1 /* $OpenBSD: constraint.c,v 1.51 2021/03/18 11:17:04 bluhm Exp $ */ 2 3 /* 4 * Copyright (c) 2015 Reyk Floeter <reyk@openbsd.org> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 #include <sys/queue.h> 20 #include <sys/socket.h> 21 #include <sys/time.h> 22 #include <sys/types.h> 23 #include <sys/wait.h> 24 #include <sys/resource.h> 25 #include <sys/uio.h> 26 27 #include <netinet/in.h> 28 #include <arpa/inet.h> 29 30 #include <errno.h> 31 #include <stdio.h> 32 #include <stdlib.h> 33 #include <fcntl.h> 34 #include <imsg.h> 35 #include <netdb.h> 36 #include <poll.h> 37 #include <signal.h> 38 #include <string.h> 39 #include <unistd.h> 40 #include <time.h> 41 #include <ctype.h> 42 #include <tls.h> 43 #include <pwd.h> 44 #include <math.h> 45 46 #include "ntpd.h" 47 48 #define IMF_FIXDATE "%a, %d %h %Y %T GMT" 49 #define X509_DATE "%Y-%m-%d %T UTC" 50 51 int constraint_addr_init(struct constraint *); 52 void constraint_addr_head_clear(struct constraint *); 53 struct constraint * 54 constraint_byid(u_int32_t); 55 struct constraint * 56 constraint_byfd(int); 57 struct constraint * 58 constraint_bypid(pid_t); 59 int constraint_close(u_int32_t); 60 void constraint_update(void); 61 int constraint_cmp(const void *, const void *); 62 63 void priv_constraint_close(int, int); 64 void priv_constraint_readquery(struct constraint *, struct ntp_addr_msg *, 65 uint8_t **); 66 67 struct httpsdate * 68 httpsdate_init(const char *, const char *, const char *, 69 const char *, const u_int8_t *, size_t); 70 void httpsdate_free(void *); 71 int httpsdate_request(struct httpsdate *, struct timeval *); 72 void *httpsdate_query(const char *, const char *, const char *, 73 const char *, const u_int8_t *, size_t, 74 struct timeval *, struct timeval *); 75 76 char *tls_readline(struct tls *, size_t *, size_t *, struct timeval *); 77 78 u_int constraint_cnt; 79 extern u_int peer_cnt; 80 extern struct imsgbuf *ibuf; /* priv */ 81 extern struct imsgbuf *ibuf_main; /* chld */ 82 83 struct httpsdate { 84 char *tls_addr; 85 char *tls_port; 86 char *tls_hostname; 87 char *tls_path; 88 char *tls_request; 89 struct tls_config *tls_config; 90 struct tls *tls_ctx; 91 struct tm tls_tm; 92 }; 93 94 int 95 constraint_init(struct constraint *cstr) 96 { 97 cstr->state = STATE_NONE; 98 cstr->fd = -1; 99 cstr->last = getmonotime(); 100 cstr->constraint = 0; 101 cstr->senderrors = 0; 102 103 return (constraint_addr_init(cstr)); 104 } 105 106 int 107 constraint_addr_init(struct constraint *cstr) 108 { 109 struct sockaddr_in *sa_in; 110 struct sockaddr_in6 *sa_in6; 111 struct ntp_addr *h; 112 113 if (cstr->state == STATE_DNS_INPROGRESS) 114 return (0); 115 116 if (cstr->addr_head.a == NULL) { 117 priv_dns(IMSG_CONSTRAINT_DNS, cstr->addr_head.name, cstr->id); 118 cstr->state = STATE_DNS_INPROGRESS; 119 return (0); 120 } 121 122 h = cstr->addr; 123 switch (h->ss.ss_family) { 124 case AF_INET: 125 sa_in = (struct sockaddr_in *)&h->ss; 126 if (ntohs(sa_in->sin_port) == 0) 127 sa_in->sin_port = htons(443); 128 cstr->state = STATE_DNS_DONE; 129 break; 130 case AF_INET6: 131 sa_in6 = (struct sockaddr_in6 *)&h->ss; 132 if (ntohs(sa_in6->sin6_port) == 0) 133 sa_in6->sin6_port = htons(443); 134 cstr->state = STATE_DNS_DONE; 135 break; 136 default: 137 /* XXX king bula sez it? */ 138 fatalx("wrong AF in constraint_addr_init"); 139 /* NOTREACHED */ 140 } 141 142 return (1); 143 } 144 145 void 146 constraint_addr_head_clear(struct constraint *cstr) 147 { 148 host_dns_free(cstr->addr_head.a); 149 cstr->addr_head.a = NULL; 150 cstr->addr = NULL; 151 } 152 153 int 154 constraint_query(struct constraint *cstr) 155 { 156 time_t now; 157 struct ntp_addr_msg am; 158 struct iovec iov[3]; 159 int iov_cnt = 0; 160 161 now = getmonotime(); 162 163 switch (cstr->state) { 164 case STATE_DNS_DONE: 165 /* Proceed and query the time */ 166 break; 167 case STATE_DNS_TEMPFAIL: 168 if (now > cstr->last + (cstr->dnstries >= TRIES_AUTO_DNSFAIL ? 169 CONSTRAINT_RETRY_INTERVAL : INTERVAL_AUIO_DNSFAIL)) { 170 cstr->dnstries++; 171 /* Retry resolving the address */ 172 constraint_init(cstr); 173 return 0; 174 } 175 return (-1); 176 case STATE_QUERY_SENT: 177 if (cstr->last + CONSTRAINT_SCAN_TIMEOUT > now) { 178 /* The caller should expect a reply */ 179 return (0); 180 } 181 182 /* Timeout, just kill the process to reset it. */ 183 imsg_compose(ibuf_main, IMSG_CONSTRAINT_KILL, 184 cstr->id, 0, -1, NULL, 0); 185 186 cstr->state = STATE_TIMEOUT; 187 return (-1); 188 case STATE_INVALID: 189 if (cstr->last + CONSTRAINT_SCAN_INTERVAL > now) { 190 /* Nothing to do */ 191 return (-1); 192 } 193 194 /* Reset and retry */ 195 cstr->senderrors = 0; 196 constraint_close(cstr->id); 197 break; 198 case STATE_REPLY_RECEIVED: 199 default: 200 /* Nothing to do */ 201 return (-1); 202 } 203 204 cstr->last = now; 205 cstr->state = STATE_QUERY_SENT; 206 207 memset(&am, 0, sizeof(am)); 208 memcpy(&am.a, cstr->addr, sizeof(am.a)); 209 210 iov[iov_cnt].iov_base = &am; 211 iov[iov_cnt++].iov_len = sizeof(am); 212 if (cstr->addr_head.name) { 213 am.namelen = strlen(cstr->addr_head.name) + 1; 214 iov[iov_cnt].iov_base = cstr->addr_head.name; 215 iov[iov_cnt++].iov_len = am.namelen; 216 } 217 if (cstr->addr_head.path) { 218 am.pathlen = strlen(cstr->addr_head.path) + 1; 219 iov[iov_cnt].iov_base = cstr->addr_head.path; 220 iov[iov_cnt++].iov_len = am.pathlen; 221 } 222 223 imsg_composev(ibuf_main, IMSG_CONSTRAINT_QUERY, 224 cstr->id, 0, -1, iov, iov_cnt); 225 226 return (0); 227 } 228 229 void 230 priv_constraint_msg(u_int32_t id, u_int8_t *data, size_t len, int argc, 231 char **argv) 232 { 233 struct ntp_addr_msg am; 234 struct ntp_addr *h; 235 struct constraint *cstr; 236 int pipes[2]; 237 int rv; 238 239 if ((cstr = constraint_byid(id)) != NULL) { 240 log_warnx("IMSG_CONSTRAINT_QUERY repeated for id %d", id); 241 return; 242 } 243 244 if (len < sizeof(am)) { 245 log_warnx("invalid IMSG_CONSTRAINT_QUERY received"); 246 return; 247 } 248 memcpy(&am, data, sizeof(am)); 249 if (len != (sizeof(am) + am.namelen + am.pathlen)) { 250 log_warnx("invalid IMSG_CONSTRAINT_QUERY received"); 251 return; 252 } 253 /* Additional imsg data is obtained in the unpriv child */ 254 255 if ((h = calloc(1, sizeof(*h))) == NULL) 256 fatal("calloc ntp_addr"); 257 memcpy(h, &am.a, sizeof(*h)); 258 h->next = NULL; 259 260 cstr = new_constraint(); 261 cstr->id = id; 262 cstr->addr = h; 263 cstr->addr_head.a = h; 264 constraint_add(cstr); 265 constraint_cnt++; 266 267 if (socketpair(AF_UNIX, SOCK_DGRAM | SOCK_CLOEXEC, AF_UNSPEC, 268 pipes) == -1) 269 fatal("%s pipes", __func__); 270 271 /* Prepare and send constraint data to child. */ 272 cstr->fd = pipes[0]; 273 imsg_init(&cstr->ibuf, cstr->fd); 274 if (imsg_compose(&cstr->ibuf, IMSG_CONSTRAINT_QUERY, id, 0, -1, 275 data, len) == -1) 276 fatal("%s: imsg_compose", __func__); 277 do { 278 rv = imsg_flush(&cstr->ibuf); 279 } while (rv == -1 && errno == EAGAIN); 280 if (rv == -1) 281 fatal("imsg_flush"); 282 283 /* 284 * Fork child handlers and make sure to do any sensitive work in the 285 * the (unprivileged) child. The parent should not do any parsing, 286 * certificate loading etc. 287 */ 288 cstr->pid = start_child(CONSTRAINT_PROC_NAME, pipes[1], argc, argv); 289 } 290 291 void 292 priv_constraint_readquery(struct constraint *cstr, struct ntp_addr_msg *am, 293 uint8_t **data) 294 { 295 struct ntp_addr *h; 296 uint8_t *dptr; 297 int n; 298 struct imsg imsg; 299 size_t mlen; 300 301 /* Read the message our parent left us. */ 302 if (((n = imsg_read(&cstr->ibuf)) == -1 && errno != EAGAIN) || n == 0) 303 fatal("%s: imsg_read", __func__); 304 if (((n = imsg_get(&cstr->ibuf, &imsg)) == -1) || n == 0) 305 fatal("%s: imsg_get", __func__); 306 if (imsg.hdr.type != IMSG_CONSTRAINT_QUERY) 307 fatalx("%s: invalid message type", __func__); 308 309 /* 310 * Copy the message contents just like our father: 311 * priv_constraint_msg(). 312 */ 313 mlen = imsg.hdr.len - IMSG_HEADER_SIZE; 314 if (mlen < sizeof(*am)) 315 fatalx("%s: mlen < sizeof(*am)", __func__); 316 317 memcpy(am, imsg.data, sizeof(*am)); 318 if (mlen != (sizeof(*am) + am->namelen + am->pathlen)) 319 fatalx("%s: mlen < sizeof(*am) + am->namelen + am->pathlen", 320 __func__); 321 322 if ((h = calloc(1, sizeof(*h))) == NULL || 323 (*data = calloc(1, mlen)) == NULL) 324 fatal("%s: calloc", __func__); 325 326 memcpy(h, &am->a, sizeof(*h)); 327 h->next = NULL; 328 329 cstr->id = imsg.hdr.peerid; 330 cstr->addr = h; 331 cstr->addr_head.a = h; 332 333 dptr = imsg.data; 334 memcpy(*data, dptr + sizeof(*am), mlen - sizeof(*am)); 335 imsg_free(&imsg); 336 } 337 338 void 339 priv_constraint_child(const char *pw_dir, uid_t pw_uid, gid_t pw_gid) 340 { 341 struct constraint cstr; 342 struct ntp_addr_msg am; 343 uint8_t *data; 344 static char addr[NI_MAXHOST]; 345 struct timeval rectv, xmttv; 346 struct sigaction sa; 347 void *ctx; 348 struct iovec iov[2]; 349 int i, rv; 350 351 log_procinit("constraint"); 352 353 if (setpriority(PRIO_PROCESS, 0, 0) == -1) 354 log_warn("could not set priority"); 355 356 /* Init TLS and load CA certs before chroot() */ 357 if (tls_init() == -1) 358 fatalx("tls_init"); 359 if ((conf->ca = tls_load_file(tls_default_ca_cert_file(), 360 &conf->ca_len, NULL)) == NULL) 361 fatalx("failed to load constraint ca"); 362 363 if (chroot(pw_dir) == -1) 364 fatal("chroot"); 365 if (chdir("/") == -1) 366 fatal("chdir(\"/\")"); 367 368 if (setgroups(1, &pw_gid) || 369 setresgid(pw_gid, pw_gid, pw_gid) || 370 setresuid(pw_uid, pw_uid, pw_uid)) 371 fatal("can't drop privileges"); 372 373 /* Reset all signal handlers */ 374 memset(&sa, 0, sizeof(sa)); 375 sigemptyset(&sa.sa_mask); 376 sa.sa_flags = SA_RESTART; 377 sa.sa_handler = SIG_DFL; 378 for (i = 1; i < _NSIG; i++) 379 sigaction(i, &sa, NULL); 380 381 if (pledge("stdio inet", NULL) == -1) 382 fatal("pledge"); 383 384 cstr.fd = CONSTRAINT_PASSFD; 385 imsg_init(&cstr.ibuf, cstr.fd); 386 priv_constraint_readquery(&cstr, &am, &data); 387 388 /* 389 * Get the IP address as name and set the process title accordingly. 390 * This only converts an address into a string and does not trigger 391 * any DNS operation, so it is safe to be called without the dns 392 * pledge. 393 */ 394 if (getnameinfo((struct sockaddr *)&cstr.addr->ss, 395 SA_LEN((struct sockaddr *)&cstr.addr->ss), 396 addr, sizeof(addr), NULL, 0, 397 NI_NUMERICHOST) != 0) 398 fatalx("%s getnameinfo", __func__); 399 400 log_debug("constraint request to %s", addr); 401 setproctitle("constraint from %s", addr); 402 (void)closefrom(CONSTRAINT_PASSFD + 1); 403 404 /* 405 * Set the close-on-exec flag to prevent leaking the communication 406 * channel to any exec'ed child. In theory this could never happen, 407 * constraints don't exec children and pledge() prevents it, 408 * but we keep it as a safety belt; especially for portability. 409 */ 410 if (fcntl(CONSTRAINT_PASSFD, F_SETFD, FD_CLOEXEC) == -1) 411 fatal("%s fcntl F_SETFD", __func__); 412 413 /* Get remaining data from imsg in the unpriv child */ 414 if (am.namelen) { 415 if ((cstr.addr_head.name = 416 get_string(data, am.namelen)) == NULL) 417 fatalx("invalid IMSG_CONSTRAINT_QUERY name"); 418 data += am.namelen; 419 } 420 if (am.pathlen) { 421 if ((cstr.addr_head.path = 422 get_string(data, am.pathlen)) == NULL) 423 fatalx("invalid IMSG_CONSTRAINT_QUERY path"); 424 } 425 426 /* Run! */ 427 if ((ctx = httpsdate_query(addr, 428 CONSTRAINT_PORT, cstr.addr_head.name, cstr.addr_head.path, 429 conf->ca, conf->ca_len, &rectv, &xmttv)) == NULL) { 430 /* Abort with failure but without warning */ 431 exit(1); 432 } 433 434 iov[0].iov_base = &rectv; 435 iov[0].iov_len = sizeof(rectv); 436 iov[1].iov_base = &xmttv; 437 iov[1].iov_len = sizeof(xmttv); 438 imsg_composev(&cstr.ibuf, 439 IMSG_CONSTRAINT_RESULT, 0, 0, -1, iov, 2); 440 do { 441 rv = imsg_flush(&cstr.ibuf); 442 } while (rv == -1 && errno == EAGAIN); 443 444 /* Tear down the TLS connection after sending the result */ 445 httpsdate_free(ctx); 446 447 exit(0); 448 } 449 450 void 451 priv_constraint_check_child(pid_t pid, int status) 452 { 453 struct constraint *cstr; 454 int fail, sig; 455 char *signame; 456 457 fail = sig = 0; 458 if (WIFSIGNALED(status)) { 459 sig = WTERMSIG(status); 460 } else if (WIFEXITED(status)) { 461 if (WEXITSTATUS(status) != 0) 462 fail = 1; 463 } else 464 fatalx("unexpected cause of SIGCHLD"); 465 466 if ((cstr = constraint_bypid(pid)) != NULL) { 467 if (sig) { 468 if (sig != SIGTERM) { 469 signame = strsignal(sig) ? 470 strsignal(sig) : "unknown"; 471 log_warnx("constraint %s; " 472 "terminated with signal %d (%s)", 473 log_sockaddr((struct sockaddr *) 474 &cstr->addr->ss), sig, signame); 475 } 476 fail = 1; 477 } 478 479 priv_constraint_close(cstr->fd, fail); 480 } 481 } 482 483 void 484 priv_constraint_kill(u_int32_t id) 485 { 486 struct constraint *cstr; 487 488 if ((cstr = constraint_byid(id)) == NULL) { 489 log_warnx("IMSG_CONSTRAINT_KILL for invalid id %d", id); 490 return; 491 } 492 493 kill(cstr->pid, SIGTERM); 494 } 495 496 struct constraint * 497 constraint_byid(u_int32_t id) 498 { 499 struct constraint *cstr; 500 501 TAILQ_FOREACH(cstr, &conf->constraints, entry) { 502 if (cstr->id == id) 503 return (cstr); 504 } 505 506 return (NULL); 507 } 508 509 struct constraint * 510 constraint_byfd(int fd) 511 { 512 struct constraint *cstr; 513 514 TAILQ_FOREACH(cstr, &conf->constraints, entry) { 515 if (cstr->fd == fd) 516 return (cstr); 517 } 518 519 return (NULL); 520 } 521 522 struct constraint * 523 constraint_bypid(pid_t pid) 524 { 525 struct constraint *cstr; 526 527 TAILQ_FOREACH(cstr, &conf->constraints, entry) { 528 if (cstr->pid == pid) 529 return (cstr); 530 } 531 532 return (NULL); 533 } 534 535 int 536 constraint_close(u_int32_t id) 537 { 538 struct constraint *cstr; 539 540 if ((cstr = constraint_byid(id)) == NULL) { 541 log_warn("%s: id %d: not found", __func__, id); 542 return (0); 543 } 544 545 cstr->last = getmonotime(); 546 547 if (cstr->addr == NULL || (cstr->addr = cstr->addr->next) == NULL) { 548 /* Either a pool or all addresses have been tried */ 549 cstr->addr = cstr->addr_head.a; 550 if (cstr->senderrors) 551 cstr->state = STATE_INVALID; 552 else if (cstr->state >= STATE_QUERY_SENT) 553 cstr->state = STATE_DNS_DONE; 554 555 return (1); 556 } 557 558 /* Go on and try the next resolved address for this constraint */ 559 return (constraint_init(cstr)); 560 } 561 562 void 563 priv_constraint_close(int fd, int fail) 564 { 565 struct constraint *cstr; 566 u_int32_t id; 567 568 if ((cstr = constraint_byfd(fd)) == NULL) { 569 log_warn("%s: fd %d: not found", __func__, fd); 570 return; 571 } 572 573 id = cstr->id; 574 constraint_remove(cstr); 575 constraint_cnt--; 576 577 imsg_compose(ibuf, IMSG_CONSTRAINT_CLOSE, id, 0, -1, 578 &fail, sizeof(fail)); 579 } 580 581 void 582 constraint_add(struct constraint *cstr) 583 { 584 TAILQ_INSERT_TAIL(&conf->constraints, cstr, entry); 585 } 586 587 void 588 constraint_remove(struct constraint *cstr) 589 { 590 TAILQ_REMOVE(&conf->constraints, cstr, entry); 591 592 msgbuf_clear(&cstr->ibuf.w); 593 if (cstr->fd != -1) 594 close(cstr->fd); 595 free(cstr->addr_head.name); 596 free(cstr->addr_head.path); 597 free(cstr->addr); 598 free(cstr); 599 } 600 601 void 602 constraint_purge(void) 603 { 604 struct constraint *cstr, *ncstr; 605 606 TAILQ_FOREACH_SAFE(cstr, &conf->constraints, entry, ncstr) 607 constraint_remove(cstr); 608 } 609 610 int 611 priv_constraint_dispatch(struct pollfd *pfd) 612 { 613 struct imsg imsg; 614 struct constraint *cstr; 615 ssize_t n; 616 struct timeval tv[2]; 617 618 if ((cstr = constraint_byfd(pfd->fd)) == NULL) 619 return (0); 620 621 if (!(pfd->revents & POLLIN)) 622 return (0); 623 624 if (((n = imsg_read(&cstr->ibuf)) == -1 && errno != EAGAIN) || n == 0) { 625 /* there's a race between SIGCHLD delivery and reading imsg 626 but if we've seen the reply, we're good */ 627 priv_constraint_close(pfd->fd, cstr->state != 628 STATE_REPLY_RECEIVED); 629 return (1); 630 } 631 632 for (;;) { 633 if ((n = imsg_get(&cstr->ibuf, &imsg)) == -1) { 634 priv_constraint_close(pfd->fd, 1); 635 return (1); 636 } 637 if (n == 0) 638 break; 639 640 switch (imsg.hdr.type) { 641 case IMSG_CONSTRAINT_RESULT: 642 if (imsg.hdr.len != IMSG_HEADER_SIZE + sizeof(tv)) 643 fatalx("invalid IMSG_CONSTRAINT received"); 644 645 /* state is maintained by child, but we want to 646 remember we've seen the result */ 647 cstr->state = STATE_REPLY_RECEIVED; 648 /* forward imsg to ntp child, don't parse it here */ 649 imsg_compose(ibuf, imsg.hdr.type, 650 cstr->id, 0, -1, imsg.data, sizeof(tv)); 651 break; 652 default: 653 break; 654 } 655 imsg_free(&imsg); 656 } 657 658 return (0); 659 } 660 661 void 662 constraint_msg_result(u_int32_t id, u_int8_t *data, size_t len) 663 { 664 struct constraint *cstr; 665 struct timeval tv[2]; 666 double offset; 667 668 if ((cstr = constraint_byid(id)) == NULL) { 669 log_warnx("IMSG_CONSTRAINT_CLOSE with invalid constraint id"); 670 return; 671 } 672 673 if (len != sizeof(tv)) { 674 log_warnx("invalid IMSG_CONSTRAINT received"); 675 return; 676 } 677 678 memcpy(tv, data, len); 679 680 offset = gettime_from_timeval(&tv[0]) - 681 gettime_from_timeval(&tv[1]); 682 683 log_info("constraint reply from %s: offset %f", 684 log_sockaddr((struct sockaddr *)&cstr->addr->ss), 685 offset); 686 687 cstr->state = STATE_REPLY_RECEIVED; 688 cstr->last = getmonotime(); 689 cstr->constraint = tv[0].tv_sec; 690 691 constraint_update(); 692 } 693 694 void 695 constraint_msg_close(u_int32_t id, u_int8_t *data, size_t len) 696 { 697 struct constraint *cstr, *tmp; 698 int fail, cnt; 699 static int total_fails; 700 701 if ((cstr = constraint_byid(id)) == NULL) { 702 log_warnx("IMSG_CONSTRAINT_CLOSE with invalid constraint id"); 703 return; 704 } 705 706 if (len != sizeof(int)) { 707 log_warnx("invalid IMSG_CONSTRAINT_CLOSE received"); 708 return; 709 } 710 711 memcpy(&fail, data, len); 712 713 if (fail) { 714 log_debug("no constraint reply from %s" 715 " received in time, next query %ds", 716 log_sockaddr((struct sockaddr *) 717 &cstr->addr->ss), CONSTRAINT_SCAN_INTERVAL); 718 719 cnt = 0; 720 TAILQ_FOREACH(tmp, &conf->constraints, entry) 721 cnt++; 722 if (cnt > 0 && ++total_fails >= cnt && 723 conf->constraint_median == 0) { 724 log_warnx("constraints configured but none available"); 725 total_fails = 0; 726 } 727 } 728 729 if (fail || cstr->state < STATE_QUERY_SENT) { 730 cstr->senderrors++; 731 constraint_close(cstr->id); 732 } 733 } 734 735 void 736 constraint_msg_dns(u_int32_t id, u_int8_t *data, size_t len) 737 { 738 struct constraint *cstr, *ncstr = NULL; 739 u_int8_t *p; 740 struct ntp_addr *h; 741 742 if ((cstr = constraint_byid(id)) == NULL) { 743 log_debug("IMSG_CONSTRAINT_DNS with invalid constraint id"); 744 return; 745 } 746 if (cstr->addr != NULL) { 747 log_warnx("IMSG_CONSTRAINT_DNS but addr != NULL!"); 748 return; 749 } 750 if (len == 0) { 751 log_debug("%s FAILED", __func__); 752 cstr->state = STATE_DNS_TEMPFAIL; 753 return; 754 } 755 756 if (len % (sizeof(struct sockaddr_storage) + sizeof(int)) != 0) 757 fatalx("IMSG_CONSTRAINT_DNS len"); 758 759 if (cstr->addr_head.pool) { 760 struct constraint *n, *tmp; 761 TAILQ_FOREACH_SAFE(n, &conf->constraints, entry, tmp) { 762 if (cstr->id == n->id) 763 continue; 764 if (cstr->addr_head.pool == n->addr_head.pool) 765 constraint_remove(n); 766 } 767 } 768 769 p = data; 770 do { 771 if ((h = calloc(1, sizeof(*h))) == NULL) 772 fatal("calloc ntp_addr"); 773 memcpy(&h->ss, p, sizeof(h->ss)); 774 p += sizeof(h->ss); 775 len -= sizeof(h->ss); 776 memcpy(&h->notauth, p, sizeof(int)); 777 p += sizeof(int); 778 len -= sizeof(int); 779 780 if (ncstr == NULL || cstr->addr_head.pool) { 781 ncstr = new_constraint(); 782 ncstr->addr = h; 783 ncstr->addr_head.a = h; 784 ncstr->addr_head.name = strdup(cstr->addr_head.name); 785 ncstr->addr_head.path = strdup(cstr->addr_head.path); 786 if (ncstr->addr_head.name == NULL || 787 ncstr->addr_head.path == NULL) 788 fatal("calloc name"); 789 ncstr->addr_head.pool = cstr->addr_head.pool; 790 ncstr->state = STATE_DNS_DONE; 791 constraint_add(ncstr); 792 constraint_cnt += constraint_init(ncstr); 793 } else { 794 h->next = ncstr->addr; 795 ncstr->addr = h; 796 ncstr->addr_head.a = h; 797 } 798 } while (len); 799 800 constraint_remove(cstr); 801 } 802 803 int 804 constraint_cmp(const void *a, const void *b) 805 { 806 time_t at = *(const time_t *)a; 807 time_t bt = *(const time_t *)b; 808 return at < bt ? -1 : (at > bt ? 1 : 0); 809 } 810 811 void 812 constraint_update(void) 813 { 814 struct constraint *cstr; 815 int cnt, i; 816 time_t *values; 817 time_t now; 818 819 now = getmonotime(); 820 821 cnt = 0; 822 TAILQ_FOREACH(cstr, &conf->constraints, entry) { 823 if (cstr->state != STATE_REPLY_RECEIVED) 824 continue; 825 cnt++; 826 } 827 if (cnt == 0) 828 return; 829 830 if ((values = calloc(cnt, sizeof(time_t))) == NULL) 831 fatal("calloc"); 832 833 i = 0; 834 TAILQ_FOREACH(cstr, &conf->constraints, entry) { 835 if (cstr->state != STATE_REPLY_RECEIVED) 836 continue; 837 values[i++] = cstr->constraint + (now - cstr->last); 838 } 839 840 qsort(values, cnt, sizeof(time_t), constraint_cmp); 841 842 /* calculate median */ 843 i = cnt / 2; 844 if (cnt % 2 == 0) 845 conf->constraint_median = (values[i - 1] + values[i]) / 2; 846 else 847 conf->constraint_median = values[i]; 848 849 conf->constraint_last = now; 850 851 free(values); 852 } 853 854 void 855 constraint_reset(void) 856 { 857 struct constraint *cstr; 858 859 TAILQ_FOREACH(cstr, &conf->constraints, entry) { 860 if (cstr->state == STATE_QUERY_SENT) 861 continue; 862 constraint_close(cstr->id); 863 constraint_addr_head_clear(cstr); 864 constraint_init(cstr); 865 } 866 conf->constraint_errors = 0; 867 } 868 869 int 870 constraint_check(double val) 871 { 872 struct timeval tv; 873 double diff; 874 time_t now; 875 876 if (conf->constraint_median == 0) 877 return (0); 878 879 /* Calculate the constraint with the current offset */ 880 now = getmonotime(); 881 tv.tv_sec = conf->constraint_median + (now - conf->constraint_last); 882 tv.tv_usec = 0; 883 diff = fabs(val - gettime_from_timeval(&tv)); 884 885 if (diff > CONSTRAINT_MARGIN) { 886 if (conf->constraint_errors++ > 887 (CONSTRAINT_ERROR_MARGIN * peer_cnt)) { 888 constraint_reset(); 889 } 890 891 return (-1); 892 } 893 894 return (0); 895 } 896 897 struct httpsdate * 898 httpsdate_init(const char *addr, const char *port, const char *hostname, 899 const char *path, const u_int8_t *ca, size_t ca_len) 900 { 901 struct httpsdate *httpsdate = NULL; 902 903 if ((httpsdate = calloc(1, sizeof(*httpsdate))) == NULL) 904 goto fail; 905 906 if (hostname == NULL) 907 hostname = addr; 908 909 if ((httpsdate->tls_addr = strdup(addr)) == NULL || 910 (httpsdate->tls_port = strdup(port)) == NULL || 911 (httpsdate->tls_hostname = strdup(hostname)) == NULL || 912 (httpsdate->tls_path = strdup(path)) == NULL) 913 goto fail; 914 915 if (asprintf(&httpsdate->tls_request, 916 "HEAD %s HTTP/1.1\r\nHost: %s\r\nConnection: close\r\n\r\n", 917 httpsdate->tls_path, httpsdate->tls_hostname) == -1) 918 goto fail; 919 920 if ((httpsdate->tls_config = tls_config_new()) == NULL) 921 goto fail; 922 if (tls_config_set_ca_mem(httpsdate->tls_config, ca, ca_len) == -1) 923 goto fail; 924 925 /* 926 * Due to the fact that we're trying to determine a constraint for time 927 * we do our own certificate validity checking, since the automatic 928 * version is based on our wallclock, which may well be inaccurate... 929 */ 930 tls_config_insecure_noverifytime(httpsdate->tls_config); 931 932 return (httpsdate); 933 934 fail: 935 httpsdate_free(httpsdate); 936 return (NULL); 937 } 938 939 void 940 httpsdate_free(void *arg) 941 { 942 struct httpsdate *httpsdate = arg; 943 if (httpsdate == NULL) 944 return; 945 if (httpsdate->tls_ctx) 946 tls_close(httpsdate->tls_ctx); 947 tls_free(httpsdate->tls_ctx); 948 tls_config_free(httpsdate->tls_config); 949 free(httpsdate->tls_addr); 950 free(httpsdate->tls_port); 951 free(httpsdate->tls_hostname); 952 free(httpsdate->tls_path); 953 free(httpsdate->tls_request); 954 free(httpsdate); 955 } 956 957 int 958 httpsdate_request(struct httpsdate *httpsdate, struct timeval *when) 959 { 960 char timebuf1[32], timebuf2[32]; 961 size_t outlen = 0, maxlength = CONSTRAINT_MAXHEADERLENGTH, len; 962 char *line, *p, *buf; 963 time_t httptime, notbefore, notafter; 964 struct tm *tm; 965 ssize_t ret; 966 967 if ((httpsdate->tls_ctx = tls_client()) == NULL) 968 goto fail; 969 970 if (tls_configure(httpsdate->tls_ctx, httpsdate->tls_config) == -1) 971 goto fail; 972 973 /* 974 * libtls expects an address string, which can also be a DNS name, 975 * but we pass a pre-resolved IP address string in tls_addr so it 976 * does not trigger any DNS operation and is safe to be called 977 * without the dns pledge. 978 */ 979 if (tls_connect_servername(httpsdate->tls_ctx, httpsdate->tls_addr, 980 httpsdate->tls_port, httpsdate->tls_hostname) == -1) { 981 log_debug("tls connect failed: %s (%s): %s", 982 httpsdate->tls_addr, httpsdate->tls_hostname, 983 tls_error(httpsdate->tls_ctx)); 984 goto fail; 985 } 986 987 buf = httpsdate->tls_request; 988 len = strlen(httpsdate->tls_request); 989 while (len > 0) { 990 ret = tls_write(httpsdate->tls_ctx, buf, len); 991 if (ret == TLS_WANT_POLLIN || ret == TLS_WANT_POLLOUT) 992 continue; 993 if (ret == -1) { 994 log_warnx("tls write failed: %s (%s): %s", 995 httpsdate->tls_addr, httpsdate->tls_hostname, 996 tls_error(httpsdate->tls_ctx)); 997 goto fail; 998 } 999 buf += ret; 1000 len -= ret; 1001 } 1002 1003 while ((line = tls_readline(httpsdate->tls_ctx, &outlen, 1004 &maxlength, when)) != NULL) { 1005 line[strcspn(line, "\r\n")] = '\0'; 1006 1007 if ((p = strchr(line, ' ')) == NULL || *p == '\0') 1008 goto next; 1009 *p++ = '\0'; 1010 if (strcasecmp("Date:", line) != 0) 1011 goto next; 1012 1013 /* 1014 * Expect the date/time format as IMF-fixdate which is 1015 * mandated by HTTP/1.1 in the new RFC 7231 and was 1016 * preferred by RFC 2616. Other formats would be RFC 850 1017 * or ANSI C's asctime() - the latter doesn't include 1018 * the timezone which is required here. 1019 */ 1020 if (strptime(p, IMF_FIXDATE, 1021 &httpsdate->tls_tm) == NULL) { 1022 log_warnx("unsupported date format"); 1023 free(line); 1024 return (-1); 1025 } 1026 1027 free(line); 1028 break; 1029 next: 1030 free(line); 1031 } 1032 1033 /* 1034 * Now manually check the validity of the certificate presented in the 1035 * TLS handshake, based on the time specified by the server's HTTP Date: 1036 * header. 1037 */ 1038 notbefore = tls_peer_cert_notbefore(httpsdate->tls_ctx); 1039 notafter = tls_peer_cert_notafter(httpsdate->tls_ctx); 1040 if ((httptime = timegm(&httpsdate->tls_tm)) == -1) 1041 goto fail; 1042 if (httptime <= notbefore) { 1043 if ((tm = gmtime(¬before)) == NULL) 1044 goto fail; 1045 if (strftime(timebuf1, sizeof(timebuf1), X509_DATE, tm) == 0) 1046 goto fail; 1047 if (strftime(timebuf2, sizeof(timebuf2), X509_DATE, 1048 &httpsdate->tls_tm) == 0) 1049 goto fail; 1050 log_warnx("tls certificate not yet valid: %s (%s): " 1051 "not before %s, now %s", httpsdate->tls_addr, 1052 httpsdate->tls_hostname, timebuf1, timebuf2); 1053 goto fail; 1054 } 1055 if (httptime >= notafter) { 1056 if ((tm = gmtime(¬after)) == NULL) 1057 goto fail; 1058 if (strftime(timebuf1, sizeof(timebuf1), X509_DATE, tm) == 0) 1059 goto fail; 1060 if (strftime(timebuf2, sizeof(timebuf2), X509_DATE, 1061 &httpsdate->tls_tm) == 0) 1062 goto fail; 1063 log_warnx("tls certificate expired: %s (%s): " 1064 "not after %s, now %s", httpsdate->tls_addr, 1065 httpsdate->tls_hostname, timebuf1, timebuf2); 1066 goto fail; 1067 } 1068 1069 return (0); 1070 1071 fail: 1072 httpsdate_free(httpsdate); 1073 return (-1); 1074 } 1075 1076 void * 1077 httpsdate_query(const char *addr, const char *port, const char *hostname, 1078 const char *path, const u_int8_t *ca, size_t ca_len, 1079 struct timeval *rectv, struct timeval *xmttv) 1080 { 1081 struct httpsdate *httpsdate; 1082 struct timeval when; 1083 time_t t; 1084 1085 if ((httpsdate = httpsdate_init(addr, port, hostname, path, 1086 ca, ca_len)) == NULL) 1087 return (NULL); 1088 1089 if (httpsdate_request(httpsdate, &when) == -1) 1090 return (NULL); 1091 1092 /* Return parsed date as local time */ 1093 t = timegm(&httpsdate->tls_tm); 1094 1095 /* Report parsed Date: as "received time" */ 1096 rectv->tv_sec = t; 1097 rectv->tv_usec = 0; 1098 1099 /* And add delay as "transmit time" */ 1100 xmttv->tv_sec = when.tv_sec; 1101 xmttv->tv_usec = when.tv_usec; 1102 1103 return (httpsdate); 1104 } 1105 1106 /* Based on SSL_readline in ftp/fetch.c */ 1107 char * 1108 tls_readline(struct tls *tls, size_t *lenp, size_t *maxlength, 1109 struct timeval *when) 1110 { 1111 size_t i, len; 1112 char *buf, *q, c; 1113 ssize_t ret; 1114 1115 len = 128; 1116 if ((buf = malloc(len)) == NULL) 1117 fatal("Can't allocate memory for transfer buffer"); 1118 for (i = 0; ; i++) { 1119 if (i >= len - 1) { 1120 if ((q = reallocarray(buf, len, 2)) == NULL) 1121 fatal("Can't expand transfer buffer"); 1122 buf = q; 1123 len *= 2; 1124 } 1125 again: 1126 ret = tls_read(tls, &c, 1); 1127 if (ret == TLS_WANT_POLLIN || ret == TLS_WANT_POLLOUT) 1128 goto again; 1129 if (ret == -1) { 1130 /* SSL read error, ignore */ 1131 free(buf); 1132 return (NULL); 1133 } 1134 1135 if (maxlength != NULL && (*maxlength)-- == 0) { 1136 log_warnx("maximum length exceeded"); 1137 free(buf); 1138 return (NULL); 1139 } 1140 1141 buf[i] = c; 1142 if (c == '\n') 1143 break; 1144 } 1145 *lenp = i; 1146 if (gettimeofday(when, NULL) == -1) 1147 fatal("gettimeofday"); 1148 return (buf); 1149 } 1150 1151 char * 1152 get_string(u_int8_t *ptr, size_t len) 1153 { 1154 size_t i; 1155 1156 for (i = 0; i < len; i++) 1157 if (!(isprint(ptr[i]) || isspace(ptr[i]))) 1158 break; 1159 1160 return strndup(ptr, i); 1161 } 1162