ipf/svc/ipfd.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * This file delivers svc.ipfd, the daemon that monitors changes to
 * firewall capable services and requests IPfilter configuration update
 * on behalf of the service. Essentially, the daemon listens for
 * service changes and forks the program that update a service's
 * IPfilter configuration.
 *
 * - A firewall capable SMF service can restrict network access to its
 *   service by providing a firewall policy that can be translated into
 *   a set of IPfilter rules. The mentioned firewall policy is stored in
 *   firewall_config and firewall_context property groups. If one of these
 *   two property groups exist, the service is considered to be firewall
 *   capable.
 *
 * - A request to update service's IPfilter configuration is made for
 *   actions that affect service's configuration or running state. The
 *   actions are:
 *  - enable/disable
 *  - refresh/restart
 *  - maintenance/clear maintenance
 *
 * Lacking a generic SMF mechanism to observe service state changes, the
 * daemon observe change events by listening to changes to 'general',
 * 'general_ovr', and 'restarter_actions' property groups. This is not a
 * stable interface and should be replaced when a SMF supported mechanism
 * becomes available.
 *
 * - The program responsible for updating service's IPfilter configuration
 *   is /lib/svc/method/ipfilter. This program is called as:
 *
 *   /lib/svc/method/ipfilter fw_update fmri
 *
 *   where fmri the instance fmri of the service to be updated.
 */

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <assert.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <umem.h>
#include <libscf.h>
#include <libscf_priv.h>
#include <signal.h>
#include <string.h>
#include <syslog.h>

#define IPFILTER_FMRI       "svc:/network/ipfilter:default"
#define RPCBIND_FMRI        "svc:/network/rpc/bind:default"
#define IPF_UPDATE_CMD      "/lib/svc/method/ipfilter"

#define SCF_SNAPSHOT_RUNNING    "running"
#define SCF_PG_FW_CONTEXT   "firewall_context"
#define SCF_PG_FW_CONFIG    "firewall_config"
#define SCF_PG_REFRESH      "refresh"
#define SCF_PG_INETD        "inetd"

#define SCF_PROPERTY_ISRPC  "isrpc"

#define MAX_RETRY       7
#define DEV_NULL        "/dev/null"

static scf_handle_t *h;
static ssize_t max_scf_fmri_size;
static ssize_t max_scf_name_size;

static scf_instance_t *inst;
static scf_snapshot_t *snap;
static scf_propertygroup_t *scratch_pg;
static scf_property_t *scratch_prop;
static scf_value_t *scratch_v;

static char *scratch_fmri;
static char *scratch_name;

static const char *all_props[] = {
    SCF_PROPERTY_REFRESH, SCF_PROPERTY_RESTART, SCF_PROPERTY_MAINT_ON,
    SCF_PROPERTY_MAINT_ON_IMMEDIATE, SCF_PROPERTY_MAINT_ON_IMMTEMP,
    SCF_PROPERTY_MAINT_ON_TEMPORARY, SCF_PROPERTY_MAINT_OFF
};
#define ALL_PROPS_CNT       7

static const char *maint_props[] = {
    SCF_PROPERTY_REFRESH, SCF_PROPERTY_RESTART, SCF_PROPERTY_MAINT_OFF };
#define MAINT_PROPS_CNT     3

static int ipfilter_update(const char *);

static int
daemonize_self(void)
{
    pid_t pid;
    int fd;

    (void) close(STDIN_FILENO);

    if ((fd = open(DEV_NULL, O_RDONLY)) == -1) {
        (void) printf("Could not open /dev/null: %s\n",
            strerror(errno));
    } else if (fd != STDIN_FILENO) {
        (void) dup2(fd, STDIN_FILENO);
        (void) close(fd);
    }
    (void) dup2(STDERR_FILENO, STDOUT_FILENO);
    closefrom(3);

    if ((pid = fork1()) < 0) {
        (void) printf("fork() failed: %s\n", strerror(errno));
        return (1);
    }

    if (pid != 0)
        exit(0);

    (void) setsid();
    (void) chdir("/");

    return (0);
}

static void
repository_rebind(scf_handle_t *hndl)
{
    int c = 0;

    (void) scf_handle_unbind(hndl);
    while ((scf_handle_bind(hndl)) != 0) {
        if (c > MAX_RETRY) {
            syslog(LOG_ERR | LOG_DAEMON, "Repository access "
                "unavailable. Couldn't bind handle: %s\n",
                scf_strerror(scf_error()));
            syslog(LOG_ERR | LOG_DAEMON, "Service specific"
                "IPfilter configuration may not be updated "
                "properly\n");

            exit(1);
        } else {
            c++;
        }

        (void) sleep(1);
    }
}

static void
repository_notify_setup(scf_handle_t *h)
{
    for (;;) {
        if (_scf_notify_add_pgtype(h, SCF_GROUP_FRAMEWORK) ==
            SCF_SUCCESS)
            break;

        switch (scf_error()) {
        case SCF_ERROR_CONNECTION_BROKEN:
            repository_rebind(h);
            break;

        case SCF_ERROR_NO_RESOURCES:
            (void) sleep(1);
            break;

        default:
            syslog(LOG_ERR | LOG_DAEMON,
                "Abort: Couldn't set up repository notification "
                "for pg type %s: %s\n", SCF_GROUP_FRAMEWORK,
                scf_strerror(scf_error()));
            abort();
        }
    }
}

/*
 * If the repository connection is lost, rebind and re-setup repository
 * notification. During the repository connection outage, services that
 * changed states wouldn't get the corresponding firewall update. To make
 * we're not out of sync, update the entire system firewall configuration,
 * invoke ipfilter_update(IPFILTER_FMRI).
 */
static void
repository_setup()
{
    repository_rebind(h);
    repository_notify_setup(h);
    if (ipfilter_update(IPFILTER_FMRI) == -1) {
        syslog(LOG_ERR | LOG_DAEMON,
            "Failed to reconfigure system firewall.\n");
    }
}

static int
pg_get_prop_value(const scf_propertygroup_t *pg, const char *pname,
    scf_value_t *v)
{
    if (pg == NULL || pname == NULL || v == NULL)
        return (-1);

    if (scf_pg_get_property(pg, pname, scratch_prop) == -1 ||
        scf_property_get_value(scratch_prop, v) == -1) {
        switch (scf_error()) {
        case SCF_ERROR_NOT_FOUND:
        case SCF_ERROR_DELETED:
            break;

        default:
            syslog(LOG_ERR | LOG_DAEMON,
                "scf_pg_get_property failed for %s: %s\n",
                pname, scf_strerror(scf_error()));
        }
        return (-1);
    }
    return (0);
}

static int
is_correct_event(const char *fmri, const scf_propertygroup_t *pg,
    const boolean_t isrpc)
{
    char *state = NULL;
    const char **proplist = all_props;
    int prop_cnt = ALL_PROPS_CNT;

    int i, ret = 0;

    if (scf_pg_get_name(pg, scratch_name, max_scf_name_size) < 0) {
        syslog(LOG_ERR | LOG_DAEMON, "scf_pg_get_name failed: %s\n",
            scf_strerror(scf_error()));
        return (-1);
    }

    /*
     * We care about enable, disable, and refresh since that's
     * when we activate, deactivate, or change firewall policy.
     *
     *  - enable/disable -> change in "general" or "general_ovr"
     *  - refresh/restart -> change in "restarter_actions"
     */
    if (strcmp(scratch_name, SCF_PG_GENERAL) == 0 ||
        strcmp(scratch_name, SCF_PG_GENERAL_OVR) == 0) {
        syslog(LOG_DEBUG | LOG_DAEMON, "Action: %s", scratch_name);
        return (1);
    }

    if ((state = smf_get_state(fmri)) == NULL) {
        syslog(LOG_ERR | LOG_DAEMON, "smf_get_state failed for %s: "
            "%s\n", fmri, scf_strerror(scf_error()));
        return (-1);
    }

    syslog(LOG_DEBUG | LOG_DAEMON, "%s STATE: %s \n", fmri, state);
    if (strcmp(state, SCF_STATE_STRING_MAINT) == 0) {
        proplist = maint_props;
        prop_cnt = MAINT_PROPS_CNT;
    }

    /*
     * Only concerned with refresh, restart, and maint on|off actions.
     * RPC services are restarted whenever rpc/bind restarts so it's
     * an automatic valid event for RPC services.
     */
    if (isrpc) {
        ret = 1;
        goto out;
    } else if (strcmp(scratch_name, SCF_PG_RESTARTER_ACTIONS) == 0) {
        for (i = 0; i < prop_cnt; i++) {
            if (pg_get_prop_value(pg, proplist[i],
                scratch_v) == 0) {
                syslog(LOG_DEBUG | LOG_DAEMON, "Action: %s/%s",
                    scratch_name, proplist[i]);

                ret = 1;
                goto out;
            }
        }
    }

out:
    if (state)
        free(state);

    return (ret);
}

static int
ipfilter_update(const char *fmri)
{
    pid_t pid;
    int status, ret = 0;

    syslog(LOG_DEBUG | LOG_DAEMON, "ipfilter_update: %s\n", fmri);

    /*
     * Start refresh in another process
     */
    if ((pid = fork1()) < 0) {
        syslog(LOG_ERR | LOG_DAEMON, "Couldn't fork to refresh "
            "ipfilter for %s: %s", fmri, strerror(errno));
        ret = 1;
        goto out;
    }

    if (pid == 0) {
        if (execl(IPF_UPDATE_CMD, IPF_UPDATE_CMD, "fw_update", fmri,
            NULL) == -1)
            syslog(LOG_ERR | LOG_DAEMON, "execl() failed for "
                "%s: %s", fmri, strerror(errno));

        exit(1);
    }

    /*
     * Parent - only one update at a time.
     */
    (void) wait(&status);
    if (!WIFEXITED(status) || WEXITSTATUS(status) != 0)
        ret = 1;

out:
    if (ret == 1)
        syslog(LOG_ERR | LOG_DAEMON, "Firewall update failed "
            "for: %s\n", fmri);

    return (ret);
}

/*
 * Determine whether a given instance is a RPC service. Repository and
 * libscf errors are treated as if the service isn't an RPC service,
 * returning B_FALSE to indicate validation failure.
 */
static boolean_t
service_is_rpc(const scf_instance_t *inst)
{
    scf_snapshot_t *lsnap = NULL;
    uint8_t isrpc;

    if (scf_instance_get_snapshot(inst, SCF_SNAPSHOT_RUNNING, snap) != 0) {
        syslog(LOG_DEBUG | LOG_DAEMON,
            "Could not get running snapshot, using editing value\n");
    } else {
        lsnap = snap;
    }

    if (scf_instance_get_pg_composed(inst, lsnap, SCF_PG_INETD,
        scratch_pg) == -1) {
        switch (scf_error()) {
        case SCF_ERROR_NOT_FOUND:
        case SCF_ERROR_DELETED:
            break;

        default:
            syslog(LOG_ERR | LOG_DAEMON,
                "scf_instance_get_pg_composed failed: %s\n",
                scf_strerror(scf_error()));
            return (B_FALSE);
        }

        if (scf_instance_get_pg_composed(inst, lsnap,
            SCF_PG_FW_CONTEXT, scratch_pg) == -1) {
            switch (scf_error()) {
            case SCF_ERROR_NOT_FOUND:
            case SCF_ERROR_DELETED:
                break;

            default:
                syslog(LOG_ERR | LOG_DAEMON,
                    "scf_instance_get_pg_composed failed: %s\n",
                    scf_strerror(scf_error()));
            }
            return (B_FALSE);
        }
    }

    if (pg_get_prop_value(scratch_pg, SCF_PROPERTY_ISRPC, scratch_v) == -1)
        return (B_FALSE);

    if (scf_value_get_boolean(scratch_v, &isrpc) == -1) {
        syslog(LOG_ERR | LOG_DAEMON, "scf_value_get_boolean failed: "
            "%s\n", scf_strerror(scf_error()));
        return (B_FALSE);
    }

    if (isrpc)
        return (B_TRUE);
    else
        return (B_FALSE);
}

static int
instance_has_firewall(scf_instance_t *inst)
{
    scf_snapshot_t *lsnap = NULL;

    if (scf_instance_get_snapshot(inst, SCF_SNAPSHOT_RUNNING, snap) == -1) {
        switch (scf_error()) {
        case SCF_ERROR_CONNECTION_BROKEN:
            syslog(LOG_ERR | LOG_DAEMON,
                "scf_instance_get_snapshot failed: %s\n",
                scf_strerror(scf_error()));
            repository_setup();
            return (-1);

        case SCF_ERROR_DELETED:
        default:
            /*
             * If running snapshot is not available for
             * other reasons, fall back to current values.
             */
            syslog(LOG_DEBUG | LOG_DAEMON, "Could not get "
                "running snapshot, using current value\n");
        }
    } else {
        lsnap = snap;
    }

    /*
     * Update service's IPfilter configuration if either
     * SCF_PG_FW_CONTEXT or SCF_PG_FW_CONFIG exists.
     */
    if (scf_instance_get_pg_composed(inst, lsnap, SCF_PG_FW_CONTEXT,
        scratch_pg) == 0) {
        return (1);
    } else {
        switch (scf_error()) {
        case SCF_ERROR_NOT_FOUND:
        case SCF_ERROR_DELETED:
            break;

        case SCF_ERROR_CONNECTION_BROKEN:
            repository_setup();
            /* FALLTHROUGH */
        default:
            syslog(LOG_ERR | LOG_DAEMON,
                "scf_instance_get_pg_composed failed: %s\n",
                scf_strerror(scf_error()));
            return (-1);
        }
    }

    if (scf_instance_get_pg_composed(inst, lsnap, SCF_PG_FW_CONFIG,
        scratch_pg) == -1) {
        /*
         * It's either a non-firewall service or a failure to
         * read firewall pg, just continue and listen for
         * future events.
         */
        switch (scf_error()) {
        case SCF_ERROR_NOT_FOUND:
        case SCF_ERROR_DELETED:
            return (0);

        case SCF_ERROR_CONNECTION_BROKEN:
            repository_setup();
            /* FALLTHROUGH */
        default:
            syslog(LOG_ERR | LOG_DAEMON,
                "scf_instance_get_pg_composed failed: %s\n",
                scf_strerror(scf_error()));
            return (-1);
        }
    }
    return (1);
}

static int
repository_event_process(scf_propertygroup_t *pg)
{
    boolean_t isrpc = B_FALSE;
    int res;

    /*
     * Figure out it's a firewall capable instance and call ipfilter_update
     * if it is.
     */
    if (scf_pg_get_parent_instance(pg, inst) == -1) {
        /* Not an error if pg doesn't belong to a valid instance */
        if (scf_error() == SCF_ERROR_CONSTRAINT_VIOLATED) {
            return (0);
        }

        syslog(LOG_ERR | LOG_DAEMON, "scf_pg_get_parent_instance "
            "failed: %s\n", scf_strerror(scf_error()));

        if (scf_error() == SCF_ERROR_CONNECTION_BROKEN)
            repository_setup();

        return (1);
    }

    if (scf_instance_to_fmri(inst, scratch_fmri, max_scf_fmri_size) == -1) {
        syslog(LOG_ERR | LOG_DAEMON, "scf_instance_to_fmri "
            "failed: %s\n", scf_strerror(scf_error()));

        if (scf_error() == SCF_ERROR_CONNECTION_BROKEN)
            repository_setup();

        return (1);
    }

    if (strcmp(scratch_fmri, IPFILTER_FMRI) == 0) {
        return (0);
    }

    isrpc = service_is_rpc(inst);

    /*
     * If it's not an event we're interested in, returns success.
     */
    res = is_correct_event(scratch_fmri, pg, isrpc);
    if (res == -1) {
        syslog(LOG_ERR | LOG_DAEMON,
            "is_correct_event failed for %s.\n", scratch_fmri);
        return (1);
    } else if (res == 0) {
        return (0);
    }

    /*
     * Proceed only if instance has firewall policy.
     */
    res = instance_has_firewall(inst);
    if (res == -1) {
        syslog(LOG_ERR | LOG_DAEMON,
            "instance_has_firewall failed for %s.\n", scratch_fmri);
        return (1);
    } else if (res == 0) {
        return (0);
    }

    if (ipfilter_update(scratch_fmri) == -1) {
        return (1);
    }

    return (0);
}

static int
repository_event_wait()
{
    scf_propertygroup_t *pg;
    char *fmri, *scratch;
    const char *inst_name, *pg_name;
    ssize_t res;

    if ((fmri = umem_alloc(max_scf_fmri_size, UMEM_DEFAULT)) == NULL) {
        syslog(LOG_ERR | LOG_DAEMON, "Out of memory");
        return (1);
    }

    if ((scratch = umem_alloc(max_scf_fmri_size, UMEM_DEFAULT)) == NULL) {
        syslog(LOG_ERR | LOG_DAEMON, "Out of memory");
        return (1);
    }

    if ((pg = scf_pg_create(h)) == NULL) {
        syslog(LOG_ERR | LOG_DAEMON, "scf_pg_create failed: %s\n",
            scf_strerror(scf_error()));
        return (1);
    }

    repository_notify_setup(h);

    for (;;) {
        /*
         * Calling _scf_notify_wait which will block this thread
         * until it's notified of a framework event.
         *
         * Note: fmri is only set on delete events.
         */
        res = _scf_notify_wait(pg, fmri, max_scf_fmri_size);
        if (res < 0) {
            syslog(LOG_ERR | LOG_DAEMON, "_scf_notify_wait "
                "failed: %s\n", scf_strerror(scf_error()));
            repository_setup();
        } else if (res == 0) {
            if (repository_event_process(pg))
                syslog(LOG_ERR | LOG_DAEMON, "Service may have "
                    "incorrect IPfilter configuration\n");
        } else {
            /*
             * The received event is a deletion of a service,
             * instance or pg. If it's a deletion of an instance,
             * update the instance's IPfilter configuration.
             */
            syslog(LOG_DEBUG | LOG_DAEMON, "Deleted: %s", fmri);

            (void) strlcpy(scratch, fmri, max_scf_fmri_size);
            if (scf_parse_svc_fmri(scratch, NULL, NULL, &inst_name,
                &pg_name, NULL) != SCF_SUCCESS)
                continue;

            if (inst_name != NULL && pg_name == NULL) {
                (void) ipfilter_update(fmri);
            }
        }
    }

    /*NOTREACHED*/
}

int
main()
{
    if (daemonize_self() == 1)
        return (1);

    max_scf_fmri_size = scf_limit(SCF_LIMIT_MAX_FMRI_LENGTH) + 1;
    max_scf_name_size = scf_limit(SCF_LIMIT_MAX_NAME_LENGTH) + 1;

    assert(max_scf_fmri_size > 0);
    assert(max_scf_name_size > 0);

    if ((h = scf_handle_create(SCF_VERSION)) == NULL) {
        syslog(LOG_ERR | LOG_DAEMON, "scf_handle_create failed: %s\n",
            scf_strerror(scf_error()));
        return (1);
    }

    repository_rebind(h);

    scratch_fmri = umem_alloc(max_scf_fmri_size, UMEM_DEFAULT);
    scratch_name = umem_alloc(max_scf_name_size, UMEM_DEFAULT);

    if (scratch_fmri == NULL || scratch_name == NULL) {
        syslog(LOG_ERR | LOG_DAEMON, "Out of memory");
        return (1);
    }

    inst = scf_instance_create(h);
    snap = scf_snapshot_create(h);
    scratch_pg = scf_pg_create(h);
    scratch_prop = scf_property_create(h);
    scratch_v = scf_value_create(h);

    if (inst == NULL || snap == NULL || scratch_pg == NULL ||
        scratch_prop == NULL || scratch_v == NULL) {
        syslog(LOG_ERR | LOG_DAEMON, "Initialization failed: %s\n",
            scf_strerror(scf_error()));
        return (1);
    }

    return (repository_event_wait());
}