1 b62a1edf 2026-06-03 rsadowski /* $OpenBSD: relayd.c,v 1.199 2026/06/03 19:26:56 rsadowski Exp $ */
4 4a9b7b24 2016-07-29 reyk * Copyright (c) 2007 - 2016 Reyk Floeter <reyk@openbsd.org>
5 8c736326 2007-09-28 pyr * Copyright (c) 2006 Pierre-Yves Ritschard <pyr@openbsd.org>
7 41042ecc 2006-12-16 reyk * Permission to use, copy, modify, and distribute this software for any
8 41042ecc 2006-12-16 reyk * purpose with or without fee is hereby granted, provided that the above
9 41042ecc 2006-12-16 reyk * copyright notice and this permission notice appear in all copies.
11 41042ecc 2006-12-16 reyk * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 41042ecc 2006-12-16 reyk * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 41042ecc 2006-12-16 reyk * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 41042ecc 2006-12-16 reyk * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 41042ecc 2006-12-16 reyk * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 41042ecc 2006-12-16 reyk * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 41042ecc 2006-12-16 reyk * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 41042ecc 2006-12-16 reyk #include <sys/types.h>
21 41042ecc 2006-12-16 reyk #include <sys/queue.h>
22 41042ecc 2006-12-16 reyk #include <sys/socket.h>
23 55ca94a7 2019-05-29 reyk #include <sys/stat.h>
24 41042ecc 2006-12-16 reyk #include <sys/wait.h>
25 ea47f1c4 2010-11-30 reyk #include <sys/resource.h>
27 d8e9af71 2007-11-24 reyk #include <netinet/in.h>
28 d8e9af71 2007-11-24 reyk #include <arpa/inet.h>
30 f30efb9a 2025-01-30 martijn #include <agentx.h>
31 2f6ec04d 2015-01-16 deraadt #include <signal.h>
32 41042ecc 2006-12-16 reyk #include <string.h>
33 41042ecc 2006-12-16 reyk #include <stdio.h>
34 41042ecc 2006-12-16 reyk #include <stdlib.h>
35 591e6ab5 2011-05-19 reyk #include <fcntl.h>
36 41042ecc 2006-12-16 reyk #include <getopt.h>
37 2d9632ee 2014-07-11 reyk #include <fnmatch.h>
38 9787a4f4 2015-11-22 reyk #include <syslog.h>
39 41042ecc 2006-12-16 reyk #include <err.h>
40 41042ecc 2006-12-16 reyk #include <errno.h>
41 41042ecc 2006-12-16 reyk #include <event.h>
42 41042ecc 2006-12-16 reyk #include <unistd.h>
43 a580c7b6 2007-11-25 reyk #include <ctype.h>
44 41042ecc 2006-12-16 reyk #include <pwd.h>
45 8a025509 2007-11-21 reyk #include <sha1.h>
46 8a025509 2007-11-21 reyk #include <md5.h>
48 f4a6eef3 2017-05-27 claudio #include <tls.h>
50 6d0767ae 2007-12-07 reyk #include "relayd.h"
51 6b5c4000 2026-03-02 rsadowski #include "log.h"
53 2f6ec04d 2015-01-16 deraadt #define MAXIMUM(a, b) (((a) > (b)) ? (a) : (b))
55 41042ecc 2006-12-16 reyk __dead void usage(void);
57 591e6ab5 2011-05-19 reyk int parent_configure(struct relayd *);
58 996c1f22 2012-01-21 camield void parent_configure_done(struct relayd *);
59 591e6ab5 2011-05-19 reyk void parent_reload(struct relayd *, u_int, const char *);
60 dbef7d4f 2011-05-09 reyk void parent_sig_handler(int, short, void *);
61 dbef7d4f 2011-05-09 reyk void parent_shutdown(struct relayd *);
62 dbef7d4f 2011-05-09 reyk int parent_dispatch_pfe(int, struct privsep_proc *, struct imsg *);
63 dbef7d4f 2011-05-09 reyk int parent_dispatch_hce(int, struct privsep_proc *, struct imsg *);
64 ccf58482 2011-09-04 bluhm int parent_dispatch_relay(int, struct privsep_proc *,
65 ccf58482 2011-09-04 bluhm struct imsg *);
66 c525adb9 2014-04-18 reyk int parent_dispatch_ca(int, struct privsep_proc *,
67 c525adb9 2014-04-18 reyk struct imsg *);
68 6d5340e6 2008-06-11 reyk int bindany(struct ctl_bindany *);
69 e5c598d0 2016-09-01 claudio void parent_tls_ticket_rekey(int, short, void *);
71 591e6ab5 2011-05-19 reyk struct relayd *relayd_env;
73 dbef7d4f 2011-05-09 reyk static struct privsep_proc procs[] = {
74 dbef7d4f 2011-05-09 reyk { "pfe", PROC_PFE, parent_dispatch_pfe, pfe },
75 dbef7d4f 2011-05-09 reyk { "hce", PROC_HCE, parent_dispatch_hce, hce },
76 c525adb9 2014-04-18 reyk { "relay", PROC_RELAY, parent_dispatch_relay, relay },
77 c525adb9 2014-04-18 reyk { "ca", PROC_CA, parent_dispatch_ca, ca }
80 071bd662 2021-01-27 deraadt enum privsep_procid privsep_process;
83 dbef7d4f 2011-05-09 reyk parent_sig_handler(int sig, short event, void *arg)
85 dbef7d4f 2011-05-09 reyk struct privsep *ps = arg;
87 41042ecc 2006-12-16 reyk switch (sig) {
88 41042ecc 2006-12-16 reyk case SIGTERM:
89 41042ecc 2006-12-16 reyk case SIGINT:
90 94404df8 2016-09-02 reyk parent_shutdown(ps->ps_env);
92 41042ecc 2006-12-16 reyk case SIGHUP:
93 591e6ab5 2011-05-19 reyk log_info("%s: reload requested with SIGHUP", __func__);
96 591e6ab5 2011-05-19 reyk * This is safe because libevent uses async signal handlers
97 591e6ab5 2011-05-19 reyk * that run in the event loop and not in signal context.
99 591e6ab5 2011-05-19 reyk parent_reload(ps->ps_env, CONFIG_RELOAD, NULL);
101 f2ac441a 2010-05-14 reyk case SIGPIPE:
102 7629917f 2014-08-18 reyk case SIGUSR1:
103 f2ac441a 2010-05-14 reyk /* ignore */
106 41042ecc 2006-12-16 reyk fatalx("unexpected signal");
110 41042ecc 2006-12-16 reyk __dead void
111 41042ecc 2006-12-16 reyk usage(void)
113 41042ecc 2006-12-16 reyk extern char *__progname;
115 0c9515f6 2008-05-17 sobrado fprintf(stderr, "usage: %s [-dnv] [-D macro=value] [-f file]\n",
116 0c9515f6 2008-05-17 sobrado __progname);
121 39c45159 2006-12-25 reyk main(int argc, char *argv[])
124 591e6ab5 2011-05-19 reyk int debug = 0, verbose = 0;
125 591e6ab5 2011-05-19 reyk u_int32_t opts = 0;
126 6d0767ae 2007-12-07 reyk struct relayd *env;
127 dbef7d4f 2011-05-09 reyk struct privsep *ps;
128 591e6ab5 2011-05-19 reyk const char *conffile = CONF_FILE;
129 41ddf20a 2016-09-03 reyk enum privsep_procid proc_id = PROC_PARENT;
130 41ddf20a 2016-09-03 reyk int proc_instance = 0;
131 41ddf20a 2016-09-03 reyk const char *errp, *title = NULL;
132 41ddf20a 2016-09-03 reyk int argc0 = argc;
134 41ddf20a 2016-09-03 reyk while ((c = getopt(argc, argv, "dD:nI:P:f:v")) != -1) {
135 41042ecc 2006-12-16 reyk switch (c) {
140 aca4f638 2007-02-07 reyk if (cmdline_symset(optarg) < 0)
141 aca4f638 2007-02-07 reyk log_warnx("could not parse macro definition %s",
146 6d0767ae 2007-12-07 reyk opts |= RELAYD_OPT_NOACTION;
149 41042ecc 2006-12-16 reyk conffile = optarg;
153 6d0767ae 2007-12-07 reyk opts |= RELAYD_OPT_VERBOSE;
156 41ddf20a 2016-09-03 reyk title = optarg;
157 41ddf20a 2016-09-03 reyk proc_id = proc_getid(procs, nitems(procs), title);
158 41ddf20a 2016-09-03 reyk if (proc_id == PROC_MAX)
159 41ddf20a 2016-09-03 reyk fatalx("invalid process name");
162 41ddf20a 2016-09-03 reyk proc_instance = strtonum(optarg, 0,
163 41ddf20a 2016-09-03 reyk PROC_MAX_INSTANCES, &errp);
165 41ddf20a 2016-09-03 reyk fatalx("invalid process instance");
172 9787a4f4 2015-11-22 reyk /* log to stderr until daemonized */
173 9787a4f4 2015-11-22 reyk log_init(debug ? debug : 1, LOG_DAEMON);
175 ba0a5236 2008-05-12 pyr argc -= optind;
176 ba0a5236 2008-05-12 pyr if (argc > 0)
179 591e6ab5 2011-05-19 reyk if ((env = calloc(1, sizeof(*env))) == NULL ||
180 dbef7d4f 2011-05-09 reyk (ps = calloc(1, sizeof(*ps))) == NULL)
183 6d0767ae 2007-12-07 reyk relayd_env = env;
184 dbef7d4f 2011-05-09 reyk env->sc_ps = ps;
185 dbef7d4f 2011-05-09 reyk ps->ps_env = env;
186 fb3cc10c 2014-05-08 blambert TAILQ_INIT(&ps->ps_rcsocks);
187 591e6ab5 2011-05-19 reyk env->sc_conffile = conffile;
188 58fc320c 2016-09-02 reyk env->sc_conf.opts = opts;
189 28bd28ce 2014-11-19 blambert TAILQ_INIT(&env->sc_hosts);
190 28bd28ce 2014-11-19 blambert TAILQ_INIT(&env->sc_sessions);
191 3a342b20 2015-11-29 benno env->sc_rtable = getrtable();
192 e5c598d0 2016-09-01 claudio /* initialize the TLS session id to a random key for all relay procs */
193 58fc320c 2016-09-02 reyk arc4random_buf(env->sc_conf.tls_sid, sizeof(env->sc_conf.tls_sid));
195 591e6ab5 2011-05-19 reyk if (parse_config(env->sc_conffile, env) == -1)
199 58fc320c 2016-09-02 reyk env->sc_conf.opts |= RELAYD_OPT_LOGUPDATE;
201 41042ecc 2006-12-16 reyk if (geteuid())
202 41042ecc 2006-12-16 reyk errx(1, "need root privileges");
204 dbef7d4f 2011-05-09 reyk if ((ps->ps_pw = getpwnam(RELAYD_USER)) == NULL)
205 6d0767ae 2007-12-07 reyk errx(1, "unknown user %s", RELAYD_USER);
207 9787a4f4 2015-11-22 reyk log_init(debug, LOG_DAEMON);
208 afbe8d84 2017-01-09 reyk log_setverbose(verbose);
210 58fc320c 2016-09-02 reyk if (env->sc_conf.opts & RELAYD_OPT_NOACTION)
211 591e6ab5 2011-05-19 reyk ps->ps_noaction = 1;
213 58fc320c 2016-09-02 reyk ps->ps_instances[PROC_RELAY] = env->sc_conf.prefork_relay;
214 58fc320c 2016-09-02 reyk ps->ps_instances[PROC_CA] = env->sc_conf.prefork_relay;
215 41ddf20a 2016-09-03 reyk ps->ps_instance = proc_instance;
216 41ddf20a 2016-09-03 reyk if (title != NULL)
217 41ddf20a 2016-09-03 reyk ps->ps_title[proc_id] = title;
219 41ddf20a 2016-09-03 reyk /* only the parent returns */
220 1c66e337 2018-09-09 bluhm proc_init(ps, procs, nitems(procs), debug, argc0, argv, proc_id);
222 9787a4f4 2015-11-22 reyk log_procinit("parent");
224 41ddf20a 2016-09-03 reyk if (ps->ps_noaction == 0)
225 41ddf20a 2016-09-03 reyk log_info("startup");
227 5f37963a 2020-08-19 mestre if (unveil("/", "rx") == -1)
228 74ad078b 2021-07-12 beck err(1, "unveil /");
229 f30efb9a 2025-01-30 martijn if (env->sc_conf.flags & F_AGENTX) {
230 f30efb9a 2025-01-30 martijn if (unveil(env->sc_conf.agentx_path, "w") == -1)
231 f30efb9a 2025-01-30 martijn err(1, "unveil %s", env->sc_conf.agentx_path);
232 f30efb9a 2025-01-30 martijn } else {
233 f30efb9a 2025-01-30 martijn if (unveil(AGENTX_MASTER_PATH, "w") == -1)
234 f30efb9a 2025-01-30 martijn err(1, "unveil %s", env->sc_conf.agentx_path);
236 5f37963a 2020-08-19 mestre if (unveil(NULL, NULL) == -1)
237 5f37963a 2020-08-19 mestre err(1, "unveil");
239 41042ecc 2006-12-16 reyk event_init();
241 dbef7d4f 2011-05-09 reyk signal_set(&ps->ps_evsigint, SIGINT, parent_sig_handler, ps);
242 dbef7d4f 2011-05-09 reyk signal_set(&ps->ps_evsigterm, SIGTERM, parent_sig_handler, ps);
243 dbef7d4f 2011-05-09 reyk signal_set(&ps->ps_evsighup, SIGHUP, parent_sig_handler, ps);
244 dbef7d4f 2011-05-09 reyk signal_set(&ps->ps_evsigpipe, SIGPIPE, parent_sig_handler, ps);
245 7629917f 2014-08-18 reyk signal_set(&ps->ps_evsigusr1, SIGUSR1, parent_sig_handler, ps);
247 dbef7d4f 2011-05-09 reyk signal_add(&ps->ps_evsigint, NULL);
248 dbef7d4f 2011-05-09 reyk signal_add(&ps->ps_evsigterm, NULL);
249 dbef7d4f 2011-05-09 reyk signal_add(&ps->ps_evsighup, NULL);
250 dbef7d4f 2011-05-09 reyk signal_add(&ps->ps_evsigpipe, NULL);
251 7629917f 2014-08-18 reyk signal_add(&ps->ps_evsigusr1, NULL);
253 41ddf20a 2016-09-03 reyk proc_connect(ps);
255 53e2da5b 2016-09-27 bluhm relay_http(NULL);
256 591e6ab5 2011-05-19 reyk if (load_config(env->sc_conffile, env) == -1) {
257 591e6ab5 2011-05-19 reyk proc_kill(env->sc_ps);
261 58fc320c 2016-09-02 reyk if (env->sc_conf.opts & RELAYD_OPT_NOACTION) {
262 591e6ab5 2011-05-19 reyk fprintf(stderr, "configuration OK\n");
263 591e6ab5 2011-05-19 reyk proc_kill(env->sc_ps);
267 e5c598d0 2016-09-01 claudio /* rekey the TLS tickets before pushing the config */
268 e5c598d0 2016-09-01 claudio parent_tls_ticket_rekey(0, 0, env);
269 591e6ab5 2011-05-19 reyk if (parent_configure(env) == -1)
270 591e6ab5 2011-05-19 reyk fatalx("configuration failed");
272 39bc6125 2009-08-13 reyk init_routes(env);
274 41042ecc 2006-12-16 reyk event_dispatch();
276 dbef7d4f 2011-05-09 reyk parent_shutdown(env);
277 25080928 2010-02-17 jsg /* NOTREACHED */
279 41042ecc 2006-12-16 reyk return (0);
283 591e6ab5 2011-05-19 reyk parent_configure(struct relayd *env)
285 591e6ab5 2011-05-19 reyk struct table *tb;
286 591e6ab5 2011-05-19 reyk struct rdr *rdr;
287 591e6ab5 2011-05-19 reyk struct router *rt;
288 591e6ab5 2011-05-19 reyk struct protocol *proto;
289 591e6ab5 2011-05-19 reyk struct relay *rlay;
291 73162055 2017-01-24 benno int ret = -1;
293 591e6ab5 2011-05-19 reyk TAILQ_FOREACH(tb, env->sc_tables, entry)
294 591e6ab5 2011-05-19 reyk config_settable(env, tb);
295 591e6ab5 2011-05-19 reyk TAILQ_FOREACH(rdr, env->sc_rdrs, entry)
296 591e6ab5 2011-05-19 reyk config_setrdr(env, rdr);
297 591e6ab5 2011-05-19 reyk TAILQ_FOREACH(rt, env->sc_rts, rt_entry)
298 591e6ab5 2011-05-19 reyk config_setrt(env, rt);
299 591e6ab5 2011-05-19 reyk TAILQ_FOREACH(proto, env->sc_protos, entry)
300 591e6ab5 2011-05-19 reyk config_setproto(env, proto);
301 69fde657 2014-07-09 reyk TAILQ_FOREACH(proto, env->sc_protos, entry)
302 69fde657 2014-07-09 reyk config_setrule(env, proto);
303 03668b6b 2013-05-30 reyk TAILQ_FOREACH(rlay, env->sc_relays, rl_entry) {
304 096ff28b 2014-12-12 reyk /* Check for TLS Inspection */
305 096ff28b 2014-12-12 reyk if ((rlay->rl_conf.flags & (F_TLS|F_TLSCLIENT)) ==
306 ce78c3f2 2017-11-27 claudio (F_TLS|F_TLSCLIENT) && rlay->rl_tls_cacert_fd != -1)
307 096ff28b 2014-12-12 reyk rlay->rl_conf.flags |= F_TLSINSPECT;
309 591e6ab5 2011-05-19 reyk config_setrelay(env, rlay);
312 c525adb9 2014-04-18 reyk /* HCE, PFE, CA and the relays need to reload their config. */
313 58fc320c 2016-09-02 reyk env->sc_reload = 2 + (2 * env->sc_conf.prefork_relay);
315 591e6ab5 2011-05-19 reyk for (id = 0; id < PROC_MAX; id++) {
316 591e6ab5 2011-05-19 reyk if (id == privsep_process)
318 141b9058 2015-12-02 reyk proc_compose_imsg(env->sc_ps, id, -1, IMSG_CFG_DONE, -1,
319 73162055 2017-01-24 benno -1, &env->sc_conf, sizeof(env->sc_conf));
324 c525adb9 2014-04-18 reyk config_purge(env, CONFIG_ALL & ~CONFIG_RELAYS);
325 591e6ab5 2011-05-19 reyk return (ret);
329 591e6ab5 2011-05-19 reyk parent_reload(struct relayd *env, u_int reset, const char *filename)
331 591e6ab5 2011-05-19 reyk if (env->sc_reload) {
332 591e6ab5 2011-05-19 reyk log_debug("%s: already in progress: %d pending",
333 591e6ab5 2011-05-19 reyk __func__, env->sc_reload);
337 591e6ab5 2011-05-19 reyk /* Switch back to the default config file */
338 591e6ab5 2011-05-19 reyk if (filename == NULL || *filename == '\0')
339 591e6ab5 2011-05-19 reyk filename = env->sc_conffile;
341 591e6ab5 2011-05-19 reyk log_debug("%s: level %d config file %s", __func__, reset, filename);
343 591e6ab5 2011-05-19 reyk config_purge(env, CONFIG_ALL);
345 591e6ab5 2011-05-19 reyk if (reset == CONFIG_RELOAD) {
346 591e6ab5 2011-05-19 reyk if (load_config(filename, env) == -1) {
347 591e6ab5 2011-05-19 reyk log_debug("%s: failed to load config file %s",
348 591e6ab5 2011-05-19 reyk __func__, filename);
351 591e6ab5 2011-05-19 reyk config_setreset(env, CONFIG_ALL);
353 591e6ab5 2011-05-19 reyk if (parent_configure(env) == -1) {
354 591e6ab5 2011-05-19 reyk log_debug("%s: failed to commit config from %s",
355 591e6ab5 2011-05-19 reyk __func__, filename);
358 591e6ab5 2011-05-19 reyk config_setreset(env, reset);
362 996c1f22 2012-01-21 camield parent_configure_done(struct relayd *env)
366 996c1f22 2012-01-21 camield if (env->sc_reload == 0) {
367 996c1f22 2012-01-21 camield log_warnx("%s: configuration already finished", __func__);
371 996c1f22 2012-01-21 camield env->sc_reload--;
372 996c1f22 2012-01-21 camield if (env->sc_reload == 0) {
373 996c1f22 2012-01-21 camield for (id = 0; id < PROC_MAX; id++) {
374 996c1f22 2012-01-21 camield if (id == privsep_process)
375 996c1f22 2012-01-21 camield continue;
377 141b9058 2015-12-02 reyk proc_compose(env->sc_ps, id, IMSG_CTL_START, NULL, 0);
383 dbef7d4f 2011-05-09 reyk parent_shutdown(struct relayd *env)
385 591e6ab5 2011-05-19 reyk config_purge(env, CONFIG_ALL);
387 dbef7d4f 2011-05-09 reyk proc_kill(env->sc_ps);
388 dbef7d4f 2011-05-09 reyk control_cleanup(&env->sc_ps->ps_csock);
389 30640247 2007-02-22 reyk carp_demote_shutdown();
391 dbef7d4f 2011-05-09 reyk free(env->sc_ps);
394 dbef7d4f 2011-05-09 reyk log_info("parent terminating, pid %d", getpid());
400 dbef7d4f 2011-05-09 reyk parent_dispatch_pfe(int fd, struct privsep_proc *p, struct imsg *imsg)
402 87e4c32e 2016-09-28 reyk struct privsep *ps = p->p_ps;
403 87e4c32e 2016-09-28 reyk struct relayd *env = ps->ps_env;
404 30640247 2007-02-22 reyk struct ctl_demote demote;
405 39bc6125 2009-08-13 reyk struct ctl_netroute crt;
407 591e6ab5 2011-05-19 reyk char *str = NULL;
409 dbef7d4f 2011-05-09 reyk switch (imsg->hdr.type) {
410 dbef7d4f 2011-05-09 reyk case IMSG_DEMOTE:
411 dbef7d4f 2011-05-09 reyk IMSG_SIZE_CHECK(imsg, &demote);
412 dbef7d4f 2011-05-09 reyk memcpy(&demote, imsg->data, sizeof(demote));
413 21645604 2025-04-24 claudio demote.group[sizeof(demote.group) - 1] = '\0';
414 dbef7d4f 2011-05-09 reyk carp_demote_set(demote.group, demote.level);
416 dbef7d4f 2011-05-09 reyk case IMSG_RTMSG:
417 dbef7d4f 2011-05-09 reyk IMSG_SIZE_CHECK(imsg, &crt);
418 dbef7d4f 2011-05-09 reyk memcpy(&crt, imsg->data, sizeof(crt));
419 21645604 2025-04-24 claudio crt.host.name[sizeof(crt.host.name) - 1] = '\0';
420 21645604 2025-04-24 claudio crt.rt.name[sizeof(crt.rt.name) - 1] = '\0';
421 21645604 2025-04-24 claudio crt.rt.label[sizeof(crt.rt.label) - 1] = '\0';
422 dbef7d4f 2011-05-09 reyk pfe_route(env, &crt);
424 591e6ab5 2011-05-19 reyk case IMSG_CTL_RESET:
425 591e6ab5 2011-05-19 reyk IMSG_SIZE_CHECK(imsg, &v);
426 591e6ab5 2011-05-19 reyk memcpy(&v, imsg->data, sizeof(v));
427 591e6ab5 2011-05-19 reyk parent_reload(env, v, NULL);
429 dbef7d4f 2011-05-09 reyk case IMSG_CTL_RELOAD:
430 591e6ab5 2011-05-19 reyk if (IMSG_DATA_SIZE(imsg) > 0)
431 591e6ab5 2011-05-19 reyk str = get_string(imsg->data, IMSG_DATA_SIZE(imsg));
432 591e6ab5 2011-05-19 reyk parent_reload(env, CONFIG_RELOAD, str);
435 591e6ab5 2011-05-19 reyk case IMSG_CTL_SHUTDOWN:
436 591e6ab5 2011-05-19 reyk parent_shutdown(env);
438 591e6ab5 2011-05-19 reyk case IMSG_CFG_DONE:
439 996c1f22 2012-01-21 camield parent_configure_done(env);
441 04a2f953 2020-09-14 martijn case IMSG_AGENTXSOCK:
442 6d9ea5e7 2022-08-31 dv agentx_setsock(env, p->p_id);
445 dbef7d4f 2011-05-09 reyk return (-1);
448 dbef7d4f 2011-05-09 reyk return (0);
452 dbef7d4f 2011-05-09 reyk parent_dispatch_hce(int fd, struct privsep_proc *p, struct imsg *imsg)
454 87e4c32e 2016-09-28 reyk struct privsep *ps = p->p_ps;
455 87e4c32e 2016-09-28 reyk struct relayd *env = ps->ps_env;
456 292100ef 2007-05-29 reyk struct ctl_script scr;
458 dbef7d4f 2011-05-09 reyk switch (imsg->hdr.type) {
459 dbef7d4f 2011-05-09 reyk case IMSG_SCRIPT:
460 dbef7d4f 2011-05-09 reyk IMSG_SIZE_CHECK(imsg, &scr);
461 dbef7d4f 2011-05-09 reyk bcopy(imsg->data, &scr, sizeof(scr));
462 21645604 2025-04-24 claudio scr.name[sizeof(scr.name) - 1] = '\0';
463 21645604 2025-04-24 claudio scr.path[sizeof(scr.path) - 1] = '\0';
464 dbef7d4f 2011-05-09 reyk scr.retval = script_exec(env, &scr);
465 141b9058 2015-12-02 reyk proc_compose(ps, PROC_HCE, IMSG_SCRIPT, &scr, sizeof(scr));
467 591e6ab5 2011-05-19 reyk case IMSG_CFG_DONE:
468 996c1f22 2012-01-21 camield parent_configure_done(env);
471 dbef7d4f 2011-05-09 reyk return (-1);
474 dbef7d4f 2011-05-09 reyk return (0);
478 dbef7d4f 2011-05-09 reyk parent_dispatch_relay(int fd, struct privsep_proc *p, struct imsg *imsg)
480 87e4c32e 2016-09-28 reyk struct privsep *ps = p->p_ps;
481 87e4c32e 2016-09-28 reyk struct relayd *env = ps->ps_env;
482 6d5340e6 2008-06-11 reyk struct ctl_bindany bnd;
485 dbef7d4f 2011-05-09 reyk switch (imsg->hdr.type) {
486 dbef7d4f 2011-05-09 reyk case IMSG_BINDANY:
487 dbef7d4f 2011-05-09 reyk IMSG_SIZE_CHECK(imsg, &bnd);
488 dbef7d4f 2011-05-09 reyk bcopy(imsg->data, &bnd, sizeof(bnd));
489 37603cbd 2025-08-01 deraadt if (bnd.bnd_proc < 0 || bnd.bnd_proc > env->sc_conf.prefork_relay)
490 09e53fee 2017-05-28 benno fatalx("%s: invalid relay proc", __func__);
491 dbef7d4f 2011-05-09 reyk switch (bnd.bnd_proto) {
492 dbef7d4f 2011-05-09 reyk case IPPROTO_TCP:
493 dbef7d4f 2011-05-09 reyk case IPPROTO_UDP:
496 09e53fee 2017-05-28 benno fatalx("%s: requested socket "
497 09e53fee 2017-05-28 benno "for invalid protocol", __func__);
498 dbef7d4f 2011-05-09 reyk /* NOTREACHED */
500 dbef7d4f 2011-05-09 reyk s = bindany(&bnd);
501 dbef7d4f 2011-05-09 reyk proc_compose_imsg(ps, PROC_RELAY, bnd.bnd_proc,
502 141b9058 2015-12-02 reyk IMSG_BINDANY, -1, s, &bnd.bnd_id, sizeof(bnd.bnd_id));
504 591e6ab5 2011-05-19 reyk case IMSG_CFG_DONE:
505 996c1f22 2012-01-21 camield parent_configure_done(env);
508 dbef7d4f 2011-05-09 reyk return (-1);
511 dbef7d4f 2011-05-09 reyk return (0);
515 c525adb9 2014-04-18 reyk parent_dispatch_ca(int fd, struct privsep_proc *p, struct imsg *imsg)
517 87e4c32e 2016-09-28 reyk struct privsep *ps = p->p_ps;
518 87e4c32e 2016-09-28 reyk struct relayd *env = ps->ps_env;
520 c525adb9 2014-04-18 reyk switch (imsg->hdr.type) {
521 c525adb9 2014-04-18 reyk case IMSG_CFG_DONE:
522 c525adb9 2014-04-18 reyk parent_configure_done(env);
525 c525adb9 2014-04-18 reyk return (-1);
528 c525adb9 2014-04-18 reyk return (0);
532 2f479274 2015-05-02 claudio purge_table(struct relayd *env, struct tablelist *head, struct table *table)
534 591e6ab5 2011-05-19 reyk struct host *host;
536 591e6ab5 2011-05-19 reyk while ((host = TAILQ_FIRST(&table->hosts)) != NULL) {
537 591e6ab5 2011-05-19 reyk TAILQ_REMOVE(&table->hosts, host, entry);
538 2f479274 2015-05-02 claudio TAILQ_REMOVE(&env->sc_hosts, host, globalentry);
539 591e6ab5 2011-05-19 reyk if (event_initialized(&host->cte.ev)) {
540 591e6ab5 2011-05-19 reyk event_del(&host->cte.ev);
541 591e6ab5 2011-05-19 reyk close(host->cte.s);
543 d3d5a154 2015-12-30 benno ibuf_free(host->cte.buf);
544 f4a6eef3 2017-05-27 claudio tls_free(host->cte.tls);
545 591e6ab5 2011-05-19 reyk free(host);
547 ba24b6a0 2015-12-07 mmcc free(table->sendbuf);
548 738b3cc9 2019-09-15 rob ibuf_free(table->sendbinbuf);
549 f4a6eef3 2017-05-27 claudio tls_config_free(table->tls_cfg);
551 591e6ab5 2011-05-19 reyk if (head != NULL)
552 591e6ab5 2011-05-19 reyk TAILQ_REMOVE(head, table, entry);
553 591e6ab5 2011-05-19 reyk free(table);
557 d00c9f4e 2017-05-06 fcambus purge_key(char **key, off_t len)
559 d00c9f4e 2017-05-06 fcambus freezero(*key, len);
561 d00c9f4e 2017-05-06 fcambus *key = NULL;
565 591e6ab5 2011-05-19 reyk purge_relay(struct relayd *env, struct relay *rlay)
567 591e6ab5 2011-05-19 reyk struct rsession *con;
568 0f7a5e2e 2012-10-03 reyk struct relay_table *rlt;
569 fe4913ec 2019-05-31 reyk struct relay_cert *cert, *tmpcert;
571 591e6ab5 2011-05-19 reyk /* shutdown and remove relay */
572 591e6ab5 2011-05-19 reyk if (event_initialized(&rlay->rl_ev))
573 591e6ab5 2011-05-19 reyk event_del(&rlay->rl_ev);
574 591e6ab5 2011-05-19 reyk close(rlay->rl_s);
575 591e6ab5 2011-05-19 reyk TAILQ_REMOVE(env->sc_relays, rlay, rl_entry);
577 591e6ab5 2011-05-19 reyk /* cleanup sessions */
578 591e6ab5 2011-05-19 reyk while ((con =
579 591e6ab5 2011-05-19 reyk SPLAY_ROOT(&rlay->rl_sessions)) != NULL)
580 37ed6014 2018-08-06 benno relay_close(con, NULL, 0);
582 591e6ab5 2011-05-19 reyk /* cleanup relay */
583 591e6ab5 2011-05-19 reyk if (rlay->rl_bev != NULL)
584 591e6ab5 2011-05-19 reyk bufferevent_free(rlay->rl_bev);
585 591e6ab5 2011-05-19 reyk if (rlay->rl_dstbev != NULL)
586 591e6ab5 2011-05-19 reyk bufferevent_free(rlay->rl_dstbev);
588 096ff28b 2014-12-12 reyk purge_key(&rlay->rl_tls_cakey, rlay->rl_conf.tls_cakey_len);
590 096ff28b 2014-12-12 reyk if (rlay->rl_tls_pkey != NULL) {
591 096ff28b 2014-12-12 reyk EVP_PKEY_free(rlay->rl_tls_pkey);
592 096ff28b 2014-12-12 reyk rlay->rl_tls_pkey = NULL;
594 096ff28b 2014-12-12 reyk if (rlay->rl_tls_cacertx509 != NULL) {
595 096ff28b 2014-12-12 reyk X509_free(rlay->rl_tls_cacertx509);
596 096ff28b 2014-12-12 reyk rlay->rl_tls_cacertx509 = NULL;
598 096ff28b 2014-12-12 reyk if (rlay->rl_tls_capkey != NULL) {
599 096ff28b 2014-12-12 reyk EVP_PKEY_free(rlay->rl_tls_capkey);
600 096ff28b 2014-12-12 reyk rlay->rl_tls_capkey = NULL;
603 f4a6eef3 2017-05-27 claudio tls_free(rlay->rl_tls_ctx);
604 f4a6eef3 2017-05-27 claudio tls_config_free(rlay->rl_tls_cfg);
605 f4a6eef3 2017-05-27 claudio tls_config_free(rlay->rl_tls_client_cfg);
607 0f7a5e2e 2012-10-03 reyk while ((rlt = TAILQ_FIRST(&rlay->rl_tables))) {
608 0f7a5e2e 2012-10-03 reyk TAILQ_REMOVE(&rlay->rl_tables, rlt, rlt_entry);
612 fe4913ec 2019-05-31 reyk TAILQ_FOREACH_SAFE(cert, env->sc_certs, cert_entry, tmpcert) {
613 fe4913ec 2019-05-31 reyk if (rlay->rl_conf.id != cert->cert_relayid)
615 fe4913ec 2019-05-31 reyk if (cert->cert_fd != -1)
616 fe4913ec 2019-05-31 reyk close(cert->cert_fd);
617 fe4913ec 2019-05-31 reyk if (cert->cert_key_fd != -1)
618 fe4913ec 2019-05-31 reyk close(cert->cert_key_fd);
619 0c91187d 2019-06-26 reyk if (cert->cert_ocsp_fd != -1)
620 0c91187d 2019-06-26 reyk close(cert->cert_ocsp_fd);
621 fe4913ec 2019-05-31 reyk if (cert->cert_pkey != NULL)
622 fe4913ec 2019-05-31 reyk EVP_PKEY_free(cert->cert_pkey);
623 fe4913ec 2019-05-31 reyk TAILQ_REMOVE(env->sc_certs, cert, cert_entry);
624 fe4913ec 2019-05-31 reyk free(cert);
627 591e6ab5 2011-05-19 reyk free(rlay);
630 69fde657 2014-07-09 reyk struct kv *
631 4e975be3 2016-07-27 reyk kv_add(struct kvtree *keys, char *key, char *value, int unique)
633 2d9632ee 2014-07-11 reyk struct kv *kv, *oldkv;
635 69fde657 2014-07-09 reyk if (key == NULL)
636 69fde657 2014-07-09 reyk return (NULL);
637 69fde657 2014-07-09 reyk if ((kv = calloc(1, sizeof(*kv))) == NULL)
638 69fde657 2014-07-09 reyk return (NULL);
639 4e975be3 2016-07-27 reyk if ((kv->kv_key = strdup(key)) == NULL)
641 69fde657 2014-07-09 reyk if (value != NULL &&
642 4e975be3 2016-07-27 reyk (kv->kv_value = strdup(value)) == NULL)
644 2d9632ee 2014-07-11 reyk TAILQ_INIT(&kv->kv_children);
646 2d9632ee 2014-07-11 reyk if ((oldkv = RB_INSERT(kvtree, keys, kv)) != NULL) {
648 4e975be3 2016-07-27 reyk * return error if the key should occur only once,
649 4e975be3 2016-07-27 reyk * or add it to a list attached to the key's node.
651 4e975be3 2016-07-27 reyk if (unique)
653 2d9632ee 2014-07-11 reyk TAILQ_INSERT_TAIL(&oldkv->kv_children, kv, kv_entry);
654 2d9632ee 2014-07-11 reyk kv->kv_parent = oldkv;
657 69fde657 2014-07-09 reyk return (kv);
659 4e975be3 2016-07-27 reyk free(kv->kv_key);
660 4e975be3 2016-07-27 reyk free(kv->kv_value);
662 4e975be3 2016-07-27 reyk return (NULL);
666 69fde657 2014-07-09 reyk kv_set(struct kv *kv, char *fmt, ...)
668 2d9632ee 2014-07-11 reyk va_list ap;
669 2d9632ee 2014-07-11 reyk char *value = NULL;
670 2d9632ee 2014-07-11 reyk struct kv *ckv;
673 69fde657 2014-07-09 reyk va_start(ap, fmt);
674 e3222bf9 2022-11-10 mbuhl ret = vasprintf(&value, fmt, ap);
675 69fde657 2014-07-09 reyk va_end(ap);
676 e3222bf9 2022-11-10 mbuhl if (ret == -1)
677 e3222bf9 2022-11-10 mbuhl return (-1);
679 2d9632ee 2014-07-11 reyk /* Remove all children */
680 2d9632ee 2014-07-11 reyk while ((ckv = TAILQ_FIRST(&kv->kv_children)) != NULL) {
681 2d9632ee 2014-07-11 reyk TAILQ_REMOVE(&kv->kv_children, ckv, kv_entry);
682 2d9632ee 2014-07-11 reyk kv_free(ckv);
686 2d9632ee 2014-07-11 reyk /* Set the new value */
687 ba24b6a0 2015-12-07 mmcc free(kv->kv_value);
688 69fde657 2014-07-09 reyk kv->kv_value = value;
690 69fde657 2014-07-09 reyk return (0);
694 69fde657 2014-07-09 reyk kv_setkey(struct kv *kv, char *fmt, ...)
696 69fde657 2014-07-09 reyk va_list ap;
697 69fde657 2014-07-09 reyk char *key = NULL;
700 69fde657 2014-07-09 reyk va_start(ap, fmt);
701 e3222bf9 2022-11-10 mbuhl ret = vasprintf(&key, fmt, ap);
702 69fde657 2014-07-09 reyk va_end(ap);
703 e3222bf9 2022-11-10 mbuhl if (ret == -1)
704 e3222bf9 2022-11-10 mbuhl return (-1);
706 ba24b6a0 2015-12-07 mmcc free(kv->kv_key);
707 69fde657 2014-07-09 reyk kv->kv_key = key;
709 69fde657 2014-07-09 reyk return (0);
713 2d9632ee 2014-07-11 reyk kv_delete(struct kvtree *keys, struct kv *kv)
715 2d9632ee 2014-07-11 reyk struct kv *ckv;
717 2d9632ee 2014-07-11 reyk RB_REMOVE(kvtree, keys, kv);
719 2d9632ee 2014-07-11 reyk /* Remove all children */
720 2d9632ee 2014-07-11 reyk while ((ckv = TAILQ_FIRST(&kv->kv_children)) != NULL) {
721 2d9632ee 2014-07-11 reyk TAILQ_REMOVE(&kv->kv_children, ckv, kv_entry);
722 2d9632ee 2014-07-11 reyk kv_free(ckv);
726 69fde657 2014-07-09 reyk kv_free(kv);
731 2d9632ee 2014-07-11 reyk kv_purge(struct kvtree *keys)
733 69fde657 2014-07-09 reyk struct kv *kv;
735 2d9632ee 2014-07-11 reyk while ((kv = RB_MIN(kvtree, keys)) != NULL)
736 69fde657 2014-07-09 reyk kv_delete(keys, kv);
740 69fde657 2014-07-09 reyk kv_free(struct kv *kv)
743 c1f04885 2015-05-30 claudio * This function does not clear memory referenced by
744 c1f04885 2015-05-30 claudio * kv_children or stuff on the tailqs. Use kv_delete() instead.
747 c1f04885 2015-05-30 claudio free(kv->kv_key);
748 c1f04885 2015-05-30 claudio free(kv->kv_value);
749 69fde657 2014-07-09 reyk memset(kv, 0, sizeof(*kv));
752 69fde657 2014-07-09 reyk struct kv *
753 69fde657 2014-07-09 reyk kv_inherit(struct kv *dst, struct kv *src)
755 69fde657 2014-07-09 reyk memset(dst, 0, sizeof(*dst));
756 69fde657 2014-07-09 reyk memcpy(dst, src, sizeof(*dst));
757 2d9632ee 2014-07-11 reyk TAILQ_INIT(&dst->kv_children);
759 69fde657 2014-07-09 reyk if (src->kv_key != NULL) {
760 69fde657 2014-07-09 reyk if ((dst->kv_key = strdup(src->kv_key)) == NULL) {
761 69fde657 2014-07-09 reyk kv_free(dst);
762 69fde657 2014-07-09 reyk return (NULL);
765 69fde657 2014-07-09 reyk if (src->kv_value != NULL) {
766 69fde657 2014-07-09 reyk if ((dst->kv_value = strdup(src->kv_value)) == NULL) {
767 69fde657 2014-07-09 reyk kv_free(dst);
768 69fde657 2014-07-09 reyk return (NULL);
772 69fde657 2014-07-09 reyk if (src->kv_match != NULL)
773 69fde657 2014-07-09 reyk dst->kv_match = src->kv_match;
774 2d9632ee 2014-07-11 reyk if (src->kv_matchtree != NULL)
775 2d9632ee 2014-07-11 reyk dst->kv_matchtree = src->kv_matchtree;
777 69fde657 2014-07-09 reyk return (dst);
781 c72024a8 2014-07-13 benno kv_log(struct rsession *con, struct kv *kv, u_int16_t labelid,
782 c72024a8 2014-07-13 benno enum direction dir)
786 c72024a8 2014-07-13 benno if (con->se_log == NULL)
787 69fde657 2014-07-09 reyk return (0);
788 c72024a8 2014-07-13 benno if (asprintf(&msg, " %s%s%s%s%s%s%s",
789 c72024a8 2014-07-13 benno dir == RELAY_DIR_REQUEST ? "[" : "{",
790 69fde657 2014-07-09 reyk labelid == 0 ? "" : label_id2name(labelid),
791 69fde657 2014-07-09 reyk labelid == 0 ? "" : ", ",
792 69fde657 2014-07-09 reyk kv->kv_key == NULL ? "(unknown)" : kv->kv_key,
793 69fde657 2014-07-09 reyk kv->kv_value == NULL ? "" : ": ",
794 c72024a8 2014-07-13 benno kv->kv_value == NULL ? "" : kv->kv_value,
795 c72024a8 2014-07-13 benno dir == RELAY_DIR_REQUEST ? "]" : "}") == -1)
796 69fde657 2014-07-09 reyk return (-1);
797 c72024a8 2014-07-13 benno if (evbuffer_add(con->se_log, msg, strlen(msg)) == -1) {
799 69fde657 2014-07-09 reyk return (-1);
802 c72024a8 2014-07-13 benno con->se_haslog = 1;
803 69fde657 2014-07-09 reyk return (0);
806 2d9632ee 2014-07-11 reyk struct kv *
807 2d9632ee 2014-07-11 reyk kv_find(struct kvtree *keys, struct kv *kv)
809 2d9632ee 2014-07-11 reyk struct kv *match;
810 2d9632ee 2014-07-11 reyk const char *key;
812 2d9632ee 2014-07-11 reyk if (kv->kv_flags & KV_FLAG_GLOBBING) {
813 2d9632ee 2014-07-11 reyk /* Test header key using shell globbing rules */
814 2d9632ee 2014-07-11 reyk key = kv->kv_key == NULL ? "" : kv->kv_key;
815 2d9632ee 2014-07-11 reyk RB_FOREACH(match, kvtree, keys) {
816 2d9632ee 2014-07-11 reyk if (fnmatch(key, match->kv_key, FNM_CASEFOLD) == 0)
820 2d9632ee 2014-07-11 reyk /* Fast tree-based lookup only works without globbing */
821 2d9632ee 2014-07-11 reyk match = RB_FIND(kvtree, keys, kv);
824 2d9632ee 2014-07-11 reyk return (match);
827 62ee3f1b 2019-05-08 reyk struct kv *
828 62ee3f1b 2019-05-08 reyk kv_find_value(struct kvtree *keys, char *key, const char *value,
829 62ee3f1b 2019-05-08 reyk const char *delim)
831 62ee3f1b 2019-05-08 reyk struct kv *match, kv;
832 62ee3f1b 2019-05-08 reyk char *val = NULL, *next, *ptr;
833 62ee3f1b 2019-05-08 reyk size_t len;
835 62ee3f1b 2019-05-08 reyk kv.kv_key = key;
836 62ee3f1b 2019-05-08 reyk if ((match = RB_FIND(kvtree, keys, &kv)) == NULL)
837 62ee3f1b 2019-05-08 reyk return (NULL);
839 62ee3f1b 2019-05-08 reyk if (match->kv_value == NULL)
840 62ee3f1b 2019-05-08 reyk return (NULL);
842 62ee3f1b 2019-05-08 reyk if (delim == NULL) {
843 62ee3f1b 2019-05-08 reyk if (strcasecmp(match->kv_value, value) == 0)
846 62ee3f1b 2019-05-08 reyk if ((val = strdup(match->kv_value)) == NULL)
847 62ee3f1b 2019-05-08 reyk return (NULL);
848 62ee3f1b 2019-05-08 reyk for (next = ptr = val; ptr != NULL;
849 62ee3f1b 2019-05-08 reyk ptr = strsep(&next, delim)) {
850 62ee3f1b 2019-05-08 reyk /* strip whitespace */
851 62ee3f1b 2019-05-08 reyk ptr += strspn(ptr, " \t");
852 62ee3f1b 2019-05-08 reyk len = strcspn(ptr, " \t");
853 62ee3f1b 2019-05-08 reyk if (strncasecmp(ptr, value, len) == 0)
858 62ee3f1b 2019-05-08 reyk /* not matched */
859 62ee3f1b 2019-05-08 reyk match = NULL;
861 62ee3f1b 2019-05-08 reyk #ifdef DEBUG
862 62ee3f1b 2019-05-08 reyk if (match != NULL)
863 62ee3f1b 2019-05-08 reyk DPRINTF("%s: matched %s: %s", __func__, key, value);
866 62ee3f1b 2019-05-08 reyk return (match);
870 2d9632ee 2014-07-11 reyk kv_cmp(struct kv *a, struct kv *b)
872 2d9632ee 2014-07-11 reyk return (strcasecmp(a->kv_key, b->kv_key));
875 2d9632ee 2014-07-11 reyk RB_GENERATE(kvtree, kv, kv_node, kv_cmp);
878 69fde657 2014-07-09 reyk rule_add(struct protocol *proto, struct relay_rule *rule, const char *rulefile)
880 69fde657 2014-07-09 reyk struct relay_rule *r = NULL;
881 69fde657 2014-07-09 reyk struct kv *kv = NULL;
882 69fde657 2014-07-09 reyk FILE *fp = NULL;
883 69fde657 2014-07-09 reyk char buf[BUFSIZ];
884 69fde657 2014-07-09 reyk int ret = -1;
887 69fde657 2014-07-09 reyk for (i = 0; i < KEY_TYPE_MAX; i++) {
888 69fde657 2014-07-09 reyk kv = &rule->rule_kv[i];
889 69fde657 2014-07-09 reyk if (kv->kv_type != i)
892 69fde657 2014-07-09 reyk switch (kv->kv_option) {
893 69fde657 2014-07-09 reyk case KEY_OPTION_LOG:
894 69fde657 2014-07-09 reyk /* log action needs a key or a file to be specified */
895 69fde657 2014-07-09 reyk if (kv->kv_key == NULL && rulefile == NULL &&
896 69fde657 2014-07-09 reyk (kv->kv_key = strdup("*")) == NULL)
903 69fde657 2014-07-09 reyk switch (kv->kv_type) {
904 69fde657 2014-07-09 reyk case KEY_TYPE_QUERY:
905 69fde657 2014-07-09 reyk case KEY_TYPE_PATH:
906 69fde657 2014-07-09 reyk case KEY_TYPE_URL:
907 69fde657 2014-07-09 reyk if (rule->rule_dir != RELAY_DIR_REQUEST)
914 2d9632ee 2014-07-11 reyk if (kv->kv_value != NULL && strchr(kv->kv_value, '$') != NULL)
915 2d9632ee 2014-07-11 reyk kv->kv_flags |= KV_FLAG_MACRO;
916 2d9632ee 2014-07-11 reyk if (kv->kv_key != NULL && strpbrk(kv->kv_key, "*?[") != NULL)
917 2d9632ee 2014-07-11 reyk kv->kv_flags |= KV_FLAG_GLOBBING;
920 69fde657 2014-07-09 reyk if (rulefile == NULL) {
921 69fde657 2014-07-09 reyk TAILQ_INSERT_TAIL(&proto->rules, rule, rule_entry);
922 69fde657 2014-07-09 reyk return (0);
925 69fde657 2014-07-09 reyk if ((fp = fopen(rulefile, "r")) == NULL)
928 69fde657 2014-07-09 reyk while (fgets(buf, sizeof(buf), fp) != NULL) {
929 69fde657 2014-07-09 reyk /* strip whitespace and newline characters */
930 69fde657 2014-07-09 reyk buf[strcspn(buf, "\r\n\t ")] = '\0';
931 69fde657 2014-07-09 reyk if (!strlen(buf) || buf[0] == '#')
934 69fde657 2014-07-09 reyk if ((r = rule_inherit(rule)) == NULL)
937 69fde657 2014-07-09 reyk for (i = 0; i < KEY_TYPE_MAX; i++) {
938 69fde657 2014-07-09 reyk kv = &r->rule_kv[i];
939 69fde657 2014-07-09 reyk if (kv->kv_type != i)
941 ba24b6a0 2015-12-07 mmcc free(kv->kv_key);
942 69fde657 2014-07-09 reyk if ((kv->kv_key = strdup(buf)) == NULL) {
943 69fde657 2014-07-09 reyk rule_free(r);
949 69fde657 2014-07-09 reyk TAILQ_INSERT_TAIL(&proto->rules, r, rule_entry);
953 69fde657 2014-07-09 reyk rule_free(rule);
954 69fde657 2014-07-09 reyk free(rule);
957 69fde657 2014-07-09 reyk if (fp != NULL)
958 69fde657 2014-07-09 reyk fclose(fp);
959 69fde657 2014-07-09 reyk return (ret);
962 69fde657 2014-07-09 reyk struct relay_rule *
963 69fde657 2014-07-09 reyk rule_inherit(struct relay_rule *rule)
965 69fde657 2014-07-09 reyk struct relay_rule *r;
967 69fde657 2014-07-09 reyk struct kv *kv;
969 69fde657 2014-07-09 reyk if ((r = calloc(1, sizeof(*r))) == NULL)
970 69fde657 2014-07-09 reyk return (NULL);
971 69fde657 2014-07-09 reyk memcpy(r, rule, sizeof(*r));
973 69fde657 2014-07-09 reyk for (i = 0; i < KEY_TYPE_MAX; i++) {
974 69fde657 2014-07-09 reyk kv = &rule->rule_kv[i];
975 69fde657 2014-07-09 reyk if (kv->kv_type != i)
977 69fde657 2014-07-09 reyk if (kv_inherit(&r->rule_kv[i], kv) == NULL) {
979 63e504f7 2015-01-22 reyk return (NULL);
983 69fde657 2014-07-09 reyk if (r->rule_label > 0)
984 69fde657 2014-07-09 reyk label_ref(r->rule_label);
985 69fde657 2014-07-09 reyk if (r->rule_tag > 0)
986 69fde657 2014-07-09 reyk tag_ref(r->rule_tag);
987 69fde657 2014-07-09 reyk if (r->rule_tagged > 0)
988 69fde657 2014-07-09 reyk tag_ref(r->rule_tagged);
990 69fde657 2014-07-09 reyk return (r);
994 69fde657 2014-07-09 reyk rule_free(struct relay_rule *rule)
998 69fde657 2014-07-09 reyk for (i = 0; i < KEY_TYPE_MAX; i++)
999 69fde657 2014-07-09 reyk kv_free(&rule->rule_kv[i]);
1000 69fde657 2014-07-09 reyk if (rule->rule_label > 0)
1001 69fde657 2014-07-09 reyk label_unref(rule->rule_label);
1002 69fde657 2014-07-09 reyk if (rule->rule_tag > 0)
1003 69fde657 2014-07-09 reyk tag_unref(rule->rule_tag);
1004 69fde657 2014-07-09 reyk if (rule->rule_tagged > 0)
1005 69fde657 2014-07-09 reyk tag_unref(rule->rule_tagged);
1009 69fde657 2014-07-09 reyk rule_delete(struct relay_rules *rules, struct relay_rule *rule)
1011 69fde657 2014-07-09 reyk TAILQ_REMOVE(rules, rule, rule_entry);
1012 69fde657 2014-07-09 reyk rule_free(rule);
1013 69fde657 2014-07-09 reyk free(rule);
1017 69fde657 2014-07-09 reyk rule_settable(struct relay_rules *rules, struct relay_table *rlt)
1019 69fde657 2014-07-09 reyk struct relay_rule *r;
1020 63e504f7 2015-01-22 reyk char pname[TABLE_NAME_SIZE];
1022 69fde657 2014-07-09 reyk if (rlt->rlt_table == NULL || strlcpy(pname, rlt->rlt_table->conf.name,
1023 69fde657 2014-07-09 reyk sizeof(pname)) >= sizeof(pname))
1026 69fde657 2014-07-09 reyk pname[strcspn(pname, ":")] = '\0';
1028 69fde657 2014-07-09 reyk TAILQ_FOREACH(r, rules, rule_entry) {
1029 69fde657 2014-07-09 reyk if (r->rule_tablename[0] &&
1030 7192b56a 2015-07-29 benno strcmp(pname, r->rule_tablename) == 0)
1031 69fde657 2014-07-09 reyk r->rule_table = rlt;
1036 591e6ab5 2011-05-19 reyk * Utility functions
1039 41042ecc 2006-12-16 reyk struct host *
1040 6d0767ae 2007-12-07 reyk host_find(struct relayd *env, objid_t id)
1042 41042ecc 2006-12-16 reyk struct table *table;
1043 41042ecc 2006-12-16 reyk struct host *host;
1045 23fba4ad 2008-01-31 reyk TAILQ_FOREACH(table, env->sc_tables, entry)
1046 41042ecc 2006-12-16 reyk TAILQ_FOREACH(host, &table->hosts, entry)
1047 87178699 2007-05-27 pyr if (host->conf.id == id)
1048 41042ecc 2006-12-16 reyk return (host);
1049 41042ecc 2006-12-16 reyk return (NULL);
1052 41042ecc 2006-12-16 reyk struct table *
1053 6d0767ae 2007-12-07 reyk table_find(struct relayd *env, objid_t id)
1055 41042ecc 2006-12-16 reyk struct table *table;
1057 23fba4ad 2008-01-31 reyk TAILQ_FOREACH(table, env->sc_tables, entry)
1058 87178699 2007-05-27 pyr if (table->conf.id == id)
1059 41042ecc 2006-12-16 reyk return (table);
1060 41042ecc 2006-12-16 reyk return (NULL);
1063 c8f9d8e3 2007-12-08 pyr struct rdr *
1064 c8f9d8e3 2007-12-08 pyr rdr_find(struct relayd *env, objid_t id)
1066 c8f9d8e3 2007-12-08 pyr struct rdr *rdr;
1068 23fba4ad 2008-01-31 reyk TAILQ_FOREACH(rdr, env->sc_rdrs, entry)
1069 c8f9d8e3 2007-12-08 pyr if (rdr->conf.id == id)
1070 c8f9d8e3 2007-12-08 pyr return (rdr);
1071 41042ecc 2006-12-16 reyk return (NULL);
1074 30640247 2007-02-22 reyk struct relay *
1075 6d0767ae 2007-12-07 reyk relay_find(struct relayd *env, objid_t id)
1077 30640247 2007-02-22 reyk struct relay *rlay;
1079 146643ba 2008-01-31 reyk TAILQ_FOREACH(rlay, env->sc_relays, rl_entry)
1080 146643ba 2008-01-31 reyk if (rlay->rl_conf.id == id)
1081 30640247 2007-02-22 reyk return (rlay);
1082 30640247 2007-02-22 reyk return (NULL);
1085 591e6ab5 2011-05-19 reyk struct protocol *
1086 591e6ab5 2011-05-19 reyk proto_find(struct relayd *env, objid_t id)
1088 591e6ab5 2011-05-19 reyk struct protocol *p;
1090 591e6ab5 2011-05-19 reyk TAILQ_FOREACH(p, env->sc_protos, entry)
1091 591e6ab5 2011-05-19 reyk if (p->id == id)
1092 591e6ab5 2011-05-19 reyk return (p);
1093 591e6ab5 2011-05-19 reyk return (NULL);
1096 61afd4d6 2009-08-07 reyk struct rsession *
1097 6d0767ae 2007-12-07 reyk session_find(struct relayd *env, objid_t id)
1099 30640247 2007-02-22 reyk struct relay *rlay;
1100 61afd4d6 2009-08-07 reyk struct rsession *con;
1102 146643ba 2008-01-31 reyk TAILQ_FOREACH(rlay, env->sc_relays, rl_entry)
1103 146643ba 2008-01-31 reyk SPLAY_FOREACH(con, session_tree, &rlay->rl_sessions)
1104 aa79f3aa 2008-01-31 thib if (con->se_id == id)
1105 30640247 2007-02-22 reyk return (con);
1106 30640247 2007-02-22 reyk return (NULL);
1109 39bc6125 2009-08-13 reyk struct netroute *
1110 39bc6125 2009-08-13 reyk route_find(struct relayd *env, objid_t id)
1112 39bc6125 2009-08-13 reyk struct netroute *nr;
1114 39bc6125 2009-08-13 reyk TAILQ_FOREACH(nr, env->sc_routes, nr_route)
1115 39bc6125 2009-08-13 reyk if (nr->nr_conf.id == id)
1116 39bc6125 2009-08-13 reyk return (nr);
1117 39bc6125 2009-08-13 reyk return (NULL);
1120 591e6ab5 2011-05-19 reyk struct router *
1121 591e6ab5 2011-05-19 reyk router_find(struct relayd *env, objid_t id)
1123 591e6ab5 2011-05-19 reyk struct router *rt;
1125 591e6ab5 2011-05-19 reyk TAILQ_FOREACH(rt, env->sc_rts, rt_entry)
1126 591e6ab5 2011-05-19 reyk if (rt->rt_conf.id == id)
1127 591e6ab5 2011-05-19 reyk return (rt);
1128 591e6ab5 2011-05-19 reyk return (NULL);
1131 d2170f6d 2006-12-16 reyk struct host *
1132 6d0767ae 2007-12-07 reyk host_findbyname(struct relayd *env, const char *name)
1134 d2170f6d 2006-12-16 reyk struct table *table;
1135 d2170f6d 2006-12-16 reyk struct host *host;
1137 23fba4ad 2008-01-31 reyk TAILQ_FOREACH(table, env->sc_tables, entry)
1138 d2170f6d 2006-12-16 reyk TAILQ_FOREACH(host, &table->hosts, entry)
1139 87178699 2007-05-27 pyr if (strcmp(host->conf.name, name) == 0)
1140 d2170f6d 2006-12-16 reyk return (host);
1141 d2170f6d 2006-12-16 reyk return (NULL);
1144 d2170f6d 2006-12-16 reyk struct table *
1145 6d0767ae 2007-12-07 reyk table_findbyname(struct relayd *env, const char *name)
1147 d2170f6d 2006-12-16 reyk struct table *table;
1149 23fba4ad 2008-01-31 reyk TAILQ_FOREACH(table, env->sc_tables, entry)
1150 87178699 2007-05-27 pyr if (strcmp(table->conf.name, name) == 0)
1151 d2170f6d 2006-12-16 reyk return (table);
1152 d2170f6d 2006-12-16 reyk return (NULL);
1155 d7758aba 2007-12-08 reyk struct table *
1156 d7758aba 2007-12-08 reyk table_findbyconf(struct relayd *env, struct table *tb)
1158 d7758aba 2007-12-08 reyk struct table *table;
1159 d7758aba 2007-12-08 reyk struct table_config a, b;
1161 d7758aba 2007-12-08 reyk bcopy(&tb->conf, &a, sizeof(a));
1162 c8f9d8e3 2007-12-08 pyr a.id = a.rdrid = 0;
1163 d7758aba 2007-12-08 reyk a.flags &= ~(F_USED|F_BACKUP);
1165 23fba4ad 2008-01-31 reyk TAILQ_FOREACH(table, env->sc_tables, entry) {
1166 d7758aba 2007-12-08 reyk bcopy(&table->conf, &b, sizeof(b));
1167 c8f9d8e3 2007-12-08 pyr b.id = b.rdrid = 0;
1168 d7758aba 2007-12-08 reyk b.flags &= ~(F_USED|F_BACKUP);
1171 d7758aba 2007-12-08 reyk * Compare two tables and return the existing table if
1172 d7758aba 2007-12-08 reyk * the configuration seems to be the same.
1174 d7758aba 2007-12-08 reyk if (bcmp(&a, &b, sizeof(b)) == 0 &&
1175 d7758aba 2007-12-08 reyk ((tb->sendbuf == NULL && table->sendbuf == NULL) ||
1176 d7758aba 2007-12-08 reyk (tb->sendbuf != NULL && table->sendbuf != NULL &&
1177 d7758aba 2007-12-08 reyk strcmp(tb->sendbuf, table->sendbuf) == 0)))
1178 d7758aba 2007-12-08 reyk return (table);
1180 d7758aba 2007-12-08 reyk return (NULL);
1183 c8f9d8e3 2007-12-08 pyr struct rdr *
1184 c8f9d8e3 2007-12-08 pyr rdr_findbyname(struct relayd *env, const char *name)
1186 c8f9d8e3 2007-12-08 pyr struct rdr *rdr;
1188 23fba4ad 2008-01-31 reyk TAILQ_FOREACH(rdr, env->sc_rdrs, entry)
1189 c8f9d8e3 2007-12-08 pyr if (strcmp(rdr->conf.name, name) == 0)
1190 c8f9d8e3 2007-12-08 pyr return (rdr);
1191 d2170f6d 2006-12-16 reyk return (NULL);
1194 30640247 2007-02-22 reyk struct relay *
1195 6d0767ae 2007-12-07 reyk relay_findbyname(struct relayd *env, const char *name)
1197 30640247 2007-02-22 reyk struct relay *rlay;
1199 146643ba 2008-01-31 reyk TAILQ_FOREACH(rlay, env->sc_relays, rl_entry)
1200 146643ba 2008-01-31 reyk if (strcmp(rlay->rl_conf.name, name) == 0)
1201 30640247 2007-02-22 reyk return (rlay);
1202 30640247 2007-02-22 reyk return (NULL);
1205 d070188d 2009-08-05 reyk struct relay *
1206 d070188d 2009-08-05 reyk relay_findbyaddr(struct relayd *env, struct relay_config *rc)
1208 d070188d 2009-08-05 reyk struct relay *rlay;
1210 d070188d 2009-08-05 reyk TAILQ_FOREACH(rlay, env->sc_relays, rl_entry)
1211 d070188d 2009-08-05 reyk if (bcmp(&rlay->rl_conf.ss, &rc->ss, sizeof(rc->ss)) == 0 &&
1212 d070188d 2009-08-05 reyk rlay->rl_conf.port == rc->port)
1213 d070188d 2009-08-05 reyk return (rlay);
1214 d070188d 2009-08-05 reyk return (NULL);
1217 fae05986 2014-04-22 reyk EVP_PKEY *
1218 f4a6eef3 2017-05-27 claudio pkey_find(struct relayd *env, char * hash)
1220 fae05986 2014-04-22 reyk struct ca_pkey *pkey;
1222 fae05986 2014-04-22 reyk TAILQ_FOREACH(pkey, env->sc_pkeys, pkey_entry)
1223 f4a6eef3 2017-05-27 claudio if (strcmp(hash, pkey->pkey_hash) == 0)
1224 fae05986 2014-04-22 reyk return (pkey->pkey);
1225 fae05986 2014-04-22 reyk return (NULL);
1228 fae05986 2014-04-22 reyk struct ca_pkey *
1229 f4a6eef3 2017-05-27 claudio pkey_add(struct relayd *env, EVP_PKEY *pkey, char *hash)
1231 fae05986 2014-04-22 reyk struct ca_pkey *ca_pkey;
1233 fae05986 2014-04-22 reyk if (env->sc_pkeys == NULL)
1234 fae05986 2014-04-22 reyk fatalx("pkeys");
1236 fae05986 2014-04-22 reyk if ((ca_pkey = calloc(1, sizeof(*ca_pkey))) == NULL)
1237 fae05986 2014-04-22 reyk return (NULL);
1239 fae05986 2014-04-22 reyk ca_pkey->pkey = pkey;
1240 f4a6eef3 2017-05-27 claudio if (strlcpy(ca_pkey->pkey_hash, hash, sizeof(ca_pkey->pkey_hash)) >=
1241 d3ab5fbd 2017-05-31 jsg sizeof(ca_pkey->pkey_hash)) {
1242 d3ab5fbd 2017-05-31 jsg free(ca_pkey);
1243 f4a6eef3 2017-05-27 claudio return (NULL);
1246 fae05986 2014-04-22 reyk TAILQ_INSERT_TAIL(env->sc_pkeys, ca_pkey, pkey_entry);
1248 fae05986 2014-04-22 reyk return (ca_pkey);
1251 fe4913ec 2019-05-31 reyk struct relay_cert *
1252 fe4913ec 2019-05-31 reyk cert_add(struct relayd *env, objid_t id)
1254 fe4913ec 2019-05-31 reyk static objid_t last_cert_id = 0;
1255 fe4913ec 2019-05-31 reyk struct relay_cert *cert;
1257 fe4913ec 2019-05-31 reyk if ((cert = calloc(1, sizeof(*cert))) == NULL)
1258 fe4913ec 2019-05-31 reyk return (NULL);
1260 fe4913ec 2019-05-31 reyk if (id == 0)
1261 fe4913ec 2019-05-31 reyk id = ++last_cert_id;
1262 fe4913ec 2019-05-31 reyk if (id == INT_MAX) {
1263 fe4913ec 2019-05-31 reyk log_warnx("too many tls keypairs defined");
1264 fe4913ec 2019-05-31 reyk free(cert);
1265 fe4913ec 2019-05-31 reyk return (NULL);
1268 fe4913ec 2019-05-31 reyk cert->cert_id = id;
1269 fe4913ec 2019-05-31 reyk cert->cert_fd = -1;
1270 fe4913ec 2019-05-31 reyk cert->cert_key_fd = -1;
1271 0c91187d 2019-06-26 reyk cert->cert_ocsp_fd = -1;
1273 fe4913ec 2019-05-31 reyk TAILQ_INSERT_TAIL(env->sc_certs, cert, cert_entry);
1275 fe4913ec 2019-05-31 reyk return (cert);
1278 fe4913ec 2019-05-31 reyk struct relay_cert *
1279 fe4913ec 2019-05-31 reyk cert_find(struct relayd *env, objid_t id)
1281 fe4913ec 2019-05-31 reyk struct relay_cert *cert;
1283 fe4913ec 2019-05-31 reyk TAILQ_FOREACH(cert, env->sc_certs, cert_entry)
1284 fe4913ec 2019-05-31 reyk if (cert->cert_id == id)
1285 fe4913ec 2019-05-31 reyk return (cert);
1286 fe4913ec 2019-05-31 reyk return (NULL);
1290 55ca94a7 2019-05-29 reyk relay_load_fd(int fd, off_t *len)
1292 55ca94a7 2019-05-29 reyk char *buf = NULL;
1293 55ca94a7 2019-05-29 reyk struct stat st;
1294 55ca94a7 2019-05-29 reyk off_t size;
1297 55ca94a7 2019-05-29 reyk if (fstat(fd, &st) != 0)
1298 55ca94a7 2019-05-29 reyk goto fail;
1299 55ca94a7 2019-05-29 reyk size = st.st_size;
1300 55ca94a7 2019-05-29 reyk if ((buf = calloc(1, size + 1)) == NULL)
1301 55ca94a7 2019-05-29 reyk goto fail;
1302 41111001 2026-01-01 rsadowski if (pread(fd, buf, size, 0) != size)
1303 55ca94a7 2019-05-29 reyk goto fail;
1305 55ca94a7 2019-05-29 reyk close(fd);
1307 55ca94a7 2019-05-29 reyk *len = size;
1308 55ca94a7 2019-05-29 reyk return (buf);
1311 55ca94a7 2019-05-29 reyk err = errno;
1312 55ca94a7 2019-05-29 reyk free(buf);
1313 55ca94a7 2019-05-29 reyk close(fd);
1314 55ca94a7 2019-05-29 reyk errno = err;
1315 55ca94a7 2019-05-29 reyk return (NULL);
1319 36dd1e7a 2026-05-15 rsadowski relay_load_certfiles(struct relayd *env, struct relay *rlay, const struct keyname *name)
1321 55ca94a7 2019-05-29 reyk char certfile[PATH_MAX];
1322 9261e0d8 2019-05-31 reyk char hbuf[PATH_MAX];
1323 55ca94a7 2019-05-29 reyk struct protocol *proto = rlay->rl_proto;
1324 fe4913ec 2019-05-31 reyk struct relay_cert *cert;
1325 55ca94a7 2019-05-29 reyk int useport = htons(rlay->rl_conf.port);
1326 36dd1e7a 2026-05-15 rsadowski int cert_fd = -1, key_fd = -1, ocsp_fd = -1, ret = 0;
1328 55ca94a7 2019-05-29 reyk if (rlay->rl_conf.flags & F_TLSCLIENT) {
1329 fe4913ec 2019-05-31 reyk if (strlen(proto->tlsca) && rlay->rl_tls_ca_fd == -1) {
1330 55ca94a7 2019-05-29 reyk if ((rlay->rl_tls_ca_fd =
1331 55ca94a7 2019-05-29 reyk open(proto->tlsca, O_RDONLY)) == -1)
1332 55ca94a7 2019-05-29 reyk return (-1);
1333 55ca94a7 2019-05-29 reyk log_debug("%s: using ca %s", __func__, proto->tlsca);
1335 fe4913ec 2019-05-31 reyk if (strlen(proto->tlscacert) && rlay->rl_tls_cacert_fd == -1) {
1336 55ca94a7 2019-05-29 reyk if ((rlay->rl_tls_cacert_fd =
1337 55ca94a7 2019-05-29 reyk open(proto->tlscacert, O_RDONLY)) == -1)
1338 55ca94a7 2019-05-29 reyk return (-1);
1339 55ca94a7 2019-05-29 reyk log_debug("%s: using ca certificate %s", __func__,
1340 55ca94a7 2019-05-29 reyk proto->tlscacert);
1342 fe4913ec 2019-05-31 reyk if (strlen(proto->tlscakey) && !rlay->rl_conf.tls_cakey_len &&
1343 fe4913ec 2019-05-31 reyk proto->tlscapass != NULL) {
1344 55ca94a7 2019-05-29 reyk if ((rlay->rl_tls_cakey =
1345 55ca94a7 2019-05-29 reyk ssl_load_key(env, proto->tlscakey,
1346 55ca94a7 2019-05-29 reyk &rlay->rl_conf.tls_cakey_len,
1347 55ca94a7 2019-05-29 reyk proto->tlscapass)) == NULL)
1348 55ca94a7 2019-05-29 reyk return (-1);
1349 55ca94a7 2019-05-29 reyk log_debug("%s: using ca key %s", __func__,
1350 55ca94a7 2019-05-29 reyk proto->tlscakey);
1354 55ca94a7 2019-05-29 reyk if ((rlay->rl_conf.flags & F_TLS) == 0)
1355 55ca94a7 2019-05-29 reyk return (0);
1357 c4efe747 2024-10-28 tb if (strlen(proto->tlsclientca) && rlay->rl_tls_client_ca_fd == -1) {
1358 c4efe747 2024-10-28 tb if ((rlay->rl_tls_client_ca_fd =
1359 c4efe747 2024-10-28 tb open(proto->tlsclientca, O_RDONLY)) == -1)
1360 c4efe747 2024-10-28 tb return (-1);
1361 c4efe747 2024-10-28 tb log_debug("%s: using client ca %s", __func__,
1362 c4efe747 2024-10-28 tb proto->tlsclientca);
1365 9261e0d8 2019-05-31 reyk if (name == NULL &&
1366 9261e0d8 2019-05-31 reyk print_host(&rlay->rl_conf.ss, hbuf, sizeof(hbuf)) == NULL)
1367 fe4913ec 2019-05-31 reyk goto fail;
1368 9261e0d8 2019-05-31 reyk else if (name != NULL &&
1369 36dd1e7a 2026-05-15 rsadowski strlcpy(hbuf, name->name, sizeof(hbuf)) >= sizeof(hbuf))
1370 9261e0d8 2019-05-31 reyk goto fail;
1372 36dd1e7a 2026-05-15 rsadowski if (name != NULL && strcmp(name->certificate, "") != 0) {
1373 36dd1e7a 2026-05-15 rsadowski if (strlcpy(certfile, name->certificate, sizeof(certfile))
1374 36dd1e7a 2026-05-15 rsadowski >= sizeof(certfile)) {
1375 36dd1e7a 2026-05-15 rsadowski log_warnx("certificate truncated");
1376 36dd1e7a 2026-05-15 rsadowski goto fail;
1379 36dd1e7a 2026-05-15 rsadowski else {
1380 36dd1e7a 2026-05-15 rsadowski ret = snprintf(certfile, sizeof(certfile),
1381 36dd1e7a 2026-05-15 rsadowski "/etc/ssl/%s:%u.crt", hbuf, useport);
1383 36dd1e7a 2026-05-15 rsadowski if (ret < 0 || (size_t)ret >= sizeof(certfile))
1384 36dd1e7a 2026-05-15 rsadowski goto fail;
1386 fe4913ec 2019-05-31 reyk if ((cert_fd = open(certfile, O_RDONLY)) == -1) {
1388 36dd1e7a 2026-05-15 rsadowski ret = snprintf(certfile, sizeof(certfile),
1389 36dd1e7a 2026-05-15 rsadowski "/etc/ssl/%s.crt", hbuf);
1391 36dd1e7a 2026-05-15 rsadowski if (ret < 0 || (size_t)ret >= sizeof(certfile))
1392 fe4913ec 2019-05-31 reyk goto fail;
1393 fe4913ec 2019-05-31 reyk if ((cert_fd = open(certfile, O_RDONLY)) == -1)
1394 fe4913ec 2019-05-31 reyk goto fail;
1395 55ca94a7 2019-05-29 reyk useport = 0;
1397 55ca94a7 2019-05-29 reyk log_debug("%s: using certificate %s", __func__, certfile);
1399 36dd1e7a 2026-05-15 rsadowski if (name != NULL && strcmp(name->key, "") != 0) {
1400 36dd1e7a 2026-05-15 rsadowski if (strlcpy(certfile, name->key, sizeof(certfile))
1401 36dd1e7a 2026-05-15 rsadowski >= sizeof(certfile)) {
1402 36dd1e7a 2026-05-15 rsadowski log_warnx("certificate key truncated");
1403 fe4913ec 2019-05-31 reyk goto fail;
1406 36dd1e7a 2026-05-15 rsadowski else {
1407 36dd1e7a 2026-05-15 rsadowski if (useport) {
1408 36dd1e7a 2026-05-15 rsadowski ret = snprintf(certfile, sizeof(certfile),
1409 36dd1e7a 2026-05-15 rsadowski "/etc/ssl/private/%s:%u.key",
1410 36dd1e7a 2026-05-15 rsadowski hbuf, useport);
1412 36dd1e7a 2026-05-15 rsadowski if (ret < 0 || (size_t)ret >= sizeof(certfile))
1413 36dd1e7a 2026-05-15 rsadowski goto fail;
1414 36dd1e7a 2026-05-15 rsadowski } else {
1415 36dd1e7a 2026-05-15 rsadowski ret = snprintf(certfile, sizeof(certfile),
1416 36dd1e7a 2026-05-15 rsadowski "/etc/ssl/private/%s.key", hbuf);
1418 36dd1e7a 2026-05-15 rsadowski if (ret < 0 || (size_t)ret >= sizeof(certfile))
1419 36dd1e7a 2026-05-15 rsadowski goto fail;
1422 fe4913ec 2019-05-31 reyk if ((key_fd = open(certfile, O_RDONLY)) == -1)
1423 fe4913ec 2019-05-31 reyk goto fail;
1424 55ca94a7 2019-05-29 reyk log_debug("%s: using private key %s", __func__, certfile);
1426 36dd1e7a 2026-05-15 rsadowski if (name != NULL && strcmp(name->ocsp, "") != 0) {
1427 36dd1e7a 2026-05-15 rsadowski if (strlcpy(certfile, name->ocsp, sizeof(certfile))
1428 36dd1e7a 2026-05-15 rsadowski >= sizeof(certfile)) {
1429 36dd1e7a 2026-05-15 rsadowski log_warnx("certificate ocsp truncated");
1430 0c91187d 2019-06-26 reyk goto fail;
1434 36dd1e7a 2026-05-15 rsadowski else {
1435 36dd1e7a 2026-05-15 rsadowski if (useport) {
1436 36dd1e7a 2026-05-15 rsadowski ret = snprintf(certfile, sizeof(certfile),
1437 36dd1e7a 2026-05-15 rsadowski "/etc/ssl/%s:%u.ocsp",
1438 36dd1e7a 2026-05-15 rsadowski hbuf, useport);
1440 36dd1e7a 2026-05-15 rsadowski if (ret < 0 || (size_t)ret >= sizeof(certfile))
1441 36dd1e7a 2026-05-15 rsadowski goto fail;
1442 36dd1e7a 2026-05-15 rsadowski } else {
1443 36dd1e7a 2026-05-15 rsadowski ret = snprintf(certfile, sizeof(certfile),
1444 36dd1e7a 2026-05-15 rsadowski "/etc/ssl/%s.ocsp", hbuf);
1446 36dd1e7a 2026-05-15 rsadowski if (ret < 0 || (size_t)ret >= sizeof(certfile))
1447 36dd1e7a 2026-05-15 rsadowski goto fail;
1450 0c91187d 2019-06-26 reyk if ((ocsp_fd = open(certfile, O_RDONLY)) != -1)
1451 0c91187d 2019-06-26 reyk log_debug("%s: using OCSP staple file %s", __func__, certfile);
1453 fe4913ec 2019-05-31 reyk if ((cert = cert_add(env, 0)) == NULL)
1454 fe4913ec 2019-05-31 reyk goto fail;
1456 fe4913ec 2019-05-31 reyk cert->cert_relayid = rlay->rl_conf.id;
1457 fe4913ec 2019-05-31 reyk cert->cert_fd = cert_fd;
1458 fe4913ec 2019-05-31 reyk cert->cert_key_fd = key_fd;
1459 0c91187d 2019-06-26 reyk cert->cert_ocsp_fd = ocsp_fd;
1461 55ca94a7 2019-05-29 reyk return (0);
1464 fe4913ec 2019-05-31 reyk if (cert_fd != -1)
1465 fe4913ec 2019-05-31 reyk close(cert_fd);
1466 fe4913ec 2019-05-31 reyk if (key_fd != -1)
1467 fe4913ec 2019-05-31 reyk close(key_fd);
1468 0c91187d 2019-06-26 reyk if (ocsp_fd != -1)
1469 0c91187d 2019-06-26 reyk close(ocsp_fd);
1471 fe4913ec 2019-05-31 reyk return (-1);
1475 1f0abe81 2007-01-11 pyr event_again(struct event *ev, int fd, short event,
1476 1f0abe81 2007-01-11 pyr void (*fn)(int, short, void *),
1477 816ddb53 2007-01-11 reyk struct timeval *start, struct timeval *end, void *arg)
1479 816ddb53 2007-01-11 reyk struct timeval tv_next, tv_now, tv;
1481 b7f7a948 2013-03-10 reyk getmonotime(&tv_now);
1482 816ddb53 2007-01-11 reyk bcopy(end, &tv_next, sizeof(tv_next));
1483 816ddb53 2007-01-11 reyk timersub(&tv_now, start, &tv_now);
1484 816ddb53 2007-01-11 reyk timersub(&tv_next, &tv_now, &tv_next);
1486 816ddb53 2007-01-11 reyk bzero(&tv, sizeof(tv));
1487 816ddb53 2007-01-11 reyk if (timercmp(&tv_next, &tv, >))
1488 816ddb53 2007-01-11 reyk bcopy(&tv_next, &tv, sizeof(tv));
1490 49712947 2010-02-04 jsg event_del(ev);
1491 816ddb53 2007-01-11 reyk event_set(ev, fd, event, fn, arg);
1492 816ddb53 2007-01-11 reyk event_add(ev, &tv);
1496 30640247 2007-02-22 reyk expand_string(char *label, size_t len, const char *srch, const char *repl)
1498 30640247 2007-02-22 reyk char *tmp;
1499 30640247 2007-02-22 reyk char *p, *q;
1501 30640247 2007-02-22 reyk if ((tmp = calloc(1, len)) == NULL) {
1502 666bd316 2011-05-05 reyk log_debug("%s: calloc", __func__);
1503 30640247 2007-02-22 reyk return (-1);
1505 41111001 2026-01-01 rsadowski p = label;
1506 3e2ddb06 2007-02-22 reyk while ((q = strstr(p, srch)) != NULL) {
1507 30640247 2007-02-22 reyk *q = '\0';
1508 30640247 2007-02-22 reyk if ((strlcat(tmp, p, len) >= len) ||
1509 30640247 2007-02-22 reyk (strlcat(tmp, repl, len) >= len)) {
1510 666bd316 2011-05-05 reyk log_debug("%s: string too long", __func__);
1512 30640247 2007-02-22 reyk return (-1);
1514 30640247 2007-02-22 reyk q += strlen(srch);
1517 30640247 2007-02-22 reyk if (strlcat(tmp, p, len) >= len) {
1518 666bd316 2011-05-05 reyk log_debug("%s: string too long", __func__);
1520 30640247 2007-02-22 reyk return (-1);
1522 1193f29c 2007-02-26 reyk (void)strlcpy(label, tmp, len); /* always fits */
1523 30640247 2007-02-22 reyk free(tmp);
1525 30640247 2007-02-22 reyk return (0);
1529 b279fb39 2007-10-02 pyr translate_string(char *str)
1531 b279fb39 2007-10-02 pyr char *reader;
1532 b279fb39 2007-10-02 pyr char *writer;
1534 b279fb39 2007-10-02 pyr reader = writer = str;
1536 b279fb39 2007-10-02 pyr while (*reader) {
1537 b279fb39 2007-10-02 pyr if (*reader == '\\') {
1539 b279fb39 2007-10-02 pyr switch (*reader) {
1541 b279fb39 2007-10-02 pyr *writer++ = '\n';
1544 b279fb39 2007-10-02 pyr *writer++ = '\r';
1547 b279fb39 2007-10-02 pyr *writer++ = *reader;
1550 b279fb39 2007-10-02 pyr *writer++ = *reader;
1553 b279fb39 2007-10-02 pyr *writer = '\0';
1557 8a025509 2007-11-21 reyk digeststr(enum digest_type type, const u_int8_t *data, size_t len, char *buf)
1559 8a025509 2007-11-21 reyk switch (type) {
1560 8a025509 2007-11-21 reyk case DIGEST_SHA1:
1561 8a025509 2007-11-21 reyk return (SHA1Data(data, len, buf));
1563 8a025509 2007-11-21 reyk case DIGEST_MD5:
1564 8a025509 2007-11-21 reyk return (MD5Data(data, len, buf));
1569 8a025509 2007-11-21 reyk return (NULL);
1572 d8e9af71 2007-11-24 reyk const char *
1573 d8e9af71 2007-11-24 reyk canonicalize_host(const char *host, char *name, size_t len)
1575 d8e9af71 2007-11-24 reyk struct sockaddr_in sin4;
1576 d8e9af71 2007-11-24 reyk struct sockaddr_in6 sin6;
1577 09b69d98 2014-11-22 tedu size_t i, j;
1578 a580c7b6 2007-11-25 reyk size_t plen;
1581 a580c7b6 2007-11-25 reyk if (len < 2)
1582 a580c7b6 2007-11-25 reyk goto fail;
1585 a580c7b6 2007-11-25 reyk * Canonicalize an IPv4/6 address
1587 d8e9af71 2007-11-24 reyk if (inet_pton(AF_INET, host, &sin4) == 1)
1588 d8e9af71 2007-11-24 reyk return (inet_ntop(AF_INET, &sin4, name, len));
1589 d8e9af71 2007-11-24 reyk if (inet_pton(AF_INET6, host, &sin6) == 1)
1590 d8e9af71 2007-11-24 reyk return (inet_ntop(AF_INET6, &sin6, name, len));
1593 a580c7b6 2007-11-25 reyk * Canonicalize a hostname
1596 2e6003cf 2010-09-02 sobrado /* 1. remove repeated dots and convert upper case to lower case */
1597 a580c7b6 2007-11-25 reyk plen = strlen(host);
1598 a580c7b6 2007-11-25 reyk bzero(name, len);
1599 a580c7b6 2007-11-25 reyk for (i = j = 0; i < plen; i++) {
1600 a580c7b6 2007-11-25 reyk if (j >= (len - 1))
1601 a580c7b6 2007-11-25 reyk goto fail;
1602 0796d758 2015-10-14 reyk c = tolower((unsigned char)host[i]);
1603 a580c7b6 2007-11-25 reyk if ((c == '.') && (j == 0 || name[j - 1] == '.'))
1605 a580c7b6 2007-11-25 reyk name[j++] = c;
1608 a580c7b6 2007-11-25 reyk /* 2. remove trailing dots */
1609 a580c7b6 2007-11-25 reyk for (i = j; i > 0; i--) {
1610 a580c7b6 2007-11-25 reyk if (name[i - 1] != '.')
1612 a580c7b6 2007-11-25 reyk name[i - 1] = '\0';
1615 a580c7b6 2007-11-25 reyk if (j <= 0)
1616 a580c7b6 2007-11-25 reyk goto fail;
1618 d8e9af71 2007-11-24 reyk return (name);
1621 a580c7b6 2007-11-25 reyk errno = EINVAL;
1622 a580c7b6 2007-11-25 reyk return (NULL);
1626 4e975be3 2016-07-27 reyk parse_url(const char *url, char **protoptr, char **hostptr, char **pathptr)
1628 4e975be3 2016-07-27 reyk char *p, *proto = NULL, *host = NULL, *path = NULL;
1630 4e975be3 2016-07-27 reyk /* return error if it is not a URL */
1631 4e975be3 2016-07-27 reyk if ((p = strstr(url, ":/")) == NULL ||
1632 4e975be3 2016-07-27 reyk (strcspn(url, ":/") != (size_t)(p - url)))
1633 4e975be3 2016-07-27 reyk return (-1);
1635 4e975be3 2016-07-27 reyk /* get protocol */
1636 4e975be3 2016-07-27 reyk if ((proto = strdup(url)) == NULL)
1637 4e975be3 2016-07-27 reyk goto fail;
1638 4e975be3 2016-07-27 reyk p = proto + (p - url);
1640 4e975be3 2016-07-27 reyk /* get host */
1641 4e975be3 2016-07-27 reyk p += strspn(p, ":/");
1642 4e975be3 2016-07-27 reyk if (*p == '\0' || (host = strdup(p)) == NULL)
1643 4e975be3 2016-07-27 reyk goto fail;
1644 4e975be3 2016-07-27 reyk *p = '\0';
1646 4e975be3 2016-07-27 reyk /* find and copy path or default to "/" */
1647 4e975be3 2016-07-27 reyk if ((p = strchr(host, '/')) == NULL)
1649 4e975be3 2016-07-27 reyk if ((path = strdup(p)) == NULL)
1650 4e975be3 2016-07-27 reyk goto fail;
1652 4e975be3 2016-07-27 reyk /* strip path after host */
1653 4e975be3 2016-07-27 reyk host[strcspn(host, "/")] = '\0';
1655 4e975be3 2016-07-27 reyk DPRINTF("%s: %s proto %s, host %s, path %s", __func__,
1656 4e975be3 2016-07-27 reyk url, proto, host, path);
1658 4e975be3 2016-07-27 reyk *protoptr = proto;
1659 4e975be3 2016-07-27 reyk *hostptr = host;
1660 4e975be3 2016-07-27 reyk *pathptr = path;
1662 4e975be3 2016-07-27 reyk return (0);
1665 4e975be3 2016-07-27 reyk free(proto);
1666 4e975be3 2016-07-27 reyk free(host);
1667 4e975be3 2016-07-27 reyk free(path);
1668 4e975be3 2016-07-27 reyk return (-1);
1672 6d5340e6 2008-06-11 reyk bindany(struct ctl_bindany *bnd)
1679 6d5340e6 2008-06-11 reyk if (relay_socket_af(&bnd->bnd_ss, bnd->bnd_port) == -1)
1680 6d5340e6 2008-06-11 reyk goto fail;
1681 70f115c0 2008-07-09 reyk if ((s = socket(bnd->bnd_ss.ss_family,
1682 70f115c0 2008-07-09 reyk bnd->bnd_proto == IPPROTO_TCP ? SOCK_STREAM : SOCK_DGRAM,
1683 6d5340e6 2008-06-11 reyk bnd->bnd_proto)) == -1)
1684 6d5340e6 2008-06-11 reyk goto fail;
1685 6d5340e6 2008-06-11 reyk if (setsockopt(s, SOL_SOCKET, SO_BINDANY,
1686 6d5340e6 2008-06-11 reyk &v, sizeof(v)) == -1)
1687 6d5340e6 2008-06-11 reyk goto fail;
1688 6d5340e6 2008-06-11 reyk if (bind(s, (struct sockaddr *)&bnd->bnd_ss,
1689 6d5340e6 2008-06-11 reyk bnd->bnd_ss.ss_len) == -1)
1690 6d5340e6 2008-06-11 reyk goto fail;
1692 6d5340e6 2008-06-11 reyk return (s);
1695 6d5340e6 2008-06-11 reyk if (s != -1)
1697 6d5340e6 2008-06-11 reyk return (-1);
1701 2e5903be 2008-07-22 reyk map6to4(struct sockaddr_storage *in6)
1703 2e5903be 2008-07-22 reyk struct sockaddr_storage out4;
1704 2e5903be 2008-07-22 reyk struct sockaddr_in *sin4 = (struct sockaddr_in *)&out4;
1705 2e5903be 2008-07-22 reyk struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)in6;
1707 2e5903be 2008-07-22 reyk bzero(sin4, sizeof(*sin4));
1708 2e5903be 2008-07-22 reyk sin4->sin_len = sizeof(*sin4);
1709 2e5903be 2008-07-22 reyk sin4->sin_family = AF_INET;
1710 2e5903be 2008-07-22 reyk sin4->sin_port = sin6->sin6_port;
1712 2e5903be 2008-07-22 reyk bcopy(&sin6->sin6_addr.s6_addr[12], &sin4->sin_addr.s_addr,
1713 2e5903be 2008-07-22 reyk sizeof(sin4->sin_addr));
1715 2e5903be 2008-07-22 reyk if (sin4->sin_addr.s_addr == INADDR_ANY ||
1716 2e5903be 2008-07-22 reyk sin4->sin_addr.s_addr == INADDR_BROADCAST ||
1717 2e5903be 2008-07-22 reyk IN_MULTICAST(ntohl(sin4->sin_addr.s_addr)))
1718 2e5903be 2008-07-22 reyk return (-1);
1720 2e5903be 2008-07-22 reyk bcopy(&out4, in6, sizeof(*in6));
1722 2e5903be 2008-07-22 reyk return (0);
1726 2e5903be 2008-07-22 reyk map4to6(struct sockaddr_storage *in4, struct sockaddr_storage *map)
1728 2e5903be 2008-07-22 reyk struct sockaddr_storage out6;
1729 2e5903be 2008-07-22 reyk struct sockaddr_in *sin4 = (struct sockaddr_in *)in4;
1730 2e5903be 2008-07-22 reyk struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&out6;
1731 2e5903be 2008-07-22 reyk struct sockaddr_in6 *map6 = (struct sockaddr_in6 *)map;
1733 2e5903be 2008-07-22 reyk if (sin4->sin_addr.s_addr == INADDR_ANY ||
1734 2e5903be 2008-07-22 reyk sin4->sin_addr.s_addr == INADDR_BROADCAST ||
1735 2e5903be 2008-07-22 reyk IN_MULTICAST(ntohl(sin4->sin_addr.s_addr)))
1736 2e5903be 2008-07-22 reyk return (-1);
1738 2e5903be 2008-07-22 reyk bcopy(map6, sin6, sizeof(*sin6));
1739 2e5903be 2008-07-22 reyk sin6->sin6_len = sizeof(*sin6);
1740 2e5903be 2008-07-22 reyk sin6->sin6_family = AF_INET6;
1741 2e5903be 2008-07-22 reyk sin6->sin6_port = sin4->sin_port;
1743 2e5903be 2008-07-22 reyk bcopy(&sin4->sin_addr.s_addr, &sin6->sin6_addr.s6_addr[12],
1744 2e5903be 2008-07-22 reyk sizeof(sin4->sin_addr));
1746 2e5903be 2008-07-22 reyk bcopy(&out6, in4, sizeof(*in4));
1748 2e5903be 2008-07-22 reyk return (0);
1752 ea47f1c4 2010-11-30 reyk socket_rlimit(int maxfd)
1754 ea47f1c4 2010-11-30 reyk struct rlimit rl;
1756 ea47f1c4 2010-11-30 reyk if (getrlimit(RLIMIT_NOFILE, &rl) == -1)
1757 09e53fee 2017-05-28 benno fatal("%s: failed to get resource limit", __func__);
1758 68e92a51 2012-11-27 guenther log_debug("%s: max open files %llu", __func__, rl.rlim_max);
1761 ea47f1c4 2010-11-30 reyk * Allow the maximum number of open file descriptors for this
1762 ea47f1c4 2010-11-30 reyk * login class (which should be the class "daemon" by default).
1764 ea47f1c4 2010-11-30 reyk if (maxfd == -1)
1765 ea47f1c4 2010-11-30 reyk rl.rlim_cur = rl.rlim_max;
1767 2f6ec04d 2015-01-16 deraadt rl.rlim_cur = MAXIMUM(rl.rlim_max, (rlim_t)maxfd);
1768 ea47f1c4 2010-11-30 reyk if (setrlimit(RLIMIT_NOFILE, &rl) == -1)
1769 09e53fee 2017-05-28 benno fatal("%s: failed to set resource limit", __func__);
1773 591e6ab5 2011-05-19 reyk get_string(u_int8_t *ptr, size_t len)
1777 591e6ab5 2011-05-19 reyk for (i = 0; i < len; i++)
1778 0796d758 2015-10-14 reyk if (!(isprint((unsigned char)ptr[i]) ||
1779 0796d758 2015-10-14 reyk isspace((unsigned char)ptr[i])))
1782 1c80e16b 2015-11-19 mmcc return strndup(ptr, i);
1786 591e6ab5 2011-05-19 reyk get_data(u_int8_t *ptr, size_t len)
1788 591e6ab5 2011-05-19 reyk u_int8_t *data;
1790 1c80e16b 2015-11-19 mmcc if ((data = malloc(len)) == NULL)
1791 591e6ab5 2011-05-19 reyk return (NULL);
1792 591e6ab5 2011-05-19 reyk memcpy(data, ptr, len);
1794 591e6ab5 2011-05-19 reyk return (data);
1798 69fde657 2014-07-09 reyk sockaddr_cmp(struct sockaddr *a, struct sockaddr *b, int prefixlen)
1800 69fde657 2014-07-09 reyk struct sockaddr_in *a4, *b4;
1801 69fde657 2014-07-09 reyk struct sockaddr_in6 *a6, *b6;
1802 69fde657 2014-07-09 reyk u_int32_t av[4], bv[4], mv[4];
1804 69fde657 2014-07-09 reyk if (a->sa_family == AF_UNSPEC || b->sa_family == AF_UNSPEC)
1805 69fde657 2014-07-09 reyk return (0);
1806 69fde657 2014-07-09 reyk else if (a->sa_family > b->sa_family)
1807 69fde657 2014-07-09 reyk return (1);
1808 69fde657 2014-07-09 reyk else if (a->sa_family < b->sa_family)
1809 69fde657 2014-07-09 reyk return (-1);
1811 69fde657 2014-07-09 reyk if (prefixlen == -1)
1812 69fde657 2014-07-09 reyk memset(&mv, 0xff, sizeof(mv));
1814 69fde657 2014-07-09 reyk switch (a->sa_family) {
1815 69fde657 2014-07-09 reyk case AF_INET:
1816 69fde657 2014-07-09 reyk a4 = (struct sockaddr_in *)a;
1817 69fde657 2014-07-09 reyk b4 = (struct sockaddr_in *)b;
1819 69fde657 2014-07-09 reyk av[0] = a4->sin_addr.s_addr;
1820 69fde657 2014-07-09 reyk bv[0] = b4->sin_addr.s_addr;
1821 69fde657 2014-07-09 reyk if (prefixlen != -1)
1822 69fde657 2014-07-09 reyk mv[0] = prefixlen2mask(prefixlen);
1824 69fde657 2014-07-09 reyk if ((av[0] & mv[0]) > (bv[0] & mv[0]))
1825 69fde657 2014-07-09 reyk return (1);
1826 69fde657 2014-07-09 reyk if ((av[0] & mv[0]) < (bv[0] & mv[0]))
1827 69fde657 2014-07-09 reyk return (-1);
1829 69fde657 2014-07-09 reyk case AF_INET6:
1830 69fde657 2014-07-09 reyk a6 = (struct sockaddr_in6 *)a;
1831 69fde657 2014-07-09 reyk b6 = (struct sockaddr_in6 *)b;
1833 69fde657 2014-07-09 reyk memcpy(&av, &a6->sin6_addr.s6_addr, 16);
1834 69fde657 2014-07-09 reyk memcpy(&bv, &b6->sin6_addr.s6_addr, 16);
1835 69fde657 2014-07-09 reyk if (prefixlen != -1)
1836 69fde657 2014-07-09 reyk prefixlen2mask6(prefixlen, mv);
1838 69fde657 2014-07-09 reyk if ((av[3] & mv[3]) > (bv[3] & mv[3]))
1839 69fde657 2014-07-09 reyk return (1);
1840 69fde657 2014-07-09 reyk if ((av[3] & mv[3]) < (bv[3] & mv[3]))
1841 69fde657 2014-07-09 reyk return (-1);
1842 69fde657 2014-07-09 reyk if ((av[2] & mv[2]) > (bv[2] & mv[2]))
1843 69fde657 2014-07-09 reyk return (1);
1844 69fde657 2014-07-09 reyk if ((av[2] & mv[2]) < (bv[2] & mv[2]))
1845 69fde657 2014-07-09 reyk return (-1);
1846 69fde657 2014-07-09 reyk if ((av[1] & mv[1]) > (bv[1] & mv[1]))
1847 69fde657 2014-07-09 reyk return (1);
1848 69fde657 2014-07-09 reyk if ((av[1] & mv[1]) < (bv[1] & mv[1]))
1849 69fde657 2014-07-09 reyk return (-1);
1850 69fde657 2014-07-09 reyk if ((av[0] & mv[0]) > (bv[0] & mv[0]))
1851 69fde657 2014-07-09 reyk return (1);
1852 69fde657 2014-07-09 reyk if ((av[0] & mv[0]) < (bv[0] & mv[0]))
1853 69fde657 2014-07-09 reyk return (-1);
1857 69fde657 2014-07-09 reyk return (0);
1861 69fde657 2014-07-09 reyk prefixlen2mask(u_int8_t prefixlen)
1863 69fde657 2014-07-09 reyk if (prefixlen == 0)
1864 69fde657 2014-07-09 reyk return (0);
1866 69fde657 2014-07-09 reyk if (prefixlen > 32)
1867 69fde657 2014-07-09 reyk prefixlen = 32;
1869 69fde657 2014-07-09 reyk return (htonl(0xffffffff << (32 - prefixlen)));
1872 69fde657 2014-07-09 reyk struct in6_addr *
1873 69fde657 2014-07-09 reyk prefixlen2mask6(u_int8_t prefixlen, u_int32_t *mask)
1875 69fde657 2014-07-09 reyk static struct in6_addr s6;
1878 69fde657 2014-07-09 reyk if (prefixlen > 128)
1879 69fde657 2014-07-09 reyk prefixlen = 128;
1881 69fde657 2014-07-09 reyk bzero(&s6, sizeof(s6));
1882 69fde657 2014-07-09 reyk for (i = 0; i < prefixlen / 8; i++)
1883 69fde657 2014-07-09 reyk s6.s6_addr[i] = 0xff;
1884 69fde657 2014-07-09 reyk i = prefixlen % 8;
1886 69fde657 2014-07-09 reyk s6.s6_addr[prefixlen / 8] = 0xff00 >> i;
1888 69fde657 2014-07-09 reyk memcpy(mask, &s6, sizeof(s6));
1890 69fde657 2014-07-09 reyk return (&s6);
1894 61cca588 2012-09-21 benno accept_reserve(int sockfd, struct sockaddr *addr, socklen_t *addrlen,
1895 61cca588 2012-09-21 benno int reserve, volatile int *counter)
1898 61cca588 2012-09-21 benno if (getdtablecount() + reserve +
1899 61cca588 2012-09-21 benno *counter >= getdtablesize()) {
1900 61cca588 2012-09-21 benno errno = EMFILE;
1901 185b85c3 2014-06-27 andre return (-1);
1904 24dcf092 2015-11-28 reyk if ((ret = accept4(sockfd, addr, addrlen, SOCK_NONBLOCK)) > -1) {
1905 61cca588 2012-09-21 benno (*counter)++;
1906 185b85c3 2014-06-27 andre DPRINTF("%s: inflight incremented, now %d",__func__, *counter);
1908 185b85c3 2014-06-27 andre return (ret);
1912 e5c598d0 2016-09-01 claudio parent_tls_ticket_rekey(int fd, short events, void *arg)
1914 e5c598d0 2016-09-01 claudio static struct event rekeyev;
1915 e5c598d0 2016-09-01 claudio struct relayd *env = arg;
1916 e5c598d0 2016-09-01 claudio struct timeval tv;
1917 f4a6eef3 2017-05-27 claudio struct relay_ticket_key key;
1919 09e53fee 2017-05-28 benno log_debug("%s: rekeying tickets", __func__);
1921 f4a6eef3 2017-05-27 claudio key.tt_keyrev = arc4random();
1922 f4a6eef3 2017-05-27 claudio arc4random_buf(key.tt_key, sizeof(key.tt_key));
1924 e5c598d0 2016-09-01 claudio proc_compose_imsg(env->sc_ps, PROC_RELAY, -1, IMSG_TLSTICKET_REKEY,
1925 e5c598d0 2016-09-01 claudio -1, -1, &key, sizeof(key));
1927 e5c598d0 2016-09-01 claudio evtimer_set(&rekeyev, parent_tls_ticket_rekey, env);
1928 e5c598d0 2016-09-01 claudio timerclear(&tv);
1929 f4a6eef3 2017-05-27 claudio tv.tv_sec = TLS_SESSION_LIFETIME / 4;
1930 e5c598d0 2016-09-01 claudio evtimer_add(&rekeyev, &tv);
