Copy the updated proc.c from relayd to use the same file. Adjust

snmpd accordingly.

ok sthen@

5 files changed, 347 insertions, 130 deletions

diff --git a/usr.sbin/snmpd/control.c b/usr.sbin/snmpd/control.c
index d5bfada60cc..ed99aaba5fc 100644
--- a/usr.sbin/snmpd/control.c
+++ b/usr.sbin/snmpd/control.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: control.c,v 1.22 2014/04/14 12:55:10 blambert Exp $	*/
+/*	$OpenBSD: control.c,v 1.23 2014/04/21 19:47:27 reyk Exp $	*/
 
 /*
  * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org>
@@ -329,11 +329,11 @@ control_dispatch_imsg(int fd, short event, void *arg)
 			for (i = 0; i < PROC_MAX; i++) {
 				if (privsep_process == PROC_CONTROL)
 					continue;
-				proc_forward_imsg(&env->sc_ps, &imsg, i);
+				proc_forward_imsg(&env->sc_ps, &imsg, i, -1);
 			}
 			break;
 		case IMSG_CTL_RELOAD:
-			proc_forward_imsg(&env->sc_ps, &imsg, PROC_PARENT);
+			proc_forward_imsg(&env->sc_ps, &imsg, PROC_PARENT, -1);
 			break;
 		default:
 			log_debug("%s: error handling imsg %d",
diff --git a/usr.sbin/snmpd/proc.c b/usr.sbin/snmpd/proc.c
index 8acf2caf416..93fdac6fd6f 100644
--- a/usr.sbin/snmpd/proc.c
+++ b/usr.sbin/snmpd/proc.c
@@ -1,7 +1,7 @@
-/*	$OpenBSD: proc.c,v 1.5 2014/04/18 21:29:20 tedu Exp $	*/
+/*	$OpenBSD: proc.c,v 1.6 2014/04/21 19:47:27 reyk Exp $	*/
 
 /*
- * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org>
+ * Copyright (c) 2010 - 2014 Reyk Floeter <reyk@openbsd.org>
  * Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -20,50 +20,111 @@
 #include <sys/types.h>
 #include <sys/queue.h>
 #include <sys/socket.h>
-#include <sys/param.h>
 #include <sys/wait.h>
 #include <sys/tree.h>
 
 #include <net/if.h>
+#include <netinet/in_systm.h>
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <arpa/inet.h>
 
-#include <string.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include <getopt.h>
-#include <err.h>
+#include <unistd.h>
+#include <string.h>
 #include <errno.h>
-#include <event.h>
 #include <signal.h>
-#include <unistd.h>
 #include <pwd.h>
+#include <event.h>
 
 #include <openssl/rand.h>
+#include <openssl/ssl.h>
 
 #include "snmpd.h"
 
-void	 proc_setup(struct privsep *);
+void	 proc_open(struct privsep *, struct privsep_proc *,
+	    struct privsep_proc *, size_t);
+void	 proc_close(struct privsep *);
+int	 proc_ispeer(struct privsep_proc *, u_int, enum privsep_procid);
 void	 proc_shutdown(struct privsep_proc *);
 void	 proc_sig_handler(int, short, void *);
+void	 proc_range(struct privsep *, enum privsep_procid, int *, int *);
+
+int
+proc_ispeer(struct privsep_proc *procs, u_int nproc, enum privsep_procid type)
+{
+	u_int	i;
+
+	for (i = 0; i < nproc; i++)
+		if (procs[i].p_id == type)
+			return (1);
+	return (0);
+}
 
 void
-proc_init(struct privsep *ps, struct privsep_proc *p, u_int nproc)
+proc_init(struct privsep *ps, struct privsep_proc *procs, u_int nproc)
 {
-	u_int	 i;
+	u_int			 i, j, src, dst;
+	struct privsep_pipes	*pp;
 
 	/*
-	 * Called from parent
+	 * Allocate pipes for all process instances (incl. parent)
+	 *
+	 * - ps->ps_pipes: N:M mapping
+	 * N source processes connected to M destination processes:
+	 * [src][instances][dst][instances], for example
+	 * [PROC_RELAY][3][PROC_CA][3]
+	 *
+	 * - ps->ps_pp: per-process 1:M part of ps->ps_pipes
+	 * Each process instance has a destination array of socketpair fds:
+	 * [dst][instances], for example
+	 * [PROC_PARENT][0]
+	 */
+	for (src = 0; src < PROC_MAX; src++) {
+		/* Allocate destination array for each process */
+		if ((ps->ps_pipes[src] = calloc(ps->ps_ninstances,
+		    sizeof(struct privsep_pipes))) == NULL)
+			fatal("proc_init: calloc");
+
+		for (i = 0; i < ps->ps_ninstances; i++) {
+			pp = &ps->ps_pipes[src][i];
+
+			for (dst = 0; dst < PROC_MAX; dst++) {
+				/* Allocate maximum fd integers */
+				if ((pp->pp_pipes[dst] =
+				    calloc(ps->ps_ninstances,
+				    sizeof(int))) == NULL)
+					fatal("proc_init: calloc");
+
+				/* Mark fd as unused */
+				for (j = 0; j < ps->ps_ninstances; j++)
+					pp->pp_pipes[dst][j] = -1;
+			}
+		}
+	}
+
+	/*
+	 * Setup and run the parent and its children
 	 */
 	privsep_process = PROC_PARENT;
+	ps->ps_instances[PROC_PARENT] = 1;
 	ps->ps_title[PROC_PARENT] = "parent";
 	ps->ps_pid[PROC_PARENT] = getpid();
+	ps->ps_pp = &ps->ps_pipes[privsep_process][0];
 
-	proc_setup(ps);
+	for (i = 0; i < nproc; i++) {
+		/* Default to 1 process instance */
+		if (ps->ps_instances[procs[i].p_id] < 1)
+			ps->ps_instances[procs[i].p_id] = 1;
+		ps->ps_title[procs[i].p_id] = procs[i].p_title;
+	}
+
+	proc_open(ps, NULL, procs, nproc);
 
 	/* Engage! */
-	for (i = 0; i < nproc; i++, p++) {
-		ps->ps_title[p->p_id] = p->p_title;
-		ps->ps_pid[p->p_id] = (*p->p_init)(ps, p);
-	}
+	for (i = 0; i < nproc; i++)
+		ps->ps_pid[procs[i].p_id] = (*procs[i].p_init)(ps, &procs[i]);
 }
 
 void
@@ -78,105 +139,175 @@ proc_kill(struct privsep *ps)
 	for (i = 0; i < PROC_MAX; i++) {
 		if (ps->ps_pid[i] == 0)
 			continue;
-		kill(ps->ps_pid[i], SIGTERM);
+		killpg(ps->ps_pid[i], SIGTERM);
 	}
 
 	do {
 		pid = waitpid(WAIT_ANY, NULL, 0);
 	} while (pid != -1 || (pid == -1 && errno == EINTR));
+
+	proc_close(ps);
 }
 
 void
-proc_setup(struct privsep *ps)
+proc_open(struct privsep *ps, struct privsep_proc *p,
+    struct privsep_proc *procs, size_t nproc)
 {
-	int	 i, j, sockpair[2];
-
-	for (i = 0; i < PROC_MAX; i++)
-		for (j = 0; j < PROC_MAX; j++) {
-			if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC,
-			    sockpair) == -1)
-				fatal("sockpair");
-			ps->ps_pipes[i][j] = sockpair[0];
-			ps->ps_pipes[j][i] = sockpair[1];
-			socket_set_blockmode(ps->ps_pipes[i][j],
-			    BM_NONBLOCK);
-			socket_set_blockmode(ps->ps_pipes[j][i],
-			    BM_NONBLOCK);
+	struct privsep_pipes	*pa, *pb;
+	int			 fds[2];
+	u_int			 i, j, src, proc;
+
+	if (p == NULL)
+		src = privsep_process; /* parent */
+	else
+		src = p->p_id;
+
+	/*
+	 * Open socket pairs for our peers
+	 */	
+	for (proc = 0; proc < nproc; proc++) {
+		procs[proc].p_ps = ps;
+		procs[proc].p_env = ps->ps_env;
+
+		for (i = 0; i < ps->ps_instances[src]; i++) {
+			for (j = 0; j < ps->ps_instances[procs[proc].p_id];
+			    j++) {
+				pa = &ps->ps_pipes[src][i];
+				pb = &ps->ps_pipes[procs[proc].p_id][j];
+
+				/* Check if fds are already set by peer */
+				if (pa->pp_pipes[procs[proc].p_id][j] != -1)
+					continue;
+
+				if (socketpair(AF_UNIX, SOCK_STREAM,
+				    PF_UNSPEC, fds) == -1)
+					fatal("socketpair");
+
+				socket_set_blockmode(fds[0], BM_NONBLOCK);
+				socket_set_blockmode(fds[1], BM_NONBLOCK);
+
+				pa->pp_pipes[procs[proc].p_id][j] = fds[0];
+				pb->pp_pipes[src][i] = fds[1];
+			}
 		}
+	}
 }
 
 void
-proc_config(struct privsep *ps, struct privsep_proc *p, u_int nproc)
+proc_listen(struct privsep *ps, struct privsep_proc *procs, size_t nproc)
 {
-	u_int	 src, dst, i, j, k, found;
-
-	src = privsep_process;
+	u_int			 i, dst, src, n, m;
+	struct privsep_pipes	*pp;
 
 	/*
-	 * close unused pipes
+	 * Close unused pipes
 	 */
-	for (i = 0; i < PROC_MAX; i++) {
-		if (i != privsep_process) {
-			for (j = 0; j < PROC_MAX; j++) {
-				close(ps->ps_pipes[i][j]);
-				ps->ps_pipes[i][j] = -1;
-			}
-		} else {
-			for (j = found = 0; j < PROC_MAX; j++, found = 0) {
-				for (k = 0; k < nproc; k++) {
-					if (p[k].p_id == j)
-						found++;
-				}
-				if (!found) {
-					close(ps->ps_pipes[i][j]);
-					ps->ps_pipes[i][j] = -1;
+	for (src = 0; src < PROC_MAX; src++) {
+		for (n = 0; n < ps->ps_instances[src]; n++) {
+			/* Ingore current process */
+			if (src == (u_int)privsep_process &&
+			    n == ps->ps_instance)
+				continue;
+
+			pp = &ps->ps_pipes[src][n];
+
+			for (dst = 0; dst < PROC_MAX; dst++) {
+				if (src == dst)
+					continue;
+				for (m = 0; m < ps->ps_instances[dst]; m++) {
+					if (pp->pp_pipes[dst][m] == -1)
+						continue;
+
+					/* Close and invalidate fd */
+					close(pp->pp_pipes[dst][m]);
+					pp->pp_pipes[dst][m] = -1;
 				}
 			}
 		}
 	}
 
+	src = privsep_process;
+	ps->ps_pp = pp = &ps->ps_pipes[src][ps->ps_instance];
+
 	/*
-	 * listen on appropriate pipes
+	 * Listen on appropriate pipes
 	 */
-	for (i = 0; i < nproc; i++, p++) {
-		dst = p->p_id;
-		p->p_ps = ps;
-		p->p_env = ps->ps_env;
-
-		imsg_init(&ps->ps_ievs[dst].ibuf,
-		    ps->ps_pipes[src][dst]);
-		ps->ps_ievs[dst].handler = proc_dispatch;
-		ps->ps_ievs[dst].events = EV_READ;
-		ps->ps_ievs[dst].data = p;
-		ps->ps_ievs[dst].name = p->p_title;
-		event_set(&ps->ps_ievs[dst].ev,
-		    ps->ps_ievs[dst].ibuf.fd,
-		    ps->ps_ievs[dst].events,
-		    ps->ps_ievs[dst].handler,
-		    ps->ps_ievs[dst].data);
-		event_add(&ps->ps_ievs[dst].ev, NULL);
+	for (i = 0; i < nproc; i++) {
+		dst = procs[i].p_id;
+
+		if (src == dst)
+			fatal("proc_listen: cannot peer with oneself");
+
+		if ((ps->ps_ievs[dst] = calloc(ps->ps_instances[dst],
+		    sizeof(struct imsgev))) == NULL)
+			fatal("proc_open");
+
+		for (n = 0; n < ps->ps_instances[dst]; n++) {
+			if (pp->pp_pipes[dst][n] == -1)
+				continue;
+
+			imsg_init(&(ps->ps_ievs[dst][n].ibuf),
+			    pp->pp_pipes[dst][n]);
+			ps->ps_ievs[dst][n].handler = proc_dispatch;
+			ps->ps_ievs[dst][n].events = EV_READ;
+			ps->ps_ievs[dst][n].proc = &procs[i];
+			ps->ps_ievs[dst][n].data = &ps->ps_ievs[dst][n];
+			procs[i].p_instance = n;
+
+			event_set(&(ps->ps_ievs[dst][n].ev),
+			    ps->ps_ievs[dst][n].ibuf.fd,
+			    ps->ps_ievs[dst][n].events,
+			    ps->ps_ievs[dst][n].handler,
+			    ps->ps_ievs[dst][n].data);
+			event_add(&(ps->ps_ievs[dst][n].ev), NULL);
+		}
 	}
 }
 
 void
-proc_shutdown(struct privsep_proc *p)
+proc_close(struct privsep *ps)
 {
-	struct privsep		*ps = p->p_ps;
-	struct control_sock	*rcs;
+	u_int			 dst, n;
+	struct privsep_pipes	*pp;
 
-	if (p->p_shutdown != NULL)
-		(p->p_shutdown)(ps, p);
+	if (ps == NULL)
+		return;
 
-	if (p->p_id == PROC_CONTROL && ps) {
-		control_cleanup(&ps->ps_csock);
-		while ((rcs = TAILQ_FIRST(&ps->ps_rcsocks)) != NULL) {
-			TAILQ_REMOVE(&ps->ps_rcsocks, rcs, cs_entry);
-			control_cleanup(rcs);
-			free(rcs);
+	pp = ps->ps_pp;
+
+	for (dst = 0; dst < PROC_MAX; dst++) {
+		if (ps->ps_ievs[dst] == NULL)
+			continue;
+
+		for (n = 0; n < ps->ps_instances[dst]; n++) {
+			if (pp->pp_pipes[dst][n] == -1)
+				continue;
+
+			/* Cancel the fd, close and invalidate the fd */
+			event_del(&(ps->ps_ievs[dst][n].ev));
+			imsg_clear(&(ps->ps_ievs[dst][n].ibuf));
+			close(pp->pp_pipes[dst][n]);
+			pp->pp_pipes[dst][n] = -1;
 		}
+		free(ps->ps_ievs[dst]);
 	}
+}
+
+void
+proc_shutdown(struct privsep_proc *p)
+{
+	struct privsep	*ps = p->p_ps;
+
+	if (p->p_id == PROC_CONTROL && ps)
+		control_cleanup(&ps->ps_csock);
+
+	if (p->p_shutdown != NULL)
+		(*p->p_shutdown)();
+
+	proc_close(ps);
+
+	log_info("%s exiting, pid %d", p->p_title, getpid());
 
-	log_info("%s exiting", p->p_title);
 	_exit(0);
 }
 
@@ -204,17 +335,25 @@ proc_sig_handler(int sig, short event, void *arg)
 pid_t
 proc_run(struct privsep *ps, struct privsep_proc *p,
     struct privsep_proc *procs, u_int nproc,
-    void (*init)(struct privsep *, void *), void *arg)
+    void (*init)(struct privsep *, struct privsep_proc *, void *), void *arg)
 {
 	pid_t		 pid;
 	struct passwd	*pw;
 	const char	*root;
-	struct control_sock *rcs;
+	u_int		 n;
+
+	if (ps->ps_noaction)
+		return (0);
+
+	proc_open(ps, p, procs, nproc);
 
+	/* Fork child handlers */
 	switch (pid = fork()) {
 	case -1:
 		fatal("proc_run: cannot fork");
 	case 0:
+		/* Set the process group of the current process */
+		setpgrp(0, getpid());
 		break;
 	default:
 		return (pid);
@@ -222,12 +361,9 @@ proc_run(struct privsep *ps, struct privsep_proc *p,
 
 	pw = ps->ps_pw;
 
-	if (p->p_id == PROC_CONTROL) {
+	if (p->p_id == PROC_CONTROL && ps->ps_instance == 0) {
 		if (control_init(ps, &ps->ps_csock) == -1)
 			fatalx(p->p_title);
-		TAILQ_FOREACH(rcs, &ps->ps_rcsocks, cs_entry)
-			if (control_init(ps, rcs) == -1)
-				fatalx(p->p_title);
 	}
 
 	/* Change root directory */
@@ -262,6 +398,19 @@ proc_run(struct privsep *ps, struct privsep_proc *p,
 		fatal("proc_run: cannot drop privileges");
 #endif
 
+	/* Fork child handlers */
+	for (n = 1; n < ps->ps_instances[p->p_id]; n++) {
+		if (fork() == 0) {
+			ps->ps_instance = p->p_instance = n;
+			break;
+		}
+	}
+
+#ifdef DEBUG
+	log_debug("%s: %s %d/%d, pid %d", __func__, p->p_title,
+	    ps->ps_instance + 1, ps->ps_instances[p->p_id], getpid());
+#endif
+
 	event_init();
 
 	signal_set(&ps->ps_evsigint, SIGINT, proc_sig_handler, p);
@@ -276,20 +425,16 @@ proc_run(struct privsep *ps, struct privsep_proc *p,
 	signal_add(&ps->ps_evsighup, NULL);
 	signal_add(&ps->ps_evsigpipe, NULL);
 
-	proc_config(ps, procs, nproc);
+	proc_listen(ps, procs, nproc);
 
-	if (p->p_id == PROC_CONTROL) {
+	if (p->p_id == PROC_CONTROL && ps->ps_instance == 0) {
 		TAILQ_INIT(&ctl_conns);
 		if (control_listen(&ps->ps_csock) == -1)
 			fatalx(p->p_title);
-		TAILQ_FOREACH(rcs, &ps->ps_rcsocks, cs_entry)
-			if (control_listen(rcs) == -1)
-				fatalx(p->p_title);
-
 	}
 
 	if (init != NULL)
-		init(ps, arg);
+		init(ps, p, arg);
 
 	event_dispatch();
 
@@ -301,9 +446,9 @@ proc_run(struct privsep *ps, struct privsep_proc *p,
 void
 proc_dispatch(int fd, short event, void *arg)
 {
-	struct privsep_proc	*p = (struct privsep_proc *)arg;
+	struct imsgev		*iev = arg;
+	struct privsep_proc	*p = iev->proc;
 	struct privsep		*ps = p->p_ps;
-	struct imsgev		*iev;
 	struct imsgbuf		*ibuf;
 	struct imsg		 imsg;
 	ssize_t			 n;
@@ -311,7 +456,6 @@ proc_dispatch(int fd, short event, void *arg)
 	const char		*title;
 
 	title = ps->ps_title[privsep_process];
-	iev = &ps->ps_ievs[p->p_id];
 	ibuf = &iev->ibuf;
 
 	if (event & EV_READ) {
@@ -336,6 +480,12 @@ proc_dispatch(int fd, short event, void *arg)
 		if (n == 0)
 			break;
 
+#if DEBUG > 1
+		log_debug("%s: %s %d got imsg %d from %s %d",
+		    __func__, title, ps->ps_instance + 1,
+		    imsg.hdr.type, p->p_title, p->p_instance);
+#endif
+
 		/*
 		 * Check the message with the program callback
 		 */
@@ -351,13 +501,13 @@ proc_dispatch(int fd, short event, void *arg)
 		switch (imsg.hdr.type) {
 		case IMSG_CTL_VERBOSE:
 			IMSG_SIZE_CHECK(&imsg, &verbose);
-
 			memcpy(&verbose, imsg.data, sizeof(verbose));
 			log_verbose(verbose);
 			break;
 		default:
-			log_warnx("%s: %s got imsg %d", __func__, p->p_title,
-			    imsg.hdr.type);
+			log_warnx("%s: %s %d got invalid imsg %d from %s %d",
+			    __func__, title, ps->ps_instance + 1,
+			    imsg.hdr.type, p->p_title, p->p_instance);
 			fatalx(title);
 		}
 		imsg_free(&imsg);
@@ -365,6 +515,10 @@ proc_dispatch(int fd, short event, void *arg)
 	imsg_event_add(iev);
 }
 
+/*
+ * imsg helper functions
+ */
+
 void
 imsg_event_add(struct imsgev *iev)
 {
@@ -408,26 +562,72 @@ imsg_composev_event(struct imsgev *iev, u_int16_t type, u_int32_t peerid,
 	return (ret);
 }
 
+void
+proc_range(struct privsep *ps, enum privsep_procid id, int *n, int *m)
+{
+	if (*n == -1) {
+		/* Use a range of all target instances */
+		*n = 0;
+		*m = ps->ps_instances[id];
+	} else {
+		/* Use only a single slot of the specified peer process */
+		*m = *n + 1;
+	}
+}
+
 int
-proc_compose_imsg(struct privsep *ps, enum privsep_procid id,
+proc_compose_imsg(struct privsep *ps, enum privsep_procid id, int n,
     u_int16_t type, int fd, void *data, u_int16_t datalen)
 {
-	return (imsg_compose_event(&ps->ps_ievs[id],
-	    type, -1, 0, fd, data, datalen));
+	int	 m;
+
+	proc_range(ps, id, &n, &m);
+	for (; n < m; n++) {
+		if (imsg_compose_event(&ps->ps_ievs[id][n],
+		    type, -1, 0, fd, data, datalen) == -1)
+			return (-1);
+	}
+
+	return (0);
 }
 
 int
-proc_composev_imsg(struct privsep *ps, enum privsep_procid id,
+proc_composev_imsg(struct privsep *ps, enum privsep_procid id, int n,
     u_int16_t type, int fd, const struct iovec *iov, int iovcnt)
 {
-	return (imsg_composev_event(&ps->ps_ievs[id],
-	    type, -1, 0, fd, iov, iovcnt));
+	int	 m;
+
+	proc_range(ps, id, &n, &m);
+	for (; n < m; n++)
+		if (imsg_composev_event(&ps->ps_ievs[id][n],
+		    type, -1, 0, fd, iov, iovcnt) == -1)
+			return (-1);
+
+	return (0);
 }
 
 int
 proc_forward_imsg(struct privsep *ps, struct imsg *imsg,
-    enum privsep_procid id)
+    enum privsep_procid id, int n)
 {
-	return (proc_compose_imsg(ps, id, imsg->hdr.type,
+	return (proc_compose_imsg(ps, id, n, imsg->hdr.type,
 	    imsg->fd, imsg->data, IMSG_DATA_SIZE(imsg)));
 }
+
+struct imsgbuf *
+proc_ibuf(struct privsep *ps, enum privsep_procid id, int n)
+{
+	int	 m;
+
+	proc_range(ps, id, &n, &m);
+	return (&ps->ps_ievs[id][n].ibuf);
+}
+
+struct imsgev *
+proc_iev(struct privsep *ps, enum privsep_procid id, int n)
+{
+	int	 m;
+
+	proc_range(ps, id, &n, &m);
+	return (&ps->ps_ievs[id][n]);
+}
diff --git a/usr.sbin/snmpd/snmpd.c b/usr.sbin/snmpd/snmpd.c
index 8fa485edf30..e36820f322e 100644
--- a/usr.sbin/snmpd/snmpd.c
+++ b/usr.sbin/snmpd/snmpd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: snmpd.c,v 1.19 2014/03/16 18:38:30 guenther Exp $	*/
+/*	$OpenBSD: snmpd.c,v 1.20 2014/04/21 19:47:27 reyk Exp $	*/
 
 /*
  * Copyright (c) 2007, 2008, 2012 Reyk Floeter <reyk@openbsd.org>
@@ -170,6 +170,7 @@ main(int argc, char *argv[])
 	pf_init();
 	snmpd_generate_engineid(env);
 
+	ps->ps_ninstances = 1;
 	proc_init(ps, procs, nitems(procs));
 
 	setproctitle("parent");
@@ -189,7 +190,7 @@ main(int argc, char *argv[])
 	signal_add(&ps->ps_evsighup, NULL);
 	signal_add(&ps->ps_evsigpipe, NULL);
 
-	proc_config(ps, procs, nitems(procs));
+	proc_listen(ps, procs, nitems(procs));
 
 	event_dispatch();
 
diff --git a/usr.sbin/snmpd/snmpd.h b/usr.sbin/snmpd/snmpd.h
index a07f28e3a66..1355faf71e7 100644
--- a/usr.sbin/snmpd/snmpd.h
+++ b/usr.sbin/snmpd/snmpd.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: snmpd.h,v 1.50 2014/04/14 12:55:10 blambert Exp $	*/
+/*	$OpenBSD: snmpd.h,v 1.51 2014/04/21 19:47:27 reyk Exp $	*/
 
 /*
  * Copyright (c) 2007, 2008, 2012 Reyk Floeter <reyk@openbsd.org>
@@ -82,6 +82,7 @@ struct imsgev {
 	struct imsgbuf		 ibuf;
 	void			(*handler)(int, short, void *);
 	struct event		 ev;
+	struct privsep_proc	*proc;
 	void			*data;
 	short			 events;
 	const char		*name;
@@ -118,13 +119,24 @@ enum privsep_procid privsep_process;
 /* Attach the control socket to the following process */
 #define PROC_CONTROL	PROC_SNMPE
 
+struct privsep_pipes {
+	int			*pp_pipes[PROC_MAX];
+};
+
 struct privsep {
-	int			 ps_pipes[PROC_MAX][PROC_MAX];
-	struct imsgev		 ps_ievs[PROC_MAX];
+	struct privsep_pipes	*ps_pipes[PROC_MAX];
+	struct privsep_pipes	*ps_pp;
+
+	struct imsgev		*ps_ievs[PROC_MAX];
 	const char		*ps_title[PROC_MAX];
 	pid_t			 ps_pid[PROC_MAX];
 	struct passwd		*ps_pw;
 
+	u_int			 ps_instances[PROC_MAX];
+	u_int			 ps_ninstances;
+	u_int			 ps_instance;
+	int			 ps_noaction;
+
 	struct control_sock	 ps_csock;
 	struct control_socks	 ps_rcsocks;
 
@@ -145,11 +157,11 @@ struct privsep_proc {
 				    struct imsg *);
 	pid_t			(*p_init)(struct privsep *,
 				    struct privsep_proc *);
-	void			(*p_shutdown)(struct privsep *,
-				    struct privsep_proc *);
+	void			(*p_shutdown)(void);
 	const char		*p_chroot;
 	struct privsep		*p_ps;
 	void 			*p_env;
+	u_int			 p_instance;
 };
 
 enum blockmodes {
@@ -552,7 +564,7 @@ struct kroute	*kroute_getaddr(in_addr_t, u_int8_t, u_int8_t, int);
 
 /* snmpe.c */
 pid_t		 snmpe(struct privsep *, struct privsep_proc *);
-void		 snmpe_shutdown(struct privsep *, struct privsep_proc *);
+void		 snmpe_shutdown(void);
 
 /* trap.c */
 void		 trap_init(void);
@@ -648,22 +660,26 @@ void		 usm_make_report(struct snmp_message *);
 /* proc.c */
 void	 proc_init(struct privsep *, struct privsep_proc *, u_int);
 void	 proc_kill(struct privsep *);
-void	 proc_config(struct privsep *, struct privsep_proc *, u_int);
+void	 proc_listen(struct privsep *, struct privsep_proc *, size_t);
 void	 proc_dispatch(int, short event, void *);
 pid_t	 proc_run(struct privsep *, struct privsep_proc *,
 	    struct privsep_proc *, u_int,
-	    void (*)(struct privsep *, void *), void *);
+	    void (*)(struct privsep *, struct privsep_proc *, void *), void *);
 void	 imsg_event_add(struct imsgev *);
 int	 imsg_compose_event(struct imsgev *, u_int16_t, u_int32_t,
 	    pid_t, int, void *, u_int16_t);
 int	 imsg_composev_event(struct imsgev *, u_int16_t, u_int32_t,
 	    pid_t, int, const struct iovec *, int);
-int	 proc_compose_imsg(struct privsep *, enum privsep_procid,
+void	 proc_range(struct privsep *, enum privsep_procid, int *, int *);
+int	 proc_compose_imsg(struct privsep *, enum privsep_procid, int,
 	    u_int16_t, int, void *, u_int16_t);
-int	 proc_composev_imsg(struct privsep *, enum privsep_procid,
+int	 proc_composev_imsg(struct privsep *, enum privsep_procid, int,
 	    u_int16_t, int, const struct iovec *, int);
 int	 proc_forward_imsg(struct privsep *, struct imsg *,
-	    enum privsep_procid);
-void	 proc_flush_imsg(struct privsep *, enum privsep_procid);
+	    enum privsep_procid, int);
+struct imsgbuf *
+	 proc_ibuf(struct privsep *, enum privsep_procid, int);
+struct imsgev *
+	 proc_iev(struct privsep *, enum privsep_procid, int);
 
 #endif /* _SNMPD_H */
diff --git a/usr.sbin/snmpd/snmpe.c b/usr.sbin/snmpd/snmpe.c
index ba6e22dcca7..0653a2a3355 100644
--- a/usr.sbin/snmpd/snmpe.c
+++ b/usr.sbin/snmpd/snmpe.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: snmpe.c,v 1.37 2013/10/17 08:42:44 reyk Exp $	*/
+/*	$OpenBSD: snmpe.c,v 1.38 2014/04/21 19:47:27 reyk Exp $	*/
 
 /*
  * Copyright (c) 2007, 2008, 2012 Reyk Floeter <reyk@openbsd.org>
@@ -40,7 +40,7 @@
 #include "snmpd.h"
 #include "mib.h"
 
-void	 snmpe_init(struct privsep *, void *);
+void	 snmpe_init(struct privsep *, struct privsep_proc *, void *);
 int	 snmpe_parse(struct sockaddr_storage *,
 	    struct ber_element *, struct snmp_message *);
 unsigned long
@@ -85,7 +85,7 @@ snmpe(struct privsep *ps, struct privsep_proc *p)
 
 /* ARGSUSED */
 void
-snmpe_init(struct privsep *p, void *arg)
+snmpe_init(struct privsep *ps, struct privsep_proc *p, void *arg)
 {
 	kr_init();
 	trap_init();
@@ -99,7 +99,7 @@ snmpe_init(struct privsep *p, void *arg)
 }
 
 void
-snmpe_shutdown(struct privsep *ps, struct privsep_proc *p)
+snmpe_shutdown(void)
 {
 	kr_shutdown();
 }