static void
set_timeout(int timeout)
{
struct sigaction sa;
struct itimerval itv;
int error;
if (timeout <= 0) {
log_debugx("session timeout disabled");
return;
}
bzero(&sa, sizeof(sa));
sa.sa_handler = sigalrm_handler;
sigfillset(&sa.sa_mask);
error = sigaction(SIGALRM, &sa, NULL);
if (error != 0)
log_err(1, "sigaction");
/*
* First SIGALRM will arive after conf_timeout seconds.
* If we do nothing, another one will arrive a second later.
*/
bzero(&itv, sizeof(itv));
itv.it_interval.tv_sec = 1;
itv.it_value.tv_sec = timeout;
log_debugx("setting session timeout to %d seconds",
timeout);
error = setitimer(ITIMER_REAL, &itv, NULL);
if (error != 0)
log_err(1, "setitimer");
}
static int
wait_for_children(bool block)
{
pid_t pid;
int status;
int num = 0;
for (;;) {
/*
* If "block" is true, wait for at least one process.
*/
if (block && num == 0)
pid = wait4(-1, &status, 0, NULL);
else
pid = wait4(-1, &status, WNOHANG, NULL);
if (pid <= 0)
break;
if (WIFSIGNALED(status)) {
log_warnx("child process %d terminated with signal %d",
pid, WTERMSIG(status));
} else if (WEXITSTATUS(status) != 0) {
log_warnx("child process %d terminated with exit status %d",
pid, WEXITSTATUS(status));
} else {
log_debugx("child process %d terminated gracefully", pid);
}
num++;
}
return (num);
}
static void
handle_request(int iscsi_fd, const struct iscsi_daemon_request *request, int timeout)
{
struct connection *conn;
log_set_peer_addr(request->idr_conf.isc_target_addr);
if (request->idr_conf.isc_target[0] != '\0') {
log_set_peer_name(request->idr_conf.isc_target);
setproctitle("%s (%s)", request->idr_conf.isc_target_addr, request->idr_conf.isc_target);
} else {
setproctitle("%s", request->idr_conf.isc_target_addr);
}
conn = connection_new(request->idr_session_id, &request->idr_conf, iscsi_fd);
set_timeout(timeout);
capsicate(conn);
login(conn);
if (conn->conn_conf.isc_discovery != 0)
discovery(conn);
else
handoff(conn);
log_debugx("nothing more to do; exiting");
exit (0);
}
static void
handoff(struct connection *conn)
{
struct iscsi_daemon_handoff idh;
int error;
log_debugx("handing off connection to the kernel");
memset(&idh, 0, sizeof(idh));
idh.idh_session_id = conn->conn_session_id;
#ifndef ICL_KERNEL_PROXY
idh.idh_socket = conn->conn_socket;
#endif
strlcpy(idh.idh_target_alias, conn->conn_target_alias,
sizeof(idh.idh_target_alias));
memcpy(idh.idh_isid, conn->conn_isid, sizeof(idh.idh_isid));
idh.idh_statsn = conn->conn_statsn;
idh.idh_header_digest = conn->conn_header_digest;
idh.idh_data_digest = conn->conn_data_digest;
idh.idh_initial_r2t = conn->conn_initial_r2t;
idh.idh_immediate_data = conn->conn_immediate_data;
idh.idh_max_data_segment_length = conn->conn_max_data_segment_length;
idh.idh_max_burst_length = conn->conn_max_burst_length;
idh.idh_first_burst_length = conn->conn_first_burst_length;
error = ioctl(conn->conn_iscsi_fd, ISCSIDHANDOFF, &idh);
if (error != 0)
log_err(1, "ISCSIDHANDOFF");
}
/*
* XXX: I CANT INTO LATIN
*/
static void
capsicate(struct connection *conn)
{
int error;
cap_rights_t rights;
#ifdef ICL_KERNEL_PROXY
const unsigned long cmds[] = { ISCSIDCONNECT, ISCSIDSEND, ISCSIDRECEIVE,
ISCSIDHANDOFF, ISCSIDFAIL, ISCSISADD, ISCSISREMOVE
};
#else
const unsigned long cmds[] = { ISCSIDHANDOFF, ISCSIDFAIL, ISCSISADD,
ISCSISREMOVE
};
#endif
cap_rights_init(&rights, CAP_IOCTL);
error = cap_rights_limit(conn->conn_iscsi_fd, &rights);
if (error != 0 && errno != ENOSYS)
log_err(1, "cap_rights_limit");
error = cap_ioctls_limit(conn->conn_iscsi_fd, cmds,
sizeof(cmds) / sizeof(cmds[0]));
if (error != 0 && errno != ENOSYS)
log_err(1, "cap_ioctls_limit");
error = cap_enter();
if (error != 0 && errno != ENOSYS)
log_err(1, "cap_enter");
if (cap_sandboxed())
log_debugx("Capsicum capability mode enabled");
else
log_warnx("Capsicum capability mode not supported");
}
void
discovery(struct connection *conn)
{
struct pdu *request, *response;
struct keys *request_keys, *response_keys;
int i;
log_debugx("beginning discovery session");
request = text_new_request(conn);
request_keys = keys_new();
keys_add(request_keys, "SendTargets", "All");
keys_save(request_keys, request);
keys_delete(request_keys);
request_keys = NULL;
pdu_send(request);
pdu_delete(request);
request = NULL;
log_debugx("waiting for Text Response");
response = text_receive(conn);
response_keys = keys_new();
keys_load(response_keys, response);
for (i = 0; i < KEYS_MAX; i++) {
if (response_keys->keys_names[i] == NULL)
break;
if (strcmp(response_keys->keys_names[i], "TargetName") != 0)
continue;
log_debugx("adding target %s", response_keys->keys_values[i]);
/*
* XXX: Validate the target name?
*/
kernel_add(conn, response_keys->keys_values[i]);
}
keys_delete(response_keys);
pdu_delete(response);
log_debugx("removing temporary discovery session");
kernel_remove(conn);
log_debugx("discovery done; logging out");
request = logout_new_request(conn);
pdu_send(request);
pdu_delete(request);
request = NULL;
log_debugx("waiting for Logout Response");
response = logout_receive(conn);
pdu_delete(response);
log_debugx("discovery session done");
}
static int
chap_receive_bin(struct chap *chap, void *response, size_t response_len)
{
if (response_len != sizeof(chap->chap_response)) {
log_debugx("got CHAP response with invalid length; "
"got %zd, should be %zd",
response_len, sizeof(chap->chap_response));
return (1);
}
memcpy(chap->chap_response, response, response_len);
return (0);
}
int
chap_receive(struct chap *chap, const char *response)
{
void *response_bin;
size_t response_bin_len;
int error;
error = chap_hex2bin(response, &response_bin, &response_bin_len);
if (error != 0) {
log_debugx("got incorrectly encoded CHAP response \"%s\"",
response);
return (1);
}
error = chap_receive_bin(chap, response_bin, response_bin_len);
free(response_bin);
return (error);
}
void
keys_load(struct keys *keys, const struct pdu *pdu)
{
int i;
char *pair;
size_t pair_len;
if (pdu->pdu_data_len == 0)
return;
if (pdu->pdu_data[pdu->pdu_data_len - 1] != '\0')
log_errx(1, "protocol error: key not NULL-terminated\n");
assert(keys->keys_data == NULL);
keys->keys_data_len = pdu->pdu_data_len;
keys->keys_data = malloc(keys->keys_data_len);
if (keys->keys_data == NULL)
log_err(1, "malloc");
memcpy(keys->keys_data, pdu->pdu_data, keys->keys_data_len);
/*
* XXX: Review this carefully.
*/
pair = keys->keys_data;
for (i = 0;; i++) {
if (i >= KEYS_MAX)
log_errx(1, "too many keys received");
pair_len = strlen(pair);
keys->keys_values[i] = pair;
keys->keys_names[i] = strsep(&keys->keys_values[i], "=");
if (keys->keys_names[i] == NULL || keys->keys_values[i] == NULL)
log_errx(1, "malformed keys");
log_debugx("key received: \"%s=%s\"",
keys->keys_names[i], keys->keys_values[i]);
pair += pair_len + 1; /* +1 to skip the terminating '\0'. */
if (pair == keys->keys_data + keys->keys_data_len)
break;
assert(pair < keys->keys_data + keys->keys_data_len);
}
}
int
keys_find_int(struct keys *keys, const char *name)
{
const char *str;
char *endptr;
int num;
str = keys_find(keys, name);
if (str == NULL)
return (-1);
num = strtoul(str, &endptr, 10);
if (*endptr != '\0') {
log_debugx("invalid numeric value \"%s\"", str);
return (-1);
}
return (num);
}
void
keys_add(struct keys *keys, const char *name, const char *value)
{
int i;
log_debugx("key to send: \"%s=%s\"", name, value);
/*
* Note that we don't check for duplicates here, as they are perfectly
* fine in responses, e.g. the "TargetName" keys in discovery sesion
* response.
*/
for (i = 0; i < KEYS_MAX; i++) {
if (keys->keys_names[i] == NULL) {
keys->keys_names[i] = checked_strdup(name);
keys->keys_values[i] = checked_strdup(value);
return;
}
}
log_errx(1, "too many keys");
}
int
rchap_receive(struct rchap *rchap, const char *id, const char *challenge)
{
unsigned char id_bin;
void *challenge_bin;
size_t challenge_bin_len;
int error;
id_bin = strtoul(id, NULL, 10);
error = chap_hex2bin(challenge, &challenge_bin, &challenge_bin_len);
if (error != 0) {
log_debugx("got incorrectly encoded CHAP challenge \"%s\"",
challenge);
return (1);
}
rchap_receive_bin(rchap, id_bin, challenge_bin, challenge_bin_len);
free(challenge_bin);
return (0);
}
int
main(int argc, char **argv)
{
int ch, debug = 0, error, iscsi_fd, maxproc = 30, retval, saved_errno,
timeout = 60;
bool dont_daemonize = false;
struct pidfh *pidfh;
pid_t pid, otherpid;
const char *pidfile_path = DEFAULT_PIDFILE;
struct iscsi_daemon_request request;
while ((ch = getopt(argc, argv, "P:dl:m:t:")) != -1) {
switch (ch) {
case 'P':
pidfile_path = optarg;
break;
case 'd':
dont_daemonize = true;
debug++;
break;
case 'l':
debug = atoi(optarg);
break;
case 'm':
maxproc = atoi(optarg);
break;
case 't':
timeout = atoi(optarg);
break;
case '?':
default:
usage();
}
}
argc -= optind;
if (argc != 0)
usage();
log_init(debug);
pidfh = pidfile_open(pidfile_path, 0600, &otherpid);
if (pidfh == NULL) {
if (errno == EEXIST)
log_errx(1, "daemon already running, pid: %jd.",
(intmax_t)otherpid);
log_err(1, "cannot open or create pidfile \"%s\"",
pidfile_path);
}
iscsi_fd = open(ISCSI_PATH, O_RDWR);
if (iscsi_fd < 0 && errno == ENOENT) {
saved_errno = errno;
retval = kldload("iscsi");
if (retval != -1)
iscsi_fd = open(ISCSI_PATH, O_RDWR);
else
errno = saved_errno;
}
if (iscsi_fd < 0)
log_err(1, "failed to open %s", ISCSI_PATH);
if (dont_daemonize == false) {
if (daemon(0, 0) == -1) {
log_warn("cannot daemonize");
pidfile_remove(pidfh);
exit(1);
}
}
pidfile_write(pidfh);
register_sigchld();
for (;;) {
log_debugx("waiting for request from the kernel");
memset(&request, 0, sizeof(request));
error = ioctl(iscsi_fd, ISCSIDWAIT, &request);
if (error != 0) {
if (errno == EINTR) {
nchildren -= wait_for_children(false);
assert(nchildren >= 0);
continue;
}
log_err(1, "ISCSIDWAIT");
}
if (dont_daemonize) {
log_debugx("not forking due to -d flag; "
"will exit after servicing a single request");
} else {
nchildren -= wait_for_children(false);
assert(nchildren >= 0);
while (maxproc > 0 && nchildren >= maxproc) {
log_debugx("maxproc limit of %d child processes hit; "
"waiting for child process to exit", maxproc);
nchildren -= wait_for_children(true);
assert(nchildren >= 0);
}
log_debugx("incoming connection; forking child process #%d",
nchildren);
nchildren++;
pid = fork();
if (pid < 0)
log_err(1, "fork");
if (pid > 0)
continue;
}
pidfile_close(pidfh);
handle_request(iscsi_fd, &request, timeout);
}
return (0);
}
static struct connection *
connection_new(unsigned int session_id, const struct iscsi_session_conf *conf,
int iscsi_fd)
{
struct connection *conn;
struct addrinfo *from_ai, *to_ai;
const char *from_addr, *to_addr;
#ifdef ICL_KERNEL_PROXY
struct iscsi_daemon_connect idc;
#endif
int error;
conn = calloc(1, sizeof(*conn));
if (conn == NULL)
log_err(1, "calloc");
/*
* Default values, from RFC 3720, section 12.
*/
conn->conn_header_digest = CONN_DIGEST_NONE;
conn->conn_data_digest = CONN_DIGEST_NONE;
conn->conn_initial_r2t = true;
conn->conn_immediate_data = true;
conn->conn_max_data_segment_length = 8192;
conn->conn_max_burst_length = 262144;
conn->conn_first_burst_length = 65536;
conn->conn_session_id = session_id;
conn->conn_iscsi_fd = iscsi_fd;
/*
* XXX: Should we sanitize this somehow?
*/
memcpy(&conn->conn_conf, conf, sizeof(conn->conn_conf));
from_addr = conn->conn_conf.isc_initiator_addr;
to_addr = conn->conn_conf.isc_target_addr;
if (from_addr[0] != '\0')
resolve_addr(conn, from_addr, &from_ai, true);
else
from_ai = NULL;
resolve_addr(conn, to_addr, &to_ai, false);
#ifdef ICL_KERNEL_PROXY
memset(&idc, 0, sizeof(idc));
idc.idc_session_id = conn->conn_session_id;
if (conn->conn_conf.isc_iser)
idc.idc_iser = 1;
idc.idc_domain = to_ai->ai_family;
idc.idc_socktype = to_ai->ai_socktype;
idc.idc_protocol = to_ai->ai_protocol;
if (from_ai != NULL) {
idc.idc_from_addr = from_ai->ai_addr;
idc.idc_from_addrlen = from_ai->ai_addrlen;
}
idc.idc_to_addr = to_ai->ai_addr;
idc.idc_to_addrlen = to_ai->ai_addrlen;
log_debugx("connecting to %s using ICL kernel proxy", to_addr);
error = ioctl(iscsi_fd, ISCSIDCONNECT, &idc);
if (error != 0) {
fail(conn, strerror(errno));
log_err(1, "failed to connect to %s using ICL kernel proxy",
to_addr);
}
#else /* !ICL_KERNEL_PROXY */
if (conn->conn_conf.isc_iser) {
fail(conn, "iSER not supported");
log_errx(1, "iscsid(8) compiled without ICL_KERNEL_PROXY "
"does not support iSER");
}
conn->conn_socket = socket(to_ai->ai_family, to_ai->ai_socktype,
to_ai->ai_protocol);
if (conn->conn_socket < 0) {
fail(conn, strerror(errno));
log_err(1, "failed to create socket for %s", from_addr);
}
if (from_ai != NULL) {
error = bind(conn->conn_socket, from_ai->ai_addr,
from_ai->ai_addrlen);
if (error != 0) {
fail(conn, strerror(errno));
log_err(1, "failed to bind to %s", from_addr);
}
}
log_debugx("connecting to %s", to_addr);
error = connect(conn->conn_socket, to_ai->ai_addr, to_ai->ai_addrlen);
if (error != 0) {
fail(conn, strerror(errno));
log_err(1, "failed to connect to %s", to_addr);
}
#endif /* !ICL_KERNEL_PROXY */
return (conn);
}
static struct connection *
connection_new(int iscsi_fd, const struct iscsi_daemon_request *request)
{
struct connection *conn;
struct iscsi_session_limits *isl;
struct addrinfo *from_ai, *to_ai;
const char *from_addr, *to_addr;
#ifdef ICL_KERNEL_PROXY
struct iscsi_daemon_connect idc;
#endif
int error, sockbuf;
conn = calloc(1, sizeof(*conn));
if (conn == NULL)
log_err(1, "calloc");
/*
* Default values, from RFC 3720, section 12.
*/
conn->conn_header_digest = CONN_DIGEST_NONE;
conn->conn_data_digest = CONN_DIGEST_NONE;
conn->conn_initial_r2t = true;
conn->conn_immediate_data = true;
conn->conn_max_recv_data_segment_length = 8192;
conn->conn_max_send_data_segment_length = 8192;
conn->conn_max_burst_length = 262144;
conn->conn_first_burst_length = 65536;
conn->conn_iscsi_fd = iscsi_fd;
conn->conn_session_id = request->idr_session_id;
memcpy(&conn->conn_conf, &request->idr_conf, sizeof(conn->conn_conf));
memcpy(&conn->conn_isid, &request->idr_isid, sizeof(conn->conn_isid));
conn->conn_tsih = request->idr_tsih;
/*
* Read the driver limits and provide reasonable defaults for the ones
* the driver doesn't care about. If a max_snd_dsl is not explicitly
* provided by the driver then we'll make sure both conn->max_snd_dsl
* and isl->max_snd_dsl are set to the rcv_dsl. This preserves historic
* behavior.
*/
isl = &conn->conn_limits;
memcpy(isl, &request->idr_limits, sizeof(*isl));
if (isl->isl_max_recv_data_segment_length == 0)
isl->isl_max_recv_data_segment_length = (1 << 24) - 1;
if (isl->isl_max_send_data_segment_length == 0)
isl->isl_max_send_data_segment_length =
isl->isl_max_recv_data_segment_length;
if (isl->isl_max_burst_length == 0)
isl->isl_max_burst_length = (1 << 24) - 1;
if (isl->isl_first_burst_length == 0)
isl->isl_first_burst_length = (1 << 24) - 1;
if (isl->isl_first_burst_length > isl->isl_max_burst_length)
isl->isl_first_burst_length = isl->isl_max_burst_length;
/*
* Limit default send length in case it won't be negotiated.
* We can't do it for other limits, since they may affect both
* sender and receiver operation, and we must obey defaults.
*/
if (conn->conn_max_send_data_segment_length >
isl->isl_max_send_data_segment_length) {
conn->conn_max_send_data_segment_length =
isl->isl_max_send_data_segment_length;
}
from_addr = conn->conn_conf.isc_initiator_addr;
to_addr = conn->conn_conf.isc_target_addr;
if (from_addr[0] != '\0')
resolve_addr(conn, from_addr, &from_ai, true);
else
from_ai = NULL;
resolve_addr(conn, to_addr, &to_ai, false);
#ifdef ICL_KERNEL_PROXY
if (conn->conn_conf.isc_iser) {
memset(&idc, 0, sizeof(idc));
idc.idc_session_id = conn->conn_session_id;
if (conn->conn_conf.isc_iser)
idc.idc_iser = 1;
idc.idc_domain = to_ai->ai_family;
idc.idc_socktype = to_ai->ai_socktype;
idc.idc_protocol = to_ai->ai_protocol;
if (from_ai != NULL) {
idc.idc_from_addr = from_ai->ai_addr;
idc.idc_from_addrlen = from_ai->ai_addrlen;
}
idc.idc_to_addr = to_ai->ai_addr;
idc.idc_to_addrlen = to_ai->ai_addrlen;
log_debugx("connecting to %s using ICL kernel proxy", to_addr);
error = ioctl(iscsi_fd, ISCSIDCONNECT, &idc);
if (error != 0) {
fail(conn, strerror(errno));
log_err(1, "failed to connect to %s "
"using ICL kernel proxy: ISCSIDCONNECT", to_addr);
}
return (conn);
}
#endif /* ICL_KERNEL_PROXY */
if (conn->conn_conf.isc_iser) {
fail(conn, "iSER not supported");
log_errx(1, "iscsid(8) compiled without ICL_KERNEL_PROXY "
"does not support iSER");
}
conn->conn_socket = socket(to_ai->ai_family, to_ai->ai_socktype,
to_ai->ai_protocol);
if (conn->conn_socket < 0) {
fail(conn, strerror(errno));
log_err(1, "failed to create socket for %s", from_addr);
}
sockbuf = SOCKBUF_SIZE;
if (setsockopt(conn->conn_socket, SOL_SOCKET, SO_RCVBUF,
&sockbuf, sizeof(sockbuf)) == -1)
log_warn("setsockopt(SO_RCVBUF) failed");
sockbuf = SOCKBUF_SIZE;
if (setsockopt(conn->conn_socket, SOL_SOCKET, SO_SNDBUF,
&sockbuf, sizeof(sockbuf)) == -1)
log_warn("setsockopt(SO_SNDBUF) failed");
if (from_ai != NULL) {
error = bind(conn->conn_socket, from_ai->ai_addr,
from_ai->ai_addrlen);
if (error != 0) {
fail(conn, strerror(errno));
log_err(1, "failed to bind to %s", from_addr);
}
}
log_debugx("connecting to %s", to_addr);
error = connect(conn->conn_socket, to_ai->ai_addr, to_ai->ai_addrlen);
if (error != 0) {
fail(conn, strerror(errno));
log_err(1, "failed to connect to %s", to_addr);
}
return (conn);
}
