usr.sbin/rtsold/rtsol.c

   1 /*      $KAME: rtsol.c,v 1.27 2003/10/05 00:09:36 itojun Exp $  */
   2
   3 /*
   4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   5  * Copyright (C) 2011 Hiroki Sato
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. Neither the name of the project nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  *
  32  * $FreeBSD$
  33  */
  34
  35 #include <sys/param.h>
  36 #include <sys/socket.h>
  37 #include <sys/uio.h>
  38 #include <sys/time.h>
  39 #include <sys/queue.h>
  40 #include <sys/wait.h>
  41 #include <sys/stat.h>
  42
  43 #include <net/if.h>
  44 #include <net/route.h>
  45 #include <net/if_dl.h>
  46
  47 #define __BSD_VISIBLE   1       /* IN6ADDR_LINKLOCAL_ALLROUTERS_INIT */
  48 #include <netinet/in.h>
  49 #undef  __BSD_VISIBLE
  50 #include <netinet/ip6.h>
  51 #include <netinet6/ip6_var.h>
  52 #include <netinet/icmp6.h>
  53
  54 #include <arpa/inet.h>
  55
  56 #include <netdb.h>
  57 #include <time.h>
  58 #include <fcntl.h>
  59 #include <unistd.h>
  60 #include <stdio.h>
  61 #include <err.h>
  62 #include <errno.h>
  63 #include <string.h>
  64 #include <stdlib.h>
  65 #include <syslog.h>
  66 #include "rtsold.h"
  67
  68 static struct msghdr rcvmhdr;
  69 static struct msghdr sndmhdr;
  70 static struct iovec rcviov[2];
  71 static struct iovec sndiov[2];
  72 static struct sockaddr_in6 from;
  73 static int rcvcmsglen;
  74
  75 int rssock;
  76 struct ifinfo_head_t ifinfo_head =
  77         TAILQ_HEAD_INITIALIZER(ifinfo_head);
  78
  79 static const struct sockaddr_in6 sin6_allrouters = {
  80         .sin6_len =     sizeof(sin6_allrouters),
  81         .sin6_family =  AF_INET6,
  82         .sin6_addr =    IN6ADDR_LINKLOCAL_ALLROUTERS_INIT,
  83 };
  84
  85 static void call_script(const int, const char *const *, void *);
  86 static size_t dname_labeldec(char *, size_t, const char *);
  87 static int safefile(const char *);
  88
  89 #define _ARGS_OTHER     otherconf_script, ifi->ifname
  90 #define _ARGS_RESADD    resolvconf_script, "-a", ifi->ifname
  91 #define _ARGS_RESDEL    resolvconf_script, "-d", ifi->ifname
  92
  93 #define CALL_SCRIPT(name, sm_head)                                      \
  94         do {                                                            \
  95                 const char *const sarg[] = { _ARGS_##name, NULL };      \
  96                 call_script(sizeof(sarg), sarg, sm_head);               \
  97         } while(0)
  98
  99 #define ELM_MALLOC(p,error_action)                                      \
 100         do {                                                            \
 101                 p = malloc(sizeof(*p));                                 \
 102                 if (p == NULL) {                                        \
 103                         warnmsg(LOG_ERR, __func__, "malloc failed: %s", \
 104                                 strerror(errno));                       \
 105                         error_action;                                   \
 106                 }                                                       \
 107                 memset(p, 0, sizeof(*p));                               \
 108         } while(0)
 109
 110 int
 111 sockopen(void)
 112 {
 113         static u_char *rcvcmsgbuf = NULL, *sndcmsgbuf = NULL;
 114         int sndcmsglen, on;
 115         static u_char answer[1500];
 116         struct icmp6_filter filt;
 117
 118         sndcmsglen = rcvcmsglen = CMSG_SPACE(sizeof(struct in6_pktinfo)) +
 119             CMSG_SPACE(sizeof(int));
 120         if (rcvcmsgbuf == NULL && (rcvcmsgbuf = malloc(rcvcmsglen)) == NULL) {
 121                 warnmsg(LOG_ERR, __func__,
 122                     "malloc for receive msghdr failed");
 123                 return (-1);
 124         }
 125         if (sndcmsgbuf == NULL && (sndcmsgbuf = malloc(sndcmsglen)) == NULL) {
 126                 warnmsg(LOG_ERR, __func__,
 127                     "malloc for send msghdr failed");
 128                 return (-1);
 129         }
 130         if ((rssock = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6)) < 0) {
 131                 warnmsg(LOG_ERR, __func__, "socket: %s", strerror(errno));
 132                 return (-1);
 133         }
 134
 135         /* specify to tell receiving interface */
 136         on = 1;
 137         if (setsockopt(rssock, IPPROTO_IPV6, IPV6_RECVPKTINFO, &on,
 138             sizeof(on)) < 0) {
 139                 warnmsg(LOG_ERR, __func__, "IPV6_RECVPKTINFO: %s",
 140                     strerror(errno));
 141                 exit(1);
 142         }
 143
 144         /* specify to tell value of hoplimit field of received IP6 hdr */
 145         on = 1;
 146         if (setsockopt(rssock, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &on,
 147             sizeof(on)) < 0) {
 148                 warnmsg(LOG_ERR, __func__, "IPV6_RECVHOPLIMIT: %s",
 149                     strerror(errno));
 150                 exit(1);
 151         }
 152
 153         /* specfiy to accept only router advertisements on the socket */
 154         ICMP6_FILTER_SETBLOCKALL(&filt);
 155         ICMP6_FILTER_SETPASS(ND_ROUTER_ADVERT, &filt);
 156         if (setsockopt(rssock, IPPROTO_ICMPV6, ICMP6_FILTER, &filt,
 157             sizeof(filt)) == -1) {
 158                 warnmsg(LOG_ERR, __func__, "setsockopt(ICMP6_FILTER): %s",
 159                     strerror(errno));
 160                 return(-1);
 161         }
 162
 163         /* initialize msghdr for receiving packets */
 164         rcviov[0].iov_base = (caddr_t)answer;
 165         rcviov[0].iov_len = sizeof(answer);
 166         rcvmhdr.msg_name = (caddr_t)&from;
 167         rcvmhdr.msg_iov = rcviov;
 168         rcvmhdr.msg_iovlen = 1;
 169         rcvmhdr.msg_control = (caddr_t) rcvcmsgbuf;
 170
 171         /* initialize msghdr for sending packets */
 172         sndmhdr.msg_namelen = sizeof(struct sockaddr_in6);
 173         sndmhdr.msg_iov = sndiov;
 174         sndmhdr.msg_iovlen = 1;
 175         sndmhdr.msg_control = (caddr_t)sndcmsgbuf;
 176         sndmhdr.msg_controllen = sndcmsglen;
 177
 178         return (rssock);
 179 }
 180
 181 void
 182 sendpacket(struct ifinfo *ifi)
 183 {
 184         struct in6_pktinfo *pi;
 185         struct cmsghdr *cm;
 186         int hoplimit = 255;
 187         ssize_t i;
 188         struct sockaddr_in6 dst;
 189
 190         dst = sin6_allrouters;
 191         dst.sin6_scope_id = ifi->linkid;
 192
 193         sndmhdr.msg_name = (caddr_t)&dst;
 194         sndmhdr.msg_iov[0].iov_base = (caddr_t)ifi->rs_data;
 195         sndmhdr.msg_iov[0].iov_len = ifi->rs_datalen;
 196
 197         cm = CMSG_FIRSTHDR(&sndmhdr);
 198         /* specify the outgoing interface */
 199         cm->cmsg_level = IPPROTO_IPV6;
 200         cm->cmsg_type = IPV6_PKTINFO;
 201         cm->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
 202         pi = (struct in6_pktinfo *)CMSG_DATA(cm);
 203         memset(&pi->ipi6_addr, 0, sizeof(pi->ipi6_addr));       /*XXX*/
 204         pi->ipi6_ifindex = ifi->sdl->sdl_index;
 205
 206         /* specify the hop limit of the packet */
 207         cm = CMSG_NXTHDR(&sndmhdr, cm);
 208         cm->cmsg_level = IPPROTO_IPV6;
 209         cm->cmsg_type = IPV6_HOPLIMIT;
 210         cm->cmsg_len = CMSG_LEN(sizeof(int));
 211         memcpy(CMSG_DATA(cm), &hoplimit, sizeof(int));
 212
 213         warnmsg(LOG_DEBUG, __func__,
 214             "send RS on %s, whose state is %d",
 215             ifi->ifname, ifi->state);
 216         i = sendmsg(rssock, &sndmhdr, 0);
 217         if (i < 0 || (size_t)i != ifi->rs_datalen) {
 218                 /*
 219                  * ENETDOWN is not so serious, especially when using several
 220                  * network cards on a mobile node. We ignore it.
 221                  */
 222                 if (errno != ENETDOWN || dflag > 0)
 223                         warnmsg(LOG_ERR, __func__, "sendmsg on %s: %s",
 224                             ifi->ifname, strerror(errno));
 225         }
 226
 227         /* update counter */
 228         ifi->probes++;
 229 }
 230
 231 void
 232 rtsol_input(int s)
 233 {
 234         u_char ntopbuf[INET6_ADDRSTRLEN], ifnamebuf[IFNAMSIZ];
 235         int l, ifindex = 0, *hlimp = NULL;
 236         ssize_t msglen;
 237         struct in6_pktinfo *pi = NULL;
 238         struct ifinfo *ifi = NULL;
 239         struct ra_opt *rao = NULL;
 240         struct icmp6_hdr *icp;
 241         struct nd_router_advert *nd_ra;
 242         struct cmsghdr *cm;
 243         char *raoptp;
 244         char *p;
 245         struct in6_addr *addr;
 246         struct nd_opt_hdr *ndo;
 247         struct nd_opt_rdnss *rdnss;
 248         struct nd_opt_dnssl *dnssl;
 249         size_t len;
 250         char nsbuf[INET6_ADDRSTRLEN + 1 + IFNAMSIZ + 1];
 251         char dname[NI_MAXHOST];
 252         struct timeval now;
 253         struct timeval lifetime;
 254
 255         /* get message.  namelen and controllen must always be initialized. */
 256         rcvmhdr.msg_namelen = sizeof(from);
 257         rcvmhdr.msg_controllen = rcvcmsglen;
 258         if ((msglen = recvmsg(s, &rcvmhdr, 0)) < 0) {
 259                 warnmsg(LOG_ERR, __func__, "recvmsg: %s", strerror(errno));
 260                 return;
 261         }
 262
 263         /* extract optional information via Advanced API */
 264         for (cm = (struct cmsghdr *)CMSG_FIRSTHDR(&rcvmhdr); cm;
 265             cm = (struct cmsghdr *)CMSG_NXTHDR(&rcvmhdr, cm)) {
 266                 if (cm->cmsg_level == IPPROTO_IPV6 &&
 267                     cm->cmsg_type == IPV6_PKTINFO &&
 268                     cm->cmsg_len == CMSG_LEN(sizeof(struct in6_pktinfo))) {
 269                         pi = (struct in6_pktinfo *)(CMSG_DATA(cm));
 270                         ifindex = pi->ipi6_ifindex;
 271                 }
 272                 if (cm->cmsg_level == IPPROTO_IPV6 &&
 273                     cm->cmsg_type == IPV6_HOPLIMIT &&
 274                     cm->cmsg_len == CMSG_LEN(sizeof(int)))
 275                         hlimp = (int *)CMSG_DATA(cm);
 276         }
 277
 278         if (ifindex == 0) {
 279                 warnmsg(LOG_ERR, __func__,
 280                     "failed to get receiving interface");
 281                 return;
 282         }
 283         if (hlimp == NULL) {
 284                 warnmsg(LOG_ERR, __func__,
 285                     "failed to get receiving hop limit");
 286                 return;
 287         }
 288
 289         if ((size_t)msglen < sizeof(struct nd_router_advert)) {
 290                 warnmsg(LOG_INFO, __func__,
 291                     "packet size(%zd) is too short", msglen);
 292                 return;
 293         }
 294
 295         icp = (struct icmp6_hdr *)rcvmhdr.msg_iov[0].iov_base;
 296
 297         if (icp->icmp6_type != ND_ROUTER_ADVERT) {
 298                 /*
 299                  * this should not happen because we configured a filter
 300                  * that only passes RAs on the receiving socket.
 301                  */
 302                 warnmsg(LOG_ERR, __func__,
 303                     "invalid icmp type(%d) from %s on %s", icp->icmp6_type,
 304                     inet_ntop(AF_INET6, &from.sin6_addr, ntopbuf,
 305                     INET6_ADDRSTRLEN),
 306                     if_indextoname(pi->ipi6_ifindex, ifnamebuf));
 307                 return;
 308         }
 309
 310         if (icp->icmp6_code != 0) {
 311                 warnmsg(LOG_INFO, __func__,
 312                     "invalid icmp code(%d) from %s on %s", icp->icmp6_code,
 313                     inet_ntop(AF_INET6, &from.sin6_addr, ntopbuf,
 314                     INET6_ADDRSTRLEN),
 315                     if_indextoname(pi->ipi6_ifindex, ifnamebuf));
 316                 return;
 317         }
 318
 319         if (*hlimp != 255) {
 320                 warnmsg(LOG_INFO, __func__,
 321                     "invalid RA with hop limit(%d) from %s on %s",
 322                     *hlimp,
 323                     inet_ntop(AF_INET6, &from.sin6_addr, ntopbuf,
 324                     INET6_ADDRSTRLEN),
 325                     if_indextoname(pi->ipi6_ifindex, ifnamebuf));
 326                 return;
 327         }
 328
 329         if (pi && !IN6_IS_ADDR_LINKLOCAL(&from.sin6_addr)) {
 330                 warnmsg(LOG_INFO, __func__,
 331                     "invalid RA with non link-local source from %s on %s",
 332                     inet_ntop(AF_INET6, &from.sin6_addr, ntopbuf,
 333                     INET6_ADDRSTRLEN),
 334                     if_indextoname(pi->ipi6_ifindex, ifnamebuf));
 335                 return;
 336         }
 337
 338         /* xxx: more validation? */
 339
 340         if ((ifi = find_ifinfo(pi->ipi6_ifindex)) == NULL) {
 341                 warnmsg(LOG_INFO, __func__,
 342                     "received RA from %s on an unexpected IF(%s)",
 343                     inet_ntop(AF_INET6, &from.sin6_addr, ntopbuf,
 344                     INET6_ADDRSTRLEN),
 345                     if_indextoname(pi->ipi6_ifindex, ifnamebuf));
 346                 return;
 347         }
 348
 349         warnmsg(LOG_DEBUG, __func__,
 350             "received RA from %s on %s, state is %d",
 351             inet_ntop(AF_INET6, &from.sin6_addr, ntopbuf, INET6_ADDRSTRLEN),
 352             ifi->ifname, ifi->state);
 353
 354         nd_ra = (struct nd_router_advert *)icp;
 355
 356         /*
 357          * Process the "O bit."
 358          * If the value of OtherConfigFlag changes from FALSE to TRUE, the
 359          * host should invoke the stateful autoconfiguration protocol,
 360          * requesting information.
 361          * [RFC 2462 Section 5.5.3]
 362          */
 363         if (((nd_ra->nd_ra_flags_reserved) & ND_RA_FLAG_OTHER) &&
 364             !ifi->otherconfig) {
 365                 warnmsg(LOG_DEBUG, __func__,
 366                     "OtherConfigFlag on %s is turned on", ifi->ifname);
 367                 ifi->otherconfig = 1;
 368                 CALL_SCRIPT(OTHER, NULL);
 369         }
 370
 371         /* Initialize ra_opt per-interface structure. */
 372         gettimeofday(&now, NULL);
 373         if (!TAILQ_EMPTY(&ifi->ifi_ra_opt))
 374                 while ((rao = TAILQ_FIRST(&ifi->ifi_ra_opt)) != NULL) {
 375                         if (rao->rao_msg != NULL)
 376                                 free(rao->rao_msg);
 377                         TAILQ_REMOVE(&ifi->ifi_ra_opt, rao, rao_next);
 378                         free(rao);
 379                 }
 380         else
 381                 TAILQ_INIT(&ifi->ifi_ra_opt);
 382
 383 #define RA_OPT_NEXT_HDR(x)      (struct nd_opt_hdr *)((char *)x + \
 384                                 (((struct nd_opt_hdr *)x)->nd_opt_len * 8))
 385
 386         /* Process RA options. */
 387         warnmsg(LOG_DEBUG, __func__, "Processing RA");
 388         raoptp = (char *)icp + sizeof(struct nd_router_advert);
 389         while (raoptp < (char *)icp + msglen) {
 390                 ndo = (struct nd_opt_hdr *)raoptp;
 391                 warnmsg(LOG_DEBUG, __func__, "ndo = %p", raoptp);
 392                 warnmsg(LOG_DEBUG, __func__, "ndo->nd_opt_type = %d",
 393                     ndo->nd_opt_type);
 394                 warnmsg(LOG_DEBUG, __func__, "ndo->nd_opt_len = %d",
 395                     ndo->nd_opt_len);
 396
 397                 switch (ndo->nd_opt_type) {
 398                 case ND_OPT_RDNSS:
 399                         rdnss = (struct nd_opt_rdnss *)raoptp;
 400
 401                         /* Optlen sanity check (Section 5.3.1 in RFC 6106) */
 402                         if (rdnss->nd_opt_rdnss_len < 3) {
 403                                 warnmsg(LOG_INFO, __func__,
 404                                         "too short RDNSS option"
 405                                         "in RA from %s was ignored.",
 406                                         inet_ntop(AF_INET6, &from.sin6_addr,
 407                                                   ntopbuf, INET6_ADDRSTRLEN));
 408                                 break;
 409                         }
 410
 411                         addr = (struct in6_addr *)(raoptp + sizeof(*rdnss));
 412                         while ((char *)addr < (char *)RA_OPT_NEXT_HDR(raoptp)) {
 413                                 if (inet_ntop(AF_INET6, addr, ntopbuf,
 414                                     INET6_ADDRSTRLEN) == NULL) {
 415                                         warnmsg(LOG_INFO, __func__,
 416                                             "an invalid address in RDNSS option"
 417                                             " in RA from %s was ignored.",
 418                                             inet_ntop(AF_INET6, &from.sin6_addr,
 419                                             ntopbuf, INET6_ADDRSTRLEN));
 420                                         addr++;
 421                                         continue;
 422                                 }
 423                                 if (IN6_IS_ADDR_LINKLOCAL(addr))
 424                                         /* XXX: % has to be escaped here */
 425                                         l = snprintf(nsbuf, sizeof(nsbuf),
 426                                             "%s%c%s", ntopbuf,
 427                                             SCOPE_DELIMITER,
 428                                             ifi->ifname);
 429                                 else
 430                                         l = snprintf(nsbuf, sizeof(nsbuf),
 431                                             "%s", ntopbuf);
 432                                 if (l < 0 || (size_t)l >= sizeof(nsbuf)) {
 433                                         warnmsg(LOG_ERR, __func__,
 434                                             "address copying error in "
 435                                             "RDNSS option: %d.", l);
 436                                         addr++;
 437                                         continue;
 438                                 }
 439                                 warnmsg(LOG_DEBUG, __func__, "nsbuf = %s",
 440                                     nsbuf);
 441
 442                                 ELM_MALLOC(rao, break);
 443                                 rao->rao_type = ndo->nd_opt_type;
 444                                 rao->rao_len = strlen(nsbuf);
 445                                 rao->rao_msg = strdup(nsbuf);
 446                                 if (rao->rao_msg == NULL) {
 447                                         warnmsg(LOG_ERR, __func__,
 448                                             "strdup failed: %s",
 449                                             strerror(errno));
 450                                         free(rao);
 451                                         addr++;
 452                                         continue;
 453                                 }
 454                                 /* Set expiration timer */
 455                                 memset(&rao->rao_expire, 0, sizeof(rao->rao_expire));
 456                                 memset(&lifetime, 0, sizeof(lifetime));
 457                                 lifetime.tv_sec = ntohl(rdnss->nd_opt_rdnss_lifetime);
 458                                 timeradd(&now, &lifetime, &rao->rao_expire);
 459
 460                                 TAILQ_INSERT_TAIL(&ifi->ifi_ra_opt, rao, rao_next);
 461                                 addr++;
 462                         }
 463                         break;
 464                 case ND_OPT_DNSSL:
 465                         dnssl = (struct nd_opt_dnssl *)raoptp;
 466
 467                         /* Optlen sanity check (Section 5.3.1 in RFC 6106) */
 468                         if (dnssl->nd_opt_dnssl_len < 2) {
 469                                 warnmsg(LOG_INFO, __func__,
 470                                         "too short DNSSL option"
 471                                         "in RA from %s was ignored.",
 472                                         inet_ntop(AF_INET6, &from.sin6_addr,
 473                                                   ntopbuf, INET6_ADDRSTRLEN));
 474                                 break;
 475                         }
 476
 477                         /*
 478                          * Ensure NUL-termination in DNSSL in case of
 479                          * malformed field.
 480                          */
 481                         p = (char *)RA_OPT_NEXT_HDR(raoptp);
 482                         *(p - 1) = '\0';
 483
 484                         p = raoptp + sizeof(*dnssl);
 485                         while (1 < (len = dname_labeldec(dname, sizeof(dname),
 486                             p))) {
 487                                 /* length == 1 means empty string */
 488                                 warnmsg(LOG_DEBUG, __func__, "dname = %s",
 489                                     dname);
 490
 491                                 ELM_MALLOC(rao, break);
 492                                 rao->rao_type = ndo->nd_opt_type;
 493                                 rao->rao_len = strlen(dname);
 494                                 rao->rao_msg = strdup(dname);
 495                                 if (rao->rao_msg == NULL) {
 496                                         warnmsg(LOG_ERR, __func__,
 497                                             "strdup failed: %s",
 498                                             strerror(errno));
 499                                         free(rao);
 500                                         break;
 501                                 }
 502                                 /* Set expiration timer */
 503                                 memset(&rao->rao_expire, 0, sizeof(rao->rao_expire));
 504                                 memset(&lifetime, 0, sizeof(lifetime));
 505                                 lifetime.tv_sec = ntohl(dnssl->nd_opt_dnssl_lifetime);
 506                                 timeradd(&now, &lifetime, &rao->rao_expire);
 507
 508                                 TAILQ_INSERT_TAIL(&ifi->ifi_ra_opt, rao, rao_next);
 509                                 p += len;
 510                         }
 511                         break;
 512                 default:
 513                         /* nothing to do for other options */
 514                         break;
 515                 }
 516                 raoptp = (char *)RA_OPT_NEXT_HDR(raoptp);
 517         }
 518         ra_opt_handler(ifi);
 519         ifi->racnt++;
 520
 521         switch (ifi->state) {
 522         case IFS_IDLE:          /* should be ignored */
 523         case IFS_DELAY:         /* right? */
 524                 break;
 525         case IFS_PROBE:
 526                 ifi->state = IFS_IDLE;
 527                 ifi->probes = 0;
 528                 rtsol_timer_update(ifi);
 529                 break;
 530         }
 531 }
 532
 533 static char resstr_ns_prefix[] = "nameserver ";
 534 static char resstr_sh_prefix[] = "search ";
 535 static char resstr_nl[] = "\n";
 536 static char resstr_sp[] = " ";
 537
 538 int
 539 ra_opt_handler(struct ifinfo *ifi)
 540 {
 541         struct ra_opt *rao;
 542         struct script_msg *smp1, *smp2, *smp3;
 543         struct timeval now;
 544         TAILQ_HEAD(, script_msg) sm_rdnss_head =
 545                 TAILQ_HEAD_INITIALIZER(sm_rdnss_head);
 546         TAILQ_HEAD(, script_msg) sm_dnssl_head =
 547                 TAILQ_HEAD_INITIALIZER(sm_dnssl_head);
 548         int dcount, dlen;
 549
 550         dcount = 0;
 551         dlen = strlen(resstr_sh_prefix) + strlen(resstr_nl);
 552         gettimeofday(&now, NULL);
 553         TAILQ_FOREACH(rao, &ifi->ifi_ra_opt, rao_next) {
 554                 switch (rao->rao_type) {
 555                 case ND_OPT_RDNSS:
 556                         if (timercmp(&now, &rao->rao_expire, >)) {
 557                                 warnmsg(LOG_INFO, __func__,
 558                                         "expired rdnss entry: %s",
 559                                         (char *)rao->rao_msg);
 560                                 break;
 561                         }
 562                         ELM_MALLOC(smp1, continue);
 563                         ELM_MALLOC(smp2, goto free1);
 564                         ELM_MALLOC(smp3, goto free2);
 565                         smp1->sm_msg = resstr_ns_prefix;
 566                         TAILQ_INSERT_TAIL(&sm_rdnss_head, smp1, sm_next);
 567                         smp2->sm_msg = rao->rao_msg;
 568                         TAILQ_INSERT_TAIL(&sm_rdnss_head, smp2, sm_next);
 569                         smp3->sm_msg = resstr_nl;
 570                         TAILQ_INSERT_TAIL(&sm_rdnss_head, smp3, sm_next);
 571
 572                         break;
 573                 case ND_OPT_DNSSL:
 574                         if (timercmp(&now, &rao->rao_expire, >)) {
 575                                 warnmsg(LOG_INFO, __func__,
 576                                         "expired dnssl entry: %s",
 577                                         (char *)rao->rao_msg);
 578                                 break;
 579                         }
 580                         dcount++;
 581                         /* Check resolv.conf(5) restrictions. */
 582                         if (dcount > 6) {
 583                                 warnmsg(LOG_INFO, __func__,
 584                                     "dnssl entry exceeding maximum count (%d>6)"
 585                                     ": %s", dcount, (char *)rao->rao_msg);
 586                                 break;
 587                         }
 588                         if (256 < dlen + strlen(rao->rao_msg) +
 589                             strlen(resstr_sp)) {
 590                                 warnmsg(LOG_INFO, __func__,
 591                                     "dnssl entry exceeding maximum length "
 592                                     "(>256): %s", (char *)rao->rao_msg);
 593                                 break;
 594                         }
 595                         ELM_MALLOC(smp1, continue);
 596                         ELM_MALLOC(smp2, goto free1);
 597                         if (TAILQ_EMPTY(&sm_dnssl_head)) {
 598                                 ELM_MALLOC(smp3, goto free2);
 599                                 smp3->sm_msg = resstr_sh_prefix;
 600                                 TAILQ_INSERT_TAIL(&sm_dnssl_head, smp3,
 601                                     sm_next);
 602                         }
 603                         smp1->sm_msg = rao->rao_msg;
 604                         TAILQ_INSERT_TAIL(&sm_dnssl_head, smp1, sm_next);
 605                         smp2->sm_msg = resstr_sp;
 606                         TAILQ_INSERT_TAIL(&sm_dnssl_head, smp2, sm_next);
 607                         dlen += strlen(rao->rao_msg) + strlen(resstr_sp);
 608                         break;
 609                 default:
 610                         break;
 611                 }
 612                 continue;
 613 free2:
 614                 free(smp2);
 615 free1:
 616                 free(smp1);
 617         }
 618         /* Add \n for DNSSL list. */
 619         if (!TAILQ_EMPTY(&sm_dnssl_head)) {
 620                 ELM_MALLOC(smp1, goto ra_opt_handler_freeit);
 621                 smp1->sm_msg = resstr_nl;
 622                 TAILQ_INSERT_TAIL(&sm_dnssl_head, smp1, sm_next);
 623         }
 624         TAILQ_CONCAT(&sm_rdnss_head, &sm_dnssl_head, sm_next);
 625
 626         if (!TAILQ_EMPTY(&sm_rdnss_head))
 627                 CALL_SCRIPT(RESADD, &sm_rdnss_head);
 628         else
 629                 CALL_SCRIPT(RESDEL, NULL);
 630
 631 ra_opt_handler_freeit:
 632         /* Clear script message queue. */
 633         if (!TAILQ_EMPTY(&sm_rdnss_head)) {
 634                 while ((smp1 = TAILQ_FIRST(&sm_rdnss_head)) != NULL) {
 635                         TAILQ_REMOVE(&sm_rdnss_head, smp1, sm_next);
 636                         free(smp1);
 637                 }
 638         }
 639         return (0);
 640 }
 641
 642 static void
 643 call_script(const int argc, const char *const argv[], void *head)
 644 {
 645         const char *scriptpath;
 646         int fd[2];
 647         int error;
 648         pid_t pid, wpid;
 649         TAILQ_HEAD(, script_msg) *sm_head;
 650
 651         if ((scriptpath = argv[0]) == NULL)
 652                 return;
 653
 654         fd[0] = fd[1] = -1;
 655         sm_head = head;
 656         if (sm_head != NULL && !TAILQ_EMPTY(sm_head)) {
 657                 error = pipe(fd);
 658                 if (error) {
 659                         warnmsg(LOG_ERR, __func__,
 660                             "failed to create a pipe: %s", strerror(errno));
 661                         return;
 662                 }
 663         }
 664
 665         /* launch the script */
 666         pid = fork();
 667         if (pid < 0) {
 668                 warnmsg(LOG_ERR, __func__,
 669                     "failed to fork: %s", strerror(errno));
 670                 return;
 671         } else if (pid) {       /* parent */
 672                 int wstatus;
 673
 674                 if (fd[0] != -1) {      /* Send message to the child if any. */
 675                         ssize_t len;
 676                         struct script_msg *smp;
 677
 678                         close(fd[0]);
 679                         TAILQ_FOREACH(smp, sm_head, sm_next) {
 680                                 len = strlen(smp->sm_msg);
 681                                 warnmsg(LOG_DEBUG, __func__,
 682                                     "write to child = %s(%zd)",
 683                                     smp->sm_msg, len);
 684                                 if (write(fd[1], smp->sm_msg, len) != len) {
 685                                         warnmsg(LOG_ERR, __func__,
 686                                             "write to child failed: %s",
 687                                             strerror(errno));
 688                                         break;
 689                                 }
 690                         }
 691                         close(fd[1]);
 692                 }
 693                 do {
 694                         wpid = wait(&wstatus);
 695                 } while (wpid != pid && wpid > 0);
 696
 697                 if (wpid < 0)
 698                         warnmsg(LOG_ERR, __func__,
 699                             "wait: %s", strerror(errno));
 700                 else
 701                         warnmsg(LOG_DEBUG, __func__,
 702                             "script \"%s\" terminated", scriptpath);
 703         } else {                /* child */
 704                 int nullfd;
 705                 char **_argv;
 706
 707                 if (safefile(scriptpath)) {
 708                         warnmsg(LOG_ERR, __func__,
 709                             "script \"%s\" cannot be executed safely",
 710                             scriptpath);
 711                         exit(1);
 712                 }
 713                 nullfd = open("/dev/null", O_RDWR);
 714                 if (nullfd < 0) {
 715                         warnmsg(LOG_ERR, __func__,
 716                             "open /dev/null: %s", strerror(errno));
 717                         exit(1);
 718                 }
 719                 if (fd[0] != -1) {      /* Receive message from STDIN if any. */
 720                         close(fd[1]);
 721                         if (fd[0] != STDIN_FILENO) {
 722                                 /* Connect a pipe read-end to child's STDIN. */
 723                                 if (dup2(fd[0], STDIN_FILENO) != STDIN_FILENO) {
 724                                         warnmsg(LOG_ERR, __func__,
 725                                             "dup2 STDIN: %s", strerror(errno));
 726                                         exit(1);
 727                                 }
 728                                 close(fd[0]);
 729                         }
 730                 } else
 731                         dup2(nullfd, STDIN_FILENO);
 732
 733                 dup2(nullfd, STDOUT_FILENO);
 734                 dup2(nullfd, STDERR_FILENO);
 735                 if (nullfd > STDERR_FILENO)
 736                         close(nullfd);
 737
 738                 _argv = malloc(sizeof(*_argv) * argc);
 739                 if (_argv == NULL) {
 740                         warnmsg(LOG_ERR, __func__,
 741                                 "malloc: %s", strerror(errno));
 742                         exit(1);
 743                 }
 744                 memcpy(_argv, argv, (size_t)argc);
 745                 execv(scriptpath, (char *const *)_argv);
 746                 warnmsg(LOG_ERR, __func__, "child: exec failed: %s",
 747                     strerror(errno));
 748                 exit(1);
 749         }
 750
 751         return;
 752 }
 753
 754 static int
 755 safefile(const char *path)
 756 {
 757         struct stat s;
 758         uid_t myuid;
 759
 760         /* no setuid */
 761         if (getuid() != geteuid()) {
 762                 warnmsg(LOG_NOTICE, __func__,
 763                     "setuid'ed execution not allowed\n");
 764                 return (-1);
 765         }
 766
 767         if (lstat(path, &s) != 0) {
 768                 warnmsg(LOG_NOTICE, __func__, "lstat failed: %s",
 769                     strerror(errno));
 770                 return (-1);
 771         }
 772
 773         /* the file must be owned by the running uid */
 774         myuid = getuid();
 775         if (s.st_uid != myuid) {
 776                 warnmsg(LOG_NOTICE, __func__,
 777                     "%s has invalid owner uid\n", path);
 778                 return (-1);
 779         }
 780
 781         switch (s.st_mode & S_IFMT) {
 782         case S_IFREG:
 783                 break;
 784         default:
 785                 warnmsg(LOG_NOTICE, __func__,
 786                     "%s is an invalid file type 0x%o\n",
 787                     path, (s.st_mode & S_IFMT));
 788                 return (-1);
 789         }
 790
 791         return (0);
 792 }
 793
 794 /* Decode domain name label encoding in RFC 1035 Section 3.1 */
 795 static size_t
 796 dname_labeldec(char *dst, size_t dlen, const char *src)
 797 {
 798         size_t len;
 799         const char *src_origin;
 800         const char *src_last;
 801         const char *dst_origin;
 802
 803         src_origin = src;
 804         src_last = strchr(src, '\0');
 805         dst_origin = dst;
 806         memset(dst, '\0', dlen);
 807         while (src && (len = (uint8_t)(*src++) & 0x3f) &&
 808             (src + len) <= src_last) {
 809                 if (dst != dst_origin)
 810                         *dst++ = '.';
 811                 warnmsg(LOG_DEBUG, __func__, "labellen = %zd", len);
 812                 memcpy(dst, src, len);
 813                 src += len;
 814                 dst += len;
 815         }
 816         *dst = '\0';
 817
 818         /*
 819          * XXX validate that domain name only contains valid characters
 820          * for two reasons: 1) correctness, 2) we do not want to pass
 821          * possible malicious, unescaped characters like `` to a script
 822          * or program that could be exploited that way.
 823          */
 824
 825         return (src - src_origin);
 826 }