GCOV - Varnish Cache


/*-
 * Copyright (c) 2006 Verdens Gang AS
 * Copyright (c) 2006-2015 Varnish Software AS
 * All rights reserved.
 *
 * Author: Poul-Henning Kamp <phk@phk.freebsd.dk>
 *
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * The mechanics of handling the child process
 */

#include "config.h"

#include <sys/types.h>

#include <poll.h>
#include <stdarg.h>
#include <stdio.h>
#include <string.h>
#include <syslog.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <sys/resource.h>

#include "mgt.h"
#include "acceptor/mgt_acceptor.h"

#include "vapi/vsig.h"

#include "vbm.h"
#include "vcli_serve.h"
#include "vev.h"
#include "vfil.h"
#include "vlu.h"
#include "vtim.h"

#include "common/heritage.h"

static pid_t            child_pid = -1;

static struct vbitmap   *fd_map;

static int              child_cli_fd = -1;
static int              child_output = -1;

static enum {
        CH_STOPPED = 0,
        CH_STARTING = 1,
        CH_RUNNING = 2,
        CH_STOPPING = 3,
        CH_DIED = 4
}                       child_state = CH_STOPPED;

static const char * const ch_state[] = {
        [CH_STOPPED] =  "stopped",
        [CH_STARTING] = "starting",
        [CH_RUNNING] =  "running",
        [CH_STOPPING] = "stopping",
        [CH_DIED] =     "died, (restarting)",
};

static struct vev       *ev_poker;
static struct vev       *ev_listen;
static struct vlu       *child_std_vlu;

static struct vsb *child_panic = NULL;

static void mgt_reap_child(void);
static int kill_child(void);

/*=====================================================================
 * Panic string evacuation and handling
 */

static void
mgt_panic_record(pid_t r)
{
        char time_str[30];

        if (child_panic != NULL)
                VSB_destroy(&child_panic);
        child_panic = VSB_new_auto();
        AN(child_panic);
        VTIM_format(VTIM_real(), time_str);
        VSB_printf(child_panic, "Child (%jd) Panic at: %s\n",
            (intmax_t)r, time_str);
        VSB_quote(child_panic, heritage.panic_str,
            strnlen(heritage.panic_str, heritage.panic_str_len),
            VSB_QUOTE_NONL);
        MGT_ComplainVSB(C_ERR, child_panic);
}

static void
mgt_panic_clear(void)
{
        VSB_destroy(&child_panic);
}

static void
cli_panic_show(struct cli *cli, const char * const *av, int json)
{
        if (!child_panic) {
                VCLI_SetResult(cli, CLIS_CANT);
                VCLI_Out(cli,
                    "Child has not panicked or panic has been cleared");
                return;
        }

        if (!json) {
                VCLI_Out(cli, "%s\n", VSB_data(child_panic));
                return;
        }

        VCLI_JSON_begin(cli, 2, av);
        VCLI_Out(cli, ",\n");
        VCLI_JSON_str(cli, VSB_data(child_panic));
        VCLI_JSON_end(cli);
}

static void v_matchproto_(cli_func_t)
mch_cli_panic_show(struct cli *cli, const char * const *av, void *priv)
{
        (void)priv;
        cli_panic_show(cli, av, 0);
}

static void v_matchproto_(cli_func_t)
mch_cli_panic_show_json(struct cli *cli, const char * const *av, void *priv)
{
        (void)priv;
        cli_panic_show(cli, av, 1);
}

static void v_matchproto_(cli_func_t)
mch_cli_panic_clear(struct cli *cli, const char * const *av, void *priv)
{
        (void)priv;

        if (av[2] != NULL && strcmp(av[2], "-z")) {
                VCLI_SetResult(cli, CLIS_PARAM);
                VCLI_Out(cli, "Unknown parameter \"%s\".", av[2]);
                return;
        } else if (av[2] != NULL) {
                VSC_C_mgt->child_panic = 0;
                if (child_panic == NULL)
                        return;
        }
        if (child_panic == NULL) {
                VCLI_SetResult(cli, CLIS_CANT);
                VCLI_Out(cli, "No panic to clear");
                return;
        }
        mgt_panic_clear();
}

/*=====================================================================
 * Track the highest file descriptor the parent knows is being used.
 *
 * This allows the child process to clean/close only a small fraction
 * of the possible file descriptors after exec(2).
 *
 * This is likely to a bit on the low side, as libc and other libraries
 * has a tendency to cache file descriptors (syslog, resolver, etc.)
 * so we add a margin of 10 fds.
 *
 * For added safety, we check that we see no file descriptor open for
 * another margin above the limit for which we close by design
 */

static int              mgt_max_fd;

#define CLOSE_FD_UP_TO  (mgt_max_fd + 10)
#define CHECK_FD_UP_TO  (CLOSE_FD_UP_TO + 10)

void
MCH_TrackHighFd(int fd)
{
        /*
         * Assert > 0, to catch bogus opens, we know where stdin goes
         * in the master process.
         */
        assert(fd > 0);
        mgt_max_fd = vmax(mgt_max_fd, fd);
}

/*--------------------------------------------------------------------
 * Keep track of which filedescriptors the child should inherit and
 * which should be closed after fork()
 */

void
MCH_Fd_Inherit(int fd, const char *what)
{

        assert(fd >= 0);
        // XXX why?
        if (fd > 0)
                MCH_TrackHighFd(fd);
        if (fd_map == NULL)
                fd_map = vbit_new(128);
        AN(fd_map);
        if (what != NULL)
                vbit_set(fd_map, fd);
        else
                vbit_clr(fd_map, fd);
}

/*=====================================================================
 * Listen to stdout+stderr from the child
 */

static const char *whining_child = C_ERR;

static int v_matchproto_(vlu_f)
child_line(void *priv, const char *p)
{
        (void)priv;

        MGT_Complain(whining_child, "Child (%jd) said %s", (intmax_t)child_pid, p);
        return (0);
}

/*--------------------------------------------------------------------
 * NB: Notice cleanup call from mgt_reap_child()
 */

static int v_matchproto_(vev_cb_f)
child_listener(const struct vev *e, int what)
{

        if ((what & ~VEV__RD) || VLU_Fd(child_std_vlu, child_output)) {
                ev_listen = NULL;
                if (e != NULL)
                        mgt_reap_child();
                return (1);
        }
        return (0);
}

/*=====================================================================
 * Periodically poke the child, to see that it still lives
 */

static int v_matchproto_(vev_cb_f)
child_poker(const struct vev *e, int what)
{
        char *r = NULL;
        unsigned status;

        (void)e;
        (void)what;
        if (child_state != CH_RUNNING)
                return (1);
        if (child_pid < 0)
                return (0);
        if (mgt_cli_askchild(&status, &r, "ping\n") || strncmp("PONG ", r, 5)) {
                MGT_Complain(C_ERR, "Unexpected reply from ping: %u %s",
                    status, r);
                if (status != CLIS_COMMS)
                        MCH_Cli_Fail();
        }
        free(r);
        return (0);
}

/*=====================================================================
 * Launch the child process
 */

#define mgt_launch_err(cli, status, ...) do {           \
                MGT_Complain(C_ERR, __VA_ARGS__);       \
                if (cli == NULL)                        \
                        break;                          \
                VCLI_Out(cli, __VA_ARGS__);             \
                VCLI_SetResult(cli, status);            \
        } while (0)

static void
mgt_launch_child(struct cli *cli)
{
        pid_t pid;
        unsigned u;
        char *p;
        struct vev *e;
        int i, cp[2];
        struct rlimit rl[1];
        vtim_dur dstart;
        int bstart;
        vtim_mono t0;

        if (child_state != CH_STOPPED && child_state != CH_DIED)
                return;

        child_state = CH_STARTING;

        /* Open pipe for mgt->child CLI */
        AZ(socketpair(AF_UNIX, SOCK_STREAM, 0, cp));
        heritage.cli_fd = cp[0];
        assert(cp[0] > STDERR_FILENO);  // See #2782
        assert(cp[1] > STDERR_FILENO);
        MCH_Fd_Inherit(heritage.cli_fd, "cli_fd");
        child_cli_fd = cp[1];

        /*
         * Open pipe for child stdout/err
         * NB: not inherited, because we dup2() it to stdout/stderr in child
         */
        AZ(pipe(cp));
        heritage.std_fd = cp[1];
        child_output = cp[0];

        mgt_SHM_ChildNew();

        AN(heritage.param);
        AN(heritage.panic_str);
        VJ_master(JAIL_MASTER_SYSTEM);
        if ((pid = fork()) < 0) {
                VJ_master(JAIL_MASTER_LOW);
                perror("Could not fork child");
                exit(1);                // XXX Harsh ?
        }
        if (pid == 0) {

                if (MGT_FEATURE(FEATURE_NO_COREDUMP)) {
                        memset(rl, 0, sizeof *rl);
                        rl->rlim_cur = 0;
                        AZ(setrlimit(RLIMIT_CORE, rl));
                }

                /* Redirect stdin/out/err */
                VFIL_null_fd(STDIN_FILENO);
                assert(dup2(heritage.std_fd, STDOUT_FILENO) == STDOUT_FILENO);
                assert(dup2(heritage.std_fd, STDERR_FILENO) == STDERR_FILENO);

                setbuf(stdout, NULL);
                setbuf(stderr, NULL);
                printf("Child starts\n");

                /*
                 * Close all FDs the child shouldn't know about
                 *
                 * We cannot just close these filedescriptors, some random
                 * library routine might miss it later on and wantonly close
                 * a FD we use at that point in time. (See bug #1841).
                 * We close the FD and replace it with /dev/null instead,
                 * That prevents security leakage, and gives the library
                 * code a valid FD to close when it discovers the changed
                 * circumstances.
                 */
                closelog();

                for (i = STDERR_FILENO + 1; i <= CLOSE_FD_UP_TO; i++) {
                        if (vbit_test(fd_map, i))
                                continue;
                        if (close(i) == 0)
                                VFIL_null_fd(i);
                }
                for (i = CLOSE_FD_UP_TO + 1; i <= CHECK_FD_UP_TO; i++) {
                        assert(close(i) == -1);
                        assert(errno == EBADF);
                }

                mgt_ProcTitle("Child");

                heritage.cls = mgt_cls;
                heritage.ident = VSB_data(vident) + 1;

                vext_load();

                STV_Init();

                VJ_subproc(JAIL_SUBPROC_WORKER);

                /*
                 * We pass these two params because child_main needs them
                 * well before it has found its own param struct.
                 */
                child_main(mgt_param.sigsegv_handler,
                    mgt_param.wthread_stacksize);

                /*
                 * It would be natural to clean VSMW up here, but it is apt
                 * to fail in some scenarios because of the fall-back
                 * "rm -rf" in mgt_SHM_ChildDestroy() which is there to
                 * catch the cases were we don't get here.
                 */
                // VSMW_Destroy(&heritage.proc_vsmw);

                exit(0);
        }
        VJ_master(JAIL_MASTER_LOW);
        assert(pid > 1);
        MGT_Complain(C_DEBUG, "Child (%jd) Started", (intmax_t)pid);
        VSC_C_mgt->child_start++;

        /* Close stuff the child got */
        closefd(&heritage.std_fd);

        MCH_Fd_Inherit(heritage.cli_fd, NULL);
        closefd(&heritage.cli_fd);

        child_std_vlu = VLU_New(child_line, NULL, 0);
        AN(child_std_vlu);

        /* Wait for cache/cache_cli.c::CLI_Run() to check in */
        bstart = mgt_param.startup_timeout >= mgt_param.cli_timeout;
        dstart = bstart ? mgt_param.startup_timeout : mgt_param.cli_timeout;
        t0 = VTIM_mono();
        u = mgt_cli_start_child(child_cli_fd, dstart);
        if (u != CLIS_OK) {
                assert(u == CLIS_COMMS);
                if (VTIM_mono() - t0 < dstart)
                        mgt_launch_err(cli, u, "Child failed on launch ");
                else
                        mgt_launch_err(cli, u, "Child failed on launch "
                            "within %s_timeout=%.2fs%s",
                            bstart ? "startup" : "cli", dstart,
                            bstart ? "" : " (tip: set startup_timeout)");
                child_pid = pid;
                (void)kill_child();
                mgt_reap_child();
                child_state = CH_STOPPED;
                return;
        } else {
                assert(u == CLIS_OK);
                fprintf(stderr, "Child launched OK\n");
        }
        whining_child = C_INFO;

        AZ(ev_listen);
        e = VEV_Alloc();
        XXXAN(e);
        e->fd = child_output;
        e->fd_flags = VEV__RD;
        e->name = "Child listener";
        e->callback = child_listener;
        AZ(VEV_Start(mgt_evb, e));
        ev_listen = e;
        AZ(ev_poker);
        if (mgt_param.ping_interval > 0) {
                e = VEV_Alloc();
                XXXAN(e);
                e->timeout = mgt_param.ping_interval;
                e->callback = child_poker;
                e->name = "child poker";
                AZ(VEV_Start(mgt_evb, e));
                ev_poker = e;
        }

        child_pid = pid;

        if (mgt_push_vcls(cli, &u, &p)) {
                mgt_launch_err(cli, u, "Child (%jd) Pushing vcls failed:\n%s",
                    (intmax_t)child_pid, p);
                free(p);
                MCH_Stop_Child();
                return;
        }

        if (mgt_cli_askchild(&u, &p, "start\n")) {
                mgt_launch_err(cli, u, "Child (%jd) Acceptor start failed:\n%s",
                    (intmax_t)child_pid, p);
                free(p);
                MCH_Stop_Child();
                return;
        }

        free(p);
        child_state = CH_RUNNING;
}

/*=====================================================================
 * Cleanup when child dies.
 */

static int
kill_child(void)
{
        int i, error;

        VJ_master(JAIL_MASTER_KILL);
        i = kill(child_pid, SIGQUIT);
        error = errno;
        VJ_master(JAIL_MASTER_LOW);
        errno = error;
        return (i);
}

static void
mgt_reap_child(void)
{
        int i;
        int status = 0xffff;
        struct vsb *vsb;
        pid_t r = 0;

        assert(child_pid != -1);

        /*
         * Close the CLI connections
         * This signals orderly shut down to child
         */
        mgt_cli_stop_child();
        if (child_cli_fd >= 0)
                closefd(&child_cli_fd);

        /* Stop the poker */
        if (ev_poker != NULL) {
                VEV_Stop(mgt_evb, ev_poker);
                free(ev_poker);
                ev_poker = NULL;
        }

        /* Stop the listener */
        if (ev_listen != NULL) {
                VEV_Stop(mgt_evb, ev_listen);
                free(ev_listen);
                ev_listen = NULL;
        }

        /* Compose obituary */
        vsb = VSB_new_auto();
        XXXAN(vsb);

        (void)VFIL_nonblocking(child_output);
        /* Wait for child to die */
        for (i = 0; i < mgt_param.cli_timeout * 10; i++) {
                (void)child_listener(NULL, VEV__RD);
                r = waitpid(child_pid, &status, WNOHANG);
                if (r == child_pid)
                        break;
                VTIM_sleep(0.1);
        }
        if (r == 0) {
                VSB_printf(vsb, "Child (%jd) not dying (waitpid = %jd),"
                    " killing\n", (intmax_t)child_pid, (intmax_t)r);

                /* Kick it Jim... */
                (void)kill_child();
                r = waitpid(child_pid, &status, 0);
        }
        if (r != child_pid)
                fprintf(stderr, "WAIT 0x%jd\n", (intmax_t)r);
        assert(r == child_pid);

        VSB_printf(vsb, "Child (%jd) %s", (intmax_t)r,
            status ? "died" : "ended");
        if (WIFEXITED(status) && WEXITSTATUS(status)) {
                VSB_printf(vsb, " status=%d", WEXITSTATUS(status));
                exit_status |= 0x20;
                if (WEXITSTATUS(status) == 1)
                        VSC_C_mgt->child_exit++;
                else
                        VSC_C_mgt->child_stop++;
        }
        if (WIFSIGNALED(status)) {
                VSB_printf(vsb, " signal=%d", WTERMSIG(status));
                exit_status |= 0x40;
                VSC_C_mgt->child_died++;
        }
#ifdef WCOREDUMP
        if (WCOREDUMP(status)) {
                VSB_cat(vsb, " (core dumped)");
                if (!MGT_FEATURE(FEATURE_NO_COREDUMP))
                        exit_status |= 0x80;
                VSC_C_mgt->child_dump++;
        }
#endif
        MGT_ComplainVSB(status ? C_ERR : C_INFO, vsb);
        VSB_destroy(&vsb);

        /* Dispose of shared memory but evacuate panic messages first */
        if (heritage.panic_str[0] != '\0') {
                mgt_panic_record(r);
                VSC_C_mgt->child_panic++;
        }

        mgt_SHM_ChildDestroy();

        if (child_state == CH_RUNNING)
                child_state = CH_DIED;

        /* Pick up any stuff lingering on stdout/stderr */
        (void)child_listener(NULL, VEV__RD);
        closefd(&child_output);
        VLU_Destroy(&child_std_vlu);

        child_pid = -1;

        MGT_Complain(C_DEBUG, "Child cleanup complete");

        /* XXX number of retries? interval? */
        for (i = 0; i < 3; i++) {
                if (VCA_reopen_sockets() == 0)
                        break;
                /* error already logged */
                (void)sleep(1);
        }
        if (i == 3) {
                /* We failed to reopen our listening sockets. No choice
                 * but to exit. */
                MGT_Complain(C_ERR,
                    "Could not reopen listening sockets. Exiting.");
                exit(1);
        }

        if (child_state == CH_DIED && mgt_param.auto_restart)
                mgt_launch_child(NULL);
        else if (child_state == CH_DIED)
                child_state = CH_STOPPED;
        else if (child_state == CH_STOPPING)
                child_state = CH_STOPPED;
}

/*=====================================================================
 * If CLI communications with the child process fails, there is nothing
 * for us to do but to drag it behind the barn and get it over with.
 *
 * The typical case is where the child process fails to return a reply
 * before the cli_timeout expires.  This invalidates the CLI pipes for
 * all future use, as we don't know if the child was just slow and the
 * result gets piped later on, or if the child is catatonic.
 */

void
MCH_Cli_Fail(void)
{

        if (child_state != CH_RUNNING && child_state != CH_STARTING)
                return;
        if (child_pid < 0)
                return;
        if (kill_child() == 0)
                MGT_Complain(C_ERR, "Child (%jd) not responding to CLI,"
                    " killed it.", (intmax_t)child_pid);
        else
                MGT_Complain(C_ERR, "Failed to kill child with PID %jd: %s",
                    (intmax_t)child_pid, VAS_errtxt(errno));
}

/*=====================================================================
 * Controlled stop of child process
 *
 * Reaping the child asks for orderly shutdown
 */

void
MCH_Stop_Child(void)
{

        if (child_state != CH_RUNNING && child_state != CH_STARTING)
                return;

        child_state = CH_STOPPING;

        MGT_Complain(C_DEBUG, "Stopping Child");

        mgt_reap_child();
}

/*=====================================================================
 */

int
MCH_Start_Child(void)
{
        mgt_launch_child(NULL);
        if (child_state != CH_RUNNING)
                return (2);
        return (0);
}

/*====================================================================
 * Query if the child is running
 */

int
MCH_Running(void)
{

        return (child_pid > 0);
}

/*=====================================================================
 * CLI commands
 */

static void v_matchproto_(cli_func_t)
mch_pid(struct cli *cli, const char * const *av, void *priv)
{

        (void)av;
        (void)priv;
        VCLI_Out(cli, "Master: %10jd\n", (intmax_t)getpid());
        if (!MCH_Running())
                return;
        VCLI_Out(cli, "Worker: %10jd\n", (intmax_t)child_pid);
}

static void v_matchproto_(cli_func_t)
mch_pid_json(struct cli *cli, const char * const *av, void *priv)
{

        (void)priv;
        VCLI_JSON_begin(cli, 2, av);
        VCLI_Out(cli, ",\n  {\"master\": %jd", (intmax_t)getpid());
        if (MCH_Running())
                VCLI_Out(cli, ", \"worker\": %jd", (intmax_t)child_pid);
        VCLI_Out(cli, "}");
        VCLI_JSON_end(cli);
}

static void v_matchproto_(cli_func_t)
mch_cli_server_start(struct cli *cli, const char * const *av, void *priv)
{
        const char *err;

        (void)av;
        (void)priv;
        if (child_state == CH_STOPPED) {
                err = mgt_has_vcl();
                if (err == NULL) {
                        mgt_launch_child(cli);
                } else {
                        VCLI_SetResult(cli, CLIS_CANT);
                        VCLI_Out(cli, "%s", err);
                }
        } else {
                VCLI_SetResult(cli, CLIS_CANT);
                VCLI_Out(cli, "Child in state %s", ch_state[child_state]);
        }
}

static void v_matchproto_(cli_func_t)
mch_cli_server_stop(struct cli *cli, const char * const *av, void *priv)
{

        (void)av;
        (void)priv;
        if (child_state == CH_RUNNING) {
                MCH_Stop_Child();
        } else {
                VCLI_SetResult(cli, CLIS_CANT);
                VCLI_Out(cli, "Child in state %s", ch_state[child_state]);
        }
}

static void v_matchproto_(cli_func_t)
mch_cli_server_status(struct cli *cli, const char * const *av, void *priv)
{
        (void)av;
        (void)priv;
        VCLI_Out(cli, "Child in state %s", ch_state[child_state]);
}

static void v_matchproto_(cli_func_t)
mch_cli_server_status_json(struct cli *cli, const char * const *av, void *priv)
{
        (void)priv;
        VCLI_JSON_begin(cli, 2, av);
        VCLI_Out(cli, ", ");
        VCLI_JSON_str(cli, ch_state[child_state]);
        VCLI_JSON_end(cli);
}

static struct cli_proto cli_mch[] = {
        { CLICMD_SERVER_STATUS,         "", mch_cli_server_status,
          mch_cli_server_status_json },
        { CLICMD_SERVER_START,          "", mch_cli_server_start },
        { CLICMD_SERVER_STOP,           "", mch_cli_server_stop },
        { CLICMD_PANIC_SHOW,            "", mch_cli_panic_show,
          mch_cli_panic_show_json },
        { CLICMD_PANIC_CLEAR,           "", mch_cli_panic_clear },
        { CLICMD_PID,                   "", mch_pid, mch_pid_json },
        { NULL }
};

/*=====================================================================
 * This thread is the master thread in the management process.
 * The relatively simple task is to start and stop the child process
 * and to reincarnate it in case of trouble.
 */

void
MCH_Init(void)
{

        VCLS_AddFunc(mgt_cls, MCF_AUTH, cli_mch);
}

		varnish-cache/bin/varnishd/mgt/mgt_child.c
0		/*-
1		* Copyright (c) 2006 Verdens Gang AS
2		* Copyright (c) 2006-2015 Varnish Software AS
3		* All rights reserved.
4		*
5		* Author: Poul-Henning Kamp <phk@phk.freebsd.dk>
6		*
7		* SPDX-License-Identifier: BSD-2-Clause
8		*
9		* Redistribution and use in source and binary forms, with or without
10		* modification, are permitted provided that the following conditions
11		* are met:
12		* 1. Redistributions of source code must retain the above copyright
13		* notice, this list of conditions and the following disclaimer.
14		* 2. Redistributions in binary form must reproduce the above copyright
15		* notice, this list of conditions and the following disclaimer in the
16		* documentation and/or other materials provided with the distribution.
17		*
18		* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19		* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20		* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21		* ARE DISCLAIMED. IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
22		* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23		* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24		* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25		* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26		* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27		* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28		* SUCH DAMAGE.
29		*
30		* The mechanics of handling the child process
31		*/
32
33		#include "config.h"
34
35		#include <sys/types.h>
36
37		#include <poll.h>
38		#include <stdarg.h>
39		#include <stdio.h>
40		#include <string.h>
41		#include <syslog.h>
42		#include <unistd.h>
43		#include <sys/types.h>
44		#include <sys/socket.h>
45		#include <sys/time.h>
46		#include <sys/resource.h>
47
48		#include "mgt.h"
49		#include "acceptor/mgt_acceptor.h"
50
51		#include "vapi/vsig.h"
52
53		#include "vbm.h"
54		#include "vcli_serve.h"
55		#include "vev.h"
56		#include "vfil.h"
57		#include "vlu.h"
58		#include "vtim.h"
59
60		#include "common/heritage.h"
61
62		static pid_t child_pid = -1;
63
64		static struct vbitmap *fd_map;
65
66		static int child_cli_fd = -1;
67		static int child_output = -1;
68
69		static enum {
70		CH_STOPPED = 0,
71		CH_STARTING = 1,
72		CH_RUNNING = 2,
73		CH_STOPPING = 3,
74		CH_DIED = 4
75		} child_state = CH_STOPPED;
76
77		static const char * const ch_state[] = {
78		[CH_STOPPED] = "stopped",
79		[CH_STARTING] = "starting",
80		[CH_RUNNING] = "running",
81		[CH_STOPPING] = "stopping",
82		[CH_DIED] = "died, (restarting)",
83		};
84
85		static struct vev *ev_poker;
86		static struct vev *ev_listen;
87		static struct vlu *child_std_vlu;
88
89		static struct vsb *child_panic = NULL;
90
91		static void mgt_reap_child(void);
92		static int kill_child(void);
93
94		/*=====================================================================
95		* Panic string evacuation and handling
96		*/
97
98		static void
99	508	mgt_panic_record(pid_t r)
100		{
101		char time_str[30];
102
103	508	if (child_panic != NULL)
104	0	VSB_destroy(&child_panic);
105	508	child_panic = VSB_new_auto();
106	508	AN(child_panic);
107	508	VTIM_format(VTIM_real(), time_str);
108	1016	VSB_printf(child_panic, "Child (%jd) Panic at: %s\n",
109	508	(intmax_t)r, time_str);
110	1016	VSB_quote(child_panic, heritage.panic_str,
111	508	strnlen(heritage.panic_str, heritage.panic_str_len),
112		VSB_QUOTE_NONL);
113	508	MGT_ComplainVSB(C_ERR, child_panic);
114	508	}
115
116		static void
117	440	mgt_panic_clear(void)
118		{
119	440	VSB_destroy(&child_panic);
120	440	}
121
122		static void
123	38759	cli_panic_show(struct cli cli, const char const *av, int json)
124		{
125	38759	if (!child_panic) {
126	38319	VCLI_SetResult(cli, CLIS_CANT);
127	38319	VCLI_Out(cli,
128		"Child has not panicked or panic has been cleared");
129	38319	return;
130		}
131
132	440	if (!json) {
133	280	VCLI_Out(cli, "%s\n", VSB_data(child_panic));
134	280	return;
135		}
136
137	160	VCLI_JSON_begin(cli, 2, av);
138	160	VCLI_Out(cli, ",\n");
139	160	VCLI_JSON_str(cli, VSB_data(child_panic));
140	160	VCLI_JSON_end(cli);
141	38759	}
142
143		static void v_matchproto_(cli_func_t)
144	38599	mch_cli_panic_show(struct cli cli, const char const av, void priv)
145		{
146	38599	(void)priv;
147	38599	cli_panic_show(cli, av, 0);
148	38599	}
149
150		static void v_matchproto_(cli_func_t)
151	160	mch_cli_panic_show_json(struct cli cli, const char const av, void priv)
152		{
153	160	(void)priv;
154	160	cli_panic_show(cli, av, 1);
155	160	}
156
157		static void v_matchproto_(cli_func_t)
158	560	mch_cli_panic_clear(struct cli cli, const char const av, void priv)
159		{
160	560	(void)priv;
161
162	560	if (av[2] != NULL && strcmp(av[2], "-z")) {
163	0	VCLI_SetResult(cli, CLIS_PARAM);
164	0	VCLI_Out(cli, "Unknown parameter \"%s\".", av[2]);
165	0	return;
166	80	} else if (av[2] != NULL) {
167	80	VSC_C_mgt->child_panic = 0;
168	80	if (child_panic == NULL)
169	40	return;
170	40	}
171	520	if (child_panic == NULL) {
172	80	VCLI_SetResult(cli, CLIS_CANT);
173	80	VCLI_Out(cli, "No panic to clear");
174	80	return;
175		}
176	440	mgt_panic_clear();
177	560	}
178
179		/*=====================================================================
180		* Track the highest file descriptor the parent knows is being used.
181		*
182		* This allows the child process to clean/close only a small fraction
183		* of the possible file descriptors after exec(2).
184		*
185		* This is likely to a bit on the low side, as libc and other libraries
186		* has a tendency to cache file descriptors (syslog, resolver, etc.)
187		* so we add a margin of 10 fds.
188		*
189		* For added safety, we check that we see no file descriptor open for
190		* another margin above the limit for which we close by design
191		*/
192
193		static int mgt_max_fd;
194
195		#define CLOSE_FD_UP_TO (mgt_max_fd + 10)
196		#define CHECK_FD_UP_TO (CLOSE_FD_UP_TO + 10)
197
198		void
199	400395	MCH_TrackHighFd(int fd)
200		{
201		/*
202		* Assert > 0, to catch bogus opens, we know where stdin goes
203		* in the master process.
204		*/
205	400395	assert(fd > 0);
206	400395	mgt_max_fd = vmax(mgt_max_fd, fd);
207	400395	}
208
209		/*--------------------------------------------------------------------
210		* Keep track of which filedescriptors the child should inherit and
211		* which should be closed after fork()
212		*/
213
214		void
215	239039	MCH_Fd_Inherit(int fd, const char *what)
216		{
217
218	239039	assert(fd >= 0);
219		// XXX why?
220	239039	if (fd > 0)
221	239039	MCH_TrackHighFd(fd);
222	438439	if (fd_map == NULL)
223	39639	fd_map = vbit_new(128);
224	239039	AN(fd_map);
225	239039	if (what != NULL)
226	160359	vbit_set(fd_map, fd);
227		else
228	78680	vbit_clr(fd_map, fd);
229	239039	}
230
231		/*=====================================================================
232		* Listen to stdout+stderr from the child
233		*/
234
235		static const char *whining_child = C_ERR;
236
237		static int v_matchproto_(vlu_f)
238	109126	child_line(void priv, const char p)
239		{
240	109126	(void)priv;
241
242	109126	MGT_Complain(whining_child, "Child (%jd) said %s", (intmax_t)child_pid, p);
243	109126	return (0);
244		}
245
246		/*--------------------------------------------------------------------
247		* NB: Notice cleanup call from mgt_reap_child()
248		*/
249
250		static int v_matchproto_(vev_cb_f)
251	426663	child_listener(const struct vev *e, int what)
252		{
253
254	426663	if ((what & ~VEV__RD) \|\| VLU_Fd(child_std_vlu, child_output)) {
255	360	ev_listen = NULL;
256	360	if (e != NULL)
257	360	mgt_reap_child();
258	342289	return (1);
259		}
260	84374	return (0);
261	426663	}
262
263		/*=====================================================================
264		* Periodically poke the child, to see that it still lives
265		*/
266
267		static int v_matchproto_(vev_cb_f)
268	7589	child_poker(const struct vev *e, int what)
269		{
270	7589	char *r = NULL;
271		unsigned status;
272
273	7589	(void)e;
274	7589	(void)what;
275	7589	if (child_state != CH_RUNNING)
276	0	return (1);
277	7589	if (child_pid < 0)
278	0	return (0);
279	7589	if (mgt_cli_askchild(&status, &r, "ping\n") \|\| strncmp("PONG ", r, 5)) {
280	0	MGT_Complain(C_ERR, "Unexpected reply from ping: %u %s",
281	0	status, r);
282	0	if (status != CLIS_COMMS)
283	0	MCH_Cli_Fail();
284	0	}
285	7589	free(r);
286	7589	return (0);
287	7589	}
288
289		/*=====================================================================
290		* Launch the child process
291		*/
292
293		#define mgt_launch_err(cli, status, ...) do { \
294		MGT_Complain(C_ERR, __VA_ARGS__); \
295		if (cli == NULL) \
296		break; \
297		VCLI_Out(cli, __VA_ARGS__); \
298		VCLI_SetResult(cli, status); \
299		} while (0)
300
301		static void
302	39080	mgt_launch_child(struct cli *cli)
303		{
304		pid_t pid;
305		unsigned u;
306		char *p;
307		struct vev *e;
308		int i, cp[2];
309		struct rlimit rl[1];
310		vtim_dur dstart;
311		int bstart;
312		vtim_mono t0;
313
314	39080	if (child_state != CH_STOPPED && child_state != CH_DIED)
315	0	return;
316
317	39080	child_state = CH_STARTING;
318
319		/* Open pipe for mgt->child CLI */
320	39080	AZ(socketpair(AF_UNIX, SOCK_STREAM, 0, cp));
321	39080	heritage.cli_fd = cp[0];
322	39080	assert(cp[0] > STDERR_FILENO); // See #2782
323	39080	assert(cp[1] > STDERR_FILENO);
324	39080	MCH_Fd_Inherit(heritage.cli_fd, "cli_fd");
325	39080	child_cli_fd = cp[1];
326
327		/*
328		* Open pipe for child stdout/err
329		* NB: not inherited, because we dup2() it to stdout/stderr in child
330		*/
331	39080	AZ(pipe(cp));
332	39080	heritage.std_fd = cp[1];
333	39080	child_output = cp[0];
334
335	39080	mgt_SHM_ChildNew();
336
337	39080	AN(heritage.param);
338	39080	AN(heritage.panic_str);
339	39080	VJ_master(JAIL_MASTER_SYSTEM);
340	39080	if ((pid = fork()) < 0) {
341	0	VJ_master(JAIL_MASTER_LOW);
342	0	perror("Could not fork child");
343	0	exit(1); // XXX Harsh ?
344		}
345	77387	if (pid == 0) {
346
347	38307	if (MGT_FEATURE(FEATURE_NO_COREDUMP)) {
348	639	memset(rl, 0, sizeof *rl);
349	639	rl->rlim_cur = 0;
350	639	AZ(setrlimit(RLIMIT_CORE, rl));
351	639	}
352
353		/* Redirect stdin/out/err */
354	38307	VFIL_null_fd(STDIN_FILENO);
355	38307	assert(dup2(heritage.std_fd, STDOUT_FILENO) == STDOUT_FILENO);
356	38307	assert(dup2(heritage.std_fd, STDERR_FILENO) == STDERR_FILENO);
357
358	38307	setbuf(stdout, NULL);
359	38307	setbuf(stderr, NULL);
360	38307	printf("Child starts\n");
361
362		/*
363		* Close all FDs the child shouldn't know about
364		*
365		* We cannot just close these filedescriptors, some random
366		* library routine might miss it later on and wantonly close
367		* a FD we use at that point in time. (See bug #1841).
368		* We close the FD and replace it with /dev/null instead,
369		* That prevents security leakage, and gives the library
370		* code a valid FD to close when it discovers the changed
371		* circumstances.
372		*/
373	38307	closelog();
374
375	881489	for (i = STDERR_FILENO + 1; i <= CLOSE_FD_UP_TO; i++) {
376	843182	if (vbit_test(fd_map, i))
377	115389	continue;
378	727793	if (close(i) == 0)
379	344375	VFIL_null_fd(i);
380	727793	}
381	421377	for (i = CLOSE_FD_UP_TO + 1; i <= CHECK_FD_UP_TO; i++) {
382	383070	assert(close(i) == -1);
383	383070	assert(errno == EBADF);
384	383070	}
385
386	38307	mgt_ProcTitle("Child");
387
388	38307	heritage.cls = mgt_cls;
389	38307	heritage.ident = VSB_data(vident) + 1;
390
391	38307	vext_load();
392
393	38307	STV_Init();
394
395	38307	VJ_subproc(JAIL_SUBPROC_WORKER);
396
397		/*
398		* We pass these two params because child_main needs them
399		* well before it has found its own param struct.
400		*/
401	76614	child_main(mgt_param.sigsegv_handler,
402	38307	mgt_param.wthread_stacksize);
403
404		/*
405		* It would be natural to clean VSMW up here, but it is apt
406		* to fail in some scenarios because of the fall-back
407		* "rm -rf" in mgt_SHM_ChildDestroy() which is there to
408		* catch the cases were we don't get here.
409		*/
410		// VSMW_Destroy(&heritage.proc_vsmw);
411
412	38307	exit(0);
413		}
414	39080	VJ_master(JAIL_MASTER_LOW);
415	39080	assert(pid > 1);
416	39080	MGT_Complain(C_DEBUG, "Child (%jd) Started", (intmax_t)pid);
417	39080	VSC_C_mgt->child_start++;
418
419		/* Close stuff the child got */
420	39080	closefd(&heritage.std_fd);
421
422	39080	MCH_Fd_Inherit(heritage.cli_fd, NULL);
423	39080	closefd(&heritage.cli_fd);
424
425	39080	child_std_vlu = VLU_New(child_line, NULL, 0);
426	39080	AN(child_std_vlu);
427
428		/* Wait for cache/cache_cli.c::CLI_Run() to check in */
429	39080	bstart = mgt_param.startup_timeout >= mgt_param.cli_timeout;
430	39080	dstart = bstart ? mgt_param.startup_timeout : mgt_param.cli_timeout;
431	39080	t0 = VTIM_mono();
432	39080	u = mgt_cli_start_child(child_cli_fd, dstart);
433	39080	if (u != CLIS_OK) {
434	440	assert(u == CLIS_COMMS);
435	440	if (VTIM_mono() - t0 < dstart)
436	280	mgt_launch_err(cli, u, "Child failed on launch ");
437		else
438	160	mgt_launch_err(cli, u, "Child failed on launch "
439		"within %s_timeout=%.2fs%s",
440		bstart ? "startup" : "cli", dstart,
441		bstart ? "" : " (tip: set startup_timeout)");
442	440	child_pid = pid;
443	440	(void)kill_child();
444	440	mgt_reap_child();
445	440	child_state = CH_STOPPED;
446	440	return;
447		} else {
448	38640	assert(u == CLIS_OK);
449	38640	fprintf(stderr, "Child launched OK\n");
450		}
451	38640	whining_child = C_INFO;
452
453	38640	AZ(ev_listen);
454	38640	e = VEV_Alloc();
455	38640	XXXAN(e);
456	38640	e->fd = child_output;
457	38640	e->fd_flags = VEV__RD;
458	38640	e->name = "Child listener";
459	38640	e->callback = child_listener;
460	38640	AZ(VEV_Start(mgt_evb, e));
461	38640	ev_listen = e;
462	38640	AZ(ev_poker);
463	38640	if (mgt_param.ping_interval > 0) {
464	38640	e = VEV_Alloc();
465	38640	XXXAN(e);
466	38640	e->timeout = mgt_param.ping_interval;
467	38640	e->callback = child_poker;
468	38640	e->name = "child poker";
469	38640	AZ(VEV_Start(mgt_evb, e));
470	38640	ev_poker = e;
471	38640	}
472
473	38640	child_pid = pid;
474
475	38640	if (mgt_push_vcls(cli, &u, &p)) {
476	40	mgt_launch_err(cli, u, "Child (%jd) Pushing vcls failed:\n%s",
477		(intmax_t)child_pid, p);
478	40	free(p);
479	40	MCH_Stop_Child();
480	40	return;
481		}
482
483	38600	if (mgt_cli_askchild(&u, &p, "start\n")) {
484	0	mgt_launch_err(cli, u, "Child (%jd) Acceptor start failed:\n%s",
485		(intmax_t)child_pid, p);
486	0	free(p);
487	0	MCH_Stop_Child();
488	0	return;
489		}
490
491	38600	free(p);
492	38600	child_state = CH_RUNNING;
493	39080	}
494
495		/*=====================================================================
496		* Cleanup when child dies.
497		*/
498
499		static int