fix a heap overrun
[project/netifd.git] / proto-shell.c
1 #include <string.h>
2 #include <stdlib.h>
3 #include <stdio.h>
4 #include <glob.h>
5 #include <unistd.h>
6 #include <fcntl.h>
7 #include <signal.h>
8
9 #include <arpa/inet.h>
10 #include <netinet/in.h>
11
12 #include <libubox/blobmsg_json.h>
13
14 #include "netifd.h"
15 #include "interface.h"
16 #include "interface-ip.h"
17 #include "proto.h"
18
19 static int proto_fd;
20
21 struct proto_shell_handler {
22 struct list_head list;
23 struct proto_handler proto;
24 struct config_param_list config;
25 char *config_buf;
26 char script_name[];
27 };
28
29 struct proto_shell_state {
30 struct interface_proto_state proto;
31 struct proto_shell_handler *handler;
32 struct blob_attr *config;
33
34 struct device_user l3_dev;
35
36 struct uloop_timeout setup_timeout;
37 struct uloop_process setup_task;
38 struct uloop_process teardown_task;
39 bool teardown_pending;
40 };
41
42 static int
43 run_script(const char **argv, struct uloop_process *proc)
44 {
45 int pid;
46
47 if ((pid = fork()) < 0)
48 return -1;
49
50 if (!pid) {
51 fchdir(proto_fd);
52 execvp(argv[0], (char **) argv);
53 exit(127);
54 }
55
56 if (pid < 0)
57 return -1;
58
59 proc->pid = pid;
60 uloop_process_add(proc);
61
62 return 0;
63 }
64
65 static int
66 proto_shell_handler(struct interface_proto_state *proto,
67 enum interface_proto_cmd cmd, bool force)
68 {
69 struct proto_shell_state *state;
70 struct proto_shell_handler *handler;
71 struct uloop_process *proc;
72 const char *argv[6];
73 const char *action;
74 char *config;
75 int ret, i = 0;
76
77 state = container_of(proto, struct proto_shell_state, proto);
78 handler = state->handler;
79
80 if (cmd == PROTO_CMD_SETUP) {
81 action = "setup";
82 proc = &state->setup_task;
83 } else {
84 action = "teardown";
85 proc = &state->teardown_task;
86 if (state->setup_task.pending) {
87 uloop_timeout_set(&state->setup_timeout, 1000);
88 kill(state->setup_task.pid, SIGINT);
89 state->teardown_pending = true;
90 return 0;
91 }
92 }
93
94 config = blobmsg_format_json(state->config, true);
95 if (!config)
96 return -1;
97
98 argv[i++] = handler->script_name;
99 argv[i++] = handler->proto.name;
100 argv[i++] = action;
101 argv[i++] = proto->iface->name;
102 argv[i++] = config;
103 if (proto->iface->main_dev.dev)
104 argv[i++] = proto->iface->main_dev.dev->ifname;
105 argv[i] = NULL;
106
107 ret = run_script(argv, proc);
108 free(config);
109
110 return ret;
111 }
112
113 static void
114 proto_shell_setup_timeout_cb(struct uloop_timeout *timeout)
115 {
116 struct proto_shell_state *state;
117
118 state = container_of(timeout, struct proto_shell_state, setup_timeout);
119 kill(state->setup_task.pid, SIGKILL);
120 }
121
122 static void
123 proto_shell_setup_cb(struct uloop_process *p, int ret)
124 {
125 struct proto_shell_state *state;
126
127 state = container_of(p, struct proto_shell_state, setup_task);
128 uloop_timeout_cancel(&state->setup_timeout);
129 if (state->teardown_pending) {
130 state->teardown_pending = false;
131 proto_shell_handler(&state->proto, PROTO_CMD_TEARDOWN, false);
132 }
133 }
134
135 static void
136 proto_shell_teardown_cb(struct uloop_process *p, int ret)
137 {
138 struct proto_shell_state *state;
139
140 state = container_of(p, struct proto_shell_state, teardown_task);
141 state->proto.proto_event(&state->proto, IFPEV_DOWN);
142 if (state->l3_dev.dev)
143 device_remove_user(&state->l3_dev);
144 }
145
146 static void
147 proto_shell_free(struct interface_proto_state *proto)
148 {
149 struct proto_shell_state *state;
150
151 state = container_of(proto, struct proto_shell_state, proto);
152 free(state->config);
153 free(state);
154 }
155
156 static void
157 proto_shell_parse_addr_list(struct interface *iface, struct blob_attr *attr,
158 bool v6, bool external)
159 {
160 struct device_addr *addr;
161 struct blob_attr *cur;
162 int rem;
163
164 blobmsg_for_each_attr(cur, attr, rem) {
165 if (blobmsg_type(cur) != BLOBMSG_TYPE_STRING) {
166 DPRINTF("Ignore wrong address type: %d\n", blobmsg_type(cur));
167 continue;
168 }
169
170 addr = proto_parse_ip_addr_string(blobmsg_data(cur), v6, v6 ? 32 : 128);
171 if (!addr) {
172 DPRINTF("Failed to parse IP address string: %s\n", (char *) blobmsg_data(cur));
173 continue;
174 }
175
176 if (external)
177 addr->flags |= DEVADDR_EXTERNAL;
178
179 vlist_add(&iface->proto_addr, &addr->node);
180 }
181 }
182
183 enum {
184 ROUTE_TARGET,
185 ROUTE_MASK,
186 ROUTE_GATEWAY,
187 ROUTE_DEVICE,
188 __ROUTE_LAST
189 };
190
191 static const struct blobmsg_policy route_attr[__ROUTE_LAST] = {
192 [ROUTE_TARGET] = { .name = "target", .type = BLOBMSG_TYPE_STRING },
193 [ROUTE_MASK] = { .name = "mask", .type = BLOBMSG_TYPE_INT32 },
194 [ROUTE_GATEWAY] = { .name = "gateway", .type = BLOBMSG_TYPE_STRING },
195 [ROUTE_DEVICE] = { .name = "device", .type = BLOBMSG_TYPE_STRING },
196 };
197
198 static void
199 parse_route(struct interface *iface, struct blob_attr *attr, bool v6)
200 {
201 struct blob_attr *tb[__ROUTE_LAST], *cur;
202 struct device_route *route;
203 int af = v6 ? AF_INET6 : AF_INET;
204
205 blobmsg_parse(route_attr, __ROUTE_LAST, tb, blobmsg_data(attr), blobmsg_data_len(attr));
206
207 if (!tb[ROUTE_GATEWAY] && !tb[ROUTE_DEVICE])
208 return;
209
210 route = calloc(1, sizeof(*route));
211 if (!route)
212 return;
213
214 route->mask = v6 ? 128 : 32;
215 if ((cur = tb[ROUTE_MASK]) != NULL) {
216 route->mask = blobmsg_get_u32(cur);
217 if (route->mask > v6 ? 128 : 32)
218 goto error;
219 }
220
221 if ((cur = tb[ROUTE_TARGET]) != NULL) {
222 if (!inet_pton(af, blobmsg_data(cur), &route->addr)) {
223 DPRINTF("Failed to parse route target: %s\n", (char *) blobmsg_data(cur));
224 goto error;
225 }
226 }
227
228 if ((cur = tb[ROUTE_GATEWAY]) != NULL) {
229 if (!inet_pton(af, blobmsg_data(cur), &route->nexthop)) {
230 DPRINTF("Failed to parse route gateway: %s\n", (char *) blobmsg_data(cur));
231 goto error;
232 }
233 }
234
235 if ((cur = tb[ROUTE_DEVICE]) != NULL)
236 route->device = device_get(blobmsg_data(cur), true);
237
238 vlist_add(&iface->proto_route, &route->node);
239 return;
240
241 error:
242 free(route);
243 }
244
245 static void
246 proto_shell_parse_route_list(struct interface *iface, struct blob_attr *attr,
247 bool v6)
248 {
249 struct blob_attr *cur;
250 int rem;
251
252 blobmsg_for_each_attr(cur, attr, rem) {
253 if (blobmsg_type(cur) != BLOBMSG_TYPE_TABLE) {
254 DPRINTF("Ignore wrong route type: %d\n", blobmsg_type(cur));
255 continue;
256 }
257
258 parse_route(iface, cur, v6);
259 }
260 }
261
262
263 enum {
264 NOTIFY_LINK_UP,
265 NOTIFY_IFNAME,
266 NOTIFY_ADDR_EXT,
267 NOTIFY_IPADDR,
268 NOTIFY_IP6ADDR,
269 NOTIFY_ROUTES,
270 NOTIFY_ROUTES6,
271 __NOTIFY_LAST
272 };
273
274 static const struct blobmsg_policy notify_attr[__NOTIFY_LAST] = {
275 [NOTIFY_LINK_UP] = { .name = "link-up", .type = BLOBMSG_TYPE_BOOL },
276 [NOTIFY_IFNAME] = { .name = "ifname", .type = BLOBMSG_TYPE_STRING },
277 [NOTIFY_ADDR_EXT] = { .name = "address-external", .type = BLOBMSG_TYPE_BOOL },
278 [NOTIFY_IPADDR] = { .name = "ipaddr", .type = BLOBMSG_TYPE_ARRAY },
279 [NOTIFY_IP6ADDR] = { .name = "ip6addr", .type = BLOBMSG_TYPE_ARRAY },
280 [NOTIFY_ROUTES] = { .name = "routes", .type = BLOBMSG_TYPE_ARRAY },
281 [NOTIFY_ROUTES6] = { .name = "routes6", .type = BLOBMSG_TYPE_ARRAY },
282 };
283
284 static int
285 proto_shell_notify(struct interface_proto_state *proto, struct blob_attr *attr)
286 {
287 struct proto_shell_state *state;
288 struct blob_attr *tb[__NOTIFY_LAST], *cur;
289 bool addr_ext = false;
290 bool up;
291
292 state = container_of(proto, struct proto_shell_state, proto);
293
294 blobmsg_parse(notify_attr, __NOTIFY_LAST, tb, blob_data(attr), blob_len(attr));
295 if (!tb[NOTIFY_LINK_UP])
296 return UBUS_STATUS_INVALID_ARGUMENT;
297
298 up = blobmsg_get_bool(tb[NOTIFY_LINK_UP]);
299 if (up) {
300 if (!tb[NOTIFY_IFNAME])
301 return UBUS_STATUS_INVALID_ARGUMENT;
302
303 if (!state->l3_dev.dev) {
304 device_add_user(&state->l3_dev,
305 device_get(blobmsg_data(tb[NOTIFY_IFNAME]), true));
306 device_claim(&state->l3_dev);
307 state->proto.iface->l3_dev = &state->l3_dev;
308 }
309 state->proto.proto_event(&state->proto, IFPEV_UP);
310 } else {
311 state->proto.proto_event(&state->proto, IFPEV_LINK_LOST);
312 }
313
314 if ((cur = tb[NOTIFY_ADDR_EXT]) != NULL)
315 addr_ext = blobmsg_get_bool(cur);
316
317 if ((cur = tb[NOTIFY_IPADDR]) != NULL)
318 proto_shell_parse_addr_list(state->proto.iface, cur, false, addr_ext);
319
320 if ((cur = tb[NOTIFY_IP6ADDR]) != NULL)
321 proto_shell_parse_addr_list(state->proto.iface, cur, true, addr_ext);
322
323 if ((cur = tb[NOTIFY_ROUTES]) != NULL)
324 proto_shell_parse_route_list(state->proto.iface, cur, false);
325
326 if ((cur = tb[NOTIFY_ROUTES6]) != NULL)
327 proto_shell_parse_route_list(state->proto.iface, cur, true);
328
329 return 0;
330 }
331
332 struct interface_proto_state *
333 proto_shell_attach(const struct proto_handler *h, struct interface *iface,
334 struct blob_attr *attr)
335 {
336 struct proto_shell_state *state;
337
338 state = calloc(1, sizeof(*state));
339 state->config = malloc(blob_pad_len(attr));
340 if (!state->config)
341 goto error;
342
343 memcpy(state->config, attr, blob_pad_len(attr));
344 state->proto.free = proto_shell_free;
345 state->proto.notify = proto_shell_notify;
346 state->proto.cb = proto_shell_handler;
347 state->setup_timeout.cb = proto_shell_setup_timeout_cb;
348 state->setup_task.cb = proto_shell_setup_cb;
349 state->teardown_task.cb = proto_shell_teardown_cb;
350 state->handler = container_of(h, struct proto_shell_handler, proto);
351
352 return &state->proto;
353
354 error:
355 free(state);
356 return NULL;
357 }
358
359 static json_object *
360 check_type(json_object *obj, json_type type)
361 {
362 if (!obj)
363 return NULL;
364
365 if (json_object_get_type(obj) != type)
366 return NULL;
367
368 return obj;
369 }
370
371 static inline json_object *
372 get_field(json_object *obj, const char *name, json_type type)
373 {
374 return check_type(json_object_object_get(obj, name), type);
375 }
376
377 static char *
378 proto_shell_parse_config(struct config_param_list *config, json_object *obj)
379 {
380 struct blobmsg_policy *attrs;
381 char *str_buf, *str_cur;
382 int str_len = 0;
383 int i;
384
385 config->n_params = json_object_array_length(obj);
386 attrs = calloc(1, sizeof(*attrs) * config->n_params);
387 if (!attrs)
388 return NULL;
389
390 config->params = attrs;
391 for (i = 0; i < config->n_params; i++) {
392 json_object *cur, *name, *type;
393
394 cur = check_type(json_object_array_get_idx(obj, i), json_type_array);
395 if (!cur)
396 goto error;
397
398 name = check_type(json_object_array_get_idx(cur, 0), json_type_string);
399 if (!name)
400 goto error;
401
402 type = check_type(json_object_array_get_idx(cur, 1), json_type_int);
403 if (!type)
404 goto error;
405
406 attrs[i].name = json_object_get_string(name);
407 attrs[i].type = json_object_get_int(type);
408 if (attrs[i].type > BLOBMSG_TYPE_LAST)
409 goto error;
410
411 str_len += strlen(attrs[i].name + 1);
412 }
413
414 str_buf = malloc(str_len);
415 if (!str_buf)
416 goto error;
417
418 str_cur = str_buf;
419 for (i = 0; i < config->n_params; i++) {
420 const char *name = attrs[i].name;
421
422 attrs[i].name = str_cur;
423 str_cur += sprintf(str_cur, "%s", name) + 1;
424 }
425
426 return str_buf;
427
428 error:
429 free(attrs);
430 config->n_params = 0;
431 return NULL;
432 }
433
434 static void
435 proto_shell_add_handler(const char *script, json_object *obj)
436 {
437 struct proto_shell_handler *handler;
438 struct proto_handler *proto;
439 json_object *config, *tmp;
440 const char *name;
441 char *str;
442
443 if (!check_type(obj, json_type_object))
444 return;
445
446 tmp = get_field(obj, "name", json_type_string);
447 if (!tmp)
448 return;
449
450 name = json_object_get_string(tmp);
451
452 handler = calloc(1, sizeof(*handler) +
453 strlen(script) + 1 +
454 strlen(name) + 1);
455 if (!handler)
456 return;
457
458 strcpy(handler->script_name, script);
459
460 str = handler->script_name + strlen(handler->script_name) + 1;
461 strcpy(str, name);
462
463 proto = &handler->proto;
464 proto->name = str;
465 proto->config_params = &handler->config;
466 proto->attach = proto_shell_attach;
467
468 tmp = get_field(obj, "no-device", json_type_boolean);
469 if (tmp && json_object_get_boolean(tmp))
470 handler->proto.flags |= PROTO_FLAG_NODEV;
471
472 config = get_field(obj, "config", json_type_array);
473 if (config)
474 handler->config_buf = proto_shell_parse_config(&handler->config, config);
475
476 DPRINTF("Add handler for script %s: %s\n", script, proto->name);
477 add_proto_handler(proto);
478 }
479
480 static void proto_shell_add_script(const char *name)
481 {
482 struct json_tokener *tok = NULL;
483 json_object *obj;
484 static char buf[512];
485 char *start, *end, *cmd;
486 FILE *f;
487 int buflen, len;
488
489 #define DUMP_SUFFIX " '' dump"
490
491 cmd = alloca(strlen(name) + 1 + sizeof(DUMP_SUFFIX));
492 sprintf(cmd, "%s" DUMP_SUFFIX, name);
493
494 f = popen(cmd, "r");
495 if (!f)
496 return;
497
498 do {
499 buflen = fread(buf, 1, sizeof(buf) - 1, f);
500 if (buflen <= 0)
501 continue;
502
503 start = buf;
504 len = buflen;
505 do {
506 end = memchr(start, '\n', len);
507 if (end)
508 len = end - start;
509
510 if (!tok)
511 tok = json_tokener_new();
512
513 obj = json_tokener_parse_ex(tok, start, len);
514 if (!is_error(obj)) {
515 proto_shell_add_handler(name, obj);
516 json_object_put(obj);
517 json_tokener_free(tok);
518 tok = NULL;
519 }
520
521 if (end) {
522 start = end + 1;
523 len = buflen - (start - buf);
524 }
525 } while (len > 0);
526 } while (!feof(f) && !ferror(f));
527
528 if (tok)
529 json_tokener_free(tok);
530
531 pclose(f);
532 }
533
534 void __init proto_shell_init(void)
535 {
536 glob_t g;
537 int main_fd;
538 int i;
539
540 main_fd = open(".", O_RDONLY | O_DIRECTORY);
541 if (main_fd < 0)
542 return;
543
544 if (chdir(main_path)) {
545 perror("chdir(main path)");
546 goto close_cur;
547 }
548
549 if (chdir("./proto"))
550 goto close_cur;
551
552 proto_fd = open(".", O_RDONLY | O_DIRECTORY);
553 if (proto_fd < 0)
554 goto close_cur;
555
556 glob("./*.sh", 0, NULL, &g);
557 for (i = 0; i < g.gl_pathc; i++)
558 proto_shell_add_script(g.gl_pathv[i]);
559
560 close_cur:
561 fchdir(main_fd);
562 close(main_fd);
563 }