blob: 1f7da504dfd5e2a1f8fda72b8d3d3d8f1453fc24 [file] [log] [blame]
/*
* SOCK_UNIX socket management
*
* Copyright 2000-2020 Willy Tarreau <w@1wt.eu>
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version
* 2 of the License, or (at your option) any later version.
*
*/
#include <ctype.h>
#include <errno.h>
#include <string.h>
#include <unistd.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/un.h>
#include <haproxy/api.h>
#include <haproxy/errors.h>
#include <haproxy/fd.h>
#include <haproxy/global.h>
#include <haproxy/listener.h>
#include <haproxy/receiver-t.h>
#include <haproxy/namespace.h>
#include <haproxy/sock.h>
#include <haproxy/sock_unix.h>
#include <haproxy/tools.h>
struct proto_fam proto_fam_unix = {
.name = "unix",
.sock_domain = PF_UNIX,
.sock_family = AF_UNIX,
.sock_addrlen = sizeof(struct sockaddr_un),
.l3_addrlen = sizeof(((struct sockaddr_un*)0)->sun_path),
.addrcmp = sock_unix_addrcmp,
.bind = sock_unix_bind_receiver,
.get_src = sock_get_src,
.get_dst = sock_get_dst,
};
/* PLEASE NOTE for functions below:
*
* The address family SHOULD always be checked. In some cases a function will
* be used in a situation where the address family is guaranteed (e.g. protocol
* definitions), so the test may be avoided. This special case must then be
* mentioned in the comment before the function definition.
*/
/* Compares two AF_UNIX sockaddr addresses. Returns 0 if they match or non-zero
* if they do not match. It also supports ABNS socket addresses (those starting
* with \0). For regular UNIX sockets however, this does explicitly support
* matching names ending exactly with .XXXXX.tmp which are newly bound sockets
* about to be replaced; this suffix is then ignored. Note that our UNIX socket
* paths are always zero-terminated.
*/
int sock_unix_addrcmp(const struct sockaddr_storage *a, const struct sockaddr_storage *b)
{
const struct sockaddr_un *au = (const struct sockaddr_un *)a;
const struct sockaddr_un *bu = (const struct sockaddr_un *)b;
int idx, dot, idx2;
if (a->ss_family != b->ss_family)
return -1;
if (a->ss_family != AF_UNIX)
return -1;
if (au->sun_path[0] != bu->sun_path[0])
return -1;
if (au->sun_path[0] == 0)
return memcmp(au->sun_path, bu->sun_path, sizeof(au->sun_path));
idx = 1; dot = 0;
while (au->sun_path[idx] == bu->sun_path[idx]) {
if (au->sun_path[idx] == 0)
return 0;
if (au->sun_path[idx] == '.')
dot = idx;
idx++;
}
/* Now we have a difference. It's OK if they are within or after a
* sequence of digits following a dot, and are followed by ".tmp".
*
* make sure to perform the check against tempname if the compared
* string is in "final" format (does not end with ".XXXX.tmp").
*
* Examples:
* /tmp/test matches with /tmp/test.1822.tmp
* /tmp/test.1822.tmp matches with /tmp/test.XXXX.tmp
*/
if (au->sun_path[idx] == 0 || bu->sun_path[idx] == 0) {
if (au->sun_path[idx] == '.' || bu->sun_path[idx] == '.')
dot = idx; /* try to match against temp path */
else
return -1; /* invalid temp path */
}
if (!dot)
return -1;
/* First, check in path "a" */
if (au->sun_path[idx] != 0) {
for (idx2 = dot + 1; idx2 && isdigit((unsigned char)au->sun_path[idx2]);)
idx2++;
if (strcmp(au->sun_path + idx2, ".tmp") != 0)
return -1;
}
/* Then check in path "b" */
if (bu->sun_path[idx] != 0) {
for (idx2 = dot + 1; idx2 && isdigit((unsigned char)bu->sun_path[idx2]); idx2++)
;
if (strcmp(bu->sun_path + idx2, ".tmp") != 0)
return -1;
}
/* OK that's a match */
return 0;
}
/* Binds receiver <rx>, and assigns rx->iocb and rx->owner as the callback and
* context, respectively, with ->bind_thread as the thread mask. Returns an
* error code made of ERR_* bits on failure or ERR_NONE on success. On failure,
* an error message may be passed into <errmsg>.
*/
int sock_unix_bind_receiver(struct receiver *rx, char **errmsg)
{
char tempname[MAXPATHLEN];
char backname[MAXPATHLEN];
struct sockaddr_un addr;
const char *path;
int maxpathlen;
int fd, err, ext, ret;
/* ensure we never return garbage */
if (errmsg)
*errmsg = 0;
err = ERR_NONE;
if (rx->flags & RX_F_BOUND)
return ERR_NONE;
if (rx->flags & RX_F_MUST_DUP) {
/* this is a secondary receiver that is an exact copy of a
* reference which must already be bound (or has failed).
* We'll try to dup() the other one's FD and take it. We
* try hard not to reconfigure the socket since it's shared.
*/
BUG_ON(!rx->shard_info);
if (!(rx->shard_info->ref->flags & RX_F_BOUND)) {
/* it's assumed that the first one has already reported
* the error, let's not spam with another one, and do
* not set ERR_ALERT.
*/
err |= ERR_RETRYABLE;
goto bind_ret_err;
}
/* taking the other one's FD will result in it being marked
* extern and being dup()ed. Let's mark the receiver as
* inherited so that it properly bypasses all second-stage
* setup and avoids being passed to new processes.
*/
rx->flags |= RX_F_INHERITED;
rx->fd = rx->shard_info->ref->fd;
}
/* if no FD was assigned yet, we'll have to either find a compatible
* one or create a new one.
*/
if (rx->fd == -1)
rx->fd = sock_find_compatible_fd(rx);
path = ((struct sockaddr_un *)&rx->addr)->sun_path;
maxpathlen = MIN(MAXPATHLEN, sizeof(addr.sun_path));
/* if the listener already has an fd assigned, then we were offered the
* fd by an external process (most likely the parent), and we don't want
* to create a new socket. However we still want to set a few flags on
* the socket.
*/
fd = rx->fd;
ext = (fd >= 0);
if (ext)
goto fd_ready;
if (path[0]) {
ret = snprintf(tempname, maxpathlen, "%s.%d.tmp", path, pid);
if (ret < 0 || ret >= sizeof(addr.sun_path)) {
err |= ERR_FATAL | ERR_ALERT;
memprintf(errmsg, "name too long for UNIX socket (limit usually 97)");
goto bind_return;
}
ret = snprintf(backname, maxpathlen, "%s.%d.bak", path, pid);
if (ret < 0 || ret >= maxpathlen) {
err |= ERR_FATAL | ERR_ALERT;
memprintf(errmsg, "name too long for UNIX socket (limit usually 97)");
goto bind_return;
}
/* 2. clean existing orphaned entries */
if (unlink(tempname) < 0 && errno != ENOENT) {
err |= ERR_FATAL | ERR_ALERT;
memprintf(errmsg, "error when trying to unlink previous UNIX socket (%s)", strerror(errno));
goto bind_return;
}
if (unlink(backname) < 0 && errno != ENOENT) {
err |= ERR_FATAL | ERR_ALERT;
memprintf(errmsg, "error when trying to unlink previous UNIX socket (%s)", strerror(errno));
goto bind_return;
}
/* 3. backup existing socket */
if (link(path, backname) < 0 && errno != ENOENT) {
err |= ERR_FATAL | ERR_ALERT;
memprintf(errmsg, "error when trying to preserve previous UNIX socket (%s)", strerror(errno));
goto bind_return;
}
/* Note: this test is redundant with the snprintf one above and
* will never trigger, it's just added as the only way to shut
* gcc's painfully dumb warning about possibly truncated output
* during strncpy(). Don't move it above or smart gcc will not
* see it!
*/
if (strlen(tempname) >= sizeof(addr.sun_path)) {
err |= ERR_FATAL | ERR_ALERT;
memprintf(errmsg, "name too long for UNIX socket (limit usually 97)");
goto bind_return;
}
strncpy(addr.sun_path, tempname, sizeof(addr.sun_path) - 1);
addr.sun_path[sizeof(addr.sun_path) - 1] = 0;
}
else {
/* first char is zero, it's an abstract socket whose address
* is defined by all the bytes past this zero.
*/
memcpy(addr.sun_path, path, sizeof(addr.sun_path));
}
addr.sun_family = AF_UNIX;
/* WT: shouldn't we use my_socketat(rx->netns) here instead ? */
fd = socket(rx->proto->fam->sock_domain, rx->proto->sock_type, rx->proto->sock_prot);
if (fd < 0) {
err |= ERR_FATAL | ERR_ALERT;
memprintf(errmsg, "cannot create receiving socket (%s)", strerror(errno));
goto bind_return;
}
fd_ready:
if (ext && fd < global.maxsock && fdtab[fd].owner) {
/* This FD was already bound so this means that it was already
* known and registered before parsing, hence it's an inherited
* FD. The only reason why it's already known here is that it
* has been registered multiple times (multiple listeners on the
* same, or a "shards" directive on the line). There cannot be
* multiple listeners on one FD but at least we can create a
* new one from the original one. We won't reconfigure it,
* however, as this was already done for the first one.
*/
fd = dup(fd);
if (fd == -1) {
err |= ERR_RETRYABLE | ERR_ALERT;
memprintf(errmsg, "cannot dup() receiving socket (%s)", strerror(errno));
goto bind_return;
}
}
if (fd >= global.maxsock) {
err |= ERR_FATAL | ERR_ABORT | ERR_ALERT;
memprintf(errmsg, "not enough free sockets (raise '-n' parameter)");
goto bind_close_return;
}
if (fd_set_nonblock(fd) == -1) {
err |= ERR_FATAL | ERR_ALERT;
memprintf(errmsg, "cannot make socket non-blocking");
goto bind_close_return;
}
if (!ext && bind(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
/* note that bind() creates the socket <tempname> on the file system */
if (errno == EADDRINUSE) {
/* the old process might still own it, let's retry */
err |= ERR_RETRYABLE | ERR_ALERT;
memprintf(errmsg, "cannot bind UNIX socket (already in use)");
goto bind_close_return;
}
else {
err |= ERR_FATAL | ERR_ALERT;
memprintf(errmsg, "cannot bind UNIX socket (%s)", strerror(errno));
goto bind_close_return;
}
}
/* <uid> and <gid> different of -1 will be used to change the socket owner.
* If <mode> is not 0, it will be used to restrict access to the socket.
* While it is known not to be portable on every OS, it's still useful
* where it works. We also don't change permissions on abstract sockets.
*/
if (!ext && path[0] &&
(((rx->settings->ux.uid != -1 || rx->settings->ux.gid != -1) &&
(chown(tempname, rx->settings->ux.uid, rx->settings->ux.gid) == -1)) ||
(rx->settings->ux.mode != 0 && chmod(tempname, rx->settings->ux.mode) == -1))) {
err |= ERR_FATAL | ERR_ALERT;
memprintf(errmsg, "cannot change UNIX socket ownership (%s)", strerror(errno));
goto err_unlink_temp;
}
/* Point of no return: we are ready, we'll switch the sockets. We don't
* fear losing the socket <path> because we have a copy of it in
* backname. Abstract sockets are not renamed.
*/
if (!ext && path[0] && rename(tempname, path) < 0) {
err |= ERR_FATAL | ERR_ALERT;
memprintf(errmsg, "cannot switch final and temporary UNIX sockets (%s)", strerror(errno));
goto err_rename;
}
/* Cleanup: only unlink if we didn't inherit the fd from the parent */
if (!ext && path[0])
unlink(backname);
rx->fd = fd;
rx->flags |= RX_F_BOUND;
fd_insert(fd, rx->owner, rx->iocb, rx->bind_tgroup, rx->bind_thread);
/* for now, all regularly bound TCP listeners are exportable */
if (!(rx->flags & RX_F_INHERITED))
HA_ATOMIC_OR(&fdtab[fd].state, FD_EXPORTED);
return err;
err_rename:
ret = rename(backname, path);
if (ret < 0 && errno == ENOENT)
unlink(path);
err_unlink_temp:
if (!ext && path[0])
unlink(tempname);
close(fd);
err_unlink_back:
if (!ext && path[0])
unlink(backname);
bind_return:
if (errmsg && *errmsg) {
if (!ext) {
char *path_str;
path_str = sa2str((struct sockaddr_storage *)&rx->addr, 0, 0);
memprintf(errmsg, "%s [%s]", *errmsg, ((path_str) ? path_str : ""));
ha_free(&path_str);
}
else
memprintf(errmsg, "%s [fd %d]", *errmsg, fd);
}
bind_ret_err:
return err;
bind_close_return:
close(fd);
goto bind_return;
}