]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * ssld.c: The ircd-ratbox ssl/zlib helper daemon thingy | |
3 | * Copyright (C) 2007 Aaron Sethman <androsyn@ratbox.org> | |
4 | * Copyright (C) 2007 ircd-ratbox development team | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or modify | |
7 | * it under the terms of the GNU General Public License as published by | |
8 | * the Free Software Foundation; either version 2 of the License, or | |
9 | * (at your option) any later version. | |
10 | * | |
11 | * This program is distributed in the hope that it will be useful, | |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
14 | * GNU General Public License for more details. | |
15 | * | |
16 | * You should have received a copy of the GNU General Public License | |
17 | * along with this program; if not, write to the Free Software | |
18 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 | |
19 | * USA | |
20 | */ | |
21 | ||
22 | ||
23 | #include "stdinc.h" | |
24 | ||
25 | #define MAXPASSFD 4 | |
26 | #ifndef READBUF_SIZE | |
27 | #define READBUF_SIZE 16384 | |
28 | #endif | |
29 | ||
30 | static void setup_signals(void); | |
31 | static pid_t ppid; | |
32 | ||
33 | static inline uint32_t | |
34 | buf_to_uint32(uint8_t *buf) | |
35 | { | |
36 | uint32_t x; | |
37 | memcpy(&x, buf, sizeof(x)); | |
38 | return x; | |
39 | } | |
40 | ||
41 | static inline void | |
42 | uint32_to_buf(uint8_t *buf, uint32_t x) | |
43 | { | |
44 | memcpy(buf, &x, sizeof(x)); | |
45 | return; | |
46 | } | |
47 | ||
48 | typedef struct _mod_ctl_buf | |
49 | { | |
50 | rb_dlink_node node; | |
51 | uint8_t *buf; | |
52 | size_t buflen; | |
53 | rb_fde_t *F[MAXPASSFD]; | |
54 | int nfds; | |
55 | } mod_ctl_buf_t; | |
56 | ||
57 | typedef struct _mod_ctl | |
58 | { | |
59 | rb_dlink_node node; | |
60 | int cli_count; | |
61 | rb_fde_t *F; | |
62 | rb_fde_t *F_pipe; | |
63 | rb_dlink_list readq; | |
64 | rb_dlink_list writeq; | |
65 | } mod_ctl_t; | |
66 | ||
67 | static mod_ctl_t *mod_ctl; | |
68 | ||
69 | typedef struct _conn | |
70 | { | |
71 | rb_dlink_node node; | |
72 | mod_ctl_t *ctl; | |
73 | rawbuf_head_t *modbuf_out; | |
74 | rawbuf_head_t *plainbuf_out; | |
75 | ||
76 | uint32_t id; | |
77 | ||
78 | rb_fde_t *mod_fd; | |
79 | rb_fde_t *plain_fd; | |
80 | uint64_t mod_out; | |
81 | uint64_t mod_in; | |
82 | uint64_t plain_in; | |
83 | uint64_t plain_out; | |
84 | uint8_t flags; | |
85 | void *stream; | |
86 | } conn_t; | |
87 | ||
88 | #define FLAG_SSL 0x01 | |
89 | #define FLAG_ZIP 0x02 | |
90 | #define FLAG_CORK 0x04 | |
91 | #define FLAG_DEAD 0x08 | |
92 | #define FLAG_SSL_W_WANTS_R 0x10 /* output needs to wait until input possible */ | |
93 | #define FLAG_SSL_R_WANTS_W 0x20 /* input needs to wait until output possible */ | |
94 | #define FLAG_ZIPSSL 0x40 | |
95 | ||
96 | #define IsSSL(x) ((x)->flags & FLAG_SSL) | |
97 | #define IsZip(x) ((x)->flags & FLAG_ZIP) | |
98 | #define IsCork(x) ((x)->flags & FLAG_CORK) | |
99 | #define IsDead(x) ((x)->flags & FLAG_DEAD) | |
100 | #define IsSSLWWantsR(x) ((x)->flags & FLAG_SSL_W_WANTS_R) | |
101 | #define IsSSLRWantsW(x) ((x)->flags & FLAG_SSL_R_WANTS_W) | |
102 | #define IsZipSSL(x) ((x)->flags & FLAG_ZIPSSL) | |
103 | ||
104 | #define SetSSL(x) ((x)->flags |= FLAG_SSL) | |
105 | #define SetZip(x) ((x)->flags |= FLAG_ZIP) | |
106 | #define SetCork(x) ((x)->flags |= FLAG_CORK) | |
107 | #define SetDead(x) ((x)->flags |= FLAG_DEAD) | |
108 | #define SetSSLWWantsR(x) ((x)->flags |= FLAG_SSL_W_WANTS_R) | |
109 | #define SetSSLRWantsW(x) ((x)->flags |= FLAG_SSL_R_WANTS_W) | |
110 | ||
111 | #define ClearCork(x) ((x)->flags &= ~FLAG_CORK) | |
112 | #define ClearSSLWWantsR(x) ((x)->flags &= ~FLAG_SSL_W_WANTS_R) | |
113 | #define ClearSSLRWantsW(x) ((x)->flags &= ~FLAG_SSL_R_WANTS_W) | |
114 | ||
115 | #define NO_WAIT 0x0 | |
116 | #define WAIT_PLAIN 0x1 | |
117 | ||
118 | #define HASH_WALK_SAFE(i, max, ptr, next, table) for(i = 0; i < max; i++) { RB_DLINK_FOREACH_SAFE(ptr, next, table[i].head) | |
119 | #define HASH_WALK_END } | |
120 | #define CONN_HASH_SIZE 2000 | |
121 | #define connid_hash(x) (&connid_hash_table[(x % CONN_HASH_SIZE)]) | |
122 | ||
123 | ||
124 | ||
125 | static rb_dlink_list connid_hash_table[CONN_HASH_SIZE]; | |
126 | static rb_dlink_list dead_list; | |
127 | ||
128 | static void conn_mod_read_cb(rb_fde_t *fd, void *data); | |
129 | static void conn_mod_write_sendq(rb_fde_t *, void *data); | |
130 | static void conn_plain_write_sendq(rb_fde_t *, void *data); | |
131 | static void mod_write_ctl(rb_fde_t *, void *data); | |
132 | static void conn_plain_read_cb(rb_fde_t *fd, void *data); | |
133 | static void conn_plain_read_shutdown_cb(rb_fde_t *fd, void *data); | |
134 | static void mod_cmd_write_queue(mod_ctl_t * ctl, const void *data, size_t len); | |
135 | static const char *remote_closed = "Remote host closed the connection"; | |
136 | static bool ssld_ssl_ok; | |
137 | static int certfp_method = RB_SSL_CERTFP_METH_CERT_SHA1; | |
138 | static bool zlib_ok = false; | |
139 | ||
140 | ||
141 | static conn_t * | |
142 | conn_find_by_id(uint32_t id) | |
143 | { | |
144 | rb_dlink_node *ptr; | |
145 | conn_t *conn; | |
146 | ||
147 | RB_DLINK_FOREACH(ptr, (connid_hash(id))->head) | |
148 | { | |
149 | conn = ptr->data; | |
150 | if(conn->id == id && !IsDead(conn)) | |
151 | return conn; | |
152 | } | |
153 | return NULL; | |
154 | } | |
155 | ||
156 | static void | |
157 | conn_add_id_hash(conn_t * conn, uint32_t id) | |
158 | { | |
159 | conn->id = id; | |
160 | rb_dlinkAdd(conn, &conn->node, connid_hash(id)); | |
161 | } | |
162 | ||
163 | static void | |
164 | free_conn(conn_t * conn) | |
165 | { | |
166 | rb_free_rawbuffer(conn->modbuf_out); | |
167 | rb_free_rawbuffer(conn->plainbuf_out); | |
168 | rb_free(conn); | |
169 | } | |
170 | ||
171 | static void | |
172 | clean_dead_conns(void *unused) | |
173 | { | |
174 | conn_t *conn; | |
175 | rb_dlink_node *ptr, *next; | |
176 | RB_DLINK_FOREACH_SAFE(ptr, next, dead_list.head) | |
177 | { | |
178 | conn = ptr->data; | |
179 | free_conn(conn); | |
180 | } | |
181 | dead_list.tail = dead_list.head = NULL; | |
182 | } | |
183 | ||
184 | ||
185 | static void | |
186 | close_conn(conn_t * conn, int wait_plain, const char *fmt, ...) | |
187 | { | |
188 | va_list ap; | |
189 | char reason[128]; /* must always be under 250 bytes */ | |
190 | uint8_t buf[256]; | |
191 | int len; | |
192 | if(IsDead(conn)) | |
193 | return; | |
194 | ||
195 | rb_rawbuf_flush(conn->modbuf_out, conn->mod_fd); | |
196 | rb_rawbuf_flush(conn->plainbuf_out, conn->plain_fd); | |
197 | rb_close(conn->mod_fd); | |
198 | SetDead(conn); | |
199 | ||
200 | if(!IsZipSSL(conn)) | |
201 | rb_dlinkDelete(&conn->node, connid_hash(conn->id)); | |
202 | ||
203 | if(!wait_plain || fmt == NULL) | |
204 | { | |
205 | rb_close(conn->plain_fd); | |
206 | rb_dlinkAdd(conn, &conn->node, &dead_list); | |
207 | return; | |
208 | } | |
209 | rb_setselect(conn->plain_fd, RB_SELECT_READ, conn_plain_read_shutdown_cb, conn); | |
210 | rb_setselect(conn->plain_fd, RB_SELECT_WRITE, NULL, NULL); | |
211 | va_start(ap, fmt); | |
212 | vsnprintf(reason, sizeof(reason), fmt, ap); | |
213 | va_end(ap); | |
214 | ||
215 | buf[0] = 'D'; | |
216 | uint32_to_buf(&buf[1], conn->id); | |
217 | rb_strlcpy((char *) &buf[5], reason, sizeof(buf) - 5); | |
218 | len = (strlen(reason) + 1) + 5; | |
219 | mod_cmd_write_queue(conn->ctl, buf, len); | |
220 | } | |
221 | ||
222 | static conn_t * | |
223 | make_conn(mod_ctl_t * ctl, rb_fde_t *mod_fd, rb_fde_t *plain_fd) | |
224 | { | |
225 | conn_t *conn = rb_malloc(sizeof(conn_t)); | |
226 | conn->ctl = ctl; | |
227 | conn->modbuf_out = rb_new_rawbuffer(); | |
228 | conn->plainbuf_out = rb_new_rawbuffer(); | |
229 | conn->mod_fd = mod_fd; | |
230 | conn->plain_fd = plain_fd; | |
231 | conn->id = -1; | |
232 | conn->stream = NULL; | |
233 | rb_set_nb(mod_fd); | |
234 | rb_set_nb(plain_fd); | |
235 | return conn; | |
236 | } | |
237 | ||
238 | static void | |
239 | check_handshake_flood(void *unused) | |
240 | { | |
241 | conn_t *conn; | |
242 | rb_dlink_node *ptr, *next; | |
243 | unsigned int count; | |
244 | int i; | |
245 | HASH_WALK_SAFE(i, CONN_HASH_SIZE, ptr, next, connid_hash_table) | |
246 | { | |
247 | conn = ptr->data; | |
248 | if(!IsSSL(conn)) | |
249 | continue; | |
250 | ||
251 | count = rb_ssl_handshake_count(conn->mod_fd); | |
252 | /* nothing needs to do this more than twice in ten seconds i don't think */ | |
253 | if(count > 2) | |
254 | close_conn(conn, WAIT_PLAIN, "Handshake flooding"); | |
255 | else | |
256 | rb_ssl_clear_handshake_count(conn->mod_fd); | |
257 | } | |
258 | HASH_WALK_END} | |
259 | ||
260 | static void | |
261 | conn_mod_write_sendq(rb_fde_t *fd, void *data) | |
262 | { | |
263 | conn_t *conn = data; | |
264 | const char *err; | |
265 | int retlen; | |
266 | if(IsDead(conn)) | |
267 | return; | |
268 | ||
269 | if(IsSSLWWantsR(conn)) | |
270 | { | |
271 | ClearSSLWWantsR(conn); | |
272 | conn_mod_read_cb(conn->mod_fd, conn); | |
273 | if(IsDead(conn)) | |
274 | return; | |
275 | } | |
276 | ||
277 | while((retlen = rb_rawbuf_flush(conn->modbuf_out, fd)) > 0) | |
278 | conn->mod_out += retlen; | |
279 | ||
280 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
281 | { | |
282 | if(retlen == 0) | |
283 | close_conn(conn, WAIT_PLAIN, "%s", remote_closed); | |
284 | if(IsSSL(conn) && retlen == RB_RW_SSL_ERROR) | |
285 | err = rb_get_ssl_strerror(conn->mod_fd); | |
286 | else | |
287 | err = strerror(errno); | |
288 | close_conn(conn, WAIT_PLAIN, "Write error: %s", err); | |
289 | return; | |
290 | } | |
291 | if(rb_rawbuf_length(conn->modbuf_out) > 0) | |
292 | { | |
293 | if(retlen != RB_RW_SSL_NEED_READ) | |
294 | rb_setselect(conn->mod_fd, RB_SELECT_WRITE, conn_mod_write_sendq, conn); | |
295 | else | |
296 | { | |
297 | rb_setselect(conn->mod_fd, RB_SELECT_READ, conn_mod_write_sendq, conn); | |
298 | rb_setselect(conn->mod_fd, RB_SELECT_WRITE, NULL, NULL); | |
299 | SetSSLWWantsR(conn); | |
300 | } | |
301 | } | |
302 | else | |
303 | rb_setselect(conn->mod_fd, RB_SELECT_WRITE, NULL, NULL); | |
304 | ||
305 | if(IsCork(conn) && rb_rawbuf_length(conn->modbuf_out) == 0) | |
306 | { | |
307 | ClearCork(conn); | |
308 | conn_plain_read_cb(conn->plain_fd, conn); | |
309 | } | |
310 | ||
311 | } | |
312 | ||
313 | static void | |
314 | conn_mod_write(conn_t * conn, void *data, size_t len) | |
315 | { | |
316 | if(IsDead(conn)) /* no point in queueing to a dead man */ | |
317 | return; | |
318 | rb_rawbuf_append(conn->modbuf_out, data, len); | |
319 | } | |
320 | ||
321 | static void | |
322 | conn_plain_write(conn_t * conn, void *data, size_t len) | |
323 | { | |
324 | if(IsDead(conn)) /* again no point in queueing to dead men */ | |
325 | return; | |
326 | rb_rawbuf_append(conn->plainbuf_out, data, len); | |
327 | } | |
328 | ||
329 | static void | |
330 | mod_cmd_write_queue(mod_ctl_t * ctl, const void *data, size_t len) | |
331 | { | |
332 | mod_ctl_buf_t *ctl_buf; | |
333 | ctl_buf = rb_malloc(sizeof(mod_ctl_buf_t)); | |
334 | ctl_buf->buf = rb_malloc(len); | |
335 | ctl_buf->buflen = len; | |
336 | memcpy(ctl_buf->buf, data, len); | |
337 | ctl_buf->nfds = 0; | |
338 | rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->writeq); | |
339 | mod_write_ctl(ctl->F, ctl); | |
340 | } | |
341 | ||
342 | static bool | |
343 | plain_check_cork(conn_t * conn) | |
344 | { | |
345 | if(rb_rawbuf_length(conn->modbuf_out) >= 4096) | |
346 | { | |
347 | /* if we have over 4k pending outbound, don't read until | |
348 | * we've cleared the queue */ | |
349 | SetCork(conn); | |
350 | rb_setselect(conn->plain_fd, RB_SELECT_READ, NULL, NULL); | |
351 | /* try to write */ | |
352 | conn_mod_write_sendq(conn->mod_fd, conn); | |
353 | return true; | |
354 | } | |
355 | return false; | |
356 | } | |
357 | ||
358 | ||
359 | static void | |
360 | conn_plain_read_cb(rb_fde_t *fd, void *data) | |
361 | { | |
362 | char inbuf[READBUF_SIZE]; | |
363 | conn_t *conn = data; | |
364 | int length = 0; | |
365 | if(conn == NULL) | |
366 | return; | |
367 | ||
368 | if(IsDead(conn)) | |
369 | return; | |
370 | ||
371 | if(plain_check_cork(conn)) | |
372 | return; | |
373 | ||
374 | while(1) | |
375 | { | |
376 | if(IsDead(conn)) | |
377 | return; | |
378 | ||
379 | length = rb_read(conn->plain_fd, inbuf, sizeof(inbuf)); | |
380 | ||
381 | if(length == 0 || (length < 0 && !rb_ignore_errno(errno))) | |
382 | { | |
383 | close_conn(conn, NO_WAIT, NULL); | |
384 | return; | |
385 | } | |
386 | ||
387 | if(length < 0) | |
388 | { | |
389 | rb_setselect(conn->plain_fd, RB_SELECT_READ, conn_plain_read_cb, conn); | |
390 | conn_mod_write_sendq(conn->mod_fd, conn); | |
391 | return; | |
392 | } | |
393 | conn->plain_in += length; | |
394 | ||
395 | conn_mod_write(conn, inbuf, length); | |
396 | if(IsDead(conn)) | |
397 | return; | |
398 | if(plain_check_cork(conn)) | |
399 | return; | |
400 | } | |
401 | } | |
402 | ||
403 | static void | |
404 | conn_plain_read_shutdown_cb(rb_fde_t *fd, void *data) | |
405 | { | |
406 | char inbuf[READBUF_SIZE]; | |
407 | conn_t *conn = data; | |
408 | int length = 0; | |
409 | ||
410 | if(conn == NULL) | |
411 | return; | |
412 | ||
413 | while(1) | |
414 | { | |
415 | length = rb_read(conn->plain_fd, inbuf, sizeof(inbuf)); | |
416 | ||
417 | if(length == 0 || (length < 0 && !rb_ignore_errno(errno))) | |
418 | { | |
419 | rb_close(conn->plain_fd); | |
420 | rb_dlinkAdd(conn, &conn->node, &dead_list); | |
421 | return; | |
422 | } | |
423 | ||
424 | if(length < 0) | |
425 | { | |
426 | rb_setselect(conn->plain_fd, RB_SELECT_READ, conn_plain_read_shutdown_cb, conn); | |
427 | return; | |
428 | } | |
429 | } | |
430 | } | |
431 | ||
432 | static void | |
433 | conn_mod_read_cb(rb_fde_t *fd, void *data) | |
434 | { | |
435 | char inbuf[READBUF_SIZE]; | |
436 | conn_t *conn = data; | |
437 | int length; | |
438 | if(conn == NULL) | |
439 | return; | |
440 | if(IsDead(conn)) | |
441 | return; | |
442 | ||
443 | if(IsSSLRWantsW(conn)) | |
444 | { | |
445 | ClearSSLRWantsW(conn); | |
446 | conn_mod_write_sendq(conn->mod_fd, conn); | |
447 | if(IsDead(conn)) | |
448 | return; | |
449 | } | |
450 | ||
451 | while(1) | |
452 | { | |
453 | if(IsDead(conn)) | |
454 | return; | |
455 | ||
456 | length = rb_read(conn->mod_fd, inbuf, sizeof(inbuf)); | |
457 | ||
458 | if(length == 0 || (length < 0 && !rb_ignore_errno(errno))) | |
459 | { | |
460 | if(length == 0) | |
461 | { | |
462 | close_conn(conn, WAIT_PLAIN, "%s", remote_closed); | |
463 | return; | |
464 | } | |
465 | ||
466 | const char *err; | |
467 | if(IsSSL(conn) && length == RB_RW_SSL_ERROR) | |
468 | err = rb_get_ssl_strerror(conn->mod_fd); | |
469 | else | |
470 | err = strerror(errno); | |
471 | close_conn(conn, WAIT_PLAIN, "Read error: %s", err); | |
472 | return; | |
473 | } | |
474 | if(length < 0) | |
475 | { | |
476 | if(length != RB_RW_SSL_NEED_WRITE) | |
477 | rb_setselect(conn->mod_fd, RB_SELECT_READ, conn_mod_read_cb, conn); | |
478 | else | |
479 | { | |
480 | rb_setselect(conn->mod_fd, RB_SELECT_READ, NULL, NULL); | |
481 | rb_setselect(conn->mod_fd, RB_SELECT_WRITE, conn_mod_read_cb, conn); | |
482 | SetSSLRWantsW(conn); | |
483 | } | |
484 | conn_plain_write_sendq(conn->plain_fd, conn); | |
485 | return; | |
486 | } | |
487 | conn->mod_in += length; | |
488 | conn_plain_write(conn, inbuf, length); | |
489 | } | |
490 | } | |
491 | ||
492 | static void | |
493 | conn_plain_write_sendq(rb_fde_t *fd, void *data) | |
494 | { | |
495 | conn_t *conn = data; | |
496 | int retlen; | |
497 | ||
498 | if(IsDead(conn)) | |
499 | return; | |
500 | ||
501 | while((retlen = rb_rawbuf_flush(conn->plainbuf_out, fd)) > 0) | |
502 | { | |
503 | conn->plain_out += retlen; | |
504 | } | |
505 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
506 | { | |
507 | close_conn(data, NO_WAIT, NULL); | |
508 | return; | |
509 | } | |
510 | ||
511 | ||
512 | if(rb_rawbuf_length(conn->plainbuf_out) > 0) | |
513 | rb_setselect(conn->plain_fd, RB_SELECT_WRITE, conn_plain_write_sendq, conn); | |
514 | else | |
515 | rb_setselect(conn->plain_fd, RB_SELECT_WRITE, NULL, NULL); | |
516 | } | |
517 | ||
518 | static int | |
519 | maxconn(void) | |
520 | { | |
521 | #if defined(RLIMIT_NOFILE) && defined(HAVE_SYS_RESOURCE_H) | |
522 | struct rlimit limit; | |
523 | ||
524 | if(!getrlimit(RLIMIT_NOFILE, &limit)) | |
525 | { | |
526 | return limit.rlim_cur; | |
527 | } | |
528 | #endif /* RLIMIT_FD_MAX */ | |
529 | return MAXCONNECTIONS; | |
530 | } | |
531 | ||
532 | static void | |
533 | ssl_send_cipher(conn_t *conn) | |
534 | { | |
535 | size_t len; | |
536 | uint8_t buf[512]; | |
537 | char cstring[256]; | |
538 | const char *p; | |
539 | if(!IsSSL(conn)) | |
540 | return; | |
541 | ||
542 | p = rb_ssl_get_cipher(conn->mod_fd); | |
543 | ||
544 | if(p == NULL) | |
545 | return; | |
546 | ||
547 | rb_strlcpy(cstring, p, sizeof(cstring)); | |
548 | ||
549 | buf[0] = 'C'; | |
550 | uint32_to_buf(&buf[1], conn->id); | |
551 | strcpy((char *) &buf[5], cstring); | |
552 | len = (strlen(cstring) + 1) + 5; | |
553 | mod_cmd_write_queue(conn->ctl, buf, len); | |
554 | } | |
555 | ||
556 | static void | |
557 | ssl_send_certfp(conn_t *conn) | |
558 | { | |
559 | uint8_t buf[13 + RB_SSL_CERTFP_LEN]; | |
560 | ||
561 | int len = rb_get_ssl_certfp(conn->mod_fd, &buf[13], certfp_method); | |
562 | if (!len) | |
563 | return; | |
564 | ||
565 | lrb_assert(len <= RB_SSL_CERTFP_LEN); | |
566 | buf[0] = 'F'; | |
567 | uint32_to_buf(&buf[1], conn->id); | |
568 | uint32_to_buf(&buf[5], certfp_method); | |
569 | uint32_to_buf(&buf[9], len); | |
570 | mod_cmd_write_queue(conn->ctl, buf, 13 + len); | |
571 | } | |
572 | ||
573 | static void | |
574 | ssl_send_open(conn_t *conn) | |
575 | { | |
576 | uint8_t buf[5]; | |
577 | ||
578 | buf[0] = 'O'; | |
579 | uint32_to_buf(&buf[1], conn->id); | |
580 | mod_cmd_write_queue(conn->ctl, buf, 5); | |
581 | } | |
582 | ||
583 | static void | |
584 | ssl_process_accept_cb(rb_fde_t *F, int status, struct sockaddr *addr, rb_socklen_t len, void *data) | |
585 | { | |
586 | conn_t *conn = data; | |
587 | ||
588 | if(status == RB_OK) | |
589 | { | |
590 | ssl_send_cipher(conn); | |
591 | ssl_send_certfp(conn); | |
592 | ssl_send_open(conn); | |
593 | conn_mod_read_cb(conn->mod_fd, conn); | |
594 | conn_plain_read_cb(conn->plain_fd, conn); | |
595 | return; | |
596 | } | |
597 | /* ircd doesn't care about the reason for this */ | |
598 | close_conn(conn, NO_WAIT, 0); | |
599 | return; | |
600 | } | |
601 | ||
602 | static void | |
603 | ssl_process_connect_cb(rb_fde_t *F, int status, void *data) | |
604 | { | |
605 | conn_t *conn = data; | |
606 | ||
607 | if(status == RB_OK) | |
608 | { | |
609 | ssl_send_cipher(conn); | |
610 | ssl_send_certfp(conn); | |
611 | ssl_send_open(conn); | |
612 | conn_mod_read_cb(conn->mod_fd, conn); | |
613 | conn_plain_read_cb(conn->plain_fd, conn); | |
614 | } | |
615 | else if(status == RB_ERR_TIMEOUT) | |
616 | close_conn(conn, WAIT_PLAIN, "SSL handshake timed out"); | |
617 | else if(status == RB_ERROR_SSL) | |
618 | close_conn(conn, WAIT_PLAIN, "%s", rb_get_ssl_strerror(conn->mod_fd)); | |
619 | else | |
620 | close_conn(conn, WAIT_PLAIN, "SSL handshake failed"); | |
621 | } | |
622 | ||
623 | ||
624 | static void | |
625 | cleanup_bad_message(mod_ctl_t * ctl, mod_ctl_buf_t * ctlb) | |
626 | { | |
627 | int i; | |
628 | ||
629 | /* XXX should log this somehow */ | |
630 | for (i = 0; i < ctlb->nfds; i++) | |
631 | rb_close(ctlb->F[i]); | |
632 | } | |
633 | ||
634 | static void | |
635 | ssl_process_accept(mod_ctl_t * ctl, mod_ctl_buf_t * ctlb) | |
636 | { | |
637 | conn_t *conn; | |
638 | uint32_t id; | |
639 | ||
640 | conn = make_conn(ctl, ctlb->F[0], ctlb->F[1]); | |
641 | ||
642 | id = buf_to_uint32(&ctlb->buf[1]); | |
643 | conn_add_id_hash(conn, id); | |
644 | SetSSL(conn); | |
645 | ||
646 | if(rb_get_type(conn->mod_fd) & RB_FD_UNKNOWN) | |
647 | rb_set_type(conn->mod_fd, RB_FD_SOCKET); | |
648 | ||
649 | if(rb_get_type(conn->plain_fd) == RB_FD_UNKNOWN) | |
650 | rb_set_type(conn->plain_fd, RB_FD_SOCKET); | |
651 | ||
652 | rb_ssl_start_accepted(ctlb->F[0], ssl_process_accept_cb, conn, 10); | |
653 | } | |
654 | ||
655 | static void | |
656 | ssl_change_certfp_method(mod_ctl_t * ctl, mod_ctl_buf_t * ctlb) | |
657 | { | |
658 | certfp_method = buf_to_uint32(&ctlb->buf[1]); | |
659 | } | |
660 | ||
661 | static void | |
662 | ssl_process_connect(mod_ctl_t * ctl, mod_ctl_buf_t * ctlb) | |
663 | { | |
664 | conn_t *conn; | |
665 | uint32_t id; | |
666 | conn = make_conn(ctl, ctlb->F[0], ctlb->F[1]); | |
667 | ||
668 | id = buf_to_uint32(&ctlb->buf[1]); | |
669 | conn_add_id_hash(conn, id); | |
670 | SetSSL(conn); | |
671 | ||
672 | if(rb_get_type(conn->mod_fd) == RB_FD_UNKNOWN) | |
673 | rb_set_type(conn->mod_fd, RB_FD_SOCKET); | |
674 | ||
675 | if(rb_get_type(conn->plain_fd) == RB_FD_UNKNOWN) | |
676 | rb_set_type(conn->plain_fd, RB_FD_SOCKET); | |
677 | ||
678 | ||
679 | rb_ssl_start_connected(ctlb->F[0], ssl_process_connect_cb, conn, 10); | |
680 | } | |
681 | ||
682 | static void | |
683 | process_stats(mod_ctl_t * ctl, mod_ctl_buf_t * ctlb) | |
684 | { | |
685 | char outstat[512]; | |
686 | conn_t *conn; | |
687 | uint8_t *odata; | |
688 | uint32_t id; | |
689 | ||
690 | id = buf_to_uint32(&ctlb->buf[1]); | |
691 | ||
692 | odata = &ctlb->buf[5]; | |
693 | conn = conn_find_by_id(id); | |
694 | ||
695 | if(conn == NULL) | |
696 | return; | |
697 | ||
698 | snprintf(outstat, sizeof(outstat), "S %s %llu %llu %llu %llu", odata, | |
699 | (unsigned long long)conn->plain_out, | |
700 | (unsigned long long)conn->mod_in, | |
701 | (unsigned long long)conn->plain_in, | |
702 | (unsigned long long)conn->mod_out); | |
703 | conn->plain_out = 0; | |
704 | conn->plain_in = 0; | |
705 | conn->mod_in = 0; | |
706 | conn->mod_out = 0; | |
707 | mod_cmd_write_queue(ctl, outstat, strlen(outstat) + 1); /* +1 is so we send the \0 as well */ | |
708 | } | |
709 | ||
710 | static void | |
711 | ssl_new_keys(mod_ctl_t * ctl, mod_ctl_buf_t * ctl_buf) | |
712 | { | |
713 | char *buf; | |
714 | char *cert, *key, *dhparam, *cipher_list; | |
715 | ||
716 | buf = (char *) &ctl_buf->buf[2]; | |
717 | cert = buf; | |
718 | buf += strlen(cert) + 1; | |
719 | key = buf; | |
720 | buf += strlen(key) + 1; | |
721 | dhparam = buf; | |
722 | buf += strlen(dhparam) + 1; | |
723 | cipher_list = buf; | |
724 | if(strlen(key) == 0) | |
725 | key = cert; | |
726 | if(strlen(dhparam) == 0) | |
727 | dhparam = NULL; | |
728 | if(strlen(cipher_list) == 0) | |
729 | cipher_list = NULL; | |
730 | ||
731 | if(!rb_setup_ssl_server(cert, key, dhparam, cipher_list)) | |
732 | { | |
733 | const char *invalid = "I"; | |
734 | mod_cmd_write_queue(ctl, invalid, strlen(invalid)); | |
735 | return; | |
736 | } | |
737 | } | |
738 | ||
739 | static void | |
740 | send_nossl_support(mod_ctl_t * ctl, mod_ctl_buf_t * ctlb) | |
741 | { | |
742 | static const char *nossl_cmd = "N"; | |
743 | conn_t *conn; | |
744 | uint32_t id; | |
745 | ||
746 | if(ctlb != NULL) | |
747 | { | |
748 | conn = make_conn(ctl, ctlb->F[0], ctlb->F[1]); | |
749 | id = buf_to_uint32(&ctlb->buf[1]); | |
750 | conn_add_id_hash(conn, id); | |
751 | close_conn(conn, WAIT_PLAIN, "libratbox reports no SSL/TLS support"); | |
752 | } | |
753 | mod_cmd_write_queue(ctl, nossl_cmd, strlen(nossl_cmd)); | |
754 | } | |
755 | ||
756 | static void | |
757 | send_i_am_useless(mod_ctl_t * ctl) | |
758 | { | |
759 | static const char *useless = "U"; | |
760 | mod_cmd_write_queue(ctl, useless, strlen(useless)); | |
761 | } | |
762 | ||
763 | static void | |
764 | send_version(mod_ctl_t * ctl) | |
765 | { | |
766 | char version[256] = { 'V', 0 }; | |
767 | strncpy(&version[1], rb_lib_version(), sizeof(version) - 2); | |
768 | mod_cmd_write_queue(ctl, version, strlen(version)); | |
769 | } | |
770 | ||
771 | static void | |
772 | send_nozlib_support(mod_ctl_t * ctl, mod_ctl_buf_t * ctlb) | |
773 | { | |
774 | static const char *nozlib_cmd = "z"; | |
775 | conn_t *conn; | |
776 | uint32_t id; | |
777 | if(ctlb != NULL) | |
778 | { | |
779 | conn = make_conn(ctl, ctlb->F[0], ctlb->F[1]); | |
780 | id = buf_to_uint32(&ctlb->buf[1]); | |
781 | conn_add_id_hash(conn, id); | |
782 | close_conn(conn, WAIT_PLAIN, "libratbox reports no zlib support"); | |
783 | } | |
784 | mod_cmd_write_queue(ctl, nozlib_cmd, strlen(nozlib_cmd)); | |
785 | } | |
786 | ||
787 | static void | |
788 | mod_process_cmd_recv(mod_ctl_t * ctl) | |
789 | { | |
790 | rb_dlink_node *ptr, *next; | |
791 | mod_ctl_buf_t *ctl_buf; | |
792 | ||
793 | RB_DLINK_FOREACH_SAFE(ptr, next, ctl->readq.head) | |
794 | { | |
795 | ctl_buf = ptr->data; | |
796 | ||
797 | switch (*ctl_buf->buf) | |
798 | { | |
799 | case 'A': | |
800 | { | |
801 | if (ctl_buf->nfds != 2 || ctl_buf->buflen != 5) | |
802 | { | |
803 | cleanup_bad_message(ctl, ctl_buf); | |
804 | break; | |
805 | } | |
806 | ||
807 | if(!ssld_ssl_ok) | |
808 | { | |
809 | send_nossl_support(ctl, ctl_buf); | |
810 | break; | |
811 | } | |
812 | ssl_process_accept(ctl, ctl_buf); | |
813 | break; | |
814 | } | |
815 | case 'C': | |
816 | { | |
817 | if (ctl_buf->buflen != 5) | |
818 | { | |
819 | cleanup_bad_message(ctl, ctl_buf); | |
820 | break; | |
821 | } | |
822 | ||
823 | if(!ssld_ssl_ok) | |
824 | { | |
825 | send_nossl_support(ctl, ctl_buf); | |
826 | break; | |
827 | } | |
828 | ssl_process_connect(ctl, ctl_buf); | |
829 | break; | |
830 | } | |
831 | case 'F': | |
832 | { | |
833 | if (ctl_buf->buflen != 5) | |
834 | { | |
835 | cleanup_bad_message(ctl, ctl_buf); | |
836 | break; | |
837 | } | |
838 | ssl_change_certfp_method(ctl, ctl_buf); | |
839 | break; | |
840 | } | |
841 | case 'K': | |
842 | { | |
843 | if(!ssld_ssl_ok) | |
844 | { | |
845 | send_nossl_support(ctl, ctl_buf); | |
846 | break; | |
847 | } | |
848 | ssl_new_keys(ctl, ctl_buf); | |
849 | break; | |
850 | } | |
851 | case 'S': | |
852 | { | |
853 | process_stats(ctl, ctl_buf); | |
854 | break; | |
855 | } | |
856 | ||
857 | case 'Z': | |
858 | send_nozlib_support(ctl, ctl_buf); | |
859 | break; | |
860 | ||
861 | default: | |
862 | break; | |
863 | /* Log unknown commands */ | |
864 | } | |
865 | rb_dlinkDelete(ptr, &ctl->readq); | |
866 | rb_free(ctl_buf->buf); | |
867 | rb_free(ctl_buf); | |
868 | } | |
869 | ||
870 | } | |
871 | ||
872 | ||
873 | ||
874 | static void | |
875 | mod_read_ctl(rb_fde_t *F, void *data) | |
876 | { | |
877 | mod_ctl_buf_t *ctl_buf; | |
878 | mod_ctl_t *ctl = data; | |
879 | int retlen; | |
880 | int i; | |
881 | ||
882 | do | |
883 | { | |
884 | ctl_buf = rb_malloc(sizeof(mod_ctl_buf_t)); | |
885 | ctl_buf->buf = rb_malloc(READBUF_SIZE); | |
886 | ctl_buf->buflen = READBUF_SIZE; | |
887 | retlen = rb_recv_fd_buf(ctl->F, ctl_buf->buf, ctl_buf->buflen, ctl_buf->F, | |
888 | MAXPASSFD); | |
889 | if(retlen <= 0) | |
890 | { | |
891 | rb_free(ctl_buf->buf); | |
892 | rb_free(ctl_buf); | |
893 | } | |
894 | else | |
895 | { | |
896 | ctl_buf->buflen = retlen; | |
897 | rb_dlinkAddTail(ctl_buf, &ctl_buf->node, &ctl->readq); | |
898 | for (i = 0; i < MAXPASSFD && ctl_buf->F[i] != NULL; i++) | |
899 | ; | |
900 | ctl_buf->nfds = i; | |
901 | } | |
902 | } | |
903 | while(retlen > 0); | |
904 | ||
905 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
906 | exit(0); | |
907 | ||
908 | mod_process_cmd_recv(ctl); | |
909 | rb_setselect(ctl->F, RB_SELECT_READ, mod_read_ctl, ctl); | |
910 | } | |
911 | ||
912 | static void | |
913 | mod_write_ctl(rb_fde_t *F, void *data) | |
914 | { | |
915 | mod_ctl_t *ctl = data; | |
916 | mod_ctl_buf_t *ctl_buf; | |
917 | rb_dlink_node *ptr, *next; | |
918 | int retlen, x; | |
919 | ||
920 | RB_DLINK_FOREACH_SAFE(ptr, next, ctl->writeq.head) | |
921 | { | |
922 | ctl_buf = ptr->data; | |
923 | retlen = rb_send_fd_buf(ctl->F, ctl_buf->F, ctl_buf->nfds, ctl_buf->buf, | |
924 | ctl_buf->buflen, ppid); | |
925 | if(retlen > 0) | |
926 | { | |
927 | rb_dlinkDelete(ptr, &ctl->writeq); | |
928 | for(x = 0; x < ctl_buf->nfds; x++) | |
929 | rb_close(ctl_buf->F[x]); | |
930 | rb_free(ctl_buf->buf); | |
931 | rb_free(ctl_buf); | |
932 | ||
933 | } | |
934 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
935 | exit(0); | |
936 | ||
937 | } | |
938 | if(rb_dlink_list_length(&ctl->writeq) > 0) | |
939 | rb_setselect(ctl->F, RB_SELECT_WRITE, mod_write_ctl, ctl); | |
940 | } | |
941 | ||
942 | ||
943 | static void | |
944 | read_pipe_ctl(rb_fde_t *F, void *data) | |
945 | { | |
946 | char inbuf[READBUF_SIZE]; | |
947 | int retlen; | |
948 | while((retlen = rb_read(F, inbuf, sizeof(inbuf))) > 0) | |
949 | { | |
950 | ;; /* we don't do anything with the pipe really, just care if the other process dies.. */ | |
951 | } | |
952 | if(retlen == 0 || (retlen < 0 && !rb_ignore_errno(errno))) | |
953 | exit(0); | |
954 | rb_setselect(F, RB_SELECT_READ, read_pipe_ctl, NULL); | |
955 | ||
956 | } | |
957 | ||
958 | int | |
959 | main(int argc, char **argv) | |
960 | { | |
961 | const char *s_ctlfd, *s_pipe, *s_pid; | |
962 | int ctlfd, pipefd, maxfd, x; | |
963 | maxfd = maxconn(); | |
964 | ||
965 | s_ctlfd = getenv("CTL_FD"); | |
966 | s_pipe = getenv("CTL_PIPE"); | |
967 | s_pid = getenv("CTL_PPID"); | |
968 | ||
969 | if(s_ctlfd == NULL || s_pipe == NULL || s_pid == NULL) | |
970 | { | |
971 | fprintf(stderr, | |
972 | "This is the solanum ssld for internal ircd use.\n"); | |
973 | fprintf(stderr, | |
974 | "You aren't supposed to run me directly. Exiting.\n"); | |
975 | exit(1); | |
976 | } | |
977 | ||
978 | ctlfd = atoi(s_ctlfd); | |
979 | pipefd = atoi(s_pipe); | |
980 | ppid = atoi(s_pid); | |
981 | ||
982 | for(x = 3; x < maxfd; x++) | |
983 | { | |
984 | if(x != ctlfd && x != pipefd) | |
985 | close(x); | |
986 | } | |
987 | ||
988 | x = open("/dev/null", O_RDWR); | |
989 | ||
990 | if(x >= 0) | |
991 | { | |
992 | if(ctlfd != 0 && pipefd != 0) | |
993 | dup2(x, 0); | |
994 | if(ctlfd != 1 && pipefd != 1) | |
995 | dup2(x, 1); | |
996 | if(ctlfd != 2 && pipefd != 2) | |
997 | dup2(x, 2); | |
998 | if(x > 2) | |
999 | close(x); | |
1000 | } | |
1001 | ||
1002 | setup_signals(); | |
1003 | rb_lib_init(NULL, NULL, NULL, 0, maxfd, 1024, 4096); | |
1004 | rb_init_rawbuffers(1024); | |
1005 | rb_init_prng(NULL, RB_PRNG_DEFAULT); | |
1006 | ssld_ssl_ok = rb_supports_ssl(); | |
1007 | mod_ctl = rb_malloc(sizeof(mod_ctl_t)); | |
1008 | mod_ctl->F = rb_open(ctlfd, RB_FD_SOCKET, "ircd control socket"); | |
1009 | mod_ctl->F_pipe = rb_open(pipefd, RB_FD_PIPE, "ircd pipe"); | |
1010 | rb_set_nb(mod_ctl->F); | |
1011 | rb_set_nb(mod_ctl->F_pipe); | |
1012 | rb_event_addish("clean_dead_conns", clean_dead_conns, NULL, 10); | |
1013 | rb_event_add("check_handshake_flood", check_handshake_flood, NULL, 10); | |
1014 | read_pipe_ctl(mod_ctl->F_pipe, NULL); | |
1015 | mod_read_ctl(mod_ctl->F, mod_ctl); | |
1016 | send_version(mod_ctl); | |
1017 | if(!zlib_ok && !ssld_ssl_ok) | |
1018 | { | |
1019 | /* this is really useless... */ | |
1020 | send_i_am_useless(mod_ctl); | |
1021 | /* sleep until the ircd kills us */ | |
1022 | rb_sleep(1 << 30, 0); | |
1023 | exit(1); | |
1024 | } | |
1025 | ||
1026 | if(!zlib_ok) | |
1027 | send_nozlib_support(mod_ctl, NULL); | |
1028 | if(!ssld_ssl_ok) | |
1029 | send_nossl_support(mod_ctl, NULL); | |
1030 | rb_lib_loop(0); | |
1031 | return 0; | |
1032 | } | |
1033 | ||
1034 | ||
1035 | static void | |
1036 | dummy_handler(int sig) | |
1037 | { | |
1038 | return; | |
1039 | } | |
1040 | ||
1041 | static void | |
1042 | setup_signals() | |
1043 | { | |
1044 | struct sigaction act; | |
1045 | ||
1046 | act.sa_flags = 0; | |
1047 | act.sa_handler = SIG_IGN; | |
1048 | sigemptyset(&act.sa_mask); | |
1049 | sigaddset(&act.sa_mask, SIGPIPE); | |
1050 | sigaddset(&act.sa_mask, SIGALRM); | |
1051 | #ifdef SIGTRAP | |
1052 | sigaddset(&act.sa_mask, SIGTRAP); | |
1053 | #endif | |
1054 | ||
1055 | #ifdef SIGWINCH | |
1056 | sigaddset(&act.sa_mask, SIGWINCH); | |
1057 | sigaction(SIGWINCH, &act, 0); | |
1058 | #endif | |
1059 | sigaction(SIGPIPE, &act, 0); | |
1060 | #ifdef SIGTRAP | |
1061 | sigaction(SIGTRAP, &act, 0); | |
1062 | #endif | |
1063 | ||
1064 | act.sa_handler = dummy_handler; | |
1065 | sigaction(SIGALRM, &act, 0); | |
1066 | } |