2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4 * Copyright (c) 2012 The FreeBSD Foundation
6 * This software was developed by Edward Tomasz Napierala under sponsorship
7 * from the FreeBSD Foundation.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
35 #include <sys/types.h>
37 #include <sys/ioctl.h>
38 #include <sys/param.h>
39 #include <sys/linker.h>
40 #include <sys/socket.h>
41 #include <sys/capsicum.h>
43 #include <netinet/in.h>
45 #include <capsicum_helpers.h>
60 static volatile bool sigalrm_received = false;
62 static int nchildren = 0;
68 fprintf(stderr, "usage: iscsid [-P pidfile][-d][-m maxproc][-t timeout]\n");
73 checked_strdup(const char *s)
84 resolve_addr(const struct connection *conn, const char *address,
85 struct addrinfo **ai, bool initiator_side)
87 struct addrinfo hints;
88 char *arg, *addr, *ch;
90 int error, colons = 0;
92 arg = checked_strdup(address);
95 fail(conn, "empty address");
96 log_errx(1, "empty address");
100 * IPv6 address in square brackets, perhaps with port.
103 addr = strsep(&arg, "]");
105 fail(conn, "malformed address");
106 log_errx(1, "malformed address %s", address);
108 if (arg[0] == '\0') {
110 } else if (arg[0] == ':') {
113 fail(conn, "malformed address");
114 log_errx(1, "malformed address %s", address);
118 * Either IPv6 address without brackets - and without
119 * a port - or IPv4 address. Just count the colons.
121 for (ch = arg; *ch != '\0'; ch++) {
129 addr = strsep(&arg, ":");
137 if (port == NULL && !initiator_side)
140 memset(&hints, 0, sizeof(hints));
141 hints.ai_family = PF_UNSPEC;
142 hints.ai_socktype = SOCK_STREAM;
143 hints.ai_flags = AI_ADDRCONFIG | AI_NUMERICSERV;
145 hints.ai_flags |= AI_PASSIVE;
147 error = getaddrinfo(addr, port, &hints, ai);
149 fail(conn, gai_strerror(error));
150 log_errx(1, "getaddrinfo for %s failed: %s",
151 address, gai_strerror(error));
157 static struct connection *
158 connection_new(int iscsi_fd, const struct iscsi_daemon_request *request)
160 struct connection *conn;
161 struct iscsi_session_limits *isl;
162 struct addrinfo *from_ai, *to_ai;
163 const char *from_addr, *to_addr;
164 #ifdef ICL_KERNEL_PROXY
165 struct iscsi_daemon_connect idc;
169 conn = calloc(1, sizeof(*conn));
171 log_err(1, "calloc");
174 * Default values, from RFC 3720, section 12.
176 conn->conn_protocol_level = 0;
177 conn->conn_header_digest = CONN_DIGEST_NONE;
178 conn->conn_data_digest = CONN_DIGEST_NONE;
179 conn->conn_initial_r2t = true;
180 conn->conn_immediate_data = true;
181 conn->conn_max_recv_data_segment_length = 8192;
182 conn->conn_max_send_data_segment_length = 8192;
183 conn->conn_max_burst_length = 262144;
184 conn->conn_first_burst_length = 65536;
185 conn->conn_iscsi_fd = iscsi_fd;
187 conn->conn_session_id = request->idr_session_id;
188 memcpy(&conn->conn_conf, &request->idr_conf, sizeof(conn->conn_conf));
189 memcpy(&conn->conn_isid, &request->idr_isid, sizeof(conn->conn_isid));
190 conn->conn_tsih = request->idr_tsih;
193 * Read the driver limits and provide reasonable defaults for the ones
194 * the driver doesn't care about. If a max_snd_dsl is not explicitly
195 * provided by the driver then we'll make sure both conn->max_snd_dsl
196 * and isl->max_snd_dsl are set to the rcv_dsl. This preserves historic
199 isl = &conn->conn_limits;
200 memcpy(isl, &request->idr_limits, sizeof(*isl));
201 if (isl->isl_max_recv_data_segment_length == 0)
202 isl->isl_max_recv_data_segment_length = (1 << 24) - 1;
203 if (isl->isl_max_send_data_segment_length == 0)
204 isl->isl_max_send_data_segment_length =
205 isl->isl_max_recv_data_segment_length;
206 if (isl->isl_max_burst_length == 0)
207 isl->isl_max_burst_length = (1 << 24) - 1;
208 if (isl->isl_first_burst_length == 0)
209 isl->isl_first_burst_length = (1 << 24) - 1;
210 if (isl->isl_first_burst_length > isl->isl_max_burst_length)
211 isl->isl_first_burst_length = isl->isl_max_burst_length;
214 * Limit default send length in case it won't be negotiated.
215 * We can't do it for other limits, since they may affect both
216 * sender and receiver operation, and we must obey defaults.
218 if (conn->conn_max_send_data_segment_length >
219 isl->isl_max_send_data_segment_length) {
220 conn->conn_max_send_data_segment_length =
221 isl->isl_max_send_data_segment_length;
224 from_addr = conn->conn_conf.isc_initiator_addr;
225 to_addr = conn->conn_conf.isc_target_addr;
227 if (from_addr[0] != '\0')
228 resolve_addr(conn, from_addr, &from_ai, true);
232 resolve_addr(conn, to_addr, &to_ai, false);
234 #ifdef ICL_KERNEL_PROXY
235 if (conn->conn_conf.isc_iser) {
236 memset(&idc, 0, sizeof(idc));
237 idc.idc_session_id = conn->conn_session_id;
238 if (conn->conn_conf.isc_iser)
240 idc.idc_domain = to_ai->ai_family;
241 idc.idc_socktype = to_ai->ai_socktype;
242 idc.idc_protocol = to_ai->ai_protocol;
243 if (from_ai != NULL) {
244 idc.idc_from_addr = from_ai->ai_addr;
245 idc.idc_from_addrlen = from_ai->ai_addrlen;
247 idc.idc_to_addr = to_ai->ai_addr;
248 idc.idc_to_addrlen = to_ai->ai_addrlen;
250 log_debugx("connecting to %s using ICL kernel proxy", to_addr);
251 error = ioctl(iscsi_fd, ISCSIDCONNECT, &idc);
253 fail(conn, strerror(errno));
254 log_err(1, "failed to connect to %s "
255 "using ICL kernel proxy: ISCSIDCONNECT", to_addr);
259 freeaddrinfo(from_ai);
264 #endif /* ICL_KERNEL_PROXY */
266 if (conn->conn_conf.isc_iser) {
267 fail(conn, "iSER not supported");
268 log_errx(1, "iscsid(8) compiled without ICL_KERNEL_PROXY "
269 "does not support iSER");
272 conn->conn_socket = socket(to_ai->ai_family, to_ai->ai_socktype,
274 if (conn->conn_socket < 0) {
275 fail(conn, strerror(errno));
276 log_err(1, "failed to create socket for %s", from_addr);
278 sockbuf = SOCKBUF_SIZE;
279 if (setsockopt(conn->conn_socket, SOL_SOCKET, SO_RCVBUF,
280 &sockbuf, sizeof(sockbuf)) == -1)
281 log_warn("setsockopt(SO_RCVBUF) failed");
282 sockbuf = SOCKBUF_SIZE;
283 if (setsockopt(conn->conn_socket, SOL_SOCKET, SO_SNDBUF,
284 &sockbuf, sizeof(sockbuf)) == -1)
285 log_warn("setsockopt(SO_SNDBUF) failed");
286 if (conn->conn_conf.isc_dscp != -1) {
287 int tos = conn->conn_conf.isc_dscp << 2;
288 if (to_ai->ai_family == AF_INET) {
289 if (setsockopt(conn->conn_socket,
291 &tos, sizeof(tos)) == -1)
292 log_warn("setsockopt(IP_TOS) "
296 if (to_ai->ai_family == AF_INET6) {
297 if (setsockopt(conn->conn_socket,
298 IPPROTO_IPV6, IPV6_TCLASS,
299 &tos, sizeof(tos)) == -1)
300 log_warn("setsockopt(IPV6_TCLASS) "
305 if (conn->conn_conf.isc_pcp != -1) {
306 int pcp = conn->conn_conf.isc_pcp;
307 if (to_ai->ai_family == AF_INET) {
308 if (setsockopt(conn->conn_socket,
309 IPPROTO_IP, IP_VLAN_PCP,
310 &pcp, sizeof(pcp)) == -1)
311 log_warn("setsockopt(IP_VLAN_PCP) "
315 if (to_ai->ai_family == AF_INET6) {
316 if (setsockopt(conn->conn_socket,
317 IPPROTO_IPV6, IPV6_VLAN_PCP,
318 &pcp, sizeof(pcp)) == -1)
319 log_warn("setsockopt(IPV6_VLAN_PCP) "
324 if (from_ai != NULL) {
325 error = bind(conn->conn_socket, from_ai->ai_addr,
326 from_ai->ai_addrlen);
328 fail(conn, strerror(errno));
329 log_err(1, "failed to bind to %s", from_addr);
332 log_debugx("connecting to %s", to_addr);
333 error = connect(conn->conn_socket, to_ai->ai_addr, to_ai->ai_addrlen);
335 fail(conn, strerror(errno));
336 log_err(1, "failed to connect to %s", to_addr);
340 freeaddrinfo(from_ai);
347 handoff(struct connection *conn)
349 struct iscsi_daemon_handoff idh;
352 log_debugx("handing off connection to the kernel");
354 memset(&idh, 0, sizeof(idh));
355 idh.idh_session_id = conn->conn_session_id;
356 idh.idh_socket = conn->conn_socket;
357 strlcpy(idh.idh_target_alias, conn->conn_target_alias,
358 sizeof(idh.idh_target_alias));
359 idh.idh_tsih = conn->conn_tsih;
360 idh.idh_statsn = conn->conn_statsn;
361 idh.idh_protocol_level = conn->conn_protocol_level;
362 idh.idh_header_digest = conn->conn_header_digest;
363 idh.idh_data_digest = conn->conn_data_digest;
364 idh.idh_initial_r2t = conn->conn_initial_r2t;
365 idh.idh_immediate_data = conn->conn_immediate_data;
366 idh.idh_max_recv_data_segment_length =
367 conn->conn_max_recv_data_segment_length;
368 idh.idh_max_send_data_segment_length =
369 conn->conn_max_send_data_segment_length;
370 idh.idh_max_burst_length = conn->conn_max_burst_length;
371 idh.idh_first_burst_length = conn->conn_first_burst_length;
373 error = ioctl(conn->conn_iscsi_fd, ISCSIDHANDOFF, &idh);
375 log_err(1, "ISCSIDHANDOFF");
379 fail(const struct connection *conn, const char *reason)
381 struct iscsi_daemon_fail idf;
382 int error, saved_errno;
386 memset(&idf, 0, sizeof(idf));
387 idf.idf_session_id = conn->conn_session_id;
388 strlcpy(idf.idf_reason, reason, sizeof(idf.idf_reason));
390 error = ioctl(conn->conn_iscsi_fd, ISCSIDFAIL, &idf);
392 log_err(1, "ISCSIDFAIL");
398 * XXX: I CANT INTO LATIN
401 capsicate(struct connection *conn)
404 #ifdef ICL_KERNEL_PROXY
405 const unsigned long cmds[] = { ISCSIDCONNECT, ISCSIDSEND, ISCSIDRECEIVE,
406 ISCSIDHANDOFF, ISCSIDFAIL, ISCSISADD, ISCSISREMOVE, ISCSISMODIFY };
408 const unsigned long cmds[] = { ISCSIDHANDOFF, ISCSIDFAIL, ISCSISADD,
409 ISCSISREMOVE, ISCSISMODIFY };
412 cap_rights_init(&rights, CAP_IOCTL);
413 if (caph_rights_limit(conn->conn_iscsi_fd, &rights) < 0)
414 log_err(1, "cap_rights_limit");
416 if (caph_ioctls_limit(conn->conn_iscsi_fd, cmds, nitems(cmds)) < 0)
417 log_err(1, "cap_ioctls_limit");
419 if (caph_enter() != 0)
420 log_err(1, "cap_enter");
423 log_debugx("Capsicum capability mode enabled");
425 log_warnx("Capsicum capability mode not supported");
432 return (sigalrm_received);
436 sigalrm_handler(int dummy __unused)
439 * It would be easiest to just log an error and exit. We can't
440 * do this, though, because log_errx() is not signal safe, since
441 * it calls syslog(3). Instead, set a flag checked by pdu_send()
442 * and pdu_receive(), to call log_errx() there. Should they fail
443 * to notice, we'll exit here one second later.
445 if (sigalrm_received) {
447 * Oh well. Just give up and quit.
452 sigalrm_received = true;
456 set_timeout(int timeout)
459 struct itimerval itv;
463 log_debugx("session timeout disabled");
467 bzero(&sa, sizeof(sa));
468 sa.sa_handler = sigalrm_handler;
469 sigfillset(&sa.sa_mask);
470 error = sigaction(SIGALRM, &sa, NULL);
472 log_err(1, "sigaction");
475 * First SIGALRM will arive after conf_timeout seconds.
476 * If we do nothing, another one will arrive a second later.
478 bzero(&itv, sizeof(itv));
479 itv.it_interval.tv_sec = 1;
480 itv.it_value.tv_sec = timeout;
482 log_debugx("setting session timeout to %d seconds",
484 error = setitimer(ITIMER_REAL, &itv, NULL);
486 log_err(1, "setitimer");
490 sigchld_handler(int dummy __unused)
494 * The only purpose of this handler is to make SIGCHLD
495 * interrupt the ISCSIDWAIT ioctl(2), so we can call
496 * wait_for_children().
501 register_sigchld(void)
506 bzero(&sa, sizeof(sa));
507 sa.sa_handler = sigchld_handler;
508 sigfillset(&sa.sa_mask);
509 error = sigaction(SIGCHLD, &sa, NULL);
511 log_err(1, "sigaction");
516 handle_request(int iscsi_fd, const struct iscsi_daemon_request *request, int timeout)
518 struct connection *conn;
520 log_set_peer_addr(request->idr_conf.isc_target_addr);
521 if (request->idr_conf.isc_target[0] != '\0') {
522 log_set_peer_name(request->idr_conf.isc_target);
523 setproctitle("%s (%s)", request->idr_conf.isc_target_addr, request->idr_conf.isc_target);
525 setproctitle("%s", request->idr_conf.isc_target_addr);
528 conn = connection_new(iscsi_fd, request);
529 set_timeout(timeout);
532 if (conn->conn_conf.isc_discovery != 0)
537 log_debugx("nothing more to do; exiting");
542 wait_for_children(bool block)
550 * If "block" is true, wait for at least one process.
552 if (block && num == 0)
553 pid = wait4(-1, &status, 0, NULL);
555 pid = wait4(-1, &status, WNOHANG, NULL);
558 if (WIFSIGNALED(status)) {
559 log_warnx("child process %d terminated with signal %d",
560 pid, WTERMSIG(status));
561 } else if (WEXITSTATUS(status) != 0) {
562 log_warnx("child process %d terminated with exit status %d",
563 pid, WEXITSTATUS(status));
565 log_debugx("child process %d terminated gracefully", pid);
574 main(int argc, char **argv)
576 int ch, debug = 0, error, iscsi_fd, maxproc = 30, retval, saved_errno,
578 bool dont_daemonize = false;
581 const char *pidfile_path = DEFAULT_PIDFILE;
582 struct iscsi_daemon_request request;
584 while ((ch = getopt(argc, argv, "P:dl:m:t:")) != -1) {
587 pidfile_path = optarg;
590 dont_daemonize = true;
594 debug = atoi(optarg);
597 maxproc = atoi(optarg);
600 timeout = atoi(optarg);
613 pidfh = pidfile_open(pidfile_path, 0600, &otherpid);
616 log_errx(1, "daemon already running, pid: %jd.",
618 log_err(1, "cannot open or create pidfile \"%s\"",
622 iscsi_fd = open(ISCSI_PATH, O_RDWR);
623 if (iscsi_fd < 0 && errno == ENOENT) {
625 retval = kldload("iscsi");
627 iscsi_fd = open(ISCSI_PATH, O_RDWR);
632 log_err(1, "failed to open %s", ISCSI_PATH);
634 if (dont_daemonize == false) {
635 if (daemon(0, 0) == -1) {
636 log_warn("cannot daemonize");
637 pidfile_remove(pidfh);
642 pidfile_write(pidfh);
647 log_debugx("waiting for request from the kernel");
649 memset(&request, 0, sizeof(request));
650 error = ioctl(iscsi_fd, ISCSIDWAIT, &request);
652 if (errno == EINTR) {
653 nchildren -= wait_for_children(false);
654 assert(nchildren >= 0);
658 log_err(1, "ISCSIDWAIT");
661 if (dont_daemonize) {
662 log_debugx("not forking due to -d flag; "
663 "will exit after servicing a single request");
665 nchildren -= wait_for_children(false);
666 assert(nchildren >= 0);
668 while (maxproc > 0 && nchildren >= maxproc) {
669 log_debugx("maxproc limit of %d child processes hit; "
670 "waiting for child process to exit", maxproc);
671 nchildren -= wait_for_children(true);
672 assert(nchildren >= 0);
674 log_debugx("incoming connection; forking child process #%d",
685 pidfile_close(pidfh);
686 handle_request(iscsi_fd, &request, timeout);