1 /* SPDX-License-Identifier: BSD-2-Clause */
2 /*
3 * dhcpcd - DHCP client daemon
4 * Copyright (c) 2006-2023 Roy Marples <roy@marples.name>
5 * All rights reserved
6
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include <sys/socket.h>
30 #include <sys/stat.h>
31 #include <sys/uio.h>
32 #include <sys/un.h>
33
34 #include <errno.h>
35 #include <fcntl.h>
36 #include <stdio.h>
37 #include <stdlib.h>
38 #include <string.h>
39 #include <time.h>
40 #include <unistd.h>
41
42 #include "config.h"
43 #include "common.h"
44 #include "dhcpcd.h"
45 #include "control.h"
46 #include "eloop.h"
47 #include "if.h"
48 #include "logerr.h"
49 #include "privsep.h"
50
51 #ifndef SUN_LEN
52 #define SUN_LEN(su) \
53 (sizeof(*(su)) - sizeof((su)->sun_path) + strlen((su)->sun_path))
54 #endif
55
56 static void control_handle_data(void *, unsigned short);
57
58 static void
control_queue_free(struct fd_list * fd)59 control_queue_free(struct fd_list *fd)
60 {
61 struct fd_data *fdp;
62
63 while ((fdp = TAILQ_FIRST(&fd->queue))) {
64 TAILQ_REMOVE(&fd->queue, fdp, next);
65 if (fdp->data_size != 0)
66 free(fdp->data);
67 free(fdp);
68 }
69
70 #ifdef CTL_FREE_LIST
71 while ((fdp = TAILQ_FIRST(&fd->free_queue))) {
72 TAILQ_REMOVE(&fd->free_queue, fdp, next);
73 if (fdp->data_size != 0)
74 free(fdp->data);
75 free(fdp);
76 }
77 #endif
78 }
79
80 void
control_free(struct fd_list * fd)81 control_free(struct fd_list *fd)
82 {
83
84 #ifdef PRIVSEP
85 if (fd->ctx->ps_control_client == fd)
86 fd->ctx->ps_control_client = NULL;
87 #endif
88
89 eloop_event_delete(fd->ctx->eloop, fd->fd);
90 close(fd->fd);
91 TAILQ_REMOVE(&fd->ctx->control_fds, fd, next);
92 control_queue_free(fd);
93 free(fd);
94 }
95
96 static void
control_hangup(struct fd_list * fd)97 control_hangup(struct fd_list *fd)
98 {
99
100 #ifdef PRIVSEP
101 if (IN_PRIVSEP(fd->ctx)) {
102 if (ps_ctl_sendeof(fd) == -1)
103 logerr(__func__);
104 }
105 #endif
106 control_free(fd);
107 }
108
109 static int
control_handle_read(struct fd_list * fd)110 control_handle_read(struct fd_list *fd)
111 {
112 char buffer[1024];
113 ssize_t bytes;
114
115 bytes = read(fd->fd, buffer, sizeof(buffer) - 1);
116 if (bytes == -1)
117 logerr(__func__);
118 if (bytes == -1 || bytes == 0) {
119 control_hangup(fd);
120 return -1;
121 }
122
123 #ifdef PRIVSEP
124 if (IN_PRIVSEP(fd->ctx)) {
125 ssize_t err;
126
127 fd->flags |= FD_SENDLEN;
128 err = ps_ctl_handleargs(fd, buffer, (size_t)bytes);
129 fd->flags &= ~FD_SENDLEN;
130 if (err == -1) {
131 logerr(__func__);
132 return 0;
133 }
134 if (err == 1 &&
135 ps_ctl_sendargs(fd, buffer, (size_t)bytes) == -1) {
136 logerr(__func__);
137 control_free(fd);
138 return -1;
139 }
140 return 0;
141 }
142 #endif
143
144 control_recvdata(fd, buffer, (size_t)bytes);
145 return 0;
146 }
147
148 static int
control_handle_write(struct fd_list * fd)149 control_handle_write(struct fd_list *fd)
150 {
151 struct iovec iov[2];
152 int iov_len;
153 struct fd_data *data;
154
155 data = TAILQ_FIRST(&fd->queue);
156
157 if (data->data_flags & FD_SENDLEN) {
158 iov[0].iov_base = &data->data_len;
159 iov[0].iov_len = sizeof(size_t);
160 iov[1].iov_base = data->data;
161 iov[1].iov_len = data->data_len;
162 iov_len = 2;
163 } else {
164 iov[0].iov_base = data->data;
165 iov[0].iov_len = data->data_len;
166 iov_len = 1;
167 }
168
169 if (writev(fd->fd, iov, iov_len) == -1) {
170 if (errno != EPIPE && errno != ENOTCONN) {
171 // We don't get ELE_HANGUP for some reason
172 logerr("%s: write", __func__);
173 }
174 control_hangup(fd);
175 return -1;
176 }
177
178 TAILQ_REMOVE(&fd->queue, data, next);
179 #ifdef CTL_FREE_LIST
180 TAILQ_INSERT_TAIL(&fd->free_queue, data, next);
181 #else
182 if (data->data_size != 0)
183 free(data->data);
184 free(data);
185 #endif
186
187 if (TAILQ_FIRST(&fd->queue) != NULL)
188 return 0;
189
190 #ifdef PRIVSEP
191 if (IN_PRIVSEP_SE(fd->ctx) && !(fd->flags & FD_LISTEN)) {
192 if (ps_ctl_sendeof(fd) == -1)
193 logerr(__func__);
194 }
195 #endif
196
197 /* Done sending data, stop watching write to fd */
198 if (eloop_event_add(fd->ctx->eloop, fd->fd, ELE_READ,
199 control_handle_data, fd) == -1)
200 logerr("%s: eloop_event_add", __func__);
201 return 0;
202 }
203
204 static void
control_handle_data(void * arg,unsigned short events)205 control_handle_data(void *arg, unsigned short events)
206 {
207 struct fd_list *fd = arg;
208
209 if (!(events & (ELE_READ | ELE_WRITE | ELE_HANGUP)))
210 logerrx("%s: unexpected event 0x%04x", __func__, events);
211
212 if (events & ELE_WRITE && !(events & ELE_HANGUP)) {
213 if (control_handle_write(fd) == -1)
214 return;
215 }
216 if (events & ELE_READ) {
217 if (control_handle_read(fd) == -1)
218 return;
219 }
220 if (events & ELE_HANGUP)
221 control_hangup(fd);
222 }
223
224 void
control_recvdata(struct fd_list * fd,char * data,size_t len)225 control_recvdata(struct fd_list *fd, char *data, size_t len)
226 {
227 char *p = data, *e;
228 char *argvp[255], **ap;
229 int argc;
230
231 /* Each command is \n terminated
232 * Each argument is NULL separated */
233 while (len != 0) {
234 argc = 0;
235 ap = argvp;
236 while (len != 0) {
237 if (*p == '\0') {
238 p++;
239 len--;
240 continue;
241 }
242 e = memchr(p, '\0', len);
243 if (e == NULL) {
244 errno = EINVAL;
245 logerrx("%s: no terminator", __func__);
246 return;
247 }
248 if ((size_t)argc >= sizeof(argvp) / sizeof(argvp[0])) {
249 errno = ENOBUFS;
250 logerrx("%s: no arg buffer", __func__);
251 return;
252 }
253 *ap++ = p;
254 argc++;
255 e++;
256 len -= (size_t)(e - p);
257 p = e;
258 e--;
259 if (*(--e) == '\n') {
260 *e = '\0';
261 break;
262 }
263 }
264 if (argc == 0) {
265 logerrx("%s: no args", __func__);
266 continue;
267 }
268 *ap = NULL;
269 if (dhcpcd_handleargs(fd->ctx, fd, argc, argvp) == -1) {
270 logerr(__func__);
271 if (errno != EINTR && errno != EAGAIN) {
272 control_free(fd);
273 return;
274 }
275 }
276 }
277 }
278
279 struct fd_list *
control_new(struct dhcpcd_ctx * ctx,int fd,unsigned int flags)280 control_new(struct dhcpcd_ctx *ctx, int fd, unsigned int flags)
281 {
282 struct fd_list *l;
283
284 l = malloc(sizeof(*l));
285 if (l == NULL)
286 return NULL;
287
288 l->ctx = ctx;
289 l->fd = fd;
290 l->flags = flags;
291 TAILQ_INIT(&l->queue);
292 #ifdef CTL_FREE_LIST
293 TAILQ_INIT(&l->free_queue);
294 #endif
295 TAILQ_INSERT_TAIL(&ctx->control_fds, l, next);
296 return l;
297 }
298
299 static void
control_handle1(struct dhcpcd_ctx * ctx,int lfd,unsigned int fd_flags,unsigned short events)300 control_handle1(struct dhcpcd_ctx *ctx, int lfd, unsigned int fd_flags,
301 unsigned short events)
302 {
303 struct sockaddr_un run;
304 socklen_t len;
305 struct fd_list *l;
306 int fd, flags;
307
308 if (events != ELE_READ)
309 logerrx("%s: unexpected event 0x%04x", __func__, events);
310
311 len = sizeof(run);
312 if ((fd = accept(lfd, (struct sockaddr *)&run, &len)) == -1)
313 goto error;
314 if ((flags = fcntl(fd, F_GETFD, 0)) == -1 ||
315 fcntl(fd, F_SETFD, flags | FD_CLOEXEC) == -1)
316 goto error;
317 if ((flags = fcntl(fd, F_GETFL, 0)) == -1 ||
318 fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1)
319 goto error;
320
321 #ifdef PRIVSEP
322 if (IN_PRIVSEP(ctx) && !IN_PRIVSEP_SE(ctx))
323 ;
324 else
325 #endif
326 fd_flags |= FD_SENDLEN;
327
328 l = control_new(ctx, fd, fd_flags);
329 if (l == NULL)
330 goto error;
331
332 if (eloop_event_add(ctx->eloop, l->fd, ELE_READ,
333 control_handle_data, l) == -1)
334 logerr("%s: eloop_event_add", __func__);
335 return;
336
337 error:
338 logerr(__func__);
339 if (fd != -1)
340 close(fd);
341 }
342
343 static void
control_handle(void * arg,unsigned short events)344 control_handle(void *arg, unsigned short events)
345 {
346 struct dhcpcd_ctx *ctx = arg;
347
348 control_handle1(ctx, ctx->control_fd, 0, events);
349 }
350
351 static void
control_handle_unpriv(void * arg,unsigned short events)352 control_handle_unpriv(void *arg, unsigned short events)
353 {
354 struct dhcpcd_ctx *ctx = arg;
355
356 control_handle1(ctx, ctx->control_unpriv_fd, FD_UNPRIV, events);
357 }
358
359 static int
make_path(char * path,size_t len,const char * ifname,sa_family_t family,bool unpriv)360 make_path(char *path, size_t len, const char *ifname, sa_family_t family,
361 bool unpriv)
362 {
363 const char *per;
364 const char *sunpriv;
365
366 switch(family) {
367 case AF_INET:
368 per = "-4";
369 break;
370 case AF_INET6:
371 per = "-6";
372 break;
373 default:
374 per = "";
375 break;
376 }
377 if (unpriv)
378 sunpriv = ifname ? ".unpriv" : "unpriv.";
379 else
380 sunpriv = "";
381 return snprintf(path, len, CONTROLSOCKET,
382 ifname ? ifname : "", ifname ? per : "",
383 sunpriv, ifname ? "." : "");
384 }
385
386 static int
make_sock(struct sockaddr_un * sa,const char * ifname,sa_family_t family,bool unpriv)387 make_sock(struct sockaddr_un *sa, const char *ifname, sa_family_t family,
388 bool unpriv)
389 {
390 int fd;
391
392 if ((fd = xsocket(AF_UNIX, SOCK_STREAM | SOCK_CXNB, 0)) == -1)
393 return -1;
394 memset(sa, 0, sizeof(*sa));
395 sa->sun_family = AF_UNIX;
396 make_path(sa->sun_path, sizeof(sa->sun_path), ifname, family, unpriv);
397 return fd;
398 }
399
400 #define S_PRIV (S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP)
401 #define S_UNPRIV (S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH)
402
403 static int
control_start1(struct dhcpcd_ctx * ctx,const char * ifname,sa_family_t family,mode_t fmode)404 control_start1(struct dhcpcd_ctx *ctx, const char *ifname, sa_family_t family,
405 mode_t fmode)
406 {
407 struct sockaddr_un sa;
408 int fd;
409 socklen_t len;
410
411 fd = make_sock(&sa, ifname, family, (fmode & S_UNPRIV) == S_UNPRIV);
412 if (fd == -1)
413 return -1;
414
415 len = (socklen_t)SUN_LEN(&sa);
416 unlink(sa.sun_path);
417 if (bind(fd, (struct sockaddr *)&sa, len) == -1 ||
418 chmod(sa.sun_path, fmode) == -1 ||
419 (ctx->control_group &&
420 chown(sa.sun_path, geteuid(), ctx->control_group) == -1) ||
421 listen(fd, sizeof(ctx->control_fds)) == -1)
422 {
423 close(fd);
424 unlink(sa.sun_path);
425 return -1;
426 }
427
428 #ifdef PRIVSEP_RIGHTS
429 if (IN_PRIVSEP(ctx) && ps_rights_limit_fd_fctnl(fd) == -1) {
430 close(fd);
431 unlink(sa.sun_path);
432 return -1;
433 }
434 #endif
435
436 if ((fmode & S_UNPRIV) == S_UNPRIV)
437 strlcpy(ctx->control_sock_unpriv, sa.sun_path,
438 sizeof(ctx->control_sock_unpriv));
439 else
440 strlcpy(ctx->control_sock, sa.sun_path,
441 sizeof(ctx->control_sock));
442 return fd;
443 }
444
445 int
control_start(struct dhcpcd_ctx * ctx,const char * ifname,sa_family_t family)446 control_start(struct dhcpcd_ctx *ctx, const char *ifname, sa_family_t family)
447 {
448 int fd;
449
450 #ifdef PRIVSEP
451 if (IN_PRIVSEP_SE(ctx)) {
452 make_path(ctx->control_sock, sizeof(ctx->control_sock),
453 ifname, family, false);
454 make_path(ctx->control_sock_unpriv,
455 sizeof(ctx->control_sock_unpriv),
456 ifname, family, true);
457 return 0;
458 }
459 #endif
460
461 if ((fd = control_start1(ctx, ifname, family, S_PRIV)) == -1)
462 return -1;
463
464 ctx->control_fd = fd;
465 if (eloop_event_add(ctx->eloop, fd, ELE_READ,
466 control_handle, ctx) == -1)
467 logerr("%s: eloop_event_add", __func__);
468
469 if ((fd = control_start1(ctx, ifname, family, S_UNPRIV)) != -1) {
470 ctx->control_unpriv_fd = fd;
471 if (eloop_event_add(ctx->eloop, fd, ELE_READ,
472 control_handle_unpriv, ctx) == -1)
473 logerr("%s: eloop_event_add", __func__);
474 }
475 return ctx->control_fd;
476 }
477
478 static int
control_unlink(struct dhcpcd_ctx * ctx,const char * file)479 control_unlink(struct dhcpcd_ctx *ctx, const char *file)
480 {
481 int retval = 0;
482
483 errno = 0;
484 #ifdef PRIVSEP
485 if (IN_PRIVSEP(ctx))
486 retval = (int)ps_root_unlink(ctx, file);
487 else
488 #else
489 UNUSED(ctx);
490 #endif
491 retval = unlink(file);
492
493 return retval == -1 && errno != ENOENT ? -1 : 0;
494 }
495
496 int
control_stop(struct dhcpcd_ctx * ctx)497 control_stop(struct dhcpcd_ctx *ctx)
498 {
499 int retval = 0;
500 struct fd_list *l;
501
502 while ((l = TAILQ_FIRST(&ctx->control_fds)) != NULL) {
503 control_free(l);
504 }
505
506 #ifdef PRIVSEP
507 if (IN_PRIVSEP_SE(ctx)) {
508 if (ctx->control_sock[0] != '\0' &&
509 ps_root_unlink(ctx, ctx->control_sock) == -1)
510 retval = -1;
511 if (ctx->control_sock_unpriv[0] != '\0' &&
512 ps_root_unlink(ctx, ctx->control_sock_unpriv) == -1)
513 retval = -1;
514 return retval;
515 } else if (ctx->options & DHCPCD_FORKED)
516 return retval;
517 #endif
518
519 if (ctx->control_fd != -1) {
520 eloop_event_delete(ctx->eloop, ctx->control_fd);
521 close(ctx->control_fd);
522 ctx->control_fd = -1;
523 if (control_unlink(ctx, ctx->control_sock) == -1)
524 retval = -1;
525 }
526
527 if (ctx->control_unpriv_fd != -1) {
528 eloop_event_delete(ctx->eloop, ctx->control_unpriv_fd);
529 close(ctx->control_unpriv_fd);
530 ctx->control_unpriv_fd = -1;
531 if (control_unlink(ctx, ctx->control_sock_unpriv) == -1)
532 retval = -1;
533 }
534
535 return retval;
536 }
537
538 int
control_open(const char * ifname,sa_family_t family,bool unpriv)539 control_open(const char *ifname, sa_family_t family, bool unpriv)
540 {
541 struct sockaddr_un sa;
542 int fd;
543
544 if ((fd = make_sock(&sa, ifname, family, unpriv)) != -1) {
545 socklen_t len;
546
547 len = (socklen_t)SUN_LEN(&sa);
548 if (connect(fd, (struct sockaddr *)&sa, len) == -1) {
549 close(fd);
550 fd = -1;
551 }
552 }
553 return fd;
554 }
555
556 ssize_t
control_send(struct dhcpcd_ctx * ctx,int argc,char * const * argv)557 control_send(struct dhcpcd_ctx *ctx, int argc, char * const *argv)
558 {
559 char buffer[1024];
560 int i;
561 size_t len, l;
562
563 if (argc > 255) {
564 errno = ENOBUFS;
565 return -1;
566 }
567 len = 0;
568 for (i = 0; i < argc; i++) {
569 l = strlen(argv[i]) + 1;
570 if (len + l > sizeof(buffer)) {
571 errno = ENOBUFS;
572 return -1;
573 }
574 memcpy(buffer + len, argv[i], l);
575 len += l;
576 }
577 return write(ctx->control_fd, buffer, len);
578 }
579
580 int
control_queue(struct fd_list * fd,void * data,size_t data_len)581 control_queue(struct fd_list *fd, void *data, size_t data_len)
582 {
583 struct fd_data *d;
584 unsigned short events;
585
586 if (data_len == 0) {
587 errno = EINVAL;
588 return -1;
589 }
590
591 #ifdef CTL_FREE_LIST
592 struct fd_data *df;
593
594 d = NULL;
595 TAILQ_FOREACH(df, &fd->free_queue, next) {
596 if (d == NULL || d->data_size < df->data_size) {
597 d = df;
598 if (d->data_size <= data_len)
599 break;
600 }
601 }
602 if (d != NULL)
603 TAILQ_REMOVE(&fd->free_queue, d, next);
604 else
605 #endif
606 {
607 d = calloc(1, sizeof(*d));
608 if (d == NULL)
609 return -1;
610 }
611
612 if (d->data_size == 0)
613 d->data = NULL;
614 if (d->data_size < data_len) {
615 void *nbuf = realloc(d->data, data_len);
616 if (nbuf == NULL) {
617 free(d->data);
618 free(d);
619 return -1;
620 }
621 d->data = nbuf;
622 d->data_size = data_len;
623 }
624 memcpy(d->data, data, data_len);
625 d->data_len = data_len;
626 d->data_flags = fd->flags & FD_SENDLEN;
627
628 TAILQ_INSERT_TAIL(&fd->queue, d, next);
629 events = ELE_WRITE;
630 if (fd->flags & FD_LISTEN)
631 events |= ELE_READ;
632 return eloop_event_add(fd->ctx->eloop, fd->fd, events,
633 control_handle_data, fd);
634 }
635