVSEP_SE(fd->ctx) && !(fd->flags & FD_LISTEN)) { 537 if (ps_ctl_sendeof(fd) == -1) 538 logerr(__func__); 539 control_free(fd); 540 } 541 #endif 542 } 543 544 int 545 control_queue(struct fd_list *fd, void *data, size_t data_len) 546 { 547 struct fd_data *d; 548 549 if (data_len == 0) { 550 errno = EINVAL; 551 return -1; 552 } 553 554 #ifdef CTL_FREE_LIST 555 struct fd_data *df; 556 557 d = NULL; 558 TAILQ_FOREACH(df, &fd->free_queue, next) { 559 if (d == NULL || d->data_size < df->data_size) { 560 d = df; 561 if (d->data_size <= data_len) 562 break; 563 } 564 } 565 if (d != NULL) 566 TAILQ_REMOVE(&fd->free_queue, d, next); 567 else 568 #endif 569 { 570 d = calloc(1, sizeof(*d)); 571 if (d == NULL) 572 return -1; 573 } 574 575 if (d->data_size == 0) 576 d->data = NULL; 577 if (d->data_size < data_len) { 578 void *nbuf = realloc(d->data, data_len); 579 if (nbuf == NULL) { 580 free(d->data); 581 free(d); 582 return -1; 583 } 584 d->data = nbuf; 585 d->data_size = data_len; 586 } 587 memcpy(d->data, data, data_len); 588 d->data_len = data_len; 589 d->data_flags = fd->flags & FD_SENDLEN; 590 591 TAILQ_INSERT_TAIL(&fd->queue, d, next); 592 eloop_event_add_w(fd->ctx->eloop, fd->fd, control_writeone, fd); 593 return 0; 594 } 595