ovpnagent.cpp

Go to the documentation of this file.

//    OpenVPN -- An application to securely tunnel IP networks
//               over a single port, with support for SSL/TLS-based
//               session authentication and key exchange,
//               packet encryption, packet authentication, and
//               packet compression.
//
//    Copyright (C) 2012- OpenVPN Inc.
//
//    SPDX-License-Identifier: MPL-2.0 OR AGPL-3.0-only WITH openvpn3-openssl-exception
//
 
// OpenVPN agent for Mac
 
// #define OPENVPN_EXIT_IN 30
 
// #define OPENVPN_SSL_DEBUG 9   // MbedTLS debugging max level
 
#include <iostream>
#include <string>
#include <utility>
 
#include <unistd.h>
 
// VERSION version can be passed on build command line
#include <openvpn/common/stringize.hpp>
#ifdef VERSION
#define HTTP_SERVER_VERSION OPENVPN_STRINGIZE(VERSION)
#else
#define HTTP_SERVER_VERSION "0.1.1"
#endif
 
#ifdef OVPNAGENT_NAME
#define OVPNAGENT_NAME_STRING OPENVPN_STRINGIZE(OVPNAGENT_NAME)
#else
#define OVPNAGENT_NAME_STRING "ovpnagent"
#endif
 
#include <openvpn/log/logbase.hpp>
 
#include <openvpn/common/platform.hpp>
#include <openvpn/common/size.hpp>
#include <openvpn/common/exception.hpp>
#include <openvpn/common/rc.hpp>
#include <openvpn/common/runcontext.hpp>
#include <openvpn/common/file.hpp>
#include <openvpn/common/getopt.hpp>
#include <openvpn/common/scoped_fd.hpp>
#include <openvpn/common/daemon.hpp>
#include <openvpn/common/waitbarrier.hpp>
#include <openvpn/common/usergroup.hpp>
#include <openvpn/common/xmitfd.hpp>
#include <openvpn/buffer/bufstr.hpp>
#include <openvpn/buffer/buflist.hpp>
#include <openvpn/init/initprocess.hpp>
#include <openvpn/ssl/sslchoose.hpp>
#include <openvpn/ws/httpserv.hpp>
#include <openvpn/tun/mac/client/tunsetup.hpp>
 
void log_version()
{
    std::cout << "OpenVPN Agent (Mac) " HTTP_SERVER_VERSION " [" SSL_LIB_NAME "]"
#ifdef OPENVPN_DEBUG
              << " built on " __DATE__ " " __TIME__
#endif
              << std::endl;
}
 
using namespace openvpn;
 
class MySessionStats : public SessionStats
{
  public:
    typedef RCPtr<MySessionStats> Ptr;
 
    void error(const size_t err_type, const std::string *text = nullptr) override
    {
        OPENVPN_LOG(Error::name(err_type));
    }
 
    std::string dump() const
    {
        std::ostringstream os;
        os << "OpenVPN Agent Stats" << std::endl;
        return os.str();
    }
};
 
struct ThreadCommon
{
    ThreadCommon(const char *unix_sock, const char *user, const char *group)
        : listen_list(build_listen_list(unix_sock)),
          user_group(user, group, true),
          stats(new MySessionStats),
          event_loop_bar(1)
    {
    }
 
    static Listen::List build_listen_list(const char *unix_sock)
    {
        Listen::List ll;
        if (unix_sock)
        {
            Listen::Item li;
            li.directive = "http-listen";
            li.addr = unix_sock;
            li.proto = Protocol(Protocol::UnixStream);
            li.n_threads = 1;
            ll.push_back(std::move(li));
        }
        return ll;
    }
 
    void show_unused_options() const
    {
    }
 
    const Listen::List listen_list;
    const SetUserGroup user_group;
    MySessionStats::Ptr stats;
    PThreadBarrier event_loop_bar;
};
 
class MyListener : public WS::Server::Listener
{
    // handles ungraceful exit of client and closes tun
    class WatchdogThread : public RC<thread_safe_refcount>
    {
      private:
        typedef RCPtr<WatchdogThread> Ptr;
 
        friend class MyListener;
        MyListener *parent;
 
      public:
        WatchdogThread(MyListener *parent_arg, openvpn_io::io_context &io_context_arg)
            : parent(parent_arg), io_context(io_context_arg)
        {
        }
 
        ~WatchdogThread()
        {
            if (th.joinable())
            {
                OPENVPN_LOG("Reaping watchdog thread");
                th.join();
            }
        }
 
        // starts a thread which blocks until:
        // - process with given pid exits
        // - there is a data in pipe
        void watch(pid_t pid)
        {
            if (client_pid != -1)
            {
                OPENVPN_LOG("Watchdog already set for pid " << client_pid << ", won't set for pid " << pid);
                return;
            }
 
            OPENVPN_LOG("Setting up watchdog for pid " << pid << " exit notification");
 
            // self-pipe trick to be able to interrupt wait when agent exits
            if (pipe(fds) == -1)
            {
                OPENVPN_LOG("pipe() failed: " << strerror(errno));
                return;
            }
            // make write nonblocking
            fcntl(fds[1], F_SETFL, O_NONBLOCK);
 
            kq = kqueue();
            if (kq == -1)
            {
                OPENVPN_LOG("kqueue() failed: " << strerror(errno));
                close_pipe_fds();
                return;
            }
 
            // add pid exit and self-pipe read_fd to kevent changelist
            struct kevent chlist[2];
            EV_SET(&chlist[0], pid, EVFILT_PROC, EV_ADD | EV_RECEIPT, NOTE_EXIT, 0, NULL);
            EV_SET(&chlist[1], fds[0], EVFILT_READ, EV_ADD, 0, 0, NULL);
            if (kevent(kq, chlist, 2, NULL, 0, NULL) == -1)
            {
                OPENVPN_LOG("kevent() failed: " << strerror(errno));
                close_pipe_fds();
                return;
            }
 
            // reap thread if previous client didn't exit gracefullt
            if (th.joinable())
            {
                OPENVPN_LOG("Reaping watchdog thread");
                th.join();
            }
 
            client_pid = pid;
 
            th = std::thread([self = Ptr(this), pid]()
                             {
    struct kevent evlist[2];
    int nev = kevent(self->kq, 0, 0, evlist, 2, NULL);
    if (nev == -1)
      {
        OPENVPN_LOG("kevent() failed: " << strerror(errno));
        self->close_pipe_fds();
        return;
      }
 
    for (int i = 0; i < nev; ++ i)
      {
        if (evlist[i].filter == EVFILT_PROC)
          {
        openvpn_io::post(self->io_context, [self, pid]() {
          OPENVPN_LOG("Process " << pid << " has exited, destroy tun");
          std::ostringstream os;
          self->parent->destroy_tun(os);
        });
          }
      }
 
    self->client_pid = -1;
    self->close_pipe_fds(); });
        }
 
        void unwatch()
        {
            OPENVPN_LOG("Stopping watchdog thread");
            write(fds[1], "x", 1);
            if (th.joinable())
            {
                OPENVPN_LOG("Reaping watchdog thread");
                th.join();
            }
        }
 
      private:
        void close_pipe_fds()
        {
            close(fds[0]);
            close(fds[1]);
        }
 
        pid_t client_pid = -1;
        openvpn_io::io_context &io_context;
        int kq;     // kqueue
        int fds[2]; // file descriptors for self-pipe trick
        std::thread th;
    };
 
  public:
    typedef RCPtr<MyListener> Ptr;
 
    MyListener(openvpn_io::io_context &io_context,
               const WS::Server::Config::Ptr &config,
               const Listen::List &listen_list,
               const WS::Server::Listener::Client::Factory::Ptr &client_factory)
        : WS::Server::Listener(io_context, config, listen_list, client_factory)
    {
        watchdog.reset(new WatchdogThread(this, io_context));
    }
 
    ScopedFD establish_tun(const TunBuilderCapture &tbc,
                           TunBuilderSetup::Config *config,
                           Stop *stop,
                           std::ostream &os)
    {
        if (!tun)
            tun.reset(new TunMac::Setup);
        return ScopedFD(tun->establish(tbc, config, stop, os));
    }
 
    void destroy_tun(std::ostream &os)
    {
        if (tun)
        {
            tun->destroy(os);
            tun.reset();
        }
 
        remove_cmds_bypass_hosts.execute(os);
        remove_cmds_bypass_hosts.clear();
        bypass_host.clear();
    }
 
    void set_watchdog(pid_t pid)
    {
        watchdog->watch(pid);
    }
 
    void unset_watchdog()
    {
        watchdog->unwatch();
    }
 
    void add_bypass_route(const std::string &host, bool ipv6)
    {
        if (host != bypass_host)
        {
            bypass_host = host;
 
            std::ostringstream os;
 
            remove_cmds_bypass_hosts.execute(os);
            remove_cmds_bypass_hosts.clear();
 
            ActionList add_cmds;
            TunMac::Setup::add_bypass_route(host, ipv6, add_cmds, remove_cmds_bypass_hosts);
            add_cmds.execute(os);
 
            OPENVPN_LOG(os.str());
        }
    }
 
  private:
    bool allow_client(AsioPolySock::Base &sock) override
    {
        return true;
    }
 
    std::string bypass_host;
    ActionList remove_cmds_bypass_hosts;
 
    TunMac::Setup::Ptr tun;
    WatchdogThread::Ptr watchdog;
};
 
class MyClientInstance : public WS::Server::Listener::Client
{
  public:
    typedef RCPtr<MyClientInstance> Ptr;
 
    MyClientInstance(WS::Server::Listener::Client::Initializer &ci)
        : WS::Server::Listener::Client(ci)
    {
    }
 
    virtual ~MyClientInstance() = default;
 
  private:
    void generate_reply(const Json::Value &jout)
    {
        out = buf_from_string(jout.toStyledString());
 
        WS::Server::ContentInfo ci;
        ci.http_status = HTTP::Status::OK;
        ci.type = "application/json";
        ci.length = out->size();
        ci.keepalive = keepalive_request();
        generate_reply_headers(ci);
    }
 
    void http_request_received() override
    {
        // alloc output buffer
        std::ostringstream os;
 
        try
        {
            const HTTP::Request &req = request();
            OPENVPN_LOG("HTTP request received from " << sock->remote_endpoint_str() << '\n'
                                                      << req.to_string());
 
            // get content-type
            const std::string content_type = req.headers.get_value_trim("content-type");
 
            if (req.method == "POST")
            {
                // verify correct content-type
                if (string::strcasecmp(content_type, "application/json"))
                    throw Exception("bad content-type");
 
                // parse the json dict
                const Json::Value root = json::parse(in.to_string(), "JSON request");
                if (!root.isObject())
                    throw Exception("json parse error: top level json object is not a dictionary");
 
                if (req.uri == "/tun-setup")
                {
                    send_fd.reset();
 
                    // get PID
                    pid_t pid = json::get_int_optional(root, "pid", -1);
                    if (pid != -1)
                        parent()->set_watchdog(pid);
 
                    // parse JSON data into a TunBuilderCapture object
                    TunBuilderCapture::Ptr tbc = TunBuilderCapture::from_json(json::get_dict(root, "tun", false));
                    tbc->validate();
 
                    // get config
                    TunMac::Setup::Config config;
                    config.from_json(json::get_dict(root, "config", false), "config");
 
                    // establish the tun setup object
                    send_fd = parent()->establish_tun(*tbc, &config, nullptr, os);
 
                    // build JSON return dictionary
                    Json::Value jout(Json::objectValue);
                    jout["log_txt"] = Json::Value(string::remove_blanks(os.str()));
                    jout["config"] = config.to_json();
                    generate_reply(jout);
                }
                else if (req.uri == "/add-bypass-route")
                {
                    pid_t pid = json::get_int_optional(root, "pid", -1);
                    if (pid != -1)
                        parent()->set_watchdog(pid);
                    bool ipv6 = json::get_bool(root, "ipv6");
                    std::string host = json::get_string(root, "host");
 
                    parent()->add_bypass_route(host, ipv6);
 
                    Json::Value jout(Json::objectValue);
                    generate_reply(jout);
                }
            }
            else if (req.method == "GET" && req.uri == "/tun-destroy")
            {
                // destroy tun object
                parent()->destroy_tun(os);
 
                // build JSON return dictionary
                Json::Value jout(Json::objectValue);
                jout["log_txt"] = Json::Value(string::remove_blanks(os.str()));
                generate_reply(jout);
            }
            else
            {
                out = buf_from_string("page not found\n");
                WS::Server::ContentInfo ci;
                ci.http_status = HTTP::Status::NotFound;
                ci.type = "text/plain";
                ci.length = out->size();
                generate_reply_headers(ci);
            }
        }
        catch (const std::exception &e)
        {
            out = buf_from_string(string::remove_blanks(os.str() + e.what() + '\n'));
            WS::Server::ContentInfo ci;
            ci.http_status = HTTP::Status::BadRequest;
            ci.type = "text/plain";
            ci.length = out->size();
            generate_reply_headers(ci);
        }
    }
 
    void http_content_in(BufferAllocated &buf) override
    {
        if (buf.defined())
            in.emplace_back(BufferAllocatedRc::Create(std::move(buf)));
    }
 
    BufferPtr http_content_out() override
    {
        BufferPtr ret;
        ret.swap(out);
        return ret;
    }
 
    // Normally true is returned, however return false if we
    // are planning to send the tun file descriptor to the client.
    bool http_out_eof() override
    {
        // OPENVPN_LOG("HTTP output EOF send_fd=" << send_fd());
        return !send_fd.defined();
    }
 
    // After HTTP reply has been transmitted, wait for client to
    // send a 't' message.  On receipt, reply with a 'T' message
    // that bundles the tun file descriptor.
    void http_pipeline_peek(BufferAllocated &buf) override
    {
        // OPENVPN_LOG("HTTP PIPELINE PEEK send_fd=" << send_fd() << " CONTENT=" << buf_to_string(buf));
        if (send_fd.defined())
        {
            if (buf.size() == 1 && buf.front() == 't')
            {
                const int fd = unix_fd();
                if (fd < 0)
                    OPENVPN_THROW_EXCEPTION("http_pipeline_peek: not a unix socket");
                XmitFD::xmit_fd(fd, send_fd(), "T", 5000);
                external_stop("FD transmitted");
            }
            else
                OPENVPN_THROW_EXCEPTION("bad FD request message");
        }
    }
 
    bool http_stop(const int status, const std::string &description) override
    {
        OPENVPN_LOG("INSTANCE STOP : " << WS::Server::Status::error_str(status) << " : " << description);
 
        // if the shutdown happened due to an unexpected error, the TUN status has
        // to be cleaned up to avoid configuration inconsistency.
        //
        // A problem we have witnessed was that the DNS settings were not being
        // reverted when the HTTP connection with the core was interrupted in the
        // middle of the establish() call.
        if (status != WS::Server::Status::E_SUCCESS
            && status != WS::Server::Status::E_EXTERNAL_STOP)
        {
            std::ostringstream os;
            parent()->destroy_tun(os);
        }
 
        // returning true here triggers socket shutdown, which triggers "Socket is not connected" error
        return false;
    }
 
    MyListener *parent()
    {
        return static_cast<MyListener *>(get_parent());
    }
 
    ScopedFD send_fd;
    BufferList in;
    BufferPtr out;
};
 
class MyClientFactory : public WS::Server::Listener::Client::Factory
{
  public:
    typedef RCPtr<MyClientFactory> Ptr;
 
    WS::Server::Listener::Client::Ptr new_client(WS::Server::Listener::Client::Initializer &ci) override
    {
        return new MyClientInstance(ci);
    }
};
 
class ServerThread : public ServerThreadBase
{
  public:
    typedef RCPtr<ServerThread> Ptr;
 
    ServerThread(openvpn_io::io_context &io_context_arg,
                 ThreadCommon &tc)
        : io_context(io_context_arg),
          halt(false)
    {
        Frame::Ptr frame = frame_init_simple(2048);
 
        WS::Server::Config::Ptr config = new WS::Server::Config();
        config->http_server_id = OVPNAGENT_NAME_STRING "/" HTTP_SERVER_VERSION;
        config->frame = frame;
        config->stats = tc.stats;
        config->unix_mode = 0777;
 
        MyClientFactory::Ptr factory = new MyClientFactory();
        listener.reset(new MyListener(io_context_arg, config, tc.listen_list, factory));
    }
 
    void start()
    {
        if (!halt)
        {
            listener->start();
        }
    }
 
    void stop()
    {
        if (!halt)
        {
            halt = true;
            listener->stop();
            listener->unset_watchdog();
        }
    }
 
    void thread_safe_stop() override
    {
        if (!halt)
        {
            openvpn_io::post(io_context, [self = Ptr(this)]()
                             { self->stop(); });
        }
    }
 
  private:
    openvpn_io::io_context &io_context;
    MyListener::Ptr listener;
    bool halt;
};
 
typedef RunContext<ServerThreadBase, MySessionStats> MyRunContext;
 
void work(openvpn_io::io_context &io_context,
          ThreadCommon &tc,
          MyRunContext &runctx,
          const unsigned int unit)
{
    ServerThread::Ptr serv;
 
    try
    {
        serv.reset(new ServerThread(io_context, tc));
        runctx.set_server(unit, serv.get());
 
        serv->start();
 
        // barrier prior to event-loop entry
        event_loop_wait_barrier(tc);
 
        // privilege has now been downgraded
 
        // run i/o reactor
        io_context.run();
        runctx.clear_server(unit);
        serv->stop();
    }
    catch (...)
    {
        tc.event_loop_bar.error();
        if (serv)
        {
            runctx.clear_server(unit);
            serv->stop(); // on exception, stop server
        }
        io_context.poll(); // execute completion handlers
        throw;
    }
}
 
void worker_thread(ThreadCommon &tc,
                   MyRunContext &runctx,
                   const unsigned int unit)
{
    SignalBlockerDefault signal_blocker;
    openvpn_io::io_context io_context(1); // concurrency hint=1
    Log::Context log_context(runctx.log_wrapper());
    MyRunContext::ThreadContext thread_ctx(runctx);
 
    try
    {
        work(io_context, tc, runctx, unit);
    }
    catch (const std::exception &e)
    {
        OPENVPN_LOG("Worker thread exception: " << e.what());
    }
}
 
int ovpnagent(const char *sock_fn,
              const char *log_fn,
              const bool log_append,
              const char *pid_fn,
              const char *user,
              const char *group)
{
    if (log_fn)
        daemonize(log_fn, nullptr, log_append, 0);
 
    if (pid_fn)
        write_pid(pid_fn);
 
    log_version();
 
    MyRunContext::Ptr runctx(new MyRunContext());
    ThreadCommon tc(sock_fn, user, group);
 
    // Give runctx visibility into global stats
    // for SIGUSR2 dump.
    runctx->set_stats_obj(tc.stats);
 
    // Main worker thread
    {
        const unsigned int thread_num = 0;
        std::thread *thread = new std::thread([&tc, &runctx]()
                                              { worker_thread(tc, *runctx, thread_num); });
        runctx->set_thread(thread_num, thread);
    }
 
    // wait for worker to exit
    runctx->run();
    runctx->join();
 
    // dump final stats
    OPENVPN_LOG_NTNL(tc.stats->dump());
 
    // remove pidfile
    if (pid_fn)
        ::unlink(pid_fn);
 
    return 0;
}
 
OPENVPN_SIMPLE_EXCEPTION(usage);
 
int main(int argc, char *argv[])
{
    static const struct option longopts[] = {
        {"help", no_argument, nullptr, 'h'},
        {"append", no_argument, nullptr, 'a'},
        {"daemon", required_argument, nullptr, 'd'},
        {"pidfile", required_argument, nullptr, 'p'},
        {"user", required_argument, nullptr, 'u'},
        {"group", required_argument, nullptr, 'g'},
        {nullptr, 0, nullptr, 0}};
 
    int ret = 0;
 
    bool append = false;
    const char *logfile = nullptr;
    const char *pidfile = nullptr;
    const char *user = nullptr;
    const char *group = nullptr;
 
    // process-wide initialization
    InitProcess::Init init;
 
    // set global MbedTLS debug level
#if defined(USE_MBEDTLS) && defined(OPENVPN_SSL_DEBUG)
    debug_set_threshold(OPENVPN_SSL_DEBUG);
#endif
 
    try
    {
        if (argc < 1)
            throw usage();
 
        int ch;
        while ((ch = getopt_long(argc, argv, "had:p:u:g:", longopts, nullptr)) != -1)
        {
            switch (ch)
            {
            case 'a':
                append = true;
                break;
            case 'd':
                logfile = optarg;
                break;
            case 'p':
                pidfile = optarg;
                break;
            case 'u':
                user = optarg;
                break;
            case 'g':
                group = optarg;
                break;
            default:
                throw usage();
            }
        }
        argc -= optind;
        argv += optind;
 
        ret = ovpnagent("/var/run/" OVPNAGENT_NAME_STRING ".sock", logfile, append, pidfile, user, group);
    }
    catch (const usage &)
    {
        log_version();
        std::cout << "usage: ovpnagent [options]" << std::endl;
        std::cout << "  --daemon <file>, -d       : daemonize, log to file" << std::endl;
        std::cout << "  --append, -a              : append to log file" << std::endl;
        std::cout << "  --pidfile <file>, -p      : write pid to file" << std::endl;
        std::cout << "  --user <user>, -u         : set UID to user" << std::endl;
        std::cout << "  --group <group>, -g       : set group" << std::endl;
        ret = 2;
    }
    catch (const std::exception &e)
    {
        std::cout << "Main thread exception: " << e.what() << std::endl;
        ret = 1;
    }
 
    return ret;
}