1 /*- 2 * Copyright (c) 2012 The FreeBSD Foundation 3 * All rights reserved. 4 * 5 * This software was developed by Edward Tomasz Napierala under sponsorship 6 * from the FreeBSD Foundation. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 * 29 * $FreeBSD$ 30 */ 31 32 #include <sys/types.h> 33 #include <sys/time.h> 34 #include <sys/ioctl.h> 35 #include <sys/param.h> 36 #include <sys/linker.h> 37 #include <sys/socket.h> 38 #include <sys/capability.h> 39 #include <sys/wait.h> 40 #include <assert.h> 41 #include <errno.h> 42 #include <fcntl.h> 43 #include <netdb.h> 44 #include <signal.h> 45 #include <stdbool.h> 46 #include <stdint.h> 47 #include <stdio.h> 48 #include <stdlib.h> 49 #include <string.h> 50 #include <unistd.h> 51 52 #include <libutil.h> 53 54 #include "iscsid.h" 55 56 static volatile bool sigalrm_received = false; 57 58 static int nchildren = 0; 59 60 static void 61 usage(void) 62 { 63 64 fprintf(stderr, "usage: iscsid [-P pidfile][-d][-m maxproc][-t timeout]\n"); 65 exit(1); 66 } 67 68 char * 69 checked_strdup(const char *s) 70 { 71 char *c; 72 73 c = strdup(s); 74 if (c == NULL) 75 log_err(1, "strdup"); 76 return (c); 77 } 78 79 static void 80 resolve_addr(const struct connection *conn, const char *address, 81 struct addrinfo **ai, bool initiator_side) 82 { 83 struct addrinfo hints; 84 char *arg, *addr, *ch; 85 const char *port; 86 int error, colons = 0; 87 88 arg = checked_strdup(address); 89 90 if (arg[0] == '\0') { 91 fail(conn, "empty address"); 92 log_errx(1, "empty address"); 93 } 94 if (arg[0] == '[') { 95 /* 96 * IPv6 address in square brackets, perhaps with port. 97 */ 98 arg++; 99 addr = strsep(&arg, "]"); 100 if (arg == NULL) { 101 fail(conn, "malformed address"); 102 log_errx(1, "malformed address %s", address); 103 } 104 if (arg[0] == '\0') { 105 port = NULL; 106 } else if (arg[0] == ':') { 107 port = arg + 1; 108 } else { 109 fail(conn, "malformed address"); 110 log_errx(1, "malformed address %s", address); 111 } 112 } else { 113 /* 114 * Either IPv6 address without brackets - and without 115 * a port - or IPv4 address. Just count the colons. 116 */ 117 for (ch = arg; *ch != '\0'; ch++) { 118 if (*ch == ':') 119 colons++; 120 } 121 if (colons > 1) { 122 addr = arg; 123 port = NULL; 124 } else { 125 addr = strsep(&arg, ":"); 126 if (arg == NULL) 127 port = NULL; 128 else 129 port = arg; 130 } 131 } 132 133 if (port == NULL && !initiator_side) 134 port = "3260"; 135 136 memset(&hints, 0, sizeof(hints)); 137 hints.ai_family = PF_UNSPEC; 138 hints.ai_socktype = SOCK_STREAM; 139 hints.ai_flags = AI_ADDRCONFIG | AI_NUMERICSERV; 140 if (initiator_side) 141 hints.ai_flags |= AI_PASSIVE; 142 143 error = getaddrinfo(addr, port, &hints, ai); 144 if (error != 0) { 145 fail(conn, gai_strerror(error)); 146 log_errx(1, "getaddrinfo for %s failed: %s", 147 address, gai_strerror(error)); 148 } 149 } 150 151 static struct connection * 152 connection_new(unsigned int session_id, const struct iscsi_session_conf *conf, 153 int iscsi_fd) 154 { 155 struct connection *conn; 156 struct addrinfo *from_ai, *to_ai; 157 const char *from_addr, *to_addr; 158 #ifdef ICL_KERNEL_PROXY 159 struct iscsi_daemon_connect idc; 160 #endif 161 int error; 162 163 conn = calloc(1, sizeof(*conn)); 164 if (conn == NULL) 165 log_err(1, "calloc"); 166 167 /* 168 * Default values, from RFC 3720, section 12. 169 */ 170 conn->conn_header_digest = CONN_DIGEST_NONE; 171 conn->conn_data_digest = CONN_DIGEST_NONE; 172 conn->conn_initial_r2t = true; 173 conn->conn_immediate_data = true; 174 conn->conn_max_data_segment_length = 8192; 175 conn->conn_max_burst_length = 262144; 176 conn->conn_first_burst_length = 65536; 177 178 conn->conn_session_id = session_id; 179 conn->conn_iscsi_fd = iscsi_fd; 180 181 /* 182 * XXX: Should we sanitize this somehow? 183 */ 184 memcpy(&conn->conn_conf, conf, sizeof(conn->conn_conf)); 185 186 from_addr = conn->conn_conf.isc_initiator_addr; 187 to_addr = conn->conn_conf.isc_target_addr; 188 189 if (from_addr[0] != '\0') 190 resolve_addr(conn, from_addr, &from_ai, true); 191 else 192 from_ai = NULL; 193 194 resolve_addr(conn, to_addr, &to_ai, false); 195 196 #ifdef ICL_KERNEL_PROXY 197 198 memset(&idc, 0, sizeof(idc)); 199 idc.idc_session_id = conn->conn_session_id; 200 if (conn->conn_conf.isc_iser) 201 idc.idc_iser = 1; 202 idc.idc_domain = to_ai->ai_family; 203 idc.idc_socktype = to_ai->ai_socktype; 204 idc.idc_protocol = to_ai->ai_protocol; 205 if (from_ai != NULL) { 206 idc.idc_from_addr = from_ai->ai_addr; 207 idc.idc_from_addrlen = from_ai->ai_addrlen; 208 } 209 idc.idc_to_addr = to_ai->ai_addr; 210 idc.idc_to_addrlen = to_ai->ai_addrlen; 211 212 log_debugx("connecting to %s using ICL kernel proxy", to_addr); 213 error = ioctl(iscsi_fd, ISCSIDCONNECT, &idc); 214 if (error != 0) { 215 fail(conn, strerror(errno)); 216 log_err(1, "failed to connect to %s using ICL kernel proxy", 217 to_addr); 218 } 219 220 #else /* !ICL_KERNEL_PROXY */ 221 222 if (conn->conn_conf.isc_iser) { 223 fail(conn, "iSER not supported"); 224 log_errx(1, "iscsid(8) compiled without ICL_KERNEL_PROXY " 225 "does not support iSER"); 226 } 227 228 conn->conn_socket = socket(to_ai->ai_family, to_ai->ai_socktype, 229 to_ai->ai_protocol); 230 if (conn->conn_socket < 0) { 231 fail(conn, strerror(errno)); 232 log_err(1, "failed to create socket for %s", from_addr); 233 } 234 if (from_ai != NULL) { 235 error = bind(conn->conn_socket, from_ai->ai_addr, 236 from_ai->ai_addrlen); 237 if (error != 0) { 238 fail(conn, strerror(errno)); 239 log_err(1, "failed to bind to %s", from_addr); 240 } 241 } 242 log_debugx("connecting to %s", to_addr); 243 error = connect(conn->conn_socket, to_ai->ai_addr, to_ai->ai_addrlen); 244 if (error != 0) { 245 fail(conn, strerror(errno)); 246 log_err(1, "failed to connect to %s", to_addr); 247 } 248 249 #endif /* !ICL_KERNEL_PROXY */ 250 251 return (conn); 252 } 253 254 static void 255 handoff(struct connection *conn) 256 { 257 struct iscsi_daemon_handoff idh; 258 int error; 259 260 log_debugx("handing off connection to the kernel"); 261 262 memset(&idh, 0, sizeof(idh)); 263 idh.idh_session_id = conn->conn_session_id; 264 #ifndef ICL_KERNEL_PROXY 265 idh.idh_socket = conn->conn_socket; 266 #endif 267 strlcpy(idh.idh_target_alias, conn->conn_target_alias, 268 sizeof(idh.idh_target_alias)); 269 memcpy(idh.idh_isid, conn->conn_isid, sizeof(idh.idh_isid)); 270 idh.idh_statsn = conn->conn_statsn; 271 idh.idh_header_digest = conn->conn_header_digest; 272 idh.idh_data_digest = conn->conn_data_digest; 273 idh.idh_initial_r2t = conn->conn_initial_r2t; 274 idh.idh_immediate_data = conn->conn_immediate_data; 275 idh.idh_max_data_segment_length = conn->conn_max_data_segment_length; 276 idh.idh_max_burst_length = conn->conn_max_burst_length; 277 idh.idh_first_burst_length = conn->conn_first_burst_length; 278 279 error = ioctl(conn->conn_iscsi_fd, ISCSIDHANDOFF, &idh); 280 if (error != 0) 281 log_err(1, "ISCSIDHANDOFF"); 282 } 283 284 void 285 fail(const struct connection *conn, const char *reason) 286 { 287 struct iscsi_daemon_fail idf; 288 int error; 289 290 memset(&idf, 0, sizeof(idf)); 291 idf.idf_session_id = conn->conn_session_id; 292 strlcpy(idf.idf_reason, reason, sizeof(idf.idf_reason)); 293 294 error = ioctl(conn->conn_iscsi_fd, ISCSIDFAIL, &idf); 295 if (error != 0) 296 log_err(1, "ISCSIDFAIL"); 297 } 298 299 /* 300 * XXX: I CANT INTO LATIN 301 */ 302 static void 303 capsicate(struct connection *conn) 304 { 305 int error; 306 cap_rights_t rights; 307 #ifdef ICL_KERNEL_PROXY 308 const unsigned long cmds[] = { ISCSIDCONNECT, ISCSIDSEND, ISCSIDRECEIVE, 309 ISCSIDHANDOFF, ISCSIDFAIL, ISCSISADD, ISCSISREMOVE }; 310 #else 311 const unsigned long cmds[] = { ISCSIDHANDOFF, ISCSIDFAIL, ISCSISADD, 312 ISCSISREMOVE }; 313 #endif 314 315 cap_rights_init(&rights, CAP_IOCTL); 316 error = cap_rights_limit(conn->conn_iscsi_fd, &rights); 317 if (error != 0 && errno != ENOSYS) 318 log_err(1, "cap_rights_limit"); 319 320 error = cap_ioctls_limit(conn->conn_iscsi_fd, cmds, 321 sizeof(cmds) / sizeof(cmds[0])); 322 if (error != 0 && errno != ENOSYS) 323 log_err(1, "cap_ioctls_limit"); 324 325 error = cap_enter(); 326 if (error != 0 && errno != ENOSYS) 327 log_err(1, "cap_enter"); 328 329 if (cap_sandboxed()) 330 log_debugx("Capsicum capability mode enabled"); 331 else 332 log_warnx("Capsicum capability mode not supported"); 333 } 334 335 bool 336 timed_out(void) 337 { 338 339 return (sigalrm_received); 340 } 341 342 static void 343 sigalrm_handler(int dummy __unused) 344 { 345 /* 346 * It would be easiest to just log an error and exit. We can't 347 * do this, though, because log_errx() is not signal safe, since 348 * it calls syslog(3). Instead, set a flag checked by pdu_send() 349 * and pdu_receive(), to call log_errx() there. Should they fail 350 * to notice, we'll exit here one second later. 351 */ 352 if (sigalrm_received) { 353 /* 354 * Oh well. Just give up and quit. 355 */ 356 _exit(2); 357 } 358 359 sigalrm_received = true; 360 } 361 362 static void 363 set_timeout(int timeout) 364 { 365 struct sigaction sa; 366 struct itimerval itv; 367 int error; 368 369 if (timeout <= 0) { 370 log_debugx("session timeout disabled"); 371 return; 372 } 373 374 bzero(&sa, sizeof(sa)); 375 sa.sa_handler = sigalrm_handler; 376 sigfillset(&sa.sa_mask); 377 error = sigaction(SIGALRM, &sa, NULL); 378 if (error != 0) 379 log_err(1, "sigaction"); 380 381 /* 382 * First SIGALRM will arive after conf_timeout seconds. 383 * If we do nothing, another one will arrive a second later. 384 */ 385 bzero(&itv, sizeof(itv)); 386 itv.it_interval.tv_sec = 1; 387 itv.it_value.tv_sec = timeout; 388 389 log_debugx("setting session timeout to %d seconds", 390 timeout); 391 error = setitimer(ITIMER_REAL, &itv, NULL); 392 if (error != 0) 393 log_err(1, "setitimer"); 394 } 395 396 static void 397 handle_request(int iscsi_fd, const struct iscsi_daemon_request *request, int timeout) 398 { 399 struct connection *conn; 400 401 log_set_peer_addr(request->idr_conf.isc_target_addr); 402 if (request->idr_conf.isc_target[0] != '\0') { 403 log_set_peer_name(request->idr_conf.isc_target); 404 setproctitle("%s (%s)", request->idr_conf.isc_target_addr, request->idr_conf.isc_target); 405 } else { 406 setproctitle("%s", request->idr_conf.isc_target_addr); 407 } 408 409 conn = connection_new(request->idr_session_id, &request->idr_conf, iscsi_fd); 410 set_timeout(timeout); 411 capsicate(conn); 412 login(conn); 413 if (conn->conn_conf.isc_discovery != 0) 414 discovery(conn); 415 else 416 handoff(conn); 417 418 log_debugx("nothing more to do; exiting"); 419 exit (0); 420 } 421 422 static int 423 wait_for_children(bool block) 424 { 425 pid_t pid; 426 int status; 427 int num = 0; 428 429 for (;;) { 430 /* 431 * If "block" is true, wait for at least one process. 432 */ 433 if (block && num == 0) 434 pid = wait4(-1, &status, 0, NULL); 435 else 436 pid = wait4(-1, &status, WNOHANG, NULL); 437 if (pid <= 0) 438 break; 439 if (WIFSIGNALED(status)) { 440 log_warnx("child process %d terminated with signal %d", 441 pid, WTERMSIG(status)); 442 } else if (WEXITSTATUS(status) != 0) { 443 log_warnx("child process %d terminated with exit status %d", 444 pid, WEXITSTATUS(status)); 445 } else { 446 log_debugx("child process %d terminated gracefully", pid); 447 } 448 num++; 449 } 450 451 return (num); 452 } 453 454 int 455 main(int argc, char **argv) 456 { 457 int ch, debug = 0, error, iscsi_fd, maxproc = 30, retval, saved_errno, 458 timeout = 60; 459 bool dont_daemonize = false; 460 struct pidfh *pidfh; 461 pid_t pid, otherpid; 462 const char *pidfile_path = DEFAULT_PIDFILE; 463 struct iscsi_daemon_request request; 464 465 while ((ch = getopt(argc, argv, "P:dl:m:t:")) != -1) { 466 switch (ch) { 467 case 'P': 468 pidfile_path = optarg; 469 break; 470 case 'd': 471 dont_daemonize = true; 472 debug++; 473 break; 474 case 'l': 475 debug = atoi(optarg); 476 break; 477 case 'm': 478 maxproc = atoi(optarg); 479 break; 480 case 't': 481 timeout = atoi(optarg); 482 break; 483 case '?': 484 default: 485 usage(); 486 } 487 } 488 argc -= optind; 489 if (argc != 0) 490 usage(); 491 492 log_init(debug); 493 494 pidfh = pidfile_open(pidfile_path, 0600, &otherpid); 495 if (pidfh == NULL) { 496 if (errno == EEXIST) 497 log_errx(1, "daemon already running, pid: %jd.", 498 (intmax_t)otherpid); 499 log_err(1, "cannot open or create pidfile \"%s\"", 500 pidfile_path); 501 } 502 503 iscsi_fd = open(ISCSI_PATH, O_RDWR); 504 if (iscsi_fd < 0 && errno == ENOENT) { 505 saved_errno = errno; 506 retval = kldload("iscsi"); 507 if (retval != -1) 508 iscsi_fd = open(ISCSI_PATH, O_RDWR); 509 else 510 errno = saved_errno; 511 } 512 if (iscsi_fd < 0) 513 log_err(1, "failed to open %s", ISCSI_PATH); 514 515 if (dont_daemonize == false) { 516 if (daemon(0, 0) == -1) { 517 log_warn("cannot daemonize"); 518 pidfile_remove(pidfh); 519 exit(1); 520 } 521 } 522 523 pidfile_write(pidfh); 524 525 for (;;) { 526 log_debugx("waiting for request from the kernel"); 527 528 memset(&request, 0, sizeof(request)); 529 error = ioctl(iscsi_fd, ISCSIDWAIT, &request); 530 if (error != 0) { 531 if (errno == EINTR) { 532 nchildren -= wait_for_children(false); 533 assert(nchildren >= 0); 534 continue; 535 } 536 537 log_err(1, "ISCSIDWAIT"); 538 } 539 540 if (dont_daemonize) { 541 log_debugx("not forking due to -d flag; " 542 "will exit after servicing a single request"); 543 } else { 544 nchildren -= wait_for_children(false); 545 assert(nchildren >= 0); 546 547 while (maxproc > 0 && nchildren >= maxproc) { 548 log_debugx("maxproc limit of %d child processes hit; " 549 "waiting for child process to exit", maxproc); 550 nchildren -= wait_for_children(true); 551 assert(nchildren >= 0); 552 } 553 log_debugx("incoming connection; forking child process #%d", 554 nchildren); 555 nchildren++; 556 557 pid = fork(); 558 if (pid < 0) 559 log_err(1, "fork"); 560 if (pid > 0) 561 continue; 562 } 563 564 pidfile_close(pidfh); 565 handle_request(iscsi_fd, &request, timeout); 566 } 567 568 return (0); 569 } 570