1 /* SPDX-License-Identifier: BSD-2-Clause */ 2 /* 3 * dhcpcd - DHCP client daemon 4 * Copyright (c) 2006-2020 Roy Marples <roy@marples.name> 5 * All rights reserved 6 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/socket.h> 30 #include <sys/stat.h> 31 #include <sys/uio.h> 32 #include <sys/un.h> 33 34 #include <errno.h> 35 #include <fcntl.h> 36 #include <stdio.h> 37 #include <stdlib.h> 38 #include <string.h> 39 #include <time.h> 40 #include <unistd.h> 41 42 #include "config.h" 43 #include "common.h" 44 #include "dhcpcd.h" 45 #include "control.h" 46 #include "eloop.h" 47 #include "if.h" 48 #include "logerr.h" 49 #include "privsep.h" 50 51 #ifndef SUN_LEN 52 #define SUN_LEN(su) \ 53 (sizeof(*(su)) - sizeof((su)->sun_path) + strlen((su)->sun_path)) 54 #endif 55 56 static void 57 control_queue_free(struct fd_list *fd) 58 { 59 struct fd_data *fdp; 60 61 while ((fdp = TAILQ_FIRST(&fd->queue))) { 62 TAILQ_REMOVE(&fd->queue, fdp, next); 63 if (fdp->data_size != 0) 64 free(fdp->data); 65 free(fdp); 66 } 67 68 #ifdef CTL_FREE_LIST 69 while ((fdp = TAILQ_FIRST(&fd->free_queue))) { 70 TAILQ_REMOVE(&fd->free_queue, fdp, next); 71 if (fdp->data_size != 0) 72 free(fdp->data); 73 free(fdp); 74 } 75 #endif 76 } 77 78 void 79 control_free(struct fd_list *fd) 80 { 81 82 #ifdef PRIVSEP 83 if (fd->ctx->ps_control_client == fd) 84 fd->ctx->ps_control_client = NULL; 85 #endif 86 87 eloop_event_remove_writecb(fd->ctx->eloop, fd->fd); 88 TAILQ_REMOVE(&fd->ctx->control_fds, fd, next); 89 control_queue_free(fd); 90 free(fd); 91 } 92 93 void 94 control_delete(struct fd_list *fd) 95 { 96 97 #ifdef PRIVSEP 98 if (IN_PRIVSEP_SE(fd->ctx)) 99 return; 100 #endif 101 102 eloop_event_delete(fd->ctx->eloop, fd->fd); 103 close(fd->fd); 104 control_free(fd); 105 } 106 107 static void 108 control_handle_data(void *arg) 109 { 110 struct fd_list *fd = arg; 111 char buffer[1024]; 112 ssize_t bytes; 113 114 bytes = read(fd->fd, buffer, sizeof(buffer) - 1); 115 116 if (bytes == -1 || bytes == 0) { 117 /* Control was closed or there was an error. 118 * Remove it from our list. */ 119 control_delete(fd); 120 return; 121 } 122 123 #ifdef PRIVSEP 124 if (IN_PRIVSEP(fd->ctx)) { 125 ssize_t err; 126 127 fd->flags |= FD_SENDLEN; 128 err = ps_ctl_handleargs(fd, buffer, (size_t)bytes); 129 fd->flags &= ~FD_SENDLEN; 130 if (err == -1) { 131 logerr(__func__); 132 return; 133 } 134 if (err == 1 && 135 ps_ctl_sendargs(fd, buffer, (size_t)bytes) == -1) { 136 logerr(__func__); 137 control_delete(fd); 138 } 139 return; 140 } 141 #endif 142 143 control_recvdata(fd, buffer, (size_t)bytes); 144 } 145 146 void 147 control_recvdata(struct fd_list *fd, char *data, size_t len) 148 { 149 char *p = data, *e; 150 char *argvp[255], **ap; 151 int argc; 152 153 /* Each command is \n terminated 154 * Each argument is NULL separated */ 155 while (len != 0) { 156 argc = 0; 157 ap = argvp; 158 while (len != 0) { 159 if (*p == '\0') { 160 p++; 161 len--; 162 continue; 163 } 164 e = memchr(p, '\0', len); 165 if (e == NULL) { 166 errno = EINVAL; 167 logerrx("%s: no terminator", __func__); 168 return; 169 } 170 if ((size_t)argc >= sizeof(argvp) / sizeof(argvp[0])) { 171 errno = ENOBUFS; 172 logerrx("%s: no arg buffer", __func__); 173 return; 174 } 175 *ap++ = p; 176 argc++; 177 e++; 178 len -= (size_t)(e - p); 179 p = e; 180 e--; 181 if (*(--e) == '\n') { 182 *e = '\0'; 183 break; 184 } 185 } 186 if (argc == 0) { 187 logerrx("%s: no args", __func__); 188 continue; 189 } 190 *ap = NULL; 191 if (dhcpcd_handleargs(fd->ctx, fd, argc, argvp) == -1) { 192 logerr(__func__); 193 if (errno != EINTR && errno != EAGAIN) { 194 control_delete(fd); 195 return; 196 } 197 } 198 } 199 } 200 201 struct fd_list * 202 control_new(struct dhcpcd_ctx *ctx, int fd, unsigned int flags) 203 { 204 struct fd_list *l; 205 206 l = malloc(sizeof(*l)); 207 if (l == NULL) 208 return NULL; 209 210 l->ctx = ctx; 211 l->fd = fd; 212 l->flags = flags; 213 TAILQ_INIT(&l->queue); 214 #ifdef CTL_FREE_LIST 215 TAILQ_INIT(&l->free_queue); 216 #endif 217 TAILQ_INSERT_TAIL(&ctx->control_fds, l, next); 218 return l; 219 } 220 221 static void 222 control_handle1(struct dhcpcd_ctx *ctx, int lfd, unsigned int fd_flags) 223 { 224 struct sockaddr_un run; 225 socklen_t len; 226 struct fd_list *l; 227 int fd, flags; 228 229 len = sizeof(run); 230 if ((fd = accept(lfd, (struct sockaddr *)&run, &len)) == -1) 231 goto error; 232 if ((flags = fcntl(fd, F_GETFD, 0)) == -1 || 233 fcntl(fd, F_SETFD, flags | FD_CLOEXEC) == -1) 234 goto error; 235 if ((flags = fcntl(fd, F_GETFL, 0)) == -1 || 236 fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) 237 goto error; 238 239 #ifdef PRIVSEP 240 if (IN_PRIVSEP(ctx) && !IN_PRIVSEP_SE(ctx)) 241 ; 242 else 243 #endif 244 fd_flags |= FD_SENDLEN; 245 246 l = control_new(ctx, fd, fd_flags); 247 if (l == NULL) 248 goto error; 249 250 if (eloop_event_add(ctx->eloop, l->fd, control_handle_data, l) == -1) 251 logerr(__func__); 252 return; 253 254 error: 255 logerr(__func__); 256 if (fd != -1) 257 close(fd); 258 } 259 260 static void 261 control_handle(void *arg) 262 { 263 struct dhcpcd_ctx *ctx = arg; 264 265 control_handle1(ctx, ctx->control_fd, 0); 266 } 267 268 static void 269 control_handle_unpriv(void *arg) 270 { 271 struct dhcpcd_ctx *ctx = arg; 272 273 control_handle1(ctx, ctx->control_unpriv_fd, FD_UNPRIV); 274 } 275 276 static int 277 make_path(char *path, size_t len, const char *ifname, sa_family_t family, 278 bool unpriv) 279 { 280 const char *per; 281 const char *sunpriv; 282 283 switch(family) { 284 case AF_INET: 285 per = "-4"; 286 break; 287 case AF_INET6: 288 per = "-6"; 289 break; 290 default: 291 per = ""; 292 break; 293 } 294 if (unpriv) 295 sunpriv = ifname ? ".unpriv" : "unpriv."; 296 else 297 sunpriv = ""; 298 return snprintf(path, len, CONTROLSOCKET, 299 ifname ? ifname : "", ifname ? per : "", 300 sunpriv, ifname ? "." : ""); 301 } 302 303 static int 304 make_sock(struct sockaddr_un *sa, const char *ifname, sa_family_t family, 305 bool unpriv) 306 { 307 int fd; 308 309 if ((fd = xsocket(AF_UNIX, SOCK_STREAM | SOCK_CXNB, 0)) == -1) 310 return -1; 311 memset(sa, 0, sizeof(*sa)); 312 sa->sun_family = AF_UNIX; 313 make_path(sa->sun_path, sizeof(sa->sun_path), ifname, family, unpriv); 314 return fd; 315 } 316 317 #define S_PRIV (S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP) 318 #define S_UNPRIV (S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH) 319 320 static int 321 control_start1(struct dhcpcd_ctx *ctx, const char *ifname, sa_family_t family, 322 mode_t fmode) 323 { 324 struct sockaddr_un sa; 325 int fd; 326 socklen_t len; 327 328 fd = make_sock(&sa, ifname, family, (fmode & S_UNPRIV) == S_UNPRIV); 329 if (fd == -1) 330 return -1; 331 332 len = (socklen_t)SUN_LEN(&sa); 333 unlink(sa.sun_path); 334 if (bind(fd, (struct sockaddr *)&sa, len) == -1 || 335 chmod(sa.sun_path, fmode) == -1 || 336 (ctx->control_group && 337 chown(sa.sun_path, geteuid(), ctx->control_group) == -1) || 338 listen(fd, sizeof(ctx->control_fds)) == -1) 339 { 340 close(fd); 341 unlink(sa.sun_path); 342 return -1; 343 } 344 345 #ifdef PRIVSEP_RIGHTS 346 if (IN_PRIVSEP(ctx) && ps_rights_limit_fd_fctnl(fd) == -1) { 347 close(fd); 348 unlink(sa.sun_path); 349 return -1; 350 } 351 #endif 352 353 if ((fmode & S_PRIV) == S_PRIV) 354 strlcpy(ctx->control_sock, sa.sun_path, 355 sizeof(ctx->control_sock)); 356 else 357 strlcpy(ctx->control_sock_unpriv, sa.sun_path, 358 sizeof(ctx->control_sock_unpriv)); 359 return fd; 360 } 361 362 int 363 control_start(struct dhcpcd_ctx *ctx, const char *ifname, sa_family_t family) 364 { 365 int fd; 366 367 #ifdef PRIVSEP 368 if (IN_PRIVSEP_SE(ctx)) { 369 make_path(ctx->control_sock, sizeof(ctx->control_sock), 370 ifname, family, false); 371 make_path(ctx->control_sock_unpriv, sizeof(ctx->control_sock), 372 ifname, family, true); 373 return 0; 374 } 375 #endif 376 377 if ((fd = control_start1(ctx, ifname, family, S_PRIV)) == -1) 378 return -1; 379 380 ctx->control_fd = fd; 381 eloop_event_add(ctx->eloop, fd, control_handle, ctx); 382 383 if ((fd = control_start1(ctx, ifname, family, S_UNPRIV)) != -1) { 384 ctx->control_unpriv_fd = fd; 385 eloop_event_add(ctx->eloop, fd, control_handle_unpriv, ctx); 386 } 387 return ctx->control_fd; 388 } 389 390 static int 391 control_unlink(struct dhcpcd_ctx *ctx, const char *file) 392 { 393 int retval = 0; 394 395 errno = 0; 396 #ifdef PRIVSEP 397 if (IN_PRIVSEP(ctx)) 398 retval = (int)ps_root_unlink(ctx, file); 399 else 400 #else 401 UNUSED(ctx); 402 #endif 403 retval = unlink(file); 404 405 return retval == -1 && errno != ENOENT ? -1 : 0; 406 } 407 408 int 409 control_stop(struct dhcpcd_ctx *ctx) 410 { 411 int retval = 0; 412 struct fd_list *l; 413 414 while ((l = TAILQ_FIRST(&ctx->control_fds)) != NULL) { 415 control_free(l); 416 } 417 418 #ifdef PRIVSEP 419 if (IN_PRIVSEP_SE(ctx)) { 420 if (ps_root_unlink(ctx, ctx->control_sock) == -1) 421 retval = -1; 422 if (ps_root_unlink(ctx, ctx->control_sock_unpriv) == -1) 423 retval = -1; 424 return retval; 425 } else if (ctx->options & DHCPCD_FORKED) 426 return retval; 427 #endif 428 429 if (ctx->control_fd != -1) { 430 eloop_event_delete(ctx->eloop, ctx->control_fd); 431 close(ctx->control_fd); 432 ctx->control_fd = -1; 433 if (control_unlink(ctx, ctx->control_sock) == -1) 434 retval = -1; 435 } 436 437 if (ctx->control_unpriv_fd != -1) { 438 eloop_event_delete(ctx->eloop, ctx->control_unpriv_fd); 439 close(ctx->control_unpriv_fd); 440 ctx->control_unpriv_fd = -1; 441 if (control_unlink(ctx, ctx->control_sock_unpriv) == -1) 442 retval = -1; 443 } 444 445 return retval; 446 } 447 448 int 449 control_open(const char *ifname, sa_family_t family, bool unpriv) 450 { 451 struct sockaddr_un sa; 452 int fd; 453 454 if ((fd = make_sock(&sa, ifname, family, unpriv)) != -1) { 455 socklen_t len; 456 457 len = (socklen_t)SUN_LEN(&sa); 458 if (connect(fd, (struct sockaddr *)&sa, len) == -1) { 459 close(fd); 460 fd = -1; 461 } 462 } 463 return fd; 464 } 465 466 ssize_t 467 control_send(struct dhcpcd_ctx *ctx, int argc, char * const *argv) 468 { 469 char buffer[1024]; 470 int i; 471 size_t len, l; 472 473 if (argc > 255) { 474 errno = ENOBUFS; 475 return -1; 476 } 477 len = 0; 478 for (i = 0; i < argc; i++) { 479 l = strlen(argv[i]) + 1; 480 if (len + l > sizeof(buffer)) { 481 errno = ENOBUFS; 482 return -1; 483 } 484 memcpy(buffer + len, argv[i], l); 485 len += l; 486 } 487 return write(ctx->control_fd, buffer, len); 488 } 489 490 static void 491 control_writeone(void *arg) 492 { 493 struct fd_list *fd; 494 struct iovec iov[2]; 495 int iov_len; 496 struct fd_data *data; 497 498 fd = arg; 499 data = TAILQ_FIRST(&fd->queue); 500 501 if (data->data_flags & FD_SENDLEN) { 502 iov[0].iov_base = &data->data_len; 503 iov[0].iov_len = sizeof(size_t); 504 iov[1].iov_base = data->data; 505 iov[1].iov_len = data->data_len; 506 iov_len = 2; 507 } else { 508 iov[0].iov_base = data->data; 509 iov[0].iov_len = data->data_len; 510 iov_len = 1; 511 } 512 513 if (writev(fd->fd, iov, iov_len) == -1) { 514 logerr("%s: write", __func__); 515 control_delete(fd); 516 return; 517 } 518 519 TAILQ_REMOVE(&fd->queue, data, next); 520 #ifdef CTL_FREE_LIST 521 TAILQ_INSERT_TAIL(&fd->free_queue, data, next); 522 #else 523 if (data->data_size != 0) 524 free(data->data); 525 free(data); 526 #endif 527 528 if (TAILQ_FIRST(&fd->queue) != NULL) 529 return; 530 531 eloop_event_remove_writecb(fd->ctx->eloop, fd->fd); 532 #ifdef PRIVSEP 533 if (IN_PRIVSEP_SE(fd->ctx) && !(fd->flags & FD_LISTEN)) { 534 if (ps_ctl_sendeof(fd) == -1) 535 logerr(__func__); 536 control_free(fd); 537 } 538 #endif 539 } 540 541 int 542 control_queue(struct fd_list *fd, void *data, size_t data_len) 543 { 544 struct fd_data *d; 545 546 if (data_len == 0) { 547 errno = EINVAL; 548 return -1; 549 } 550 551 #ifdef CTL_FREE_LIST 552 struct fd_data *df; 553 554 d = NULL; 555 TAILQ_FOREACH(df, &fd->free_queue, next) { 556 if (d == NULL || d->data_size < df->data_size) { 557 d = df; 558 if (d->data_size <= data_len) 559 break; 560 } 561 } 562 if (d != NULL) 563 TAILQ_REMOVE(&fd->free_queue, d, next); 564 else 565 #endif 566 { 567 d = calloc(1, sizeof(*d)); 568 if (d == NULL) 569 return -1; 570 } 571 572 if (d->data_size == 0) 573 d->data = NULL; 574 if (d->data_size < data_len) { 575 void *nbuf = realloc(d->data, data_len); 576 if (nbuf == NULL) { 577 free(d->data); 578 free(d); 579 return -1; 580 } 581 d->data = nbuf; 582 d->data_size = data_len; 583 } 584 memcpy(d->data, data, data_len); 585 d->data_len = data_len; 586 d->data_flags = fd->flags & FD_SENDLEN; 587 588 TAILQ_INSERT_TAIL(&fd->queue, d, next); 589 eloop_event_add_w(fd->ctx->eloop, fd->fd, control_writeone, fd); 590 return 0; 591 } 592