1
0

Configurator.c 24 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633
  1. /* vim: set expandtab ts=4 sw=4: */
  2. /*
  3. * You may redistribute this program and/or modify it under the terms of
  4. * the GNU General Public License as published by the Free Software Foundation,
  5. * either version 3 of the License, or (at your option) any later version.
  6. *
  7. * This program is distributed in the hope that it will be useful,
  8. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  9. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  10. * GNU General Public License for more details.
  11. *
  12. * You should have received a copy of the GNU General Public License
  13. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  14. */
  15. #include "client/AdminClient.h"
  16. #include "client/Configurator.h"
  17. #include "benc/String.h"
  18. #include "benc/Dict.h"
  19. #include "benc/Int.h"
  20. #include "benc/List.h"
  21. #include "memory/Allocator.h"
  22. #include "util/events/Event.h"
  23. #include "util/events/UDPAddrIface.h"
  24. #include "util/Bits.h"
  25. #include "util/log/Log.h"
  26. #include "util/platform/Sockaddr.h"
  27. #include "util/Defined.h"
  28. #include "util/events/Timeout.h"
  29. #include <stdlib.h>
  30. #include <stdbool.h>
  31. struct Context
  32. {
  33. struct Log* logger;
  34. struct Allocator* alloc;
  35. struct AdminClient* client;
  36. struct Allocator* currentReqAlloc;
  37. struct AdminClient_Result* currentResult;
  38. struct EventBase* base;
  39. };
  40. static void rpcCallback(struct AdminClient_Promise* p, struct AdminClient_Result* res)
  41. {
  42. struct Context* ctx = p->userData;
  43. Allocator_adopt(ctx->alloc, p->alloc);
  44. ctx->currentResult = res;
  45. EventBase_endLoop(ctx->base);
  46. }
  47. static void die(struct AdminClient_Result* res, struct Context* ctx, struct Allocator* alloc)
  48. {
  49. Log_keys(ctx->logger, "message bytes = [%s]", res->messageBytes);
  50. #ifndef Log_KEYS
  51. Log_critical(ctx->logger, "enable Log_LEVEL=KEYS to see message content.");
  52. #endif
  53. Dict d = NULL;
  54. struct AdminClient_Promise* exitPromise =
  55. AdminClient_rpcCall(String_CONST("Core_exit"), &d, ctx->client, alloc);
  56. exitPromise->callback = rpcCallback;
  57. exitPromise->userData = ctx;
  58. EventBase_beginLoop(ctx->base);
  59. if (ctx->currentResult->err) {
  60. Log_critical(ctx->logger, "Failed to stop the core.");
  61. }
  62. Log_critical(ctx->logger, "Aborting.");
  63. exit(1);
  64. }
  65. static int rpcCall0(String* function,
  66. Dict* args,
  67. struct Context* ctx,
  68. struct Allocator* alloc,
  69. Dict** resultP,
  70. bool exitIfError)
  71. {
  72. ctx->currentReqAlloc = Allocator_child(alloc);
  73. ctx->currentResult = NULL;
  74. struct AdminClient_Promise* promise = AdminClient_rpcCall(function, args, ctx->client, alloc);
  75. promise->callback = rpcCallback;
  76. promise->userData = ctx;
  77. EventBase_beginLoop(ctx->base);
  78. struct AdminClient_Result* res = ctx->currentResult;
  79. Assert_true(res);
  80. if (res->err) {
  81. Log_critical(ctx->logger,
  82. "Failed to make function call [%s], error: [%s]",
  83. AdminClient_errorString(res->err),
  84. function->bytes);
  85. die(res, ctx, alloc);
  86. }
  87. String* error = Dict_getString(res->responseDict, String_CONST("error"));
  88. int ret = 0;
  89. if (error && !String_equals(error, String_CONST("none"))) {
  90. if (exitIfError) {
  91. Log_critical(ctx->logger,
  92. "Got error [%s] calling [%s]",
  93. error->bytes,
  94. function->bytes);
  95. die(res, ctx, alloc);
  96. }
  97. Log_warn(ctx->logger, "Got error [%s] calling [%s], ignoring.",
  98. error->bytes, function->bytes);
  99. ret = 1;
  100. }
  101. if (resultP) {
  102. *resultP = res->responseDict;
  103. } else {
  104. Allocator_free(ctx->currentReqAlloc);
  105. }
  106. ctx->currentReqAlloc = NULL;
  107. return ret;
  108. }
  109. static void rpcCall(String* function, Dict* args, struct Context* ctx, struct Allocator* alloc)
  110. {
  111. rpcCall0(function, args, ctx, alloc, NULL, true);
  112. }
  113. static void authorizedPasswords(List* list, struct Context* ctx)
  114. {
  115. uint32_t count = List_size(list);
  116. for (uint32_t i = 0; i < count; i++) {
  117. Dict* d = List_getDict(list, i);
  118. Log_info(ctx->logger, "Checking authorized password %d.", i);
  119. if (!d) {
  120. Log_critical(ctx->logger, "Not a dictionary type %d.", i);
  121. exit(-1);
  122. }
  123. String* passwd = Dict_getString(d, String_CONST("password"));
  124. if (!passwd) {
  125. Log_critical(ctx->logger, "Must specify a password %d.", i);
  126. exit(-1);
  127. }
  128. }
  129. for (uint32_t i = 0; i < count; i++) {
  130. struct Allocator* child = Allocator_child(ctx->alloc);
  131. Dict* d = List_getDict(list, i);
  132. String* passwd = Dict_getString(d, String_CONST("password"));
  133. String* user = Dict_getString(d, String_CONST("user"));
  134. if (!user) {
  135. user = String_printf(child, "password [%d]", i);
  136. }
  137. //String* publicKey = Dict_getString(d, String_CONST("publicKey"));
  138. String* ipv6 = Dict_getString(d, String_CONST("ipv6"));
  139. Log_info(ctx->logger, "Adding authorized password #[%d] for user [%s].", i, user->bytes);
  140. Dict *args = Dict_new(child);
  141. uint32_t i = 1;
  142. Dict_putInt(args, String_CONST("authType"), i, child);
  143. Dict_putString(args, String_CONST("password"), passwd, child);
  144. Dict_putString(args, String_CONST("user"), user, child);
  145. if (ipv6) {
  146. Log_info(ctx->logger,
  147. " This connection password restricted to [%s] only.", ipv6->bytes);
  148. Dict_putString(args, String_CONST("ipv6"), ipv6, child);
  149. }
  150. rpcCall(String_CONST("AuthorizedPasswords_add"), args, ctx, child);
  151. Allocator_free(child);
  152. }
  153. }
  154. static void udpInterface(Dict* config, struct Context* ctx)
  155. {
  156. List* ifaces = Dict_getList(config, String_CONST("UDPInterface"));
  157. if (!ifaces) {
  158. ifaces = List_new(ctx->alloc);
  159. List_addDict(ifaces, Dict_getDict(config, String_CONST("UDPInterface")), ctx->alloc);
  160. }
  161. uint32_t count = List_size(ifaces);
  162. for (uint32_t i = 0; i < count; i++) {
  163. Dict *udp = List_getDict(ifaces, i);
  164. if (!udp) {
  165. continue;
  166. }
  167. // Setup the interface.
  168. String* bindStr = Dict_getString(udp, String_CONST("bind"));
  169. Dict* d = Dict_new(ctx->alloc);
  170. if (bindStr) {
  171. Dict_putString(d, String_CONST("bindAddress"), bindStr, ctx->alloc);
  172. }
  173. Dict* resp = NULL;
  174. rpcCall0(String_CONST("UDPInterface_new"), d, ctx, ctx->alloc, &resp, true);
  175. int ifNum = *(Dict_getInt(resp, String_CONST("interfaceNumber")));
  176. // Make the connections.
  177. Dict* connectTo = Dict_getDict(udp, String_CONST("connectTo"));
  178. if (connectTo) {
  179. struct Dict_Entry* entry = *connectTo;
  180. struct Allocator* perCallAlloc = Allocator_child(ctx->alloc);
  181. while (entry != NULL) {
  182. String* key = (String*) entry->key;
  183. if (entry->val->type != Object_DICT) {
  184. Log_critical(ctx->logger, "interfaces.UDPInterface.connectTo: entry [%s] "
  185. "is not a dictionary type.", key->bytes);
  186. exit(-1);
  187. }
  188. Dict* value = entry->val->as.dictionary;
  189. Log_keys(ctx->logger, "Attempting to connect to node [%s].", key->bytes);
  190. key = String_clone(key, perCallAlloc);
  191. char* lastColon = CString_strrchr(key->bytes, ':');
  192. if (!Sockaddr_parse(key->bytes, NULL)) {
  193. // it's a sockaddr, fall through
  194. } else if (lastColon) {
  195. // try it as a hostname.
  196. int port = atoi(lastColon+1);
  197. if (!port) {
  198. Log_critical(ctx->logger, "Couldn't get port number from [%s]", key->bytes);
  199. exit(-1);
  200. }
  201. *lastColon = '\0';
  202. struct Sockaddr* adr = Sockaddr_fromName(key->bytes, perCallAlloc);
  203. if (adr != NULL) {
  204. Sockaddr_setPort(adr, port);
  205. key = String_new(Sockaddr_print(adr, perCallAlloc), perCallAlloc);
  206. } else {
  207. Log_warn(ctx->logger, "Failed to lookup hostname [%s]", key->bytes);
  208. entry = entry->next;
  209. continue;
  210. }
  211. }
  212. Dict_putInt(value, String_CONST("interfaceNumber"), ifNum, perCallAlloc);
  213. Dict_putString(value, String_CONST("address"), key, perCallAlloc);
  214. rpcCall(String_CONST("UDPInterface_beginConnection"), value, ctx, perCallAlloc);
  215. entry = entry->next;
  216. }
  217. Allocator_free(perCallAlloc);
  218. }
  219. }
  220. }
  221. static void tunInterface(Dict* ifaceConf, struct Allocator* tempAlloc, struct Context* ctx)
  222. {
  223. String* ifaceType = Dict_getString(ifaceConf, String_CONST("type"));
  224. if (!String_equals(ifaceType, String_CONST("TUNInterface"))) {
  225. return;
  226. }
  227. // Setup the interface.
  228. String* device = Dict_getString(ifaceConf, String_CONST("tunDevice"));
  229. Dict* args = Dict_new(tempAlloc);
  230. if (device) {
  231. Dict_putString(args, String_CONST("desiredTunName"), device, tempAlloc);
  232. }
  233. rpcCall0(String_CONST("Core_initTunnel"), args, ctx, tempAlloc, NULL, false);
  234. }
  235. static void ipTunnel(Dict* ifaceConf, struct Allocator* tempAlloc, struct Context* ctx)
  236. {
  237. List* incoming = Dict_getList(ifaceConf, String_CONST("allowedConnections"));
  238. if (incoming) {
  239. Dict* d;
  240. for (int i = 0; (d = List_getDict(incoming, i)) != NULL; i++) {
  241. String* key = Dict_getString(d, String_CONST("publicKey"));
  242. String* ip4 = Dict_getString(d, String_CONST("ip4Address"));
  243. // Note that the prefix length has to be a proper int in the config
  244. // (not quoted!)
  245. int64_t* ip4Prefix = Dict_getInt(d, String_CONST("ip4Prefix"));
  246. String* ip6 = Dict_getString(d, String_CONST("ip6Address"));
  247. int64_t* ip6Prefix = Dict_getInt(d, String_CONST("ip6Prefix"));
  248. if (!key) {
  249. Log_critical(ctx->logger, "In router.ipTunnel.allowedConnections[%d]"
  250. "'publicKey' required.", i);
  251. exit(1);
  252. }
  253. if (!ip4 && !ip6) {
  254. Log_critical(ctx->logger, "In router.ipTunnel.allowedConnections[%d]"
  255. "either 'ip4Address' or 'ip6Address' required.", i);
  256. exit(1);
  257. } else if (ip4Prefix && !ip4) {
  258. Log_critical(ctx->logger, "In router.ipTunnel.allowedConnections[%d]"
  259. "'ip4Address' required with 'ip4Prefix'.", i);
  260. exit(1);
  261. } else if (ip6Prefix && !ip6) {
  262. Log_critical(ctx->logger, "In router.ipTunnel.allowedConnections[%d]"
  263. "'ip6Address' required with 'ip6Prefix'.", i);
  264. exit(1);
  265. }
  266. Log_debug(ctx->logger, "Allowing IpTunnel connections from [%s]", key->bytes);
  267. if (ip4) {
  268. Log_debug(ctx->logger, "Issue IPv4 address %s", ip4->bytes);
  269. if (ip4Prefix) {
  270. Log_debug(ctx->logger, "Issue IPv4 netmask/prefix length /%d",
  271. (int) *ip4Prefix);
  272. } else {
  273. Log_debug(ctx->logger, "Use default netmask/prefix length /0");
  274. }
  275. }
  276. if (ip6) {
  277. Log_debug(ctx->logger, "Issue IPv6 address [%s]", ip6->bytes);
  278. if (ip6Prefix) {
  279. Log_debug(ctx->logger, "Issue IPv6 netmask/prefix length /%d",
  280. (int) *ip6Prefix);
  281. } else {
  282. Log_debug(ctx->logger, "Use default netmask/prefix length /0");
  283. }
  284. }
  285. Dict_putString(d, String_CONST("publicKeyOfAuthorizedNode"), key, tempAlloc);
  286. rpcCall0(String_CONST("IpTunnel_allowConnection"), d, ctx, tempAlloc, NULL, true);
  287. }
  288. }
  289. List* outgoing = Dict_getList(ifaceConf, String_CONST("outgoingConnections"));
  290. if (outgoing) {
  291. String* s;
  292. for (int i = 0; (s = List_getString(outgoing, i)) != NULL; i++) {
  293. Log_debug(ctx->logger, "Initiating IpTunnel connection to [%s]", s->bytes);
  294. Dict requestDict =
  295. Dict_CONST(String_CONST("publicKeyOfNodeToConnectTo"), String_OBJ(s), NULL);
  296. rpcCall0(String_CONST("IpTunnel_connectTo"), &requestDict, ctx, tempAlloc, NULL, true);
  297. }
  298. }
  299. }
  300. static void routerConfig(Dict* routerConf, struct Allocator* tempAlloc, struct Context* ctx)
  301. {
  302. tunInterface(Dict_getDict(routerConf, String_CONST("interface")), tempAlloc, ctx);
  303. ipTunnel(Dict_getDict(routerConf, String_CONST("ipTunnel")), tempAlloc, ctx);
  304. }
  305. static void ethInterfaceSetBeacon(int ifNum, Dict* eth, struct Context* ctx)
  306. {
  307. int64_t* beaconP = Dict_getInt(eth, String_CONST("beacon"));
  308. if (beaconP) {
  309. int64_t beacon = *beaconP;
  310. if (beacon > 3 || beacon < 0) {
  311. Log_error(ctx->logger, "interfaces.ETHInterface.beacon may only be 0, 1,or 2");
  312. } else {
  313. // We can cast beacon to an int here because we know it's small enough
  314. Log_info(ctx->logger, "Setting beacon mode on ETHInterface to [%d].", (int) beacon);
  315. Dict d = Dict_CONST(String_CONST("interfaceNumber"), Int_OBJ(ifNum),
  316. Dict_CONST(String_CONST("state"), Int_OBJ(beacon), NULL));
  317. rpcCall(String_CONST("ETHInterface_beacon"), &d, ctx, ctx->alloc);
  318. }
  319. }
  320. }
  321. static void ethInterface(Dict* config, struct Context* ctx)
  322. {
  323. List* ifaces = Dict_getList(config, String_CONST("ETHInterface"));
  324. if (!ifaces) {
  325. ifaces = List_new(ctx->alloc);
  326. List_addDict(ifaces, Dict_getDict(config, String_CONST("ETHInterface")), ctx->alloc);
  327. }
  328. uint32_t count = List_size(ifaces);
  329. for (uint32_t i = 0; i < count; i++) {
  330. Dict *eth = List_getDict(ifaces, i);
  331. if (!eth) { continue; }
  332. String* deviceStr = Dict_getString(eth, String_CONST("bind"));
  333. if (!deviceStr || !String_equals(String_CONST("all"), deviceStr)) { continue; }
  334. Log_info(ctx->logger, "Setting up all ETHInterfaces...");
  335. Dict* res = NULL;
  336. Dict* d = Dict_new(ctx->alloc);
  337. if (rpcCall0(String_CONST("ETHInterface_listDevices"), d, ctx, ctx->alloc, &res, false)) {
  338. Log_info(ctx->logger, "Getting device list failed");
  339. break;
  340. }
  341. List* devs = Dict_getList(res, String_CONST("devices"));
  342. uint32_t devCount = List_size(devs);
  343. for (uint32_t j = 0; j < devCount; j++) {
  344. Dict* d = Dict_new(ctx->alloc);
  345. String* deviceName = List_getString(devs, j);
  346. // skip loopback...
  347. if (String_equals(String_CONST("lo"), deviceName)) { continue; }
  348. Dict_putString(d, String_CONST("bindDevice"), deviceName, ctx->alloc);
  349. Dict* resp;
  350. Log_info(ctx->logger, "Creating new ETHInterface [%s]", deviceName->bytes);
  351. if (rpcCall0(String_CONST("ETHInterface_new"), d, ctx, ctx->alloc, &resp, false)) {
  352. Log_warn(ctx->logger, "Failed to create ETHInterface.");
  353. continue;
  354. }
  355. int ifNum = *(Dict_getInt(resp, String_CONST("interfaceNumber")));
  356. ethInterfaceSetBeacon(ifNum, eth, ctx);
  357. }
  358. return;
  359. }
  360. for (uint32_t i = 0; i < count; i++) {
  361. Dict *eth = List_getDict(ifaces, i);
  362. if (!eth) { continue; }
  363. // Setup the interface.
  364. String* deviceStr = Dict_getString(eth, String_CONST("bind"));
  365. Log_info(ctx->logger, "Setting up ETHInterface [%d].", i);
  366. Dict* d = Dict_new(ctx->alloc);
  367. if (deviceStr) {
  368. Log_info(ctx->logger, "Binding to device [%s].", deviceStr->bytes);
  369. Dict_putString(d, String_CONST("bindDevice"), deviceStr, ctx->alloc);
  370. }
  371. Dict* resp = NULL;
  372. if (rpcCall0(String_CONST("ETHInterface_new"), d, ctx, ctx->alloc, &resp, false)) {
  373. Log_warn(ctx->logger, "Failed to create ETHInterface.");
  374. continue;
  375. }
  376. int ifNum = *(Dict_getInt(resp, String_CONST("interfaceNumber")));
  377. ethInterfaceSetBeacon(ifNum, eth, ctx);
  378. // Make the connections.
  379. Dict* connectTo = Dict_getDict(eth, String_CONST("connectTo"));
  380. if (connectTo) {
  381. Log_info(ctx->logger, "ETHInterface should connect to a specific node.");
  382. struct Dict_Entry* entry = *connectTo;
  383. while (entry != NULL) {
  384. String* key = (String*) entry->key;
  385. if (entry->val->type != Object_DICT) {
  386. Log_critical(ctx->logger, "interfaces.ETHInterface.connectTo: entry [%s] "
  387. "is not a dictionary type.", key->bytes);
  388. exit(-1);
  389. }
  390. Dict* value = entry->val->as.dictionary;
  391. Log_keys(ctx->logger, "Attempting to connect to node [%s].", key->bytes);
  392. struct Allocator* perCallAlloc = Allocator_child(ctx->alloc);
  393. // Turn the dict from the config into our RPC args dict by filling in all
  394. // the arguments,
  395. Dict_putString(value, String_CONST("macAddress"), key, perCallAlloc);
  396. Dict_putInt(value, String_CONST("interfaceNumber"), ifNum, perCallAlloc);
  397. rpcCall(String_CONST("ETHInterface_beginConnection"), value, ctx, perCallAlloc);
  398. Allocator_free(perCallAlloc);
  399. entry = entry->next;
  400. }
  401. }
  402. }
  403. }
  404. static void security(struct Allocator* tempAlloc, List* conf, struct Log* log, struct Context* ctx)
  405. {
  406. int seccomp = 1;
  407. int nofiles = 0;
  408. int noforks = 1;
  409. int chroot = 1;
  410. int setupComplete = 1;
  411. int setuser = 1;
  412. int uid = -1;
  413. int keepNetAdmin = 1;
  414. do {
  415. Dict* d = Dict_new(tempAlloc);
  416. Dict_putString(d, String_CONST("user"), String_CONST("nobody"), tempAlloc);
  417. Dict* ret = NULL;
  418. rpcCall0(String_CONST("Security_getUser"), d, ctx, tempAlloc, &ret, true);
  419. uid = *Dict_getInt(ret, String_CONST("uid"));
  420. } while (0);
  421. for (int i = 0; conf && i < List_size(conf); i++) {
  422. Dict* elem = List_getDict(conf, i);
  423. String* s;
  424. if (elem && (s = Dict_getString(elem, String_CONST("setuser")))) {
  425. if (setuser == 0) { continue; }
  426. Dict* d = Dict_new(tempAlloc);
  427. Dict_putString(d, String_CONST("user"), s, tempAlloc);
  428. Dict* ret = NULL;
  429. rpcCall0(String_CONST("Security_getUser"), d, ctx, tempAlloc, &ret, true);
  430. uid = *Dict_getInt(ret, String_CONST("uid"));
  431. int64_t* nka = Dict_getInt(elem, String_CONST("keepNetAdmin"));
  432. int64_t* exemptAngel = Dict_getInt(elem, String_CONST("exemptAngel"));
  433. keepNetAdmin = ((nka) ? *nka : ((exemptAngel) ? *exemptAngel : 0));
  434. continue;
  435. }
  436. if (elem && (s = Dict_getString(elem, String_CONST("chroot")))) {
  437. Log_debug(log, "Security_chroot(%s)", s->bytes);
  438. Dict* d = Dict_new(tempAlloc);
  439. Dict_putString(d, String_CONST("root"), s, tempAlloc);
  440. rpcCall0(String_CONST("Security_chroot"), d, ctx, tempAlloc, NULL, false);
  441. chroot = 0;
  442. continue;
  443. }
  444. uint64_t* x;
  445. if (elem && (x = Dict_getInt(elem, String_CONST("nofiles")))) {
  446. if (!*x) { continue; }
  447. nofiles = 1;
  448. continue;
  449. }
  450. if (elem && (x = Dict_getInt(elem, String_CONST("setuser")))) {
  451. if (!*x) { setuser = 0; }
  452. continue;
  453. }
  454. if (elem && (x = Dict_getInt(elem, String_CONST("seccomp")))) {
  455. if (!*x) { seccomp = 0; }
  456. continue;
  457. }
  458. if (elem && (x = Dict_getInt(elem, String_CONST("noforks")))) {
  459. if (!*x) { noforks = 0; }
  460. continue;
  461. }
  462. if (elem && (x = Dict_getInt(elem, String_CONST("chroot")))) {
  463. if (!*x) { chroot = 0; }
  464. continue;
  465. }
  466. if (elem && (x = Dict_getInt(elem, String_CONST("setupComplete")))) {
  467. if (!*x) { setupComplete = 0; }
  468. continue;
  469. }
  470. Log_info(ctx->logger, "Unrecognized entry in security at index [%d]", i);
  471. }
  472. if (chroot) {
  473. Log_debug(log, "Security_chroot(/var/run)");
  474. Dict* d = Dict_new(tempAlloc);
  475. Dict_putString(d, String_CONST("root"), String_CONST("/var/run/"), tempAlloc);
  476. rpcCall0(String_CONST("Security_chroot"), d, ctx, tempAlloc, NULL, false);
  477. }
  478. if (noforks) {
  479. Log_debug(log, "Security_noforks()");
  480. Dict* d = Dict_new(tempAlloc);
  481. rpcCall(String_CONST("Security_noforks"), d, ctx, tempAlloc);
  482. }
  483. if (setuser) {
  484. Log_debug(log, "Security_setUser(uid:%d, keepNetAdmin:%d)", uid, keepNetAdmin);
  485. Dict* d = Dict_new(tempAlloc);
  486. Dict_putInt(d, String_CONST("uid"), uid, tempAlloc);
  487. Dict_putInt(d, String_CONST("keepNetAdmin"), keepNetAdmin, tempAlloc);
  488. rpcCall0(String_CONST("Security_setUser"), d, ctx, tempAlloc, NULL, false);
  489. }
  490. if (nofiles) {
  491. Log_debug(log, "Security_nofiles()");
  492. Dict* d = Dict_new(tempAlloc);
  493. rpcCall(String_CONST("Security_nofiles"), d, ctx, tempAlloc);
  494. }
  495. if (seccomp) {
  496. Log_debug(log, "Security_seccomp()");
  497. Dict* d = Dict_new(tempAlloc);
  498. rpcCall(String_CONST("Security_seccomp"), d, ctx, tempAlloc);
  499. }
  500. if (setupComplete) {
  501. Log_debug(log, "Security_setupComplete()");
  502. Dict* d = Dict_new(tempAlloc);
  503. rpcCall(String_CONST("Security_setupComplete"), d, ctx, tempAlloc);
  504. }
  505. }
  506. static int tryPing(struct Allocator* tempAlloc, struct Context* ctx)
  507. {
  508. Dict* resp = NULL;
  509. Dict* d = Dict_new(tempAlloc);
  510. rpcCall0(String_CONST("ping"), d, ctx, tempAlloc, &resp, false);
  511. if (!resp) { return -1; }
  512. String* q = Dict_getString(resp, String_CONST("q"));
  513. if (String_equals(q, String_CONST("pong"))) {
  514. return true;
  515. }
  516. return false;
  517. }
  518. static void awaken(void* vcontext)
  519. {
  520. struct Context* ctx = vcontext;
  521. EventBase_endLoop(ctx->base);
  522. }
  523. static void sleep(int milliseconds, struct Context* ctx, struct Allocator* temp)
  524. {
  525. Timeout_setTimeout(awaken, ctx, milliseconds, ctx->base, temp);
  526. EventBase_beginLoop(ctx->base);
  527. }
  528. static void waitUntilPong(struct Context* ctx)
  529. {
  530. for (int i = 0; i < 10; i++) {
  531. struct Allocator* temp = Allocator_child(ctx->alloc);
  532. if (tryPing(temp, ctx)) {
  533. Allocator_free(temp);
  534. return;
  535. }
  536. sleep(200, ctx, temp);
  537. Allocator_free(temp);
  538. }
  539. Assert_failure("Failed connecting to core (perhaps you have a firewall on loopback device?)");
  540. }
  541. void Configurator_config(Dict* config,
  542. struct Sockaddr* sockAddr,
  543. String* adminPassword,
  544. struct EventBase* eventBase,
  545. struct Log* logger,
  546. struct Allocator* alloc)
  547. {
  548. struct Allocator* tempAlloc = Allocator_child(alloc);
  549. struct UDPAddrIface* udp = UDPAddrIface_new(eventBase, NULL, alloc, NULL, logger);
  550. struct AdminClient* client =
  551. AdminClient_new(&udp->generic, sockAddr, adminPassword, eventBase, logger, tempAlloc);
  552. struct Context ctx = {
  553. .logger = logger,
  554. .alloc = tempAlloc,
  555. .client = client,
  556. .base = eventBase,
  557. };
  558. waitUntilPong(&ctx);
  559. List* authedPasswords = Dict_getList(config, String_CONST("authorizedPasswords"));
  560. if (authedPasswords) {
  561. authorizedPasswords(authedPasswords, &ctx);
  562. }
  563. Dict* ifaces = Dict_getDict(config, String_CONST("interfaces"));
  564. udpInterface(ifaces, &ctx);
  565. if (Defined(HAS_ETH_INTERFACE)) {
  566. ethInterface(ifaces, &ctx);
  567. }
  568. Dict* routerConf = Dict_getDict(config, String_CONST("router"));
  569. routerConfig(routerConf, tempAlloc, &ctx);
  570. List* secList = Dict_getList(config, String_CONST("security"));
  571. security(tempAlloc, secList, logger, &ctx);
  572. Log_debug(logger, "Cjdns started in the background");
  573. Allocator_free(tempAlloc);
  574. }