Clean up kernel IPsec flows and security associations on shutdown.

Discussed with sthen@
ok patrick@

diff --git a/sbin/iked/config.c b/sbin/iked/config.c
index 7df23d8..26c63f5 100644 (file)
--- a/sbin/iked/config.c
+++ b/sbin/iked/config.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: config.c,v 1.75 2021/01/21 16:46:47 tobhe Exp $       */
+/*     $OpenBSD: config.c,v 1.76 2021/02/08 16:13:58 tobhe Exp $       */
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -531,14 +531,14 @@ config_getreset(struct iked *env, struct imsg *imsg)
        IMSG_SIZE_CHECK(imsg, &mode);
        memcpy(&mode, imsg->data, sizeof(mode));
 
-       if (mode == RESET_ALL || mode == RESET_POLICY) {
+       if (mode == RESET_EXIT || mode == RESET_ALL || mode == RESET_POLICY) {
                log_debug("%s: flushing policies", __func__);
                TAILQ_FOREACH_SAFE(pol, &env->sc_policies, pol_entry, poltmp) {
                        config_free_policy(env, pol);
                }
        }
 
-       if (mode == RESET_ALL || mode == RESET_SA) {
+       if (mode == RESET_EXIT || mode == RESET_ALL || mode == RESET_SA) {
                log_debug("%s: flushing SAs", __func__);
                while ((sa = RB_MIN(iked_sas, &env->sc_sas))) {
                        /* for RESET_SA we try send a DELETE */
@@ -552,7 +552,7 @@ config_getreset(struct iked *env, struct imsg *imsg)
                }
        }
 
-       if (mode == RESET_ALL || mode == RESET_USER) {
+       if (mode == RESET_EXIT || mode == RESET_ALL || mode == RESET_USER) {
                log_debug("%s: flushing users", __func__);
                while ((usr = RB_MIN(iked_users, &env->sc_users))) {
                        RB_REMOVE(iked_users, &env->sc_users, usr);
@@ -560,6 +560,9 @@ config_getreset(struct iked *env, struct imsg *imsg)
                }
        }
 
+       if (mode == RESET_EXIT)
+               proc_compose(&env->sc_ps, PROC_PARENT, IMSG_CTL_EXIT, NULL, 0);
+
        return (0);
 }
 

diff --git a/sbin/iked/iked.c b/sbin/iked/iked.c
index 202879b..b4a1335 100644 (file)
--- a/sbin/iked/iked.c
+++ b/sbin/iked/iked.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: iked.c,v 1.52 2020/12/17 20:43:07 tobhe Exp $ */
+/*     $OpenBSD: iked.c,v 1.53 2021/02/08 16:13:58 tobhe Exp $ */
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -43,12 +43,13 @@ void         parent_shutdown(struct iked *);
 void    parent_sig_handler(int, short, void *);
 int     parent_dispatch_ca(int, struct privsep_proc *, struct imsg *);
 int     parent_dispatch_control(int, struct privsep_proc *, struct imsg *);
+int     parent_dispatch_ikev2(int, struct privsep_proc *, struct imsg *);
 int     parent_configure(struct iked *);
 
 static struct privsep_proc procs[] = {
        { "ca",         PROC_CERT,      parent_dispatch_ca, caproc, IKED_CA },
        { "control",    PROC_CONTROL,   parent_dispatch_control, control },
-       { "ikev2",      PROC_IKEV2,     NULL, ikev2 }
+       { "ikev2",      PROC_IKEV2,     parent_dispatch_ikev2, ikev2 }
 };
 
 __dead void
@@ -341,8 +342,10 @@ parent_sig_handler(int sig, short event, void *arg)
                break;
        case SIGTERM:
        case SIGINT:
-               die = 1;
-               /* FALLTHROUGH */
+               log_info("%s: stopping iked", __func__);
+               config_setreset(ps->ps_env, RESET_EXIT, PROC_IKEV2);
+               config_setreset(ps->ps_env, RESET_ALL, PROC_CERT);
+               break;
        case SIGCHLD:
                do {
                        int len;
@@ -445,6 +448,21 @@ parent_dispatch_control(int fd, struct privsep_proc *p, struct imsg *imsg)
        return (0);
 }
 
+int
+parent_dispatch_ikev2(int fd, struct privsep_proc *p, struct imsg *imsg)
+{
+       struct iked     *env = p->p_ps->ps_env;
+
+       switch (imsg->hdr.type) {
+       case IMSG_CTL_EXIT:
+               parent_shutdown(env);
+       default:
+               return (-1);
+       }
+
+       return (0);
+}
+
 void
 parent_shutdown(struct iked *env)
 {

diff --git a/sbin/iked/types.h b/sbin/iked/types.h
index 56970db..61dcfcb 100644 (file)
--- a/sbin/iked/types.h
+++ b/sbin/iked/types.h
@@ -1,4 +1,4 @@
-/*     $OpenBSD: types.h,v 1.40 2020/09/23 14:25:55 tobhe Exp $        */
+/*     $OpenBSD: types.h,v 1.41 2021/02/08 16:13:58 tobhe Exp $        */
 
 /*
  * Copyright (c) 2019 Tobias Heider <tobias.heider@stusta.de>
@@ -100,6 +100,7 @@ enum imsg_type {
        IMSG_CTL_ACTIVE,
        IMSG_CTL_PASSIVE,
        IMSG_CTL_RESET_ID,
+       IMSG_CTL_EXIT,
        IMSG_CTL_SHOW_SA,
        IMSG_CTL_STATIC,
        IMSG_COMPILE,
@@ -135,7 +136,8 @@ enum flushmode {
        RESET_CA,
        RESET_POLICY,
        RESET_SA,
-       RESET_USER
+       RESET_USER,
+       RESET_EXIT
 };
 
 #ifndef nitems