/usr/src/usr.sbin/relayd/relay.c

Bug Summary

File:	src/usr.sbin/relayd/relay.c
Warning:	line 1635, column 3 Use of memory after it is freed
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name relay.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/relayd/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.sbin/relayd -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/relayd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/relayd/relay.c
1/*	$OpenBSD: relay.c,v 1.254 2021/03/24 20:59:53 benno Exp $	*/

3/*
* Copyright (c) 2006 - 2014 Reyk Floeter <reyk@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

19#include <sys/types.h>
20#include <sys/queue.h>
21#include <sys/time.h>
22#include <sys/socket.h>
23#include <sys/tree.h>

25#include <netinet/in.h>
26#include <netinet/tcp.h>
27#include <arpa/inet.h>

29#include <limits.h>
30#include <netdb.h>
31#include <poll.h>
32#include <stdio.h>
33#include <stdlib.h>
34#include <errno(*__errno()).h>
35#include <fcntl.h>
36#include <string.h>
37#include <unistd.h>
38#include <event.h>
39#include <siphash.h>
40#include <imsg.h>

42#include <tls.h>

44#include "relayd.h"

46#define MINIMUM(a, b)(((a) < (b)) ? (a) : (b))	(((a) < (b)) ? (a) : (b))

48void		 relay_statistics(int, short, void *);
49int		 relay_dispatch_parent(int, struct privsep_proc *,
    struct imsg *);
51int		 relay_dispatch_pfe(int, struct privsep_proc *,
    struct imsg *);
53int		 relay_dispatch_ca(int, struct privsep_proc *,
    struct imsg *);
55int		 relay_dispatch_hce(int, struct privsep_proc *,
    struct imsg *);
57void		 relay_shutdown(void);

59void		 relay_protodebug(struct relay *);
60void		 relay_ruledebug(struct relay_rule *);
61void		 relay_init(struct privsep *, struct privsep_proc *p, void *);
62void		 relay_launch(void);
63int		 relay_socket(struct sockaddr_storage *, in_port_t,
    struct protocol *, int, int);
65int		 relay_socket_listen(struct sockaddr_storage *, in_port_t,
    struct protocol *);
67int		 relay_socket_connect(struct sockaddr_storage *, in_port_t,
    struct protocol *, int);

70void		 relay_accept(int, short, void *);
71void		 relay_input(struct rsession *);

73void		 relay_hash_addr(SIPHASH_CTX *, struct sockaddr_storage *, int);

75int		 relay_tls_ctx_create(struct relay *);
76void		 relay_tls_transaction(struct rsession *,
    struct ctl_relay_event *);
78void		 relay_tls_handshake(int, short, void *);
79void		 relay_tls_connected(struct ctl_relay_event *);
80void		 relay_tls_readcb(int, short, void *);
81void		 relay_tls_writecb(int, short, void *);

83void		 relay_connect_retry(int, short, void *);
84void		 relay_connect_state(struct rsession *,
    struct ctl_relay_event *, enum relay_state);

87extern void	 bufferevent_read_pressure_cb(struct evbuffer *, size_t,
    size_t, void *);

90volatile int relay_sessions;
91volatile int relay_inflight = 0;
92objid_t relay_conid;

94static struct relayd		*env = NULL((void*)0);

96static struct privsep_proc procs[] = {
{ "parent",	PROC_PARENT,	relay_dispatch_parent },
{ "pfe",	PROC_PFE,	relay_dispatch_pfe },
{ "ca",		PROC_CA,	relay_dispatch_ca },
{ "hce",	PROC_HCE,	relay_dispatch_hce },
101};

103void
104relay(struct privsep *ps, struct privsep_proc *p)
105{
env = ps->ps_env;
proc_run(ps, p, procs, nitems(procs)(sizeof((procs)) / sizeof((procs)[0])), relay_init, NULL((void*)0));
relay_http(env);
109}

111void
112relay_shutdown(void)
113{
config_purge(env, CONFIG_ALL0xff);
usleep(200);	/* XXX relay needs to shutdown last */
116}

118void
119relay_ruledebug(struct relay_rule *rule)
120{
struct kv	*kv = NULL((void*)0);
u_int		 i;
char		 buf[NI_MAXHOST256];

fprintf(stderr(&__sF[2]), "\t\t");

switch (rule->rule_action) {
case RULE_ACTION_MATCH:
fprintf(stderr(&__sF[2]), "match ");
break;
case RULE_ACTION_BLOCK:
fprintf(stderr(&__sF[2]), "block ");
break;
case RULE_ACTION_PASS:
fprintf(stderr(&__sF[2]), "pass ");
break;
}

switch (rule->rule_dir) {
case RELAY_DIR_ANY:
break;
case RELAY_DIR_REQUEST:
fprintf(stderr(&__sF[2]), "request ");
break;
case RELAY_DIR_RESPONSE:
fprintf(stderr(&__sF[2]), "response ");
break;
default:
return;
/* NOTREACHED */
break;
}

if (rule->rule_flags & RULE_FLAG_QUICK0x01)
fprintf(stderr(&__sF[2]), "quick ");

switch (rule->rule_af) {
case AF_INET2:
fprintf(stderr(&__sF[2]), "inet ");
break;
case AF_INET624:
fprintf(stderr(&__sF[2]), "inet6 ");
break;
}

if (rule->rule_src.addr.ss_family != AF_UNSPEC0)
fprintf(stderr(&__sF[2]), "from %s/%d ",
    print_host(&rule->rule_src.addr, buf, sizeof(buf)),
    rule->rule_src.addr_mask);

if (rule->rule_dst.addr.ss_family != AF_UNSPEC0)
fprintf(stderr(&__sF[2]), "to %s/%d ",
    print_host(&rule->rule_dst.addr, buf, sizeof(buf)),
    rule->rule_dst.addr_mask);

for (i = 1; i < KEY_TYPE_MAX; i++) {
kv = &rule->rule_kv[i];
if (kv->kv_type != i)
	continue;

switch (kv->kv_type) {
case KEY_TYPE_COOKIE:
	fprintf(stderr(&__sF[2]), "cookie ");
	break;
case KEY_TYPE_HEADER:
	fprintf(stderr(&__sF[2]), "header ");
	break;
case KEY_TYPE_PATH:
	fprintf(stderr(&__sF[2]), "path ");
	break;
case KEY_TYPE_QUERY:
	fprintf(stderr(&__sF[2]), "query ");
	break;
case KEY_TYPE_URL:
	fprintf(stderr(&__sF[2]), "url ");
	break;
default:
	continue;
}

switch (kv->kv_option) {
case KEY_OPTION_APPEND:
	fprintf(stderr(&__sF[2]), "append ");
	break;
case KEY_OPTION_SET:
	fprintf(stderr(&__sF[2]), "set ");
	break;
case KEY_OPTION_REMOVE:
	fprintf(stderr(&__sF[2]), "remove ");
	break;
case KEY_OPTION_HASH:
	fprintf(stderr(&__sF[2]), "hash ");
	break;
case KEY_OPTION_LOG:
	fprintf(stderr(&__sF[2]), "log ");
	break;
case KEY_OPTION_STRIP:
	fprintf(stderr(&__sF[2]), "strip ");
	break;
case KEY_OPTION_NONE:
	break;
}

switch (kv->kv_digest) {
case DIGEST_SHA1:
case DIGEST_MD5:
	fprintf(stderr(&__sF[2]), "digest ");
	break;
default:
	break;
}

int kvv = (kv->kv_option == KEY_OPTION_STRIP ||
     kv->kv_value == NULL((void*)0));
fprintf(stderr(&__sF[2]), "%s%s%s%s%s%s ",
    kv->kv_key == NULL((void*)0) ? "" : "\"",
    kv->kv_key == NULL((void*)0) ? "" : kv->kv_key,
    kv->kv_key == NULL((void*)0) ? "" : "\"",
    kvv ? "" : " value \"",
    kv->kv_value == NULL((void*)0) ? "" : kv->kv_value,
    kvv ? "" : "\"");
}

if (rule->rule_tablename[0])
fprintf(stderr(&__sF[2]), "forward to <%s> ", rule->rule_tablename);

if (rule->rule_tag == -1)
fprintf(stderr(&__sF[2]), "no tag ");
else if (rule->rule_tag && rule->rule_tagname[0])
fprintf(stderr(&__sF[2]), "tag \"%s\" ",
    rule->rule_tagname);

if (rule->rule_tagged && rule->rule_taggedname[0])
fprintf(stderr(&__sF[2]), "tagged \"%s\" ",
    rule->rule_taggedname);

if (rule->rule_label == -1)
fprintf(stderr(&__sF[2]), "no label ");
else if (rule->rule_label && rule->rule_labelname[0])
fprintf(stderr(&__sF[2]), "label \"%s\" ",
    rule->rule_labelname);

fprintf(stderr(&__sF[2]), "\n");
264}

266void
267relay_protodebug(struct relay *rlay)
268{
struct protocol		*proto = rlay->rl_proto;
struct relay_rule	*rule = NULL((void*)0);

fprintf(stderr(&__sF[2]), "protocol %d: name %s\n",
   proto->id, proto->name);
fprintf(stderr(&__sF[2]), "\tflags: %s, relay flags: %s\n",
   printb_flags(proto->flags, F_BITS"\10\01DISABLE\02BACKUP\03USED\04DOWN\05ADD\06DEL\07CHANGED" "\10STICKY-ADDRESS\11CHECK_DONE\12ACTIVE_RULESET\13CHECK_SENT"
 "\14TLS\15NAT_LOOKUP\16DEMOTE\17LOOKUP_PATH\20DEMOTED\21UDP"
 "\22RETURN\23TRAP\24NEEDPF\25PORT\26TLS_CLIENT\27NEEDRT" "\30MATCH\31DIVERT\32SCRIPT\33TLS_INSPECT\34HASHKEY"
 "\35AGENTX_TRAPONLY"),
   printb_flags(rlay->rl_conf.flags, F_BITS"\10\01DISABLE\02BACKUP\03USED\04DOWN\05ADD\06DEL\07CHANGED" "\10STICKY-ADDRESS\11CHECK_DONE\12ACTIVE_RULESET\13CHECK_SENT"
 "\14TLS\15NAT_LOOKUP\16DEMOTE\17LOOKUP_PATH\20DEMOTED\21UDP"
 "\22RETURN\23TRAP\24NEEDPF\25PORT\26TLS_CLIENT\27NEEDRT" "\30MATCH\31DIVERT\32SCRIPT\33TLS_INSPECT\34HASHKEY"
 "\35AGENTX_TRAPONLY"));
if (proto->tcpflags)
fprintf(stderr(&__sF[2]), "\ttcp flags: %s\n",
    printb_flags(proto->tcpflags, TCPFLAG_BITS"\10\01NODELAY\02NO_NODELAY\03SACK\04NO_SACK" "\05SOCKET_BUFFER_SIZE\06IP_TTL\07IP_MINTTL\10NO_SPLICE"));
if ((rlay->rl_conf.flags & (F_TLS0x00000800|F_TLSCLIENT0x00200000)) && proto->tlsflags)
fprintf(stderr(&__sF[2]), "\ttls flags: %s\n",
    printb_flags(proto->tlsflags, TLSFLAG_BITS"\06\01sslv3\02tlsv1.0\03tlsv1.1\04tlsv1.2\05tlsv1.3" "\06cipher-server-preference\07client-renegotiation"));
fprintf(stderr(&__sF[2]), "\ttls session tickets: %s\n",
   (proto->tickets == 1) ? "enabled" : "disabled");
fprintf(stderr(&__sF[2]), "\ttype: ");
switch (proto->type) {
case RELAY_PROTO_TCP:
fprintf(stderr(&__sF[2]), "tcp\n");
break;
case RELAY_PROTO_HTTP:
fprintf(stderr(&__sF[2]), "http\n");
break;
case RELAY_PROTO_DNS:
fprintf(stderr(&__sF[2]), "dns\n");
break;
}

rule = TAILQ_FIRST(&proto->rules)((&proto->rules)->tqh_first);
while (rule != NULL((void*)0)) {
relay_ruledebug(rule);
rule = TAILQ_NEXT(rule, rule_entry)((rule)->rule_entry.tqe_next);
}
303}

305int
306relay_privinit(struct relay *rlay)
307{
log_debug("%s: adding relay %s", __func__, rlay->rl_conf.name);

if (log_getverbose() > 1)
relay_protodebug(rlay);

switch (rlay->rl_proto->type) {
case RELAY_PROTO_DNS:
relay_udp_privinit(rlay);
break;
case RELAY_PROTO_TCP:
break;
case RELAY_PROTO_HTTP:
break;
}

if (rlay->rl_conf.flags & F_UDP0x00010000)
rlay->rl_s = relay_udp_bind(&rlay->rl_conf.ss,
    rlay->rl_conf.port, rlay->rl_proto);
else
rlay->rl_s = relay_socket_listen(&rlay->rl_conf.ss,
    rlay->rl_conf.port, rlay->rl_proto);
if (rlay->rl_s == -1)
return (-1);

return (0);
333}

335void
336relay_init(struct privsep *ps, struct privsep_proc *p, void *arg)
337{
struct timeval	 tv;

if (config_init(ps->ps_env) == -1)
fatal("failed to initialize configuration");

/* We use a custom shutdown callback */
p->p_shutdown = relay_shutdown;

/* Unlimited file descriptors (use system limits) */
socket_rlimit(-1);

if (pledge("stdio recvfd inet", NULL((void*)0)) == -1)
fatal("pledge");

/* Schedule statistics timer */
evtimer_set(&env->sc_statev, relay_statistics, ps)event_set(&env->sc_statev, -1, 0, relay_statistics, ps
);
bcopy(&env->sc_conf.statinterval, &tv, sizeof(tv));
evtimer_add(&env->sc_statev, &tv)event_add(&env->sc_statev, &tv);
356}

358void
359relay_session_publish(struct rsession *s)
360{
proc_compose(env->sc_ps, PROC_PFE, IMSG_SESS_PUBLISH, s, sizeof(*s));
362}

364void
365relay_session_unpublish(struct rsession *s)
366{
proc_compose(env->sc_ps, PROC_PFE, IMSG_SESS_UNPUBLISH,
   &s->se_id, sizeof(s->se_id));
369}

371void
372relay_statistics(int fd, short events, void *arg)
373{
struct privsep		*ps = arg;
struct relay		*rlay;
struct ctl_stats	 crs, *cur;
struct timeval		 tv, tv_now;
int			 resethour = 0, resetday = 0;
struct rsession		*con, *next_con;

/*
* This is a hack to calculate some average statistics.
* It doesn't try to be very accurate, but could be improved...
*/

timerclear(&tv)(&tv)->tv_sec = (&tv)->tv_usec = 0;
getmonotime(&tv_now);

TAILQ_FOREACH(rlay, env->sc_relays, rl_entry)for((rlay) = ((env->sc_relays)->tqh_first); (rlay) != (
(void*)0); (rlay) = ((rlay)->rl_entry.tqe_next)) {
bzero(&crs, sizeof(crs));
resethour = resetday = 0;

cur = &rlay->rl_stats[ps->ps_instance];
cur->cnt += cur->last;
cur->tick++;
cur->avg = (cur->last + cur->avg) / 2;
cur->last_hour += cur->last;
if ((cur->tick %
    (3600 / env->sc_conf.statinterval.tv_sec)) == 0) {
	cur->avg_hour = (cur->last_hour + cur->avg_hour) / 2;
	resethour++;
}
cur->last_day += cur->last;
if ((cur->tick %
    (86400 / env->sc_conf.statinterval.tv_sec)) == 0) {
	cur->avg_day = (cur->last_day + cur->avg_day) / 2;
	resethour++;
}
bcopy(cur, &crs, sizeof(crs));

cur->last = 0;
if (resethour)
	cur->last_hour = 0;
if (resetday)
	cur->last_day = 0;

crs.id = rlay->rl_conf.id;
crs.proc = ps->ps_instance;
proc_compose(env->sc_ps, PROC_PFE, IMSG_STATISTICS,
    &crs, sizeof(crs));

for (con = SPLAY_ROOT(&rlay->rl_sessions)(&rlay->rl_sessions)->sph_root;
    con != NULL((void*)0); con = next_con) {
	next_con = SPLAY_NEXT(session_tree,session_tree_SPLAY_NEXT(&rlay->rl_sessions, con)
	    &rlay->rl_sessions, con)session_tree_SPLAY_NEXT(&rlay->rl_sessions, con);
	timersub(&tv_now, &con->se_tv_last, &tv)do { (&tv)->tv_sec = (&tv_now)->tv_sec - (&
con->se_tv_last)->tv_sec; (&tv)->tv_usec = (&
tv_now)->tv_usec - (&con->se_tv_last)->tv_usec; if
 ((&tv)->tv_usec < 0) { (&tv)->tv_sec--; (&
tv)->tv_usec += 1000000; } } while (0);
	if (timercmp(&tv, &rlay->rl_conf.timeout, >=)(((&tv)->tv_sec == (&rlay->rl_conf.timeout)->
tv_sec) ? ((&tv)->tv_usec >= (&rlay->rl_conf
.timeout)->tv_usec) : ((&tv)->tv_sec >= (&rlay
->rl_conf.timeout)->tv_sec)))
		relay_close(con, "hard timeout", 1);
}
}

/* Schedule statistics timer */
evtimer_set(&env->sc_statev, relay_statistics, ps)event_set(&env->sc_statev, -1, 0, relay_statistics, ps
);
bcopy(&env->sc_conf.statinterval, &tv, sizeof(tv));
evtimer_add(&env->sc_statev, &tv)event_add(&env->sc_statev, &tv);
436}

438void
439relay_launch(void)
440{
void			(*callback)(int, short, void *);
struct relay		*rlay;
struct host		*host;
struct relay_table	*rlt;

TAILQ_FOREACH(rlay, env->sc_relays, rl_entry)for((rlay) = ((env->sc_relays)->tqh_first); (rlay) != (
(void*)0); (rlay) = ((rlay)->rl_entry.tqe_next)) {
if ((rlay->rl_conf.flags & (F_TLS0x00000800|F_TLSCLIENT0x00200000)) &&
    relay_tls_ctx_create(rlay) == -1)
	fatalx("%s: failed to create TLS context", __func__);

TAILQ_FOREACH(rlt, &rlay->rl_tables, rlt_entry)for((rlt) = ((&rlay->rl_tables)->tqh_first); (rlt) !=
 ((void*)0); (rlt) = ((rlt)->rlt_entry.tqe_next)) {
	/*
	 * set rule->rule_table in advance and save time
	 * looking up for this later on rule/connection
	 * evalution
	 */
	rule_settable(&rlay->rl_proto->rules, rlt);

	rlt->rlt_index = 0;
	rlt->rlt_nhosts = 0;
	TAILQ_FOREACH(host, &rlt->rlt_table->hosts, entry)for((host) = ((&rlt->rlt_table->hosts)->tqh_first
); (host) != ((void*)0); (host) = ((host)->entry.tqe_next)
) {
		if (rlt->rlt_nhosts >= RELAY_MAXHOSTS32)
			fatal("%s: too many hosts in table",
			    __func__);
		host->idx = rlt->rlt_nhosts;
		rlt->rlt_host[rlt->rlt_nhosts++] = host;
	}
	log_info("adding %d hosts from table %s%s",
	    rlt->rlt_nhosts, rlt->rlt_table->conf.name,
	    rlt->rlt_table->conf.check ? "" : " (no check)");
}

switch (rlay->rl_proto->type) {
case RELAY_PROTO_DNS:
	relay_udp_init(env, rlay);
	break;
case RELAY_PROTO_TCP:
case RELAY_PROTO_HTTP:
	relay_http_init(rlay);
	/* Use defaults */
	break;
}

log_debug("%s: running relay %s", __func__,
    rlay->rl_conf.name);

rlay->rl_up = HOST_UP;

if (rlay->rl_conf.flags & F_UDP0x00010000)
	callback = relay_udp_server;
else
	callback = relay_accept;

event_set(&rlay->rl_ev, rlay->rl_s, EV_READ0x02,
    callback, rlay);
event_add(&rlay->rl_ev, NULL((void*)0));
evtimer_set(&rlay->rl_evt, callback, rlay)event_set(&rlay->rl_evt, -1, 0, callback, rlay);
}
499}

501int
502relay_socket_af(struct sockaddr_storage *ss, in_port_t port)
503{
switch (ss->ss_family) {
case AF_INET2:
((struct sockaddr_in *)ss)->sin_port = port;
((struct sockaddr_in *)ss)->sin_len =
    sizeof(struct sockaddr_in);
break;
case AF_INET624:
((struct sockaddr_in6 *)ss)->sin6_port = port;
((struct sockaddr_in6 *)ss)->sin6_len =
    sizeof(struct sockaddr_in6);
break;
default:
return (-1);
}

return (0);
520}

522in_port_t
523relay_socket_getport(struct sockaddr_storage *ss)
524{
switch (ss->ss_family) {
case AF_INET2:
return (((struct sockaddr_in *)ss)->sin_port);
case AF_INET624:
return (((struct sockaddr_in6 *)ss)->sin6_port);
default:
return (0);
}

/* NOTREACHED */
return (0);
536}

538int
539relay_socket(struct sockaddr_storage *ss, in_port_t port,
  struct protocol *proto, int fd, int reuseport)
541{
struct linger	lng;
int		s = -1, val;

if (relay_socket_af(ss, port) == -1)
goto bad;

s = fd == -1 ? socket(ss->ss_family,
   SOCK_STREAM1 | SOCK_NONBLOCK0x4000, IPPROTO_TCP6) : fd;
if (s == -1)
goto bad;

/*
* Socket options
*/
bzero(&lng, sizeof(lng));
if (setsockopt(s, SOL_SOCKET0xffff, SO_LINGER0x0080, &lng, sizeof(lng)) == -1)
goto bad;
if (reuseport) {
val = 1;
if (setsockopt(s, SOL_SOCKET0xffff, SO_REUSEPORT0x0200, &val,
	sizeof(int)) == -1)
	goto bad;
}
if (proto->tcpflags & TCPFLAG_BUFSIZ0x10) {
val = proto->tcpbufsiz;
if (setsockopt(s, SOL_SOCKET0xffff, SO_RCVBUF0x1002,
    &val, sizeof(val)) == -1)
	goto bad;
val = proto->tcpbufsiz;
if (setsockopt(s, SOL_SOCKET0xffff, SO_SNDBUF0x1001,
    &val, sizeof(val)) == -1)
	goto bad;
}

/*
* IP options
*/
if (proto->tcpflags & TCPFLAG_IPTTL0x20) {
val = (int)proto->tcpipttl;
switch (ss->ss_family) {
case AF_INET2:
	if (setsockopt(s, IPPROTO_IP0, IP_TTL4,
	    &val, sizeof(val)) == -1)
		goto bad;
	break;
case AF_INET624:
	if (setsockopt(s, IPPROTO_IPV641, IPV6_UNICAST_HOPS4,
	    &val, sizeof(val)) == -1)
		goto bad;
	break;
}
}
if (proto->tcpflags & TCPFLAG_IPMINTTL0x40) {
val = (int)proto->tcpipminttl;
switch (ss->ss_family) {
case AF_INET2:
	if (setsockopt(s, IPPROTO_IP0, IP_MINTTL32,
	    &val, sizeof(val)) == -1)
		goto bad;
	break;
case AF_INET624:
	if (setsockopt(s, IPPROTO_IPV641, IPV6_MINHOPCOUNT65,
	    &val, sizeof(val)) == -1)
		goto bad;
	break;
}
}

/*
* TCP options
*/
if (proto->tcpflags & (TCPFLAG_NODELAY0x01|TCPFLAG_NNODELAY0x02)) {
if (proto->tcpflags & TCPFLAG_NNODELAY0x02)
	val = 0;
else
	val = 1;
if (setsockopt(s, IPPROTO_TCP6, TCP_NODELAY0x01,
    &val, sizeof(val)) == -1)
	goto bad;
}
if (proto->tcpflags & (TCPFLAG_SACK0x04|TCPFLAG_NSACK0x08)) {
if (proto->tcpflags & TCPFLAG_NSACK0x08)
	val = 0;
else
	val = 1;
if (setsockopt(s, IPPROTO_TCP6, TCP_SACK_ENABLE0x08,
    &val, sizeof(val)) == -1)
	goto bad;
}

return (s);

bad:
if (s != -1)
close(s);
return (-1);
638}

640int
641relay_socket_connect(struct sockaddr_storage *ss, in_port_t port,
  struct protocol *proto, int fd)
643{
int	s;

if ((s = relay_socket(ss, port, proto, fd, 0)) == -1)
return (-1);

if (connect(s, (struct sockaddr *)ss, ss->ss_len) == -1) {
if (errno(*__errno()) != EINPROGRESS36)
	goto bad;
}

return (s);

bad:
close(s);
return (-1);
659}

661int
662relay_socket_listen(struct sockaddr_storage *ss, in_port_t port,
  struct protocol *proto)
664{
int s;

if ((s = relay_socket(ss, port, proto, -1, 1)) == -1)
return (-1);

if (bind(s, (struct sockaddr *)ss, ss->ss_len) == -1)
goto bad;
if (listen(s, proto->tcpbacklog) == -1)
goto bad;

return (s);

bad:
close(s);
return (-1);
680}

682void
683relay_connected(int fd, short sig, void *arg)
684{
char			 obuf[128];
struct rsession		*con = arg;
struct relay		*rlay = con->se_relay;
struct protocol		*proto = rlay->rl_proto;
evbuffercb		 outrd = relay_read;
evbuffercb		 outwr = relay_write;
struct bufferevent	*bev;
struct ctl_relay_event	*out = &con->se_out;
char			*msg;
socklen_t		 len;
int			 error;

if (sig25.1
'sig' is not equal to EV_TIMEOUT
 == EV_TIMEOUT0x01) {
26
←
Taking false branch→
relay_abort_http(con, 504, "connect timeout", 0);
return;
}

len = sizeof(error);
if (getsockopt(fd, SOL_SOCKET0xffff, SO_ERROR0x1007, &error, &len) == -1) {
27
←
Assuming the condition is false→
28
←
Taking false branch→
relay_abort_http(con, 500, "getsockopt failed", 0);
return;
}
if (error) {
29
←
Assuming 'error' is 0→
30
←
Taking false branch→
errno(*__errno()) = error;
if (asprintf(&msg, "socket error: %s",
    strerror(error)) >= 0) {
	relay_abort_http(con, 500, msg, 0);
	free(msg);
	return;
} else {
	relay_abort_http(con, 500,
	    "socket error and asprintf failed", 0);
	return;
}
}

if ((rlay->rl_conf.flags & F_TLSCLIENT0x00200000) && (out->tls == NULL((void*)0))) {
31
←
Assuming the condition is false→
relay_tls_transaction(con, out);
return;
}

DPRINTF("%s: session %d: successful", __func__, con->se_id)do {} while(0);
32
←
Loop condition is false.  Exiting loop→

/* Log destination if it was changed in a keep-alive connection */
if ((con->se_table != con->se_table0) &&
33
←
Assuming field 'se_table' is equal to field 'se_table0'→
   (env->sc_conf.opts & (RELAYD_OPT_LOGCON0x20|RELAYD_OPT_LOGCONERR0x40))) {
con->se_table0 = con->se_table;
memset(&obuf, 0, sizeof(obuf));
(void)print_host(&con->se_out.ss, obuf, sizeof(obuf));
if (asprintf(&msg, " -> %s:%d",
    obuf, ntohs(con->se_out.port)(__uint16_t)(__builtin_constant_p(con->se_out.port) ? (__uint16_t
)(((__uint16_t)(con->se_out.port) & 0xffU) << 8 |
 ((__uint16_t)(con->se_out.port) & 0xff00U) >> 8
) : __swap16md(con->se_out.port))) == -1) {
	relay_abort_http(con, 500,
	    "connection changed and asprintf failed", 0);
	return;
}
relay_log(con, msg);
free(msg);
}

switch (rlay->rl_proto->type) {
34
←
Control jumps to 'case RELAY_PROTO_HTTP:'  at line 745→
case RELAY_PROTO_HTTP:
if (relay_httpdesc_init(out) == -1) {
35
←
Assuming the condition is true→
36
←
Taking true branch→
	relay_close(con,
37
←
Calling 'relay_close'→
54
←
Returning; memory was released via 1st parameter→
	    "failed to allocate http descriptor", 1);
	return;
}
con->se_out.toread = TOREAD_HTTP_HEADER;
outrd = relay_read_http;
break;
case RELAY_PROTO_TCP:
/* Use defaults */
break;
default:
fatalx("%s: unknown protocol", __func__);
}

/*
* Relay <-> Server
*/
bev = bufferevent_new(fd, outrd, outwr, relay_error, &con->se_out);
if (bev == NULL((void*)0)) {
relay_abort_http(con, 500,
    "failed to allocate output buffer event", 0);
return;
}
/* write pending output buffer now */
if (bufferevent_write_buffer(bev, con->se_out.output)) {
relay_abort_http(con, 500, strerror(errno(*__errno())), 0);
return;
}
con->se_out.bev = bev;

/* Initialize the TLS wrapper */
if ((rlay->rl_conf.flags & F_TLSCLIENT0x00200000) && (out->tls != NULL((void*)0)))
relay_tls_connected(out);

bufferevent_settimeout(bev,
   rlay->rl_conf.timeout.tv_sec, rlay->rl_conf.timeout.tv_sec);
bufferevent_setwatermark(bev, EV_WRITE0x04,
RELAY_MIN_PREFETCHED32 * proto->tcpbufsiz, 0);
bufferevent_enable(bev, EV_READ0x02|EV_WRITE0x04);
if (con->se_in.bev)
bufferevent_enable(con->se_in.bev, EV_READ0x02);

if (relay_splice(&con->se_out) == -1)
relay_close(con, strerror(errno(*__errno())), 1);
791}

793void
794relay_input(struct rsession *con)
795{
struct relay	*rlay = con->se_relay;
struct protocol	*proto = rlay->rl_proto;
evbuffercb	 inrd = relay_read;
evbuffercb	 inwr = relay_write;

switch (rlay->rl_proto->type) {
case RELAY_PROTO_HTTP:
if (relay_http_priv_init(con) == -1) {
	relay_close(con,
	    "failed to allocate http descriptor", 1);
	return;
}
con->se_in.toread = TOREAD_HTTP_HEADER;
inrd = relay_read_http;
break;
case RELAY_PROTO_TCP:
/* Use defaults */
break;
default:
fatalx("%s: unknown protocol", __func__);
}

/*
* Client <-> Relay
*/
con->se_in.bev = bufferevent_new(con->se_in.s, inrd, inwr,
   relay_error, &con->se_in);
if (con->se_in.bev == NULL((void*)0)) {
relay_close(con, "failed to allocate input buffer event", 1);
return;
}

/* Initialize the TLS wrapper */
if ((rlay->rl_conf.flags & F_TLS0x00000800) && con->se_in.tls != NULL((void*)0))
relay_tls_connected(&con->se_in);

bufferevent_settimeout(con->se_in.bev,
   rlay->rl_conf.timeout.tv_sec, rlay->rl_conf.timeout.tv_sec);
bufferevent_setwatermark(con->se_in.bev, EV_WRITE0x04,
RELAY_MIN_PREFETCHED32 * proto->tcpbufsiz, 0);
bufferevent_enable(con->se_in.bev, EV_READ0x02|EV_WRITE0x04);

if (relay_splice(&con->se_in) == -1)
relay_close(con, strerror(errno(*__errno())), 1);
840}

842void
843relay_write(struct bufferevent *bev, void *arg)
844{
struct ctl_relay_event	*cre = arg;
struct rsession		*con = cre->con;

getmonotime(&con->se_tv_last);

if (con->se_done && EVBUFFER_LENGTH(EVBUFFER_OUTPUT(bev))((bev)->output)->off == 0)
goto done;
if (cre->dst->bev)
bufferevent_enable(cre->dst->bev, EV_READ0x02);
if (relay_splice(cre->dst) == -1)
goto fail;

return;
done:
relay_close(con, "last write (done)", 0);
return;
fail:
relay_close(con, strerror(errno(*__errno())), 1);
863}

865void
866relay_dump(struct ctl_relay_event *cre, const void *buf, size_t len)
867{
if (!len)
return;

/*
* This function will dump the specified message directly
* to the underlying session, without waiting for success
* of non-blocking events etc. This is useful to print an
* error message before gracefully closing the session.
*/
if (cre->tls != NULL((void*)0))
(void)tls_write(cre->tls, buf, len);
else
(void)write(cre->s, buf, len);
881}

883void
884relay_read(struct bufferevent *bev, void *arg)
885{
struct ctl_relay_event	*cre = arg;
struct rsession		*con = cre->con;
struct protocol		*proto = con->se_relay->rl_proto;
struct evbuffer		*src = EVBUFFER_INPUT(bev)(bev)->input;

getmonotime(&con->se_tv_last);
cre->timedout = 0;

if (!EVBUFFER_LENGTH(src)(src)->off)
return;
if (relay_bufferevent_write_buffer(cre->dst, src) == -1)
goto fail;
if (con->se_done)
goto done;
if (cre->dst->bev)
bufferevent_enable(cre->dst->bev, EV_READ0x02);
if (cre->dst->bev && EVBUFFER_LENGTH(EVBUFFER_OUTPUT(cre->dst->bev))((cre->dst->bev)->output)->off >
   (size_t)RELAY_MAX_PREFETCH256 * proto->tcpbufsiz)
bufferevent_disable(bev, EV_READ0x02);

return;
done:
relay_close(con, "last read (done)", 0);
return;
fail:
relay_close(con, strerror(errno(*__errno())), 1);
912}

914/*
* Splice sockets from cre to cre->dst if applicable.  Returns:
* -1 socket splicing has failed
* 0 socket splicing is currently not possible
* 1 socket splicing was successful
*/
920int
921relay_splice(struct ctl_relay_event *cre)
922{
struct rsession		*con = cre->con;
struct relay		*rlay = con->se_relay;
struct protocol		*proto = rlay->rl_proto;
struct splice		 sp;

if ((rlay->rl_conf.flags & (F_TLS0x00000800|F_TLSCLIENT0x00200000)) ||
   (proto->tcpflags & TCPFLAG_NSPLICE0x80))
return (0);

if (cre->splicelen >= 0)
return (0);

/* still not connected */
if (cre->bev == NULL((void*)0) || cre->dst->bev == NULL((void*)0))
return (0);

if (!(cre->toread == TOREAD_UNLIMITED || cre->toread > 0)) {
DPRINTF("%s: session %d: splice dir %d, nothing to read %lld",do {} while(0)
    __func__, con->se_id, cre->dir, cre->toread)do {} while(0);
return (0);
}

/* do not splice before buffers have not been completely flushed */
if (EVBUFFER_LENGTH(cre->bev->input)(cre->bev->input)->off ||
   EVBUFFER_LENGTH(cre->dst->bev->output)(cre->dst->bev->output)->off) {
DPRINTF("%s: session %d: splice dir %d, dirty buffer",do {} while(0)
    __func__, con->se_id, cre->dir)do {} while(0);
bufferevent_disable(cre->bev, EV_READ0x02);
return (0);
}

bzero(&sp, sizeof(sp));
sp.sp_fd = cre->dst->s;
sp.sp_max = cre->toread > 0 ? cre->toread : 0;
bcopy(&rlay->rl_conf.timeout, &sp.sp_idle, sizeof(sp.sp_idle));
if (setsockopt(cre->s, SOL_SOCKET0xffff, SO_SPLICE0x1023, &sp, sizeof(sp)) == -1) {
log_debug("%s: session %d: splice dir %d failed: %s",
    __func__, con->se_id, cre->dir, strerror(errno(*__errno())));
return (-1);
}
cre->splicelen = 0;
bufferevent_enable(cre->bev, EV_READ0x02);

DPRINTF("%s: session %d: splice dir %d, maximum %lld, successful",do {} while(0)
   __func__, con->se_id, cre->dir, cre->toread)do {} while(0);

return (1);
970}

972int
973relay_splicelen(struct ctl_relay_event *cre)
974{
struct rsession		*con = cre->con;
off_t			 len;
socklen_t		 optlen;

if (cre->splicelen < 0)
return (0);

optlen = sizeof(len);
if (getsockopt(cre->s, SOL_SOCKET0xffff, SO_SPLICE0x1023, &len, &optlen) == -1) {
log_debug("%s: session %d: splice dir %d get length failed: %s",
    __func__, con->se_id, cre->dir, strerror(errno(*__errno())));
return (-1);
}

DPRINTF("%s: session %d: splice dir %d, length %lld",do {} while(0)
   __func__, con->se_id, cre->dir, len)do {} while(0);

if (len > cre->splicelen) {
getmonotime(&con->se_tv_last);

cre->splicelen = len;
return (1);
}

return (0);
1000}

1002int
1003relay_spliceadjust(struct ctl_relay_event *cre)
1004{
if (cre->splicelen < 0)
return (0);
if (relay_splicelen(cre) == -1)
return (-1);
if (cre->splicelen > 0 && cre->toread > 0)
cre->toread -= cre->splicelen;
cre->splicelen = -1;

return (0);
1014}

1016void
1017relay_error(struct bufferevent *bev, short error, void *arg)
1018{
struct ctl_relay_event	*cre = arg;
struct rsession		*con = cre->con;
struct evbuffer		*dst;

DPRINTF("%s: session %d: dir %d state %d to read %lld event error %x",do {} while(0)
__func__, con->se_id, cre->dir, cre->state, cre->toread, error)do {} while(0);
if (error & EVBUFFER_TIMEOUT0x40) {
if (cre->splicelen >= 0) {
	bufferevent_enable(bev, EV_READ0x02);
} else if (cre->dst->splicelen >= 0) {
	switch (relay_splicelen(cre->dst)) {
	case -1:
		goto fail;
	case 0:
		relay_close(con, "buffer event timeout", 1);
		break;
	case 1:
		cre->timedout = 1;
		bufferevent_enable(bev, EV_READ0x02);
		break;
	}
} else {
	relay_close(con, "buffer event timeout", 1);
}
return;
}
if (error & EVBUFFER_ERROR0x20 && errno(*__errno()) == ETIMEDOUT60) {
if (cre->dst->splicelen >= 0) {
	switch (relay_splicelen(cre->dst)) {
	case -1:
		goto fail;
	case 0:
		relay_close(con, "splice timeout", 1);
		return;
	case 1:
		bufferevent_enable(bev, EV_READ0x02);
		break;
	}
} else if (cre->dst->timedout) {
	relay_close(con, "splice timeout", 1);
	return;
}
if (relay_spliceadjust(cre) == -1)
	goto fail;
if (relay_splice(cre) == -1)
	goto fail;
return;
}
if (error & EVBUFFER_ERROR0x20 && errno(*__errno()) == EFBIG27) {
if (relay_spliceadjust(cre) == -1)
	goto fail;
bufferevent_enable(cre->bev, EV_READ0x02);
return;
}
if (error & (EVBUFFER_READ0x01|EVBUFFER_WRITE0x02|EVBUFFER_EOF0x10)) {
bufferevent_disable(bev, EV_READ0x02|EV_WRITE0x04);

con->se_done = 1;
if (cre->dst->bev != NULL((void*)0)) {
	dst = EVBUFFER_OUTPUT(cre->dst->bev)(cre->dst->bev)->output;
	if (EVBUFFER_LENGTH(dst)(dst)->off)
		return;
} else if (cre->toread == TOREAD_UNLIMITED || cre->toread == 0)
	return;

relay_close(con, "done", 0);
return;
}
relay_close(con, "buffer event error", 1);
return;
fail:
relay_close(con, strerror(errno(*__errno())), 1);
1091}

1093void
1094relay_accept(int fd, short event, void *arg)
1095{
struct privsep		*ps = env->sc_ps;
struct relay		*rlay = arg;
struct rsession		*con = NULL((void*)0);
struct ctl_natlook	*cnl = NULL((void*)0);
socklen_t		 slen;
struct timeval		 tv;
struct sockaddr_storage	 ss;
int			 s = -1;

event_add(&rlay->rl_ev, NULL((void*)0));
if ((event & EV_TIMEOUT0x01))
return;

slen = sizeof(ss);
if ((s = accept_reserve(fd, (struct sockaddr *)&ss,
   &slen, FD_RESERVE5, &relay_inflight)) == -1) {
/*
 * Pause accept if we are out of file descriptors, or
 * libevent will haunt us here too.
 */
if (errno(*__errno()) == ENFILE23 || errno(*__errno()) == EMFILE24) {
	struct timeval evtpause = { 1, 0 };

	event_del(&rlay->rl_ev);
	evtimer_add(&rlay->rl_evt, &evtpause)event_add(&rlay->rl_evt, &evtpause);
	log_debug("%s: deferring connections", __func__);
}
return;
}
if (rlay->rl_conf.flags & F_DISABLE0x00000001)
goto err;

if ((con = calloc(1, sizeof(*con))) == NULL((void*)0))
goto err;

/* Pre-allocate log buffer */
con->se_haslog = 0;
con->se_log = evbuffer_new();
if (con->se_log == NULL((void*)0))
goto err;

con->se_in.s = s;
con->se_in.tls = NULL((void*)0);
con->se_out.s = -1;
con->se_out.tls = NULL((void*)0);
con->se_in.dst = &con->se_out;
con->se_out.dst = &con->se_in;
con->se_in.con = con;
con->se_out.con = con;
con->se_in.splicelen = -1;
con->se_out.splicelen = -1;
con->se_in.toread = TOREAD_UNLIMITED;
con->se_out.toread = TOREAD_UNLIMITED;
con->se_relay = rlay;
con->se_id = ++relay_conid;
con->se_relayid = rlay->rl_conf.id;
con->se_pid = getpid();
con->se_in.dir = RELAY_DIR_REQUEST;
con->se_out.dir = RELAY_DIR_RESPONSE;
con->se_retry = rlay->rl_conf.dstretry;
con->se_bnds = -1;
con->se_out.port = rlay->rl_conf.dstport;
switch (ss.ss_family) {
case AF_INET2:
con->se_in.port = ((struct sockaddr_in *)&ss)->sin_port;
break;
case AF_INET624:
con->se_in.port = ((struct sockaddr_in6 *)&ss)->sin6_port;
break;
}
memcpy(&con->se_in.ss, &ss, sizeof(con->se_in.ss));

slen = sizeof(con->se_sockname);
if (getsockname(s, (struct sockaddr *)&con->se_sockname, &slen) == -1) {
relay_close(con, "sockname lookup failed", 1);
return;
}

getmonotime(&con->se_tv_start);
bcopy(&con->se_tv_start, &con->se_tv_last, sizeof(con->se_tv_last));

if (rlay->rl_conf.flags & F_HASHKEY0x08000000) {
SipHash24_Init(&con->se_siphashctx,SipHash_Init((&con->se_siphashctx), (&rlay->rl_conf
.hashkey.siphashkey))
    &rlay->rl_conf.hashkey.siphashkey)SipHash_Init((&con->se_siphashctx), (&rlay->rl_conf
.hashkey.siphashkey));
}

relay_sessions++;
SPLAY_INSERT(session_tree, &rlay->rl_sessions, con)session_tree_SPLAY_INSERT(&rlay->rl_sessions, con);
relay_session_publish(con);

/* Increment the per-relay session counter */
rlay->rl_stats[ps->ps_instance].last++;

/* Pre-allocate output buffer */
con->se_out.output = evbuffer_new();
if (con->se_out.output == NULL((void*)0)) {
relay_close(con, "failed to allocate output buffer", 1);
return;
}

if (rlay->rl_conf.flags & F_DIVERT0x01000000) {
memcpy(&con->se_out.ss, &con->se_sockname,
    sizeof(con->se_out.ss));
con->se_out.port = relay_socket_getport(&con->se_out.ss);

/* Detect loop and fall back to the alternate forward target */
if (bcmp(&rlay->rl_conf.ss, &con->se_out.ss,
    sizeof(con->se_out.ss)) == 0 &&
    con->se_out.port == rlay->rl_conf.port)
	con->se_out.ss.ss_family = AF_UNSPEC0;
} else if (rlay->rl_conf.flags & F_NATLOOK0x00001000) {
if ((cnl = calloc(1, sizeof(*cnl))) == NULL((void*)0)) {
	relay_close(con, "failed to allocate nat lookup", 1);
	return;
}

con->se_cnl = cnl;
bzero(cnl, sizeof(*cnl));
cnl->in = -1;
cnl->id = con->se_id;
cnl->proc = ps->ps_instance;
cnl->proto = IPPROTO_TCP6;

memcpy(&cnl->src, &con->se_in.ss, sizeof(cnl->src));
memcpy(&cnl->dst, &con->se_sockname, sizeof(cnl->dst));

proc_compose(env->sc_ps, PROC_PFE, IMSG_NATLOOK,
    cnl, sizeof(*cnl));

/* Schedule timeout */
evtimer_set(&con->se_ev, relay_natlook, con)event_set(&con->se_ev, -1, 0, relay_natlook, con);
bcopy(&rlay->rl_conf.timeout, &tv, sizeof(tv));
evtimer_add(&con->se_ev, &tv)event_add(&con->se_ev, &tv);
return;
}

if (rlay->rl_conf.flags & F_TLSINSPECT0x04000000) {
relay_preconnect(con);
return;
}

relay_session(con);
return;
err:
if (s != -1) {
close(s);
free(con);
/*
 * the session struct was not completely set up, but still
 * counted as an inflight session. account for this.
 */
relay_inflight--;
log_debug("%s: inflight decremented, now %d",
    __func__, relay_inflight);
}
1251}

1253void
1254relay_hash_addr(SIPHASH_CTX *ctx, struct sockaddr_storage *ss, int portset)
1255{
struct sockaddr_in	*sin4;
struct sockaddr_in6	*sin6;
in_port_t		 port;

if (ss->ss_family == AF_INET2) {
sin4 = (struct sockaddr_in *)ss;
SipHash24_Update(ctx, &sin4->sin_addr,SipHash_Update((ctx), 2, 4, (&sin4->sin_addr), (sizeof
(struct in_addr)))
    sizeof(struct in_addr))SipHash_Update((ctx), 2, 4, (&sin4->sin_addr), (sizeof
(struct in_addr)));
} else {
sin6 = (struct sockaddr_in6 *)ss;
SipHash24_Update(ctx, &sin6->sin6_addr,SipHash_Update((ctx), 2, 4, (&sin6->sin6_addr), (sizeof
(struct in6_addr)))
    sizeof(struct in6_addr))SipHash_Update((ctx), 2, 4, (&sin6->sin6_addr), (sizeof
(struct in6_addr)));
}

if (portset != -1) {
port = (in_port_t)portset;
SipHash24_Update(ctx, &port, sizeof(port))SipHash_Update((ctx), 2, 4, (&port), (sizeof(port)));
}
1274}

1276int
1277relay_from_table(struct rsession *con)
1278{
struct relay		*rlay = con->se_relay;
struct host		*host = NULL((void*)0);
struct relay_table	*rlt = NULL((void*)0);
struct table		*table = NULL((void*)0);
int			 idx = -1;
int			 cnt = 0;
int			 maxtries;
u_int64_t		 p = 0;

/* the table is already selected */
if (con->se_table != NULL((void*)0)) {
rlt = con->se_table;
table = rlt->rlt_table;
if (table->conf.check && !table->up)
	table = NULL((void*)0);
goto gottable;
}

/* otherwise grep the first active table */
TAILQ_FOREACH(rlt, &rlay->rl_tables, rlt_entry)for((rlt) = ((&rlay->rl_tables)->tqh_first); (rlt) !=
 ((void*)0); (rlt) = ((rlt)->rlt_entry.tqe_next)) {
table = rlt->rlt_table;
if ((rlt->rlt_flags & F_USED0x00000004) == 0 ||
    (table->conf.check && !table->up))
	table = NULL((void*)0);
else
	break;
}

gottable:
if (table == NULL((void*)0)) {
log_debug("%s: session %d: no active hosts",
    __func__, con->se_id);
return (-1);
}

switch (rlt->rlt_mode) {
case RELAY_DSTMODE_ROUNDROBIN:
if ((int)rlt->rlt_index >= rlt->rlt_nhosts)
	rlt->rlt_index = 0;
idx = (int)rlt->rlt_index;
break;
case RELAY_DSTMODE_RANDOM:
idx = (int)arc4random_uniform(rlt->rlt_nhosts);
break;
case RELAY_DSTMODE_SRCHASH:
/* Source IP address without port */
relay_hash_addr(&con->se_siphashctx, &con->se_in.ss, -1);
break;
case RELAY_DSTMODE_LOADBALANCE:
/* Source IP address without port */
relay_hash_addr(&con->se_siphashctx, &con->se_in.ss, -1);
/* FALLTHROUGH */
case RELAY_DSTMODE_HASH:
/* Local "destination" IP address and port */
relay_hash_addr(&con->se_siphashctx, &rlay->rl_conf.ss,
    rlay->rl_conf.port);
break;
default:
fatalx("%s: unsupported mode", __func__);
/* NOTREACHED */
}
if (idx == -1) {
/* handle all hashing algorithms */
p = SipHash24_End(&con->se_siphashctx)SipHash_End((&con->se_siphashctx), 2, 4);

/* Reset hash context */
SipHash24_Init(&con->se_siphashctx,SipHash_Init((&con->se_siphashctx), (&rlay->rl_conf
.hashkey.siphashkey))
    &rlay->rl_conf.hashkey.siphashkey)SipHash_Init((&con->se_siphashctx), (&rlay->rl_conf
.hashkey.siphashkey));

maxtries = (rlt->rlt_nhosts < RELAY_MAX_HASH_RETRIES5 ?
    rlt->rlt_nhosts : RELAY_MAX_HASH_RETRIES5);
for (cnt = 0; cnt < maxtries; cnt++) {
	if ((idx = p % rlt->rlt_nhosts) >= RELAY_MAXHOSTS32)
		return (-1);

	host = rlt->rlt_host[idx];

	DPRINTF("%s: session %d: table %s host %s, "do {} while(0)
	    "p 0x%016llx, idx %d, cnt %d, max %d",do {} while(0)
	    __func__, con->se_id, table->conf.name,do {} while(0)
	    host->conf.name, p, idx, cnt, maxtries)do {} while(0);

	if (!table->conf.check || host->up == HOST_UP)
		goto found;
	p = p >> 1;
}
} else {
/* handle all non-hashing algorithms */
host = rlt->rlt_host[idx];
DPRINTF("%s: session %d: table %s host %s, p 0x%016llx, idx %d",do {} while(0)
    __func__, con->se_id, table->conf.name, host->conf.name,do {} while(0)
    p, idx)do {} while(0);
}

while (host != NULL((void*)0)) {
DPRINTF("%s: session %d: host %s", __func__,do {} while(0)
    con->se_id, host->conf.name)do {} while(0);
if (!table->conf.check || host->up == HOST_UP)
	goto found;
host = TAILQ_NEXT(host, entry)((host)->entry.tqe_next);
}
TAILQ_FOREACH(host, &table->hosts, entry)for((host) = ((&table->hosts)->tqh_first); (host) !=
 ((void*)0); (host) = ((host)->entry.tqe_next)) {
DPRINTF("%s: session %d: next host %s",do {} while(0)
    __func__, con->se_id, host->conf.name)do {} while(0);
if (!table->conf.check || host->up == HOST_UP)
	goto found;
}

/* Should not happen */
fatalx("%s: no active hosts, desynchronized", __func__);

found:
if (rlt->rlt_mode == RELAY_DSTMODE_ROUNDROBIN)
rlt->rlt_index = host->idx + 1;
con->se_retry = host->conf.retry;
con->se_out.port = table->conf.port;
bcopy(&host->conf.ss, &con->se_out.ss, sizeof(con->se_out.ss));

return (0);
1398}

1400void
1401relay_natlook(int fd, short event, void *arg)
1402{
struct rsession		*con = arg;
struct relay		*rlay = con->se_relay;
struct ctl_natlook	*cnl = con->se_cnl;

if (cnl == NULL((void*)0))
fatalx("invalid NAT lookup");

if (con->se_out.ss.ss_family == AF_UNSPEC0 && cnl->in == -1 &&
   rlay->rl_conf.dstss.ss_family == AF_UNSPEC0 &&
   TAILQ_EMPTY(&rlay->rl_tables)(((&rlay->rl_tables)->tqh_first) == ((void*)0))) {
relay_close(con, "session NAT lookup failed", 1);
return;
}
if (cnl->in != -1) {
bcopy(&cnl->rdst, &con->se_out.ss, sizeof(con->se_out.ss));
con->se_out.port = cnl->rdport;
}
free(con->se_cnl);
con->se_cnl = NULL((void*)0);

relay_session(con);
1424}

1426void
1427relay_session(struct rsession *con)
1428{
struct relay		*rlay = con->se_relay;
struct ctl_relay_event	*in = &con->se_in, *out = &con->se_out;

if (bcmp(&rlay->rl_conf.ss, &out->ss, sizeof(out->ss)) == 0 &&
9
←
Assuming the condition is false→
   out->port == rlay->rl_conf.port) {
log_debug("%s: session %d: looping", __func__, con->se_id);
relay_close(con, "session aborted", 1);
return;
}

if (rlay->rl_conf.flags & F_UDP0x00010000) {
10
←
Assuming the condition is false→
11
←
Taking false branch→
/*
 * Call the UDP protocol-specific handler
 */
if (rlay->rl_proto->request == NULL((void*)0))
	fatalx("invalide UDP session");
if ((*rlay->rl_proto->request)(con) == -1)
	relay_close(con, "session failed", 1);
return;
}

if ((rlay->rl_conf.flags & F_TLS0x00000800) && (in->tls == NULL((void*)0))) {
12
←
Assuming the condition is false→
relay_tls_transaction(con, in);
return;
}

if (rlay->rl_proto->type != RELAY_PROTO_HTTP) {
13
←
Assuming field 'type' is not equal to RELAY_PROTO_HTTP→
14
←
Taking true branch→
if (rlay->rl_conf.fwdmode == FWD_TRANS)
15
←
Assuming field 'fwdmode' is not equal to FWD_TRANS→
16
←
Taking false branch→
	relay_bindanyreq(con, 0, IPPROTO_TCP6);
else if (relay_connect(con) == -1) {
17
←
Calling 'relay_connect'→
	relay_close(con, "session failed", 1);
	return;
}
}

relay_input(con);
1465}

1467void
1468relay_bindanyreq(struct rsession *con, in_port_t port, int proto)
1469{
struct privsep		*ps = env->sc_ps;
struct relay		*rlay = con->se_relay;
struct ctl_bindany	 bnd;
struct timeval		 tv;

bzero(&bnd, sizeof(bnd));
bnd.bnd_id = con->se_id;
bnd.bnd_proc = ps->ps_instance;
bnd.bnd_port = port;
bnd.bnd_proto = proto;
bcopy(&con->se_in.ss, &bnd.bnd_ss, sizeof(bnd.bnd_ss));
proc_compose(env->sc_ps, PROC_PARENT, IMSG_BINDANY,
   &bnd, sizeof(bnd));

/* Schedule timeout */
evtimer_set(&con->se_ev, relay_bindany, con)event_set(&con->se_ev, -1, 0, relay_bindany, con);
bcopy(&rlay->rl_conf.timeout, &tv, sizeof(tv));
evtimer_add(&con->se_ev, &tv)event_add(&con->se_ev, &tv);
1488}

1490void
1491relay_bindany(int fd, short event, void *arg)
1492{
struct rsession	*con = arg;

if (con->se_bnds == -1) {
relay_close(con, "bindany failed, invalid socket", 1);
return;
}
if (relay_connect(con) == -1)
relay_close(con, "session failed", 1);
1501}

1503void
1504relay_connect_state(struct rsession *con, struct ctl_relay_event *cre,
  enum relay_state new)
1506{
DPRINTF("%s: session %d: %s state %s -> %s",do {} while(0)
   __func__, con->se_id,do {} while(0)
   cre->dir == RELAY_DIR_REQUEST ? "accept" : "connect",do {} while(0)
   relay_state(cre->state), relay_state(new))do {} while(0);
cre->state = new;
1512}

1514void
1515relay_connect_retry(int fd, short sig, void *arg)
1516{
struct timeval	 evtpause = { 1, 0 };
struct rsession	*con = arg;
struct relay	*rlay = con->se_relay;
int		 bnds = -1;

if (relay_inflight < 1) {
log_warnx("%s: no connection in flight", __func__);
relay_inflight = 1;
}

DPRINTF("%s: retry %d of %d, inflight: %d",__func__,do {} while(0)
   con->se_retrycount, con->se_retry, relay_inflight)do {} while(0);

if (sig != EV_TIMEOUT0x01)
fatalx("%s: called without timeout", __func__);

evtimer_del(&con->se_inflightevt)event_del(&con->se_inflightevt);

/*
* XXX we might want to check if the inbound socket is still
* available: client could have closed it while we were waiting?
*/

DPRINTF("%s: got EV_TIMEOUT", __func__)do {} while(0);

if (getdtablecount() + FD_RESERVE5 +
   relay_inflight > getdtablesize()) {
if (con->se_retrycount < RELAY_OUTOF_FD_RETRIES5) {
	evtimer_add(&con->se_inflightevt, &evtpause)event_add(&con->se_inflightevt, &evtpause);
	return;
}
/* we waited for RELAY_OUTOF_FD_RETRIES seconds, give up */
event_add(&rlay->rl_ev, NULL((void*)0));
relay_abort_http(con, 504, "connection timed out", 0);
return;
}

if (rlay->rl_conf.fwdmode == FWD_TRANS) {
/* con->se_bnds cannot be unset */
bnds = con->se_bnds;
}

retry:
if ((con->se_out.s = relay_socket_connect(&con->se_out.ss,
   con->se_out.port, rlay->rl_proto, bnds)) == -1) {
log_debug("%s: session %d: "
    "forward failed: %s, %s", __func__,
    con->se_id, strerror(errno(*__errno())),
    con->se_retry ? "next retry" : "last retry");

con->se_retrycount++;

if ((errno(*__errno()) == ENFILE23 || errno(*__errno()) == EMFILE24) &&
    (con->se_retrycount < con->se_retry)) {
	event_del(&rlay->rl_ev);
	evtimer_add(&con->se_inflightevt, &evtpause)event_add(&con->se_inflightevt, &evtpause);
	evtimer_add(&rlay->rl_evt, &evtpause)event_add(&rlay->rl_evt, &evtpause);
	return;
} else if (con->se_retrycount < con->se_retry)
	goto retry;
event_add(&rlay->rl_ev, NULL((void*)0));
relay_abort_http(con, 504, "connect failed", 0);
return;
}

if (rlay->rl_conf.flags & F_TLSINSPECT0x04000000)
relay_connect_state(con, &con->se_out, STATE_PRECONNECT);
else
relay_connect_state(con, &con->se_out, STATE_CONNECTED);
relay_inflight--;
DPRINTF("%s: inflight decremented, now %d",__func__, relay_inflight)do {} while(0);

event_add(&rlay->rl_ev, NULL((void*)0));

if (errno(*__errno()) == EINPROGRESS36)
event_again(&con->se_ev, con->se_out.s, EV_WRITE0x04|EV_TIMEOUT0x01,
    relay_connected, &con->se_tv_start, &rlay->rl_conf.timeout,
    con);
else
relay_connected(con->se_out.s, EV_WRITE0x04, con);

return;
1599}

1601int
1602relay_preconnect(struct rsession *con)
1603{
int rv;

log_debug("%s: session %d: process %d", __func__,
   con->se_id, privsep_process);
rv = relay_connect(con);
if (con->se_out.state == STATE_CONNECTED)
relay_connect_state(con, &con->se_out, STATE_PRECONNECT);
return (rv);
1612}

1614int
1615relay_connect(struct rsession *con)
1616{
struct relay	*rlay = con->se_relay;
struct timeval	 evtpause = { 1, 0 };
int		 bnds = -1, ret;

/* relay_connect should only be called once per relay */
if (con->se_out.state == STATE_CONNECTED) {
18
←
Assuming field 'state' is not equal to STATE_CONNECTED→
19
←
Taking false branch→
log_debug("%s: connect already called once", __func__);
return (0);
}

/* Connection is already established but session not active */
if ((rlay->rl_conf.flags & F_TLSINSPECT0x04000000) &&
20
←
Assuming the condition is true→
22
←
Taking true branch→
   con->se_out.state == STATE_PRECONNECT) {
21
←
Assuming field 'state' is equal to STATE_PRECONNECT→
if (con->se_out.tls == NULL((void*)0)) {
23
←
Assuming field 'tls' is not equal to NULL→
24
←
Taking false branch→
	log_debug("%s: tls connect failed", __func__);
	return (-1);
}
relay_connected(con->se_out.s, EV_WRITE0x04, con);
25
←
Calling 'relay_connected'→
55
←
Returning; memory was released via 3rd parameter→
relay_connect_state(con, &con->se_out, STATE_CONNECTED);
56
←
Use of memory after it is freed
return (0);
}

if (relay_inflight < 1) {
log_warnx("relay_connect: no connection in flight");
relay_inflight = 1;
}

getmonotime(&con->se_tv_start);

if (con->se_out.ss.ss_family == AF_UNSPEC0 &&
   !TAILQ_EMPTY(&rlay->rl_tables)(((&rlay->rl_tables)->tqh_first) == ((void*)0))) {
if (relay_from_table(con) != 0)
	return (-1);
} else if (con->se_out.ss.ss_family == AF_UNSPEC0) {
bcopy(&rlay->rl_conf.dstss, &con->se_out.ss,
    sizeof(con->se_out.ss));
con->se_out.port = rlay->rl_conf.dstport;
}

if (rlay->rl_conf.fwdmode == FWD_TRANS) {
if (con->se_bnds == -1) {
	log_debug("%s: could not bind any sock", __func__);
	return (-1);
}
bnds = con->se_bnds;
}

/* Do the IPv4-to-IPv6 or IPv6-to-IPv4 translation if requested */
if (rlay->rl_conf.dstaf.ss_family != AF_UNSPEC0) {
if (con->se_out.ss.ss_family == AF_INET2 &&
    rlay->rl_conf.dstaf.ss_family == AF_INET624)
	ret = map4to6(&con->se_out.ss, &rlay->rl_conf.dstaf);
else if (con->se_out.ss.ss_family == AF_INET624 &&
    rlay->rl_conf.dstaf.ss_family == AF_INET2)
	ret = map6to4(&con->se_out.ss);
else
	ret = 0;
if (ret != 0) {
	log_debug("%s: mapped to invalid address", __func__);
	return (-1);
}
}

retry:
if ((con->se_out.s = relay_socket_connect(&con->se_out.ss,
   con->se_out.port, rlay->rl_proto, bnds)) == -1) {
if (errno(*__errno()) == ENFILE23 || errno(*__errno()) == EMFILE24) {
	log_debug("%s: session %d: forward failed: %s",
	    __func__, con->se_id, strerror(errno(*__errno())));
	evtimer_set(&con->se_inflightevt, relay_connect_retry,event_set(&con->se_inflightevt, -1, 0, relay_connect_retry
, con)
	    con)event_set(&con->se_inflightevt, -1, 0, relay_connect_retry
, con);
	event_del(&rlay->rl_ev);
	evtimer_add(&con->se_inflightevt, &evtpause)event_add(&con->se_inflightevt, &evtpause);
	evtimer_add(&rlay->rl_evt, &evtpause)event_add(&rlay->rl_evt, &evtpause);

	/* this connect is pending */
	relay_connect_state(con, &con->se_out, STATE_PENDING);
	return (0);
} else {
	if (con->se_retry) {
		con->se_retry--;
		log_debug("%s: session %d: "
		    "forward failed: %s, %s", __func__,
		    con->se_id, strerror(errno(*__errno())),
		    con->se_retry ?
		    "next retry" : "last retry");
		goto retry;
	}
	log_debug("%s: session %d: forward failed: %s",
	    __func__, con->se_id, strerror(errno(*__errno())));
	return (-1);
}
}

relay_connect_state(con, &con->se_out, STATE_CONNECTED);
relay_inflight--;
DPRINTF("%s: inflight decremented, now %d",__func__,do {} while(0)
   relay_inflight)do {} while(0);

if (errno(*__errno()) == EINPROGRESS36)
event_again(&con->se_ev, con->se_out.s, EV_WRITE0x04|EV_TIMEOUT0x01,
    relay_connected, &con->se_tv_start, &rlay->rl_conf.timeout,
    con);
else
relay_connected(con->se_out.s, EV_WRITE0x04, con);

return (0);
1724}

1726void
1727relay_close(struct rsession *con, const char *msg, int err)
1728{
char		 ibuf[128], obuf[128], *ptr = NULL((void*)0);
struct relay	*rlay = con->se_relay;
struct protocol	*proto = rlay->rl_proto;

SPLAY_REMOVE(session_tree, &rlay->rl_sessions, con)session_tree_SPLAY_REMOVE(&rlay->rl_sessions, con);
relay_session_unpublish(con);

event_del(&con->se_ev);

if ((env->sc_conf.opts & (RELAYD_OPT_LOGCON0x20|RELAYD_OPT_LOGCONERR0x40)) &&
38
←
Assuming the condition is false→
   msg != NULL((void*)0)) {
bzero(&ibuf, sizeof(ibuf));
bzero(&obuf, sizeof(obuf));
(void)print_host(&con->se_in.ss, ibuf, sizeof(ibuf));
(void)print_host(&con->se_out.ss, obuf, sizeof(obuf));
if (EVBUFFER_LENGTH(con->se_log)(con->se_log)->off &&
    evbuffer_add_printf(con->se_log, "\r\n") != -1) {
	ptr = evbuffer_readln(con->se_log, NULL((void*)0),
	    EVBUFFER_EOL_CRLF);
}
if (err == 0 && (env->sc_conf.opts & RELAYD_OPT_LOGCON0x20))
	log_info("relay %s, "
	    "session %d (%d active), %s, %s -> %s:%d, "
	    "%s%s%s", rlay->rl_conf.name, con->se_id,
	    relay_sessions, con->se_tag != 0 ?
	    tag_id2name(con->se_tag) : "0", ibuf, obuf,
	    ntohs(con->se_out.port)(__uint16_t)(__builtin_constant_p(con->se_out.port) ? (__uint16_t
)(((__uint16_t)(con->se_out.port) & 0xffU) << 8 |
 ((__uint16_t)(con->se_out.port) & 0xff00U) >> 8
) : __swap16md(con->se_out.port)), msg, ptr == NULL((void*)0) ?
	    "" : ",", ptr == NULL((void*)0) ? "" : ptr);
if (err == 1 && (env->sc_conf.opts & RELAYD_OPT_LOGCONERR0x40))
	log_warn("relay %s, "
	    "session %d (%d active), %s, %s -> %s:%d, "
	    "%s%s%s", rlay->rl_conf.name, con->se_id,
	    relay_sessions, con->se_tag != 0 ?
	    tag_id2name(con->se_tag) : "0", ibuf, obuf,
	    ntohs(con->se_out.port)(__uint16_t)(__builtin_constant_p(con->se_out.port) ? (__uint16_t
)(((__uint16_t)(con->se_out.port) & 0xffU) << 8 |
 ((__uint16_t)(con->se_out.port) & 0xff00U) >> 8
) : __swap16md(con->se_out.port)), msg, ptr == NULL((void*)0) ?
	    "" : ",", ptr == NULL((void*)0) ? "" : ptr);
free(ptr);
}

if (proto->close != NULL((void*)0))
39
←
Assuming field 'close' is equal to NULL→
40
←
Taking false branch→
(*proto->close)(con);

free(con->se_priv);

relay_connect_state(con, &con->se_in, STATE_DONE);
if (relay_reset_event(con, &con->se_in)) {
41
←
Assuming the condition is false→
42
←
Taking false branch→
if (con->se_out.s == -1) {
	/*
	 * the output was never connected,
	 * thus this was an inflight session.
	 */
	relay_inflight--;
	log_debug("%s: sessions inflight decremented, now %d",
	    __func__, relay_inflight);
}
}
if (con->se_in.output != NULL((void*)0))
43
←
Assuming field 'output' is equal to NULL→
44
←
Taking false branch→
evbuffer_free(con->se_in.output);

relay_connect_state(con, &con->se_out, STATE_DONE);
if (relay_reset_event(con, &con->se_out)) {
45
←
Assuming the condition is false→
46
←
Taking false branch→
/* Some file descriptors are available again. */
if (evtimer_pending(&rlay->rl_evt, NULL)event_pending(&rlay->rl_evt, 0x01, ((void*)0))) {
	evtimer_del(&rlay->rl_evt)event_del(&rlay->rl_evt);
	event_add(&rlay->rl_ev, NULL((void*)0));
}
}
if (con->se_out.output != NULL((void*)0))
47
←
Assuming field 'output' is equal to NULL→
48
←
Taking false branch→
evbuffer_free(con->se_out.output);

if (con->se_log != NULL((void*)0))
49
←
Assuming field 'se_log' is equal to NULL→
50
←
Taking false branch→
evbuffer_free(con->se_log);

if (con->se_cnl != NULL((void*)0)) {
51
←
Assuming field 'se_cnl' is equal to NULL→
52
←
Taking false branch→
1803#if 0
proc_compose_imsg(env->sc_ps, PROC_PFE, -1, IMSG_KILLSTATES, -1,
    cnl, sizeof(*cnl));
1806#endif
free(con->se_cnl);
}

free(con);
53
←
Memory is released→
relay_sessions--;
1812}

1814int
1815relay_reset_event(struct rsession *con, struct ctl_relay_event *cre)
1816{
int		 rv = 0;

if (cre->state != STATE_DONE)
relay_connect_state(con, cre, STATE_CLOSED);
if (cre->bev != NULL((void*)0)) {
bufferevent_disable(cre->bev, EV_READ0x02|EV_WRITE0x04);
bufferevent_free(cre->bev);
}
if (cre->tls != NULL((void*)0))
tls_close(cre->tls);
tls_free(cre->tls);
tls_free(cre->tls_ctx);
tls_config_free(cre->tls_cfg);
free(cre->tlscert);
if (cre->s != -1) {
close(cre->s);
rv = 1;
}
cre->bev = NULL((void*)0);
cre->tls = NULL((void*)0);
cre->tls_cfg = NULL((void*)0);
cre->tlscert = NULL((void*)0);
cre->s = -1;

return (rv);
1842}

1844int
1845relay_dispatch_pfe(int fd, struct privsep_proc *p, struct imsg *imsg)
1846{
struct relay		*rlay;
struct rsession		*con, se;
struct ctl_natlook	 cnl;
struct timeval		 tv;
struct host		*host;
struct table		*table;
struct ctl_status	 st;
objid_t			 id;
int			 cid;

switch (imsg->hdr.type) {
case IMSG_HOST_DISABLE:
memcpy(&id, imsg->data, sizeof(id));
if ((host = host_find(env, id)) == NULL((void*)0))
	fatalx("%s: desynchronized", __func__);
if ((table = table_find(env, host->conf.tableid)) ==
    NULL((void*)0))
	fatalx("%s: invalid table id", __func__);
if (host->up == HOST_UP)
	table->up--;
host->flags |= F_DISABLE0x00000001;
host->up = HOST_UNKNOWN;
break;
case IMSG_HOST_ENABLE:
memcpy(&id, imsg->data, sizeof(id));
if ((host = host_find(env, id)) == NULL((void*)0))
	fatalx("%s: desynchronized", __func__);
host->flags &= ~(F_DISABLE0x00000001);
host->up = HOST_UNKNOWN;
break;
case IMSG_TABLE_DISABLE:
memcpy(&id, imsg->data, sizeof(id));
if ((table = table_find(env, id)) == NULL((void*)0))
	fatalx("%s: desynchronized", __func__);
table->conf.flags |= F_DISABLE0x00000001;
table->up = 0;
TAILQ_FOREACH(host, &table->hosts, entry)for((host) = ((&table->hosts)->tqh_first); (host) !=
 ((void*)0); (host) = ((host)->entry.tqe_next))
	host->up = HOST_UNKNOWN;
break;
case IMSG_TABLE_ENABLE:
memcpy(&id, imsg->data, sizeof(id));
if ((table = table_find(env, id)) == NULL((void*)0))
	fatalx("%s: desynchronized", __func__);
table->conf.flags &= ~(F_DISABLE0x00000001);
table->up = 0;
TAILQ_FOREACH(host, &table->hosts, entry)for((host) = ((&table->hosts)->tqh_first); (host) !=
 ((void*)0); (host) = ((host)->entry.tqe_next))
	host->up = HOST_UNKNOWN;
break;
case IMSG_HOST_STATUS:
IMSG_SIZE_CHECK(imsg, &st)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&st)) fatalx("bad length imsg received"); } while (0);
memcpy(&st, imsg->data, sizeof(st));
if ((host = host_find(env, st.id)) == NULL((void*)0))
	fatalx("%s: invalid host id", __func__);
if (host->flags & F_DISABLE0x00000001)
	break;
if (host->up == st.up) {
	log_debug("%s: host %d => %d", __func__,
	    host->conf.id, host->up);
	fatalx("%s: desynchronized", __func__);
}

if ((table = table_find(env, host->conf.tableid))
    == NULL((void*)0))
	fatalx("%s: invalid table id", __func__);

DPRINTF("%s: [%d] state %d for "do {} while(0)
    "host %u %s", __func__, p->p_ps->ps_instance, st.up,do {} while(0)
    host->conf.id, host->conf.name)do {} while(0);

if ((st.up == HOST_UNKNOWN && host->up == HOST_DOWN) ||
    (st.up == HOST_DOWN && host->up == HOST_UNKNOWN)) {
	host->up = st.up;
	break;
}
if (st.up == HOST_UP)
	table->up++;
else
	table->up--;
host->up = st.up;
break;
case IMSG_NATLOOK:
bcopy(imsg->data, &cnl, sizeof(cnl));
if ((con = session_find(env, cnl.id)) == NULL((void*)0) ||
    con->se_cnl == NULL((void*)0)) {
	log_debug("%s: session %d: expired",
	    __func__, cnl.id);
	break;
}
bcopy(&cnl, con->se_cnl, sizeof(*con->se_cnl));
evtimer_del(&con->se_ev)event_del(&con->se_ev);
evtimer_set(&con->se_ev, relay_natlook, con)event_set(&con->se_ev, -1, 0, relay_natlook, con);
bzero(&tv, sizeof(tv));
evtimer_add(&con->se_ev, &tv)event_add(&con->se_ev, &tv);
break;
case IMSG_CTL_SESSION:
IMSG_SIZE_CHECK(imsg, &cid)do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*&cid)) fatalx("bad length imsg received"); } while (0);
memcpy(&cid, imsg->data, sizeof(cid));
TAILQ_FOREACH(rlay, env->sc_relays, rl_entry)for((rlay) = ((env->sc_relays)->tqh_first); (rlay) != (
(void*)0); (rlay) = ((rlay)->rl_entry.tqe_next)) {
	SPLAY_FOREACH(con, session_tree,for ((con) = (((&rlay->rl_sessions)->sph_root == ((
void*)0)) ? ((void*)0) : session_tree_SPLAY_MIN_MAX(&rlay
->rl_sessions, -1)); (con) != ((void*)0); (con) = session_tree_SPLAY_NEXT
(&rlay->rl_sessions, con))
	    &rlay->rl_sessions)for ((con) = (((&rlay->rl_sessions)->sph_root == ((
void*)0)) ? ((void*)0) : session_tree_SPLAY_MIN_MAX(&rlay
->rl_sessions, -1)); (con) != ((void*)0); (con) = session_tree_SPLAY_NEXT
(&rlay->rl_sessions, con)) {
		memcpy(&se, con, sizeof(se));
		se.se_cid = cid;
		proc_compose(env->sc_ps, p->p_id,
		    IMSG_CTL_SESSION, &se, sizeof(se));
	}
}
proc_compose(env->sc_ps, p->p_id, IMSG_CTL_END,
    &cid, sizeof(cid));
break;
default:
return (-1);
}

return (0);
1961}

1963int
1964relay_dispatch_ca(int fd, struct privsep_proc *p, struct imsg *imsg)
1965{
switch (imsg->hdr.type) {
case IMSG_CA_PRIVENC:
case IMSG_CA_PRIVDEC:
log_warnx("%s: priv%s result after timeout", __func__,
    imsg->hdr.type == IMSG_CA_PRIVENC ? "enc" : "dec");
return (0);
}

return (-1);
1975}

1977int
1978relay_dispatch_parent(int fd, struct privsep_proc *p, struct imsg *imsg)
1979{
struct relay_ticket_key	 ticket;
struct relay		*rlay;
struct rsession		*con;
struct timeval		 tv;
objid_t			 id;

switch (imsg->hdr.type) {
case IMSG_BINDANY:
bcopy(imsg->data, &id, sizeof(id));
if ((con = session_find(env, id)) == NULL((void*)0)) {
	log_debug("%s: session %d: expired",
	    __func__, id);
	break;
}

/* Will validate the result later */
con->se_bnds = imsg->fd;

evtimer_del(&con->se_ev)event_del(&con->se_ev);
evtimer_set(&con->se_ev, relay_bindany, con)event_set(&con->se_ev, -1, 0, relay_bindany, con);
bzero(&tv, sizeof(tv));
evtimer_add(&con->se_ev, &tv)event_add(&con->se_ev, &tv);
break;
case IMSG_CFG_TABLE:
config_gettable(env, imsg);
break;
case IMSG_CFG_HOST:
config_gethost(env, imsg);
break;
case IMSG_CFG_PROTO:
config_getproto(env, imsg);
break;
case IMSG_CFG_RULE:
config_getrule(env, imsg);
break;
case IMSG_CFG_RELAY:
config_getrelay(env, imsg);
break;
case IMSG_CFG_RELAY_TABLE:
config_getrelaytable(env, imsg);
break;
case IMSG_CFG_RELAY_FD:
config_getrelayfd(env, imsg);
break;
case IMSG_CFG_DONE:
config_getcfg(env, imsg);
break;
case IMSG_CTL_START:
relay_launch();
break;
case IMSG_CTL_RESET:
config_getreset(env, imsg);
break;
case IMSG_TLSTICKET_REKEY:
IMSG_SIZE_CHECK(imsg, (&ticket))do { if (((imsg)->hdr.len - sizeof(struct imsg_hdr)) < sizeof
(*(&ticket))) fatalx("bad length imsg received"); } while
 (0);
memcpy(&env->sc_ticket, imsg->data, sizeof(env->sc_ticket));
TAILQ_FOREACH(rlay, env->sc_relays, rl_entry)for((rlay) = ((env->sc_relays)->tqh_first); (rlay) != (
(void*)0); (rlay) = ((rlay)->rl_entry.tqe_next)) {
	if (rlay->rl_conf.flags & F_TLS0x00000800)
		tls_config_add_ticket_key(rlay->rl_tls_cfg,
		    env->sc_ticket.tt_keyrev,
		    env->sc_ticket.tt_key,
		    sizeof(env->sc_ticket.tt_key));
}
break;
default:
return (-1);
}

return (0);
2049}

2051int
2052relay_dispatch_hce(int fd, struct privsep_proc *p, struct imsg *imsg)
2053{
switch (imsg->hdr.type) {
default:
break;
}

return (-1);
2060}

2062static int
2063relay_tls_ctx_create_proto(struct protocol *proto, struct tls_config *tls_cfg)
2064{
uint32_t		 protocols = 0;

/* Set the allowed SSL protocols */
if (proto->tlsflags & TLSFLAG_TLSV1_00x02)
protocols |= TLS_PROTOCOL_TLSv1_0(1 << 1);
if (proto->tlsflags & TLSFLAG_TLSV1_10x04)
protocols |= TLS_PROTOCOL_TLSv1_1(1 << 2);
if (proto->tlsflags & TLSFLAG_TLSV1_20x08)
protocols |= TLS_PROTOCOL_TLSv1_2(1 << 3);
if (proto->tlsflags & TLSFLAG_TLSV1_30x10)
protocols |= TLS_PROTOCOL_TLSv1_3(1 << 4);
if (tls_config_set_protocols(tls_cfg, protocols) == -1) {
log_warnx("could not set the TLS protocol: %s",
    tls_config_error(tls_cfg));
return (-1);
}

if (tls_config_set_ciphers(tls_cfg, proto->tlsciphers)) {
log_warnx("could not set the TLS cypers: %s",
    tls_config_error(tls_cfg));
return (-1);
}

if ((proto->tlsflags & TLSFLAG_CIPHER_SERVER_PREF0x20) == 0)
tls_config_prefer_ciphers_client(tls_cfg);

/*
* Set session ID context to a random value. It needs to be the
* same accross all relay processes or session caching will fail.
*/
if (tls_config_set_session_id(tls_cfg, env->sc_conf.tls_sid,
   sizeof(env->sc_conf.tls_sid)) == -1) {
log_warnx("could not set the TLS session ID: %s",
    tls_config_error(tls_cfg));
return (-1);
}

/* Set callback for TLS session tickets if enabled */
if (proto->tickets == 1) {
/* set timeout to the ticket rekey time */
tls_config_set_session_lifetime(tls_cfg, TLS_SESSION_LIFETIME(2 * 3600));

tls_config_add_ticket_key(tls_cfg,
    env->sc_ticket.tt_keyrev, env->sc_ticket.tt_key,
    sizeof(env->sc_ticket.tt_key));
}

if (tls_config_set_ecdhecurves(tls_cfg, proto->tlsecdhecurves) != 0) {
log_warnx("failed to set ecdhe curves %s: %s",
    proto->tlsecdhecurves, tls_config_error(tls_cfg));
return (-1);
}

if (tls_config_set_dheparams(tls_cfg, proto->tlsdhparams) != 0) {
log_warnx("failed to set dh params %s: %s",
    proto->tlsdhparams, tls_config_error(tls_cfg));
return (-1);
}

return (0);
2125}

2127/*
* This function is not publicy exported because it is a hack until libtls
* has a proper privsep setup
*/
2131void tls_config_use_fake_private_key(struct tls_config *config);

2133int
2134relay_tls_ctx_create(struct relay *rlay)
2135{
struct tls_config	*tls_cfg, *tls_client_cfg;
struct tls		*tls = NULL((void*)0);
struct relay_cert	*cert;
int			 keyfound = 0;
char			*buf = NULL((void*)0), *cabuf = NULL((void*)0), *ocspbuf = NULL((void*)0);
off_t			 len = 0, calen = 0, ocsplen = 0;

if ((tls_cfg = tls_config_new()) == NULL((void*)0)) {
log_warnx("unable to allocate TLS config");
return (-1);
}
if ((tls_client_cfg = tls_config_new()) == NULL((void*)0)) {
log_warnx("unable to allocate TLS config");
return (-1);
}

if (relay_tls_ctx_create_proto(rlay->rl_proto, tls_cfg) == -1)
goto err;
if (relay_tls_ctx_create_proto(rlay->rl_proto, tls_client_cfg) == -1)
goto err;

/* Verify the server certificate if we have a CA chain */
if (rlay->rl_conf.flags & F_TLSCLIENT0x00200000) {
/*
 * Currently relayd can't verify the name of certs and changing
 * this is non trivial. For now just disable name verification.
 */
tls_config_insecure_noverifyname(tls_client_cfg);

if (rlay->rl_tls_ca_fd != -1) {
	if ((buf = relay_load_fd(rlay->rl_tls_ca_fd, &len)) ==
	    NULL((void*)0)) {
		log_warn("failed to read root certificates");
		goto err;
	}
	rlay->rl_tls_ca_fd = -1;

	if (tls_config_set_ca_mem(tls_client_cfg, buf, len) !=
	    0) {
		log_warnx("failed to set root certificates: %s",
		    tls_config_error(tls_client_cfg));
		goto err;
	}
	purge_key(&buf, len);
} else {
	/* No root cert available so disable the checking */
	tls_config_insecure_noverifycert(tls_client_cfg);
}

rlay->rl_tls_client_cfg = tls_client_cfg;
}

if (rlay->rl_conf.flags & F_TLS0x00000800) {
log_debug("%s: loading certificate", __func__);
/*
 * Use the public key as the "private" key - the secret key
 * parameters are hidden in an extra process that will be
 * contacted by the RSA engine.  The SSL/TLS library needs at
 * least the public key parameters in the current process.
 */
tls_config_use_fake_private_key(tls_cfg);

TAILQ_FOREACH(cert, env->sc_certs, cert_entry)for((cert) = ((env->sc_certs)->tqh_first); (cert) != ((
void*)0); (cert) = ((cert)->cert_entry.tqe_next)) {
	if (cert->cert_relayid != rlay->rl_conf.id ||
	    cert->cert_fd == -1)
		continue;
	keyfound++;

	if ((buf = relay_load_fd(cert->cert_fd,
	    &len)) == NULL((void*)0)) {
		log_warn("failed to load tls certificate");
		goto err;
	}
	cert->cert_fd = -1;

	if (cert->cert_ocsp_fd != -1 &&
	    (ocspbuf = relay_load_fd(cert->cert_ocsp_fd,
	    &ocsplen)) == NULL((void*)0)) {
		log_warn("failed to load OCSP staplefile");
		goto err;
	}
	if (ocsplen == 0)
		purge_key(&ocspbuf, ocsplen);
	cert->cert_ocsp_fd = -1;

	if (keyfound == 1 &&
	    tls_config_set_keypair_ocsp_mem(tls_cfg, buf, len,
	    NULL((void*)0), 0, ocspbuf, ocsplen) != 0) {
		log_warnx("failed to set tls certificate: %s",
		    tls_config_error(tls_cfg));
		goto err;
	}

	/* loading certificate public key */
	if (keyfound == 1 &&
	    !ssl_load_pkey(buf, len, NULL((void*)0), &rlay->rl_tls_pkey))
		goto err;

	if (tls_config_add_keypair_ocsp_mem(tls_cfg, buf, len,
	    NULL((void*)0), 0, ocspbuf, ocsplen) != 0) {
		log_warnx("failed to add tls certificate: %s",
		    tls_config_error(tls_cfg));
		goto err;
	}

	purge_key(&buf, len);
	purge_key(&ocspbuf, ocsplen);
}

if (rlay->rl_tls_cacert_fd != -1) {
	if ((cabuf = relay_load_fd(rlay->rl_tls_cacert_fd,
	    &calen)) == NULL((void*)0)) {
		log_warn("failed to load tls CA certificate");
		goto err;
	}
	log_debug("%s: loading CA certificate", __func__);
	if (!ssl_load_pkey(cabuf, calen,
	    &rlay->rl_tls_cacertx509, &rlay->rl_tls_capkey))
		goto err;
}
rlay->rl_tls_cacert_fd = -1;

tls = tls_server();
if (tls == NULL((void*)0)) {
	log_warnx("unable to allocate TLS context");
	goto err;
}
if (tls_configure(tls, tls_cfg) == -1) {
	log_warnx("could not configure the TLS context: %s",
	    tls_error(tls));
	tls_free(tls);
	goto err;
}
rlay->rl_tls_cfg = tls_cfg;
rlay->rl_tls_ctx = tls;

purge_key(&cabuf, calen);
}

if (rlay->rl_tls_client_cfg == NULL((void*)0))
tls_config_free(tls_client_cfg);
if (rlay->rl_tls_cfg == NULL((void*)0))
tls_config_free(tls_cfg);

return (0);
err:
purge_key(&ocspbuf, ocsplen);
purge_key(&cabuf, calen);
purge_key(&buf, len);

tls_config_free(tls_client_cfg);
tls_config_free(tls_cfg);
return (-1);
2289}

2291static struct tls *
2292relay_tls_inspect_create(struct relay *rlay, struct ctl_relay_event *cre)
2293{
struct tls_config	*tls_cfg;
struct tls		*tls = NULL((void*)0);

/* TLS inspection: use session-specific certificate */
if ((tls_cfg = tls_config_new()) == NULL((void*)0)) {
log_warnx("unable to allocate TLS config");
goto err;
}
if (relay_tls_ctx_create_proto(rlay->rl_proto, tls_cfg) == -1) {
/* error already printed */
goto err;
}

tls_config_use_fake_private_key(tls_cfg);

if (tls_config_set_keypair_ocsp_mem(tls_cfg,
   cre->tlscert, cre->tlscert_len, NULL((void*)0), 0, NULL((void*)0), 0) != 0) {
log_warnx("failed to set tls certificate: %s",
    tls_config_error(tls_cfg));
goto err;
}

tls = tls_server();
if (tls == NULL((void*)0)) {
log_warnx("unable to allocate TLS context");
goto err;
}
if (tls_configure(tls, tls_cfg) == -1) {
log_warnx("could not configure the TLS context: %s",
    tls_error(tls));
tls_free(tls);
goto err;
}

cre->tls_cfg = tls_cfg;
cre->tls_ctx = tls;
return (tls);
err:
tls_config_free(tls_cfg);
return (NULL((void*)0));
2334}

2336void
2337relay_tls_transaction(struct rsession *con, struct ctl_relay_event *cre)
2338{
struct relay		*rlay = con->se_relay;
struct tls		*tls_server;
const char		*errstr;
u_int			 flag;

if (cre->dir == RELAY_DIR_REQUEST) {
if (cre->tlscert != NULL((void*)0))
	tls_server = relay_tls_inspect_create(rlay, cre);
else
	tls_server = rlay->rl_tls_ctx;
if (tls_server == NULL((void*)0)) {
	errstr = "no TLS server context available";
	goto err;
}

if (tls_accept_socket(tls_server, &cre->tls, cre->s) == -1) {
	errstr = "could not accept the TLS connection";
	goto err;
}
flag = EV_READ0x02;
} else {
cre->tls = tls_client();
if (cre->tls == NULL((void*)0) ||
    tls_configure(cre->tls, rlay->rl_tls_client_cfg) == -1) {
	errstr = "could not configure the TLS client context";
	goto err;
}
if (tls_connect_socket(cre->tls, cre->s, NULL((void*)0)) == -1) {
	errstr = "could not connect the TLS connection";
	goto err;
}
flag = EV_WRITE0x04;
}

log_debug("%s: session %d: scheduling on %s", __func__, con->se_id,
   (flag == EV_READ0x02) ? "EV_READ" : "EV_WRITE");
event_again(&con->se_ev, cre->s, EV_TIMEOUT0x01|flag, relay_tls_handshake,
   &con->se_tv_start, &rlay->rl_conf.timeout, cre);
return;

err:
relay_close(con, errstr, 1);
2381}

2383void
2384relay_tls_handshake(int fd, short event, void *arg)
2385{
struct ctl_relay_event	*cre = arg;
struct rsession		*con = cre->con;
struct relay		*rlay = con->se_relay;
int			 retry_flag = 0;
int			 ret;
char			*msg;

if (event == EV_TIMEOUT0x01) {
1
Assuming 'event' is not equal to EV_TIMEOUT→
2
←
Taking false branch→
relay_close(con, "TLS handshake timeout", 1);
return;
}

ret = tls_handshake(cre->tls);
if (ret == 0) {
3
←
Assuming 'ret' is equal to 0→
4
←
Taking true branch→
2400#ifdef DEBUG
log_info(
2402#else
log_debug(
2404#endif
    "relay %s, tls session %d %s (%d active)",
    rlay->rl_conf.name, con->se_id,
    cre->dir == RELAY_DIR_REQUEST ? "established" : "connected",
5
←
Assuming field 'dir' is equal to RELAY_DIR_REQUEST→
6
←
'?' condition is true→
    relay_sessions);

if (cre->dir6.1
Field 'dir' is equal to RELAY_DIR_REQUEST
 == RELAY_DIR_REQUEST) {
7
←
Taking true branch→
	relay_session(con);
8
←
Calling 'relay_session'→
	return;
}

if (rlay->rl_conf.flags & F_TLSINSPECT0x04000000) {
	const uint8_t	*servercert;
	size_t		 len;

	servercert = tls_peer_cert_chain_pem(con->se_out.tls,
	    &len);
	if (servercert != NULL((void*)0)) {
		con->se_in.tlscert = ssl_update_certificate(
		    servercert, len,
		    rlay->rl_tls_pkey, rlay->rl_tls_capkey,
		    rlay->rl_tls_cacertx509,
		    &con->se_in.tlscert_len);
	} else
		con->se_in.tlscert = NULL((void*)0);
	if (con->se_in.tlscert == NULL((void*)0))
		relay_close(con,
		    "could not create certificate", 1);
	else
		relay_session(con);
	return;
}
relay_connected(fd, EV_WRITE0x04, con);
return;
} else if (ret == TLS_WANT_POLLIN-2) {
retry_flag = EV_READ0x02;
} else if (ret == TLS_WANT_POLLOUT-3) {
retry_flag = EV_WRITE0x04;
} else {
if (asprintf(&msg, "TLS handshake error: %s",
    tls_error(cre->tls)) >= 0) {
	relay_close(con, msg, 1);
	free(msg);
} else {
	relay_close(con, "TLS handshake error", 1);
}
return;
}

DPRINTF("%s: session %d: scheduling on %s", __func__, con->se_id,do {} while(0)
   (retry_flag == EV_READ) ? "EV_READ" : "EV_WRITE")do {} while(0);
event_again(&con->se_ev, fd, EV_TIMEOUT0x01|retry_flag, relay_tls_handshake,
   &con->se_tv_start, &rlay->rl_conf.timeout, cre);
2457}

2459void
2460relay_tls_connected(struct ctl_relay_event *cre)
2461{
/*
* Hack libevent - we overwrite the internal bufferevent I/O
* functions to handle the TLS abstraction.
*/
event_del(&cre->bev->ev_read);
event_del(&cre->bev->ev_write);

event_set(&cre->bev->ev_read, cre->s, EV_READ0x02,
   relay_tls_readcb, cre->bev);
event_set(&cre->bev->ev_write, cre->s, EV_WRITE0x04,
   relay_tls_writecb, cre->bev);
2473}

2475void
2476relay_tls_readcb(int fd, short event, void *arg)
2477{
char			 rbuf[IBUF_READ_SIZE65535];
struct bufferevent	*bufev = arg;
struct ctl_relay_event	*cre = bufev->cbarg;
short			 what = EVBUFFER_READ0x01;
int			 howmuch = IBUF_READ_SIZE65535;
ssize_t			 ret;
size_t			 len;

if (event == EV_TIMEOUT0x01) {
what |= EVBUFFER_TIMEOUT0x40;
goto err;
}

if (bufev->wm_read.high != 0)
howmuch = MINIMUM(sizeof(rbuf), bufev->wm_read.high)(((sizeof(rbuf)) < (bufev->wm_read.high)) ? (sizeof(rbuf
)) : (bufev->wm_read.high));

ret = tls_read(cre->tls, rbuf, howmuch);
if (ret == TLS_WANT_POLLIN-2 || ret == TLS_WANT_POLLOUT-3) {
goto retry;
} else if (ret == -1) {
what |= EVBUFFER_ERROR0x20;
goto err;
}
len = ret;

if (len == 0) {
what |= EVBUFFER_EOF0x10;
goto err;
}

if (evbuffer_add(bufev->input, rbuf, ret) == -1) {
what |= EVBUFFER_ERROR0x20;
goto err;
}

relay_bufferevent_add(&bufev->ev_read, bufev->timeout_read);

len = EVBUFFER_LENGTH(bufev->input)(bufev->input)->off;
if (bufev->wm_read.low != 0 && len < bufev->wm_read.low)
return;
if (bufev->wm_read.high != 0 && len > bufev->wm_read.high) {
struct evbuffer *buf = bufev->input;
event_del(&bufev->ev_read);
evbuffer_setcb(buf, bufferevent_read_pressure_cb, bufev);
return;
}

if (bufev->readcb != NULL((void*)0))
(*bufev->readcb)(bufev, bufev->cbarg);
return;

retry:
relay_bufferevent_add(&bufev->ev_read, bufev->timeout_read);
return;

err:
(*bufev->errorcb)(bufev, what, bufev->cbarg);
2535}

2537void
2538relay_tls_writecb(int fd, short event, void *arg)
2539{
struct bufferevent	*bufev = arg;
struct ctl_relay_event	*cre = bufev->cbarg;
ssize_t			 ret;
size_t			 len;
short			 what = EVBUFFER_WRITE0x02;

if (event == EV_TIMEOUT0x01) {
what |= EVBUFFER_TIMEOUT0x40;
goto err;
}

if (EVBUFFER_LENGTH(bufev->output)(bufev->output)->off) {
ret = tls_write(cre->tls, EVBUFFER_DATA(bufev->output)(bufev->output)->buffer,
    EVBUFFER_LENGTH(bufev->output)(bufev->output)->off);
if (ret == TLS_WANT_POLLIN-2 || ret == TLS_WANT_POLLOUT-3) {
	goto retry;
} else if (ret == -1) {
	what |= EVBUFFER_ERROR0x20;
	goto err;
}
len = ret;
evbuffer_drain(bufev->output, len);
}

if (EVBUFFER_LENGTH(bufev->output)(bufev->output)->off != 0)
relay_bufferevent_add(&bufev->ev_write, bufev->timeout_write);

if (bufev->writecb != NULL((void*)0) &&
   EVBUFFER_LENGTH(bufev->output)(bufev->output)->off <= bufev->wm_write.low)
(*bufev->writecb)(bufev, bufev->cbarg);
return;

retry:
relay_bufferevent_add(&bufev->ev_write, bufev->timeout_write);
return;

err:
(*bufev->errorcb)(bufev, what, bufev->cbarg);
2578}

2580int
2581relay_bufferevent_add(struct event *ev, int timeout)
2582{
struct timeval tv, *ptv = NULL((void*)0);

if (timeout) {
timerclear(&tv)(&tv)->tv_sec = (&tv)->tv_usec = 0;
tv.tv_sec = timeout;
ptv = &tv;
}

return (event_add(ev, ptv));
2592}

2594#ifdef notyet
2595int
2596relay_bufferevent_printf(struct ctl_relay_event *cre, const char *fmt, ...)
2597{
int	ret;
va_list	ap;

va_start(ap, fmt)__builtin_va_start(ap, fmt);
ret = evbuffer_add_vprintf(cre->output, fmt, ap);
va_end(ap)__builtin_va_end(ap);

if (cre->bev != NULL((void*)0) &&
   ret != -1 && EVBUFFER_LENGTH(cre->output)(cre->output)->off > 0 &&
   (cre->bev->enabled & EV_WRITE0x04))
bufferevent_enable(cre->bev, EV_WRITE0x04);

return (ret);
2611}
2612#endif

2614int
2615relay_bufferevent_print(struct ctl_relay_event *cre, const char *str)
2616{
if (cre->bev == NULL((void*)0))
return (evbuffer_add(cre->output, str, strlen(str)));
return (bufferevent_write(cre->bev, str, strlen(str)));
2620}

2622int
2623relay_bufferevent_write_buffer(struct ctl_relay_event *cre,
  struct evbuffer *buf)
2625{
if (cre->bev == NULL((void*)0))
return (evbuffer_add_buffer(cre->output, buf));
return (bufferevent_write_buffer(cre->bev, buf));
2629}

2631int
2632relay_bufferevent_write_chunk(struct ctl_relay_event *cre,
  struct evbuffer *buf, size_t size)
2634{
int ret;
ret = relay_bufferevent_write(cre, buf->buffer, size);
if (ret != -1)
evbuffer_drain(buf, size);
return (ret);
2640}

2642int
2643relay_bufferevent_write(struct ctl_relay_event *cre, void *data, size_t size)
2644{
if (cre->bev == NULL((void*)0))
return (evbuffer_add(cre->output, data, size));
return (bufferevent_write(cre->bev, data, size));
2648}

2650int
2651relay_cmp_af(struct sockaddr_storage *a, struct sockaddr_storage *b)
2652{
int			ret = -1;
struct sockaddr_in	ia, ib;
struct sockaddr_in6	ia6, ib6;

switch (a->ss_family) {
case AF_INET2:
bcopy(a, &ia, sizeof(struct sockaddr_in));
bcopy(b, &ib, sizeof(struct sockaddr_in));

ret = memcmp(&ia.sin_addr, &ib.sin_addr,
    sizeof(ia.sin_addr));
if (ret == 0)
	ret = memcmp(&ia.sin_port, &ib.sin_port,
	    sizeof(ia.sin_port));
break;
case AF_INET624:
bcopy(a, &ia6, sizeof(struct sockaddr_in6));
bcopy(b, &ib6, sizeof(struct sockaddr_in6));

ret = memcmp(&ia6.sin6_addr, &ib6.sin6_addr,
    sizeof(ia6.sin6_addr));
if (ret == 0)
	ret = memcmp(&ia6.sin6_port, &ib6.sin6_port,
	    sizeof(ia6.sin6_port));
break;
default:
break;
}

return (ret);
2683}

2685int
2686relay_session_cmp(struct rsession *a, struct rsession *b)
2687{
struct relay	*rlay = b->se_relay;
struct protocol	*proto = rlay->rl_proto;

if (proto != NULL((void*)0) && proto->cmp != NULL((void*)0))
return ((*proto->cmp)(a, b));

return ((int)a->se_id - b->se_id);
2695}

2697void
2698relay_log(struct rsession *con, char *msg)
2699{
if (con->se_haslog && con->se_log != NULL((void*)0)) {
evbuffer_add(con->se_log, msg, strlen(msg));
}
2703}

2705SPLAY_GENERATE(session_tree, rsession, se_nodes, relay_session_cmp)struct rsession * session_tree_SPLAY_INSERT(struct session_tree
 *head, struct rsession *elm) { if (((head)->sph_root == (
(void*)0))) { (elm)->se_nodes.spe_left = (elm)->se_nodes
.spe_right = ((void*)0); } else { int __comp; session_tree_SPLAY
(head, elm); __comp = (relay_session_cmp)(elm, (head)->sph_root
); if(__comp < 0) { (elm)->se_nodes.spe_left = ((head)->
sph_root)->se_nodes.spe_left; (elm)->se_nodes.spe_right
 = (head)->sph_root; ((head)->sph_root)->se_nodes.spe_left
 = ((void*)0); } else if (__comp > 0) { (elm)->se_nodes
.spe_right = ((head)->sph_root)->se_nodes.spe_right; (elm
)->se_nodes.spe_left = (head)->sph_root; ((head)->sph_root
)->se_nodes.spe_right = ((void*)0); } else return ((head)->
sph_root); } (head)->sph_root = (elm); return (((void*)0))
; } struct rsession * session_tree_SPLAY_REMOVE(struct session_tree
 *head, struct rsession *elm) { struct rsession *__tmp; if ((
(head)->sph_root == ((void*)0))) return (((void*)0)); session_tree_SPLAY
(head, elm); if ((relay_session_cmp)(elm, (head)->sph_root
) == 0) { if (((head)->sph_root)->se_nodes.spe_left == (
(void*)0)) { (head)->sph_root = ((head)->sph_root)->
se_nodes.spe_right; } else { __tmp = ((head)->sph_root)->
se_nodes.spe_right; (head)->sph_root = ((head)->sph_root
)->se_nodes.spe_left; session_tree_SPLAY(head, elm); ((head
)->sph_root)->se_nodes.spe_right = __tmp; } return (elm
); } return (((void*)0)); } void session_tree_SPLAY(struct session_tree
 *head, struct rsession *elm) { struct rsession __node, *__left
, *__right, *__tmp; int __comp; (&__node)->se_nodes.spe_left
 = (&__node)->se_nodes.spe_right = ((void*)0); __left =
 __right = &__node; while ((__comp = (relay_session_cmp)(
elm, (head)->sph_root))) { if (__comp < 0) { __tmp = ((
head)->sph_root)->se_nodes.spe_left; if (__tmp == ((void
*)0)) break; if ((relay_session_cmp)(elm, __tmp) < 0){ do {
 ((head)->sph_root)->se_nodes.spe_left = (__tmp)->se_nodes
.spe_right; (__tmp)->se_nodes.spe_right = (head)->sph_root
; (head)->sph_root = __tmp; } while (0); if (((head)->sph_root
)->se_nodes.spe_left == ((void*)0)) break; } do { (__right
)->se_nodes.spe_left = (head)->sph_root; __right = (head
)->sph_root; (head)->sph_root = ((head)->sph_root)->
se_nodes.spe_left; } while (0); } else if (__comp > 0) { __tmp
 = ((head)->sph_root)->se_nodes.spe_right; if (__tmp ==
 ((void*)0)) break; if ((relay_session_cmp)(elm, __tmp) > 0
){ do { ((head)->sph_root)->se_nodes.spe_right = (__tmp
)->se_nodes.spe_left; (__tmp)->se_nodes.spe_left = (head
)->sph_root; (head)->sph_root = __tmp; } while (0); if (
((head)->sph_root)->se_nodes.spe_right == ((void*)0)) break
; } do { (__left)->se_nodes.spe_right = (head)->sph_root
; __left = (head)->sph_root; (head)->sph_root = ((head)
->sph_root)->se_nodes.spe_right; } while (0); } } do { (
__left)->se_nodes.spe_right = ((head)->sph_root)->se_nodes
.spe_left; (__right)->se_nodes.spe_left = ((head)->sph_root
)->se_nodes.spe_right; ((head)->sph_root)->se_nodes.
spe_left = (&__node)->se_nodes.spe_right; ((head)->
sph_root)->se_nodes.spe_right = (&__node)->se_nodes
.spe_left; } while (0); } void session_tree_SPLAY_MINMAX(struct
 session_tree *head, int __comp) { struct rsession __node, *__left
, *__right, *__tmp; (&__node)->se_nodes.spe_left = (&
__node)->se_nodes.spe_right = ((void*)0); __left = __right
 = &__node; while (1) { if (__comp < 0) { __tmp = ((head
)->sph_root)->se_nodes.spe_left; if (__tmp == ((void*)0
)) break; if (__comp < 0){ do { ((head)->sph_root)->
se_nodes.spe_left = (__tmp)->se_nodes.spe_right; (__tmp)->
se_nodes.spe_right = (head)->sph_root; (head)->sph_root
 = __tmp; } while (0); if (((head)->sph_root)->se_nodes
.spe_left == ((void*)0)) break; } do { (__right)->se_nodes
.spe_left = (head)->sph_root; __right = (head)->sph_root
; (head)->sph_root = ((head)->sph_root)->se_nodes.spe_left
; } while (0); } else if (__comp > 0) { __tmp = ((head)->
sph_root)->se_nodes.spe_right; if (__tmp == ((void*)0)) break
; if (__comp > 0) { do { ((head)->sph_root)->se_nodes
.spe_right = (__tmp)->se_nodes.spe_left; (__tmp)->se_nodes
.spe_left = (head)->sph_root; (head)->sph_root = __tmp;
 } while (0); if (((head)->sph_root)->se_nodes.spe_right
 == ((void*)0)) break; } do { (__left)->se_nodes.spe_right
 = (head)->sph_root; __left = (head)->sph_root; (head)->
sph_root = ((head)->sph_root)->se_nodes.spe_right; } while
 (0); } } do { (__left)->se_nodes.spe_right = ((head)->
sph_root)->se_nodes.spe_left; (__right)->se_nodes.spe_left
 = ((head)->sph_root)->se_nodes.spe_right; ((head)->
sph_root)->se_nodes.spe_left = (&__node)->se_nodes.
spe_right; ((head)->sph_root)->se_nodes.spe_right = (&
__node)->se_nodes.spe_left; } while (0); };