You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

474 lines
12 KiB

nginx-util: use UCI for server configuration **tl;dr:** The functions `{add,del}_ssl` modify a server section of the UCI config if there is no `.conf` file with the same name in `/etc/nginx/conf.d/`. Then `init_lan` creates `/var/lib/nginx/uci.conf` files by copying the `/etc/nginx/uci.conf.template` and standard options from the UCI config; additionally the special path `logd` can be used in `{access,error}_log`. The init does not change the configuration beside re-creating self-signed certificates when needed. This is also the only purpose of the new `check_ssl`, which is installed as yearly cron job. **Initialization:** Invoking `nginx-util init_lan` parses the UCI configuration for package `nginx`. It creates a server part in `/var/lib/nginx/uci.conf` for each `section server '$name'` by copying all UCI options but the following: * `option uci_manage_ssl` is skipped. It is set to 'self-signed' by `nginx-util add_ssl $name`, removed by `nginx-util del_ssl $name` and used by `nginx-util check_ssl` (see below). * `logd` as path in `error_log` or `access_log` writes them to STDERR respective STDOUT, which are fowarded by Nginx's init to the log daemon. Specifically: `option error_log 'logd'` becomes `error_log stderr;` and `option access_log 'logd openwrt'` becomes `access_log /proc/self/fd/1 openwrt;` Other `[option|list] key 'value'` entries just become `key value;` directives. The init.d calls internally also `check_ssl` for rebuilding self-signed SSL certificates if needed (see below). And it still sets up `/var/lib/nginx/lan{,_ssl}.listen` files as it is doing in the current version (so they stay available). **Defaults:** The package installs the file `/etc/nginx/restrict_locally` containing allow/deny directives for restricting the access to LAN addresses by including it into a server part. The default server '_lan' includes this file and listens on all IPs (instead of only the local IPs as it did before; other servers do not need to listen explicitly on the local IPs anymore). The default server is contained together with a server that redirects HTTP requests for inexistent URLs to HTTPS in the UCI configuration file `/etc/config/nginx`. Furthermore, the packages installs a `/etc/nginx/uci.conf.template` containing the current setup and a marker, which will be replaced by the created UCI servers when calling `init_lan`. **Other:** If there is a file named `/etc/nginx/conf.d/$name.conf` the functions `init_lan`, `add_ssl $name` and `del_ssl $name` will use that file instead of a UCI server section (this is similar to the current version). Else it selects the UCI `section server $name`, or, when there is no such section, it searches for the first one having `option server_name '… $name …'`. For this section: * `nginx-util add_ssl $name` will add to it: `option uci_manage_ssl 'self-signed'` `option ssl_certificate '/etc/nginx/conf.d/$name.crt'` `option ssl_certificate_key '/etc/nginx/conf.d/$name.key'` `option ssl_session_cache 'shared:SSL:32k'` `option ssl_session_timeout '64m'` If these options are already present, they will stay the same; just the first option `uci_manage_ssl` will always be changed to 'self-signed'. The command also changes all `listen` list items to use port 443 and ssl instead of port 80 (without ssl). If they stated another port than 80 before, they are kept the same. Furthermore, it creates a self-signed SSL certificate if necessary, i.e., if there is no *valid* certificate and key at the locations given by the options `ssl_certificate` and `ssl_certificate_key`. * `nginx-util del_ssl $name` checks if `uci_manage_ssl` is set 'self-signed' in the corresponding UCI section. Only then it removes all of the above options regardless of the value looking just at the key name. Then, it also changes all `listen` list items to use port 80 (without ssl) instead of port 443 with ssl. If stating another port than 443, they are kept the same. Furthermore, it removes the SSL certificate and key that were indicated by `ssl_certificate{,_key}`. * `nginx-util check_ssl` looks through all server sections of the UCI config for `uci_manage_ssl 'self-signed'`. On every hit it checks if the SSL certificate-key-pair indicated by the options `ssl_certificate{,_key}` is expired. Then it re-creates a self-signed certificate. If there exists at least one `section server` with `uci_manage_ssl 'self-signed'`, it will try to install itself as cron job. If there are no such sections, it removes that cron job if possible. For installing a ssl certificate and key managed by another app, you can call: `nginx-util add_ssl $name $manager $crtpath $keypath` Hereby `$name` is as above, `$manager` is an arbitrary string, and the the ssl certificate and its key are indicated by their absolute path. If you want to remove the directives again, then you can use: `nginx-util del_ssl $name $manager` Signed-off-by: Peter Stadler <peter.stadler@student.uibk.ac.at>
4 years ago
  1. #ifndef _UCI_CXX_HPP
  2. #define _UCI_CXX_HPP
  3. #include <uci.h>
  4. #include <memory>
  5. #include <mutex>
  6. #include <stdexcept>
  7. #include <string>
  8. #include <string_view>
  9. namespace uci {
  10. template <class T>
  11. class iterator { // like uci_foreach_element_safe.
  12. private:
  13. const uci_ptr& _ptr;
  14. uci_element* _it = nullptr;
  15. uci_element* _next = nullptr;
  16. // wrapper for clang-tidy
  17. inline auto _list_to_element(const uci_list* cur) -> uci_element*
  18. {
  19. // NOLINTNEXTLINE(cppcoreguidelines-pro-bounds-pointer-arithmetic,cppcoreguidelines-pro-type-cstyle-cast)
  20. return list_to_element(cur); // macro casting container=pointer-offset.
  21. }
  22. public:
  23. inline explicit iterator(const uci_ptr& ptr, const uci_list* cur)
  24. : _ptr{ptr}, _it{_list_to_element(cur)}
  25. {
  26. _next = _list_to_element(_it->list.next);
  27. }
  28. inline iterator(iterator&&) noexcept = default;
  29. inline iterator(const iterator&) = delete;
  30. inline auto operator=(const iterator&) -> iterator& = delete;
  31. inline auto operator=(iterator &&) -> iterator& = delete;
  32. auto operator*() -> T
  33. {
  34. return T{_ptr, _it};
  35. }
  36. inline auto operator!=(const iterator& rhs) -> bool
  37. {
  38. return (&_it->list != &rhs._it->list);
  39. }
  40. inline auto operator++() -> iterator&
  41. {
  42. _it = _next;
  43. _next = _list_to_element(_next->list.next);
  44. return *this;
  45. }
  46. inline ~iterator() = default;
  47. };
  48. class locked_context {
  49. private:
  50. static std::mutex inuse;
  51. public:
  52. inline locked_context()
  53. {
  54. inuse.lock();
  55. }
  56. inline locked_context(locked_context&&) noexcept = default;
  57. inline locked_context(const locked_context&) = delete;
  58. inline auto operator=(const locked_context&) -> locked_context& = delete;
  59. inline auto operator=(locked_context &&) -> locked_context& = delete;
  60. // NOLINTNEXTLINE(readability-convert-member-functions-to-static)
  61. inline auto get() -> uci_context* // is member to enforce inuse
  62. {
  63. static auto free_ctx = [](uci_context* ctx) { uci_free_context(ctx); };
  64. static std::unique_ptr<uci_context, decltype(free_ctx)> lazy_ctx{uci_alloc_context(),
  65. free_ctx};
  66. if (!lazy_ctx) { // it could be available on a later call:
  67. lazy_ctx.reset(uci_alloc_context());
  68. if (!lazy_ctx) {
  69. throw std::runtime_error("uci error: cannot allocate context");
  70. }
  71. }
  72. return lazy_ctx.get();
  73. }
  74. inline ~locked_context()
  75. {
  76. inuse.unlock();
  77. }
  78. };
  79. template <class T>
  80. class element {
  81. private:
  82. uci_list* _begin = nullptr;
  83. uci_list* _end = nullptr;
  84. uci_ptr _ptr{};
  85. protected:
  86. [[nodiscard]] inline auto ptr() -> uci_ptr&
  87. {
  88. return _ptr;
  89. }
  90. [[nodiscard]] inline auto ptr() const -> const uci_ptr&
  91. {
  92. return _ptr;
  93. }
  94. void init_begin_end(uci_list* begin, uci_list* end)
  95. {
  96. _begin = begin;
  97. _end = end;
  98. }
  99. inline explicit element(const uci_ptr& pre, uci_element* last) : _ptr{pre}
  100. {
  101. _ptr.last = last;
  102. }
  103. inline explicit element() = default;
  104. public:
  105. inline element(element&&) noexcept = default;
  106. inline element(const element&) = delete;
  107. inline auto operator=(const element&) -> element& = delete;
  108. inline auto operator=(element &&) -> element& = delete;
  109. auto operator[](std::string_view key) const -> T;
  110. [[nodiscard]] inline auto name() const -> std::string
  111. {
  112. return _ptr.last->name;
  113. }
  114. void rename(const char* value) const;
  115. void commit() const;
  116. [[nodiscard]] inline auto begin() const -> iterator<T>
  117. {
  118. return iterator<T>{_ptr, _begin};
  119. }
  120. [[nodiscard]] inline auto end() const -> iterator<T>
  121. {
  122. return iterator<T>{_ptr, _end};
  123. }
  124. inline ~element() = default;
  125. };
  126. class section;
  127. class option;
  128. class item;
  129. class package : public element<section> {
  130. public:
  131. inline package(const uci_ptr& pre, uci_element* last) : element{pre, last}
  132. {
  133. // NOLINTNEXTLINE(cppcoreguidelines-pro-bounds-pointer-arithmetic,cppcoreguidelines-pro-type-cstyle-cast)
  134. ptr().p = uci_to_package(ptr().last); // macro casting pointer-offset.
  135. ptr().package = ptr().last->name;
  136. auto* end = &ptr().p->sections;
  137. auto* begin = end->next;
  138. init_begin_end(begin, end);
  139. }
  140. explicit package(const char* name);
  141. auto set(const char* key, const char* type) const -> section;
  142. };
  143. class section : public element<option> {
  144. public:
  145. inline section(const uci_ptr& pre, uci_element* last) : element{pre, last}
  146. {
  147. // NOLINTNEXTLINE(cppcoreguidelines-pro-bounds-pointer-arithmetic,cppcoreguidelines-pro-type-cstyle-cast)
  148. ptr().s = uci_to_section(ptr().last); // macro casting pointer-offset.
  149. ptr().section = ptr().last->name;
  150. auto* end = &ptr().s->options;
  151. auto* begin = end->next;
  152. init_begin_end(begin, end);
  153. }
  154. auto set(const char* key, const char* value) const -> option;
  155. void del();
  156. [[nodiscard]] inline auto anonymous() const -> bool
  157. {
  158. return ptr().s->anonymous;
  159. }
  160. [[nodiscard]] inline auto type() const -> std::string
  161. {
  162. return ptr().s->type;
  163. }
  164. };
  165. class option : public element<item> {
  166. public:
  167. inline option(const uci_ptr& pre, uci_element* last) : element{pre, last}
  168. {
  169. // NOLINTNEXTLINE(cppcoreguidelines-pro-bounds-pointer-arithmetic,cppcoreguidelines-pro-type-cstyle-cast)
  170. ptr().o = uci_to_option(ptr().last); // macro casting pointer-offset.
  171. ptr().option = ptr().last->name;
  172. if (ptr().o->type == UCI_TYPE_LIST) { // use union ptr().o->v as list:
  173. // NOLINTNEXTLINE(cppcoreguidelines-pro-type-union-access)
  174. auto* end = &ptr().o->v.list;
  175. auto* begin = end->next;
  176. init_begin_end(begin, end);
  177. }
  178. else {
  179. auto* begin = &ptr().last->list;
  180. auto* end = begin->next;
  181. init_begin_end(begin, end);
  182. }
  183. }
  184. void del();
  185. [[nodiscard]] inline auto type() const -> std::string
  186. {
  187. return (ptr().o->type == UCI_TYPE_LIST ? "list" : "option");
  188. }
  189. };
  190. class item : public element<item> {
  191. public:
  192. inline item(const uci_ptr& pre, uci_element* last) : element{pre, last}
  193. {
  194. ptr().value = ptr().last->name;
  195. }
  196. [[nodiscard]] inline auto type() const -> std::string
  197. {
  198. return (ptr().o->type == UCI_TYPE_LIST ? "list" : "option");
  199. }
  200. [[nodiscard]] inline auto name() const -> std::string
  201. {
  202. return (ptr().last->type == UCI_TYPE_ITEM
  203. ? ptr().last->name
  204. :
  205. // else: use union ptr().o->v as string:
  206. // NOLINTNEXTLINE(cppcoreguidelines-pro-type-union-access)
  207. ptr().o->v.string);
  208. }
  209. inline explicit operator bool() const
  210. {
  211. const auto x = std::string_view{name()};
  212. if (x == "0" || x == "off" || x == "false" || x == "no" || x == "disabled") {
  213. return false;
  214. }
  215. if (x == "1" || x == "on" || x == "true" || x == "yes" || x == "enabled") {
  216. return true;
  217. }
  218. auto errmsg = std::string{"uci_error: item is not bool "} + name();
  219. throw std::runtime_error(errmsg);
  220. }
  221. void rename(const char* value) const;
  222. };
  223. // ------------------------- implementation: ----------------------------------
  224. std::mutex locked_context::inuse{};
  225. inline auto uci_error(uci_context* ctx, const char* prefix = nullptr) -> std::runtime_error
  226. {
  227. char* errmsg = nullptr;
  228. uci_get_errorstr(ctx, &errmsg, prefix);
  229. std::unique_ptr<char, decltype(&std::free)> auto_free{errmsg, std::free};
  230. return std::runtime_error{errmsg};
  231. }
  232. template <class T>
  233. auto element<T>::operator[](std::string_view key) const -> T
  234. {
  235. for (auto elmt : *this) {
  236. if (elmt.name() == key) {
  237. return elmt;
  238. }
  239. }
  240. auto errmsg = std::string{"uci error: cannot find "}.append(key);
  241. throw uci_error(locked_context{}.get(), errmsg.c_str());
  242. }
  243. template <class T>
  244. void element<T>::rename(const char* value) const
  245. {
  246. if (value == name()) {
  247. return;
  248. }
  249. auto ctx = locked_context{};
  250. auto tmp_ptr = uci_ptr{_ptr};
  251. tmp_ptr.value = value;
  252. if (uci_rename(ctx.get(), &tmp_ptr) != 0) {
  253. auto errmsg = std::string{"uci error: cannot rename "}.append(name());
  254. throw uci_error(ctx.get(), errmsg.c_str());
  255. }
  256. }
  257. template <class T>
  258. void element<T>::commit() const
  259. {
  260. auto ctx = locked_context{};
  261. // TODO(pst) use when possible:
  262. // if (uci_commit(ctx.get(), &_ptr.p, true) != 0) {
  263. // auto errmsg = std::string{"uci error: cannot commit "} + _ptr.package;
  264. // throw uci_error(ctx.get(), errmsg.c_str());
  265. // }
  266. auto err = uci_save(ctx.get(), _ptr.p);
  267. if (err == 0) {
  268. uci_package* tmp_pkg = nullptr;
  269. uci_context* tmp_ctx = uci_alloc_context();
  270. err = (tmp_ctx == nullptr ? 1 : 0);
  271. if (err == 0) {
  272. err = uci_load(tmp_ctx, _ptr.package, &tmp_pkg);
  273. }
  274. if (err == 0) {
  275. err = uci_commit(tmp_ctx, &tmp_pkg, false);
  276. }
  277. if (err == 0) {
  278. err = uci_unload(tmp_ctx, tmp_pkg);
  279. }
  280. if (tmp_ctx != nullptr) {
  281. uci_free_context(tmp_ctx);
  282. }
  283. }
  284. if (err != 0) {
  285. auto errmsg = std::string{"uci error: cannot commit "} + _ptr.package;
  286. throw uci_error(ctx.get(), errmsg.c_str());
  287. }
  288. }
  289. package::package(const char* name)
  290. {
  291. auto ctx = locked_context{};
  292. auto* pkg = uci_lookup_package(ctx.get(), name);
  293. if (pkg == nullptr) {
  294. if (uci_load(ctx.get(), name, &pkg) != 0) {
  295. auto errmsg = std::string{"uci error: cannot load package "} + name;
  296. throw uci_error(ctx.get(), errmsg.c_str());
  297. }
  298. }
  299. ptr().package = name;
  300. ptr().p = pkg;
  301. ptr().last = &pkg->e;
  302. auto* end = &ptr().p->sections;
  303. auto* begin = end->next;
  304. init_begin_end(begin, end);
  305. }
  306. auto package::set(const char* key, const char* type) const -> section
  307. {
  308. auto ctx = locked_context{};
  309. auto tmp_ptr = uci_ptr{ptr()};
  310. tmp_ptr.section = key;
  311. tmp_ptr.value = type;
  312. if (uci_set(ctx.get(), &tmp_ptr) != 0) {
  313. auto errmsg = std::string{"uci error: cannot set section "} + type + "'" + key +
  314. "' in package " + name();
  315. throw uci_error(ctx.get(), errmsg.c_str());
  316. }
  317. return section{ptr(), tmp_ptr.last};
  318. }
  319. auto section::set(const char* key, const char* value) const -> option
  320. {
  321. auto ctx = locked_context{};
  322. auto tmp_ptr = uci_ptr{ptr()};
  323. tmp_ptr.option = key;
  324. tmp_ptr.value = value;
  325. if (uci_set(ctx.get(), &tmp_ptr) != 0) {
  326. auto errmsg = std::string{"uci error: cannot set option "} + key + "'" + value +
  327. "' in package " + name();
  328. throw uci_error(ctx.get(), errmsg.c_str());
  329. }
  330. return option{ptr(), tmp_ptr.last};
  331. }
  332. void section::del()
  333. {
  334. auto ctx = locked_context{};
  335. if (uci_delete(ctx.get(), &ptr()) != 0) {
  336. auto errmsg = std::string{"uci error: cannot delete section "} + name();
  337. throw uci_error(ctx.get(), errmsg.c_str());
  338. }
  339. }
  340. void option::del()
  341. {
  342. auto ctx = locked_context{};
  343. if (uci_delete(ctx.get(), &ptr()) != 0) {
  344. auto errmsg = std::string{"uci error: cannot delete option "} + name();
  345. throw uci_error(ctx.get(), errmsg.c_str());
  346. }
  347. }
  348. void item::rename(const char* value) const
  349. {
  350. if (value == name()) {
  351. return;
  352. }
  353. auto ctx = locked_context{};
  354. auto tmp_ptr = uci_ptr{ptr()};
  355. if (tmp_ptr.last->type != UCI_TYPE_ITEM) {
  356. tmp_ptr.value = value;
  357. if (uci_set(ctx.get(), &tmp_ptr) != 0) {
  358. auto errmsg = std::string{"uci error: cannot rename item "} + name();
  359. throw uci_error(ctx.get(), errmsg.c_str());
  360. }
  361. return;
  362. } // else:
  363. tmp_ptr.value = tmp_ptr.last->name;
  364. if (uci_del_list(ctx.get(), &tmp_ptr) != 0) {
  365. auto errmsg = std::string{"uci error: cannot rename (del) "} + name();
  366. throw uci_error(ctx.get(), errmsg.c_str());
  367. }
  368. tmp_ptr.value = value;
  369. if (uci_add_list(ctx.get(), &tmp_ptr) != 0) {
  370. auto errmsg = std::string{"uci error: cannot rename (add) "} + value;
  371. throw uci_error(ctx.get(), errmsg.c_str());
  372. }
  373. }
  374. } // namespace uci
  375. #endif