1 /* SPDX-License-Identifier: BSD-2-Clause */ 2 /* 3 * dhcpcd - DHCP client daemon 4 * Copyright (c) 2006-2023 Roy Marples <roy@marples.name> 5 * All rights reserved 6 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include <sys/socket.h> 30 #include <sys/stat.h> 31 #include <sys/uio.h> 32 #include <sys/un.h> 33 34 #include <errno.h> 35 #include <fcntl.h> 36 #include <stdio.h> 37 #include <stdlib.h> 38 #include <string.h> 39 #include <time.h> 40 #include <unistd.h> 41 42 #include "config.h" 43 #include "common.h" 44 #include "dhcpcd.h" 45 #include "control.h" 46 #include "eloop.h" 47 #include "if.h" 48 #include "logerr.h" 49 #include "privsep.h" 50 51 #ifndef SUN_LEN 52 #define SUN_LEN(su) \ 53 (sizeof(*(su)) - sizeof((su)->sun_path) + strlen((su)->sun_path)) 54 #endif 55 56 static void control_handle_data(void *, unsigned short); 57 58 static void 59 control_queue_free(struct fd_list *fd) 60 { 61 struct fd_data *fdp; 62 63 while ((fdp = TAILQ_FIRST(&fd->queue))) { 64 TAILQ_REMOVE(&fd->queue, fdp, next); 65 if (fdp->data_size != 0) 66 free(fdp->data); 67 free(fdp); 68 } 69 70 #ifdef CTL_FREE_LIST 71 while ((fdp = TAILQ_FIRST(&fd->free_queue))) { 72 TAILQ_REMOVE(&fd->free_queue, fdp, next); 73 if (fdp->data_size != 0) 74 free(fdp->data); 75 free(fdp); 76 } 77 #endif 78 } 79 80 void 81 control_free(struct fd_list *fd) 82 { 83 84 #ifdef PRIVSEP 85 if (fd->ctx->ps_control_client == fd) 86 fd->ctx->ps_control_client = NULL; 87 #endif 88 89 eloop_event_delete(fd->ctx->eloop, fd->fd); 90 close(fd->fd); 91 TAILQ_REMOVE(&fd->ctx->control_fds, fd, next); 92 control_queue_free(fd); 93 free(fd); 94 } 95 96 static void 97 control_handle_read(struct fd_list *fd) 98 { 99 char buffer[1024]; 100 ssize_t bytes; 101 102 bytes = read(fd->fd, buffer, sizeof(buffer) - 1); 103 if (bytes == -1) 104 logerr(__func__); 105 if (bytes == -1 || bytes == 0) { 106 #ifdef PRIVSEP 107 if (IN_PRIVSEP(fd->ctx)) { 108 if (ps_ctl_sendeof(fd) == -1) 109 logerr(__func__); 110 } 111 #endif 112 control_free(fd); 113 return; 114 } 115 116 #ifdef PRIVSEP 117 if (IN_PRIVSEP(fd->ctx)) { 118 ssize_t err; 119 120 fd->flags |= FD_SENDLEN; 121 err = ps_ctl_handleargs(fd, buffer, (size_t)bytes); 122 fd->flags &= ~FD_SENDLEN; 123 if (err == -1) { 124 logerr(__func__); 125 return; 126 } 127 if (err == 1 && 128 ps_ctl_sendargs(fd, buffer, (size_t)bytes) == -1) { 129 logerr(__func__); 130 control_free(fd); 131 } 132 return; 133 } 134 #endif 135 136 control_recvdata(fd, buffer, (size_t)bytes); 137 } 138 139 static void 140 control_handle_write(struct fd_list *fd) 141 { 142 struct iovec iov[2]; 143 int iov_len; 144 struct fd_data *data; 145 146 data = TAILQ_FIRST(&fd->queue); 147 148 if (data->data_flags & FD_SENDLEN) { 149 iov[0].iov_base = &data->data_len; 150 iov[0].iov_len = sizeof(size_t); 151 iov[1].iov_base = data->data; 152 iov[1].iov_len = data->data_len; 153 iov_len = 2; 154 } else { 155 iov[0].iov_base = data->data; 156 iov[0].iov_len = data->data_len; 157 iov_len = 1; 158 } 159 160 if (writev(fd->fd, iov, iov_len) == -1) { 161 logerr("%s: write", __func__); 162 control_free(fd); 163 return; 164 } 165 166 TAILQ_REMOVE(&fd->queue, data, next); 167 #ifdef CTL_FREE_LIST 168 TAILQ_INSERT_TAIL(&fd->free_queue, data, next); 169 #else 170 if (data->data_size != 0) 171 free(data->data); 172 free(data); 173 #endif 174 175 if (TAILQ_FIRST(&fd->queue) != NULL) 176 return; 177 178 #ifdef PRIVSEP 179 if (IN_PRIVSEP_SE(fd->ctx) && !(fd->flags & FD_LISTEN)) { 180 if (ps_ctl_sendeof(fd) == -1) 181 logerr(__func__); 182 } 183 #endif 184 185 /* Done sending data, stop watching write to fd */ 186 if (eloop_event_add(fd->ctx->eloop, fd->fd, ELE_READ, 187 control_handle_data, fd) == -1) 188 logerr("%s: eloop_event_add", __func__); 189 } 190 191 192 static void 193 control_handle_data(void *arg, unsigned short events) 194 { 195 struct fd_list *fd = arg; 196 197 if (!(events & (ELE_READ | ELE_WRITE))) 198 logerrx("%s: unexpected event 0x%04x", __func__, events); 199 200 if (events & ELE_WRITE && !(events & ELE_HANGUP)) 201 control_handle_write(fd); 202 if (events & ELE_READ) 203 control_handle_read(fd); 204 } 205 206 void 207 control_recvdata(struct fd_list *fd, char *data, size_t len) 208 { 209 char *p = data, *e; 210 char *argvp[255], **ap; 211 int argc; 212 213 /* Each command is \n terminated 214 * Each argument is NULL separated */ 215 while (len != 0) { 216 argc = 0; 217 ap = argvp; 218 while (len != 0) { 219 if (*p == '\0') { 220 p++; 221 len--; 222 continue; 223 } 224 e = memchr(p, '\0', len); 225 if (e == NULL) { 226 errno = EINVAL; 227 logerrx("%s: no terminator", __func__); 228 return; 229 } 230 if ((size_t)argc >= sizeof(argvp) / sizeof(argvp[0])) { 231 errno = ENOBUFS; 232 logerrx("%s: no arg buffer", __func__); 233 return; 234 } 235 *ap++ = p; 236 argc++; 237 e++; 238 len -= (size_t)(e - p); 239 p = e; 240 e--; 241 if (*(--e) == '\n') { 242 *e = '\0'; 243 break; 244 } 245 } 246 if (argc == 0) { 247 logerrx("%s: no args", __func__); 248 continue; 249 } 250 *ap = NULL; 251 if (dhcpcd_handleargs(fd->ctx, fd, argc, argvp) == -1) { 252 logerr(__func__); 253 if (errno != EINTR && errno != EAGAIN) { 254 control_free(fd); 255 return; 256 } 257 } 258 } 259 } 260 261 struct fd_list * 262 control_new(struct dhcpcd_ctx *ctx, int fd, unsigned int flags) 263 { 264 struct fd_list *l; 265 266 l = malloc(sizeof(*l)); 267 if (l == NULL) 268 return NULL; 269 270 l->ctx = ctx; 271 l->fd = fd; 272 l->flags = flags; 273 TAILQ_INIT(&l->queue); 274 #ifdef CTL_FREE_LIST 275 TAILQ_INIT(&l->free_queue); 276 #endif 277 TAILQ_INSERT_TAIL(&ctx->control_fds, l, next); 278 return l; 279 } 280 281 static void 282 control_handle1(struct dhcpcd_ctx *ctx, int lfd, unsigned int fd_flags, 283 unsigned short events) 284 { 285 struct sockaddr_un run; 286 socklen_t len; 287 struct fd_list *l; 288 int fd, flags; 289 290 if (events != ELE_READ) 291 logerrx("%s: unexpected event 0x%04x", __func__, events); 292 293 len = sizeof(run); 294 if ((fd = accept(lfd, (struct sockaddr *)&run, &len)) == -1) 295 goto error; 296 if ((flags = fcntl(fd, F_GETFD, 0)) == -1 || 297 fcntl(fd, F_SETFD, flags | FD_CLOEXEC) == -1) 298 goto error; 299 if ((flags = fcntl(fd, F_GETFL, 0)) == -1 || 300 fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) 301 goto error; 302 303 #ifdef PRIVSEP 304 if (IN_PRIVSEP(ctx) && !IN_PRIVSEP_SE(ctx)) 305 ; 306 else 307 #endif 308 fd_flags |= FD_SENDLEN; 309 310 l = control_new(ctx, fd, fd_flags); 311 if (l == NULL) 312 goto error; 313 314 if (eloop_event_add(ctx->eloop, l->fd, ELE_READ, 315 control_handle_data, l) == -1) 316 logerr("%s: eloop_event_add", __func__); 317 return; 318 319 error: 320 logerr(__func__); 321 if (fd != -1) 322 close(fd); 323 } 324 325 static void 326 control_handle(void *arg, unsigned short events) 327 { 328 struct dhcpcd_ctx *ctx = arg; 329 330 control_handle1(ctx, ctx->control_fd, 0, events); 331 } 332 333 static void 334 control_handle_unpriv(void *arg, unsigned short events) 335 { 336 struct dhcpcd_ctx *ctx = arg; 337 338 control_handle1(ctx, ctx->control_unpriv_fd, FD_UNPRIV, events); 339 } 340 341 static int 342 make_path(char *path, size_t len, const char *ifname, sa_family_t family, 343 bool unpriv) 344 { 345 const char *per; 346 const char *sunpriv; 347 348 switch(family) { 349 case AF_INET: 350 per = "-4"; 351 break; 352 case AF_INET6: 353 per = "-6"; 354 break; 355 default: 356 per = ""; 357 break; 358 } 359 if (unpriv) 360 sunpriv = ifname ? ".unpriv" : "unpriv."; 361 else 362 sunpriv = ""; 363 return snprintf(path, len, CONTROLSOCKET, 364 ifname ? ifname : "", ifname ? per : "", 365 sunpriv, ifname ? "." : ""); 366 } 367 368 static int 369 make_sock(struct sockaddr_un *sa, const char *ifname, sa_family_t family, 370 bool unpriv) 371 { 372 int fd; 373 374 if ((fd = xsocket(AF_UNIX, SOCK_STREAM | SOCK_CXNB, 0)) == -1) 375 return -1; 376 memset(sa, 0, sizeof(*sa)); 377 sa->sun_family = AF_UNIX; 378 make_path(sa->sun_path, sizeof(sa->sun_path), ifname, family, unpriv); 379 return fd; 380 } 381 382 #define S_PRIV (S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP) 383 #define S_UNPRIV (S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH) 384 385 static int 386 control_start1(struct dhcpcd_ctx *ctx, const char *ifname, sa_family_t family, 387 mode_t fmode) 388 { 389 struct sockaddr_un sa; 390 int fd; 391 socklen_t len; 392 393 fd = make_sock(&sa, ifname, family, (fmode & S_UNPRIV) == S_UNPRIV); 394 if (fd == -1) 395 return -1; 396 397 len = (socklen_t)SUN_LEN(&sa); 398 unlink(sa.sun_path); 399 if (bind(fd, (struct sockaddr *)&sa, len) == -1 || 400 chmod(sa.sun_path, fmode) == -1 || 401 (ctx->control_group && 402 chown(sa.sun_path, geteuid(), ctx->control_group) == -1) || 403 listen(fd, sizeof(ctx->control_fds)) == -1) 404 { 405 close(fd); 406 unlink(sa.sun_path); 407 return -1; 408 } 409 410 #ifdef PRIVSEP_RIGHTS 411 if (IN_PRIVSEP(ctx) && ps_rights_limit_fd_fctnl(fd) == -1) { 412 close(fd); 413 unlink(sa.sun_path); 414 return -1; 415 } 416 #endif 417 418 if ((fmode & S_UNPRIV) == S_UNPRIV) 419 strlcpy(ctx->control_sock_unpriv, sa.sun_path, 420 sizeof(ctx->control_sock_unpriv)); 421 else 422 strlcpy(ctx->control_sock, sa.sun_path, 423 sizeof(ctx->control_sock)); 424 return fd; 425 } 426 427 int 428 control_start(struct dhcpcd_ctx *ctx, const char *ifname, sa_family_t family) 429 { 430 int fd; 431 432 #ifdef PRIVSEP 433 if (IN_PRIVSEP_SE(ctx)) { 434 make_path(ctx->control_sock, sizeof(ctx->control_sock), 435 ifname, family, false); 436 make_path(ctx->control_sock_unpriv, 437 sizeof(ctx->control_sock_unpriv), 438 ifname, family, true); 439 return 0; 440 } 441 #endif 442 443 if ((fd = control_start1(ctx, ifname, family, S_PRIV)) == -1) 444 return -1; 445 446 ctx->control_fd = fd; 447 if (eloop_event_add(ctx->eloop, fd, ELE_READ, 448 control_handle, ctx) == -1) 449 logerr("%s: eloop_event_add", __func__); 450 451 if ((fd = control_start1(ctx, ifname, family, S_UNPRIV)) != -1) { 452 ctx->control_unpriv_fd = fd; 453 if (eloop_event_add(ctx->eloop, fd, ELE_READ, 454 control_handle_unpriv, ctx) == -1) 455 logerr("%s: eloop_event_add", __func__); 456 } 457 return ctx->control_fd; 458 } 459 460 static int 461 control_unlink(struct dhcpcd_ctx *ctx, const char *file) 462 { 463 int retval = 0; 464 465 errno = 0; 466 #ifdef PRIVSEP 467 if (IN_PRIVSEP(ctx)) 468 retval = (int)ps_root_unlink(ctx, file); 469 else 470 #else 471 UNUSED(ctx); 472 #endif 473 retval = unlink(file); 474 475 return retval == -1 && errno != ENOENT ? -1 : 0; 476 } 477 478 int 479 control_stop(struct dhcpcd_ctx *ctx) 480 { 481 int retval = 0; 482 struct fd_list *l; 483 484 while ((l = TAILQ_FIRST(&ctx->control_fds)) != NULL) { 485 control_free(l); 486 } 487 488 #ifdef PRIVSEP 489 if (IN_PRIVSEP_SE(ctx)) { 490 if (ps_root_unlink(ctx, ctx->control_sock) == -1) 491 retval = -1; 492 if (ps_root_unlink(ctx, ctx->control_sock_unpriv) == -1) 493 retval = -1; 494 return retval; 495 } else if (ctx->options & DHCPCD_FORKED) 496 return retval; 497 #endif 498 499 if (ctx->control_fd != -1) { 500 eloop_event_delete(ctx->eloop, ctx->control_fd); 501 close(ctx->control_fd); 502 ctx->control_fd = -1; 503 if (control_unlink(ctx, ctx->control_sock) == -1) 504 retval = -1; 505 } 506 507 if (ctx->control_unpriv_fd != -1) { 508 eloop_event_delete(ctx->eloop, ctx->control_unpriv_fd); 509 close(ctx->control_unpriv_fd); 510 ctx->control_unpriv_fd = -1; 511 if (control_unlink(ctx, ctx->control_sock_unpriv) == -1) 512 retval = -1; 513 } 514 515 return retval; 516 } 517 518 int 519 control_open(const char *ifname, sa_family_t family, bool unpriv) 520 { 521 struct sockaddr_un sa; 522 int fd; 523 524 if ((fd = make_sock(&sa, ifname, family, unpriv)) != -1) { 525 socklen_t len; 526 527 len = (socklen_t)SUN_LEN(&sa); 528 if (connect(fd, (struct sockaddr *)&sa, len) == -1) { 529 close(fd); 530 fd = -1; 531 } 532 } 533 return fd; 534 } 535 536 ssize_t 537 control_send(struct dhcpcd_ctx *ctx, int argc, char * const *argv) 538 { 539 char buffer[1024]; 540 int i; 541 size_t len, l; 542 543 if (argc > 255) { 544 errno = ENOBUFS; 545 return -1; 546 } 547 len = 0; 548 for (i = 0; i < argc; i++) { 549 l = strlen(argv[i]) + 1; 550 if (len + l > sizeof(buffer)) { 551 errno = ENOBUFS; 552 return -1; 553 } 554 memcpy(buffer + len, argv[i], l); 555 len += l; 556 } 557 return write(ctx->control_fd, buffer, len); 558 } 559 560 int 561 control_queue(struct fd_list *fd, void *data, size_t data_len) 562 { 563 struct fd_data *d; 564 unsigned short events; 565 566 if (data_len == 0) { 567 errno = EINVAL; 568 return -1; 569 } 570 571 #ifdef CTL_FREE_LIST 572 struct fd_data *df; 573 574 d = NULL; 575 TAILQ_FOREACH(df, &fd->free_queue, next) { 576 if (d == NULL || d->data_size < df->data_size) { 577 d = df; 578 if (d->data_size <= data_len) 579 break; 580 } 581 } 582 if (d != NULL) 583 TAILQ_REMOVE(&fd->free_queue, d, next); 584 else 585 #endif 586 { 587 d = calloc(1, sizeof(*d)); 588 if (d == NULL) 589 return -1; 590 } 591 592 if (d->data_size == 0) 593 d->data = NULL; 594 if (d->data_size < data_len) { 595 void *nbuf = realloc(d->data, data_len); 596 if (nbuf == NULL) { 597 free(d->data); 598 free(d); 599 return -1; 600 } 601 d->data = nbuf; 602 d->data_size = data_len; 603 } 604 memcpy(d->data, data, data_len); 605 d->data_len = data_len; 606 d->data_flags = fd->flags & FD_SENDLEN; 607 608 TAILQ_INSERT_TAIL(&fd->queue, d, next); 609 events = ELE_WRITE; 610 if (fd->flags & FD_LISTEN) 611 events |= ELE_READ; 612 return eloop_event_add(fd->ctx->eloop, fd->fd, events, 613 control_handle_data, fd); 614 } 615