usr.sbin/rtsold/rtsol.c

   1 /*      $KAME: rtsol.c,v 1.27 2003/10/05 00:09:36 itojun Exp $  */
   2
   3 /*-
   4  * SPDX-License-Identifier: BSD-3-Clause
   5  *
   6  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   7  * Copyright (C) 2011 Hiroki Sato
   8  * All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  * 3. Neither the name of the project nor the names of its contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  *
  34  * $FreeBSD$
  35  */
  36
  37 #include <sys/param.h>
  38 #include <sys/socket.h>
  39 #include <sys/uio.h>
  40 #include <sys/queue.h>
  41 #include <sys/wait.h>
  42 #include <sys/stat.h>
  43
  44 #include <net/if.h>
  45 #include <net/route.h>
  46 #include <net/if_dl.h>
  47
  48 #define __BSD_VISIBLE   1       /* IN6ADDR_LINKLOCAL_ALLROUTERS_INIT */
  49 #include <netinet/in.h>
  50 #undef  __BSD_VISIBLE
  51 #include <netinet/ip6.h>
  52 #include <netinet6/ip6_var.h>
  53 #include <netinet/icmp6.h>
  54
  55 #include <arpa/inet.h>
  56
  57 #include <netdb.h>
  58 #include <time.h>
  59 #include <fcntl.h>
  60 #include <unistd.h>
  61 #include <stdio.h>
  62 #include <time.h>
  63 #include <err.h>
  64 #include <errno.h>
  65 #include <string.h>
  66 #include <stdlib.h>
  67 #include <syslog.h>
  68 #include "rtsold.h"
  69
  70 static struct msghdr rcvmhdr;
  71 static struct msghdr sndmhdr;
  72 static struct iovec rcviov[2];
  73 static struct iovec sndiov[2];
  74 static struct sockaddr_in6 from;
  75 static int rcvcmsglen;
  76
  77 int rssock;
  78 static char rsid[IFNAMSIZ + 1 + sizeof(DNSINFO_ORIGIN_LABEL) + 1 + NI_MAXHOST];
  79 struct ifinfo_head_t ifinfo_head =
  80         TAILQ_HEAD_INITIALIZER(ifinfo_head);
  81
  82 static const struct sockaddr_in6 sin6_allrouters = {
  83         .sin6_len =     sizeof(sin6_allrouters),
  84         .sin6_family =  AF_INET6,
  85         .sin6_addr =    IN6ADDR_LINKLOCAL_ALLROUTERS_INIT,
  86 };
  87
  88 static void call_script(const int, const char *const *,
  89     struct script_msg_head_t *);
  90 static size_t dname_labeldec(char *, size_t, const char *);
  91 static int safefile(const char *);
  92 static struct ra_opt *find_raopt(struct rainfo *, int, void *, size_t);
  93 static int ra_opt_rdnss_dispatch(struct ifinfo *, struct rainfo *,
  94     struct script_msg_head_t *, struct script_msg_head_t *);
  95 static char *make_rsid(const char *, const char *, struct rainfo *);
  96
  97 #define _ARGS_OTHER     otherconf_script, ifi->ifname
  98 #define _ARGS_RESADD    resolvconf_script, "-a", rsid
  99 #define _ARGS_RESDEL    resolvconf_script, "-d", rsid
 100
 101 #define CALL_SCRIPT(name, sm_head)                                      \
 102         do {                                                            \
 103                 const char *const sarg[] = { _ARGS_##name, NULL };      \
 104                 call_script(sizeof(sarg), sarg, sm_head);               \
 105         } while(0)
 106
 107 #define ELM_MALLOC(p,error_action)                                      \
 108         do {                                                            \
 109                 p = malloc(sizeof(*p));                                 \
 110                 if (p == NULL) {                                        \
 111                         warnmsg(LOG_ERR, __func__, "malloc failed: %s", \
 112                                 strerror(errno));                       \
 113                         error_action;                                   \
 114                 }                                                       \
 115                 memset(p, 0, sizeof(*p));                               \
 116         } while(0)
 117
 118 int
 119 sockopen(void)
 120 {
 121         static u_char *rcvcmsgbuf = NULL, *sndcmsgbuf = NULL;
 122         int sndcmsglen, on;
 123         static u_char answer[1500];
 124         struct icmp6_filter filt;
 125
 126         sndcmsglen = rcvcmsglen = CMSG_SPACE(sizeof(struct in6_pktinfo)) +
 127             CMSG_SPACE(sizeof(int));
 128         if (rcvcmsgbuf == NULL && (rcvcmsgbuf = malloc(rcvcmsglen)) == NULL) {
 129                 warnmsg(LOG_ERR, __func__,
 130                     "malloc for receive msghdr failed");
 131                 return (-1);
 132         }
 133         if (sndcmsgbuf == NULL && (sndcmsgbuf = malloc(sndcmsglen)) == NULL) {
 134                 warnmsg(LOG_ERR, __func__,
 135                     "malloc for send msghdr failed");
 136                 return (-1);
 137         }
 138         if ((rssock = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6)) < 0) {
 139                 warnmsg(LOG_ERR, __func__, "socket: %s", strerror(errno));
 140                 return (-1);
 141         }
 142
 143         /* specify to tell receiving interface */
 144         on = 1;
 145         if (setsockopt(rssock, IPPROTO_IPV6, IPV6_RECVPKTINFO, &on,
 146             sizeof(on)) < 0) {
 147                 warnmsg(LOG_ERR, __func__, "IPV6_RECVPKTINFO: %s",
 148                     strerror(errno));
 149                 exit(1);
 150         }
 151
 152         /* specify to tell value of hoplimit field of received IP6 hdr */
 153         on = 1;
 154         if (setsockopt(rssock, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &on,
 155             sizeof(on)) < 0) {
 156                 warnmsg(LOG_ERR, __func__, "IPV6_RECVHOPLIMIT: %s",
 157                     strerror(errno));
 158                 exit(1);
 159         }
 160
 161         /* specfiy to accept only router advertisements on the socket */
 162         ICMP6_FILTER_SETBLOCKALL(&filt);
 163         ICMP6_FILTER_SETPASS(ND_ROUTER_ADVERT, &filt);
 164         if (setsockopt(rssock, IPPROTO_ICMPV6, ICMP6_FILTER, &filt,
 165             sizeof(filt)) == -1) {
 166                 warnmsg(LOG_ERR, __func__, "setsockopt(ICMP6_FILTER): %s",
 167                     strerror(errno));
 168                 return(-1);
 169         }
 170
 171         /* initialize msghdr for receiving packets */
 172         rcviov[0].iov_base = (caddr_t)answer;
 173         rcviov[0].iov_len = sizeof(answer);
 174         rcvmhdr.msg_name = (caddr_t)&from;
 175         rcvmhdr.msg_iov = rcviov;
 176         rcvmhdr.msg_iovlen = 1;
 177         rcvmhdr.msg_control = (caddr_t) rcvcmsgbuf;
 178
 179         /* initialize msghdr for sending packets */
 180         sndmhdr.msg_namelen = sizeof(struct sockaddr_in6);
 181         sndmhdr.msg_iov = sndiov;
 182         sndmhdr.msg_iovlen = 1;
 183         sndmhdr.msg_control = (caddr_t)sndcmsgbuf;
 184         sndmhdr.msg_controllen = sndcmsglen;
 185
 186         return (rssock);
 187 }
 188
 189 void
 190 sendpacket(struct ifinfo *ifi)
 191 {
 192         struct in6_pktinfo *pi;
 193         struct cmsghdr *cm;
 194         int hoplimit = 255;
 195         ssize_t i;
 196         struct sockaddr_in6 dst;
 197
 198         dst = sin6_allrouters;
 199         dst.sin6_scope_id = ifi->linkid;
 200
 201         sndmhdr.msg_name = (caddr_t)&dst;
 202         sndmhdr.msg_iov[0].iov_base = (caddr_t)ifi->rs_data;
 203         sndmhdr.msg_iov[0].iov_len = ifi->rs_datalen;
 204
 205         cm = CMSG_FIRSTHDR(&sndmhdr);
 206         /* specify the outgoing interface */
 207         cm->cmsg_level = IPPROTO_IPV6;
 208         cm->cmsg_type = IPV6_PKTINFO;
 209         cm->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
 210         pi = (struct in6_pktinfo *)(void *)CMSG_DATA(cm);
 211         memset(&pi->ipi6_addr, 0, sizeof(pi->ipi6_addr));       /*XXX*/
 212         pi->ipi6_ifindex = ifi->sdl->sdl_index;
 213
 214         /* specify the hop limit of the packet */
 215         cm = CMSG_NXTHDR(&sndmhdr, cm);
 216         cm->cmsg_level = IPPROTO_IPV6;
 217         cm->cmsg_type = IPV6_HOPLIMIT;
 218         cm->cmsg_len = CMSG_LEN(sizeof(int));
 219         memcpy(CMSG_DATA(cm), &hoplimit, sizeof(int));
 220
 221         warnmsg(LOG_DEBUG, __func__,
 222             "send RS on %s, whose state is %d",
 223             ifi->ifname, ifi->state);
 224         i = sendmsg(rssock, &sndmhdr, 0);
 225         if (i < 0 || (size_t)i != ifi->rs_datalen) {
 226                 /*
 227                  * ENETDOWN is not so serious, especially when using several
 228                  * network cards on a mobile node. We ignore it.
 229                  */
 230                 if (errno != ENETDOWN || dflag > 0)
 231                         warnmsg(LOG_ERR, __func__, "sendmsg on %s: %s",
 232                             ifi->ifname, strerror(errno));
 233         }
 234
 235         /* update counter */
 236         ifi->probes++;
 237 }
 238
 239 void
 240 rtsol_input(int s)
 241 {
 242         char ntopbuf[INET6_ADDRSTRLEN], ifnamebuf[IFNAMSIZ];
 243         int l, ifindex = 0, *hlimp = NULL;
 244         ssize_t msglen;
 245         struct in6_pktinfo *pi = NULL;
 246         struct ifinfo *ifi = NULL;
 247         struct ra_opt *rao = NULL;
 248         struct icmp6_hdr *icp;
 249         struct nd_router_advert *nd_ra;
 250         struct cmsghdr *cm;
 251         struct rainfo *rai;
 252         char *raoptp;
 253         char *p;
 254         struct in6_addr *addr;
 255         struct nd_opt_hdr *ndo;
 256         struct nd_opt_rdnss *rdnss;
 257         struct nd_opt_dnssl *dnssl;
 258         size_t len;
 259         char nsbuf[INET6_ADDRSTRLEN + 1 + IFNAMSIZ + 1];
 260         char dname[NI_MAXHOST];
 261         struct timespec now;
 262         struct timespec lifetime;
 263         int newent_rai;
 264         int newent_rao;
 265
 266         /* get message.  namelen and controllen must always be initialized. */
 267         rcvmhdr.msg_namelen = sizeof(from);
 268         rcvmhdr.msg_controllen = rcvcmsglen;
 269         if ((msglen = recvmsg(s, &rcvmhdr, 0)) < 0) {
 270                 warnmsg(LOG_ERR, __func__, "recvmsg: %s", strerror(errno));
 271                 return;
 272         }
 273
 274         /* extract optional information via Advanced API */
 275         for (cm = (struct cmsghdr *)CMSG_FIRSTHDR(&rcvmhdr); cm;
 276             cm = (struct cmsghdr *)CMSG_NXTHDR(&rcvmhdr, cm)) {
 277                 if (cm->cmsg_level == IPPROTO_IPV6 &&
 278                     cm->cmsg_type == IPV6_PKTINFO &&
 279                     cm->cmsg_len == CMSG_LEN(sizeof(struct in6_pktinfo))) {
 280                         pi = (struct in6_pktinfo *)(void *)(CMSG_DATA(cm));
 281                         ifindex = pi->ipi6_ifindex;
 282                 }
 283                 if (cm->cmsg_level == IPPROTO_IPV6 &&
 284                     cm->cmsg_type == IPV6_HOPLIMIT &&
 285                     cm->cmsg_len == CMSG_LEN(sizeof(int)))
 286                         hlimp = (int *)(void *)CMSG_DATA(cm);
 287         }
 288
 289         if (ifindex == 0) {
 290                 warnmsg(LOG_ERR, __func__,
 291                     "failed to get receiving interface");
 292                 return;
 293         }
 294         if (hlimp == NULL) {
 295                 warnmsg(LOG_ERR, __func__,
 296                     "failed to get receiving hop limit");
 297                 return;
 298         }
 299
 300         if ((size_t)msglen < sizeof(struct nd_router_advert)) {
 301                 warnmsg(LOG_INFO, __func__,
 302                     "packet size(%zd) is too short", msglen);
 303                 return;
 304         }
 305
 306         icp = (struct icmp6_hdr *)rcvmhdr.msg_iov[0].iov_base;
 307
 308         if (icp->icmp6_type != ND_ROUTER_ADVERT) {
 309                 /*
 310                  * this should not happen because we configured a filter
 311                  * that only passes RAs on the receiving socket.
 312                  */
 313                 warnmsg(LOG_ERR, __func__,
 314                     "invalid icmp type(%d) from %s on %s", icp->icmp6_type,
 315                     inet_ntop(AF_INET6, &from.sin6_addr, ntopbuf,
 316                         sizeof(ntopbuf)),
 317                     if_indextoname(pi->ipi6_ifindex, ifnamebuf));
 318                 return;
 319         }
 320
 321         if (icp->icmp6_code != 0) {
 322                 warnmsg(LOG_INFO, __func__,
 323                     "invalid icmp code(%d) from %s on %s", icp->icmp6_code,
 324                     inet_ntop(AF_INET6, &from.sin6_addr, ntopbuf,
 325                         sizeof(ntopbuf)),
 326                     if_indextoname(pi->ipi6_ifindex, ifnamebuf));
 327                 return;
 328         }
 329
 330         if (*hlimp != 255) {
 331                 warnmsg(LOG_INFO, __func__,
 332                     "invalid RA with hop limit(%d) from %s on %s",
 333                     *hlimp,
 334                     inet_ntop(AF_INET6, &from.sin6_addr, ntopbuf,
 335                         sizeof(ntopbuf)),
 336                     if_indextoname(pi->ipi6_ifindex, ifnamebuf));
 337                 return;
 338         }
 339
 340         if (pi && !IN6_IS_ADDR_LINKLOCAL(&from.sin6_addr)) {
 341                 warnmsg(LOG_INFO, __func__,
 342                     "invalid RA with non link-local source from %s on %s",
 343                     inet_ntop(AF_INET6, &from.sin6_addr, ntopbuf,
 344                         sizeof(ntopbuf)),
 345                     if_indextoname(pi->ipi6_ifindex, ifnamebuf));
 346                 return;
 347         }
 348
 349         /* xxx: more validation? */
 350
 351         if ((ifi = find_ifinfo(pi->ipi6_ifindex)) == NULL) {
 352                 warnmsg(LOG_DEBUG, __func__,
 353                     "received RA from %s on an unexpected IF(%s)",
 354                     inet_ntop(AF_INET6, &from.sin6_addr, ntopbuf,
 355                         sizeof(ntopbuf)),
 356                     if_indextoname(pi->ipi6_ifindex, ifnamebuf));
 357                 return;
 358         }
 359
 360         warnmsg(LOG_DEBUG, __func__,
 361             "received RA from %s on %s, state is %d",
 362             inet_ntop(AF_INET6, &from.sin6_addr, ntopbuf, sizeof(ntopbuf)),
 363             ifi->ifname, ifi->state);
 364
 365         nd_ra = (struct nd_router_advert *)icp;
 366
 367         /*
 368          * Process the "O bit."
 369          * If the value of OtherConfigFlag changes from FALSE to TRUE, the
 370          * host should invoke the stateful autoconfiguration protocol,
 371          * requesting information.
 372          * [RFC 2462 Section 5.5.3]
 373          */
 374         if (((nd_ra->nd_ra_flags_reserved) & ND_RA_FLAG_OTHER) &&
 375             !ifi->otherconfig) {
 376                 warnmsg(LOG_DEBUG, __func__,
 377                     "OtherConfigFlag on %s is turned on", ifi->ifname);
 378                 ifi->otherconfig = 1;
 379                 CALL_SCRIPT(OTHER, NULL);
 380         }
 381         clock_gettime(CLOCK_MONOTONIC_FAST, &now);
 382         newent_rai = 0;
 383         rai = find_rainfo(ifi, &from);
 384         if (rai == NULL) {
 385                 ELM_MALLOC(rai, exit(1));
 386                 rai->rai_ifinfo = ifi;
 387                 TAILQ_INIT(&rai->rai_ra_opt);
 388                 rai->rai_saddr.sin6_family = AF_INET6;
 389                 rai->rai_saddr.sin6_len = sizeof(rai->rai_saddr);
 390                 memcpy(&rai->rai_saddr.sin6_addr, &from.sin6_addr,
 391                     sizeof(rai->rai_saddr.sin6_addr));
 392                 newent_rai = 1;
 393         }
 394
 395 #define RA_OPT_NEXT_HDR(x)      (struct nd_opt_hdr *)((char *)x + \
 396                                 (((struct nd_opt_hdr *)x)->nd_opt_len * 8))
 397         /* Process RA options. */
 398         warnmsg(LOG_DEBUG, __func__, "Processing RA");
 399         raoptp = (char *)icp + sizeof(struct nd_router_advert);
 400         while (raoptp < (char *)icp + msglen) {
 401                 ndo = (struct nd_opt_hdr *)raoptp;
 402                 warnmsg(LOG_DEBUG, __func__, "ndo = %p", raoptp);
 403                 warnmsg(LOG_DEBUG, __func__, "ndo->nd_opt_type = %d",
 404                     ndo->nd_opt_type);
 405                 warnmsg(LOG_DEBUG, __func__, "ndo->nd_opt_len = %d",
 406                     ndo->nd_opt_len);
 407
 408                 switch (ndo->nd_opt_type) {
 409                 case ND_OPT_RDNSS:
 410                         rdnss = (struct nd_opt_rdnss *)raoptp;
 411
 412                         /* Optlen sanity check (Section 5.3.1 in RFC 6106) */
 413                         if (rdnss->nd_opt_rdnss_len < 3) {
 414                                 warnmsg(LOG_INFO, __func__,
 415                                         "too short RDNSS option"
 416                                         "in RA from %s was ignored.",
 417                                         inet_ntop(AF_INET6, &from.sin6_addr,
 418                                             ntopbuf, sizeof(ntopbuf)));
 419                                 break;
 420                         }
 421
 422                         addr = (struct in6_addr *)(void *)(raoptp + sizeof(*rdnss));
 423                         while ((char *)addr < (char *)RA_OPT_NEXT_HDR(raoptp)) {
 424                                 if (inet_ntop(AF_INET6, addr, ntopbuf,
 425                                         sizeof(ntopbuf)) == NULL) {
 426                                         warnmsg(LOG_INFO, __func__,
 427                                             "an invalid address in RDNSS option"
 428                                             " in RA from %s was ignored.",
 429                                             inet_ntop(AF_INET6, &from.sin6_addr,
 430                                                 ntopbuf, sizeof(ntopbuf)));
 431                                         addr++;
 432                                         continue;
 433                                 }
 434                                 if (IN6_IS_ADDR_LINKLOCAL(addr))
 435                                         /* XXX: % has to be escaped here */
 436                                         l = snprintf(nsbuf, sizeof(nsbuf),
 437                                             "%s%c%s", ntopbuf,
 438                                             SCOPE_DELIMITER,
 439                                             ifi->ifname);
 440                                 else
 441                                         l = snprintf(nsbuf, sizeof(nsbuf),
 442                                             "%s", ntopbuf);
 443                                 if (l < 0 || (size_t)l >= sizeof(nsbuf)) {
 444                                         warnmsg(LOG_ERR, __func__,
 445                                             "address copying error in "
 446                                             "RDNSS option: %d.", l);
 447                                         addr++;
 448                                         continue;
 449                                 }
 450                                 warnmsg(LOG_DEBUG, __func__, "nsbuf = %s",
 451                                     nsbuf);
 452
 453                                 newent_rao = 0;
 454                                 rao = find_raopt(rai, ndo->nd_opt_type, nsbuf,
 455                                     strlen(nsbuf));
 456                                 if (rao == NULL) {
 457                                         ELM_MALLOC(rao, break);
 458                                         rao->rao_type = ndo->nd_opt_type;
 459                                         rao->rao_len = strlen(nsbuf);
 460                                         rao->rao_msg = strdup(nsbuf);
 461                                         if (rao->rao_msg == NULL) {
 462                                                 warnmsg(LOG_ERR, __func__,
 463                                                     "strdup failed: %s",
 464                                                     strerror(errno));
 465                                                 free(rao);
 466                                                 addr++;
 467                                                 continue;
 468                                         }
 469                                         newent_rao = 1;
 470                                 }
 471                                 /* Set expiration timer */
 472                                 memset(&rao->rao_expire, 0,
 473                                     sizeof(rao->rao_expire));
 474                                 memset(&lifetime, 0, sizeof(lifetime));
 475                                 lifetime.tv_sec =
 476                                     ntohl(rdnss->nd_opt_rdnss_lifetime);
 477                                 TS_ADD(&now, &lifetime, &rao->rao_expire);
 478
 479                                 if (newent_rao)
 480                                         TAILQ_INSERT_TAIL(&rai->rai_ra_opt,
 481                                             rao, rao_next);
 482                                 addr++;
 483                         }
 484                         break;
 485                 case ND_OPT_DNSSL:
 486                         dnssl = (struct nd_opt_dnssl *)raoptp;
 487
 488                         /* Optlen sanity check (Section 5.3.1 in RFC 6106) */
 489                         if (dnssl->nd_opt_dnssl_len < 2) {
 490                                 warnmsg(LOG_INFO, __func__,
 491                                         "too short DNSSL option"
 492                                         "in RA from %s was ignored.",
 493                                         inet_ntop(AF_INET6, &from.sin6_addr,
 494                                             ntopbuf, sizeof(ntopbuf)));
 495                                 break;
 496                         }
 497
 498                         /*
 499                          * Ensure NUL-termination in DNSSL in case of
 500                          * malformed field.
 501                          */
 502                         p = (char *)RA_OPT_NEXT_HDR(raoptp);
 503                         *(p - 1) = '\0';
 504
 505                         p = raoptp + sizeof(*dnssl);
 506                         while (1 < (len = dname_labeldec(dname, sizeof(dname),
 507                             p))) {
 508                                 /* length == 1 means empty string */
 509                                 warnmsg(LOG_DEBUG, __func__, "dname = %s",
 510                                     dname);
 511
 512                                 newent_rao = 0;
 513                                 rao = find_raopt(rai, ndo->nd_opt_type, dname,
 514                                     strlen(dname));
 515                                 if (rao == NULL) {
 516                                         ELM_MALLOC(rao, break);
 517                                         rao->rao_type = ndo->nd_opt_type;
 518                                         rao->rao_len = strlen(dname);
 519                                         rao->rao_msg = strdup(dname);
 520                                         if (rao->rao_msg == NULL) {
 521                                                 warnmsg(LOG_ERR, __func__,
 522                                                     "strdup failed: %s",
 523                                                     strerror(errno));
 524                                                 free(rao);
 525                                                 addr++;
 526                                                 continue;
 527                                         }
 528                                         newent_rao = 1;
 529                                 }
 530                                 /* Set expiration timer */
 531                                 memset(&rao->rao_expire, 0,
 532                                     sizeof(rao->rao_expire));
 533                                 memset(&lifetime, 0, sizeof(lifetime));
 534                                 lifetime.tv_sec =
 535                                     ntohl(dnssl->nd_opt_dnssl_lifetime);
 536                                 TS_ADD(&now, &lifetime, &rao->rao_expire);
 537
 538                                 if (newent_rao)
 539                                         TAILQ_INSERT_TAIL(&rai->rai_ra_opt,
 540                                             rao, rao_next);
 541                                 p += len;
 542                         }
 543                         break;
 544                 default:
 545                         /* nothing to do for other options */
 546                         break;
 547                 }
 548                 raoptp = (char *)RA_OPT_NEXT_HDR(raoptp);
 549         }
 550         if (newent_rai)
 551                 TAILQ_INSERT_TAIL(&ifi->ifi_rainfo, rai, rai_next);
 552
 553         ra_opt_handler(ifi);
 554         ifi->racnt++;
 555
 556         switch (ifi->state) {
 557         case IFS_IDLE:          /* should be ignored */
 558         case IFS_DELAY:         /* right? */
 559                 break;
 560         case IFS_PROBE:
 561                 ifi->state = IFS_IDLE;
 562                 ifi->probes = 0;
 563                 rtsol_timer_update(ifi);
 564                 break;
 565         }
 566 }
 567
 568 static char resstr_ns_prefix[] = "nameserver ";
 569 static char resstr_sh_prefix[] = "search ";
 570 static char resstr_nl[] = "\n";
 571 static char resstr_sp[] = " ";
 572
 573 int
 574 ra_opt_handler(struct ifinfo *ifi)
 575 {
 576         struct ra_opt *rao;
 577         struct rainfo *rai;
 578         struct script_msg *smp1, *smp2, *smp3;
 579         struct timespec now;
 580         struct script_msg_head_t sm_rdnss_head =
 581             TAILQ_HEAD_INITIALIZER(sm_rdnss_head);
 582         struct script_msg_head_t sm_dnssl_head =
 583             TAILQ_HEAD_INITIALIZER(sm_dnssl_head);
 584
 585         int dcount, dlen;
 586
 587         dcount = 0;
 588         dlen = strlen(resstr_sh_prefix) + strlen(resstr_nl);
 589         clock_gettime(CLOCK_MONOTONIC_FAST, &now);
 590
 591         /*
 592          * All options from multiple RAs with the same or different
 593          * source addresses on a single interface will be gathered and
 594          * handled, not overridden.  [RFC 4861 6.3.4]
 595          */
 596         TAILQ_FOREACH(rai, &ifi->ifi_rainfo, rai_next) {
 597                 TAILQ_FOREACH(rao, &rai->rai_ra_opt, rao_next) {
 598                         switch (rao->rao_type) {
 599                         case ND_OPT_RDNSS:
 600                                 if (TS_CMP(&now, &rao->rao_expire, >)) {
 601                                         warnmsg(LOG_INFO, __func__,
 602                                             "expired rdnss entry: %s",
 603                                             (char *)rao->rao_msg);
 604                                         break;
 605                                 }
 606                                 ELM_MALLOC(smp1, continue);
 607                                 ELM_MALLOC(smp2, goto free1);
 608                                 ELM_MALLOC(smp3, goto free2);
 609                                 smp1->sm_msg = resstr_ns_prefix;
 610                                 TAILQ_INSERT_TAIL(&sm_rdnss_head, smp1,
 611                                     sm_next);
 612                                 smp2->sm_msg = rao->rao_msg;
 613                                 TAILQ_INSERT_TAIL(&sm_rdnss_head, smp2,
 614                                     sm_next);
 615                                 smp3->sm_msg = resstr_nl;
 616                                 TAILQ_INSERT_TAIL(&sm_rdnss_head, smp3,
 617                                     sm_next);
 618                                 ifi->ifi_rdnss = IFI_DNSOPT_STATE_RECEIVED;
 619
 620                                 break;
 621                         case ND_OPT_DNSSL:
 622                                 if (TS_CMP(&now, &rao->rao_expire, >)) {
 623                                         warnmsg(LOG_INFO, __func__,
 624                                             "expired dnssl entry: %s",
 625                                             (char *)rao->rao_msg);
 626                                         break;
 627                                 }
 628                                 dcount++;
 629                                 /* Check resolv.conf(5) restrictions. */
 630                                 if (dcount > 6) {
 631                                         warnmsg(LOG_INFO, __func__,
 632                                             "dnssl entry exceeding maximum count (%d>6)"
 633                                             ": %s", dcount, (char *)rao->rao_msg);
 634                                         break;
 635                                 }
 636                                 if (256 < dlen + strlen(rao->rao_msg) +
 637                                     strlen(resstr_sp)) {
 638                                         warnmsg(LOG_INFO, __func__,
 639                                             "dnssl entry exceeding maximum length "
 640                                             "(>256): %s", (char *)rao->rao_msg);
 641                                         break;
 642                                 }
 643                                 ELM_MALLOC(smp1, continue);
 644                                 ELM_MALLOC(smp2, goto free1);
 645                                 if (TAILQ_EMPTY(&sm_dnssl_head)) {
 646                                         ELM_MALLOC(smp3, goto free2);
 647                                         smp3->sm_msg = resstr_sh_prefix;
 648                                         TAILQ_INSERT_TAIL(&sm_dnssl_head, smp3,
 649                                             sm_next);
 650                                 }
 651                                 smp1->sm_msg = rao->rao_msg;
 652                                 TAILQ_INSERT_TAIL(&sm_dnssl_head, smp1,
 653                                     sm_next);
 654                                 smp2->sm_msg = resstr_sp;
 655                                 TAILQ_INSERT_TAIL(&sm_dnssl_head, smp2,
 656                                     sm_next);
 657                                 dlen += strlen(rao->rao_msg) +
 658                                     strlen(resstr_sp);
 659                                 break;
 660
 661                                 ifi->ifi_dnssl = IFI_DNSOPT_STATE_RECEIVED;
 662                         default:
 663                                 break;
 664                         }
 665                         continue;
 666 free2:
 667                         free(smp2);
 668 free1:
 669                         free(smp1);
 670                 }
 671                 /* Call the script for each information source. */
 672                 if (uflag)
 673                         ra_opt_rdnss_dispatch(ifi, rai, &sm_rdnss_head,
 674                             &sm_dnssl_head);
 675         }
 676         /* Call the script for each interface. */
 677         if (!uflag)
 678                 ra_opt_rdnss_dispatch(ifi, NULL, &sm_rdnss_head,
 679                     &sm_dnssl_head);
 680         return (0);
 681 }
 682
 683 char *
 684 make_rsid(const char *ifname, const char *origin, struct rainfo *rai)
 685 {
 686         char hbuf[NI_MAXHOST];
 687
 688         if (rai == NULL)
 689                 sprintf(rsid, "%s:%s", ifname, origin);
 690         else {
 691                 if (!IN6_IS_ADDR_LINKLOCAL(&rai->rai_saddr.sin6_addr))
 692                         return (NULL);
 693                 if (getnameinfo((struct sockaddr *)&rai->rai_saddr,
 694                         rai->rai_saddr.sin6_len, hbuf, sizeof(hbuf), NULL, 0,
 695                         NI_NUMERICHOST) != 0)
 696                         return (NULL);
 697                 sprintf(rsid, "%s:%s:[%s]", ifname, origin, hbuf);
 698         }
 699         warnmsg(LOG_DEBUG, __func__, "rsid = [%s]", rsid);
 700         return (rsid);
 701 }
 702
 703 int
 704 ra_opt_rdnss_dispatch(struct ifinfo *ifi,
 705     struct rainfo *rai,
 706     struct script_msg_head_t *sm_rdnss_head,
 707     struct script_msg_head_t *sm_dnssl_head)
 708 {
 709         const char *r;
 710         struct script_msg *smp1;
 711         int error;
 712
 713         error = 0;
 714         /* Add \n for DNSSL list. */
 715         if (!TAILQ_EMPTY(sm_dnssl_head)) {
 716                 ELM_MALLOC(smp1, goto ra_opt_rdnss_freeit);
 717                 smp1->sm_msg = resstr_nl;
 718                 TAILQ_INSERT_TAIL(sm_dnssl_head, smp1, sm_next);
 719         }
 720         TAILQ_CONCAT(sm_rdnss_head, sm_dnssl_head, sm_next);
 721
 722         if (rai != NULL && uflag)
 723                 r = make_rsid(ifi->ifname, DNSINFO_ORIGIN_LABEL, rai);
 724         else
 725                 r = make_rsid(ifi->ifname, DNSINFO_ORIGIN_LABEL, NULL);
 726         if (r == NULL) {
 727                 warnmsg(LOG_ERR, __func__, "make_rsid() failed.  "
 728                     "Script was not invoked.");
 729                 error = 1;
 730                 goto ra_opt_rdnss_freeit;
 731         }
 732         if (!TAILQ_EMPTY(sm_rdnss_head))
 733                 CALL_SCRIPT(RESADD, sm_rdnss_head);
 734         else if (ifi->ifi_rdnss == IFI_DNSOPT_STATE_RECEIVED ||
 735             ifi->ifi_dnssl == IFI_DNSOPT_STATE_RECEIVED) {
 736                 CALL_SCRIPT(RESDEL, NULL);
 737                 ifi->ifi_rdnss = IFI_DNSOPT_STATE_NOINFO;
 738                 ifi->ifi_dnssl = IFI_DNSOPT_STATE_NOINFO;
 739         }
 740
 741 ra_opt_rdnss_freeit:
 742         /* Clear script message queue. */
 743         if (!TAILQ_EMPTY(sm_rdnss_head)) {
 744                 while ((smp1 = TAILQ_FIRST(sm_rdnss_head)) != NULL) {
 745                         TAILQ_REMOVE(sm_rdnss_head, smp1, sm_next);
 746                         free(smp1);
 747                 }
 748         }
 749         if (!TAILQ_EMPTY(sm_dnssl_head)) {
 750                 while ((smp1 = TAILQ_FIRST(sm_dnssl_head)) != NULL) {
 751                         TAILQ_REMOVE(sm_dnssl_head, smp1, sm_next);
 752                         free(smp1);
 753                 }
 754         }
 755         return (error);
 756 }
 757
 758 static struct ra_opt *
 759 find_raopt(struct rainfo *rai, int type, void *msg, size_t len)
 760 {
 761         struct ra_opt *rao;
 762
 763         TAILQ_FOREACH(rao, &rai->rai_ra_opt, rao_next) {
 764                 if (rao->rao_type == type &&
 765                     rao->rao_len == strlen(msg) &&
 766                     memcmp(rao->rao_msg, msg, len) == 0)
 767                         break;
 768         }
 769
 770         return (rao);
 771 }
 772
 773 static void
 774 call_script(const int argc, const char *const argv[],
 775     struct script_msg_head_t *sm_head)
 776 {
 777         const char *scriptpath;
 778         int fd[2];
 779         int error;
 780         pid_t pid, wpid;
 781
 782         if ((scriptpath = argv[0]) == NULL)
 783                 return;
 784
 785         fd[0] = fd[1] = -1;
 786         if (sm_head != NULL && !TAILQ_EMPTY(sm_head)) {
 787                 error = pipe(fd);
 788                 if (error) {
 789                         warnmsg(LOG_ERR, __func__,
 790                             "failed to create a pipe: %s", strerror(errno));
 791                         return;
 792                 }
 793         }
 794
 795         /* launch the script */
 796         pid = fork();
 797         if (pid < 0) {
 798                 warnmsg(LOG_ERR, __func__,
 799                     "failed to fork: %s", strerror(errno));
 800                 return;
 801         } else if (pid) {       /* parent */
 802                 int wstatus;
 803
 804                 if (fd[0] != -1) {      /* Send message to the child if any. */
 805                         ssize_t len;
 806                         struct script_msg *smp;
 807
 808                         close(fd[0]);
 809                         TAILQ_FOREACH(smp, sm_head, sm_next) {
 810                                 len = strlen(smp->sm_msg);
 811                                 warnmsg(LOG_DEBUG, __func__,
 812                                     "write to child = %s(%zd)",
 813                                     smp->sm_msg, len);
 814                                 if (write(fd[1], smp->sm_msg, len) != len) {
 815                                         warnmsg(LOG_ERR, __func__,
 816                                             "write to child failed: %s",
 817                                             strerror(errno));
 818                                         break;
 819                                 }
 820                         }
 821                         close(fd[1]);
 822                 }
 823                 do {
 824                         wpid = wait(&wstatus);
 825                 } while (wpid != pid && wpid > 0);
 826
 827                 if (wpid < 0)
 828                         warnmsg(LOG_ERR, __func__,
 829                             "wait: %s", strerror(errno));
 830                 else
 831                         warnmsg(LOG_DEBUG, __func__,
 832                             "script \"%s\" terminated", scriptpath);
 833         } else {                /* child */
 834                 int nullfd;
 835                 char **_argv;
 836
 837                 if (safefile(scriptpath)) {
 838                         warnmsg(LOG_ERR, __func__,
 839                             "script \"%s\" cannot be executed safely",
 840                             scriptpath);
 841                         exit(1);
 842                 }
 843                 nullfd = open("/dev/null", O_RDWR);
 844                 if (nullfd < 0) {
 845                         warnmsg(LOG_ERR, __func__,
 846                             "open /dev/null: %s", strerror(errno));
 847                         exit(1);
 848                 }
 849                 if (fd[0] != -1) {      /* Receive message from STDIN if any. */
 850                         close(fd[1]);
 851                         if (fd[0] != STDIN_FILENO) {
 852                                 /* Connect a pipe read-end to child's STDIN. */
 853                                 if (dup2(fd[0], STDIN_FILENO) != STDIN_FILENO) {
 854                                         warnmsg(LOG_ERR, __func__,
 855                                             "dup2 STDIN: %s", strerror(errno));
 856                                         exit(1);
 857                                 }
 858                                 close(fd[0]);
 859                         }
 860                 } else
 861                         dup2(nullfd, STDIN_FILENO);
 862
 863                 dup2(nullfd, STDOUT_FILENO);
 864                 dup2(nullfd, STDERR_FILENO);
 865                 if (nullfd > STDERR_FILENO)
 866                         close(nullfd);
 867
 868                 _argv = malloc(sizeof(*_argv) * argc);
 869                 if (_argv == NULL) {
 870                         warnmsg(LOG_ERR, __func__,
 871                                 "malloc: %s", strerror(errno));
 872                         exit(1);
 873                 }
 874                 memcpy(_argv, argv, (size_t)argc);
 875                 execv(scriptpath, (char *const *)_argv);
 876                 warnmsg(LOG_ERR, __func__, "child: exec failed: %s",
 877                     strerror(errno));
 878                 exit(1);
 879         }
 880
 881         return;
 882 }
 883
 884 static int
 885 safefile(const char *path)
 886 {
 887         struct stat s;
 888         uid_t myuid;
 889
 890         /* no setuid */
 891         if (getuid() != geteuid()) {
 892                 warnmsg(LOG_NOTICE, __func__,
 893                     "setuid'ed execution not allowed\n");
 894                 return (-1);
 895         }
 896
 897         if (lstat(path, &s) != 0) {
 898                 warnmsg(LOG_NOTICE, __func__, "lstat failed: %s",
 899                     strerror(errno));
 900                 return (-1);
 901         }
 902
 903         /* the file must be owned by the running uid */
 904         myuid = getuid();
 905         if (s.st_uid != myuid) {
 906                 warnmsg(LOG_NOTICE, __func__,
 907                     "%s has invalid owner uid\n", path);
 908                 return (-1);
 909         }
 910
 911         switch (s.st_mode & S_IFMT) {
 912         case S_IFREG:
 913                 break;
 914         default:
 915                 warnmsg(LOG_NOTICE, __func__,
 916                     "%s is an invalid file type 0x%o\n",
 917                     path, (s.st_mode & S_IFMT));
 918                 return (-1);
 919         }
 920
 921         return (0);
 922 }
 923
 924 /* Decode domain name label encoding in RFC 1035 Section 3.1 */
 925 static size_t
 926 dname_labeldec(char *dst, size_t dlen, const char *src)
 927 {
 928         size_t len;
 929         const char *src_origin;
 930         const char *src_last;
 931         const char *dst_origin;
 932
 933         src_origin = src;
 934         src_last = strchr(src, '\0');
 935         dst_origin = dst;
 936         memset(dst, '\0', dlen);
 937         while (src && (len = (uint8_t)(*src++) & 0x3f) &&
 938             (src + len) <= src_last &&
 939             (dst - dst_origin < (ssize_t)dlen)) {
 940                 if (dst != dst_origin)
 941                         *dst++ = '.';
 942                 warnmsg(LOG_DEBUG, __func__, "labellen = %zd", len);
 943                 memcpy(dst, src, len);
 944                 src += len;
 945                 dst += len;
 946         }
 947         *dst = '\0';
 948
 949         /*
 950          * XXX validate that domain name only contains valid characters
 951          * for two reasons: 1) correctness, 2) we do not want to pass
 952          * possible malicious, unescaped characters like `` to a script
 953          * or program that could be exploited that way.
 954          */
 955
 956         return (src - src_origin);
 957 }