X-Git-Url: https://git.distorted.org.uk/~mdw/tripe/blobdiff_plain/971e56892e36f3351b123200dc1df5b7845aebd7..acd781a81901f9785125ea2c4c99d5d0952eecdd:/server/admin.c

diff --git a/server/admin.c b/server/admin.c
index 58230baf..6ff0dbf3 100644
--- a/server/admin.c
+++ b/server/admin.c
@@ -68,7 +68,7 @@ static const trace_opt w_opts[] = {
 static admin *admins;
 static admin *a_dead;
 static sel_file sock;
-static const char *sockname;
+static const char *sockname = 0;
 static sym_table a_svcs;
 static unsigned flags = 0;
 static admin *a_stdin = 0;
@@ -260,7 +260,9 @@ static void a_flush(int fd, unsigned mode, void *v)
  *
  *		  * "?PEER" PEER -- peer's name
  *
- *		  * "?ERRNO" ERRNO -- system error code
+ *		  * "?ERR" CODE -- system error code
+ *
+ *		  * "?ERRNO" -- system error code from @errno@
  *
  *		  * "[!]..." ... -- @dstr_putf@-like string as single token
  */
@@ -303,7 +305,11 @@ void a_vformat(dstr *d, const char *fmt, va_list *ap)
 	while (*av) u_quotify(d, *av++);
       } else if (strcmp(fmt, "?PEER") == 0)
 	u_quotify(d, p_name(va_arg(*ap, peer *)));
-      else if (strcmp(fmt, "?ERRNO") == 0) {
+      else if (strcmp(fmt, "?ERR") == 0) {
+	int e = va_arg(*ap, int);
+	dstr_putf(d, " E%d", e);
+	u_quotify(d, strerror(e));
+      } else if (strcmp(fmt, "?ERRNO") == 0) {
 	dstr_putf(d, " E%d", errno);
 	u_quotify(d, strerror(errno));
       } else
@@ -559,8 +565,8 @@ void a_notify(const char *fmt, ...)
 void a_quit(void)
 {
   close(sock.fd);
-  unlink(sockname);
-  FOREACH_PEER(p, { p_destroy(p); });
+  if (sockname) unlink(sockname);
+  FOREACH_PEER(p, { p_destroy(p, 1); });
   ps_quit();
   exit(0);
 }
@@ -1233,7 +1239,10 @@ static void a_resolve(admin *a, admin_resop *r, const char *tag,
     { fam = "ANY"; af = AF_UNSPEC; i++; }
   else for (j = 0; j < NADDRFAM; j++) {
     if (mystrieq(av[i], aftab[j].name)) {
-      assert(udpsock[j].fd >= 0);
+      if (udpsock[j].sf.fd < 0) {
+	a_fail(a, "disabled-address-family", "%s", aftab[j].name, A_END);
+	goto fail;
+      }
       fam = aftab[j].name;
       af = aftab[j].af;
       i++;
@@ -1275,25 +1284,15 @@ static void a_resolve(admin *a, admin_resop *r, const char *tag,
   T( trace(T_ADMIN, "admin: %u, resop %s, hostname `%s', family `%s'",
 	   a->seq, BGTAG(r), r->addr, fam); )
 
-  /* --- Make sure the address family is something we can implement --- */
-
-  if (af != AF_UNSPEC && af != AF_INET) {
-    T( trace(T_ADMIN, "admin: resop %s failed: unsupported address family",
-	     BGTAG(r)); )
-    a_bgfail(&r->bg, "resolve-error", "%s", r->addr, A_END);
-    goto fail_release;
-  }
-  assert(udpsock[AFIX_INET].fd >= 0);
-
   /* --- If the name is numeric, do it the easy way --- */
 
-  aihint.ai_family = AF_INET;
+  aihint.ai_family = af;
   aihint.ai_socktype = SOCK_DGRAM;
   aihint.ai_protocol = IPPROTO_UDP;
   aihint.ai_flags = AI_NUMERICHOST;
   if (!getaddrinfo(av[i], 0, &aihint, &ailist)) {
     for (ai = ailist; ai; ai = ai->ai_next) {
-      if ((j = afix(ai->ai_family)) >= 0 && udpsock[j].fd >= 0)
+      if ((j = afix(ai->ai_family)) >= 0 && udpsock[j].sf.fd >= 0)
 	break;
     }
     if (!ai) {
@@ -1320,7 +1319,11 @@ static void a_resolve(admin *a, admin_resop *r, const char *tag,
   tv.tv_sec += T_RESOLVE;
   sel_addtimer(&sel, &r->t, &tv, a_restimer, r);
 #ifdef HAVE_LIBADNS
-  qf = adns_qf_search | adns_qf_want_ipv4;
+  qf = adns_qf_search;
+  for (j = 0; j < NADDRFAM; j++) {
+    if ((af == AF_UNSPEC || af == aftab[i].af) && udpsock[j].sf.fd >= 0)
+      qf |= aftab[j].qf;
+  }
   if ((err = adns_submit(ads, r->addr, adns_r_addr, qf, r, &r->q)) != 0) {
     T( trace(T_ADMIN, "admin: resop %s adns_submit failed: %s",
 	     BGTAG(r), strerror(err)); )
@@ -1328,6 +1331,16 @@ static void a_resolve(admin *a, admin_resop *r, const char *tag,
     goto fail_release;
   }
 #else
+  if (af != AF_UNSPEC && af != AF_INET) {
+    T( trace(T_ADMIN, "admin: resop %s failed: unsupported address family",
+	     BGTAG(r)); )
+    a_bgfail(&r->bg, "resolve-error", "%s", r->addr, A_END);
+    goto fail_release;
+  }
+  if (udpsock[AFIX_INET].sf.fd < 0) {
+    a_bgfail(&r->bg, "disabled-address-family", "INET", A_END);
+    goto fail_release;
+  }
   bres_byname(&r->r, r->addr, a_resolved, r);
 #endif
   return;
@@ -1414,6 +1427,7 @@ static void a_doadd(admin_resop *r, int rc)
 
   if (add->peer.tag) xfree(add->peer.tag);
   if (add->peer.privtag) xfree(add->peer.privtag);
+  if (add->peer.knock) xfree(add->peer.knock);
   xfree(add->peer.name);
 }
 
@@ -1439,6 +1453,7 @@ static void acmd_add(admin *a, unsigned ac, char *av[])
   add->peer.name = 0;
   add->peer.tag = 0;
   add->peer.privtag = 0;
+  add->peer.knock = 0;
   add->peer.t_ka = 0;
   add->peer.tops = tun_default;
   add->peer.f = 0;
@@ -1462,15 +1477,21 @@ static void acmd_add(admin *a, unsigned ac, char *av[])
     })
     OPTTIME("-keepalive", t, { add->peer.t_ka = t; })
     OPT("-cork", { add->peer.f |= KXF_CORK; })
+    OPT("-ephemeral", { add->peer.f |= PSF_EPHEM; })
     OPTARG("-key", arg, {
       if (add->peer.tag) xfree(add->peer.tag);
       add->peer.tag = xstrdup(arg);
     })
-    OPT("-mobile", { add->peer.f |= PSF_MOBILE; })
+    OPT("-mobile", { add->peer.f |= PSF_MOBILE | PSF_EPHEM; })
     OPTARG("-priv", arg, {
       if (add->peer.privtag) xfree(add->peer.privtag);
       add->peer.privtag = xstrdup(arg);
     })
+    OPTARG("-knock", arg, {
+      if (add->peer.knock) xfree(add->peer.knock);
+      add->peer.knock = xstrdup(arg);
+      add->peer.f |= PSF_EPHEM;
+    })
   });
 
   /* --- Make sure someone's not got there already --- */
@@ -1497,6 +1518,7 @@ fail:
   if (add->peer.name) xfree(add->peer.name);
   if (add->peer.tag) xfree(add->peer.tag);
   if (add->peer.privtag) xfree(add->peer.privtag);
+  if (add->peer.knock) xfree(add->peer.knock);
   xfree(add);
   return;
 }
@@ -1854,16 +1876,16 @@ static void acmd_port(admin *a, unsigned ac, char *av[])
     a_fail(a, "unknown-address-family", "%s", av[0], A_END);
     return;
   found:
-    if (udpsock[i].fd < 0) {
+    if (udpsock[i].sf.fd < 0) {
       a_fail(a, "disabled-address-family", "%s", aftab[i].name, A_END);
       return;
     }
   } else {
     for (i = 0; i < NADDRFAM; i++)
-      if (udpsock[i].fd >= 0) goto found;
+      if (udpsock[i].sf.fd >= 0) goto found;
     abort();
   }
-  a_info(a, "%u", p_port(i), A_END);
+  a_info(a, "%u", udpsock[i].port, A_END);
   a_ok(a);
 }
 
@@ -1975,7 +1997,7 @@ static void acmd_getchal(admin *a, unsigned ac, char *av[])
   buf b;
 
   buf_init(&b, buf_i, PKBUFSZ);
-  c_new(&b);
+  c_new(0, 0, &b);
   a_info(a, "?B64", BBASE(&b), (size_t)BLEN(&b), A_END);
   a_ok(a);
 }
@@ -1992,7 +2014,7 @@ static void acmd_checkchal(admin *a, unsigned ac, char *av[])
     a_fail(a, "bad-base64", "%s", codec_strerror(err), A_END);
   else {
     buf_init(&b, d.buf, d.len);
-    if (c_check(&b) || BBAD(&b) || BLEFT(&b))
+    if (c_check(0, 0, &b) || BBAD(&b) || BLEFT(&b))
       a_fail(a, "invalid-challenge", A_END);
     else
       a_ok(a);
@@ -2042,6 +2064,7 @@ static void acmd_peerinfo(admin *a, unsigned ac, char *av[])
   if ((p = a_findpeer(a, av[0])) != 0) {
     ps = p_spec(p);
     a_info(a, "tunnel=%s", ps->tops->name, A_END);
+    if (ps->knock) a_info(a, "knock=%s", ps->knock, A_END);
     a_info(a, "key=%s", p_tag(p),
 	   "current-key=%s", p->kx.kpub->tag, A_END);
     if ((ptag = p_privtag(p)) == 0) ptag = "(default)";
@@ -2050,6 +2073,7 @@ static void acmd_peerinfo(admin *a, unsigned ac, char *av[])
     a_info(a, "keepalive=%lu", ps->t_ka, A_END);
     a_info(a, "corked=%s", BOOL(p->kx.f&KXF_CORK),
 	   "mobile=%s", BOOL(ps->f&PSF_MOBILE),
+	   "ephemeral=%s", BOOL(ps->f&PSF_EPHEM),
 	   A_END);
     a_ok(a);
   }
@@ -2105,7 +2129,7 @@ static void acmd_kill(admin *a, unsigned ac, char *av[])
   peer *p;
 
   if ((p = a_findpeer(a, av[0])) != 0) {
-    p_destroy(p);
+    p_destroy(p, 1);
     a_ok(a);
   }
 }
@@ -2386,7 +2410,10 @@ static void a_line(char *p, size_t len, void *vp)
  *
  * Returns:	---
  *
- * Use:		Creates a new admin connection.
+ * Use:		Creates a new admin connection.  It's safe to call this
+ *		before @a_init@ -- and, indeed, this makes sense if you also
+ *		call @a_switcherr@ to report initialization errors through
+ *		the administration machinery.
  */
 
 void a_create(int fd_in, int fd_out, unsigned f)
@@ -2464,7 +2491,7 @@ void a_preselect(void) { if (a_dead) a_destroypending(); }
 
 void a_daemon(void) { flags |= F_DAEMON; }
 
-/* --- @a_init@ --- *
+/* --- @a_listen@ --- *
  *
  * Arguments:	@const char *name@ = socket name to create
  *		@uid_t u@ = user to own the socket
@@ -2476,21 +2503,13 @@ void a_daemon(void) { flags |= F_DAEMON; }
  * Use:		Creates the admin listening socket.
  */
 
-void a_init(const char *name, uid_t u, gid_t g, mode_t m)
+void a_listen(const char *name, uid_t u, gid_t g, mode_t m)
 {
   int fd;
   int n = 5;
   struct sockaddr_un sun;
-  struct sigaction sa;
   size_t sz;
   mode_t omask;
-#ifdef HAVE_LIBADNS
-  int err;
-#endif
-
-  /* --- Create services table --- */
-
-  sym_create(&a_svcs);
 
   /* --- Set up the socket address --- */
 
@@ -2525,6 +2544,7 @@ again:
     if (errno != ECONNREFUSED)
       die(EXIT_FAILURE, "couldn't bind to address: %s", strerror(e));
     if (stat(sun.sun_path, &st)) {
+      if (errno == ENOENT) { close(fd); goto again; }
       die(EXIT_FAILURE, "couldn't stat `%s': %s",
 	  sun.sun_path, strerror(errno));
     }
@@ -2553,6 +2573,72 @@ again:
   sel_initfile(&sel, &sock, fd, SEL_READ, a_accept, 0);
   sel_addfile(&sock);
   sockname = name;
+}
+
+/* --- @a_switcherr@ --- *
+ *
+ * Arguments:	---
+ *
+ * Returns:	---
+ *
+ * Use:		Arrange to report warnings, trace messages, etc. to
+ *		administration clients rather than the standard-error stream.
+ *
+ *		Obviously this makes no sense unless there is at least one
+ *		client established.  Calling @a_listen@ won't help with this,
+ *		because the earliest a new client can connect is during the
+ *		first select-loop iteration, which is too late: some initial
+ *		client must have been added manually using @a_create@.
+ */
+
+void a_switcherr(void)
+{
+  T( trace_custom(a_trace, 0);
+     trace(T_ADMIN, "admin: enabled custom tracing"); )
+  flags |= F_INIT;
+}
+
+/* --- @a_signals@ --- *
+ *
+ * Arguments:	---
+ *
+ * Returns:	---
+ *
+ * Use:		Establishes handlers for the obvious signals.
+ */
+
+void a_signals(void)
+{
+  struct sigaction sa;
+
+  sig_add(&s_term, SIGTERM, a_sigdie, 0);
+  sig_add(&s_hup, SIGHUP, a_sighup, 0);
+  sigaction(SIGINT, 0, &sa);
+  if (sa.sa_handler != SIG_IGN)
+    sig_add(&s_int, SIGINT, a_sigdie, 0);
+}
+
+/* --- @a_init@ --- *
+ *
+ * Arguments:	---
+ *
+ * Returns:	---
+ *
+ * Use:		Creates the admin listening socket.
+ */
+
+void a_init(void)
+{
+#ifdef HAVE_LIBADNS
+  int err;
+#endif
+
+  /* --- Create services table --- */
+
+  sym_create(&a_svcs);
+
+  /* --- Prepare the background name resolver --- */
+
 #ifdef HAVE_LIBADNS
   if ((err = adns_init(&ads,
 		       (adns_if_permit_ipv4 | adns_if_permit_ipv6 |
@@ -2564,17 +2650,6 @@ again:
 #else
   bres_init(&sel);
 #endif
-  T( trace_custom(a_trace, 0);
-     trace(T_ADMIN, "admin: enabled custom tracing"); )
-  flags |= F_INIT;
-
-  /* --- Set up signal handlers --- */
-
-  sig_add(&s_term, SIGTERM, a_sigdie, 0);
-  sig_add(&s_hup, SIGHUP, a_sighup, 0);
-  sigaction(SIGINT, 0, &sa);
-  if (sa.sa_handler != SIG_IGN)
-    sig_add(&s_int, SIGINT, a_sigdie, 0);
 }
 
 /*----- That's all, folks -------------------------------------------------*/