summaryrefslogtreecommitdiff
path: root/usr.sbin
diff options
context:
space:
mode:
authorReyk Floeter <reyk@cvs.openbsd.org>2010-06-16 17:39:06 +0000
committerReyk Floeter <reyk@cvs.openbsd.org>2010-06-16 17:39:06 +0000
commit7588b01c4f647fa7013a9ca3fc70a4cf7ca56f3c (patch)
tree2f7a541596e210573c23632528d8f7c881ae260d /usr.sbin
parent67640fb3bc50cba182c5a5d0a0c300aeaa9a04fe (diff)
Add support to use sasyncd(8) with iked(8) instead of isakmpd(8). The
new config option "control isakmpd|iked|all|none" in sasyncd.conf(5) is used to set the mode; the default is to control isakmpd like before. When controlling iked, sasyncd connects to the daemon using the imsg socket and sends imsgs - this is easy because the imsg framework has been imported into libutil. iked(8) already includes the important bits to work with sasyncd(8) (the active/passive mode option in ikectl). manpage bits ok jsg@ ok jsg@
Diffstat (limited to 'usr.sbin')
-rw-r--r--usr.sbin/sasyncd/Makefile6
-rw-r--r--usr.sbin/sasyncd/carp.c16
-rw-r--r--usr.sbin/sasyncd/conf.y33
-rw-r--r--usr.sbin/sasyncd/monitor.c144
-rw-r--r--usr.sbin/sasyncd/monitor.h10
-rw-r--r--usr.sbin/sasyncd/sasyncd.87
-rw-r--r--usr.sbin/sasyncd/sasyncd.c5
-rw-r--r--usr.sbin/sasyncd/sasyncd.conf.515
-rw-r--r--usr.sbin/sasyncd/sasyncd.h11
9 files changed, 196 insertions, 51 deletions
diff --git a/usr.sbin/sasyncd/Makefile b/usr.sbin/sasyncd/Makefile
index 33965457f1c..03c364e4f6e 100644
--- a/usr.sbin/sasyncd/Makefile
+++ b/usr.sbin/sasyncd/Makefile
@@ -1,4 +1,4 @@
-# $Id: Makefile,v 1.5 2005/05/24 02:35:39 ho Exp $
+# $Id: Makefile,v 1.6 2010/06/16 17:39:05 reyk Exp $
PROG= sasyncd
SRCS= sasyncd.c carp.c conf.y log.c monitor.c net.c net_ctl.c pfkey.c timer.c
@@ -8,7 +8,7 @@ MAN= sasyncd.8 sasyncd.conf.5
CFLAGS= -O0 $(PIPE) $(DEBUG)
.endif
-CFLAGS+= -I${.CURDIR}
+CFLAGS+= -I${.CURDIR} -I${.CURDIR}/../../sbin/iked
CLEANFILES= y.tab.h
# ElectricFence
@@ -20,6 +20,6 @@ CLEANFILES= y.tab.h
CFLAGS+= -Wall -Wstrict-prototypes -Wmissing-prototypes \
-Wmissing-declarations
-LDADD+= -lcrypto
+LDADD+= -lcrypto -lutil
.include <bsd.prog.mk>
diff --git a/usr.sbin/sasyncd/carp.c b/usr.sbin/sasyncd/carp.c
index 3fe52854912..85bed1bab0a 100644
--- a/usr.sbin/sasyncd/carp.c
+++ b/usr.sbin/sasyncd/carp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: carp.c,v 1.10 2009/06/26 13:25:23 deraadt Exp $ */
+/* $OpenBSD: carp.c,v 1.11 2010/06/16 17:39:05 reyk Exp $ */
/*
* Copyright (c) 2005 Håkan Olsson. All rights reserved.
@@ -173,7 +173,7 @@ carp_update_state(enum RUNSTATE current_state)
cfgstate.runstate = current_state;
if (current_state == MASTER)
pfkey_set_promisc();
- isakmpd_setrun();
+ control_setrun();
net_ctl_update_state();
}
}
@@ -269,15 +269,15 @@ carp_init(void)
return 0;
}
-/* Enable or disable isakmpd connection checker. */
+/* Enable or disable isakmpd/iked connection checker. */
void
-isakmpd_setrun(void)
+control_setrun(void)
{
if (cfgstate.runstate == MASTER) {
- if (monitor_isakmpd_active(1))
- log_msg(0, "failed to activate isakmpd");
+ if (monitor_control_active(1))
+ log_msg(0, "failed to activate controlled daemon");
} else {
- if (monitor_isakmpd_active(0))
- log_msg(0, "failed to passivate isakmpd");
+ if (monitor_control_active(0))
+ log_msg(0, "failed to passivate controlled daemon");
}
}
diff --git a/usr.sbin/sasyncd/conf.y b/usr.sbin/sasyncd/conf.y
index 338de98236b..947bb6891c5 100644
--- a/usr.sbin/sasyncd/conf.y
+++ b/usr.sbin/sasyncd/conf.y
@@ -1,4 +1,4 @@
-/* $OpenBSD: conf.y,v 1.14 2007/05/17 11:01:36 moritz Exp $ */
+/* $OpenBSD: conf.y,v 1.15 2010/06/16 17:39:05 reyk Exp $ */
/*
* Copyright (c) 2005 Håkan Olsson. All rights reserved.
@@ -64,11 +64,11 @@ unsigned char x2i(unsigned char *);
%token MODE INTERFACE INTERVAL LISTEN ON PORT PEER SHAREDKEY
%token Y_SLAVE Y_MASTER INET INET6 FLUSHMODE STARTUP NEVER SYNC
-%token GROUP SKIPSLAVE
+%token GROUP SKIPSLAVE CONTROL
%token <string> STRING
%token <hex> HEX
%token <val> VALUE
-%type <val> af port mode flushmode
+%type <val> af port mode flushmode ctlmode
%%
/* Rules */
@@ -125,6 +125,27 @@ key : STRING
log_msg(2, "config: %d byte shared hex key", $1.len);
}
+ctlmode : STRING
+ {
+ /* Compare strings to avoid keywords for daemons */
+ if (strcmp("isakmpd", $1) == 0)
+ $$ = CTL_ISAKMPD;
+ else if (strcmp("iked", $1) == 0)
+ $$ = CTL_IKED;
+ else if (strcmp("all", $1) == 0)
+ $$ = CTL_MASK;
+ else if (strcmp("none", $1) == 0)
+ $$ = CTL_NONE;
+ else {
+ log_err("config: invalid control mode");
+ free($1);
+ YYERROR;
+ }
+ log_msg(2, "config: control mode set to %s", $1);
+ free($1);
+ }
+ ;
+
setting : INTERFACE STRING
{
if (cfgstate.carp_ifname)
@@ -210,6 +231,11 @@ setting : INTERFACE STRING
}
log_msg(2, "config: shared key set");
}
+ | CONTROL ctlmode
+ {
+ cfgstate.flags &= ~CTL_MASK;
+ cfgstate.flags |= $2;
+ }
;
%%
@@ -231,6 +257,7 @@ match(char *token)
{
/* Sorted */
static const struct keyword keywords[] = {
+ { "control", CONTROL },
{ "flushmode", FLUSHMODE },
{ "group", GROUP },
{ "inet", INET },
diff --git a/usr.sbin/sasyncd/monitor.c b/usr.sbin/sasyncd/monitor.c
index 45072e7463e..613af4d60d6 100644
--- a/usr.sbin/sasyncd/monitor.c
+++ b/usr.sbin/sasyncd/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.12 2006/12/25 08:17:17 deraadt Exp $ */
+/* $OpenBSD: monitor.c,v 1.13 2010/06/16 17:39:05 reyk Exp $ */
/*
* Copyright (c) 2005 Håkan Olsson. All rights reserved.
@@ -32,6 +32,7 @@
#include <sys/stat.h>
#include <sys/sysctl.h>
#include <sys/wait.h>
+#include <sys/un.h>
#include <net/pfkeyv2.h>
#include <errno.h>
@@ -41,6 +42,9 @@
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
+#include <imsg.h>
+
+#include "types.h" /* iked imsg types */
#include "monitor.h"
#include "sasyncd.h"
@@ -55,8 +59,8 @@ volatile sig_atomic_t sigchld = 0;
static void got_sigchld(int);
static void sig_to_child(int);
static void m_priv_pfkey_snap(int);
-static void m_priv_isakmpd_activate(void);
-static void m_priv_isakmpd_passivate(void);
+static int m_priv_control_activate(void);
+static int m_priv_control_passivate(void);
static ssize_t m_write(int, void *, size_t);
static ssize_t m_read(int, void *, size_t);
@@ -146,10 +150,20 @@ monitor_drain_input(void)
void
monitor_loop(void)
{
- u_int32_t v;
- ssize_t r;
+ u_int32_t v, vn;
+ ssize_t r;
+ fd_set rfds;
+ int ret;
+ struct timeval *tvp, tv;
+
+ FD_ZERO(&rfds);
+ tvp = NULL;
+ vn = 0;
for (;;) {
+ ret = 0;
+ v = 0;
+
if (sigchld) {
pid_t pid;
int status;
@@ -162,13 +176,30 @@ monitor_loop(void)
break;
}
- /* Wait for next task */
- if ((r = m_read(m_state.s, &v, sizeof v)) < 1) {
- if (r == -1)
- log_err(0, "monitor_loop: read() ");
+ FD_SET(m_state.s, &rfds);
+ if (select(m_state.s + 1, &rfds, NULL, NULL, tvp) == -1) {
+ if (errno == EINTR || errno == EAGAIN)
+ continue;
+ log_err(0, "monitor_loop: select() ");
break;
}
+ /* Wait for next task */
+ if (FD_ISSET(m_state.s, &rfds)) {
+ if ((r = m_read(m_state.s, &v, sizeof v)) < 1) {
+ if (r == -1)
+ log_err(0, "monitor_loop: read() ");
+ break;
+ }
+ }
+
+ /* Retry after timeout */
+ if (v == 0 && tvp != NULL) {
+ v = vn;
+ tvp = NULL;
+ vn = 0;
+ }
+
switch (v) {
case MONITOR_GETSNAP:
/* Get the data. */
@@ -180,13 +211,21 @@ monitor_loop(void)
case MONITOR_CARPDEC:
carp_demote(CARP_DEC, 1);
break;
- case MONITOR_ISAKMPD_ACTIVATE:
- m_priv_isakmpd_activate();
+ case MONITOR_CONTROL_ACTIVATE:
+ ret = m_priv_control_activate();
break;
- case MONITOR_ISAKMPD_PASSIVATE:
- m_priv_isakmpd_passivate();
+ case MONITOR_CONTROL_PASSIVATE:
+ ret = m_priv_control_passivate();
break;
}
+
+ if (ret == -1) {
+ /* Trigger retry after timeout */
+ tv.tv_sec = MONITOR_RETRY_TIMEOUT;
+ tv.tv_usec = 0;
+ tvp = &tv;
+ vn = v;
+ }
}
monitor_carpundemote(NULL);
@@ -288,10 +327,10 @@ monitor_get_pfkey_snap(u_int8_t **sadb, u_int32_t *sadbsize, u_int8_t **spd,
}
int
-monitor_isakmpd_active(int active)
+monitor_control_active(int active)
{
u_int32_t cmd =
- active ? MONITOR_ISAKMPD_ACTIVATE : MONITOR_ISAKMPD_PASSIVATE;
+ active ? MONITOR_CONTROL_ACTIVATE : MONITOR_CONTROL_PASSIVATE;
if (write(m_state.s, &cmd, sizeof cmd) < 1)
return -1;
return 0;
@@ -386,11 +425,11 @@ m_priv_pfkey_snap(int s)
return;
}
-static void
+static int
m_priv_isakmpd_fifocmd(const char *cmd)
{
struct stat sb;
- int fd = -1;
+ int fd = -1, ret = -1;
if ((fd = open(ISAKMPD_FIFO, O_WRONLY)) == -1) {
log_err("m_priv_isakmpd_fifocmd: open(%s)", ISAKMPD_FIFO);
@@ -409,23 +448,78 @@ m_priv_isakmpd_fifocmd(const char *cmd)
log_err("m_priv_isakmpd_fifocmd write");
goto out;
}
+
+ ret = 0;
out:
if (fd != -1)
close(fd);
- /* No values returned. */
- return;
+
+ return (ret);
}
-static void
-m_priv_isakmpd_activate(void)
+static int
+m_priv_iked_imsg(u_int cmd)
{
- m_priv_isakmpd_fifocmd("M active\n");
+ struct sockaddr_un sun;
+ int fd = -1, ret = -1;
+ struct imsgbuf ibuf;
+
+ if ((fd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
+ log_err("m_priv_iked_imsg: socket");
+ goto out;
+ }
+
+ bzero(&sun, sizeof(sun));
+ sun.sun_family = AF_UNIX;
+ strlcpy(sun.sun_path, IKED_SOCKET, sizeof(sun.sun_path));
+
+ if (connect(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) {
+ log_err("m_priv_iked_imsg: connect");
+ goto out;
+ }
+
+ imsg_init(&ibuf, fd);
+ if (imsg_compose(&ibuf, cmd, 0, 0, -1, NULL, 0) == -1) {
+ log_err("m_priv_iked_imsg: compose");
+ goto err;
+ }
+ if (imsg_flush(&ibuf) == -1) {
+ log_err("m_priv_iked_imsg: flush");
+ goto err;
+ }
+
+ ret = 0;
+ err:
+ imsg_clear(&ibuf);
+ out:
+ if (fd != -1)
+ close(fd);
+
+ return (ret);
}
-static void
-m_priv_isakmpd_passivate(void)
+static int
+m_priv_control_activate(void)
+{
+ if (cfgstate.flags & CTL_ISAKMPD)
+ if (m_priv_isakmpd_fifocmd("M active\n") == -1)
+ return (-1);
+ if (cfgstate.flags & CTL_IKED)
+ if (m_priv_iked_imsg(IMSG_CTL_ACTIVE) == -1)
+ return (-1);
+ return (0);
+}
+
+static int
+m_priv_control_passivate(void)
{
- m_priv_isakmpd_fifocmd("M passive\n");
+ if (cfgstate.flags & CTL_ISAKMPD)
+ if (m_priv_isakmpd_fifocmd("M passive\n") == -1)
+ return (-1);
+ if (cfgstate.flags & CTL_IKED)
+ if (m_priv_iked_imsg(IMSG_CTL_PASSIVE) == -1)
+ return (-1);
+ return (0);
}
ssize_t
diff --git a/usr.sbin/sasyncd/monitor.h b/usr.sbin/sasyncd/monitor.h
index 10cf767e307..3548729708b 100644
--- a/usr.sbin/sasyncd/monitor.h
+++ b/usr.sbin/sasyncd/monitor.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.h,v 1.1 2006/09/01 01:13:25 mpf Exp $ */
+/* $OpenBSD: monitor.h,v 1.2 2010/06/16 17:39:05 reyk Exp $ */
/*
* Copyright (c) 2005 Håkan Olsson. All rights reserved.
@@ -28,8 +28,10 @@
#define MONITOR_GETSNAP 1
#define MONITOR_CARPINC 2
#define MONITOR_CARPDEC 3
-#define MONITOR_ISAKMPD_ACTIVATE 4
-#define MONITOR_ISAKMPD_PASSIVATE 5
+#define MONITOR_CONTROL_ACTIVATE 4
+#define MONITOR_CONTROL_PASSIVATE 5
+
+#define MONITOR_RETRY_TIMEOUT 4
#define ISAKMPD_FIFO "/var/run/isakmpd.fifo"
@@ -38,4 +40,4 @@ void monitor_loop(void);
int monitor_get_pfkey_snap(u_int8_t **, u_int32_t *, u_int8_t **,
u_int32_t *);
-int monitor_isakmpd_active(int);
+int monitor_control_active(int);
diff --git a/usr.sbin/sasyncd/sasyncd.8 b/usr.sbin/sasyncd/sasyncd.8
index 9e4970a9b50..89ce15ca158 100644
--- a/usr.sbin/sasyncd/sasyncd.8
+++ b/usr.sbin/sasyncd/sasyncd.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sasyncd.8,v 1.10 2008/04/04 06:21:27 otto Exp $
+.\" $OpenBSD: sasyncd.8,v 1.11 2010/06/16 17:39:05 reyk Exp $
.\"
.\" Copyright (c) 2005 Håkan Olsson. All rights reserved.
.\"
@@ -27,7 +27,7 @@
.\"
.\" Manual page for sasyncd
.\"
-.Dd $Mdocdate: April 4 2008 $
+.Dd $Mdocdate: June 16 2010 $
.Dt SASYNCD 8
.Os
.Sh NAME
@@ -46,6 +46,8 @@ The most typical scenario is to run
.Nm
on hosts also running
.Xr isakmpd 8
+or
+.Xr iked 8
and sharing a common IP address using
.Xr carp 4 .
.Pp
@@ -136,6 +138,7 @@ configuration file.
.Xr ipsec 4 ,
.Xr pfsync 4 ,
.Xr sasyncd.conf 5 ,
+.Xr iked 8 ,
.Xr isakmpd 8
.Sh HISTORY
The
diff --git a/usr.sbin/sasyncd/sasyncd.c b/usr.sbin/sasyncd/sasyncd.c
index 4a53424fa71..46a14c401ab 100644
--- a/usr.sbin/sasyncd/sasyncd.c
+++ b/usr.sbin/sasyncd/sasyncd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sasyncd.c,v 1.19 2009/11/11 23:05:40 deraadt Exp $ */
+/* $OpenBSD: sasyncd.c,v 1.20 2010/06/16 17:39:05 reyk Exp $ */
/*
* Copyright (c) 2005 Håkan Olsson. All rights reserved.
@@ -76,7 +76,7 @@ sasyncd_run(pid_t ppid)
return -1;
}
- isakmpd_setrun();
+ control_setrun();
signal(SIGINT, sasyncd_stop);
signal(SIGTERM, sasyncd_stop);
@@ -185,6 +185,7 @@ main(int argc, char **argv)
LIST_INIT(&cfgstate.peerlist);
cfgstate.listen_port = SASYNCD_DEFAULT_PORT;
+ cfgstate.flags |= CTL_DEFAULT;
if (!cfgfile)
cfgfile = SASYNCD_CFGFILE;
diff --git a/usr.sbin/sasyncd/sasyncd.conf.5 b/usr.sbin/sasyncd/sasyncd.conf.5
index 6fa24dab74e..26b3a00ade7 100644
--- a/usr.sbin/sasyncd/sasyncd.conf.5
+++ b/usr.sbin/sasyncd/sasyncd.conf.5
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sasyncd.conf.5,v 1.15 2007/05/31 19:20:29 jmc Exp $
+.\" $OpenBSD: sasyncd.conf.5,v 1.16 2010/06/16 17:39:05 reyk Exp $
.\"
.\" Copyright (c) 2005 Håkan Olsson. All rights reserved.
.\"
@@ -27,7 +27,7 @@
.\"
.\" Manual page for sasyncd.conf
.\"
-.Dd $Mdocdate: May 31 2007 $
+.Dd $Mdocdate: June 16 2010 $
.Dt SASYNCD.CONF 5
.Os
.Sh NAME
@@ -157,6 +157,17 @@ The shared AES key used to encrypt messages between
hosts.
This configuration setting is required and must be either 16, 24 or 32
bytes long (corresponding to AES using a 128, 192 or 256 bit key).
+.It Ic control isakmpd | iked | all | none
+By default,
+.Xr sasyncd 8
+tracks its local master/slave mode and toggles the passive mode of
+.Xr isakmpd 8
+accordingly.
+This option can be changed to control
+.Xr iked 8
+instead,
+to control all supported daemons at the same time,
+or to turn it off to synchronize SAs only.
.El
.Sh SEE ALSO
.Xr chmod 1 ,
diff --git a/usr.sbin/sasyncd/sasyncd.h b/usr.sbin/sasyncd/sasyncd.h
index 92939f3a6c5..d518087b207 100644
--- a/usr.sbin/sasyncd/sasyncd.h
+++ b/usr.sbin/sasyncd/sasyncd.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: sasyncd.h,v 1.14 2007/01/08 15:31:01 markus Exp $ */
+/* $OpenBSD: sasyncd.h,v 1.15 2010/06/16 17:39:05 reyk Exp $ */
/*
* Copyright (c) 2005 Håkan Olsson. All rights reserved.
@@ -73,6 +73,13 @@ struct cfgstate {
/* Do not sync SAs to/from our peers. */
#define SKIP_LOCAL_SAS 0x0004
+/* Control isakmpd or iked */
+#define CTL_NONE 0x0000
+#define CTL_ISAKMPD 0x0008
+#define CTL_IKED 0x0010
+#define CTL_DEFAULT CTL_ISAKMPD
+#define CTL_MASK 0x0018
+
extern struct cfgstate cfgstate;
extern int carp_demoted;
@@ -113,7 +120,7 @@ void carp_update_state(enum RUNSTATE);
void carp_set_rfd(fd_set *);
void carp_read_message(fd_set *);
const char* carp_state_name(enum RUNSTATE);
-void isakmpd_setrun(void);
+void control_setrun(void);
/* log.c */