1 /* SPDX-License-Identifier: BSD-2-Clause */ 2 /* 3 * Privilege Separation for dhcpcd 4 * Copyright (c) 2006-2020 Roy Marples <roy@marples.name> 5 * All rights reserved 6 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 /* 30 * The current design is this: 31 * Spawn a priv process to carry out privileged actions and 32 * spawning unpriv process to initate network connections such as BPF 33 * or address specific listener. 34 * Spawn an unpriv process to send/receive common network data. 35 * Then drop all privs and start running. 36 * Every process aside from the privileged actioneer is chrooted. 37 * All privsep processes ignore signals - only the master process accepts them. 38 * 39 * dhcpcd will maintain the config file in the chroot, no need to handle 40 * this in a script or something. 41 */ 42 43 #include <sys/resource.h> 44 #include <sys/socket.h> 45 #include <sys/stat.h> 46 #include <sys/types.h> 47 #include <sys/wait.h> 48 49 #ifdef AF_LINK 50 #include <net/if_dl.h> 51 #endif 52 53 #include <assert.h> 54 #include <errno.h> 55 #include <fcntl.h> 56 #include <grp.h> 57 #include <paths.h> 58 #include <pwd.h> 59 #include <stddef.h> /* For offsetof, struct padding debug */ 60 #include <signal.h> 61 #include <stdlib.h> 62 #include <string.h> 63 #include <unistd.h> 64 65 #include "arp.h" 66 #include "common.h" 67 #include "control.h" 68 #include "dev.h" 69 #include "dhcp.h" 70 #include "dhcp6.h" 71 #include "eloop.h" 72 #include "ipv6nd.h" 73 #include "logerr.h" 74 #include "privsep.h" 75 76 #ifdef HAVE_CAPSICUM 77 #include <sys/capsicum.h> 78 #include <capsicum_helpers.h> 79 #endif 80 #ifdef HAVE_UTIL_H 81 #include <util.h> 82 #endif 83 84 int 85 ps_init(struct dhcpcd_ctx *ctx) 86 { 87 struct passwd *pw; 88 struct stat st; 89 90 errno = 0; 91 if ((ctx->ps_user = pw = getpwnam(PRIVSEP_USER)) == NULL) { 92 ctx->options &= ~DHCPCD_PRIVSEP; 93 if (errno == 0) { 94 logerrx("no such user %s", PRIVSEP_USER); 95 /* Just incase logerrx caused an error... */ 96 errno = 0; 97 } else 98 logerr("getpwnam"); 99 return -1; 100 } 101 102 if (stat(pw->pw_dir, &st) == -1 || !S_ISDIR(st.st_mode)) { 103 ctx->options &= ~DHCPCD_PRIVSEP; 104 logerrx("refusing chroot: %s: %s", 105 PRIVSEP_USER, pw->pw_dir); 106 errno = 0; 107 return -1; 108 } 109 110 ctx->options |= DHCPCD_PRIVSEP; 111 return 0; 112 } 113 114 static int 115 ps_dropprivs(struct dhcpcd_ctx *ctx) 116 { 117 struct passwd *pw = ctx->ps_user; 118 119 if (ctx->options & DHCPCD_LAUNCHER) 120 logdebugx("chrooting as %s to %s", pw->pw_name, pw->pw_dir); 121 if (chroot(pw->pw_dir) == -1 && 122 (errno != EPERM || ctx->options & DHCPCD_FORKED)) 123 logerr("%s: chroot: %s", __func__, pw->pw_dir); 124 if (chdir("/") == -1) 125 logerr("%s: chdir: /", __func__); 126 127 if ((setgroups(1, &pw->pw_gid) == -1 || 128 setgid(pw->pw_gid) == -1 || 129 setuid(pw->pw_uid) == -1) && 130 (errno != EPERM || ctx->options & DHCPCD_FORKED)) 131 { 132 logerr("failed to drop privileges"); 133 return -1; 134 } 135 136 struct rlimit rzero = { .rlim_cur = 0, .rlim_max = 0 }; 137 138 if (ctx->ps_control_pid != getpid()) { 139 /* Prohibit new files, sockets, etc */ 140 #if defined(__linux__) || defined(__sun) || defined(__OpenBSD__) 141 /* 142 * If poll(2) is called with nfds > RLIMIT_NOFILE 143 * then it returns EINVAL. 144 * This blows. 145 * Do the best we can and limit to what we need. 146 * An attacker could potentially close a file and 147 * open a new one still, but that cannot be helped. 148 */ 149 unsigned long maxfd; 150 maxfd = (unsigned long)eloop_event_count(ctx->eloop); 151 if (IN_PRIVSEP_SE(ctx)) 152 maxfd++; /* XXX why? */ 153 154 struct rlimit rmaxfd = { 155 .rlim_cur = maxfd, 156 .rlim_max = maxfd 157 }; 158 if (setrlimit(RLIMIT_NOFILE, &rmaxfd) == -1) 159 logerr("setrlimit RLIMIT_NOFILE"); 160 #else 161 if (setrlimit(RLIMIT_NOFILE, &rzero) == -1) 162 logerr("setrlimit RLIMIT_NOFILE"); 163 #endif 164 } 165 166 #define DHC_NOCHKIO (DHCPCD_STARTED | DHCPCD_DAEMONISE) 167 /* Prohibit writing to files. 168 * Obviously this won't work if we are using a logfile 169 * or redirecting stderr to a file. */ 170 if ((ctx->options & DHC_NOCHKIO) == DHC_NOCHKIO || 171 (ctx->logfile == NULL && 172 (!ctx->stderr_valid || isatty(STDERR_FILENO) == 1))) 173 { 174 if (setrlimit(RLIMIT_FSIZE, &rzero) == -1) 175 logerr("setrlimit RLIMIT_FSIZE"); 176 } 177 178 #ifdef RLIMIT_NPROC 179 /* Prohibit forks */ 180 if (setrlimit(RLIMIT_NPROC, &rzero) == -1) 181 logerr("setrlimit RLIMIT_NPROC"); 182 #endif 183 184 return 0; 185 } 186 187 static int 188 ps_setbuf0(int fd, int ctl, int minlen) 189 { 190 int len; 191 socklen_t slen; 192 193 slen = sizeof(len); 194 if (getsockopt(fd, SOL_SOCKET, ctl, &len, &slen) == -1) 195 return -1; 196 197 #ifdef __linux__ 198 len /= 2; 199 #endif 200 if (len >= minlen) 201 return 0; 202 203 return setsockopt(fd, SOL_SOCKET, ctl, &minlen, sizeof(minlen)); 204 } 205 206 static int 207 ps_setbuf(int fd) 208 { 209 /* Ensure we can receive a fully sized privsep message. 210 * Double the send buffer. */ 211 int minlen = (int)sizeof(struct ps_msg); 212 213 if (ps_setbuf0(fd, SO_RCVBUF, minlen) == -1 || 214 ps_setbuf0(fd, SO_SNDBUF, minlen * 2) == -1) 215 { 216 logerr(__func__); 217 return -1; 218 } 219 return 0; 220 } 221 222 int 223 ps_setbuf_fdpair(int fd[]) 224 { 225 226 if (ps_setbuf(fd[0]) == -1 || ps_setbuf(fd[1]) == -1) 227 return -1; 228 return 0; 229 } 230 231 #ifdef PRIVSEP_RIGHTS 232 int 233 ps_rights_limit_ioctl(int fd) 234 { 235 cap_rights_t rights; 236 237 cap_rights_init(&rights, CAP_IOCTL); 238 if (cap_rights_limit(fd, &rights) == -1 && errno != ENOSYS) 239 return -1; 240 return 0; 241 } 242 243 int 244 ps_rights_limit_fd_fctnl(int fd) 245 { 246 cap_rights_t rights; 247 248 cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_EVENT, 249 CAP_ACCEPT, CAP_FCNTL); 250 if (cap_rights_limit(fd, &rights) == -1 && errno != ENOSYS) 251 return -1; 252 return 0; 253 } 254 255 int 256 ps_rights_limit_fd(int fd) 257 { 258 cap_rights_t rights; 259 260 cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_EVENT, CAP_SHUTDOWN); 261 if (cap_rights_limit(fd, &rights) == -1 && errno != ENOSYS) 262 return -1; 263 return 0; 264 } 265 266 int 267 ps_rights_limit_fd_sockopt(int fd) 268 { 269 cap_rights_t rights; 270 271 cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_EVENT, 272 CAP_GETSOCKOPT, CAP_SETSOCKOPT); 273 if (cap_rights_limit(fd, &rights) == -1 && errno != ENOSYS) 274 return -1; 275 return 0; 276 } 277 278 int 279 ps_rights_limit_fd_rdonly(int fd) 280 { 281 cap_rights_t rights; 282 283 cap_rights_init(&rights, CAP_READ, CAP_EVENT); 284 if (cap_rights_limit(fd, &rights) == -1 && errno != ENOSYS) 285 return -1; 286 return 0; 287 } 288 289 int 290 ps_rights_limit_fdpair(int fd[]) 291 { 292 293 if (ps_rights_limit_fd(fd[0]) == -1 || ps_rights_limit_fd(fd[1]) == -1) 294 return -1; 295 return 0; 296 } 297 298 static int 299 ps_rights_limit_stdio(struct dhcpcd_ctx *ctx) 300 { 301 const int iebadf = CAPH_IGNORE_EBADF; 302 int error = 0; 303 304 if (ctx->stdin_valid && 305 caph_limit_stream(STDIN_FILENO, CAPH_READ | iebadf) == -1) 306 error = -1; 307 if (ctx->stdout_valid && 308 caph_limit_stream(STDOUT_FILENO, CAPH_WRITE | iebadf) == -1) 309 error = -1; 310 if (ctx->stderr_valid && 311 caph_limit_stream(STDERR_FILENO, CAPH_WRITE | iebadf) == -1) 312 error = -1; 313 314 return error; 315 } 316 #endif 317 318 pid_t 319 ps_dostart(struct dhcpcd_ctx *ctx, 320 pid_t *priv_pid, int *priv_fd, 321 void (*recv_msg)(void *), void (*recv_unpriv_msg), 322 void *recv_ctx, int (*callback)(void *), void (*signal_cb)(int, void *), 323 unsigned int flags) 324 { 325 int fd[2]; 326 pid_t pid; 327 328 if (xsocketpair(AF_UNIX, SOCK_DGRAM | SOCK_CXNB, 0, fd) == -1) { 329 logerr("%s: socketpair", __func__); 330 return -1; 331 } 332 if (ps_setbuf_fdpair(fd) == -1) { 333 logerr("%s: ps_setbuf_fdpair", __func__); 334 return -1; 335 } 336 #ifdef PRIVSEP_RIGHTS 337 if (ps_rights_limit_fdpair(fd) == -1) { 338 logerr("%s: ps_rights_limit_fdpair", __func__); 339 return -1; 340 } 341 #endif 342 343 switch (pid = fork()) { 344 case -1: 345 logerr("fork"); 346 return -1; 347 case 0: 348 *priv_fd = fd[1]; 349 close(fd[0]); 350 break; 351 default: 352 *priv_pid = pid; 353 *priv_fd = fd[0]; 354 close(fd[1]); 355 if (recv_unpriv_msg == NULL) 356 ; 357 else if (eloop_event_add(ctx->eloop, *priv_fd, 358 recv_unpriv_msg, recv_ctx) == -1) 359 { 360 logerr("%s: eloop_event_add", __func__); 361 return -1; 362 } 363 return pid; 364 } 365 366 ctx->options |= DHCPCD_FORKED; 367 if (ctx->fork_fd != -1) { 368 close(ctx->fork_fd); 369 ctx->fork_fd = -1; 370 } 371 pidfile_clean(); 372 eloop_clear(ctx->eloop); 373 374 /* We are not root */ 375 if (priv_fd != &ctx->ps_root_fd) { 376 ps_freeprocesses(ctx, recv_ctx); 377 if (ctx->ps_root_fd != -1) { 378 close(ctx->ps_root_fd); 379 ctx->ps_root_fd = -1; 380 } 381 382 #ifdef PRIVSEP_RIGHTS 383 /* We cannot limit the root process in any way. */ 384 if (ps_rights_limit_stdio(ctx) == -1) { 385 logerr("ps_rights_limit_stdio"); 386 goto errexit; 387 } 388 #endif 389 } 390 391 if (priv_fd != &ctx->ps_inet_fd && ctx->ps_inet_fd != -1) { 392 close(ctx->ps_inet_fd); 393 ctx->ps_inet_fd = -1; 394 } 395 396 eloop_signal_set_cb(ctx->eloop, 397 dhcpcd_signals, dhcpcd_signals_len, signal_cb, ctx); 398 399 /* ctx->sigset aready has the initial sigmask set in main() */ 400 if (eloop_signal_mask(ctx->eloop, NULL) == -1) { 401 logerr("%s: eloop_signal_mask", __func__); 402 goto errexit; 403 } 404 405 if (eloop_event_add(ctx->eloop, *priv_fd, recv_msg, recv_ctx) == -1) 406 { 407 logerr("%s: eloop_event_add", __func__); 408 goto errexit; 409 } 410 411 if (callback(recv_ctx) == -1) 412 goto errexit; 413 414 if (flags & PSF_DROPPRIVS) 415 ps_dropprivs(ctx); 416 417 return 0; 418 419 errexit: 420 /* Failure to start root or inet processes is fatal. */ 421 if (priv_fd == &ctx->ps_root_fd || priv_fd == &ctx->ps_inet_fd) 422 (void)ps_sendcmd(ctx, *priv_fd, PS_STOP, 0, NULL, 0); 423 shutdown(*priv_fd, SHUT_RDWR); 424 *priv_fd = -1; 425 eloop_exit(ctx->eloop, EXIT_FAILURE); 426 return -1; 427 } 428 429 int 430 ps_dostop(struct dhcpcd_ctx *ctx, pid_t *pid, int *fd) 431 { 432 int err = 0; 433 434 #ifdef PRIVSEP_DEBUG 435 logdebugx("%s: pid=%d fd=%d", __func__, *pid, *fd); 436 #endif 437 438 if (*fd != -1) { 439 eloop_event_delete(ctx->eloop, *fd); 440 if (ps_sendcmd(ctx, *fd, PS_STOP, 0, NULL, 0) == -1) { 441 logerr(__func__); 442 err = -1; 443 } 444 (void)shutdown(*fd, SHUT_RDWR); 445 close(*fd); 446 *fd = -1; 447 } 448 449 /* Don't wait for the process as it may not respond to the shutdown 450 * request. We'll reap the process on receipt of SIGCHLD. */ 451 *pid = 0; 452 return err; 453 } 454 455 int 456 ps_start(struct dhcpcd_ctx *ctx) 457 { 458 pid_t pid; 459 460 TAILQ_INIT(&ctx->ps_processes); 461 462 switch (pid = ps_root_start(ctx)) { 463 case -1: 464 logerr("ps_root_start"); 465 return -1; 466 case 0: 467 return 0; 468 default: 469 logdebugx("spawned privileged actioneer on PID %d", pid); 470 } 471 472 /* No point in spawning the generic network listener if we're 473 * not going to use it. */ 474 if (!ps_inet_canstart(ctx)) 475 goto started_net; 476 477 switch (pid = ps_inet_start(ctx)) { 478 case -1: 479 return -1; 480 case 0: 481 return 0; 482 default: 483 logdebugx("spawned network proxy on PID %d", pid); 484 } 485 486 started_net: 487 if (!(ctx->options & DHCPCD_TEST)) { 488 switch (pid = ps_ctl_start(ctx)) { 489 case -1: 490 return -1; 491 case 0: 492 return 0; 493 default: 494 logdebugx("spawned controller proxy on PID %d", pid); 495 } 496 } 497 498 #ifdef ARC4RANDOM_H 499 /* Seed the random number generator early incase it needs /dev/urandom 500 * which won't be available in the chroot. */ 501 arc4random(); 502 #endif 503 504 return 1; 505 } 506 507 int 508 ps_entersandbox(const char *_pledge, const char **sandbox) 509 { 510 511 #if !defined(HAVE_PLEDGE) 512 UNUSED(_pledge); 513 #endif 514 515 #if defined(HAVE_CAPSICUM) 516 if (sandbox != NULL) 517 *sandbox = "capsicum"; 518 return cap_enter(); 519 #elif defined(HAVE_PLEDGE) 520 if (sandbox != NULL) 521 *sandbox = "pledge"; 522 return pledge(_pledge, NULL); 523 #elif defined(HAVE_SECCOMP) 524 if (sandbox != NULL) 525 *sandbox = "seccomp"; 526 return ps_seccomp_enter(); 527 #else 528 if (sandbox != NULL) 529 *sandbox = "posix resource limited"; 530 return 0; 531 #endif 532 } 533 534 int 535 ps_mastersandbox(struct dhcpcd_ctx *ctx, const char *_pledge) 536 { 537 const char *sandbox = NULL; 538 bool forked; 539 int dropped; 540 541 forked = ctx->options & DHCPCD_FORKED; 542 ctx->options &= ~DHCPCD_FORKED; 543 dropped = ps_dropprivs(ctx); 544 if (forked) 545 ctx->options |= DHCPCD_FORKED; 546 547 /* 548 * If we don't have a root process, we cannot use syslog. 549 * If it cannot be opened before chrooting then syslog(3) will fail. 550 * openlog(3) does not return an error which doubly sucks. 551 */ 552 if (ctx->ps_root_fd == -1) { 553 unsigned int logopts = loggetopts(); 554 555 logopts &= ~LOGERR_LOG; 556 logsetopts(logopts); 557 } 558 559 if (dropped == -1) { 560 logerr("%s: ps_dropprivs", __func__); 561 return -1; 562 } 563 564 #ifdef PRIVSEP_RIGHTS 565 if ((ctx->pf_inet_fd != -1 && 566 ps_rights_limit_ioctl(ctx->pf_inet_fd) == -1) || 567 ps_rights_limit_stdio(ctx) == -1) 568 { 569 logerr("%s: cap_rights_limit", __func__); 570 return -1; 571 } 572 #endif 573 574 if (_pledge == NULL) 575 _pledge = "stdio"; 576 if (ps_entersandbox(_pledge, &sandbox) == -1) { 577 if (errno == ENOSYS) { 578 if (sandbox != NULL) 579 logwarnx("sandbox unavailable: %s", sandbox); 580 return 0; 581 } 582 logerr("%s: %s", __func__, sandbox); 583 return -1; 584 } else if (ctx->options & DHCPCD_LAUNCHER) 585 logdebugx("sandbox: %s", sandbox); 586 return 0; 587 } 588 589 int 590 ps_stop(struct dhcpcd_ctx *ctx) 591 { 592 int r, ret = 0; 593 594 if (!(ctx->options & DHCPCD_PRIVSEP) || 595 ctx->options & DHCPCD_FORKED || 596 ctx->eloop == NULL) 597 return 0; 598 599 r = ps_ctl_stop(ctx); 600 if (r != 0) 601 ret = r; 602 603 r = ps_inet_stop(ctx); 604 if (r != 0) 605 ret = r; 606 607 /* We've been chrooted, so we need to tell the 608 * privileged actioneer to remove the pidfile. */ 609 ps_root_unlink(ctx, ctx->pidfile); 610 611 r = ps_root_stop(ctx); 612 if (r != 0) 613 ret = r; 614 615 ctx->options &= ~DHCPCD_PRIVSEP; 616 return ret; 617 } 618 619 void 620 ps_freeprocess(struct ps_process *psp) 621 { 622 623 TAILQ_REMOVE(&psp->psp_ctx->ps_processes, psp, next); 624 if (psp->psp_fd != -1) { 625 eloop_event_delete(psp->psp_ctx->eloop, psp->psp_fd); 626 close(psp->psp_fd); 627 } 628 if (psp->psp_work_fd != -1) { 629 eloop_event_delete(psp->psp_ctx->eloop, psp->psp_work_fd); 630 close(psp->psp_work_fd); 631 } 632 #ifdef INET 633 if (psp->psp_bpf != NULL) 634 bpf_close(psp->psp_bpf); 635 #endif 636 free(psp); 637 } 638 639 static void 640 ps_free(struct dhcpcd_ctx *ctx) 641 { 642 struct ps_process *psp; 643 bool stop = ctx->ps_root_pid == getpid(); 644 645 while ((psp = TAILQ_FIRST(&ctx->ps_processes)) != NULL) { 646 if (stop) 647 ps_dostop(ctx, &psp->psp_pid, &psp->psp_fd); 648 ps_freeprocess(psp); 649 } 650 } 651 652 int 653 ps_unrollmsg(struct msghdr *msg, struct ps_msghdr *psm, 654 const void *data, size_t len) 655 { 656 uint8_t *datap, *namep, *controlp; 657 658 namep = UNCONST(data); 659 controlp = namep + psm->ps_namelen; 660 datap = controlp + psm->ps_controllen; 661 662 if (psm->ps_namelen != 0) { 663 if (psm->ps_namelen > len) { 664 errno = EINVAL; 665 return -1; 666 } 667 msg->msg_name = namep; 668 len -= psm->ps_namelen; 669 } else 670 msg->msg_name = NULL; 671 msg->msg_namelen = psm->ps_namelen; 672 673 if (psm->ps_controllen != 0) { 674 if (psm->ps_controllen > len) { 675 errno = EINVAL; 676 return -1; 677 } 678 msg->msg_control = controlp; 679 len -= psm->ps_controllen; 680 } else 681 msg->msg_control = NULL; 682 msg->msg_controllen = psm->ps_controllen; 683 684 if (len != 0) { 685 msg->msg_iovlen = 1; 686 msg->msg_iov[0].iov_base = datap; 687 msg->msg_iov[0].iov_len = len; 688 } else { 689 msg->msg_iovlen = 0; 690 msg->msg_iov[0].iov_base = NULL; 691 msg->msg_iov[0].iov_len = 0; 692 } 693 return 0; 694 } 695 696 ssize_t 697 ps_sendpsmmsg(struct dhcpcd_ctx *ctx, int fd, 698 struct ps_msghdr *psm, const struct msghdr *msg) 699 { 700 struct iovec iov[] = { 701 { .iov_base = UNCONST(psm), .iov_len = sizeof(*psm) }, 702 { .iov_base = NULL, }, /* name */ 703 { .iov_base = NULL, }, /* control */ 704 { .iov_base = NULL, }, /* payload 1 */ 705 { .iov_base = NULL, }, /* payload 2 */ 706 { .iov_base = NULL, }, /* payload 3 */ 707 }; 708 int iovlen; 709 ssize_t len; 710 711 if (msg != NULL) { 712 struct iovec *iovp = &iov[1]; 713 int i; 714 715 psm->ps_namelen = msg->msg_namelen; 716 psm->ps_controllen = (socklen_t)msg->msg_controllen; 717 718 iovp->iov_base = msg->msg_name; 719 iovp->iov_len = msg->msg_namelen; 720 iovp++; 721 iovp->iov_base = msg->msg_control; 722 iovp->iov_len = msg->msg_controllen; 723 iovlen = 3; 724 725 for (i = 0; i < (int)msg->msg_iovlen; i++) { 726 if ((size_t)(iovlen + i) > __arraycount(iov)) { 727 errno = ENOBUFS; 728 return -1; 729 } 730 iovp++; 731 iovp->iov_base = msg->msg_iov[i].iov_base; 732 iovp->iov_len = msg->msg_iov[i].iov_len; 733 } 734 iovlen += i; 735 } else 736 iovlen = 1; 737 738 len = writev(fd, iov, iovlen); 739 if (len == -1) { 740 logerr(__func__); 741 if (ctx->options & DHCPCD_FORKED && 742 !(ctx->options & DHCPCD_PRIVSEPROOT)) 743 eloop_exit(ctx->eloop, EXIT_FAILURE); 744 } 745 return len; 746 } 747 748 ssize_t 749 ps_sendpsmdata(struct dhcpcd_ctx *ctx, int fd, 750 struct ps_msghdr *psm, const void *data, size_t len) 751 { 752 struct iovec iov[] = { 753 { .iov_base = UNCONST(data), .iov_len = len }, 754 }; 755 struct msghdr msg = { 756 .msg_iov = iov, .msg_iovlen = 1, 757 }; 758 759 return ps_sendpsmmsg(ctx, fd, psm, &msg); 760 } 761 762 763 ssize_t 764 ps_sendmsg(struct dhcpcd_ctx *ctx, int fd, uint16_t cmd, unsigned long flags, 765 const struct msghdr *msg) 766 { 767 struct ps_msghdr psm = { 768 .ps_cmd = cmd, 769 .ps_flags = flags, 770 .ps_namelen = msg->msg_namelen, 771 .ps_controllen = (socklen_t)msg->msg_controllen, 772 }; 773 size_t i; 774 775 for (i = 0; i < (size_t)msg->msg_iovlen; i++) 776 psm.ps_datalen += msg->msg_iov[i].iov_len; 777 778 #if 0 /* For debugging structure padding. */ 779 logerrx("psa.family %lu %zu", offsetof(struct ps_addr, psa_family), sizeof(psm.ps_id.psi_addr.psa_family)); 780 logerrx("psa.pad %lu %zu", offsetof(struct ps_addr, psa_pad), sizeof(psm.ps_id.psi_addr.psa_pad)); 781 logerrx("psa.psa_u %lu %zu", offsetof(struct ps_addr, psa_u), sizeof(psm.ps_id.psi_addr.psa_u)); 782 logerrx("psa %zu", sizeof(psm.ps_id.psi_addr)); 783 784 logerrx("psi.addr %lu %zu", offsetof(struct ps_id, psi_addr), sizeof(psm.ps_id.psi_addr)); 785 logerrx("psi.index %lu %zu", offsetof(struct ps_id, psi_ifindex), sizeof(psm.ps_id.psi_ifindex)); 786 logerrx("psi.cmd %lu %zu", offsetof(struct ps_id, psi_cmd), sizeof(psm.ps_id.psi_cmd)); 787 logerrx("psi.pad %lu %zu", offsetof(struct ps_id, psi_pad), sizeof(psm.ps_id.psi_pad)); 788 logerrx("psi %zu", sizeof(struct ps_id)); 789 790 logerrx("ps_cmd %lu", offsetof(struct ps_msghdr, ps_cmd)); 791 logerrx("ps_pad %lu %zu", offsetof(struct ps_msghdr, ps_pad), sizeof(psm.ps_pad)); 792 logerrx("ps_flags %lu %zu", offsetof(struct ps_msghdr, ps_flags), sizeof(psm.ps_flags)); 793 794 logerrx("ps_id %lu %zu", offsetof(struct ps_msghdr, ps_id), sizeof(psm.ps_id)); 795 796 logerrx("ps_namelen %lu %zu", offsetof(struct ps_msghdr, ps_namelen), sizeof(psm.ps_namelen)); 797 logerrx("ps_controllen %lu %zu", offsetof(struct ps_msghdr, ps_controllen), sizeof(psm.ps_controllen)); 798 logerrx("ps_pad2 %lu %zu", offsetof(struct ps_msghdr, ps_pad2), sizeof(psm.ps_pad2)); 799 logerrx("ps_datalen %lu %zu", offsetof(struct ps_msghdr, ps_datalen), sizeof(psm.ps_datalen)); 800 logerrx("psm %zu", sizeof(psm)); 801 #endif 802 803 return ps_sendpsmmsg(ctx, fd, &psm, msg); 804 } 805 806 ssize_t 807 ps_sendcmd(struct dhcpcd_ctx *ctx, int fd, uint16_t cmd, unsigned long flags, 808 const void *data, size_t len) 809 { 810 struct ps_msghdr psm = { 811 .ps_cmd = cmd, 812 .ps_flags = flags, 813 }; 814 struct iovec iov[] = { 815 { .iov_base = UNCONST(data), .iov_len = len } 816 }; 817 struct msghdr msg = { 818 .msg_iov = iov, .msg_iovlen = 1, 819 }; 820 821 return ps_sendpsmmsg(ctx, fd, &psm, &msg); 822 } 823 824 static ssize_t 825 ps_sendcmdmsg(int fd, uint16_t cmd, const struct msghdr *msg) 826 { 827 struct ps_msghdr psm = { .ps_cmd = cmd }; 828 uint8_t data[PS_BUFLEN], *p = data; 829 struct iovec iov[] = { 830 { .iov_base = &psm, .iov_len = sizeof(psm) }, 831 { .iov_base = data, .iov_len = 0 }, 832 }; 833 size_t dl = sizeof(data); 834 835 if (msg->msg_namelen != 0) { 836 if (msg->msg_namelen > dl) 837 goto nobufs; 838 psm.ps_namelen = msg->msg_namelen; 839 memcpy(p, msg->msg_name, msg->msg_namelen); 840 p += msg->msg_namelen; 841 dl -= msg->msg_namelen; 842 } 843 844 if (msg->msg_controllen != 0) { 845 if (msg->msg_controllen > dl) 846 goto nobufs; 847 psm.ps_controllen = (socklen_t)msg->msg_controllen; 848 memcpy(p, msg->msg_control, msg->msg_controllen); 849 p += msg->msg_controllen; 850 dl -= msg->msg_controllen; 851 } 852 853 psm.ps_datalen = msg->msg_iov[0].iov_len; 854 if (psm.ps_datalen > dl) 855 goto nobufs; 856 857 iov[1].iov_len = psm.ps_namelen + psm.ps_controllen + psm.ps_datalen; 858 if (psm.ps_datalen != 0) 859 memcpy(p, msg->msg_iov[0].iov_base, psm.ps_datalen); 860 return writev(fd, iov, __arraycount(iov)); 861 862 nobufs: 863 errno = ENOBUFS; 864 return -1; 865 } 866 867 ssize_t 868 ps_recvmsg(struct dhcpcd_ctx *ctx, int rfd, uint16_t cmd, int wfd) 869 { 870 struct sockaddr_storage ss = { .ss_family = AF_UNSPEC }; 871 uint8_t controlbuf[sizeof(struct sockaddr_storage)] = { 0 }; 872 uint8_t databuf[64 * 1024]; 873 struct iovec iov[] = { 874 { .iov_base = databuf, .iov_len = sizeof(databuf) } 875 }; 876 struct msghdr msg = { 877 .msg_name = &ss, .msg_namelen = sizeof(ss), 878 .msg_control = controlbuf, .msg_controllen = sizeof(controlbuf), 879 .msg_iov = iov, .msg_iovlen = 1, 880 }; 881 882 ssize_t len = recvmsg(rfd, &msg, 0); 883 884 if (len == -1) 885 logerr("%s: recvmsg", __func__); 886 if (len == -1 || len == 0) { 887 if (ctx->options & DHCPCD_FORKED && 888 !(ctx->options & DHCPCD_PRIVSEPROOT)) 889 eloop_exit(ctx->eloop, 890 len == 0 ? EXIT_SUCCESS : EXIT_FAILURE); 891 return len; 892 } 893 894 iov[0].iov_len = (size_t)len; 895 len = ps_sendcmdmsg(wfd, cmd, &msg); 896 if (len == -1) { 897 logerr("ps_sendcmdmsg"); 898 if (ctx->options & DHCPCD_FORKED && 899 !(ctx->options & DHCPCD_PRIVSEPROOT)) 900 eloop_exit(ctx->eloop, EXIT_FAILURE); 901 } 902 return len; 903 } 904 905 ssize_t 906 ps_recvpsmsg(struct dhcpcd_ctx *ctx, int fd, 907 ssize_t (*callback)(void *, struct ps_msghdr *, struct msghdr *), 908 void *cbctx) 909 { 910 struct ps_msg psm; 911 ssize_t len; 912 size_t dlen; 913 struct iovec iov[1]; 914 struct msghdr msg = { .msg_iov = iov, .msg_iovlen = 1 }; 915 bool stop = false; 916 917 len = read(fd, &psm, sizeof(psm)); 918 #ifdef PRIVSEP_DEBUG 919 logdebugx("%s: %zd", __func__, len); 920 #endif 921 922 if (len == -1 || len == 0) 923 stop = true; 924 else { 925 dlen = (size_t)len; 926 if (dlen < sizeof(psm.psm_hdr)) { 927 errno = EINVAL; 928 return -1; 929 } 930 931 if (psm.psm_hdr.ps_cmd == PS_STOP) { 932 stop = true; 933 len = 0; 934 } 935 } 936 937 if (stop) { 938 #ifdef PRIVSEP_DEBUG 939 logdebugx("process %d stopping", getpid()); 940 #endif 941 ps_free(ctx); 942 #ifdef PLUGIN_DEV 943 dev_stop(ctx); 944 #endif 945 eloop_exit(ctx->eloop, len != -1 ? EXIT_SUCCESS : EXIT_FAILURE); 946 return len; 947 } 948 dlen -= sizeof(psm.psm_hdr); 949 950 if (ps_unrollmsg(&msg, &psm.psm_hdr, psm.psm_data, dlen) == -1) 951 return -1; 952 953 if (callback == NULL) 954 return 0; 955 956 errno = 0; 957 return callback(cbctx, &psm.psm_hdr, &msg); 958 } 959 960 struct ps_process * 961 ps_findprocess(struct dhcpcd_ctx *ctx, struct ps_id *psid) 962 { 963 struct ps_process *psp; 964 965 TAILQ_FOREACH(psp, &ctx->ps_processes, next) { 966 if (memcmp(&psp->psp_id, psid, sizeof(psp->psp_id)) == 0) 967 return psp; 968 } 969 errno = ESRCH; 970 return NULL; 971 } 972 973 struct ps_process * 974 ps_newprocess(struct dhcpcd_ctx *ctx, struct ps_id *psid) 975 { 976 struct ps_process *psp; 977 978 psp = calloc(1, sizeof(*psp)); 979 if (psp == NULL) 980 return NULL; 981 psp->psp_ctx = ctx; 982 memcpy(&psp->psp_id, psid, sizeof(psp->psp_id)); 983 psp->psp_work_fd = -1; 984 TAILQ_INSERT_TAIL(&ctx->ps_processes, psp, next); 985 return psp; 986 } 987 988 void 989 ps_freeprocesses(struct dhcpcd_ctx *ctx, struct ps_process *notthis) 990 { 991 struct ps_process *psp, *psn; 992 993 TAILQ_FOREACH_SAFE(psp, &ctx->ps_processes, next, psn) { 994 if (psp == notthis) 995 continue; 996 ps_freeprocess(psp); 997 } 998 } 999