1 /*
2  * Copyright (c) 2010 - 2016 Reyk Floeter <reyk@openbsd.org>
3  * Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/socket.h>
20 #include <sys/wait.h>
21 
22 /* TA: FIXME */
23 #include <grp.h>
24 
25 #include <fcntl.h>
26 #include <stdio.h>
27 #include <stdlib.h>
28 #include <unistd.h>
29 #include <string.h>
30 #include <errno.h>
31 #include <signal.h>
32 #include <pwd.h>
33 #include <event.h>
34 
35 #include "proc.h"
36 
37 #include "got_compat.h"
38 
39 void	 proc_exec(struct privsep *, struct privsep_proc *, unsigned int,
40 	    int, char **);
41 void	 proc_setup(struct privsep *, struct privsep_proc *, unsigned int);
42 void	 proc_open(struct privsep *, int, int);
43 void	 proc_accept(struct privsep *, int, enum privsep_procid,
44 	    unsigned int);
45 void	 proc_close(struct privsep *);
46 int	 proc_ispeer(struct privsep_proc *, unsigned int, enum privsep_procid);
47 void	 proc_shutdown(struct privsep_proc *);
48 void	 proc_sig_handler(int, short, void *);
49 int	 proc_dispatch_null(int, struct privsep_proc *, struct imsg *);
50 
51 enum privsep_procid privsep_process;
52 
53 int
54 proc_ispeer(struct privsep_proc *procs, unsigned int nproc,
55     enum privsep_procid type)
56 {
57 	unsigned int i;
58 
59 	for (i = 0; i < nproc; i++)
60 		if (procs[i].p_id == type)
61 			return (1);
62 
63 	return (0);
64 }
65 
66 enum privsep_procid
67 proc_getid(struct privsep_proc *procs, unsigned int nproc,
68     const char *proc_name)
69 {
70 	struct privsep_proc *p;
71 	unsigned int proc;
72 
73 	for (proc = 0; proc < nproc; proc++) {
74 		p = &procs[proc];
75 		if (strcmp(p->p_title, proc_name))
76 			continue;
77 
78 		return (p->p_id);
79 	}
80 
81 	return (PROC_MAX);
82 }
83 
84 void
85 proc_exec(struct privsep *ps, struct privsep_proc *procs, unsigned int nproc,
86     int argc, char **argv)
87 {
88 	unsigned int proc, nargc, i, proc_i;
89 	char **nargv;
90 	struct privsep_proc *p;
91 	char num[32];
92 	int fd;
93 
94 	/* Prepare the new process argv. */
95 	nargv = calloc(argc + 5, sizeof(char *));
96 	if (nargv == NULL)
97 		fatal("%s: calloc", __func__);
98 
99 	/* Copy call argument first. */
100 	nargc = 0;
101 	nargv[nargc++] = argv[0];
102 
103 	/* Set process name argument and save the position. */
104 	nargv[nargc] = strdup("-P");
105 	if (nargv[nargc] == NULL)
106 		fatal("%s: strdup", __func__);
107 	nargc++;
108 	proc_i = nargc;
109 	nargc++;
110 
111 	/* Point process instance arg to stack and copy the original args. */
112 	nargv[nargc] = strdup("-I");
113 	if (nargv[nargc] == NULL)
114 		fatal("%s: strdup", __func__);
115 	nargc++;
116 	nargv[nargc++] = num;
117 	for (i = 1; i < (unsigned int) argc; i++)
118 		nargv[nargc++] = argv[i];
119 
120 	nargv[nargc] = NULL;
121 
122 	for (proc = 0; proc < nproc; proc++) {
123 		p = &procs[proc];
124 
125 		/* Update args with process title. */
126 		nargv[proc_i] = (char *)(uintptr_t)p->p_title;
127 
128 		/* Fire children processes. */
129 		for (i = 0; i < ps->ps_instances[p->p_id]; i++) {
130 			/* Update the process instance number. */
131 			snprintf(num, sizeof(num), "%u", i);
132 
133 			fd = ps->ps_pipes[p->p_id][i].pp_pipes[PROC_GOTWEBD][0];
134 			ps->ps_pipes[p->p_id][i].pp_pipes[PROC_GOTWEBD][0] = -1;
135 
136 			switch (fork()) {
137 			case -1:
138 				fatal("%s: fork", __func__);
139 				break;
140 			case 0:
141 				/* First create a new session */
142 				if (setsid() == -1)
143 					fatal("setsid");
144 
145 				/* Prepare parent socket. */
146 				if (fd != PROC_GOTWEBD_SOCK_FILENO) {
147 					if (dup2(fd, PROC_GOTWEBD_SOCK_FILENO)
148 					    == -1)
149 						fatal("dup2");
150 				} else if (fcntl(fd, F_SETFD, 0) == -1)
151 					fatal("fcntl");
152 
153 				execvp(argv[0], nargv);
154 				fatal("%s: execvp", __func__);
155 				break;
156 			default:
157 				/* Close child end. */
158 				close(fd);
159 				break;
160 			}
161 		}
162 	}
163 
164 	free(nargv);
165 }
166 
167 void
168 proc_connect(struct privsep *ps)
169 {
170 	struct imsgev *iev;
171 	unsigned int src, dst, inst;
172 
173 	/* Don't distribute any sockets if we are not really going to run. */
174 	if (ps->ps_noaction)
175 		return;
176 
177 	for (dst = 0; dst < PROC_MAX; dst++) {
178 		/* We don't communicate with ourselves. */
179 		if (dst == PROC_GOTWEBD)
180 			continue;
181 
182 		for (inst = 0; inst < ps->ps_instances[dst]; inst++) {
183 			iev = &ps->ps_ievs[dst][inst];
184 			imsg_init(&iev->ibuf, ps->ps_pp->pp_pipes[dst][inst]);
185 			event_set(&iev->ev, iev->ibuf.fd, iev->events,
186 			    iev->handler, iev->data);
187 			event_add(&iev->ev, NULL);
188 		}
189 	}
190 
191 	/* Distribute the socketpair()s for everyone. */
192 	for (src = 0; src < PROC_MAX; src++)
193 		for (dst = src; dst < PROC_MAX; dst++) {
194 			/* Parent already distributed its fds. */
195 			if (src == PROC_GOTWEBD || dst == PROC_GOTWEBD)
196 				continue;
197 
198 			proc_open(ps, src, dst);
199 		}
200 }
201 
202 void
203 proc_init(struct privsep *ps, struct privsep_proc *procs, unsigned int nproc,
204     int argc, char **argv, enum privsep_procid proc_id)
205 {
206 	struct privsep_proc *p = NULL;
207 	struct privsep_pipes *pa, *pb;
208 	unsigned int proc;
209 	unsigned int dst;
210 	int fds[2];
211 
212 	/* Don't initiate anything if we are not really going to run. */
213 	if (ps->ps_noaction)
214 		return;
215 
216 	if (proc_id == PROC_GOTWEBD) {
217 		privsep_process = PROC_GOTWEBD;
218 		proc_setup(ps, procs, nproc);
219 
220 		/*
221 		 * Create the children sockets so we can use them 
222 		 * to distribute the rest of the socketpair()s using
223 		 * proc_connect() later.
224 		 */
225 		for (dst = 0; dst < PROC_MAX; dst++) {
226 			/* Don't create socket for ourselves. */
227 			if (dst == PROC_GOTWEBD)
228 				continue;
229 
230 			for (proc = 0; proc < ps->ps_instances[dst]; proc++) {
231 				pa = &ps->ps_pipes[PROC_GOTWEBD][0];
232 				pb = &ps->ps_pipes[dst][proc];
233 				int sock_flags = SOCK_STREAM | SOCK_NONBLOCK;
234 #ifdef SOCK_CLOEXEC
235 				sock_flags |= SOCK_CLOEXEC;
236 #endif
237 				if (socketpair(AF_UNIX, sock_flags,
238 				    PF_UNSPEC, fds) == -1)
239 					fatal("%s: socketpair", __func__);
240 
241 				pa->pp_pipes[dst][proc] = fds[0];
242 				pb->pp_pipes[PROC_GOTWEBD][0] = fds[1];
243 			}
244 		}
245 
246 		/* Engage! */
247 		proc_exec(ps, procs, nproc, argc, argv);
248 		return;
249 	}
250 
251 	/* Initialize a child */
252 	for (proc = 0; proc < nproc; proc++) {
253 		if (procs[proc].p_id != proc_id)
254 			continue;
255 		p = &procs[proc];
256 		break;
257 	}
258 	if (p == NULL || p->p_init == NULL)
259 		fatalx("%s: process %d missing process initialization",
260 		    __func__, proc_id);
261 
262 	p->p_init(ps, p);
263 
264 	fatalx("failed to initiate child process");
265 }
266 
267 void
268 proc_accept(struct privsep *ps, int fd, enum privsep_procid dst,
269     unsigned int n)
270 {
271 	struct privsep_pipes *pp = ps->ps_pp;
272 	struct imsgev *iev;
273 
274 	if (ps->ps_ievs[dst] == NULL) {
275 #if DEBUG > 1
276 		log_debug("%s: %s src %d %d to dst %d %d not connected",
277 		    __func__, ps->ps_title[privsep_process],
278 		    privsep_process, ps->ps_instance + 1,
279 		    dst, n + 1);
280 #endif
281 		close(fd);
282 		return;
283 	}
284 
285 	if (pp->pp_pipes[dst][n] != -1) {
286 		log_warnx("%s: duplicated descriptor", __func__);
287 		close(fd);
288 		return;
289 	} else
290 		pp->pp_pipes[dst][n] = fd;
291 
292 	iev = &ps->ps_ievs[dst][n];
293 	imsg_init(&iev->ibuf, fd);
294 	event_set(&iev->ev, iev->ibuf.fd, iev->events, iev->handler, iev->data);
295 	event_add(&iev->ev, NULL);
296 }
297 
298 void
299 proc_setup(struct privsep *ps, struct privsep_proc *procs, unsigned int nproc)
300 {
301 	unsigned int i, j, src, dst, id;
302 	struct privsep_pipes *pp;
303 
304 	/* Initialize parent title, ps_instances and procs. */
305 	ps->ps_title[PROC_GOTWEBD] = "parent";
306 
307 	for (src = 0; src < PROC_MAX; src++)
308 		/* Default to 1 process instance */
309 		if (ps->ps_instances[src] < 1)
310 			ps->ps_instances[src] = 1;
311 
312 	for (src = 0; src < nproc; src++) {
313 		procs[src].p_ps = ps;
314 		if (procs[src].p_cb == NULL)
315 			procs[src].p_cb = proc_dispatch_null;
316 
317 		id = procs[src].p_id;
318 		ps->ps_title[id] = procs[src].p_title;
319 		ps->ps_ievs[id] = calloc(ps->ps_instances[id],
320 		    sizeof(struct imsgev));
321 		if (ps->ps_ievs[id] == NULL)
322 			fatal("%s: calloc", __func__);
323 
324 		/* With this set up, we are ready to call imsg_init(). */
325 		for (i = 0; i < ps->ps_instances[id]; i++) {
326 			ps->ps_ievs[id][i].handler = proc_dispatch;
327 			ps->ps_ievs[id][i].events = EV_READ;
328 			ps->ps_ievs[id][i].proc = &procs[src];
329 			ps->ps_ievs[id][i].data = &ps->ps_ievs[id][i];
330 		}
331 	}
332 
333 	/*
334 	 * Allocate pipes for all process instances (incl. parent)
335 	 *
336 	 * - ps->ps_pipes: N:M mapping
337 	 * N source processes connected to M destination processes:
338 	 * [src][instances][dst][instances], for example
339 	 * [PROC_RELAY][3][PROC_CA][3]
340 	 *
341 	 * - ps->ps_pp: per-process 1:M part of ps->ps_pipes
342 	 * Each process instance has a destination array of socketpair fds:
343 	 * [dst][instances], for example
344 	 * [PROC_GOTWEBD][0]
345 	 */
346 	for (src = 0; src < PROC_MAX; src++) {
347 		/* Allocate destination array for each process */
348 		ps->ps_pipes[src] = calloc(ps->ps_instances[src],
349 		    sizeof(struct privsep_pipes));
350 		if (ps->ps_pipes[src] == NULL)
351 			fatal("%s: calloc", __func__);
352 
353 		for (i = 0; i < ps->ps_instances[src]; i++) {
354 			pp = &ps->ps_pipes[src][i];
355 
356 			for (dst = 0; dst < PROC_MAX; dst++) {
357 				/* Allocate maximum fd integers */
358 				pp->pp_pipes[dst] =
359 				    calloc(ps->ps_instances[dst],
360 				    sizeof(int));
361 				if (pp->pp_pipes[dst] == NULL)
362 					fatal("%s: calloc", __func__);
363 
364 				/* Mark fd as unused */
365 				for (j = 0; j < ps->ps_instances[dst]; j++)
366 					pp->pp_pipes[dst][j] = -1;
367 			}
368 		}
369 	}
370 
371 	ps->ps_pp = &ps->ps_pipes[privsep_process][ps->ps_instance];
372 }
373 
374 void
375 proc_kill(struct privsep *ps)
376 {
377 	char *cause;
378 	pid_t pid;
379 	int len, status;
380 
381 	if (privsep_process != PROC_GOTWEBD)
382 		return;
383 
384 	proc_close(ps);
385 
386 	do {
387 		pid = waitpid(WAIT_ANY, &status, 0);
388 		if (pid <= 0)
389 			continue;
390 
391 		if (WIFSIGNALED(status)) {
392 			len = asprintf(&cause, "terminated; signal %d",
393 			    WTERMSIG(status));
394 		} else if (WIFEXITED(status)) {
395 			if (WEXITSTATUS(status) != 0)
396 				len = asprintf(&cause, "exited abnormally");
397 			else
398 				len = 0;
399 		} else
400 			len = -1;
401 
402 		if (len == 0) {
403 			/* child exited OK, don't print a warning message */
404 		} else if (len != -1) {
405 			log_warnx("lost child: pid %u %s", pid, cause);
406 			free(cause);
407 		} else
408 			log_warnx("lost child: pid %u", pid);
409 	} while (pid != -1 || (pid == -1 && errno == EINTR));
410 }
411 
412 void
413 proc_open(struct privsep *ps, int src, int dst)
414 {
415 	struct privsep_pipes *pa, *pb;
416 	struct privsep_fd pf;
417 	int fds[2];
418 	unsigned int i, j;
419 
420 	/* Exchange pipes between process. */
421 	for (i = 0; i < ps->ps_instances[src]; i++) {
422 		for (j = 0; j < ps->ps_instances[dst]; j++) {
423 			/* Don't create sockets for ourself. */
424 			if (src == dst && i == j)
425 				continue;
426 
427 			pa = &ps->ps_pipes[src][i];
428 			pb = &ps->ps_pipes[dst][j];
429 			int sock_flags = SOCK_STREAM | SOCK_NONBLOCK;
430 #ifdef SOCK_CLOEXEC
431 			sock_flags |= SOCK_CLOEXEC;
432 #endif
433 			if (socketpair(AF_UNIX, sock_flags,
434 			    PF_UNSPEC, fds) == -1)
435 				fatal("%s: socketpair", __func__);
436 
437 			pa->pp_pipes[dst][j] = fds[0];
438 			pb->pp_pipes[src][i] = fds[1];
439 
440 			pf.pf_procid = src;
441 			pf.pf_instance = i;
442 			if (proc_compose_imsg(ps, dst, j, IMSG_CTL_PROCFD,
443 			    -1, pb->pp_pipes[src][i], &pf, sizeof(pf)) == -1)
444 				fatal("%s: proc_compose_imsg", __func__);
445 
446 			pf.pf_procid = dst;
447 			pf.pf_instance = j;
448 			if (proc_compose_imsg(ps, src, i, IMSG_CTL_PROCFD,
449 			    -1, pa->pp_pipes[dst][j], &pf, sizeof(pf)) == -1)
450 				fatal("%s: proc_compose_imsg", __func__);
451 
452 			/*
453 			 * We have to flush to send the descriptors and close
454 			 * them to avoid the fd ramp on startup.
455 			 */
456 			if (proc_flush_imsg(ps, src, i) == -1 ||
457 			    proc_flush_imsg(ps, dst, j) == -1)
458 				fatal("%s: imsg_flush", __func__);
459 		}
460 	}
461 }
462 
463 void
464 proc_close(struct privsep *ps)
465 {
466 	unsigned int dst, n;
467 	struct privsep_pipes *pp;
468 
469 	if (ps == NULL)
470 		return;
471 
472 	pp = ps->ps_pp;
473 
474 	for (dst = 0; dst < PROC_MAX; dst++) {
475 		if (ps->ps_ievs[dst] == NULL)
476 			continue;
477 
478 		for (n = 0; n < ps->ps_instances[dst]; n++) {
479 			if (pp->pp_pipes[dst][n] == -1)
480 				continue;
481 
482 			/* Cancel the fd, close and invalidate the fd */
483 			event_del(&(ps->ps_ievs[dst][n].ev));
484 			imsg_clear(&(ps->ps_ievs[dst][n].ibuf));
485 			close(pp->pp_pipes[dst][n]);
486 			pp->pp_pipes[dst][n] = -1;
487 		}
488 		free(ps->ps_ievs[dst]);
489 	}
490 }
491 
492 void
493 proc_shutdown(struct privsep_proc *p)
494 {
495 	struct privsep *ps = p->p_ps;
496 
497 	if (p->p_shutdown != NULL)
498 		(*p->p_shutdown)();
499 
500 	proc_close(ps);
501 
502 	log_info("%s, %s exiting, pid %d", getprogname(), p->p_title, getpid());
503 
504 	exit(0);
505 }
506 
507 void
508 proc_sig_handler(int sig, short event, void *arg)
509 {
510 	struct privsep_proc *p = arg;
511 
512 	switch (sig) {
513 	case SIGINT:
514 	case SIGTERM:
515 		proc_shutdown(p);
516 		break;
517 	case SIGCHLD:
518 	case SIGHUP:
519 	case SIGPIPE:
520 	case SIGUSR1:
521 		/* ignore */
522 		break;
523 	default:
524 		fatalx("proc_sig_handler: unexpected signal");
525 		/* NOTREACHED */
526 	}
527 }
528 
529 void
530 proc_run(struct privsep *ps, struct privsep_proc *p,
531     struct privsep_proc *procs, unsigned int nproc,
532     void (*run)(struct privsep *, struct privsep_proc *, void *), void *arg)
533 {
534 	struct passwd *pw;
535 	const char *root;
536 
537 	log_procinit(p->p_title);
538 
539 	/* Set the process group of the current process */
540 	setpgid(0, 0);
541 
542 	/* Use non-standard user */
543 	if (p->p_pw != NULL)
544 		pw = p->p_pw;
545 	else
546 		pw = ps->ps_pw;
547 
548 	/* Change root directory */
549 	if (p->p_chroot != NULL)
550 		root = p->p_chroot;
551 	else
552 		root = pw->pw_dir;
553 
554 	if (chroot(root) == -1)
555 		fatal("proc_run: chroot");
556 	if (chdir("/") == -1)
557 		fatal("proc_run: chdir(\"/\")");
558 
559 	privsep_process = p->p_id;
560 
561 	setproctitle("%s", p->p_title);
562 
563 	if (setgroups(1, &pw->pw_gid) ||
564 	    setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
565 	    setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))
566 		fatal("proc_run: cannot drop privileges");
567 
568 	event_init();
569 
570 	signal_set(&ps->ps_evsigint, SIGINT, proc_sig_handler, p);
571 	signal_set(&ps->ps_evsigterm, SIGTERM, proc_sig_handler, p);
572 	signal_set(&ps->ps_evsigchld, SIGCHLD, proc_sig_handler, p);
573 	signal_set(&ps->ps_evsighup, SIGHUP, proc_sig_handler, p);
574 	signal_set(&ps->ps_evsigpipe, SIGPIPE, proc_sig_handler, p);
575 	signal_set(&ps->ps_evsigusr1, SIGUSR1, proc_sig_handler, p);
576 
577 	signal_add(&ps->ps_evsigint, NULL);
578 	signal_add(&ps->ps_evsigterm, NULL);
579 	signal_add(&ps->ps_evsigchld, NULL);
580 	signal_add(&ps->ps_evsighup, NULL);
581 	signal_add(&ps->ps_evsigpipe, NULL);
582 	signal_add(&ps->ps_evsigusr1, NULL);
583 
584 	proc_setup(ps, procs, nproc);
585 	proc_accept(ps, PROC_GOTWEBD_SOCK_FILENO, PROC_GOTWEBD, 0);
586 
587 	DPRINTF("%s: %s %d/%d, pid %d", __func__, p->p_title,
588 	    ps->ps_instance + 1, ps->ps_instances[p->p_id], getpid());
589 
590 	if (run != NULL)
591 		run(ps, p, arg);
592 
593 	event_dispatch();
594 
595 	proc_shutdown(p);
596 }
597 
598 void
599 proc_dispatch(int fd, short event, void *arg)
600 {
601 	struct imsgev *iev = arg;
602 	struct privsep_proc *p = iev->proc;
603 	struct privsep *ps = p->p_ps;
604 	struct imsgbuf *ibuf;
605 	struct imsg imsg;
606 	ssize_t n;
607 	int verbose;
608 	const char *title;
609 	struct privsep_fd pf;
610 
611 	title = ps->ps_title[privsep_process];
612 	ibuf = &iev->ibuf;
613 
614 	if (event & EV_READ) {
615 		n = imsg_read(ibuf);
616 		if (n == -1 && errno != EAGAIN)
617 			fatal("%s: imsg_read", __func__);
618 		if (n == 0) {
619 			/* this pipe is dead, so remove the event handler */
620 			event_del(&iev->ev);
621 			event_loopexit(NULL);
622 			return;
623 		}
624 	}
625 
626 	if (event & EV_WRITE) {
627 		n = msgbuf_write(&ibuf->w);
628 		if (n == -1 && errno != EAGAIN)
629 			fatal("%s: msgbuf_write", __func__);
630 		if (n == 0) {
631 			/* this pipe is dead, so remove the event handler */
632 			event_del(&iev->ev);
633 			event_loopexit(NULL);
634 			return;
635 		}
636 	}
637 
638 	for (;;) {
639 		n = imsg_get(ibuf, &imsg);
640 		if (n == -1)
641 			fatal("%s: imsg_get", __func__);
642 		if (n == 0)
643 			break;
644 
645 #if DEBUG > 1
646 		log_debug("%s: %s %d got imsg %d peerid %d from %s %d",
647 		    __func__, title, ps->ps_instance + 1,
648 		    imsg.hdr.type, imsg.hdr.peerid, p->p_title, imsg.hdr.pid);
649 #endif
650 
651 		/*
652 		 * Check the message with the program callback
653 		 */
654 		if ((p->p_cb)(fd, p, &imsg) == 0) {
655 			/* Message was handled by the callback, continue */
656 			imsg_free(&imsg);
657 			continue;
658 		}
659 
660 		/*
661 		 * Generic message handling
662 		 */
663 		switch (imsg.hdr.type) {
664 		case IMSG_CTL_VERBOSE:
665 			log_info("%s", __func__);
666 			IMSG_SIZE_CHECK(&imsg, &verbose);
667 			memcpy(&verbose, imsg.data, sizeof(verbose));
668 			log_setverbose(verbose);
669 			break;
670 		case IMSG_CTL_PROCFD:
671 			IMSG_SIZE_CHECK(&imsg, &pf);
672 			memcpy(&pf, imsg.data, sizeof(pf));
673 			proc_accept(ps, imsg.fd, pf.pf_procid,
674 			    pf.pf_instance);
675 			break;
676 		default:
677 			log_warnx("%s: %s %d got invalid imsg %d peerid %d "
678 			    "from %s %d",
679 			    __func__, title, ps->ps_instance + 1,
680 			    imsg.hdr.type, imsg.hdr.peerid,
681 			    p->p_title, imsg.hdr.pid);
682 		}
683 		imsg_free(&imsg);
684 	}
685 	imsg_event_add(iev);
686 }
687 
688 int
689 proc_dispatch_null(int fd, struct privsep_proc *p, struct imsg *imsg)
690 {
691 	return (-1);
692 }
693 
694 /*
695  * imsg helper functions
696  */
697 
698 void
699 imsg_event_add(struct imsgev *iev)
700 {
701 	if (iev->handler == NULL) {
702 		imsg_flush(&iev->ibuf);
703 		return;
704 	}
705 
706 	iev->events = EV_READ;
707 	if (iev->ibuf.w.queued)
708 		iev->events |= EV_WRITE;
709 
710 	event_del(&iev->ev);
711 	event_set(&iev->ev, iev->ibuf.fd, iev->events, iev->handler, iev->data);
712 	event_add(&iev->ev, NULL);
713 }
714 
715 int
716 imsg_compose_event(struct imsgev *iev, uint16_t type, uint32_t peerid,
717     pid_t pid, int fd, void *data, uint16_t datalen)
718 {
719 	int ret;
720 
721 	ret = imsg_compose(&iev->ibuf, type, peerid, pid, fd, data, datalen);
722 	if (ret == -1)
723 		return (ret);
724 	imsg_event_add(iev);
725 	return (ret);
726 }
727 
728 int
729 imsg_composev_event(struct imsgev *iev, uint16_t type, uint32_t peerid,
730     pid_t pid, int fd, const struct iovec *iov, int iovcnt)
731 {
732 	int ret;
733 
734 	ret = imsg_composev(&iev->ibuf, type, peerid, pid, fd, iov, iovcnt);
735 	if (ret == -1)
736 		return (ret);
737 	imsg_event_add(iev);
738 	return (ret);
739 }
740 
741 void
742 proc_range(struct privsep *ps, enum privsep_procid id, int *n, int *m)
743 {
744 	if (*n == -1) {
745 		/* Use a range of all target instances */
746 		*n = 0;
747 		*m = ps->ps_instances[id];
748 	} else {
749 		/* Use only a single slot of the specified peer process */
750 		*m = *n + 1;
751 	}
752 }
753 
754 int
755 proc_compose_imsg(struct privsep *ps, enum privsep_procid id, int n,
756     uint16_t type, uint32_t peerid, int fd, void *data, uint16_t datalen)
757 {
758 	int m;
759 
760 	proc_range(ps, id, &n, &m);
761 	for (; n < m; n++) {
762 		if (imsg_compose_event(&ps->ps_ievs[id][n],
763 		    type, peerid, ps->ps_instance + 1, fd, data, datalen) == -1)
764 			return (-1);
765 	}
766 
767 	return (0);
768 }
769 
770 int
771 proc_compose(struct privsep *ps, enum privsep_procid id,
772     uint16_t type, void *data, uint16_t datalen)
773 {
774 	return (proc_compose_imsg(ps, id, -1, type, -1, -1, data, datalen));
775 }
776 
777 int
778 proc_composev_imsg(struct privsep *ps, enum privsep_procid id, int n,
779     uint16_t type, uint32_t peerid, int fd, const struct iovec *iov, int iovcnt)
780 {
781 	int m;
782 
783 	proc_range(ps, id, &n, &m);
784 	for (; n < m; n++)
785 		if (imsg_composev_event(&ps->ps_ievs[id][n],
786 		    type, peerid, ps->ps_instance + 1, fd, iov, iovcnt) == -1)
787 			return (-1);
788 
789 	return (0);
790 }
791 
792 int
793 proc_composev(struct privsep *ps, enum privsep_procid id,
794     uint16_t type, const struct iovec *iov, int iovcnt)
795 {
796 	return (proc_composev_imsg(ps, id, -1, type, -1, -1, iov, iovcnt));
797 }
798 
799 int
800 proc_forward_imsg(struct privsep *ps, struct imsg *imsg,
801     enum privsep_procid id, int n)
802 {
803 	return (proc_compose_imsg(ps, id, n, imsg->hdr.type,
804 	    imsg->hdr.peerid, imsg->fd, imsg->data, IMSG_DATA_SIZE(imsg)));
805 }
806 
807 struct imsgbuf *
808 proc_ibuf(struct privsep *ps, enum privsep_procid id, int n)
809 {
810 	int m;
811 
812 	proc_range(ps, id, &n, &m);
813 	return (&ps->ps_ievs[id][n].ibuf);
814 }
815 
816 struct imsgev *
817 proc_iev(struct privsep *ps, enum privsep_procid id, int n)
818 {
819 	int m;
820 
821 	proc_range(ps, id, &n, &m);
822 	return (&ps->ps_ievs[id][n]);
823 }
824 
825 /* This function should only be called with care as it breaks async I/O */
826 int
827 proc_flush_imsg(struct privsep *ps, enum privsep_procid id, int n)
828 {
829 	struct imsgbuf *ibuf;
830 	int m, ret = 0;
831 
832 	proc_range(ps, id, &n, &m);
833 	for (; n < m; n++) {
834 		ibuf = proc_ibuf(ps, id, n);
835 		if (ibuf == NULL)
836 			return (-1);
837 		do {
838 			ret = imsg_flush(ibuf);
839 		} while (ret == -1 && errno == EAGAIN);
840 		if (ret == -1)
841 			break;
842 		imsg_event_add(&ps->ps_ievs[id][n]);
843 	}
844 
845 	return (ret);
846 }