]> git.proxmox.com Git - systemd.git/blob - src/socket-proxy/socket-proxyd.c
Enable seccomp support on powerpc, ppc64el, and s390x
[systemd.git] / src / socket-proxy / socket-proxyd.c
1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
2
3 /***
4 This file is part of systemd.
5
6 Copyright 2013 David Strauss
7
8 systemd is free software; you can redistribute it and/or modify it
9 under the terms of the GNU Lesser General Public License as published by
10 the Free Software Foundation; either version 2.1 of the License, or
11 (at your option) any later version.
12
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 Lesser General Public License for more details.
17
18 You should have received a copy of the GNU Lesser General Public License
19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
20 ***/
21
22 #include <errno.h>
23 #include <fcntl.h>
24 #include <getopt.h>
25 #include <netdb.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <string.h>
29 #include <sys/socket.h>
30 #include <sys/un.h>
31 #include <unistd.h>
32
33 #include "sd-daemon.h"
34 #include "sd-event.h"
35 #include "sd-resolve.h"
36
37 #include "alloc-util.h"
38 #include "fd-util.h"
39 #include "log.h"
40 #include "path-util.h"
41 #include "set.h"
42 #include "socket-util.h"
43 #include "string-util.h"
44 #include "util.h"
45
46 #define BUFFER_SIZE (256 * 1024)
47 #define CONNECTIONS_MAX 256
48
49 static const char *arg_remote_host = NULL;
50
51 typedef struct Context {
52 sd_event *event;
53 sd_resolve *resolve;
54
55 Set *listen;
56 Set *connections;
57 } Context;
58
59 typedef struct Connection {
60 Context *context;
61
62 int server_fd, client_fd;
63 int server_to_client_buffer[2]; /* a pipe */
64 int client_to_server_buffer[2]; /* a pipe */
65
66 size_t server_to_client_buffer_full, client_to_server_buffer_full;
67 size_t server_to_client_buffer_size, client_to_server_buffer_size;
68
69 sd_event_source *server_event_source, *client_event_source;
70
71 sd_resolve_query *resolve_query;
72 } Connection;
73
74 static void connection_free(Connection *c) {
75 assert(c);
76
77 if (c->context)
78 set_remove(c->context->connections, c);
79
80 sd_event_source_unref(c->server_event_source);
81 sd_event_source_unref(c->client_event_source);
82
83 safe_close(c->server_fd);
84 safe_close(c->client_fd);
85
86 safe_close_pair(c->server_to_client_buffer);
87 safe_close_pair(c->client_to_server_buffer);
88
89 sd_resolve_query_unref(c->resolve_query);
90
91 free(c);
92 }
93
94 static void context_free(Context *context) {
95 sd_event_source *es;
96 Connection *c;
97
98 assert(context);
99
100 while ((es = set_steal_first(context->listen)))
101 sd_event_source_unref(es);
102
103 while ((c = set_first(context->connections)))
104 connection_free(c);
105
106 set_free(context->listen);
107 set_free(context->connections);
108
109 sd_event_unref(context->event);
110 sd_resolve_unref(context->resolve);
111 }
112
113 static int connection_create_pipes(Connection *c, int buffer[2], size_t *sz) {
114 int r;
115
116 assert(c);
117 assert(buffer);
118 assert(sz);
119
120 if (buffer[0] >= 0)
121 return 0;
122
123 r = pipe2(buffer, O_CLOEXEC|O_NONBLOCK);
124 if (r < 0)
125 return log_error_errno(errno, "Failed to allocate pipe buffer: %m");
126
127 (void) fcntl(buffer[0], F_SETPIPE_SZ, BUFFER_SIZE);
128
129 r = fcntl(buffer[0], F_GETPIPE_SZ);
130 if (r < 0)
131 return log_error_errno(errno, "Failed to get pipe buffer size: %m");
132
133 assert(r > 0);
134 *sz = r;
135
136 return 0;
137 }
138
139 static int connection_shovel(
140 Connection *c,
141 int *from, int buffer[2], int *to,
142 size_t *full, size_t *sz,
143 sd_event_source **from_source, sd_event_source **to_source) {
144
145 bool shoveled;
146
147 assert(c);
148 assert(from);
149 assert(buffer);
150 assert(buffer[0] >= 0);
151 assert(buffer[1] >= 0);
152 assert(to);
153 assert(full);
154 assert(sz);
155 assert(from_source);
156 assert(to_source);
157
158 do {
159 ssize_t z;
160
161 shoveled = false;
162
163 if (*full < *sz && *from >= 0 && *to >= 0) {
164 z = splice(*from, NULL, buffer[1], NULL, *sz - *full, SPLICE_F_MOVE|SPLICE_F_NONBLOCK);
165 if (z > 0) {
166 *full += z;
167 shoveled = true;
168 } else if (z == 0 || errno == EPIPE || errno == ECONNRESET) {
169 *from_source = sd_event_source_unref(*from_source);
170 *from = safe_close(*from);
171 } else if (errno != EAGAIN && errno != EINTR)
172 return log_error_errno(errno, "Failed to splice: %m");
173 }
174
175 if (*full > 0 && *to >= 0) {
176 z = splice(buffer[0], NULL, *to, NULL, *full, SPLICE_F_MOVE|SPLICE_F_NONBLOCK);
177 if (z > 0) {
178 *full -= z;
179 shoveled = true;
180 } else if (z == 0 || errno == EPIPE || errno == ECONNRESET) {
181 *to_source = sd_event_source_unref(*to_source);
182 *to = safe_close(*to);
183 } else if (errno != EAGAIN && errno != EINTR)
184 return log_error_errno(errno, "Failed to splice: %m");
185 }
186 } while (shoveled);
187
188 return 0;
189 }
190
191 static int connection_enable_event_sources(Connection *c);
192
193 static int traffic_cb(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
194 Connection *c = userdata;
195 int r;
196
197 assert(s);
198 assert(fd >= 0);
199 assert(c);
200
201 r = connection_shovel(c,
202 &c->server_fd, c->server_to_client_buffer, &c->client_fd,
203 &c->server_to_client_buffer_full, &c->server_to_client_buffer_size,
204 &c->server_event_source, &c->client_event_source);
205 if (r < 0)
206 goto quit;
207
208 r = connection_shovel(c,
209 &c->client_fd, c->client_to_server_buffer, &c->server_fd,
210 &c->client_to_server_buffer_full, &c->client_to_server_buffer_size,
211 &c->client_event_source, &c->server_event_source);
212 if (r < 0)
213 goto quit;
214
215 /* EOF on both sides? */
216 if (c->server_fd == -1 && c->client_fd == -1)
217 goto quit;
218
219 /* Server closed, and all data written to client? */
220 if (c->server_fd == -1 && c->server_to_client_buffer_full <= 0)
221 goto quit;
222
223 /* Client closed, and all data written to server? */
224 if (c->client_fd == -1 && c->client_to_server_buffer_full <= 0)
225 goto quit;
226
227 r = connection_enable_event_sources(c);
228 if (r < 0)
229 goto quit;
230
231 return 1;
232
233 quit:
234 connection_free(c);
235 return 0; /* ignore errors, continue serving */
236 }
237
238 static int connection_enable_event_sources(Connection *c) {
239 uint32_t a = 0, b = 0;
240 int r;
241
242 assert(c);
243
244 if (c->server_to_client_buffer_full > 0)
245 b |= EPOLLOUT;
246 if (c->server_to_client_buffer_full < c->server_to_client_buffer_size)
247 a |= EPOLLIN;
248
249 if (c->client_to_server_buffer_full > 0)
250 a |= EPOLLOUT;
251 if (c->client_to_server_buffer_full < c->client_to_server_buffer_size)
252 b |= EPOLLIN;
253
254 if (c->server_event_source)
255 r = sd_event_source_set_io_events(c->server_event_source, a);
256 else if (c->server_fd >= 0)
257 r = sd_event_add_io(c->context->event, &c->server_event_source, c->server_fd, a, traffic_cb, c);
258 else
259 r = 0;
260
261 if (r < 0)
262 return log_error_errno(r, "Failed to set up server event source: %m");
263
264 if (c->client_event_source)
265 r = sd_event_source_set_io_events(c->client_event_source, b);
266 else if (c->client_fd >= 0)
267 r = sd_event_add_io(c->context->event, &c->client_event_source, c->client_fd, b, traffic_cb, c);
268 else
269 r = 0;
270
271 if (r < 0)
272 return log_error_errno(r, "Failed to set up client event source: %m");
273
274 return 0;
275 }
276
277 static int connection_complete(Connection *c) {
278 int r;
279
280 assert(c);
281
282 r = connection_create_pipes(c, c->server_to_client_buffer, &c->server_to_client_buffer_size);
283 if (r < 0)
284 goto fail;
285
286 r = connection_create_pipes(c, c->client_to_server_buffer, &c->client_to_server_buffer_size);
287 if (r < 0)
288 goto fail;
289
290 r = connection_enable_event_sources(c);
291 if (r < 0)
292 goto fail;
293
294 return 0;
295
296 fail:
297 connection_free(c);
298 return 0; /* ignore errors, continue serving */
299 }
300
301 static int connect_cb(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
302 Connection *c = userdata;
303 socklen_t solen;
304 int error, r;
305
306 assert(s);
307 assert(fd >= 0);
308 assert(c);
309
310 solen = sizeof(error);
311 r = getsockopt(fd, SOL_SOCKET, SO_ERROR, &error, &solen);
312 if (r < 0) {
313 log_error_errno(errno, "Failed to issue SO_ERROR: %m");
314 goto fail;
315 }
316
317 if (error != 0) {
318 log_error_errno(error, "Failed to connect to remote host: %m");
319 goto fail;
320 }
321
322 c->client_event_source = sd_event_source_unref(c->client_event_source);
323
324 return connection_complete(c);
325
326 fail:
327 connection_free(c);
328 return 0; /* ignore errors, continue serving */
329 }
330
331 static int connection_start(Connection *c, struct sockaddr *sa, socklen_t salen) {
332 int r;
333
334 assert(c);
335 assert(sa);
336 assert(salen);
337
338 c->client_fd = socket(sa->sa_family, SOCK_STREAM|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
339 if (c->client_fd < 0) {
340 log_error_errno(errno, "Failed to get remote socket: %m");
341 goto fail;
342 }
343
344 r = connect(c->client_fd, sa, salen);
345 if (r < 0) {
346 if (errno == EINPROGRESS) {
347 r = sd_event_add_io(c->context->event, &c->client_event_source, c->client_fd, EPOLLOUT, connect_cb, c);
348 if (r < 0) {
349 log_error_errno(r, "Failed to add connection socket: %m");
350 goto fail;
351 }
352
353 r = sd_event_source_set_enabled(c->client_event_source, SD_EVENT_ONESHOT);
354 if (r < 0) {
355 log_error_errno(r, "Failed to enable oneshot event source: %m");
356 goto fail;
357 }
358 } else {
359 log_error_errno(errno, "Failed to connect to remote host: %m");
360 goto fail;
361 }
362 } else {
363 r = connection_complete(c);
364 if (r < 0)
365 goto fail;
366 }
367
368 return 0;
369
370 fail:
371 connection_free(c);
372 return 0; /* ignore errors, continue serving */
373 }
374
375 static int resolve_cb(sd_resolve_query *q, int ret, const struct addrinfo *ai, void *userdata) {
376 Connection *c = userdata;
377
378 assert(q);
379 assert(c);
380
381 if (ret != 0) {
382 log_error("Failed to resolve host: %s", gai_strerror(ret));
383 goto fail;
384 }
385
386 c->resolve_query = sd_resolve_query_unref(c->resolve_query);
387
388 return connection_start(c, ai->ai_addr, ai->ai_addrlen);
389
390 fail:
391 connection_free(c);
392 return 0; /* ignore errors, continue serving */
393 }
394
395 static int resolve_remote(Connection *c) {
396
397 static const struct addrinfo hints = {
398 .ai_family = AF_UNSPEC,
399 .ai_socktype = SOCK_STREAM,
400 .ai_flags = AI_ADDRCONFIG
401 };
402
403 union sockaddr_union sa = {};
404 const char *node, *service;
405 socklen_t salen;
406 int r;
407
408 if (path_is_absolute(arg_remote_host)) {
409 sa.un.sun_family = AF_UNIX;
410 strncpy(sa.un.sun_path, arg_remote_host, sizeof(sa.un.sun_path)-1);
411 sa.un.sun_path[sizeof(sa.un.sun_path)-1] = 0;
412
413 salen = offsetof(union sockaddr_union, un.sun_path) + strlen(sa.un.sun_path);
414
415 return connection_start(c, &sa.sa, salen);
416 }
417
418 if (arg_remote_host[0] == '@') {
419 sa.un.sun_family = AF_UNIX;
420 sa.un.sun_path[0] = 0;
421 strncpy(sa.un.sun_path+1, arg_remote_host+1, sizeof(sa.un.sun_path)-2);
422 sa.un.sun_path[sizeof(sa.un.sun_path)-1] = 0;
423
424 salen = offsetof(union sockaddr_union, un.sun_path) + 1 + strlen(sa.un.sun_path + 1);
425
426 return connection_start(c, &sa.sa, salen);
427 }
428
429 service = strrchr(arg_remote_host, ':');
430 if (service) {
431 node = strndupa(arg_remote_host, service - arg_remote_host);
432 service ++;
433 } else {
434 node = arg_remote_host;
435 service = "80";
436 }
437
438 log_debug("Looking up address info for %s:%s", node, service);
439 r = sd_resolve_getaddrinfo(c->context->resolve, &c->resolve_query, node, service, &hints, resolve_cb, c);
440 if (r < 0) {
441 log_error_errno(r, "Failed to resolve remote host: %m");
442 goto fail;
443 }
444
445 return 0;
446
447 fail:
448 connection_free(c);
449 return 0; /* ignore errors, continue serving */
450 }
451
452 static int add_connection_socket(Context *context, int fd) {
453 Connection *c;
454 int r;
455
456 assert(context);
457 assert(fd >= 0);
458
459 if (set_size(context->connections) > CONNECTIONS_MAX) {
460 log_warning("Hit connection limit, refusing connection.");
461 safe_close(fd);
462 return 0;
463 }
464
465 r = set_ensure_allocated(&context->connections, NULL);
466 if (r < 0) {
467 log_oom();
468 return 0;
469 }
470
471 c = new0(Connection, 1);
472 if (!c) {
473 log_oom();
474 return 0;
475 }
476
477 c->context = context;
478 c->server_fd = fd;
479 c->client_fd = -1;
480 c->server_to_client_buffer[0] = c->server_to_client_buffer[1] = -1;
481 c->client_to_server_buffer[0] = c->client_to_server_buffer[1] = -1;
482
483 r = set_put(context->connections, c);
484 if (r < 0) {
485 free(c);
486 log_oom();
487 return 0;
488 }
489
490 return resolve_remote(c);
491 }
492
493 static int accept_cb(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
494 _cleanup_free_ char *peer = NULL;
495 Context *context = userdata;
496 int nfd = -1, r;
497
498 assert(s);
499 assert(fd >= 0);
500 assert(revents & EPOLLIN);
501 assert(context);
502
503 nfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK|SOCK_CLOEXEC);
504 if (nfd < 0) {
505 if (errno != -EAGAIN)
506 log_warning_errno(errno, "Failed to accept() socket: %m");
507 } else {
508 getpeername_pretty(nfd, &peer);
509 log_debug("New connection from %s", strna(peer));
510
511 r = add_connection_socket(context, nfd);
512 if (r < 0) {
513 log_error_errno(r, "Failed to accept connection, ignoring: %m");
514 safe_close(fd);
515 }
516 }
517
518 r = sd_event_source_set_enabled(s, SD_EVENT_ONESHOT);
519 if (r < 0) {
520 log_error_errno(r, "Error while re-enabling listener with ONESHOT: %m");
521 sd_event_exit(context->event, r);
522 return r;
523 }
524
525 return 1;
526 }
527
528 static int add_listen_socket(Context *context, int fd) {
529 sd_event_source *source;
530 int r;
531
532 assert(context);
533 assert(fd >= 0);
534
535 r = set_ensure_allocated(&context->listen, NULL);
536 if (r < 0) {
537 log_oom();
538 return r;
539 }
540
541 r = sd_is_socket(fd, 0, SOCK_STREAM, 1);
542 if (r < 0)
543 return log_error_errno(r, "Failed to determine socket type: %m");
544 if (r == 0) {
545 log_error("Passed in socket is not a stream socket.");
546 return -EINVAL;
547 }
548
549 r = fd_nonblock(fd, true);
550 if (r < 0)
551 return log_error_errno(r, "Failed to mark file descriptor non-blocking: %m");
552
553 r = sd_event_add_io(context->event, &source, fd, EPOLLIN, accept_cb, context);
554 if (r < 0)
555 return log_error_errno(r, "Failed to add event source: %m");
556
557 r = set_put(context->listen, source);
558 if (r < 0) {
559 log_error_errno(r, "Failed to add source to set: %m");
560 sd_event_source_unref(source);
561 return r;
562 }
563
564 /* Set the watcher to oneshot in case other processes are also
565 * watching to accept(). */
566 r = sd_event_source_set_enabled(source, SD_EVENT_ONESHOT);
567 if (r < 0)
568 return log_error_errno(r, "Failed to enable oneshot mode: %m");
569
570 return 0;
571 }
572
573 static void help(void) {
574 printf("%1$s [HOST:PORT]\n"
575 "%1$s [SOCKET]\n\n"
576 "Bidirectionally proxy local sockets to another (possibly remote) socket.\n\n"
577 " -h --help Show this help\n"
578 " --version Show package version\n",
579 program_invocation_short_name);
580 }
581
582 static int parse_argv(int argc, char *argv[]) {
583
584 enum {
585 ARG_VERSION = 0x100,
586 ARG_IGNORE_ENV
587 };
588
589 static const struct option options[] = {
590 { "help", no_argument, NULL, 'h' },
591 { "version", no_argument, NULL, ARG_VERSION },
592 {}
593 };
594
595 int c;
596
597 assert(argc >= 0);
598 assert(argv);
599
600 while ((c = getopt_long(argc, argv, "h", options, NULL)) >= 0)
601
602 switch (c) {
603
604 case 'h':
605 help();
606 return 0;
607
608 case ARG_VERSION:
609 return version();
610
611 case '?':
612 return -EINVAL;
613
614 default:
615 assert_not_reached("Unhandled option");
616 }
617
618 if (optind >= argc) {
619 log_error("Not enough parameters.");
620 return -EINVAL;
621 }
622
623 if (argc != optind+1) {
624 log_error("Too many parameters.");
625 return -EINVAL;
626 }
627
628 arg_remote_host = argv[optind];
629 return 1;
630 }
631
632 int main(int argc, char *argv[]) {
633 Context context = {};
634 int r, n, fd;
635
636 log_parse_environment();
637 log_open();
638
639 r = parse_argv(argc, argv);
640 if (r <= 0)
641 goto finish;
642
643 r = sd_event_default(&context.event);
644 if (r < 0) {
645 log_error_errno(r, "Failed to allocate event loop: %m");
646 goto finish;
647 }
648
649 r = sd_resolve_default(&context.resolve);
650 if (r < 0) {
651 log_error_errno(r, "Failed to allocate resolver: %m");
652 goto finish;
653 }
654
655 r = sd_resolve_attach_event(context.resolve, context.event, 0);
656 if (r < 0) {
657 log_error_errno(r, "Failed to attach resolver: %m");
658 goto finish;
659 }
660
661 sd_event_set_watchdog(context.event, true);
662
663 n = sd_listen_fds(1);
664 if (n < 0) {
665 log_error("Failed to receive sockets from parent.");
666 r = n;
667 goto finish;
668 } else if (n == 0) {
669 log_error("Didn't get any sockets passed in.");
670 r = -EINVAL;
671 goto finish;
672 }
673
674 for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + n; fd++) {
675 r = add_listen_socket(&context, fd);
676 if (r < 0)
677 goto finish;
678 }
679
680 r = sd_event_loop(context.event);
681 if (r < 0) {
682 log_error_errno(r, "Failed to run event loop: %m");
683 goto finish;
684 }
685
686 finish:
687 context_free(&context);
688
689 return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
690 }