1 88acf51a 2026-04-02 tb /* $OpenBSD: relay.c,v 1.263 2026/04/02 13:38:24 tb Exp $ */
4 c525adb9 2014-04-18 reyk * Copyright (c) 2006 - 2014 Reyk Floeter <reyk@openbsd.org>
6 30640247 2007-02-22 reyk * Permission to use, copy, modify, and distribute this software for any
7 30640247 2007-02-22 reyk * purpose with or without fee is hereby granted, provided that the above
8 30640247 2007-02-22 reyk * copyright notice and this permission notice appear in all copies.
10 30640247 2007-02-22 reyk * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 30640247 2007-02-22 reyk * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 30640247 2007-02-22 reyk * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 30640247 2007-02-22 reyk * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 30640247 2007-02-22 reyk * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 30640247 2007-02-22 reyk * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 30640247 2007-02-22 reyk * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 30640247 2007-02-22 reyk #include <sys/types.h>
20 e1f9d231 2007-11-24 reyk #include <sys/queue.h>
21 30640247 2007-02-22 reyk #include <sys/time.h>
22 30640247 2007-02-22 reyk #include <sys/socket.h>
23 30640247 2007-02-22 reyk #include <sys/tree.h>
25 30640247 2007-02-22 reyk #include <netinet/in.h>
26 30640247 2007-02-22 reyk #include <netinet/tcp.h>
27 d93c36af 2015-01-22 reyk #include <arpa/inet.h>
29 d93c36af 2015-01-22 reyk #include <limits.h>
30 fc2c091b 2019-05-10 reyk #include <netdb.h>
31 e5c598d0 2016-09-01 claudio #include <poll.h>
32 d93c36af 2015-01-22 reyk #include <stdio.h>
33 d93c36af 2015-01-22 reyk #include <stdlib.h>
34 30640247 2007-02-22 reyk #include <errno.h>
35 30640247 2007-02-22 reyk #include <fcntl.h>
36 30640247 2007-02-22 reyk #include <string.h>
37 30640247 2007-02-22 reyk #include <unistd.h>
38 30640247 2007-02-22 reyk #include <event.h>
39 d93c36af 2015-01-22 reyk #include <siphash.h>
40 d93c36af 2015-01-22 reyk #include <imsg.h>
42 f4a6eef3 2017-05-27 claudio #include <tls.h>
44 6d0767ae 2007-12-07 reyk #include "relayd.h"
45 6b5c4000 2026-03-02 rsadowski #include "log.h"
47 2f6ec04d 2015-01-16 deraadt #define MINIMUM(a, b) (((a) < (b)) ? (a) : (b))
49 30640247 2007-02-22 reyk void relay_statistics(int, short, void *);
50 dbef7d4f 2011-05-09 reyk int relay_dispatch_parent(int, struct privsep_proc *,
51 dbef7d4f 2011-05-09 reyk struct imsg *);
52 dbef7d4f 2011-05-09 reyk int relay_dispatch_pfe(int, struct privsep_proc *,
53 dbef7d4f 2011-05-09 reyk struct imsg *);
54 c525adb9 2014-04-18 reyk int relay_dispatch_ca(int, struct privsep_proc *,
55 c525adb9 2014-04-18 reyk struct imsg *);
56 28bd28ce 2014-11-19 blambert int relay_dispatch_hce(int, struct privsep_proc *,
57 28bd28ce 2014-11-19 blambert struct imsg *);
58 30640247 2007-02-22 reyk void relay_shutdown(void);
60 30640247 2007-02-22 reyk void relay_protodebug(struct relay *);
61 69fde657 2014-07-09 reyk void relay_ruledebug(struct relay_rule *);
62 dbef7d4f 2011-05-09 reyk void relay_init(struct privsep *, struct privsep_proc *p, void *);
63 30640247 2007-02-22 reyk void relay_launch(void);
64 30640247 2007-02-22 reyk int relay_socket(struct sockaddr_storage *, in_port_t,
65 9ce3310d 2010-12-20 dhill struct protocol *, int, int);
66 30640247 2007-02-22 reyk int relay_socket_listen(struct sockaddr_storage *, in_port_t,
67 30640247 2007-02-22 reyk struct protocol *);
68 30640247 2007-02-22 reyk int relay_socket_connect(struct sockaddr_storage *, in_port_t,
69 6d5340e6 2008-06-11 reyk struct protocol *, int);
71 30640247 2007-02-22 reyk void relay_accept(int, short, void *);
72 61afd4d6 2009-08-07 reyk void relay_input(struct rsession *);
74 3e04b122 2014-12-18 reyk void relay_hash_addr(SIPHASH_CTX *, struct sockaddr_storage *, int);
76 f4a6eef3 2017-05-27 claudio int relay_tls_ctx_create(struct relay *);
77 096ff28b 2014-12-12 reyk void relay_tls_transaction(struct rsession *,
78 6024acb8 2009-04-01 reyk struct ctl_relay_event *);
79 f4a6eef3 2017-05-27 claudio void relay_tls_handshake(int, short, void *);
80 096ff28b 2014-12-12 reyk void relay_tls_connected(struct ctl_relay_event *);
81 096ff28b 2014-12-12 reyk void relay_tls_readcb(int, short, void *);
82 096ff28b 2014-12-12 reyk void relay_tls_writecb(int, short, void *);
84 b8764354 2019-05-13 reyk void relay_connect_retry(int, short, void *);
85 b8764354 2019-05-13 reyk void relay_connect_state(struct rsession *,
86 b8764354 2019-05-13 reyk struct ctl_relay_event *, enum relay_state);
88 30640247 2007-02-22 reyk extern void bufferevent_read_pressure_cb(struct evbuffer *, size_t,
89 30640247 2007-02-22 reyk size_t, void *);
91 61cca588 2012-09-21 benno volatile int relay_sessions;
92 61cca588 2012-09-21 benno volatile int relay_inflight = 0;
93 30640247 2007-02-22 reyk objid_t relay_conid;
95 6d0767ae 2007-12-07 reyk static struct relayd *env = NULL;
97 dbef7d4f 2011-05-09 reyk static struct privsep_proc procs[] = {
98 dbef7d4f 2011-05-09 reyk { "parent", PROC_PARENT, relay_dispatch_parent },
99 dbef7d4f 2011-05-09 reyk { "pfe", PROC_PFE, relay_dispatch_pfe },
100 28bd28ce 2014-11-19 blambert { "ca", PROC_CA, relay_dispatch_ca },
101 28bd28ce 2014-11-19 blambert { "hce", PROC_HCE, relay_dispatch_hce },
105 dbef7d4f 2011-05-09 reyk relay(struct privsep *ps, struct privsep_proc *p)
107 dbef7d4f 2011-05-09 reyk env = ps->ps_env;
108 94404df8 2016-09-02 reyk proc_run(ps, p, procs, nitems(procs), relay_init, NULL);
109 69fde657 2014-07-09 reyk relay_http(env);
113 30640247 2007-02-22 reyk relay_shutdown(void)
115 591e6ab5 2011-05-19 reyk config_purge(env, CONFIG_ALL);
116 30640247 2007-02-22 reyk usleep(200); /* XXX relay needs to shutdown last */
120 69fde657 2014-07-09 reyk relay_ruledebug(struct relay_rule *rule)
122 69fde657 2014-07-09 reyk struct kv *kv = NULL;
124 fc2c091b 2019-05-10 reyk char buf[NI_MAXHOST];
126 a0941812 2007-11-19 reyk fprintf(stderr, "\t\t");
128 69fde657 2014-07-09 reyk switch (rule->rule_action) {
129 69fde657 2014-07-09 reyk case RULE_ACTION_MATCH:
130 69fde657 2014-07-09 reyk fprintf(stderr, "match ");
132 69fde657 2014-07-09 reyk case RULE_ACTION_BLOCK:
133 69fde657 2014-07-09 reyk fprintf(stderr, "block ");
135 69fde657 2014-07-09 reyk case RULE_ACTION_PASS:
136 69fde657 2014-07-09 reyk fprintf(stderr, "pass ");
140 69fde657 2014-07-09 reyk switch (rule->rule_dir) {
141 69fde657 2014-07-09 reyk case RELAY_DIR_ANY:
143 69fde657 2014-07-09 reyk case RELAY_DIR_REQUEST:
144 69fde657 2014-07-09 reyk fprintf(stderr, "request ");
146 69fde657 2014-07-09 reyk case RELAY_DIR_RESPONSE:
147 69fde657 2014-07-09 reyk fprintf(stderr, "response ");
151 69fde657 2014-07-09 reyk /* NOTREACHED */
155 69fde657 2014-07-09 reyk if (rule->rule_flags & RULE_FLAG_QUICK)
156 69fde657 2014-07-09 reyk fprintf(stderr, "quick ");
158 fc2c091b 2019-05-10 reyk switch (rule->rule_af) {
159 fc2c091b 2019-05-10 reyk case AF_INET:
160 fc2c091b 2019-05-10 reyk fprintf(stderr, "inet ");
162 fc2c091b 2019-05-10 reyk case AF_INET6:
163 fc2c091b 2019-05-10 reyk fprintf(stderr, "inet6 ");
167 fc2c091b 2019-05-10 reyk if (rule->rule_src.addr.ss_family != AF_UNSPEC)
168 fc2c091b 2019-05-10 reyk fprintf(stderr, "from %s/%d ",
169 fc2c091b 2019-05-10 reyk print_host(&rule->rule_src.addr, buf, sizeof(buf)),
170 fc2c091b 2019-05-10 reyk rule->rule_src.addr_mask);
172 fc2c091b 2019-05-10 reyk if (rule->rule_dst.addr.ss_family != AF_UNSPEC)
173 fc2c091b 2019-05-10 reyk fprintf(stderr, "to %s/%d ",
174 fc2c091b 2019-05-10 reyk print_host(&rule->rule_dst.addr, buf, sizeof(buf)),
175 fc2c091b 2019-05-10 reyk rule->rule_dst.addr_mask);
177 69fde657 2014-07-09 reyk for (i = 1; i < KEY_TYPE_MAX; i++) {
178 69fde657 2014-07-09 reyk kv = &rule->rule_kv[i];
179 69fde657 2014-07-09 reyk if (kv->kv_type != i)
182 69fde657 2014-07-09 reyk switch (kv->kv_type) {
183 69fde657 2014-07-09 reyk case KEY_TYPE_COOKIE:
184 69fde657 2014-07-09 reyk fprintf(stderr, "cookie ");
186 69fde657 2014-07-09 reyk case KEY_TYPE_HEADER:
187 69fde657 2014-07-09 reyk fprintf(stderr, "header ");
189 69fde657 2014-07-09 reyk case KEY_TYPE_PATH:
190 69fde657 2014-07-09 reyk fprintf(stderr, "path ");
192 69fde657 2014-07-09 reyk case KEY_TYPE_QUERY:
193 69fde657 2014-07-09 reyk fprintf(stderr, "query ");
195 69fde657 2014-07-09 reyk case KEY_TYPE_URL:
196 69fde657 2014-07-09 reyk fprintf(stderr, "url ");
202 69fde657 2014-07-09 reyk switch (kv->kv_option) {
203 69fde657 2014-07-09 reyk case KEY_OPTION_APPEND:
204 69fde657 2014-07-09 reyk fprintf(stderr, "append ");
206 69fde657 2014-07-09 reyk case KEY_OPTION_SET:
207 69fde657 2014-07-09 reyk fprintf(stderr, "set ");
209 69fde657 2014-07-09 reyk case KEY_OPTION_REMOVE:
210 69fde657 2014-07-09 reyk fprintf(stderr, "remove ");
212 69fde657 2014-07-09 reyk case KEY_OPTION_HASH:
213 69fde657 2014-07-09 reyk fprintf(stderr, "hash ");
215 69fde657 2014-07-09 reyk case KEY_OPTION_LOG:
216 69fde657 2014-07-09 reyk fprintf(stderr, "log ");
218 d498e80a 2021-01-09 denis case KEY_OPTION_STRIP:
219 d498e80a 2021-01-09 denis fprintf(stderr, "strip ");
221 69fde657 2014-07-09 reyk case KEY_OPTION_NONE:
225 69fde657 2014-07-09 reyk switch (kv->kv_digest) {
226 69fde657 2014-07-09 reyk case DIGEST_SHA1:
227 69fde657 2014-07-09 reyk case DIGEST_MD5:
228 69fde657 2014-07-09 reyk fprintf(stderr, "digest ");
234 d498e80a 2021-01-09 denis int kvv = (kv->kv_option == KEY_OPTION_STRIP ||
235 d498e80a 2021-01-09 denis kv->kv_value == NULL);
236 69fde657 2014-07-09 reyk fprintf(stderr, "%s%s%s%s%s%s ",
237 69fde657 2014-07-09 reyk kv->kv_key == NULL ? "" : "\"",
238 69fde657 2014-07-09 reyk kv->kv_key == NULL ? "" : kv->kv_key,
239 69fde657 2014-07-09 reyk kv->kv_key == NULL ? "" : "\"",
240 d498e80a 2021-01-09 denis kvv ? "" : " value \"",
241 69fde657 2014-07-09 reyk kv->kv_value == NULL ? "" : kv->kv_value,
242 d498e80a 2021-01-09 denis kvv ? "" : "\"");
245 69fde657 2014-07-09 reyk if (rule->rule_tablename[0])
246 69fde657 2014-07-09 reyk fprintf(stderr, "forward to <%s> ", rule->rule_tablename);
248 69fde657 2014-07-09 reyk if (rule->rule_tag == -1)
249 69fde657 2014-07-09 reyk fprintf(stderr, "no tag ");
250 69fde657 2014-07-09 reyk else if (rule->rule_tag && rule->rule_tagname[0])
251 69fde657 2014-07-09 reyk fprintf(stderr, "tag \"%s\" ",
252 69fde657 2014-07-09 reyk rule->rule_tagname);
254 69fde657 2014-07-09 reyk if (rule->rule_tagged && rule->rule_taggedname[0])
255 69fde657 2014-07-09 reyk fprintf(stderr, "tagged \"%s\" ",
256 69fde657 2014-07-09 reyk rule->rule_taggedname);
258 69fde657 2014-07-09 reyk if (rule->rule_label == -1)
259 69fde657 2014-07-09 reyk fprintf(stderr, "no label ");
260 69fde657 2014-07-09 reyk else if (rule->rule_label && rule->rule_labelname[0])
261 69fde657 2014-07-09 reyk fprintf(stderr, "label \"%s\" ",
262 69fde657 2014-07-09 reyk rule->rule_labelname);
264 a0941812 2007-11-19 reyk fprintf(stderr, "\n");
268 30640247 2007-02-22 reyk relay_protodebug(struct relay *rlay)
270 146643ba 2008-01-31 reyk struct protocol *proto = rlay->rl_proto;
271 69fde657 2014-07-09 reyk struct relay_rule *rule = NULL;
273 591e6ab5 2011-05-19 reyk fprintf(stderr, "protocol %d: name %s\n",
274 591e6ab5 2011-05-19 reyk proto->id, proto->name);
275 ee6d33e4 2011-04-12 reyk fprintf(stderr, "\tflags: %s, relay flags: %s\n",
276 ee6d33e4 2011-04-12 reyk printb_flags(proto->flags, F_BITS),
277 ee6d33e4 2011-04-12 reyk printb_flags(rlay->rl_conf.flags, F_BITS));
278 ee6d33e4 2011-04-12 reyk if (proto->tcpflags)
279 ee6d33e4 2011-04-12 reyk fprintf(stderr, "\ttcp flags: %s\n",
280 ee6d33e4 2011-04-12 reyk printb_flags(proto->tcpflags, TCPFLAG_BITS));
281 096ff28b 2014-12-12 reyk if ((rlay->rl_conf.flags & (F_TLS|F_TLSCLIENT)) && proto->tlsflags)
282 096ff28b 2014-12-12 reyk fprintf(stderr, "\ttls flags: %s\n",
283 096ff28b 2014-12-12 reyk printb_flags(proto->tlsflags, TLSFLAG_BITS));
284 e5c598d0 2016-09-01 claudio fprintf(stderr, "\ttls session tickets: %s\n",
285 f4a6eef3 2017-05-27 claudio (proto->tickets == 1) ? "enabled" : "disabled");
286 30640247 2007-02-22 reyk fprintf(stderr, "\ttype: ");
287 30640247 2007-02-22 reyk switch (proto->type) {
288 30640247 2007-02-22 reyk case RELAY_PROTO_TCP:
289 30640247 2007-02-22 reyk fprintf(stderr, "tcp\n");
291 30640247 2007-02-22 reyk case RELAY_PROTO_HTTP:
292 30640247 2007-02-22 reyk fprintf(stderr, "http\n");
294 7ba7514d 2007-09-10 reyk case RELAY_PROTO_DNS:
295 7ba7514d 2007-09-10 reyk fprintf(stderr, "dns\n");
299 69fde657 2014-07-09 reyk rule = TAILQ_FIRST(&proto->rules);
300 69fde657 2014-07-09 reyk while (rule != NULL) {
301 69fde657 2014-07-09 reyk relay_ruledebug(rule);
302 69fde657 2014-07-09 reyk rule = TAILQ_NEXT(rule, rule_entry);
307 591e6ab5 2011-05-19 reyk relay_privinit(struct relay *rlay)
309 591e6ab5 2011-05-19 reyk log_debug("%s: adding relay %s", __func__, rlay->rl_conf.name);
311 afbe8d84 2017-01-09 reyk if (log_getverbose() > 1)
312 591e6ab5 2011-05-19 reyk relay_protodebug(rlay);
314 591e6ab5 2011-05-19 reyk switch (rlay->rl_proto->type) {
315 591e6ab5 2011-05-19 reyk case RELAY_PROTO_DNS:
316 a2811280 2017-07-04 benno relay_udp_privinit(rlay);
318 591e6ab5 2011-05-19 reyk case RELAY_PROTO_TCP:
320 591e6ab5 2011-05-19 reyk case RELAY_PROTO_HTTP:
324 591e6ab5 2011-05-19 reyk if (rlay->rl_conf.flags & F_UDP)
325 591e6ab5 2011-05-19 reyk rlay->rl_s = relay_udp_bind(&rlay->rl_conf.ss,
326 591e6ab5 2011-05-19 reyk rlay->rl_conf.port, rlay->rl_proto);
328 591e6ab5 2011-05-19 reyk rlay->rl_s = relay_socket_listen(&rlay->rl_conf.ss,
329 591e6ab5 2011-05-19 reyk rlay->rl_conf.port, rlay->rl_proto);
330 591e6ab5 2011-05-19 reyk if (rlay->rl_s == -1)
331 591e6ab5 2011-05-19 reyk return (-1);
333 591e6ab5 2011-05-19 reyk return (0);
337 dbef7d4f 2011-05-09 reyk relay_init(struct privsep *ps, struct privsep_proc *p, void *arg)
339 30640247 2007-02-22 reyk struct timeval tv;
341 591e6ab5 2011-05-19 reyk if (config_init(ps->ps_env) == -1)
342 591e6ab5 2011-05-19 reyk fatal("failed to initialize configuration");
344 dbef7d4f 2011-05-09 reyk /* We use a custom shutdown callback */
345 dbef7d4f 2011-05-09 reyk p->p_shutdown = relay_shutdown;
347 ea47f1c4 2010-11-30 reyk /* Unlimited file descriptors (use system limits) */
348 ea47f1c4 2010-11-30 reyk socket_rlimit(-1);
350 8bee5325 2015-12-04 benno if (pledge("stdio recvfd inet", NULL) == -1)
351 8bee5325 2015-12-04 benno fatal("pledge");
353 30640247 2007-02-22 reyk /* Schedule statistics timer */
354 b14526d5 2016-09-02 reyk evtimer_set(&env->sc_statev, relay_statistics, ps);
355 58fc320c 2016-09-02 reyk bcopy(&env->sc_conf.statinterval, &tv, sizeof(tv));
356 23fba4ad 2008-01-31 reyk evtimer_add(&env->sc_statev, &tv);
360 28bd28ce 2014-11-19 blambert relay_session_publish(struct rsession *s)
362 141b9058 2015-12-02 reyk proc_compose(env->sc_ps, PROC_PFE, IMSG_SESS_PUBLISH, s, sizeof(*s));
366 28bd28ce 2014-11-19 blambert relay_session_unpublish(struct rsession *s)
368 141b9058 2015-12-02 reyk proc_compose(env->sc_ps, PROC_PFE, IMSG_SESS_UNPUBLISH,
369 28bd28ce 2014-11-19 blambert &s->se_id, sizeof(s->se_id));
373 30640247 2007-02-22 reyk relay_statistics(int fd, short events, void *arg)
375 b14526d5 2016-09-02 reyk struct privsep *ps = arg;
376 30640247 2007-02-22 reyk struct relay *rlay;
377 30640247 2007-02-22 reyk struct ctl_stats crs, *cur;
378 30640247 2007-02-22 reyk struct timeval tv, tv_now;
379 30640247 2007-02-22 reyk int resethour = 0, resetday = 0;
380 61afd4d6 2009-08-07 reyk struct rsession *con, *next_con;
383 30640247 2007-02-22 reyk * This is a hack to calculate some average statistics.
384 30640247 2007-02-22 reyk * It doesn't try to be very accurate, but could be improved...
387 30640247 2007-02-22 reyk timerclear(&tv);
388 b7f7a948 2013-03-10 reyk getmonotime(&tv_now);
390 146643ba 2008-01-31 reyk TAILQ_FOREACH(rlay, env->sc_relays, rl_entry) {
391 30640247 2007-02-22 reyk bzero(&crs, sizeof(crs));
392 30640247 2007-02-22 reyk resethour = resetday = 0;
394 b14526d5 2016-09-02 reyk cur = &rlay->rl_stats[ps->ps_instance];
395 30640247 2007-02-22 reyk cur->cnt += cur->last;
396 30640247 2007-02-22 reyk cur->tick++;
397 30640247 2007-02-22 reyk cur->avg = (cur->last + cur->avg) / 2;
398 30640247 2007-02-22 reyk cur->last_hour += cur->last;
399 58fc320c 2016-09-02 reyk if ((cur->tick %
400 58fc320c 2016-09-02 reyk (3600 / env->sc_conf.statinterval.tv_sec)) == 0) {
401 30640247 2007-02-22 reyk cur->avg_hour = (cur->last_hour + cur->avg_hour) / 2;
402 30640247 2007-02-22 reyk resethour++;
404 30640247 2007-02-22 reyk cur->last_day += cur->last;
405 58fc320c 2016-09-02 reyk if ((cur->tick %
406 58fc320c 2016-09-02 reyk (86400 / env->sc_conf.statinterval.tv_sec)) == 0) {
407 30640247 2007-02-22 reyk cur->avg_day = (cur->last_day + cur->avg_day) / 2;
408 30640247 2007-02-22 reyk resethour++;
410 30640247 2007-02-22 reyk bcopy(cur, &crs, sizeof(crs));
412 30640247 2007-02-22 reyk cur->last = 0;
413 30640247 2007-02-22 reyk if (resethour)
414 30640247 2007-02-22 reyk cur->last_hour = 0;
415 30640247 2007-02-22 reyk if (resetday)
416 30640247 2007-02-22 reyk cur->last_day = 0;
418 146643ba 2008-01-31 reyk crs.id = rlay->rl_conf.id;
419 b14526d5 2016-09-02 reyk crs.proc = ps->ps_instance;
420 141b9058 2015-12-02 reyk proc_compose(env->sc_ps, PROC_PFE, IMSG_STATISTICS,
421 30640247 2007-02-22 reyk &crs, sizeof(crs));
423 146643ba 2008-01-31 reyk for (con = SPLAY_ROOT(&rlay->rl_sessions);
424 30640247 2007-02-22 reyk con != NULL; con = next_con) {
425 3f22dc0a 2007-09-05 reyk next_con = SPLAY_NEXT(session_tree,
426 146643ba 2008-01-31 reyk &rlay->rl_sessions, con);
427 aa79f3aa 2008-01-31 thib timersub(&tv_now, &con->se_tv_last, &tv);
428 146643ba 2008-01-31 reyk if (timercmp(&tv, &rlay->rl_conf.timeout, >=))
429 37ed6014 2018-08-06 benno relay_close(con, "hard timeout", 1);
433 30640247 2007-02-22 reyk /* Schedule statistics timer */
434 b14526d5 2016-09-02 reyk evtimer_set(&env->sc_statev, relay_statistics, ps);
435 58fc320c 2016-09-02 reyk bcopy(&env->sc_conf.statinterval, &tv, sizeof(tv));
436 23fba4ad 2008-01-31 reyk evtimer_add(&env->sc_statev, &tv);
440 30640247 2007-02-22 reyk relay_launch(void)
442 0f7a5e2e 2012-10-03 reyk void (*callback)(int, short, void *);
443 0f7a5e2e 2012-10-03 reyk struct relay *rlay;
444 0f7a5e2e 2012-10-03 reyk struct host *host;
445 0f7a5e2e 2012-10-03 reyk struct relay_table *rlt;
447 146643ba 2008-01-31 reyk TAILQ_FOREACH(rlay, env->sc_relays, rl_entry) {
448 096ff28b 2014-12-12 reyk if ((rlay->rl_conf.flags & (F_TLS|F_TLSCLIENT)) &&
449 f4a6eef3 2017-05-27 claudio relay_tls_ctx_create(rlay) == -1)
450 09e53fee 2017-05-28 benno fatalx("%s: failed to create TLS context", __func__);
452 0f7a5e2e 2012-10-03 reyk TAILQ_FOREACH(rlt, &rlay->rl_tables, rlt_entry) {
454 69fde657 2014-07-09 reyk * set rule->rule_table in advance and save time
455 69fde657 2014-07-09 reyk * looking up for this later on rule/connection
456 69fde657 2014-07-09 reyk * evalution
458 69fde657 2014-07-09 reyk rule_settable(&rlay->rl_proto->rules, rlt);
460 3e04b122 2014-12-18 reyk rlt->rlt_index = 0;
461 0f7a5e2e 2012-10-03 reyk rlt->rlt_nhosts = 0;
462 0f7a5e2e 2012-10-03 reyk TAILQ_FOREACH(host, &rlt->rlt_table->hosts, entry) {
463 0f7a5e2e 2012-10-03 reyk if (rlt->rlt_nhosts >= RELAY_MAXHOSTS)
464 09e53fee 2017-05-28 benno fatal("%s: too many hosts in table",
465 09e53fee 2017-05-28 benno __func__);
466 0f7a5e2e 2012-10-03 reyk host->idx = rlt->rlt_nhosts;
467 0f7a5e2e 2012-10-03 reyk rlt->rlt_host[rlt->rlt_nhosts++] = host;
469 591e6ab5 2011-05-19 reyk log_info("adding %d hosts from table %s%s",
470 0f7a5e2e 2012-10-03 reyk rlt->rlt_nhosts, rlt->rlt_table->conf.name,
471 0f7a5e2e 2012-10-03 reyk rlt->rlt_table->conf.check ? "" : " (no check)");
474 591e6ab5 2011-05-19 reyk switch (rlay->rl_proto->type) {
475 591e6ab5 2011-05-19 reyk case RELAY_PROTO_DNS:
476 a2811280 2017-07-04 benno relay_udp_init(env, rlay);
478 591e6ab5 2011-05-19 reyk case RELAY_PROTO_TCP:
479 591e6ab5 2011-05-19 reyk case RELAY_PROTO_HTTP:
480 69fde657 2014-07-09 reyk relay_http_init(rlay);
481 591e6ab5 2011-05-19 reyk /* Use defaults */
485 666bd316 2011-05-05 reyk log_debug("%s: running relay %s", __func__,
486 666bd316 2011-05-05 reyk rlay->rl_conf.name);
488 146643ba 2008-01-31 reyk rlay->rl_up = HOST_UP;
490 146643ba 2008-01-31 reyk if (rlay->rl_conf.flags & F_UDP)
491 7ba7514d 2007-09-10 reyk callback = relay_udp_server;
493 7ba7514d 2007-09-10 reyk callback = relay_accept;
495 1ca19f87 2012-04-11 deraadt event_set(&rlay->rl_ev, rlay->rl_s, EV_READ,
496 7ba7514d 2007-09-10 reyk callback, rlay);
497 146643ba 2008-01-31 reyk event_add(&rlay->rl_ev, NULL);
498 1ca19f87 2012-04-11 deraadt evtimer_set(&rlay->rl_evt, callback, rlay);
503 7ba7514d 2007-09-10 reyk relay_socket_af(struct sockaddr_storage *ss, in_port_t port)
505 30640247 2007-02-22 reyk switch (ss->ss_family) {
506 30640247 2007-02-22 reyk case AF_INET:
507 30640247 2007-02-22 reyk ((struct sockaddr_in *)ss)->sin_port = port;
508 30640247 2007-02-22 reyk ((struct sockaddr_in *)ss)->sin_len =
509 30640247 2007-02-22 reyk sizeof(struct sockaddr_in);
511 30640247 2007-02-22 reyk case AF_INET6:
512 30640247 2007-02-22 reyk ((struct sockaddr_in6 *)ss)->sin6_port = port;
513 30640247 2007-02-22 reyk ((struct sockaddr_in6 *)ss)->sin6_len =
514 30640247 2007-02-22 reyk sizeof(struct sockaddr_in6);
517 7ba7514d 2007-09-10 reyk return (-1);
520 7ba7514d 2007-09-10 reyk return (0);
524 9c52a29e 2011-04-07 reyk relay_socket_getport(struct sockaddr_storage *ss)
526 9c52a29e 2011-04-07 reyk switch (ss->ss_family) {
527 9c52a29e 2011-04-07 reyk case AF_INET:
528 9c52a29e 2011-04-07 reyk return (((struct sockaddr_in *)ss)->sin_port);
529 9c52a29e 2011-04-07 reyk case AF_INET6:
530 9c52a29e 2011-04-07 reyk return (((struct sockaddr_in6 *)ss)->sin6_port);
532 9c52a29e 2011-04-07 reyk return (0);
535 9c52a29e 2011-04-07 reyk /* NOTREACHED */
536 9c52a29e 2011-04-07 reyk return (0);
540 7ba7514d 2007-09-10 reyk relay_socket(struct sockaddr_storage *ss, in_port_t port,
541 9ce3310d 2010-12-20 dhill struct protocol *proto, int fd, int reuseport)
543 185b85c3 2014-06-27 andre struct linger lng;
544 185b85c3 2014-06-27 andre int s = -1, val;
546 7ba7514d 2007-09-10 reyk if (relay_socket_af(ss, port) == -1)
549 24dcf092 2015-11-28 reyk s = fd == -1 ? socket(ss->ss_family,
550 24dcf092 2015-11-28 reyk SOCK_STREAM | SOCK_NONBLOCK, IPPROTO_TCP) : fd;
551 6d5340e6 2008-06-11 reyk if (s == -1)
555 0a6c88ff 2007-03-13 reyk * Socket options
557 30640247 2007-02-22 reyk bzero(&lng, sizeof(lng));
558 30640247 2007-02-22 reyk if (setsockopt(s, SOL_SOCKET, SO_LINGER, &lng, sizeof(lng)) == -1)
560 9ce3310d 2010-12-20 dhill if (reuseport) {
562 9ce3310d 2010-12-20 dhill if (setsockopt(s, SOL_SOCKET, SO_REUSEPORT, &val,
563 9ce3310d 2010-12-20 dhill sizeof(int)) == -1)
566 0a6c88ff 2007-03-13 reyk if (proto->tcpflags & TCPFLAG_BUFSIZ) {
567 0a6c88ff 2007-03-13 reyk val = proto->tcpbufsiz;
568 0a6c88ff 2007-03-13 reyk if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
569 0a6c88ff 2007-03-13 reyk &val, sizeof(val)) == -1)
571 0a6c88ff 2007-03-13 reyk val = proto->tcpbufsiz;
572 0a6c88ff 2007-03-13 reyk if (setsockopt(s, SOL_SOCKET, SO_SNDBUF,
573 0a6c88ff 2007-03-13 reyk &val, sizeof(val)) == -1)
578 0a6c88ff 2007-03-13 reyk * IP options
580 0a6c88ff 2007-03-13 reyk if (proto->tcpflags & TCPFLAG_IPTTL) {
581 0a6c88ff 2007-03-13 reyk val = (int)proto->tcpipttl;
582 99857652 2016-11-10 jca switch (ss->ss_family) {
583 99857652 2016-11-10 jca case AF_INET:
584 99857652 2016-11-10 jca if (setsockopt(s, IPPROTO_IP, IP_TTL,
585 99857652 2016-11-10 jca &val, sizeof(val)) == -1)
588 99857652 2016-11-10 jca case AF_INET6:
589 99857652 2016-11-10 jca if (setsockopt(s, IPPROTO_IPV6, IPV6_UNICAST_HOPS,
590 99857652 2016-11-10 jca &val, sizeof(val)) == -1)
595 0a6c88ff 2007-03-13 reyk if (proto->tcpflags & TCPFLAG_IPMINTTL) {
596 0a6c88ff 2007-03-13 reyk val = (int)proto->tcpipminttl;
597 99857652 2016-11-10 jca switch (ss->ss_family) {
598 99857652 2016-11-10 jca case AF_INET:
599 99857652 2016-11-10 jca if (setsockopt(s, IPPROTO_IP, IP_MINTTL,
600 99857652 2016-11-10 jca &val, sizeof(val)) == -1)
603 99857652 2016-11-10 jca case AF_INET6:
604 99857652 2016-11-10 jca if (setsockopt(s, IPPROTO_IPV6, IPV6_MINHOPCOUNT,
605 99857652 2016-11-10 jca &val, sizeof(val)) == -1)
612 0a6c88ff 2007-03-13 reyk * TCP options
614 30640247 2007-02-22 reyk if (proto->tcpflags & (TCPFLAG_NODELAY|TCPFLAG_NNODELAY)) {
615 30640247 2007-02-22 reyk if (proto->tcpflags & TCPFLAG_NNODELAY)
619 30640247 2007-02-22 reyk if (setsockopt(s, IPPROTO_TCP, TCP_NODELAY,
620 30640247 2007-02-22 reyk &val, sizeof(val)) == -1)
623 30640247 2007-02-22 reyk if (proto->tcpflags & (TCPFLAG_SACK|TCPFLAG_NSACK)) {
624 30640247 2007-02-22 reyk if (proto->tcpflags & TCPFLAG_NSACK)
628 30640247 2007-02-22 reyk if (setsockopt(s, IPPROTO_TCP, TCP_SACK_ENABLE,
629 30640247 2007-02-22 reyk &val, sizeof(val)) == -1)
633 30640247 2007-02-22 reyk return (s);
636 30640247 2007-02-22 reyk if (s != -1)
638 30640247 2007-02-22 reyk return (-1);
642 30640247 2007-02-22 reyk relay_socket_connect(struct sockaddr_storage *ss, in_port_t port,
643 6d5340e6 2008-06-11 reyk struct protocol *proto, int fd)
647 9ce3310d 2010-12-20 dhill if ((s = relay_socket(ss, port, proto, fd, 0)) == -1)
648 30640247 2007-02-22 reyk return (-1);
650 30640247 2007-02-22 reyk if (connect(s, (struct sockaddr *)ss, ss->ss_len) == -1) {
651 30640247 2007-02-22 reyk if (errno != EINPROGRESS)
655 30640247 2007-02-22 reyk return (s);
659 30640247 2007-02-22 reyk return (-1);
663 30640247 2007-02-22 reyk relay_socket_listen(struct sockaddr_storage *ss, in_port_t port,
664 30640247 2007-02-22 reyk struct protocol *proto)
668 9ce3310d 2010-12-20 dhill if ((s = relay_socket(ss, port, proto, -1, 1)) == -1)
669 30640247 2007-02-22 reyk return (-1);
671 30640247 2007-02-22 reyk if (bind(s, (struct sockaddr *)ss, ss->ss_len) == -1)
673 ed29f86d 2007-02-24 reyk if (listen(s, proto->tcpbacklog) == -1)
676 30640247 2007-02-22 reyk return (s);
680 30640247 2007-02-22 reyk return (-1);
684 30640247 2007-02-22 reyk relay_connected(int fd, short sig, void *arg)
686 b8764354 2019-05-13 reyk char obuf[128];
687 6e65a975 2013-01-17 bluhm struct rsession *con = arg;
688 6e65a975 2013-01-17 bluhm struct relay *rlay = con->se_relay;
689 01c76597 2015-07-18 benno struct protocol *proto = rlay->rl_proto;
690 30640247 2007-02-22 reyk evbuffercb outrd = relay_read;
691 30640247 2007-02-22 reyk evbuffercb outwr = relay_write;
692 30640247 2007-02-22 reyk struct bufferevent *bev;
693 6024acb8 2009-04-01 reyk struct ctl_relay_event *out = &con->se_out;
694 f937d8d5 2017-12-27 benno char *msg;
695 a8aca5d6 2012-07-13 benno socklen_t len;
696 a8aca5d6 2012-07-13 benno int error;
698 30640247 2007-02-22 reyk if (sig == EV_TIMEOUT) {
699 8bf959a5 2012-09-20 reyk relay_abort_http(con, 504, "connect timeout", 0);
703 a8aca5d6 2012-07-13 benno len = sizeof(error);
704 f937d8d5 2017-12-27 benno if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &error, &len) == -1) {
705 f937d8d5 2017-12-27 benno relay_abort_http(con, 500, "getsockopt failed", 0);
708 f937d8d5 2017-12-27 benno if (error) {
709 f937d8d5 2017-12-27 benno errno = error;
710 f937d8d5 2017-12-27 benno if (asprintf(&msg, "socket error: %s",
711 f937d8d5 2017-12-27 benno strerror(error)) >= 0) {
712 f937d8d5 2017-12-27 benno relay_abort_http(con, 500, msg, 0);
713 f937d8d5 2017-12-27 benno free(msg);
716 f937d8d5 2017-12-27 benno relay_abort_http(con, 500,
717 f937d8d5 2017-12-27 benno "socket error and asprintf failed", 0);
722 f4a6eef3 2017-05-27 claudio if ((rlay->rl_conf.flags & F_TLSCLIENT) && (out->tls == NULL)) {
723 096ff28b 2014-12-12 reyk relay_tls_transaction(con, out);
727 69fde657 2014-07-09 reyk DPRINTF("%s: session %d: successful", __func__, con->se_id);
729 b8764354 2019-05-13 reyk /* Log destination if it was changed in a keep-alive connection */
730 b8764354 2019-05-13 reyk if ((con->se_table != con->se_table0) &&
731 b8764354 2019-05-13 reyk (env->sc_conf.opts & (RELAYD_OPT_LOGCON|RELAYD_OPT_LOGCONERR))) {
732 b8764354 2019-05-13 reyk con->se_table0 = con->se_table;
733 b8764354 2019-05-13 reyk memset(&obuf, 0, sizeof(obuf));
734 b8764354 2019-05-13 reyk (void)print_host(&con->se_out.ss, obuf, sizeof(obuf));
735 b8764354 2019-05-13 reyk if (asprintf(&msg, " -> %s:%d",
736 b8764354 2019-05-13 reyk obuf, ntohs(con->se_out.port)) == -1) {
737 b8764354 2019-05-13 reyk relay_abort_http(con, 500,
738 b8764354 2019-05-13 reyk "connection changed and asprintf failed", 0);
741 b8764354 2019-05-13 reyk relay_log(con, msg);
745 146643ba 2008-01-31 reyk switch (rlay->rl_proto->type) {
746 e624e530 2007-02-27 reyk case RELAY_PROTO_HTTP:
747 69fde657 2014-07-09 reyk if (relay_httpdesc_init(out) == -1) {
748 69fde657 2014-07-09 reyk relay_close(con,
749 37ed6014 2018-08-06 benno "failed to allocate http descriptor", 1);
752 69fde657 2014-07-09 reyk con->se_out.toread = TOREAD_HTTP_HEADER;
753 69fde657 2014-07-09 reyk outrd = relay_read_http;
755 e624e530 2007-02-27 reyk case RELAY_PROTO_TCP:
756 3f8b4585 2011-09-21 bluhm /* Use defaults */
759 09e53fee 2017-05-28 benno fatalx("%s: unknown protocol", __func__);
763 30640247 2007-02-22 reyk * Relay <-> Server
765 aa79f3aa 2008-01-31 thib bev = bufferevent_new(fd, outrd, outwr, relay_error, &con->se_out);
766 30640247 2007-02-22 reyk if (bev == NULL) {
767 8bf959a5 2012-09-20 reyk relay_abort_http(con, 500,
768 cd2aab3b 2007-11-26 reyk "failed to allocate output buffer event", 0);
772 80347df3 2026-02-18 kirill error = 0;
774 80347df3 2026-02-18 kirill if (rlay->rl_conf.flags & F_PROXYV1)
775 80347df3 2026-02-18 kirill error = proxy_protocol_v1(con, bev->output);
776 80347df3 2026-02-18 kirill else if (rlay->rl_conf.flags & F_PROXYV2)
777 80347df3 2026-02-18 kirill error = proxy_protocol_v2(con, bev->output);
779 80347df3 2026-02-18 kirill if (error) {
780 80347df3 2026-02-18 kirill relay_abort_http(con, 500, "failed to write PROXY header", 0);
784 e26e6200 2017-11-27 claudio /* write pending output buffer now */
785 e26e6200 2017-11-27 claudio if (bufferevent_write_buffer(bev, con->se_out.output)) {
786 e26e6200 2017-11-27 claudio relay_abort_http(con, 500, strerror(errno), 0);
789 aa79f3aa 2008-01-31 thib con->se_out.bev = bev;
791 096ff28b 2014-12-12 reyk /* Initialize the TLS wrapper */
792 f4a6eef3 2017-05-27 claudio if ((rlay->rl_conf.flags & F_TLSCLIENT) && (out->tls != NULL))
793 096ff28b 2014-12-12 reyk relay_tls_connected(out);
795 30640247 2007-02-22 reyk bufferevent_settimeout(bev,
796 146643ba 2008-01-31 reyk rlay->rl_conf.timeout.tv_sec, rlay->rl_conf.timeout.tv_sec);
797 01c76597 2015-07-18 benno bufferevent_setwatermark(bev, EV_WRITE,
798 01c76597 2015-07-18 benno RELAY_MIN_PREFETCHED * proto->tcpbufsiz, 0);
799 30640247 2007-02-22 reyk bufferevent_enable(bev, EV_READ|EV_WRITE);
800 01c76597 2015-07-18 benno if (con->se_in.bev)
801 01c76597 2015-07-18 benno bufferevent_enable(con->se_in.bev, EV_READ);
803 3f8b4585 2011-09-21 bluhm if (relay_splice(&con->se_out) == -1)
804 37ed6014 2018-08-06 benno relay_close(con, strerror(errno), 1);
808 61afd4d6 2009-08-07 reyk relay_input(struct rsession *con)
810 6e65a975 2013-01-17 bluhm struct relay *rlay = con->se_relay;
811 01c76597 2015-07-18 benno struct protocol *proto = rlay->rl_proto;
812 30640247 2007-02-22 reyk evbuffercb inrd = relay_read;
813 30640247 2007-02-22 reyk evbuffercb inwr = relay_write;
815 146643ba 2008-01-31 reyk switch (rlay->rl_proto->type) {
816 30640247 2007-02-22 reyk case RELAY_PROTO_HTTP:
817 94c8a65e 2021-03-24 benno if (relay_http_priv_init(con) == -1) {
818 69fde657 2014-07-09 reyk relay_close(con,
819 37ed6014 2018-08-06 benno "failed to allocate http descriptor", 1);
822 69fde657 2014-07-09 reyk con->se_in.toread = TOREAD_HTTP_HEADER;
823 69fde657 2014-07-09 reyk inrd = relay_read_http;
825 30640247 2007-02-22 reyk case RELAY_PROTO_TCP:
826 30640247 2007-02-22 reyk /* Use defaults */
829 09e53fee 2017-05-28 benno fatalx("%s: unknown protocol", __func__);
833 30640247 2007-02-22 reyk * Client <-> Relay
835 aa79f3aa 2008-01-31 thib con->se_in.bev = bufferevent_new(con->se_in.s, inrd, inwr,
836 aa79f3aa 2008-01-31 thib relay_error, &con->se_in);
837 aa79f3aa 2008-01-31 thib if (con->se_in.bev == NULL) {
838 37ed6014 2018-08-06 benno relay_close(con, "failed to allocate input buffer event", 1);
842 096ff28b 2014-12-12 reyk /* Initialize the TLS wrapper */
843 f4a6eef3 2017-05-27 claudio if ((rlay->rl_conf.flags & F_TLS) && con->se_in.tls != NULL)
844 096ff28b 2014-12-12 reyk relay_tls_connected(&con->se_in);
846 aa79f3aa 2008-01-31 thib bufferevent_settimeout(con->se_in.bev,
847 146643ba 2008-01-31 reyk rlay->rl_conf.timeout.tv_sec, rlay->rl_conf.timeout.tv_sec);
848 01c76597 2015-07-18 benno bufferevent_setwatermark(con->se_in.bev, EV_WRITE,
849 01c76597 2015-07-18 benno RELAY_MIN_PREFETCHED * proto->tcpbufsiz, 0);
850 aa79f3aa 2008-01-31 thib bufferevent_enable(con->se_in.bev, EV_READ|EV_WRITE);
852 3f8b4585 2011-09-21 bluhm if (relay_splice(&con->se_in) == -1)
853 37ed6014 2018-08-06 benno relay_close(con, strerror(errno), 1);
857 30640247 2007-02-22 reyk relay_write(struct bufferevent *bev, void *arg)
859 6e65a975 2013-01-17 bluhm struct ctl_relay_event *cre = arg;
860 63a1d849 2011-04-24 bluhm struct rsession *con = cre->con;
862 b7f7a948 2013-03-10 reyk getmonotime(&con->se_tv_last);
864 72d2562e 2017-08-28 bluhm if (con->se_done && EVBUFFER_LENGTH(EVBUFFER_OUTPUT(bev)) == 0)
865 b1e5969d 2013-03-09 bluhm goto done;
866 72d2562e 2017-08-28 bluhm if (cre->dst->bev)
867 72d2562e 2017-08-28 bluhm bufferevent_enable(cre->dst->bev, EV_READ);
868 b1e5969d 2013-03-09 bluhm if (relay_splice(cre->dst) == -1)
869 b1e5969d 2013-03-09 bluhm goto fail;
873 37ed6014 2018-08-06 benno relay_close(con, "last write (done)", 0);
876 37ed6014 2018-08-06 benno relay_close(con, strerror(errno), 1);
880 691e5d5c 2007-11-20 reyk relay_dump(struct ctl_relay_event *cre, const void *buf, size_t len)
886 691e5d5c 2007-11-20 reyk * This function will dump the specified message directly
887 691e5d5c 2007-11-20 reyk * to the underlying session, without waiting for success
888 691e5d5c 2007-11-20 reyk * of non-blocking events etc. This is useful to print an
889 691e5d5c 2007-11-20 reyk * error message before gracefully closing the session.
891 f4a6eef3 2017-05-27 claudio if (cre->tls != NULL)
892 f4a6eef3 2017-05-27 claudio (void)tls_write(cre->tls, buf, len);
894 691e5d5c 2007-11-20 reyk (void)write(cre->s, buf, len);
898 30640247 2007-02-22 reyk relay_read(struct bufferevent *bev, void *arg)
900 6e65a975 2013-01-17 bluhm struct ctl_relay_event *cre = arg;
901 63a1d849 2011-04-24 bluhm struct rsession *con = cre->con;
902 01c76597 2015-07-18 benno struct protocol *proto = con->se_relay->rl_proto;
903 30640247 2007-02-22 reyk struct evbuffer *src = EVBUFFER_INPUT(bev);
905 b7f7a948 2013-03-10 reyk getmonotime(&con->se_tv_last);
906 e442b42f 2014-07-14 bluhm cre->timedout = 0;
908 30640247 2007-02-22 reyk if (!EVBUFFER_LENGTH(src))
910 5df8b1c8 2007-02-26 reyk if (relay_bufferevent_write_buffer(cre->dst, src) == -1)
912 aa79f3aa 2008-01-31 thib if (con->se_done)
914 ec6e8722 2011-03-12 bluhm if (cre->dst->bev)
915 ec6e8722 2011-03-12 bluhm bufferevent_enable(cre->dst->bev, EV_READ);
916 01c76597 2015-07-18 benno if (cre->dst->bev && EVBUFFER_LENGTH(EVBUFFER_OUTPUT(cre->dst->bev)) >
917 01c76597 2015-07-18 benno (size_t)RELAY_MAX_PREFETCH * proto->tcpbufsiz)
918 01c76597 2015-07-18 benno bufferevent_disable(bev, EV_READ);
922 37ed6014 2018-08-06 benno relay_close(con, "last read (done)", 0);
925 37ed6014 2018-08-06 benno relay_close(con, strerror(errno), 1);
929 114ae72f 2015-05-18 bluhm * Splice sockets from cre to cre->dst if applicable. Returns:
930 114ae72f 2015-05-18 bluhm * -1 socket splicing has failed
931 114ae72f 2015-05-18 bluhm * 0 socket splicing is currently not possible
932 114ae72f 2015-05-18 bluhm * 1 socket splicing was successful
935 3f8b4585 2011-09-21 bluhm relay_splice(struct ctl_relay_event *cre)
937 3f8b4585 2011-09-21 bluhm struct rsession *con = cre->con;
938 6e65a975 2013-01-17 bluhm struct relay *rlay = con->se_relay;
939 3f8b4585 2011-09-21 bluhm struct protocol *proto = rlay->rl_proto;
940 3f8b4585 2011-09-21 bluhm struct splice sp;
942 096ff28b 2014-12-12 reyk if ((rlay->rl_conf.flags & (F_TLS|F_TLSCLIENT)) ||
943 3f8b4585 2011-09-21 bluhm (proto->tcpflags & TCPFLAG_NSPLICE))
944 3f8b4585 2011-09-21 bluhm return (0);
946 b1e5969d 2013-03-09 bluhm if (cre->splicelen >= 0)
947 3f8b4585 2011-09-21 bluhm return (0);
949 b1e5969d 2013-03-09 bluhm /* still not connected */
950 b1e5969d 2013-03-09 bluhm if (cre->bev == NULL || cre->dst->bev == NULL)
951 b1e5969d 2013-03-09 bluhm return (0);
953 e8d462ca 2015-07-28 reyk if (!(cre->toread == TOREAD_UNLIMITED || cre->toread > 0)) {
954 b1e5969d 2013-03-09 bluhm DPRINTF("%s: session %d: splice dir %d, nothing to read %lld",
955 b1e5969d 2013-03-09 bluhm __func__, con->se_id, cre->dir, cre->toread);
956 b1e5969d 2013-03-09 bluhm return (0);
959 b1e5969d 2013-03-09 bluhm /* do not splice before buffers have not been completely flushed */
960 b1e5969d 2013-03-09 bluhm if (EVBUFFER_LENGTH(cre->bev->input) ||
961 b1e5969d 2013-03-09 bluhm EVBUFFER_LENGTH(cre->dst->bev->output)) {
962 b1e5969d 2013-03-09 bluhm DPRINTF("%s: session %d: splice dir %d, dirty buffer",
963 b1e5969d 2013-03-09 bluhm __func__, con->se_id, cre->dir);
964 b1e5969d 2013-03-09 bluhm bufferevent_disable(cre->bev, EV_READ);
965 b1e5969d 2013-03-09 bluhm return (0);
968 3f8b4585 2011-09-21 bluhm bzero(&sp, sizeof(sp));
969 3f8b4585 2011-09-21 bluhm sp.sp_fd = cre->dst->s;
970 b1e5969d 2013-03-09 bluhm sp.sp_max = cre->toread > 0 ? cre->toread : 0;
971 69fde657 2014-07-09 reyk bcopy(&rlay->rl_conf.timeout, &sp.sp_idle, sizeof(sp.sp_idle));
972 3f8b4585 2011-09-21 bluhm if (setsockopt(cre->s, SOL_SOCKET, SO_SPLICE, &sp, sizeof(sp)) == -1) {
973 3f8b4585 2011-09-21 bluhm log_debug("%s: session %d: splice dir %d failed: %s",
974 3f8b4585 2011-09-21 bluhm __func__, con->se_id, cre->dir, strerror(errno));
975 3f8b4585 2011-09-21 bluhm return (-1);
977 3f8b4585 2011-09-21 bluhm cre->splicelen = 0;
978 b1e5969d 2013-03-09 bluhm bufferevent_enable(cre->bev, EV_READ);
980 b1e5969d 2013-03-09 bluhm DPRINTF("%s: session %d: splice dir %d, maximum %lld, successful",
981 b1e5969d 2013-03-09 bluhm __func__, con->se_id, cre->dir, cre->toread);
983 114ae72f 2015-05-18 bluhm return (1);
987 6caeec2c 2011-04-12 bluhm relay_splicelen(struct ctl_relay_event *cre)
989 3f8b4585 2011-09-21 bluhm struct rsession *con = cre->con;
990 3f8b4585 2011-09-21 bluhm off_t len;
991 3f8b4585 2011-09-21 bluhm socklen_t optlen;
993 b1e5969d 2013-03-09 bluhm if (cre->splicelen < 0)
994 b1e5969d 2013-03-09 bluhm return (0);
996 6caeec2c 2011-04-12 bluhm optlen = sizeof(len);
997 6caeec2c 2011-04-12 bluhm if (getsockopt(cre->s, SOL_SOCKET, SO_SPLICE, &len, &optlen) == -1) {
998 3f8b4585 2011-09-21 bluhm log_debug("%s: session %d: splice dir %d get length failed: %s",
999 3f8b4585 2011-09-21 bluhm __func__, con->se_id, cre->dir, strerror(errno));
1000 3f8b4585 2011-09-21 bluhm return (-1);
1003 b1e5969d 2013-03-09 bluhm DPRINTF("%s: session %d: splice dir %d, length %lld",
1004 b1e5969d 2013-03-09 bluhm __func__, con->se_id, cre->dir, len);
1006 6caeec2c 2011-04-12 bluhm if (len > cre->splicelen) {
1007 b7f7a948 2013-03-10 reyk getmonotime(&con->se_tv_last);
1009 6caeec2c 2011-04-12 bluhm cre->splicelen = len;
1010 6caeec2c 2011-04-12 bluhm return (1);
1013 6caeec2c 2011-04-12 bluhm return (0);
1017 b1e5969d 2013-03-09 bluhm relay_spliceadjust(struct ctl_relay_event *cre)
1019 b1e5969d 2013-03-09 bluhm if (cre->splicelen < 0)
1020 b1e5969d 2013-03-09 bluhm return (0);
1021 b1e5969d 2013-03-09 bluhm if (relay_splicelen(cre) == -1)
1022 b1e5969d 2013-03-09 bluhm return (-1);
1023 b1e5969d 2013-03-09 bluhm if (cre->splicelen > 0 && cre->toread > 0)
1024 b1e5969d 2013-03-09 bluhm cre->toread -= cre->splicelen;
1025 b1e5969d 2013-03-09 bluhm cre->splicelen = -1;
1027 b1e5969d 2013-03-09 bluhm return (0);
1031 30640247 2007-02-22 reyk relay_error(struct bufferevent *bev, short error, void *arg)
1033 185b85c3 2014-06-27 andre struct ctl_relay_event *cre = arg;
1034 185b85c3 2014-06-27 andre struct rsession *con = cre->con;
1035 185b85c3 2014-06-27 andre struct evbuffer *dst;
1037 d631e662 2017-11-28 claudio DPRINTF("%s: session %d: dir %d state %d to read %lld event error %x",
1038 a0c27c3e 2017-11-27 claudio __func__, con->se_id, cre->dir, cre->state, cre->toread, error);
1039 30640247 2007-02-22 reyk if (error & EVBUFFER_TIMEOUT) {
1040 3f8b4585 2011-09-21 bluhm if (cre->splicelen >= 0) {
1041 3f8b4585 2011-09-21 bluhm bufferevent_enable(bev, EV_READ);
1042 3f8b4585 2011-09-21 bluhm } else if (cre->dst->splicelen >= 0) {
1043 3f8b4585 2011-09-21 bluhm switch (relay_splicelen(cre->dst)) {
1045 3f8b4585 2011-09-21 bluhm goto fail;
1047 37ed6014 2018-08-06 benno relay_close(con, "buffer event timeout", 1);
1050 e442b42f 2014-07-14 bluhm cre->timedout = 1;
1051 3f8b4585 2011-09-21 bluhm bufferevent_enable(bev, EV_READ);
1055 37ed6014 2018-08-06 benno relay_close(con, "buffer event timeout", 1);
1059 3f8b4585 2011-09-21 bluhm if (error & EVBUFFER_ERROR && errno == ETIMEDOUT) {
1060 3f8b4585 2011-09-21 bluhm if (cre->dst->splicelen >= 0) {
1061 3f8b4585 2011-09-21 bluhm switch (relay_splicelen(cre->dst)) {
1063 3f8b4585 2011-09-21 bluhm goto fail;
1065 37ed6014 2018-08-06 benno relay_close(con, "splice timeout", 1);
1068 3f8b4585 2011-09-21 bluhm bufferevent_enable(bev, EV_READ);
1071 e442b42f 2014-07-14 bluhm } else if (cre->dst->timedout) {
1072 37ed6014 2018-08-06 benno relay_close(con, "splice timeout", 1);
1075 b1e5969d 2013-03-09 bluhm if (relay_spliceadjust(cre) == -1)
1076 b1e5969d 2013-03-09 bluhm goto fail;
1077 3f8b4585 2011-09-21 bluhm if (relay_splice(cre) == -1)
1078 3f8b4585 2011-09-21 bluhm goto fail;
1081 b1e5969d 2013-03-09 bluhm if (error & EVBUFFER_ERROR && errno == EFBIG) {
1082 b1e5969d 2013-03-09 bluhm if (relay_spliceadjust(cre) == -1)
1083 b1e5969d 2013-03-09 bluhm goto fail;
1084 b1e5969d 2013-03-09 bluhm bufferevent_enable(cre->bev, EV_READ);
1087 30640247 2007-02-22 reyk if (error & (EVBUFFER_READ|EVBUFFER_WRITE|EVBUFFER_EOF)) {
1088 30640247 2007-02-22 reyk bufferevent_disable(bev, EV_READ|EV_WRITE);
1090 aa79f3aa 2008-01-31 thib con->se_done = 1;
1091 30640247 2007-02-22 reyk if (cre->dst->bev != NULL) {
1092 30640247 2007-02-22 reyk dst = EVBUFFER_OUTPUT(cre->dst->bev);
1093 6170f26a 2007-02-26 reyk if (EVBUFFER_LENGTH(dst))
1095 66088222 2015-04-29 bluhm } else if (cre->toread == TOREAD_UNLIMITED || cre->toread == 0)
1098 37ed6014 2018-08-06 benno relay_close(con, "done", 0);
1101 37ed6014 2018-08-06 benno relay_close(con, "buffer event error", 1);
1104 37ed6014 2018-08-06 benno relay_close(con, strerror(errno), 1);
1108 1ca19f87 2012-04-11 deraadt relay_accept(int fd, short event, void *arg)
1110 b14526d5 2016-09-02 reyk struct privsep *ps = env->sc_ps;
1111 185b85c3 2014-06-27 andre struct relay *rlay = arg;
1112 185b85c3 2014-06-27 andre struct rsession *con = NULL;
1113 185b85c3 2014-06-27 andre struct ctl_natlook *cnl = NULL;
1114 185b85c3 2014-06-27 andre socklen_t slen;
1115 185b85c3 2014-06-27 andre struct timeval tv;
1116 185b85c3 2014-06-27 andre struct sockaddr_storage ss;
1117 185b85c3 2014-06-27 andre int s = -1;
1119 1ca19f87 2012-04-11 deraadt event_add(&rlay->rl_ev, NULL);
1120 1ca19f87 2012-04-11 deraadt if ((event & EV_TIMEOUT))
1121 1ca19f87 2012-04-11 deraadt return;
1123 30640247 2007-02-22 reyk slen = sizeof(ss);
1124 61cca588 2012-09-21 benno if ((s = accept_reserve(fd, (struct sockaddr *)&ss,
1125 68e92a51 2012-11-27 guenther &slen, FD_RESERVE, &relay_inflight)) == -1) {
1127 1ca19f87 2012-04-11 deraadt * Pause accept if we are out of file descriptors, or
1128 1ca19f87 2012-04-11 deraadt * libevent will haunt us here too.
1130 1ca19f87 2012-04-11 deraadt if (errno == ENFILE || errno == EMFILE) {
1131 1ca19f87 2012-04-11 deraadt struct timeval evtpause = { 1, 0 };
1133 1ca19f87 2012-04-11 deraadt event_del(&rlay->rl_ev);
1134 1ca19f87 2012-04-11 deraadt evtimer_add(&rlay->rl_evt, &evtpause);
1135 68e92a51 2012-11-27 guenther log_debug("%s: deferring connections", __func__);
1137 1ca19f87 2012-04-11 deraadt return;
1139 62110500 2018-04-18 claudio if (rlay->rl_conf.flags & F_DISABLE)
1142 63a1d849 2011-04-24 bluhm if ((con = calloc(1, sizeof(*con))) == NULL)
1145 8dc729b6 2015-04-23 florian /* Pre-allocate log buffer */
1146 8dc729b6 2015-04-23 florian con->se_haslog = 0;
1147 8dc729b6 2015-04-23 florian con->se_log = evbuffer_new();
1148 8dc729b6 2015-04-23 florian if (con->se_log == NULL)
1149 8dc729b6 2015-04-23 florian goto err;
1151 aa79f3aa 2008-01-31 thib con->se_in.s = s;
1152 f4a6eef3 2017-05-27 claudio con->se_in.tls = NULL;
1153 aa79f3aa 2008-01-31 thib con->se_out.s = -1;
1154 f4a6eef3 2017-05-27 claudio con->se_out.tls = NULL;
1155 aa79f3aa 2008-01-31 thib con->se_in.dst = &con->se_out;
1156 aa79f3aa 2008-01-31 thib con->se_out.dst = &con->se_in;
1157 aa79f3aa 2008-01-31 thib con->se_in.con = con;
1158 aa79f3aa 2008-01-31 thib con->se_out.con = con;
1159 6caeec2c 2011-04-12 bluhm con->se_in.splicelen = -1;
1160 6caeec2c 2011-04-12 bluhm con->se_out.splicelen = -1;
1161 268a5dac 2013-02-05 bluhm con->se_in.toread = TOREAD_UNLIMITED;
1162 268a5dac 2013-02-05 bluhm con->se_out.toread = TOREAD_UNLIMITED;
1163 aa79f3aa 2008-01-31 thib con->se_relay = rlay;
1164 aa79f3aa 2008-01-31 thib con->se_id = ++relay_conid;
1165 aa79f3aa 2008-01-31 thib con->se_relayid = rlay->rl_conf.id;
1166 f55b0941 2011-05-20 reyk con->se_pid = getpid();
1167 aa79f3aa 2008-01-31 thib con->se_in.dir = RELAY_DIR_REQUEST;
1168 aa79f3aa 2008-01-31 thib con->se_out.dir = RELAY_DIR_RESPONSE;
1169 aa79f3aa 2008-01-31 thib con->se_retry = rlay->rl_conf.dstretry;
1170 6d5340e6 2008-06-11 reyk con->se_bnds = -1;
1171 aa79f3aa 2008-01-31 thib con->se_out.port = rlay->rl_conf.dstport;
1172 41b83bb1 2007-09-07 reyk switch (ss.ss_family) {
1173 41b83bb1 2007-09-07 reyk case AF_INET:
1174 aa79f3aa 2008-01-31 thib con->se_in.port = ((struct sockaddr_in *)&ss)->sin_port;
1176 41b83bb1 2007-09-07 reyk case AF_INET6:
1177 aa79f3aa 2008-01-31 thib con->se_in.port = ((struct sockaddr_in6 *)&ss)->sin6_port;
1180 fc2c091b 2019-05-10 reyk memcpy(&con->se_in.ss, &ss, sizeof(con->se_in.ss));
1182 fc2c091b 2019-05-10 reyk slen = sizeof(con->se_sockname);
1183 fc2c091b 2019-05-10 reyk if (getsockname(s, (struct sockaddr *)&con->se_sockname, &slen) == -1) {
1184 fc2c091b 2019-05-10 reyk relay_close(con, "sockname lookup failed", 1);
1188 b7f7a948 2013-03-10 reyk getmonotime(&con->se_tv_start);
1189 b7f7a948 2013-03-10 reyk bcopy(&con->se_tv_start, &con->se_tv_last, sizeof(con->se_tv_last));
1191 3e04b122 2014-12-18 reyk if (rlay->rl_conf.flags & F_HASHKEY) {
1192 3e04b122 2014-12-18 reyk SipHash24_Init(&con->se_siphashctx,
1193 3e04b122 2014-12-18 reyk &rlay->rl_conf.hashkey.siphashkey);
1196 6f7c15c5 2007-09-04 reyk relay_sessions++;
1197 146643ba 2008-01-31 reyk SPLAY_INSERT(session_tree, &rlay->rl_sessions, con);
1198 28bd28ce 2014-11-19 blambert relay_session_publish(con);
1200 6f7c15c5 2007-09-04 reyk /* Increment the per-relay session counter */
1201 b14526d5 2016-09-02 reyk rlay->rl_stats[ps->ps_instance].last++;
1203 30640247 2007-02-22 reyk /* Pre-allocate output buffer */
1204 aa79f3aa 2008-01-31 thib con->se_out.output = evbuffer_new();
1205 aa79f3aa 2008-01-31 thib if (con->se_out.output == NULL) {
1206 37ed6014 2018-08-06 benno relay_close(con, "failed to allocate output buffer", 1);
1210 9c52a29e 2011-04-07 reyk if (rlay->rl_conf.flags & F_DIVERT) {
1211 fc2c091b 2019-05-10 reyk memcpy(&con->se_out.ss, &con->se_sockname,
1212 fc2c091b 2019-05-10 reyk sizeof(con->se_out.ss));
1213 9c52a29e 2011-04-07 reyk con->se_out.port = relay_socket_getport(&con->se_out.ss);
1215 9c52a29e 2011-04-07 reyk /* Detect loop and fall back to the alternate forward target */
1216 9c52a29e 2011-04-07 reyk if (bcmp(&rlay->rl_conf.ss, &con->se_out.ss,
1217 9c52a29e 2011-04-07 reyk sizeof(con->se_out.ss)) == 0 &&
1218 9c52a29e 2011-04-07 reyk con->se_out.port == rlay->rl_conf.port)
1219 9c52a29e 2011-04-07 reyk con->se_out.ss.ss_family = AF_UNSPEC;
1220 9c52a29e 2011-04-07 reyk } else if (rlay->rl_conf.flags & F_NATLOOK) {
1221 6e65a975 2013-01-17 bluhm if ((cnl = calloc(1, sizeof(*cnl))) == NULL) {
1222 37ed6014 2018-08-06 benno relay_close(con, "failed to allocate nat lookup", 1);
1226 aa79f3aa 2008-01-31 thib con->se_cnl = cnl;
1227 30640247 2007-02-22 reyk bzero(cnl, sizeof(*cnl));
1228 30640247 2007-02-22 reyk cnl->in = -1;
1229 aa79f3aa 2008-01-31 thib cnl->id = con->se_id;
1230 b14526d5 2016-09-02 reyk cnl->proc = ps->ps_instance;
1231 555b1b20 2008-07-09 reyk cnl->proto = IPPROTO_TCP;
1233 fc2c091b 2019-05-10 reyk memcpy(&cnl->src, &con->se_in.ss, sizeof(cnl->src));
1234 fc2c091b 2019-05-10 reyk memcpy(&cnl->dst, &con->se_sockname, sizeof(cnl->dst));
1236 141b9058 2015-12-02 reyk proc_compose(env->sc_ps, PROC_PFE, IMSG_NATLOOK,
1237 ccf58482 2011-09-04 bluhm cnl, sizeof(*cnl));
1239 30640247 2007-02-22 reyk /* Schedule timeout */
1240 aa79f3aa 2008-01-31 thib evtimer_set(&con->se_ev, relay_natlook, con);
1241 146643ba 2008-01-31 reyk bcopy(&rlay->rl_conf.timeout, &tv, sizeof(tv));
1242 aa79f3aa 2008-01-31 thib evtimer_add(&con->se_ev, &tv);
1246 096ff28b 2014-12-12 reyk if (rlay->rl_conf.flags & F_TLSINSPECT) {
1247 03668b6b 2013-05-30 reyk relay_preconnect(con);
1251 30640247 2007-02-22 reyk relay_session(con);
1254 30640247 2007-02-22 reyk if (s != -1) {
1256 ba24b6a0 2015-12-07 mmcc free(con);
1258 d063a84f 2015-12-24 mmcc * the session struct was not completely set up, but still
1259 61cca588 2012-09-21 benno * counted as an inflight session. account for this.
1261 61cca588 2012-09-21 benno relay_inflight--;
1262 61cca588 2012-09-21 benno log_debug("%s: inflight decremented, now %d",
1263 61cca588 2012-09-21 benno __func__, relay_inflight);
1268 3e04b122 2014-12-18 reyk relay_hash_addr(SIPHASH_CTX *ctx, struct sockaddr_storage *ss, int portset)
1270 30640247 2007-02-22 reyk struct sockaddr_in *sin4;
1271 30640247 2007-02-22 reyk struct sockaddr_in6 *sin6;
1272 3e04b122 2014-12-18 reyk in_port_t port;
1274 30640247 2007-02-22 reyk if (ss->ss_family == AF_INET) {
1275 30640247 2007-02-22 reyk sin4 = (struct sockaddr_in *)ss;
1276 3e04b122 2014-12-18 reyk SipHash24_Update(ctx, &sin4->sin_addr,
1277 3e04b122 2014-12-18 reyk sizeof(struct in_addr));
1279 30640247 2007-02-22 reyk sin6 = (struct sockaddr_in6 *)ss;
1280 3e04b122 2014-12-18 reyk SipHash24_Update(ctx, &sin6->sin6_addr,
1281 3e04b122 2014-12-18 reyk sizeof(struct in6_addr));
1284 3e04b122 2014-12-18 reyk if (portset != -1) {
1285 3e04b122 2014-12-18 reyk port = (in_port_t)portset;
1286 3e04b122 2014-12-18 reyk SipHash24_Update(ctx, &port, sizeof(port));
1291 61afd4d6 2009-08-07 reyk relay_from_table(struct rsession *con)
1293 6e65a975 2013-01-17 bluhm struct relay *rlay = con->se_relay;
1294 8488425a 2015-12-05 benno struct host *host = NULL;
1295 0f7a5e2e 2012-10-03 reyk struct relay_table *rlt = NULL;
1296 0f7a5e2e 2012-10-03 reyk struct table *table = NULL;
1297 d6c9879f 2012-10-19 reyk int idx = -1;
1298 da2e55f8 2015-12-02 benno int cnt = 0;
1299 da2e55f8 2015-12-02 benno int maxtries;
1300 3e04b122 2014-12-18 reyk u_int64_t p = 0;
1302 0f7a5e2e 2012-10-03 reyk /* the table is already selected */
1303 0f7a5e2e 2012-10-03 reyk if (con->se_table != NULL) {
1304 0f7a5e2e 2012-10-03 reyk rlt = con->se_table;
1305 0f7a5e2e 2012-10-03 reyk table = rlt->rlt_table;
1306 0f7a5e2e 2012-10-03 reyk if (table->conf.check && !table->up)
1307 0f7a5e2e 2012-10-03 reyk table = NULL;
1308 0f7a5e2e 2012-10-03 reyk goto gottable;
1311 0f7a5e2e 2012-10-03 reyk /* otherwise grep the first active table */
1312 0f7a5e2e 2012-10-03 reyk TAILQ_FOREACH(rlt, &rlay->rl_tables, rlt_entry) {
1313 0f7a5e2e 2012-10-03 reyk table = rlt->rlt_table;
1314 016b3271 2012-10-03 reyk if ((rlt->rlt_flags & F_USED) == 0 ||
1315 0f7a5e2e 2012-10-03 reyk (table->conf.check && !table->up))
1316 0f7a5e2e 2012-10-03 reyk table = NULL;
1322 0f7a5e2e 2012-10-03 reyk if (table == NULL) {
1323 0f7a5e2e 2012-10-03 reyk log_debug("%s: session %d: no active hosts",
1324 0f7a5e2e 2012-10-03 reyk __func__, con->se_id);
1325 30640247 2007-02-22 reyk return (-1);
1328 0f7a5e2e 2012-10-03 reyk switch (rlt->rlt_mode) {
1329 30640247 2007-02-22 reyk case RELAY_DSTMODE_ROUNDROBIN:
1330 3e04b122 2014-12-18 reyk if ((int)rlt->rlt_index >= rlt->rlt_nhosts)
1331 3e04b122 2014-12-18 reyk rlt->rlt_index = 0;
1332 3e04b122 2014-12-18 reyk idx = (int)rlt->rlt_index;
1334 d6c9879f 2012-10-19 reyk case RELAY_DSTMODE_RANDOM:
1335 d6c9879f 2012-10-19 reyk idx = (int)arc4random_uniform(rlt->rlt_nhosts);
1337 d6c9879f 2012-10-19 reyk case RELAY_DSTMODE_SRCHASH:
1338 3e04b122 2014-12-18 reyk /* Source IP address without port */
1339 3e04b122 2014-12-18 reyk relay_hash_addr(&con->se_siphashctx, &con->se_in.ss, -1);
1341 30640247 2007-02-22 reyk case RELAY_DSTMODE_LOADBALANCE:
1342 12d276b2 2014-09-05 blambert /* Source IP address without port */
1343 3e04b122 2014-12-18 reyk relay_hash_addr(&con->se_siphashctx, &con->se_in.ss, -1);
1344 12d276b2 2014-09-05 blambert /* FALLTHROUGH */
1345 30640247 2007-02-22 reyk case RELAY_DSTMODE_HASH:
1346 d6c9879f 2012-10-19 reyk /* Local "destination" IP address and port */
1347 3e04b122 2014-12-18 reyk relay_hash_addr(&con->se_siphashctx, &rlay->rl_conf.ss,
1348 3e04b122 2014-12-18 reyk rlay->rl_conf.port);
1351 09e53fee 2017-05-28 benno fatalx("%s: unsupported mode", __func__);
1352 d6c9879f 2012-10-19 reyk /* NOTREACHED */
1354 3e04b122 2014-12-18 reyk if (idx == -1) {
1355 da2e55f8 2015-12-02 benno /* handle all hashing algorithms */
1356 3e04b122 2014-12-18 reyk p = SipHash24_End(&con->se_siphashctx);
1358 3e04b122 2014-12-18 reyk /* Reset hash context */
1359 3e04b122 2014-12-18 reyk SipHash24_Init(&con->se_siphashctx,
1360 3e04b122 2014-12-18 reyk &rlay->rl_conf.hashkey.siphashkey);
1362 da2e55f8 2015-12-02 benno maxtries = (rlt->rlt_nhosts < RELAY_MAX_HASH_RETRIES ?
1363 da2e55f8 2015-12-02 benno rlt->rlt_nhosts : RELAY_MAX_HASH_RETRIES);
1364 da2e55f8 2015-12-02 benno for (cnt = 0; cnt < maxtries; cnt++) {
1365 da2e55f8 2015-12-02 benno if ((idx = p % rlt->rlt_nhosts) >= RELAY_MAXHOSTS)
1366 da2e55f8 2015-12-02 benno return (-1);
1368 da2e55f8 2015-12-02 benno host = rlt->rlt_host[idx];
1370 da2e55f8 2015-12-02 benno DPRINTF("%s: session %d: table %s host %s, "
1371 da2e55f8 2015-12-02 benno "p 0x%016llx, idx %d, cnt %d, max %d",
1372 da2e55f8 2015-12-02 benno __func__, con->se_id, table->conf.name,
1373 da2e55f8 2015-12-02 benno host->conf.name, p, idx, cnt, maxtries);
1375 da2e55f8 2015-12-02 benno if (!table->conf.check || host->up == HOST_UP)
1376 da2e55f8 2015-12-02 benno goto found;
1377 da2e55f8 2015-12-02 benno p = p >> 1;
1380 da2e55f8 2015-12-02 benno /* handle all non-hashing algorithms */
1381 da2e55f8 2015-12-02 benno host = rlt->rlt_host[idx];
1382 da2e55f8 2015-12-02 benno DPRINTF("%s: session %d: table %s host %s, p 0x%016llx, idx %d",
1383 04adeb63 2016-09-26 reyk __func__, con->se_id, table->conf.name, host->conf.name,
1387 30640247 2007-02-22 reyk while (host != NULL) {
1388 0f7a5e2e 2012-10-03 reyk DPRINTF("%s: session %d: host %s", __func__,
1389 0f7a5e2e 2012-10-03 reyk con->se_id, host->conf.name);
1390 d7758aba 2007-12-08 reyk if (!table->conf.check || host->up == HOST_UP)
1391 30640247 2007-02-22 reyk goto found;
1392 30640247 2007-02-22 reyk host = TAILQ_NEXT(host, entry);
1394 d7758aba 2007-12-08 reyk TAILQ_FOREACH(host, &table->hosts, entry) {
1395 69fde657 2014-07-09 reyk DPRINTF("%s: session %d: next host %s",
1396 69fde657 2014-07-09 reyk __func__, con->se_id, host->conf.name);
1397 d7758aba 2007-12-08 reyk if (!table->conf.check || host->up == HOST_UP)
1398 30640247 2007-02-22 reyk goto found;
1401 30640247 2007-02-22 reyk /* Should not happen */
1402 09e53fee 2017-05-28 benno fatalx("%s: no active hosts, desynchronized", __func__);
1405 0f7a5e2e 2012-10-03 reyk if (rlt->rlt_mode == RELAY_DSTMODE_ROUNDROBIN)
1406 3e04b122 2014-12-18 reyk rlt->rlt_index = host->idx + 1;
1407 aa79f3aa 2008-01-31 thib con->se_retry = host->conf.retry;
1408 aa79f3aa 2008-01-31 thib con->se_out.port = table->conf.port;
1409 aa79f3aa 2008-01-31 thib bcopy(&host->conf.ss, &con->se_out.ss, sizeof(con->se_out.ss));
1411 30640247 2007-02-22 reyk return (0);
1415 30640247 2007-02-22 reyk relay_natlook(int fd, short event, void *arg)
1417 6e65a975 2013-01-17 bluhm struct rsession *con = arg;
1418 6e65a975 2013-01-17 bluhm struct relay *rlay = con->se_relay;
1419 aa79f3aa 2008-01-31 thib struct ctl_natlook *cnl = con->se_cnl;
1421 30640247 2007-02-22 reyk if (cnl == NULL)
1422 30640247 2007-02-22 reyk fatalx("invalid NAT lookup");
1424 aa79f3aa 2008-01-31 thib if (con->se_out.ss.ss_family == AF_UNSPEC && cnl->in == -1 &&
1425 e8962295 2008-09-29 reyk rlay->rl_conf.dstss.ss_family == AF_UNSPEC &&
1426 0f7a5e2e 2012-10-03 reyk TAILQ_EMPTY(&rlay->rl_tables)) {
1427 37ed6014 2018-08-06 benno relay_close(con, "session NAT lookup failed", 1);
1430 30640247 2007-02-22 reyk if (cnl->in != -1) {
1431 aa79f3aa 2008-01-31 thib bcopy(&cnl->rdst, &con->se_out.ss, sizeof(con->se_out.ss));
1432 aa79f3aa 2008-01-31 thib con->se_out.port = cnl->rdport;
1434 aa79f3aa 2008-01-31 thib free(con->se_cnl);
1435 aa79f3aa 2008-01-31 thib con->se_cnl = NULL;
1437 30640247 2007-02-22 reyk relay_session(con);
1441 61afd4d6 2009-08-07 reyk relay_session(struct rsession *con)
1443 6e65a975 2013-01-17 bluhm struct relay *rlay = con->se_relay;
1444 aa79f3aa 2008-01-31 thib struct ctl_relay_event *in = &con->se_in, *out = &con->se_out;
1446 146643ba 2008-01-31 reyk if (bcmp(&rlay->rl_conf.ss, &out->ss, sizeof(out->ss)) == 0 &&
1447 146643ba 2008-01-31 reyk out->port == rlay->rl_conf.port) {
1448 666bd316 2011-05-05 reyk log_debug("%s: session %d: looping", __func__, con->se_id);
1449 37ed6014 2018-08-06 benno relay_close(con, "session aborted", 1);
1453 146643ba 2008-01-31 reyk if (rlay->rl_conf.flags & F_UDP) {
1455 7ba7514d 2007-09-10 reyk * Call the UDP protocol-specific handler
1457 146643ba 2008-01-31 reyk if (rlay->rl_proto->request == NULL)
1458 57122c1b 2022-12-28 jmc fatalx("invalid UDP session");
1459 146643ba 2008-01-31 reyk if ((*rlay->rl_proto->request)(con) == -1)
1460 37ed6014 2018-08-06 benno relay_close(con, "session failed", 1);
1464 f4a6eef3 2017-05-27 claudio if ((rlay->rl_conf.flags & F_TLS) && (in->tls == NULL)) {
1465 096ff28b 2014-12-12 reyk relay_tls_transaction(con, in);
1469 62ee3f1b 2019-05-08 reyk if (rlay->rl_proto->type != RELAY_PROTO_HTTP) {
1470 6d5340e6 2008-06-11 reyk if (rlay->rl_conf.fwdmode == FWD_TRANS)
1471 6d5340e6 2008-06-11 reyk relay_bindanyreq(con, 0, IPPROTO_TCP);
1472 6d5340e6 2008-06-11 reyk else if (relay_connect(con) == -1) {
1473 37ed6014 2018-08-06 benno relay_close(con, "session failed", 1);
1478 30640247 2007-02-22 reyk relay_input(con);
1482 61afd4d6 2009-08-07 reyk relay_bindanyreq(struct rsession *con, in_port_t port, int proto)
1484 b14526d5 2016-09-02 reyk struct privsep *ps = env->sc_ps;
1485 6e65a975 2013-01-17 bluhm struct relay *rlay = con->se_relay;
1486 6d5340e6 2008-06-11 reyk struct ctl_bindany bnd;
1487 6d5340e6 2008-06-11 reyk struct timeval tv;
1489 6d5340e6 2008-06-11 reyk bzero(&bnd, sizeof(bnd));
1490 6d5340e6 2008-06-11 reyk bnd.bnd_id = con->se_id;
1491 b14526d5 2016-09-02 reyk bnd.bnd_proc = ps->ps_instance;
1492 6d5340e6 2008-06-11 reyk bnd.bnd_port = port;
1493 6d5340e6 2008-06-11 reyk bnd.bnd_proto = proto;
1494 6d5340e6 2008-06-11 reyk bcopy(&con->se_in.ss, &bnd.bnd_ss, sizeof(bnd.bnd_ss));
1495 141b9058 2015-12-02 reyk proc_compose(env->sc_ps, PROC_PARENT, IMSG_BINDANY,
1496 141b9058 2015-12-02 reyk &bnd, sizeof(bnd));
1498 6d5340e6 2008-06-11 reyk /* Schedule timeout */
1499 6d5340e6 2008-06-11 reyk evtimer_set(&con->se_ev, relay_bindany, con);
1500 6d5340e6 2008-06-11 reyk bcopy(&rlay->rl_conf.timeout, &tv, sizeof(tv));
1501 6d5340e6 2008-06-11 reyk evtimer_add(&con->se_ev, &tv);
1505 6d5340e6 2008-06-11 reyk relay_bindany(int fd, short event, void *arg)
1507 6e65a975 2013-01-17 bluhm struct rsession *con = arg;
1509 6d5340e6 2008-06-11 reyk if (con->se_bnds == -1) {
1510 37ed6014 2018-08-06 benno relay_close(con, "bindany failed, invalid socket", 1);
1513 63a1d849 2011-04-24 bluhm if (relay_connect(con) == -1)
1514 37ed6014 2018-08-06 benno relay_close(con, "session failed", 1);
1518 b8764354 2019-05-13 reyk relay_connect_state(struct rsession *con, struct ctl_relay_event *cre,
1519 b8764354 2019-05-13 reyk enum relay_state new)
1521 b8764354 2019-05-13 reyk DPRINTF("%s: session %d: %s state %s -> %s",
1522 b8764354 2019-05-13 reyk __func__, con->se_id,
1523 b8764354 2019-05-13 reyk cre->dir == RELAY_DIR_REQUEST ? "accept" : "connect",
1524 b8764354 2019-05-13 reyk relay_state(cre->state), relay_state(new));
1525 b8764354 2019-05-13 reyk cre->state = new;
1529 61cca588 2012-09-21 benno relay_connect_retry(int fd, short sig, void *arg)
1531 61cca588 2012-09-21 benno struct timeval evtpause = { 1, 0 };
1532 6e65a975 2013-01-17 bluhm struct rsession *con = arg;
1533 6e65a975 2013-01-17 bluhm struct relay *rlay = con->se_relay;
1534 61cca588 2012-09-21 benno int bnds = -1;
1536 c872be5f 2015-06-08 claudio if (relay_inflight < 1) {
1537 09e53fee 2017-05-28 benno log_warnx("%s: no connection in flight", __func__);
1538 c872be5f 2015-06-08 claudio relay_inflight = 1;
1541 61cca588 2012-09-21 benno DPRINTF("%s: retry %d of %d, inflight: %d",__func__,
1542 61cca588 2012-09-21 benno con->se_retrycount, con->se_retry, relay_inflight);
1544 61cca588 2012-09-21 benno if (sig != EV_TIMEOUT)
1545 09e53fee 2017-05-28 benno fatalx("%s: called without timeout", __func__);
1547 61cca588 2012-09-21 benno evtimer_del(&con->se_inflightevt);
1550 61cca588 2012-09-21 benno * XXX we might want to check if the inbound socket is still
1551 61cca588 2012-09-21 benno * available: client could have closed it while we were waiting?
1554 61cca588 2012-09-21 benno DPRINTF("%s: got EV_TIMEOUT", __func__);
1556 61cca588 2012-09-21 benno if (getdtablecount() + FD_RESERVE +
1557 61cca588 2012-09-21 benno relay_inflight > getdtablesize()) {
1558 61cca588 2012-09-21 benno if (con->se_retrycount < RELAY_OUTOF_FD_RETRIES) {
1559 61cca588 2012-09-21 benno evtimer_add(&con->se_inflightevt, &evtpause);
1562 61cca588 2012-09-21 benno /* we waited for RELAY_OUTOF_FD_RETRIES seconds, give up */
1563 61cca588 2012-09-21 benno event_add(&rlay->rl_ev, NULL);
1564 3a75ae45 2012-10-04 reyk relay_abort_http(con, 504, "connection timed out", 0);
1568 61cca588 2012-09-21 benno if (rlay->rl_conf.fwdmode == FWD_TRANS) {
1569 61cca588 2012-09-21 benno /* con->se_bnds cannot be unset */
1570 61cca588 2012-09-21 benno bnds = con->se_bnds;
1574 61cca588 2012-09-21 benno if ((con->se_out.s = relay_socket_connect(&con->se_out.ss,
1575 61cca588 2012-09-21 benno con->se_out.port, rlay->rl_proto, bnds)) == -1) {
1576 61cca588 2012-09-21 benno log_debug("%s: session %d: "
1577 61cca588 2012-09-21 benno "forward failed: %s, %s", __func__,
1578 61cca588 2012-09-21 benno con->se_id, strerror(errno),
1579 61cca588 2012-09-21 benno con->se_retry ? "next retry" : "last retry");
1581 61cca588 2012-09-21 benno con->se_retrycount++;
1583 3a75ae45 2012-10-04 reyk if ((errno == ENFILE || errno == EMFILE) &&
1584 61cca588 2012-09-21 benno (con->se_retrycount < con->se_retry)) {
1585 61cca588 2012-09-21 benno event_del(&rlay->rl_ev);
1586 61cca588 2012-09-21 benno evtimer_add(&con->se_inflightevt, &evtpause);
1587 61cca588 2012-09-21 benno evtimer_add(&rlay->rl_evt, &evtpause);
1589 61cca588 2012-09-21 benno } else if (con->se_retrycount < con->se_retry)
1590 61cca588 2012-09-21 benno goto retry;
1591 61cca588 2012-09-21 benno event_add(&rlay->rl_ev, NULL);
1592 61cca588 2012-09-21 benno relay_abort_http(con, 504, "connect failed", 0);
1596 c872be5f 2015-06-08 claudio if (rlay->rl_conf.flags & F_TLSINSPECT)
1597 b8764354 2019-05-13 reyk relay_connect_state(con, &con->se_out, STATE_PRECONNECT);
1599 b8764354 2019-05-13 reyk relay_connect_state(con, &con->se_out, STATE_CONNECTED);
1600 61cca588 2012-09-21 benno relay_inflight--;
1601 61cca588 2012-09-21 benno DPRINTF("%s: inflight decremented, now %d",__func__, relay_inflight);
1603 61cca588 2012-09-21 benno event_add(&rlay->rl_ev, NULL);
1605 61cca588 2012-09-21 benno if (errno == EINPROGRESS)
1606 61cca588 2012-09-21 benno event_again(&con->se_ev, con->se_out.s, EV_WRITE|EV_TIMEOUT,
1607 61cca588 2012-09-21 benno relay_connected, &con->se_tv_start, &rlay->rl_conf.timeout,
1610 61cca588 2012-09-21 benno relay_connected(con->se_out.s, EV_WRITE, con);
1616 03668b6b 2013-05-30 reyk relay_preconnect(struct rsession *con)
1618 c872be5f 2015-06-08 claudio int rv;
1620 03668b6b 2013-05-30 reyk log_debug("%s: session %d: process %d", __func__,
1621 03668b6b 2013-05-30 reyk con->se_id, privsep_process);
1622 c872be5f 2015-06-08 claudio rv = relay_connect(con);
1623 6b2aabbf 2015-06-12 reyk if (con->se_out.state == STATE_CONNECTED)
1624 b8764354 2019-05-13 reyk relay_connect_state(con, &con->se_out, STATE_PRECONNECT);
1625 c872be5f 2015-06-08 claudio return (rv);
1629 61afd4d6 2009-08-07 reyk relay_connect(struct rsession *con)
1631 6e65a975 2013-01-17 bluhm struct relay *rlay = con->se_relay;
1632 61cca588 2012-09-21 benno struct timeval evtpause = { 1, 0 };
1633 2e5903be 2008-07-22 reyk int bnds = -1, ret;
1635 c872be5f 2015-06-08 claudio /* relay_connect should only be called once per relay */
1636 6b2aabbf 2015-06-12 reyk if (con->se_out.state == STATE_CONNECTED) {
1637 c872be5f 2015-06-08 claudio log_debug("%s: connect already called once", __func__);
1638 c872be5f 2015-06-08 claudio return (0);
1641 03668b6b 2013-05-30 reyk /* Connection is already established but session not active */
1642 c872be5f 2015-06-08 claudio if ((rlay->rl_conf.flags & F_TLSINSPECT) &&
1643 6b2aabbf 2015-06-12 reyk con->se_out.state == STATE_PRECONNECT) {
1644 f4a6eef3 2017-05-27 claudio if (con->se_out.tls == NULL) {
1645 096ff28b 2014-12-12 reyk log_debug("%s: tls connect failed", __func__);
1646 03668b6b 2013-05-30 reyk return (-1);
1648 03668b6b 2013-05-30 reyk relay_connected(con->se_out.s, EV_WRITE, con);
1649 b8764354 2019-05-13 reyk relay_connect_state(con, &con->se_out, STATE_CONNECTED);
1650 03668b6b 2013-05-30 reyk return (0);
1653 c872be5f 2015-06-08 claudio if (relay_inflight < 1) {
1654 c872be5f 2015-06-08 claudio log_warnx("relay_connect: no connection in flight");
1655 c872be5f 2015-06-08 claudio relay_inflight = 1;
1658 b7f7a948 2013-03-10 reyk getmonotime(&con->se_tv_start);
1660 d9d7e708 2019-07-13 chrisz if (con->se_out.ss.ss_family == AF_UNSPEC &&
1661 d9d7e708 2019-07-13 chrisz !TAILQ_EMPTY(&rlay->rl_tables)) {
1662 30640247 2007-02-22 reyk if (relay_from_table(con) != 0)
1663 30640247 2007-02-22 reyk return (-1);
1664 aa79f3aa 2008-01-31 thib } else if (con->se_out.ss.ss_family == AF_UNSPEC) {
1665 6d5340e6 2008-06-11 reyk bcopy(&rlay->rl_conf.dstss, &con->se_out.ss,
1666 6d5340e6 2008-06-11 reyk sizeof(con->se_out.ss));
1667 aa79f3aa 2008-01-31 thib con->se_out.port = rlay->rl_conf.dstport;
1670 6d5340e6 2008-06-11 reyk if (rlay->rl_conf.fwdmode == FWD_TRANS) {
1671 6d5340e6 2008-06-11 reyk if (con->se_bnds == -1) {
1672 666bd316 2011-05-05 reyk log_debug("%s: could not bind any sock", __func__);
1673 6d5340e6 2008-06-11 reyk return (-1);
1675 6d5340e6 2008-06-11 reyk bnds = con->se_bnds;
1678 2e5903be 2008-07-22 reyk /* Do the IPv4-to-IPv6 or IPv6-to-IPv4 translation if requested */
1679 2e5903be 2008-07-22 reyk if (rlay->rl_conf.dstaf.ss_family != AF_UNSPEC) {
1680 2e5903be 2008-07-22 reyk if (con->se_out.ss.ss_family == AF_INET &&
1681 2e5903be 2008-07-22 reyk rlay->rl_conf.dstaf.ss_family == AF_INET6)
1682 2e5903be 2008-07-22 reyk ret = map4to6(&con->se_out.ss, &rlay->rl_conf.dstaf);
1683 2e5903be 2008-07-22 reyk else if (con->se_out.ss.ss_family == AF_INET6 &&
1684 2e5903be 2008-07-22 reyk rlay->rl_conf.dstaf.ss_family == AF_INET)
1685 2e5903be 2008-07-22 reyk ret = map6to4(&con->se_out.ss);
1688 2e5903be 2008-07-22 reyk if (ret != 0) {
1689 666bd316 2011-05-05 reyk log_debug("%s: mapped to invalid address", __func__);
1690 2e5903be 2008-07-22 reyk return (-1);
1695 6d5340e6 2008-06-11 reyk if ((con->se_out.s = relay_socket_connect(&con->se_out.ss,
1696 6d5340e6 2008-06-11 reyk con->se_out.port, rlay->rl_proto, bnds)) == -1) {
1697 61cca588 2012-09-21 benno if (errno == ENFILE || errno == EMFILE) {
1698 61cca588 2012-09-21 benno log_debug("%s: session %d: forward failed: %s",
1699 61cca588 2012-09-21 benno __func__, con->se_id, strerror(errno));
1700 61cca588 2012-09-21 benno evtimer_set(&con->se_inflightevt, relay_connect_retry,
1702 61cca588 2012-09-21 benno event_del(&rlay->rl_ev);
1703 61cca588 2012-09-21 benno evtimer_add(&con->se_inflightevt, &evtpause);
1704 61cca588 2012-09-21 benno evtimer_add(&rlay->rl_evt, &evtpause);
1706 c872be5f 2015-06-08 claudio /* this connect is pending */
1707 b8764354 2019-05-13 reyk relay_connect_state(con, &con->se_out, STATE_PENDING);
1708 61cca588 2012-09-21 benno return (0);
1710 61cca588 2012-09-21 benno if (con->se_retry) {
1711 61cca588 2012-09-21 benno con->se_retry--;
1712 61cca588 2012-09-21 benno log_debug("%s: session %d: "
1713 61cca588 2012-09-21 benno "forward failed: %s, %s", __func__,
1714 61cca588 2012-09-21 benno con->se_id, strerror(errno),
1715 3a75ae45 2012-10-04 reyk con->se_retry ?
1716 3a75ae45 2012-10-04 reyk "next retry" : "last retry");
1717 61cca588 2012-09-21 benno goto retry;
1719 3a75ae45 2012-10-04 reyk log_debug("%s: session %d: forward failed: %s",
1720 3a75ae45 2012-10-04 reyk __func__, con->se_id, strerror(errno));
1721 61cca588 2012-09-21 benno return (-1);
1725 b8764354 2019-05-13 reyk relay_connect_state(con, &con->se_out, STATE_CONNECTED);
1726 61cca588 2012-09-21 benno relay_inflight--;
1727 61cca588 2012-09-21 benno DPRINTF("%s: inflight decremented, now %d",__func__,
1728 61cca588 2012-09-21 benno relay_inflight);
1730 30640247 2007-02-22 reyk if (errno == EINPROGRESS)
1731 aa79f3aa 2008-01-31 thib event_again(&con->se_ev, con->se_out.s, EV_WRITE|EV_TIMEOUT,
1732 9b46e219 2011-09-04 bluhm relay_connected, &con->se_tv_start, &rlay->rl_conf.timeout,
1735 aa79f3aa 2008-01-31 thib relay_connected(con->se_out.s, EV_WRITE, con);
1737 30640247 2007-02-22 reyk return (0);
1741 37ed6014 2018-08-06 benno relay_close(struct rsession *con, const char *msg, int err)
1743 ed29f86d 2007-02-24 reyk char ibuf[128], obuf[128], *ptr = NULL;
1744 6e65a975 2013-01-17 bluhm struct relay *rlay = con->se_relay;
1745 69fde657 2014-07-09 reyk struct protocol *proto = rlay->rl_proto;
1747 146643ba 2008-01-31 reyk SPLAY_REMOVE(session_tree, &rlay->rl_sessions, con);
1748 28bd28ce 2014-11-19 blambert relay_session_unpublish(con);
1750 aa79f3aa 2008-01-31 thib event_del(&con->se_ev);
1752 37ed6014 2018-08-06 benno if ((env->sc_conf.opts & (RELAYD_OPT_LOGCON|RELAYD_OPT_LOGCONERR)) &&
1753 37ed6014 2018-08-06 benno msg != NULL) {
1754 5df8b1c8 2007-02-26 reyk bzero(&ibuf, sizeof(ibuf));
1755 5df8b1c8 2007-02-26 reyk bzero(&obuf, sizeof(obuf));
1756 aa79f3aa 2008-01-31 thib (void)print_host(&con->se_in.ss, ibuf, sizeof(ibuf));
1757 aa79f3aa 2008-01-31 thib (void)print_host(&con->se_out.ss, obuf, sizeof(obuf));
1758 aa79f3aa 2008-01-31 thib if (EVBUFFER_LENGTH(con->se_log) &&
1759 ce0360b4 2017-09-23 bluhm evbuffer_add_printf(con->se_log, "\r\n") != -1) {
1760 ce0360b4 2017-09-23 bluhm ptr = evbuffer_readln(con->se_log, NULL,
1761 ce0360b4 2017-09-23 bluhm EVBUFFER_EOL_CRLF);
1763 37ed6014 2018-08-06 benno if (err == 0 && (env->sc_conf.opts & RELAYD_OPT_LOGCON))
1764 37ed6014 2018-08-06 benno log_info("relay %s, "
1765 37ed6014 2018-08-06 benno "session %d (%d active), %s, %s -> %s:%d, "
1766 37ed6014 2018-08-06 benno "%s%s%s", rlay->rl_conf.name, con->se_id,
1767 37ed6014 2018-08-06 benno relay_sessions, con->se_tag != 0 ?
1768 37ed6014 2018-08-06 benno tag_id2name(con->se_tag) : "0", ibuf, obuf,
1769 37ed6014 2018-08-06 benno ntohs(con->se_out.port), msg, ptr == NULL ?
1770 37ed6014 2018-08-06 benno "" : ",", ptr == NULL ? "" : ptr);
1771 37ed6014 2018-08-06 benno if (err == 1 && (env->sc_conf.opts & RELAYD_OPT_LOGCONERR))
1772 37ed6014 2018-08-06 benno log_warn("relay %s, "
1773 37ed6014 2018-08-06 benno "session %d (%d active), %s, %s -> %s:%d, "
1774 37ed6014 2018-08-06 benno "%s%s%s", rlay->rl_conf.name, con->se_id,
1775 37ed6014 2018-08-06 benno relay_sessions, con->se_tag != 0 ?
1776 37ed6014 2018-08-06 benno tag_id2name(con->se_tag) : "0", ibuf, obuf,
1777 37ed6014 2018-08-06 benno ntohs(con->se_out.port), msg, ptr == NULL ?
1778 37ed6014 2018-08-06 benno "" : ",", ptr == NULL ? "" : ptr);
1779 ba24b6a0 2015-12-07 mmcc free(ptr);
1782 69fde657 2014-07-09 reyk if (proto->close != NULL)
1783 69fde657 2014-07-09 reyk (*proto->close)(con);
1785 ba24b6a0 2015-12-07 mmcc free(con->se_priv);
1787 b8764354 2019-05-13 reyk relay_connect_state(con, &con->se_in, STATE_DONE);
1788 b8764354 2019-05-13 reyk if (relay_reset_event(con, &con->se_in)) {
1789 61cca588 2012-09-21 benno if (con->se_out.s == -1) {
1791 61cca588 2012-09-21 benno * the output was never connected,
1792 61cca588 2012-09-21 benno * thus this was an inflight session.
1794 61cca588 2012-09-21 benno relay_inflight--;
1795 61cca588 2012-09-21 benno log_debug("%s: sessions inflight decremented, now %d",
1796 61cca588 2012-09-21 benno __func__, relay_inflight);
1799 f877c700 2017-11-28 claudio if (con->se_in.output != NULL)
1800 f877c700 2017-11-28 claudio evbuffer_free(con->se_in.output);
1802 b8764354 2019-05-13 reyk relay_connect_state(con, &con->se_out, STATE_DONE);
1803 b8764354 2019-05-13 reyk if (relay_reset_event(con, &con->se_out)) {
1804 1ca19f87 2012-04-11 deraadt /* Some file descriptors are available again. */
1805 1ca19f87 2012-04-11 deraadt if (evtimer_pending(&rlay->rl_evt, NULL)) {
1806 1ca19f87 2012-04-11 deraadt evtimer_del(&rlay->rl_evt);
1807 1ca19f87 2012-04-11 deraadt event_add(&rlay->rl_ev, NULL);
1810 f877c700 2017-11-28 claudio if (con->se_out.output != NULL)
1811 f877c700 2017-11-28 claudio evbuffer_free(con->se_out.output);
1813 aa79f3aa 2008-01-31 thib if (con->se_log != NULL)
1814 aa79f3aa 2008-01-31 thib evbuffer_free(con->se_log);
1816 aa79f3aa 2008-01-31 thib if (con->se_cnl != NULL) {
1818 dbef7d4f 2011-05-09 reyk proc_compose_imsg(env->sc_ps, PROC_PFE, -1, IMSG_KILLSTATES, -1,
1819 30640247 2007-02-22 reyk cnl, sizeof(*cnl));
1821 aa79f3aa 2008-01-31 thib free(con->se_cnl);
1824 30640247 2007-02-22 reyk free(con);
1825 30640247 2007-02-22 reyk relay_sessions--;
1829 b8764354 2019-05-13 reyk relay_reset_event(struct rsession *con, struct ctl_relay_event *cre)
1831 f877c700 2017-11-28 claudio int rv = 0;
1833 b8764354 2019-05-13 reyk if (cre->state != STATE_DONE)
1834 b8764354 2019-05-13 reyk relay_connect_state(con, cre, STATE_CLOSED);
1835 b8764354 2019-05-13 reyk if (cre->bev != NULL) {
1836 b8764354 2019-05-13 reyk bufferevent_disable(cre->bev, EV_READ|EV_WRITE);
1837 f877c700 2017-11-28 claudio bufferevent_free(cre->bev);
1839 f877c700 2017-11-28 claudio if (cre->tls != NULL)
1840 f877c700 2017-11-28 claudio tls_close(cre->tls);
1841 f877c700 2017-11-28 claudio tls_free(cre->tls);
1842 f877c700 2017-11-28 claudio tls_free(cre->tls_ctx);
1843 f877c700 2017-11-28 claudio tls_config_free(cre->tls_cfg);
1844 f877c700 2017-11-28 claudio free(cre->tlscert);
1845 f877c700 2017-11-28 claudio if (cre->s != -1) {
1846 f877c700 2017-11-28 claudio close(cre->s);
1847 f877c700 2017-11-28 claudio rv = 1;
1849 f877c700 2017-11-28 claudio cre->bev = NULL;
1850 f877c700 2017-11-28 claudio cre->tls = NULL;
1851 f877c700 2017-11-28 claudio cre->tls_cfg = NULL;
1852 f877c700 2017-11-28 claudio cre->tlscert = NULL;
1853 f877c700 2017-11-28 claudio cre->s = -1;
1855 f877c700 2017-11-28 claudio return (rv);
1859 dbef7d4f 2011-05-09 reyk relay_dispatch_pfe(int fd, struct privsep_proc *p, struct imsg *imsg)
1861 41b83bb1 2007-09-07 reyk struct relay *rlay;
1862 f55b0941 2011-05-20 reyk struct rsession *con, se;
1863 30640247 2007-02-22 reyk struct ctl_natlook cnl;
1864 30640247 2007-02-22 reyk struct timeval tv;
1865 30640247 2007-02-22 reyk struct host *host;
1866 30640247 2007-02-22 reyk struct table *table;
1867 30640247 2007-02-22 reyk struct ctl_status st;
1868 589fbb6f 2007-03-07 reyk objid_t id;
1871 dbef7d4f 2011-05-09 reyk switch (imsg->hdr.type) {
1872 dbef7d4f 2011-05-09 reyk case IMSG_HOST_DISABLE:
1873 dbef7d4f 2011-05-09 reyk memcpy(&id, imsg->data, sizeof(id));
1874 dbef7d4f 2011-05-09 reyk if ((host = host_find(env, id)) == NULL)
1875 09e53fee 2017-05-28 benno fatalx("%s: desynchronized", __func__);
1876 dbef7d4f 2011-05-09 reyk if ((table = table_find(env, host->conf.tableid)) ==
1878 09e53fee 2017-05-28 benno fatalx("%s: invalid table id", __func__);
1879 dbef7d4f 2011-05-09 reyk if (host->up == HOST_UP)
1880 dbef7d4f 2011-05-09 reyk table->up--;
1881 dbef7d4f 2011-05-09 reyk host->flags |= F_DISABLE;
1882 dbef7d4f 2011-05-09 reyk host->up = HOST_UNKNOWN;
1884 dbef7d4f 2011-05-09 reyk case IMSG_HOST_ENABLE:
1885 dbef7d4f 2011-05-09 reyk memcpy(&id, imsg->data, sizeof(id));
1886 dbef7d4f 2011-05-09 reyk if ((host = host_find(env, id)) == NULL)
1887 09e53fee 2017-05-28 benno fatalx("%s: desynchronized", __func__);
1888 dbef7d4f 2011-05-09 reyk host->flags &= ~(F_DISABLE);
1889 dbef7d4f 2011-05-09 reyk host->up = HOST_UNKNOWN;
1891 dbef7d4f 2011-05-09 reyk case IMSG_TABLE_DISABLE:
1892 dbef7d4f 2011-05-09 reyk memcpy(&id, imsg->data, sizeof(id));
1893 dbef7d4f 2011-05-09 reyk if ((table = table_find(env, id)) == NULL)
1894 09e53fee 2017-05-28 benno fatalx("%s: desynchronized", __func__);
1895 dbef7d4f 2011-05-09 reyk table->conf.flags |= F_DISABLE;
1896 dbef7d4f 2011-05-09 reyk table->up = 0;
1897 dbef7d4f 2011-05-09 reyk TAILQ_FOREACH(host, &table->hosts, entry)
1898 dbef7d4f 2011-05-09 reyk host->up = HOST_UNKNOWN;
1900 dbef7d4f 2011-05-09 reyk case IMSG_TABLE_ENABLE:
1901 dbef7d4f 2011-05-09 reyk memcpy(&id, imsg->data, sizeof(id));
1902 dbef7d4f 2011-05-09 reyk if ((table = table_find(env, id)) == NULL)
1903 09e53fee 2017-05-28 benno fatalx("%s: desynchronized", __func__);
1904 dbef7d4f 2011-05-09 reyk table->conf.flags &= ~(F_DISABLE);
1905 dbef7d4f 2011-05-09 reyk table->up = 0;
1906 dbef7d4f 2011-05-09 reyk TAILQ_FOREACH(host, &table->hosts, entry)
1907 dbef7d4f 2011-05-09 reyk host->up = HOST_UNKNOWN;
1909 dbef7d4f 2011-05-09 reyk case IMSG_HOST_STATUS:
1910 dbef7d4f 2011-05-09 reyk IMSG_SIZE_CHECK(imsg, &st);
1911 dbef7d4f 2011-05-09 reyk memcpy(&st, imsg->data, sizeof(st));
1912 dbef7d4f 2011-05-09 reyk if ((host = host_find(env, st.id)) == NULL)
1913 09e53fee 2017-05-28 benno fatalx("%s: invalid host id", __func__);
1914 dbef7d4f 2011-05-09 reyk if (host->flags & F_DISABLE)
1916 dbef7d4f 2011-05-09 reyk if (host->up == st.up) {
1917 dbef7d4f 2011-05-09 reyk log_debug("%s: host %d => %d", __func__,
1918 dbef7d4f 2011-05-09 reyk host->conf.id, host->up);
1919 09e53fee 2017-05-28 benno fatalx("%s: desynchronized", __func__);
1922 dbef7d4f 2011-05-09 reyk if ((table = table_find(env, host->conf.tableid))
1924 09e53fee 2017-05-28 benno fatalx("%s: invalid table id", __func__);
1926 dbef7d4f 2011-05-09 reyk DPRINTF("%s: [%d] state %d for "
1927 5467e112 2016-09-29 benno "host %u %s", __func__, p->p_ps->ps_instance, st.up,
1928 dbef7d4f 2011-05-09 reyk host->conf.id, host->conf.name);
1930 dbef7d4f 2011-05-09 reyk if ((st.up == HOST_UNKNOWN && host->up == HOST_DOWN) ||
1931 dbef7d4f 2011-05-09 reyk (st.up == HOST_DOWN && host->up == HOST_UNKNOWN)) {
1932 30640247 2007-02-22 reyk host->up = st.up;
1935 dbef7d4f 2011-05-09 reyk if (st.up == HOST_UP)
1936 dbef7d4f 2011-05-09 reyk table->up++;
1938 dbef7d4f 2011-05-09 reyk table->up--;
1939 dbef7d4f 2011-05-09 reyk host->up = st.up;
1941 dbef7d4f 2011-05-09 reyk case IMSG_NATLOOK:
1942 dbef7d4f 2011-05-09 reyk bcopy(imsg->data, &cnl, sizeof(cnl));
1943 dbef7d4f 2011-05-09 reyk if ((con = session_find(env, cnl.id)) == NULL ||
1944 dbef7d4f 2011-05-09 reyk con->se_cnl == NULL) {
1945 dbef7d4f 2011-05-09 reyk log_debug("%s: session %d: expired",
1946 dbef7d4f 2011-05-09 reyk __func__, cnl.id);
1949 dbef7d4f 2011-05-09 reyk bcopy(&cnl, con->se_cnl, sizeof(*con->se_cnl));
1950 dbef7d4f 2011-05-09 reyk evtimer_del(&con->se_ev);
1951 dbef7d4f 2011-05-09 reyk evtimer_set(&con->se_ev, relay_natlook, con);
1952 dbef7d4f 2011-05-09 reyk bzero(&tv, sizeof(tv));
1953 dbef7d4f 2011-05-09 reyk evtimer_add(&con->se_ev, &tv);
1955 dbef7d4f 2011-05-09 reyk case IMSG_CTL_SESSION:
1956 f55b0941 2011-05-20 reyk IMSG_SIZE_CHECK(imsg, &cid);
1957 f55b0941 2011-05-20 reyk memcpy(&cid, imsg->data, sizeof(cid));
1958 dbef7d4f 2011-05-09 reyk TAILQ_FOREACH(rlay, env->sc_relays, rl_entry) {
1959 dbef7d4f 2011-05-09 reyk SPLAY_FOREACH(con, session_tree,
1960 dbef7d4f 2011-05-09 reyk &rlay->rl_sessions) {
1961 f55b0941 2011-05-20 reyk memcpy(&se, con, sizeof(se));
1962 f55b0941 2011-05-20 reyk se.se_cid = cid;
1963 141b9058 2015-12-02 reyk proc_compose(env->sc_ps, p->p_id,
1964 141b9058 2015-12-02 reyk IMSG_CTL_SESSION, &se, sizeof(se));
1967 141b9058 2015-12-02 reyk proc_compose(env->sc_ps, p->p_id, IMSG_CTL_END,
1968 141b9058 2015-12-02 reyk &cid, sizeof(cid));
1971 dbef7d4f 2011-05-09 reyk return (-1);
1974 dbef7d4f 2011-05-09 reyk return (0);
1978 c525adb9 2014-04-18 reyk relay_dispatch_ca(int fd, struct privsep_proc *p, struct imsg *imsg)
1980 fd9ff40c 2018-09-19 reyk switch (imsg->hdr.type) {
1981 fd9ff40c 2018-09-19 reyk case IMSG_CA_PRIVENC:
1982 fd9ff40c 2018-09-19 reyk case IMSG_CA_PRIVDEC:
1983 fd9ff40c 2018-09-19 reyk log_warnx("%s: priv%s result after timeout", __func__,
1984 fd9ff40c 2018-09-19 reyk imsg->hdr.type == IMSG_CA_PRIVENC ? "enc" : "dec");
1985 fd9ff40c 2018-09-19 reyk return (0);
1988 c525adb9 2014-04-18 reyk return (-1);
1992 dbef7d4f 2011-05-09 reyk relay_dispatch_parent(int fd, struct privsep_proc *p, struct imsg *imsg)
1994 f4a6eef3 2017-05-27 claudio struct relay_ticket_key ticket;
1995 f4a6eef3 2017-05-27 claudio struct relay *rlay;
1996 61afd4d6 2009-08-07 reyk struct rsession *con;
1997 6d5340e6 2008-06-11 reyk struct timeval tv;
1998 6d5340e6 2008-06-11 reyk objid_t id;
2000 dbef7d4f 2011-05-09 reyk switch (imsg->hdr.type) {
2001 dbef7d4f 2011-05-09 reyk case IMSG_BINDANY:
2002 dbef7d4f 2011-05-09 reyk bcopy(imsg->data, &id, sizeof(id));
2003 dbef7d4f 2011-05-09 reyk if ((con = session_find(env, id)) == NULL) {
2004 dbef7d4f 2011-05-09 reyk log_debug("%s: session %d: expired",
2005 dbef7d4f 2011-05-09 reyk __func__, id);
2009 dbef7d4f 2011-05-09 reyk /* Will validate the result later */
2010 754759d6 2024-01-17 claudio con->se_bnds = imsg_get_fd(imsg);
2012 dbef7d4f 2011-05-09 reyk evtimer_del(&con->se_ev);
2013 dbef7d4f 2011-05-09 reyk evtimer_set(&con->se_ev, relay_bindany, con);
2014 dbef7d4f 2011-05-09 reyk bzero(&tv, sizeof(tv));
2015 dbef7d4f 2011-05-09 reyk evtimer_add(&con->se_ev, &tv);
2017 591e6ab5 2011-05-19 reyk case IMSG_CFG_TABLE:
2018 591e6ab5 2011-05-19 reyk config_gettable(env, imsg);
2020 591e6ab5 2011-05-19 reyk case IMSG_CFG_HOST:
2021 591e6ab5 2011-05-19 reyk config_gethost(env, imsg);
2023 591e6ab5 2011-05-19 reyk case IMSG_CFG_PROTO:
2024 591e6ab5 2011-05-19 reyk config_getproto(env, imsg);
2026 69fde657 2014-07-09 reyk case IMSG_CFG_RULE:
2027 69fde657 2014-07-09 reyk config_getrule(env, imsg);
2029 591e6ab5 2011-05-19 reyk case IMSG_CFG_RELAY:
2030 591e6ab5 2011-05-19 reyk config_getrelay(env, imsg);
2032 0f7a5e2e 2012-10-03 reyk case IMSG_CFG_RELAY_TABLE:
2033 0f7a5e2e 2012-10-03 reyk config_getrelaytable(env, imsg);
2035 ce78c3f2 2017-11-27 claudio case IMSG_CFG_RELAY_FD:
2036 ce78c3f2 2017-11-27 claudio config_getrelayfd(env, imsg);
2038 591e6ab5 2011-05-19 reyk case IMSG_CFG_DONE:
2039 591e6ab5 2011-05-19 reyk config_getcfg(env, imsg);
2041 996c1f22 2012-01-21 camield case IMSG_CTL_START:
2042 591e6ab5 2011-05-19 reyk relay_launch();
2044 591e6ab5 2011-05-19 reyk case IMSG_CTL_RESET:
2045 591e6ab5 2011-05-19 reyk config_getreset(env, imsg);
2047 e5c598d0 2016-09-01 claudio case IMSG_TLSTICKET_REKEY:
2048 f4a6eef3 2017-05-27 claudio IMSG_SIZE_CHECK(imsg, (&ticket));
2049 f4a6eef3 2017-05-27 claudio memcpy(&env->sc_ticket, imsg->data, sizeof(env->sc_ticket));
2050 f4a6eef3 2017-05-27 claudio TAILQ_FOREACH(rlay, env->sc_relays, rl_entry) {
2051 f4a6eef3 2017-05-27 claudio if (rlay->rl_conf.flags & F_TLS)
2052 f4a6eef3 2017-05-27 claudio tls_config_add_ticket_key(rlay->rl_tls_cfg,
2053 f4a6eef3 2017-05-27 claudio env->sc_ticket.tt_keyrev,
2054 f4a6eef3 2017-05-27 claudio env->sc_ticket.tt_key,
2055 f4a6eef3 2017-05-27 claudio sizeof(env->sc_ticket.tt_key));
2059 dbef7d4f 2011-05-09 reyk return (-1);
2062 dbef7d4f 2011-05-09 reyk return (0);
2066 28bd28ce 2014-11-19 blambert relay_dispatch_hce(int fd, struct privsep_proc *p, struct imsg *imsg)
2068 28bd28ce 2014-11-19 blambert switch (imsg->hdr.type) {
2069 28bd28ce 2014-11-19 blambert default:
2070 28bd28ce 2014-11-19 blambert break;
2073 28bd28ce 2014-11-19 blambert return (-1);
2076 f4a6eef3 2017-05-27 claudio static int
2077 f4a6eef3 2017-05-27 claudio relay_tls_ctx_create_proto(struct protocol *proto, struct tls_config *tls_cfg)
2079 f4a6eef3 2017-05-27 claudio uint32_t protocols = 0;
2081 fba21fa4 2023-10-29 kn /* Set the allowed TLS protocols */
2082 f4a6eef3 2017-05-27 claudio if (proto->tlsflags & TLSFLAG_TLSV1_2)
2083 f4a6eef3 2017-05-27 claudio protocols |= TLS_PROTOCOL_TLSv1_2;
2084 8d09c191 2020-05-14 pvk if (proto->tlsflags & TLSFLAG_TLSV1_3)
2085 8d09c191 2020-05-14 pvk protocols |= TLS_PROTOCOL_TLSv1_3;
2086 f4a6eef3 2017-05-27 claudio if (tls_config_set_protocols(tls_cfg, protocols) == -1) {
2087 f4a6eef3 2017-05-27 claudio log_warnx("could not set the TLS protocol: %s",
2088 f4a6eef3 2017-05-27 claudio tls_config_error(tls_cfg));
2089 f4a6eef3 2017-05-27 claudio return (-1);
2092 f4a6eef3 2017-05-27 claudio if (tls_config_set_ciphers(tls_cfg, proto->tlsciphers)) {
2093 f4a6eef3 2017-05-27 claudio log_warnx("could not set the TLS cypers: %s",
2094 f4a6eef3 2017-05-27 claudio tls_config_error(tls_cfg));
2095 f4a6eef3 2017-05-27 claudio return (-1);
2098 f4a6eef3 2017-05-27 claudio if ((proto->tlsflags & TLSFLAG_CIPHER_SERVER_PREF) == 0)
2099 f4a6eef3 2017-05-27 claudio tls_config_prefer_ciphers_client(tls_cfg);
2102 e5c598d0 2016-09-01 claudio * Set session ID context to a random value. It needs to be the
2103 57122c1b 2022-12-28 jmc * same across all relay processes or session caching will fail.
2105 f4a6eef3 2017-05-27 claudio if (tls_config_set_session_id(tls_cfg, env->sc_conf.tls_sid,
2106 f4a6eef3 2017-05-27 claudio sizeof(env->sc_conf.tls_sid)) == -1) {
2107 f4a6eef3 2017-05-27 claudio log_warnx("could not set the TLS session ID: %s",
2108 f4a6eef3 2017-05-27 claudio tls_config_error(tls_cfg));
2109 f4a6eef3 2017-05-27 claudio return (-1);
2112 f4a6eef3 2017-05-27 claudio /* Set callback for TLS session tickets if enabled */
2113 f4a6eef3 2017-05-27 claudio if (proto->tickets == 1) {
2114 f4a6eef3 2017-05-27 claudio /* set timeout to the ticket rekey time */
2115 f4a6eef3 2017-05-27 claudio tls_config_set_session_lifetime(tls_cfg, TLS_SESSION_LIFETIME);
2117 f4a6eef3 2017-05-27 claudio tls_config_add_ticket_key(tls_cfg,
2118 f4a6eef3 2017-05-27 claudio env->sc_ticket.tt_keyrev, env->sc_ticket.tt_key,
2119 f4a6eef3 2017-05-27 claudio sizeof(env->sc_ticket.tt_key));
2122 3fe6d92f 2017-11-27 claudio if (tls_config_set_ecdhecurves(tls_cfg, proto->tlsecdhecurves) != 0) {
2123 3fe6d92f 2017-11-27 claudio log_warnx("failed to set ecdhe curves %s: %s",
2124 3fe6d92f 2017-11-27 claudio proto->tlsecdhecurves, tls_config_error(tls_cfg));
2125 f4a6eef3 2017-05-27 claudio return (-1);
2128 f4a6eef3 2017-05-27 claudio if (tls_config_set_dheparams(tls_cfg, proto->tlsdhparams) != 0) {
2129 f4a6eef3 2017-05-27 claudio log_warnx("failed to set dh params %s: %s",
2130 f4a6eef3 2017-05-27 claudio proto->tlsdhparams, tls_config_error(tls_cfg));
2131 f4a6eef3 2017-05-27 claudio return (-1);
2134 f4a6eef3 2017-05-27 claudio return (0);
2138 f4a6eef3 2017-05-27 claudio * This function is not publicy exported because it is a hack until libtls
2139 09e53fee 2017-05-28 benno * has a proper privsep setup
2141 3b62aaee 2021-01-27 eric void tls_config_use_fake_private_key(struct tls_config *config);
2144 f4a6eef3 2017-05-27 claudio relay_tls_ctx_create(struct relay *rlay)
2146 f4a6eef3 2017-05-27 claudio struct tls_config *tls_cfg, *tls_client_cfg;
2147 f4a6eef3 2017-05-27 claudio struct tls *tls = NULL;
2148 fe4913ec 2019-05-31 reyk struct relay_cert *cert;
2149 3b62aaee 2021-01-27 eric int keyfound = 0;
2150 0c91187d 2019-06-26 reyk char *buf = NULL, *cabuf = NULL, *ocspbuf = NULL;
2151 0c91187d 2019-06-26 reyk off_t len = 0, calen = 0, ocsplen = 0;
2153 f4a6eef3 2017-05-27 claudio if ((tls_cfg = tls_config_new()) == NULL) {
2154 f4a6eef3 2017-05-27 claudio log_warnx("unable to allocate TLS config");
2155 f4a6eef3 2017-05-27 claudio return (-1);
2157 f4a6eef3 2017-05-27 claudio if ((tls_client_cfg = tls_config_new()) == NULL) {
2158 f4a6eef3 2017-05-27 claudio log_warnx("unable to allocate TLS config");
2162 f4a6eef3 2017-05-27 claudio if (relay_tls_ctx_create_proto(rlay->rl_proto, tls_cfg) == -1)
2164 f4a6eef3 2017-05-27 claudio if (relay_tls_ctx_create_proto(rlay->rl_proto, tls_client_cfg) == -1)
2165 f4a6eef3 2017-05-27 claudio goto err;
2167 f4a6eef3 2017-05-27 claudio /* Verify the server certificate if we have a CA chain */
2168 f4a6eef3 2017-05-27 claudio if (rlay->rl_conf.flags & F_TLSCLIENT) {
2170 f4a6eef3 2017-05-27 claudio * Currently relayd can't verify the name of certs and changing
2171 f4a6eef3 2017-05-27 claudio * this is non trivial. For now just disable name verification.
2173 f4a6eef3 2017-05-27 claudio tls_config_insecure_noverifyname(tls_client_cfg);
2175 ce78c3f2 2017-11-27 claudio if (rlay->rl_tls_ca_fd != -1) {
2176 c4efe747 2024-10-28 tb if ((buf = relay_load_fd(rlay->rl_tls_ca_fd, &len)) == NULL) {
2177 ce78c3f2 2017-11-27 claudio log_warn("failed to read root certificates");
2178 ce78c3f2 2017-11-27 claudio goto err;
2180 fe4913ec 2019-05-31 reyk rlay->rl_tls_ca_fd = -1;
2182 ce78c3f2 2017-11-27 claudio if (tls_config_set_ca_mem(tls_client_cfg, buf, len) !=
2184 f4a6eef3 2017-05-27 claudio log_warnx("failed to set root certificates: %s",
2185 f4a6eef3 2017-05-27 claudio tls_config_error(tls_client_cfg));
2186 f4a6eef3 2017-05-27 claudio goto err;
2188 ce78c3f2 2017-11-27 claudio purge_key(&buf, len);
2189 f4a6eef3 2017-05-27 claudio } else {
2190 f4a6eef3 2017-05-27 claudio /* No root cert available so disable the checking */
2191 f4a6eef3 2017-05-27 claudio tls_config_insecure_noverifycert(tls_client_cfg);
2194 f4a6eef3 2017-05-27 claudio rlay->rl_tls_client_cfg = tls_client_cfg;
2197 f4a6eef3 2017-05-27 claudio if (rlay->rl_conf.flags & F_TLS) {
2198 f4a6eef3 2017-05-27 claudio log_debug("%s: loading certificate", __func__);
2200 f4a6eef3 2017-05-27 claudio * Use the public key as the "private" key - the secret key
2201 f4a6eef3 2017-05-27 claudio * parameters are hidden in an extra process that will be
2202 fba21fa4 2023-10-29 kn * contacted by the RSA engine. The TLS library needs at
2203 f4a6eef3 2017-05-27 claudio * least the public key parameters in the current process.
2205 3b62aaee 2021-01-27 eric tls_config_use_fake_private_key(tls_cfg);
2207 fe4913ec 2019-05-31 reyk TAILQ_FOREACH(cert, env->sc_certs, cert_entry) {
2208 fe4913ec 2019-05-31 reyk if (cert->cert_relayid != rlay->rl_conf.id ||
2209 fe4913ec 2019-05-31 reyk cert->cert_fd == -1)
2211 fe4913ec 2019-05-31 reyk keyfound++;
2213 fe4913ec 2019-05-31 reyk if ((buf = relay_load_fd(cert->cert_fd,
2214 fe4913ec 2019-05-31 reyk &len)) == NULL) {
2215 fe4913ec 2019-05-31 reyk log_warn("failed to load tls certificate");
2218 fe4913ec 2019-05-31 reyk cert->cert_fd = -1;
2220 0c91187d 2019-06-26 reyk if (cert->cert_ocsp_fd != -1 &&
2221 0c91187d 2019-06-26 reyk (ocspbuf = relay_load_fd(cert->cert_ocsp_fd,
2222 0c91187d 2019-06-26 reyk &ocsplen)) == NULL) {
2223 0c91187d 2019-06-26 reyk log_warn("failed to load OCSP staplefile");
2226 0c91187d 2019-06-26 reyk if (ocsplen == 0)
2227 0c91187d 2019-06-26 reyk purge_key(&ocspbuf, ocsplen);
2228 0c91187d 2019-06-26 reyk cert->cert_ocsp_fd = -1;
2230 fe4913ec 2019-05-31 reyk if (keyfound == 1 &&
2231 fe4913ec 2019-05-31 reyk tls_config_set_keypair_ocsp_mem(tls_cfg, buf, len,
2232 3b62aaee 2021-01-27 eric NULL, 0, ocspbuf, ocsplen) != 0) {
2233 fe4913ec 2019-05-31 reyk log_warnx("failed to set tls certificate: %s",
2234 fe4913ec 2019-05-31 reyk tls_config_error(tls_cfg));
2238 fe4913ec 2019-05-31 reyk /* loading certificate public key */
2239 fe4913ec 2019-05-31 reyk if (keyfound == 1 &&
2240 fe4913ec 2019-05-31 reyk !ssl_load_pkey(buf, len, NULL, &rlay->rl_tls_pkey))
2243 fe4913ec 2019-05-31 reyk if (tls_config_add_keypair_ocsp_mem(tls_cfg, buf, len,
2244 3b62aaee 2021-01-27 eric NULL, 0, ocspbuf, ocsplen) != 0) {
2245 fe4913ec 2019-05-31 reyk log_warnx("failed to add tls certificate: %s",
2246 fe4913ec 2019-05-31 reyk tls_config_error(tls_cfg));
2250 fe4913ec 2019-05-31 reyk purge_key(&buf, len);
2251 0c91187d 2019-06-26 reyk purge_key(&ocspbuf, ocsplen);
2254 ce78c3f2 2017-11-27 claudio if (rlay->rl_tls_cacert_fd != -1) {
2255 ce78c3f2 2017-11-27 claudio if ((cabuf = relay_load_fd(rlay->rl_tls_cacert_fd,
2256 ce78c3f2 2017-11-27 claudio &calen)) == NULL) {
2257 ce78c3f2 2017-11-27 claudio log_warn("failed to load tls CA certificate");
2258 ce78c3f2 2017-11-27 claudio goto err;
2260 f4a6eef3 2017-05-27 claudio log_debug("%s: loading CA certificate", __func__);
2261 ce78c3f2 2017-11-27 claudio if (!ssl_load_pkey(cabuf, calen,
2262 f4a6eef3 2017-05-27 claudio &rlay->rl_tls_cacertx509, &rlay->rl_tls_capkey))
2263 f4a6eef3 2017-05-27 claudio goto err;
2265 fe4913ec 2019-05-31 reyk rlay->rl_tls_cacert_fd = -1;
2267 c4efe747 2024-10-28 tb if (rlay->rl_tls_client_ca_fd != -1) {
2268 c4efe747 2024-10-28 tb if ((buf = relay_load_fd(rlay->rl_tls_client_ca_fd,
2269 c4efe747 2024-10-28 tb &len)) == NULL) {
2271 c4efe747 2024-10-28 tb "failed to read tls client CA certificate");
2275 c4efe747 2024-10-28 tb if (tls_config_set_ca_mem(tls_cfg, buf, len) != 0) {
2277 c4efe747 2024-10-28 tb "failed to set tls client CA cert: %s",
2278 c4efe747 2024-10-28 tb tls_config_error(tls_cfg));
2281 c4efe747 2024-10-28 tb purge_key(&buf, len);
2283 c4efe747 2024-10-28 tb tls_config_verify_client(tls_cfg);
2285 c4efe747 2024-10-28 tb rlay->rl_tls_client_ca_fd = -1;
2287 f4a6eef3 2017-05-27 claudio tls = tls_server();
2288 f4a6eef3 2017-05-27 claudio if (tls == NULL) {
2289 f4a6eef3 2017-05-27 claudio log_warnx("unable to allocate TLS context");
2290 f4a6eef3 2017-05-27 claudio goto err;
2292 f4a6eef3 2017-05-27 claudio if (tls_configure(tls, tls_cfg) == -1) {
2293 f4a6eef3 2017-05-27 claudio log_warnx("could not configure the TLS context: %s",
2294 f4a6eef3 2017-05-27 claudio tls_error(tls));
2295 f4a6eef3 2017-05-27 claudio tls_free(tls);
2296 f4a6eef3 2017-05-27 claudio goto err;
2298 f4a6eef3 2017-05-27 claudio rlay->rl_tls_cfg = tls_cfg;
2299 f4a6eef3 2017-05-27 claudio rlay->rl_tls_ctx = tls;
2301 ce78c3f2 2017-11-27 claudio purge_key(&cabuf, calen);
2304 f4a6eef3 2017-05-27 claudio if (rlay->rl_tls_client_cfg == NULL)
2305 f4a6eef3 2017-05-27 claudio tls_config_free(tls_client_cfg);
2306 f4a6eef3 2017-05-27 claudio if (rlay->rl_tls_cfg == NULL)
2307 f4a6eef3 2017-05-27 claudio tls_config_free(tls_cfg);
2309 f4a6eef3 2017-05-27 claudio return (0);
2311 0c91187d 2019-06-26 reyk purge_key(&ocspbuf, ocsplen);
2312 ce78c3f2 2017-11-27 claudio purge_key(&cabuf, calen);
2313 ce78c3f2 2017-11-27 claudio purge_key(&buf, len);
2315 f4a6eef3 2017-05-27 claudio tls_config_free(tls_client_cfg);
2316 f4a6eef3 2017-05-27 claudio tls_config_free(tls_cfg);
2317 f4a6eef3 2017-05-27 claudio return (-1);
2320 f4a6eef3 2017-05-27 claudio static struct tls *
2321 f4a6eef3 2017-05-27 claudio relay_tls_inspect_create(struct relay *rlay, struct ctl_relay_event *cre)
2323 f4a6eef3 2017-05-27 claudio struct tls_config *tls_cfg;
2324 14dad9a3 2017-11-28 claudio struct tls *tls = NULL;
2326 f4a6eef3 2017-05-27 claudio /* TLS inspection: use session-specific certificate */
2327 f4a6eef3 2017-05-27 claudio if ((tls_cfg = tls_config_new()) == NULL) {
2328 f4a6eef3 2017-05-27 claudio log_warnx("unable to allocate TLS config");
2329 f4a6eef3 2017-05-27 claudio goto err;
2331 8b367207 2017-07-30 bluhm if (relay_tls_ctx_create_proto(rlay->rl_proto, tls_cfg) == -1) {
2332 8b367207 2017-07-30 bluhm /* error already printed */
2333 f4a6eef3 2017-05-27 claudio goto err;
2336 3b62aaee 2021-01-27 eric tls_config_use_fake_private_key(tls_cfg);
2338 f4a6eef3 2017-05-27 claudio if (tls_config_set_keypair_ocsp_mem(tls_cfg,
2339 3b62aaee 2021-01-27 eric cre->tlscert, cre->tlscert_len, NULL, 0, NULL, 0) != 0) {
2340 f4a6eef3 2017-05-27 claudio log_warnx("failed to set tls certificate: %s",
2341 f4a6eef3 2017-05-27 claudio tls_config_error(tls_cfg));
2342 f4a6eef3 2017-05-27 claudio goto err;
2345 f4a6eef3 2017-05-27 claudio tls = tls_server();
2346 f4a6eef3 2017-05-27 claudio if (tls == NULL) {
2347 f4a6eef3 2017-05-27 claudio log_warnx("unable to allocate TLS context");
2348 f4a6eef3 2017-05-27 claudio goto err;
2350 f4a6eef3 2017-05-27 claudio if (tls_configure(tls, tls_cfg) == -1) {
2351 f4a6eef3 2017-05-27 claudio log_warnx("could not configure the TLS context: %s",
2352 f4a6eef3 2017-05-27 claudio tls_error(tls));
2353 f4a6eef3 2017-05-27 claudio tls_free(tls);
2354 f4a6eef3 2017-05-27 claudio goto err;
2357 f4a6eef3 2017-05-27 claudio cre->tls_cfg = tls_cfg;
2358 14dad9a3 2017-11-28 claudio cre->tls_ctx = tls;
2359 f4a6eef3 2017-05-27 claudio return (tls);
2361 f4a6eef3 2017-05-27 claudio tls_config_free(tls_cfg);
2362 30640247 2007-02-22 reyk return (NULL);
2366 096ff28b 2014-12-12 reyk relay_tls_transaction(struct rsession *con, struct ctl_relay_event *cre)
2368 6e65a975 2013-01-17 bluhm struct relay *rlay = con->se_relay;
2369 f4a6eef3 2017-05-27 claudio struct tls *tls_server;
2370 f4a6eef3 2017-05-27 claudio const char *errstr;
2371 9b46e219 2011-09-04 bluhm u_int flag;
2373 6024acb8 2009-04-01 reyk if (cre->dir == RELAY_DIR_REQUEST) {
2374 f4a6eef3 2017-05-27 claudio if (cre->tlscert != NULL)
2375 f4a6eef3 2017-05-27 claudio tls_server = relay_tls_inspect_create(rlay, cre);
2377 f4a6eef3 2017-05-27 claudio tls_server = rlay->rl_tls_ctx;
2378 bd00d3d8 2017-07-28 bluhm if (tls_server == NULL) {
2379 bd00d3d8 2017-07-28 bluhm errstr = "no TLS server context available";
2380 bd00d3d8 2017-07-28 bluhm goto err;
2383 f4a6eef3 2017-05-27 claudio if (tls_accept_socket(tls_server, &cre->tls, cre->s) == -1) {
2384 f4a6eef3 2017-05-27 claudio errstr = "could not accept the TLS connection";
2385 f4a6eef3 2017-05-27 claudio goto err;
2387 9b46e219 2011-09-04 bluhm flag = EV_READ;
2389 f4a6eef3 2017-05-27 claudio cre->tls = tls_client();
2390 f4a6eef3 2017-05-27 claudio if (cre->tls == NULL ||
2391 f4a6eef3 2017-05-27 claudio tls_configure(cre->tls, rlay->rl_tls_client_cfg) == -1) {
2392 f4a6eef3 2017-05-27 claudio errstr = "could not configure the TLS client context";
2393 f4a6eef3 2017-05-27 claudio goto err;
2395 f4a6eef3 2017-05-27 claudio if (tls_connect_socket(cre->tls, cre->s, NULL) == -1) {
2396 f4a6eef3 2017-05-27 claudio errstr = "could not connect the TLS connection";
2397 f4a6eef3 2017-05-27 claudio goto err;
2399 9b46e219 2011-09-04 bluhm flag = EV_WRITE;
2402 f4a6eef3 2017-05-27 claudio log_debug("%s: session %d: scheduling on %s", __func__, con->se_id,
2403 9b46e219 2011-09-04 bluhm (flag == EV_READ) ? "EV_READ" : "EV_WRITE");
2404 f4a6eef3 2017-05-27 claudio event_again(&con->se_ev, cre->s, EV_TIMEOUT|flag, relay_tls_handshake,
2405 f4a6eef3 2017-05-27 claudio &con->se_tv_start, &rlay->rl_conf.timeout, cre);
2409 37ed6014 2018-08-06 benno relay_close(con, errstr, 1);
2413 f4a6eef3 2017-05-27 claudio relay_tls_handshake(int fd, short event, void *arg)
2415 f4a6eef3 2017-05-27 claudio struct ctl_relay_event *cre = arg;
2416 f4a6eef3 2017-05-27 claudio struct rsession *con = cre->con;
2417 f4a6eef3 2017-05-27 claudio struct relay *rlay = con->se_relay;
2418 f4a6eef3 2017-05-27 claudio int retry_flag = 0;
2419 f4a6eef3 2017-05-27 claudio int ret;
2420 112f6a5d 2018-06-10 benno char *msg;
2422 30640247 2007-02-22 reyk if (event == EV_TIMEOUT) {
2423 37ed6014 2018-08-06 benno relay_close(con, "TLS handshake timeout", 1);
2427 f4a6eef3 2017-05-27 claudio ret = tls_handshake(cre->tls);
2428 f4a6eef3 2017-05-27 claudio if (ret == 0) {
2429 ed29f86d 2007-02-24 reyk #ifdef DEBUG
2430 f4a6eef3 2017-05-27 claudio log_info(
2432 f4a6eef3 2017-05-27 claudio log_debug(
2434 f4a6eef3 2017-05-27 claudio "relay %s, tls session %d %s (%d active)",
2435 f4a6eef3 2017-05-27 claudio rlay->rl_conf.name, con->se_id,
2436 f4a6eef3 2017-05-27 claudio cre->dir == RELAY_DIR_REQUEST ? "established" : "connected",
2437 f4a6eef3 2017-05-27 claudio relay_sessions);
2439 f4a6eef3 2017-05-27 claudio if (cre->dir == RELAY_DIR_REQUEST) {
2440 03668b6b 2013-05-30 reyk relay_session(con);
2441 f4a6eef3 2017-05-27 claudio return;
2444 f4a6eef3 2017-05-27 claudio if (rlay->rl_conf.flags & F_TLSINSPECT) {
2445 f4a6eef3 2017-05-27 claudio const uint8_t *servercert;
2446 f4a6eef3 2017-05-27 claudio size_t len;
2448 f4a6eef3 2017-05-27 claudio servercert = tls_peer_cert_chain_pem(con->se_out.tls,
2450 f4a6eef3 2017-05-27 claudio if (servercert != NULL) {
2451 f4a6eef3 2017-05-27 claudio con->se_in.tlscert = ssl_update_certificate(
2452 f4a6eef3 2017-05-27 claudio servercert, len,
2453 f4a6eef3 2017-05-27 claudio rlay->rl_tls_pkey, rlay->rl_tls_capkey,
2454 f4a6eef3 2017-05-27 claudio rlay->rl_tls_cacertx509,
2455 f4a6eef3 2017-05-27 claudio &con->se_in.tlscert_len);
2457 f4a6eef3 2017-05-27 claudio con->se_in.tlscert = NULL;
2458 f4a6eef3 2017-05-27 claudio if (con->se_in.tlscert == NULL)
2459 f4a6eef3 2017-05-27 claudio relay_close(con,
2460 37ed6014 2018-08-06 benno "could not create certificate", 1);
2462 f4a6eef3 2017-05-27 claudio relay_session(con);
2463 f4a6eef3 2017-05-27 claudio return;
2465 f4a6eef3 2017-05-27 claudio relay_connected(fd, EV_WRITE, con);
2467 f4a6eef3 2017-05-27 claudio } else if (ret == TLS_WANT_POLLIN) {
2468 f4a6eef3 2017-05-27 claudio retry_flag = EV_READ;
2469 f4a6eef3 2017-05-27 claudio } else if (ret == TLS_WANT_POLLOUT) {
2470 f4a6eef3 2017-05-27 claudio retry_flag = EV_WRITE;
2471 f4a6eef3 2017-05-27 claudio } else {
2472 112f6a5d 2018-06-10 benno if (asprintf(&msg, "TLS handshake error: %s",
2473 112f6a5d 2018-06-10 benno tls_error(cre->tls)) >= 0) {
2474 37ed6014 2018-08-06 benno relay_close(con, msg, 1);
2475 112f6a5d 2018-06-10 benno free(msg);
2477 37ed6014 2018-08-06 benno relay_close(con, "TLS handshake error", 1);
2479 f4a6eef3 2017-05-27 claudio return;
2482 666bd316 2011-05-05 reyk DPRINTF("%s: session %d: scheduling on %s", __func__, con->se_id,
2483 6024acb8 2009-04-01 reyk (retry_flag == EV_READ) ? "EV_READ" : "EV_WRITE");
2484 f4a6eef3 2017-05-27 claudio event_again(&con->se_ev, fd, EV_TIMEOUT|retry_flag, relay_tls_handshake,
2485 f4a6eef3 2017-05-27 claudio &con->se_tv_start, &rlay->rl_conf.timeout, cre);
2489 096ff28b 2014-12-12 reyk relay_tls_connected(struct ctl_relay_event *cre)
2492 30640247 2007-02-22 reyk * Hack libevent - we overwrite the internal bufferevent I/O
2493 096ff28b 2014-12-12 reyk * functions to handle the TLS abstraction.
2495 e85af49a 2017-11-27 claudio event_del(&cre->bev->ev_read);
2496 e85af49a 2017-11-27 claudio event_del(&cre->bev->ev_write);
2498 30640247 2007-02-22 reyk event_set(&cre->bev->ev_read, cre->s, EV_READ,
2499 096ff28b 2014-12-12 reyk relay_tls_readcb, cre->bev);
2500 30640247 2007-02-22 reyk event_set(&cre->bev->ev_write, cre->s, EV_WRITE,
2501 096ff28b 2014-12-12 reyk relay_tls_writecb, cre->bev);
2505 096ff28b 2014-12-12 reyk relay_tls_readcb(int fd, short event, void *arg)
2507 185b85c3 2014-06-27 andre char rbuf[IBUF_READ_SIZE];
2508 185b85c3 2014-06-27 andre struct bufferevent *bufev = arg;
2509 185b85c3 2014-06-27 andre struct ctl_relay_event *cre = bufev->cbarg;
2510 185b85c3 2014-06-27 andre short what = EVBUFFER_READ;
2511 185b85c3 2014-06-27 andre int howmuch = IBUF_READ_SIZE;
2512 f4a6eef3 2017-05-27 claudio ssize_t ret;
2513 185b85c3 2014-06-27 andre size_t len;
2515 30640247 2007-02-22 reyk if (event == EV_TIMEOUT) {
2516 30640247 2007-02-22 reyk what |= EVBUFFER_TIMEOUT;
2520 30640247 2007-02-22 reyk if (bufev->wm_read.high != 0)
2521 2f6ec04d 2015-01-16 deraadt howmuch = MINIMUM(sizeof(rbuf), bufev->wm_read.high);
2523 f4a6eef3 2017-05-27 claudio ret = tls_read(cre->tls, rbuf, howmuch);
2524 f4a6eef3 2017-05-27 claudio if (ret == TLS_WANT_POLLIN || ret == TLS_WANT_POLLOUT) {
2525 f4a6eef3 2017-05-27 claudio goto retry;
2526 e475725e 2019-06-28 deraadt } else if (ret == -1) {
2527 f4a6eef3 2017-05-27 claudio what |= EVBUFFER_ERROR;
2528 f4a6eef3 2017-05-27 claudio goto err;
2530 f4a6eef3 2017-05-27 claudio len = ret;
2532 f4a6eef3 2017-05-27 claudio if (len == 0) {
2533 f4a6eef3 2017-05-27 claudio what |= EVBUFFER_EOF;
2534 f4a6eef3 2017-05-27 claudio goto err;
2537 30640247 2007-02-22 reyk if (evbuffer_add(bufev->input, rbuf, ret) == -1) {
2538 30640247 2007-02-22 reyk what |= EVBUFFER_ERROR;
2542 30640247 2007-02-22 reyk relay_bufferevent_add(&bufev->ev_read, bufev->timeout_read);
2544 30640247 2007-02-22 reyk len = EVBUFFER_LENGTH(bufev->input);
2545 30640247 2007-02-22 reyk if (bufev->wm_read.low != 0 && len < bufev->wm_read.low)
2547 30640247 2007-02-22 reyk if (bufev->wm_read.high != 0 && len > bufev->wm_read.high) {
2548 30640247 2007-02-22 reyk struct evbuffer *buf = bufev->input;
2549 30640247 2007-02-22 reyk event_del(&bufev->ev_read);
2550 30640247 2007-02-22 reyk evbuffer_setcb(buf, bufferevent_read_pressure_cb, bufev);
2554 30640247 2007-02-22 reyk if (bufev->readcb != NULL)
2555 30640247 2007-02-22 reyk (*bufev->readcb)(bufev, bufev->cbarg);
2559 30640247 2007-02-22 reyk relay_bufferevent_add(&bufev->ev_read, bufev->timeout_read);
2563 30640247 2007-02-22 reyk (*bufev->errorcb)(bufev, what, bufev->cbarg);
2567 096ff28b 2014-12-12 reyk relay_tls_writecb(int fd, short event, void *arg)
2569 185b85c3 2014-06-27 andre struct bufferevent *bufev = arg;
2570 185b85c3 2014-06-27 andre struct ctl_relay_event *cre = bufev->cbarg;
2571 f4a6eef3 2017-05-27 claudio ssize_t ret;
2572 f4a6eef3 2017-05-27 claudio size_t len;
2573 185b85c3 2014-06-27 andre short what = EVBUFFER_WRITE;
2575 30640247 2007-02-22 reyk if (event == EV_TIMEOUT) {
2576 30640247 2007-02-22 reyk what |= EVBUFFER_TIMEOUT;
2580 30640247 2007-02-22 reyk if (EVBUFFER_LENGTH(bufev->output)) {
2581 f4a6eef3 2017-05-27 claudio ret = tls_write(cre->tls, EVBUFFER_DATA(bufev->output),
2582 f4a6eef3 2017-05-27 claudio EVBUFFER_LENGTH(bufev->output));
2583 f4a6eef3 2017-05-27 claudio if (ret == TLS_WANT_POLLIN || ret == TLS_WANT_POLLOUT) {
2584 f4a6eef3 2017-05-27 claudio goto retry;
2585 e475725e 2019-06-28 deraadt } else if (ret == -1) {
2586 f4a6eef3 2017-05-27 claudio what |= EVBUFFER_ERROR;
2587 f4a6eef3 2017-05-27 claudio goto err;
2589 f4a6eef3 2017-05-27 claudio len = ret;
2590 f4a6eef3 2017-05-27 claudio evbuffer_drain(bufev->output, len);
2593 30640247 2007-02-22 reyk if (EVBUFFER_LENGTH(bufev->output) != 0)
2594 30640247 2007-02-22 reyk relay_bufferevent_add(&bufev->ev_write, bufev->timeout_write);
2596 30640247 2007-02-22 reyk if (bufev->writecb != NULL &&
2597 30640247 2007-02-22 reyk EVBUFFER_LENGTH(bufev->output) <= bufev->wm_write.low)
2598 30640247 2007-02-22 reyk (*bufev->writecb)(bufev, bufev->cbarg);
2602 f4a6eef3 2017-05-27 claudio relay_bufferevent_add(&bufev->ev_write, bufev->timeout_write);
2606 30640247 2007-02-22 reyk (*bufev->errorcb)(bufev, what, bufev->cbarg);
2610 30640247 2007-02-22 reyk relay_bufferevent_add(struct event *ev, int timeout)
2612 30640247 2007-02-22 reyk struct timeval tv, *ptv = NULL;
2614 30640247 2007-02-22 reyk if (timeout) {
2615 30640247 2007-02-22 reyk timerclear(&tv);
2616 30640247 2007-02-22 reyk tv.tv_sec = timeout;
2617 30640247 2007-02-22 reyk ptv = &tv;
2620 30640247 2007-02-22 reyk return (event_add(ev, ptv));
2623 30640247 2007-02-22 reyk #ifdef notyet
2625 30640247 2007-02-22 reyk relay_bufferevent_printf(struct ctl_relay_event *cre, const char *fmt, ...)
2628 185b85c3 2014-06-27 andre va_list ap;
2630 30640247 2007-02-22 reyk va_start(ap, fmt);
2631 30640247 2007-02-22 reyk ret = evbuffer_add_vprintf(cre->output, fmt, ap);
2632 30640247 2007-02-22 reyk va_end(ap);
2634 30640247 2007-02-22 reyk if (cre->bev != NULL &&
2635 30640247 2007-02-22 reyk ret != -1 && EVBUFFER_LENGTH(cre->output) > 0 &&
2636 30640247 2007-02-22 reyk (cre->bev->enabled & EV_WRITE))
2637 30640247 2007-02-22 reyk bufferevent_enable(cre->bev, EV_WRITE);
2639 30640247 2007-02-22 reyk return (ret);
2644 69fde657 2014-07-09 reyk relay_bufferevent_print(struct ctl_relay_event *cre, const char *str)
2646 30640247 2007-02-22 reyk if (cre->bev == NULL)
2647 30640247 2007-02-22 reyk return (evbuffer_add(cre->output, str, strlen(str)));
2648 30640247 2007-02-22 reyk return (bufferevent_write(cre->bev, str, strlen(str)));
2652 b38c71db 2007-02-26 reyk relay_bufferevent_write_buffer(struct ctl_relay_event *cre,
2653 b38c71db 2007-02-26 reyk struct evbuffer *buf)
2655 30640247 2007-02-22 reyk if (cre->bev == NULL)
2656 30640247 2007-02-22 reyk return (evbuffer_add_buffer(cre->output, buf));
2657 30640247 2007-02-22 reyk return (bufferevent_write_buffer(cre->bev, buf));
2661 711018d8 2007-02-26 reyk relay_bufferevent_write_chunk(struct ctl_relay_event *cre,
2662 711018d8 2007-02-26 reyk struct evbuffer *buf, size_t size)
2665 b7ece43c 2023-09-03 nicm ret = relay_bufferevent_write(cre, EVBUFFER_DATA(buf), size);
2666 711018d8 2007-02-26 reyk if (ret != -1)
2667 711018d8 2007-02-26 reyk evbuffer_drain(buf, size);
2668 711018d8 2007-02-26 reyk return (ret);
2672 30640247 2007-02-22 reyk relay_bufferevent_write(struct ctl_relay_event *cre, void *data, size_t size)
2674 30640247 2007-02-22 reyk if (cre->bev == NULL)
2675 30640247 2007-02-22 reyk return (evbuffer_add(cre->output, data, size));
2676 30640247 2007-02-22 reyk return (bufferevent_write(cre->bev, data, size));
2680 7ba7514d 2007-09-10 reyk relay_cmp_af(struct sockaddr_storage *a, struct sockaddr_storage *b)
2682 185b85c3 2014-06-27 andre int ret = -1;
2683 185b85c3 2014-06-27 andre struct sockaddr_in ia, ib;
2684 185b85c3 2014-06-27 andre struct sockaddr_in6 ia6, ib6;
2686 7ba7514d 2007-09-10 reyk switch (a->ss_family) {
2687 7ba7514d 2007-09-10 reyk case AF_INET:
2688 7ba7514d 2007-09-10 reyk bcopy(a, &ia, sizeof(struct sockaddr_in));
2689 7ba7514d 2007-09-10 reyk bcopy(b, &ib, sizeof(struct sockaddr_in));
2691 b4608beb 2008-03-03 reyk ret = memcmp(&ia.sin_addr, &ib.sin_addr,
2692 b4608beb 2008-03-03 reyk sizeof(ia.sin_addr));
2693 b4608beb 2008-03-03 reyk if (ret == 0)
2694 b4608beb 2008-03-03 reyk ret = memcmp(&ia.sin_port, &ib.sin_port,
2695 b4608beb 2008-03-03 reyk sizeof(ia.sin_port));
2697 7ba7514d 2007-09-10 reyk case AF_INET6:
2698 7ba7514d 2007-09-10 reyk bcopy(a, &ia6, sizeof(struct sockaddr_in6));
2699 7ba7514d 2007-09-10 reyk bcopy(b, &ib6, sizeof(struct sockaddr_in6));
2701 b4608beb 2008-03-03 reyk ret = memcmp(&ia6.sin6_addr, &ib6.sin6_addr,
2702 b4608beb 2008-03-03 reyk sizeof(ia6.sin6_addr));
2703 b4608beb 2008-03-03 reyk if (ret == 0)
2704 b4608beb 2008-03-03 reyk ret = memcmp(&ia6.sin6_port, &ib6.sin6_port,
2705 b4608beb 2008-03-03 reyk sizeof(ia6.sin6_port));
2711 b4608beb 2008-03-03 reyk return (ret);
2715 61afd4d6 2009-08-07 reyk relay_session_cmp(struct rsession *a, struct rsession *b)
2717 6e65a975 2013-01-17 bluhm struct relay *rlay = b->se_relay;
2718 146643ba 2008-01-31 reyk struct protocol *proto = rlay->rl_proto;
2720 2595e192 2007-09-05 reyk if (proto != NULL && proto->cmp != NULL)
2721 3f22dc0a 2007-09-05 reyk return ((*proto->cmp)(a, b));
2723 aa79f3aa 2008-01-31 thib return ((int)a->se_id - b->se_id);
2727 c72024a8 2014-07-13 benno relay_log(struct rsession *con, char *msg)
2729 c72024a8 2014-07-13 benno if (con->se_haslog && con->se_log != NULL) {
2730 c72024a8 2014-07-13 benno evbuffer_add(con->se_log, msg, strlen(msg));
2734 61afd4d6 2009-08-07 reyk SPLAY_GENERATE(session_tree, rsession, se_nodes, relay_session_cmp);
