src/socket-proxy/socket-proxyd.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <getopt.h>
   6 #include <netdb.h>
   7 #include <stdio.h>
   8 #include <stdlib.h>
   9 #include <sys/un.h>
  10 #include <unistd.h>
  11
  12 #include "sd-daemon.h"
  13 #include "sd-event.h"
  14 #include "sd-resolve.h"
  15
  16 #include "alloc-util.h"
  17 #include "errno-util.h"
  18 #include "fd-util.h"
  19 #include "log.h"
  20 #include "main-func.h"
  21 #include "parse-util.h"
  22 #include "path-util.h"
  23 #include "pretty-print.h"
  24 #include "resolve-private.h"
  25 #include "set.h"
  26 #include "socket-util.h"
  27 #include "string-util.h"
  28 #include "util.h"
  29
  30 #define BUFFER_SIZE (256 * 1024)
  31
  32 static unsigned arg_connections_max = 256;
  33 static const char *arg_remote_host = NULL;
  34 static usec_t arg_exit_idle_time = USEC_INFINITY;
  35
  36 typedef struct Context {
  37         sd_event *event;
  38         sd_resolve *resolve;
  39         sd_event_source *idle_time;
  40
  41         Set *listen;
  42         Set *connections;
  43 } Context;
  44
  45 typedef struct Connection {
  46         Context *context;
  47
  48         int server_fd, client_fd;
  49         int server_to_client_buffer[2]; /* a pipe */
  50         int client_to_server_buffer[2]; /* a pipe */
  51
  52         size_t server_to_client_buffer_full, client_to_server_buffer_full;
  53         size_t server_to_client_buffer_size, client_to_server_buffer_size;
  54
  55         sd_event_source *server_event_source, *client_event_source;
  56
  57         sd_resolve_query *resolve_query;
  58 } Connection;
  59
  60 static void connection_free(Connection *c) {
  61         assert(c);
  62
  63         if (c->context)
  64                 set_remove(c->context->connections, c);
  65
  66         sd_event_source_unref(c->server_event_source);
  67         sd_event_source_unref(c->client_event_source);
  68
  69         safe_close(c->server_fd);
  70         safe_close(c->client_fd);
  71
  72         safe_close_pair(c->server_to_client_buffer);
  73         safe_close_pair(c->client_to_server_buffer);
  74
  75         sd_resolve_query_unref(c->resolve_query);
  76
  77         free(c);
  78 }
  79
  80 static int idle_time_cb(sd_event_source *s, uint64_t usec, void *userdata) {
  81         Context *c = userdata;
  82         int r;
  83
  84         if (!set_isempty(c->connections)) {
  85                 log_warning("Idle timer fired even though there are connections, ignoring");
  86                 return 0;
  87         }
  88
  89         r = sd_event_exit(c->event, 0);
  90         if (r < 0) {
  91                 log_warning_errno(r, "Error while stopping event loop, ignoring: %m");
  92                 return 0;
  93         }
  94         return 0;
  95 }
  96
  97 static int connection_release(Connection *c) {
  98         Context *context = c->context;
  99         int r;
 100
 101         connection_free(c);
 102
 103         if (arg_exit_idle_time < USEC_INFINITY && set_isempty(context->connections)) {
 104                 if (context->idle_time) {
 105                         r = sd_event_source_set_time_relative(context->idle_time, arg_exit_idle_time);
 106                         if (r < 0)
 107                                 return log_error_errno(r, "Error while setting idle time: %m");
 108
 109                         r = sd_event_source_set_enabled(context->idle_time, SD_EVENT_ONESHOT);
 110                         if (r < 0)
 111                                 return log_error_errno(r, "Error while enabling idle time: %m");
 112                 } else {
 113                         r = sd_event_add_time_relative(
 114                                         context->event, &context->idle_time, CLOCK_MONOTONIC,
 115                                         arg_exit_idle_time, 0, idle_time_cb, context);
 116                         if (r < 0)
 117                                 return log_error_errno(r, "Failed to create idle timer: %m");
 118                 }
 119         }
 120
 121         return 0;
 122 }
 123
 124 static void context_clear(Context *context) {
 125         assert(context);
 126
 127         set_free_with_destructor(context->listen, sd_event_source_unref);
 128         set_free_with_destructor(context->connections, connection_free);
 129
 130         sd_event_unref(context->event);
 131         sd_resolve_unref(context->resolve);
 132         sd_event_source_unref(context->idle_time);
 133 }
 134
 135 static int connection_create_pipes(Connection *c, int buffer[static 2], size_t *sz) {
 136         int r;
 137
 138         assert(c);
 139         assert(buffer);
 140         assert(sz);
 141
 142         if (buffer[0] >= 0)
 143                 return 0;
 144
 145         r = pipe2(buffer, O_CLOEXEC|O_NONBLOCK);
 146         if (r < 0)
 147                 return log_error_errno(errno, "Failed to allocate pipe buffer: %m");
 148
 149         (void) fcntl(buffer[0], F_SETPIPE_SZ, BUFFER_SIZE);
 150
 151         r = fcntl(buffer[0], F_GETPIPE_SZ);
 152         if (r < 0)
 153                 return log_error_errno(errno, "Failed to get pipe buffer size: %m");
 154
 155         assert(r > 0);
 156         *sz = r;
 157
 158         return 0;
 159 }
 160
 161 static int connection_shovel(
 162                 Connection *c,
 163                 int *from, int buffer[2], int *to,
 164                 size_t *full, size_t *sz,
 165                 sd_event_source **from_source, sd_event_source **to_source) {
 166
 167         bool shoveled;
 168
 169         assert(c);
 170         assert(from);
 171         assert(buffer);
 172         assert(buffer[0] >= 0);
 173         assert(buffer[1] >= 0);
 174         assert(to);
 175         assert(full);
 176         assert(sz);
 177         assert(from_source);
 178         assert(to_source);
 179
 180         do {
 181                 ssize_t z;
 182
 183                 shoveled = false;
 184
 185                 if (*full < *sz && *from >= 0 && *to >= 0) {
 186                         z = splice(*from, NULL, buffer[1], NULL, *sz - *full, SPLICE_F_MOVE|SPLICE_F_NONBLOCK);
 187                         if (z > 0) {
 188                                 *full += z;
 189                                 shoveled = true;
 190                         } else if (z == 0 || ERRNO_IS_DISCONNECT(errno)) {
 191                                 *from_source = sd_event_source_unref(*from_source);
 192                                 *from = safe_close(*from);
 193                         } else if (!ERRNO_IS_TRANSIENT(errno))
 194                                 return log_error_errno(errno, "Failed to splice: %m");
 195                 }
 196
 197                 if (*full > 0 && *to >= 0) {
 198                         z = splice(buffer[0], NULL, *to, NULL, *full, SPLICE_F_MOVE|SPLICE_F_NONBLOCK);
 199                         if (z > 0) {
 200                                 *full -= z;
 201                                 shoveled = true;
 202                         } else if (z == 0 || ERRNO_IS_DISCONNECT(errno)) {
 203                                 *to_source = sd_event_source_unref(*to_source);
 204                                 *to = safe_close(*to);
 205                         } else if (!ERRNO_IS_TRANSIENT(errno))
 206                                 return log_error_errno(errno, "Failed to splice: %m");
 207                 }
 208         } while (shoveled);
 209
 210         return 0;
 211 }
 212
 213 static int connection_enable_event_sources(Connection *c);
 214
 215 static int traffic_cb(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
 216         Connection *c = ASSERT_PTR(userdata);
 217         int r;
 218
 219         assert(s);
 220         assert(fd >= 0);
 221
 222         r = connection_shovel(c,
 223                               &c->server_fd, c->server_to_client_buffer, &c->client_fd,
 224                               &c->server_to_client_buffer_full, &c->server_to_client_buffer_size,
 225                               &c->server_event_source, &c->client_event_source);
 226         if (r < 0)
 227                 goto quit;
 228
 229         r = connection_shovel(c,
 230                               &c->client_fd, c->client_to_server_buffer, &c->server_fd,
 231                               &c->client_to_server_buffer_full, &c->client_to_server_buffer_size,
 232                               &c->client_event_source, &c->server_event_source);
 233         if (r < 0)
 234                 goto quit;
 235
 236         /* EOF on both sides? */
 237         if (c->server_fd == -1 && c->client_fd == -1)
 238                 goto quit;
 239
 240         /* Server closed, and all data written to client? */
 241         if (c->server_fd == -1 && c->server_to_client_buffer_full <= 0)
 242                 goto quit;
 243
 244         /* Client closed, and all data written to server? */
 245         if (c->client_fd == -1 && c->client_to_server_buffer_full <= 0)
 246                 goto quit;
 247
 248         r = connection_enable_event_sources(c);
 249         if (r < 0)
 250                 goto quit;
 251
 252         return 1;
 253
 254 quit:
 255         connection_release(c);
 256         return 0; /* ignore errors, continue serving */
 257 }
 258
 259 static int connection_enable_event_sources(Connection *c) {
 260         uint32_t a = 0, b = 0;
 261         int r;
 262
 263         assert(c);
 264
 265         if (c->server_to_client_buffer_full > 0)
 266                 b |= EPOLLOUT;
 267         if (c->server_to_client_buffer_full < c->server_to_client_buffer_size)
 268                 a |= EPOLLIN;
 269
 270         if (c->client_to_server_buffer_full > 0)
 271                 a |= EPOLLOUT;
 272         if (c->client_to_server_buffer_full < c->client_to_server_buffer_size)
 273                 b |= EPOLLIN;
 274
 275         if (c->server_event_source)
 276                 r = sd_event_source_set_io_events(c->server_event_source, a);
 277         else if (c->server_fd >= 0)
 278                 r = sd_event_add_io(c->context->event, &c->server_event_source, c->server_fd, a, traffic_cb, c);
 279         else
 280                 r = 0;
 281
 282         if (r < 0)
 283                 return log_error_errno(r, "Failed to set up server event source: %m");
 284
 285         if (c->client_event_source)
 286                 r = sd_event_source_set_io_events(c->client_event_source, b);
 287         else if (c->client_fd >= 0)
 288                 r = sd_event_add_io(c->context->event, &c->client_event_source, c->client_fd, b, traffic_cb, c);
 289         else
 290                 r = 0;
 291
 292         if (r < 0)
 293                 return log_error_errno(r, "Failed to set up client event source: %m");
 294
 295         return 0;
 296 }
 297
 298 static int connection_complete(Connection *c) {
 299         int r;
 300
 301         assert(c);
 302
 303         r = connection_create_pipes(c, c->server_to_client_buffer, &c->server_to_client_buffer_size);
 304         if (r < 0)
 305                 goto fail;
 306
 307         r = connection_create_pipes(c, c->client_to_server_buffer, &c->client_to_server_buffer_size);
 308         if (r < 0)
 309                 goto fail;
 310
 311         r = connection_enable_event_sources(c);
 312         if (r < 0)
 313                 goto fail;
 314
 315         return 0;
 316
 317 fail:
 318         connection_release(c);
 319         return 0; /* ignore errors, continue serving */
 320 }
 321
 322 static int connect_cb(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
 323         Connection *c = ASSERT_PTR(userdata);
 324         socklen_t solen;
 325         int error, r;
 326
 327         assert(s);
 328         assert(fd >= 0);
 329
 330         solen = sizeof(error);
 331         r = getsockopt(fd, SOL_SOCKET, SO_ERROR, &error, &solen);
 332         if (r < 0) {
 333                 log_error_errno(errno, "Failed to issue SO_ERROR: %m");
 334                 goto fail;
 335         }
 336
 337         if (error != 0) {
 338                 log_error_errno(error, "Failed to connect to remote host: %m");
 339                 goto fail;
 340         }
 341
 342         c->client_event_source = sd_event_source_unref(c->client_event_source);
 343
 344         return connection_complete(c);
 345
 346 fail:
 347         connection_release(c);
 348         return 0; /* ignore errors, continue serving */
 349 }
 350
 351 static int connection_start(Connection *c, struct sockaddr *sa, socklen_t salen) {
 352         int r;
 353
 354         assert(c);
 355         assert(sa);
 356         assert(salen);
 357
 358         c->client_fd = socket(sa->sa_family, SOCK_STREAM|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
 359         if (c->client_fd < 0) {
 360                 log_error_errno(errno, "Failed to get remote socket: %m");
 361                 goto fail;
 362         }
 363
 364         r = connect(c->client_fd, sa, salen);
 365         if (r < 0) {
 366                 if (errno == EINPROGRESS) {
 367                         r = sd_event_add_io(c->context->event, &c->client_event_source, c->client_fd, EPOLLOUT, connect_cb, c);
 368                         if (r < 0) {
 369                                 log_error_errno(r, "Failed to add connection socket: %m");
 370                                 goto fail;
 371                         }
 372
 373                         r = sd_event_source_set_enabled(c->client_event_source, SD_EVENT_ONESHOT);
 374                         if (r < 0) {
 375                                 log_error_errno(r, "Failed to enable oneshot event source: %m");
 376                                 goto fail;
 377                         }
 378                 } else {
 379                         log_error_errno(errno, "Failed to connect to remote host: %m");
 380                         goto fail;
 381                 }
 382         } else {
 383                 r = connection_complete(c);
 384                 if (r < 0)
 385                         goto fail;
 386         }
 387
 388         return 0;
 389
 390 fail:
 391         connection_release(c);
 392         return 0; /* ignore errors, continue serving */
 393 }
 394
 395 static int resolve_handler(sd_resolve_query *q, int ret, const struct addrinfo *ai, Connection *c) {
 396         assert(q);
 397         assert(c);
 398
 399         if (ret != 0) {
 400                 log_error("Failed to resolve host: %s", gai_strerror(ret));
 401                 goto fail;
 402         }
 403
 404         c->resolve_query = sd_resolve_query_unref(c->resolve_query);
 405
 406         return connection_start(c, ai->ai_addr, ai->ai_addrlen);
 407
 408 fail:
 409         connection_release(c);
 410         return 0; /* ignore errors, continue serving */
 411 }
 412
 413 static int resolve_remote(Connection *c) {
 414
 415         static const struct addrinfo hints = {
 416                 .ai_family = AF_UNSPEC,
 417                 .ai_socktype = SOCK_STREAM,
 418         };
 419
 420         const char *node, *service;
 421         int r;
 422
 423         if (IN_SET(arg_remote_host[0], '/', '@')) {
 424                 union sockaddr_union sa;
 425                 int sa_len;
 426
 427                 r = sockaddr_un_set_path(&sa.un, arg_remote_host);
 428                 if (r < 0) {
 429                         log_error_errno(r, "Specified address doesn't fit in an AF_UNIX address, refusing: %m");
 430                         goto fail;
 431                 }
 432                 sa_len = r;
 433
 434                 return connection_start(c, &sa.sa, sa_len);
 435         }
 436
 437         service = strrchr(arg_remote_host, ':');
 438         if (service) {
 439                 node = strndupa_safe(arg_remote_host,
 440                                      service - arg_remote_host);
 441                 service++;
 442         } else {
 443                 node = arg_remote_host;
 444                 service = "80";
 445         }
 446
 447         log_debug("Looking up address info for %s:%s", node, service);
 448         r = resolve_getaddrinfo(c->context->resolve, &c->resolve_query, node, service, &hints, resolve_handler, NULL, c);
 449         if (r < 0) {
 450                 log_error_errno(r, "Failed to resolve remote host: %m");
 451                 goto fail;
 452         }
 453
 454         return 0;
 455
 456 fail:
 457         connection_release(c);
 458         return 0; /* ignore errors, continue serving */
 459 }
 460
 461 static int add_connection_socket(Context *context, int fd) {
 462         Connection *c;
 463         int r;
 464
 465         assert(context);
 466         assert(fd >= 0);
 467
 468         if (set_size(context->connections) > arg_connections_max) {
 469                 log_warning("Hit connection limit, refusing connection.");
 470                 safe_close(fd);
 471                 return 0;
 472         }
 473
 474         if (context->idle_time) {
 475                 r = sd_event_source_set_enabled(context->idle_time, SD_EVENT_OFF);
 476                 if (r < 0)
 477                         log_warning_errno(r, "Unable to disable idle timer, continuing: %m");
 478         }
 479
 480         c = new(Connection, 1);
 481         if (!c) {
 482                 log_oom();
 483                 return 0;
 484         }
 485
 486         *c = (Connection) {
 487                .context = context,
 488                .server_fd = fd,
 489                .client_fd = -1,
 490                .server_to_client_buffer = {-1, -1},
 491                .client_to_server_buffer = {-1, -1},
 492         };
 493
 494         r = set_ensure_put(&context->connections, NULL, c);
 495         if (r < 0) {
 496                 free(c);
 497                 log_oom();
 498                 return 0;
 499         }
 500
 501         return resolve_remote(c);
 502 }
 503
 504 static int accept_cb(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
 505         _cleanup_free_ char *peer = NULL;
 506         Context *context = ASSERT_PTR(userdata);
 507         int nfd = -1, r;
 508
 509         assert(s);
 510         assert(fd >= 0);
 511         assert(revents & EPOLLIN);
 512
 513         nfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK|SOCK_CLOEXEC);
 514         if (nfd < 0) {
 515                 if (!ERRNO_IS_ACCEPT_AGAIN(errno))
 516                         log_warning_errno(errno, "Failed to accept() socket: %m");
 517         } else {
 518                 (void) getpeername_pretty(nfd, true, &peer);
 519                 log_debug("New connection from %s", strna(peer));
 520
 521                 r = add_connection_socket(context, nfd);
 522                 if (r < 0) {
 523                         log_warning_errno(r, "Failed to accept connection, ignoring: %m");
 524                         safe_close(nfd);
 525                 }
 526         }
 527
 528         r = sd_event_source_set_enabled(s, SD_EVENT_ONESHOT);
 529         if (r < 0)
 530                 return log_error_errno(r, "Error while re-enabling listener with ONESHOT: %m");
 531
 532         return 1;
 533 }
 534
 535 static int add_listen_socket(Context *context, int fd) {
 536         sd_event_source *source;
 537         int r;
 538
 539         assert(context);
 540         assert(fd >= 0);
 541
 542         r = sd_is_socket(fd, 0, SOCK_STREAM, 1);
 543         if (r < 0)
 544                 return log_error_errno(r, "Failed to determine socket type: %m");
 545         if (r == 0)
 546                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 547                                        "Passed in socket is not a stream socket.");
 548
 549         r = fd_nonblock(fd, true);
 550         if (r < 0)
 551                 return log_error_errno(r, "Failed to mark file descriptor non-blocking: %m");
 552
 553         r = sd_event_add_io(context->event, &source, fd, EPOLLIN, accept_cb, context);
 554         if (r < 0)
 555                 return log_error_errno(r, "Failed to add event source: %m");
 556
 557         r = set_ensure_put(&context->listen, NULL, source);
 558         if (r < 0) {
 559                 sd_event_source_unref(source);
 560                 return log_error_errno(r, "Failed to add source to set: %m");
 561         }
 562
 563         r = sd_event_source_set_exit_on_failure(source, true);
 564         if (r < 0)
 565                 return log_error_errno(r, "Failed to enable exit-on-failure logic: %m");
 566
 567         /* Set the watcher to oneshot in case other processes are also
 568          * watching to accept(). */
 569         r = sd_event_source_set_enabled(source, SD_EVENT_ONESHOT);
 570         if (r < 0)
 571                 return log_error_errno(r, "Failed to enable oneshot mode: %m");
 572
 573         return 0;
 574 }
 575
 576 static int help(void) {
 577         _cleanup_free_ char *link = NULL;
 578         _cleanup_free_ char *time_link = NULL;
 579         int r;
 580
 581         r = terminal_urlify_man("systemd-socket-proxyd", "8", &link);
 582         if (r < 0)
 583                 return log_oom();
 584         r = terminal_urlify_man("systemd.time", "7", &time_link);
 585         if (r < 0)
 586                 return log_oom();
 587
 588         printf("%1$s [HOST:PORT]\n"
 589                "%1$s [SOCKET]\n\n"
 590                "Bidirectionally proxy local sockets to another (possibly remote) socket.\n\n"
 591                "  -c --connections-max=  Set the maximum number of connections to be accepted\n"
 592                "     --exit-idle-time=   Exit when without a connection for this duration. See\n"
 593                "                         the %3$s for time span format\n"
 594                "  -h --help              Show this help\n"
 595                "     --version           Show package version\n"
 596                "\nSee the %2$s for details.\n",
 597                program_invocation_short_name,
 598                link,
 599                time_link);
 600
 601         return 0;
 602 }
 603
 604 static int parse_argv(int argc, char *argv[]) {
 605
 606         enum {
 607                 ARG_VERSION = 0x100,
 608                 ARG_EXIT_IDLE,
 609                 ARG_IGNORE_ENV
 610         };
 611
 612         static const struct option options[] = {
 613                 { "connections-max", required_argument, NULL, 'c'           },
 614                 { "exit-idle-time",  required_argument, NULL, ARG_EXIT_IDLE },
 615                 { "help",            no_argument,       NULL, 'h'           },
 616                 { "version",         no_argument,       NULL, ARG_VERSION   },
 617                 {}
 618         };
 619
 620         int c, r;
 621
 622         assert(argc >= 0);
 623         assert(argv);
 624
 625         while ((c = getopt_long(argc, argv, "c:h", options, NULL)) >= 0)
 626
 627                 switch (c) {
 628
 629                 case 'h':
 630                         return help();
 631
 632                 case ARG_VERSION:
 633                         return version();
 634
 635                 case 'c':
 636                         r = safe_atou(optarg, &arg_connections_max);
 637                         if (r < 0) {
 638                                 log_error("Failed to parse --connections-max= argument: %s", optarg);
 639                                 return r;
 640                         }
 641
 642                         if (arg_connections_max < 1)
 643                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 644                                                        "Connection limit is too low.");
 645
 646                         break;
 647
 648                 case ARG_EXIT_IDLE:
 649                         r = parse_sec(optarg, &arg_exit_idle_time);
 650                         if (r < 0)
 651                                 return log_error_errno(r, "Failed to parse --exit-idle-time= argument: %s", optarg);
 652                         break;
 653
 654                 case '?':
 655                         return -EINVAL;
 656
 657                 default:
 658                         assert_not_reached();
 659                 }
 660
 661         if (optind >= argc)
 662                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 663                                        "Not enough parameters.");
 664
 665         if (argc != optind+1)
 666                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 667                                        "Too many parameters.");
 668
 669         arg_remote_host = argv[optind];
 670         return 1;
 671 }
 672
 673 static int run(int argc, char *argv[]) {
 674         _cleanup_(context_clear) Context context = {};
 675         int r, n, fd;
 676
 677         log_parse_environment();
 678         log_open();
 679
 680         r = parse_argv(argc, argv);
 681         if (r <= 0)
 682                 return r;
 683
 684         r = sd_event_default(&context.event);
 685         if (r < 0)
 686                 return log_error_errno(r, "Failed to allocate event loop: %m");
 687
 688         r = sd_resolve_default(&context.resolve);
 689         if (r < 0)
 690                 return log_error_errno(r, "Failed to allocate resolver: %m");
 691
 692         r = sd_resolve_attach_event(context.resolve, context.event, 0);
 693         if (r < 0)
 694                 return log_error_errno(r, "Failed to attach resolver: %m");
 695
 696         sd_event_set_watchdog(context.event, true);
 697
 698         r = sd_listen_fds(1);
 699         if (r < 0)
 700                 return log_error_errno(r, "Failed to receive sockets from parent.");
 701         if (r == 0)
 702                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Didn't get any sockets passed in.");
 703
 704         n = r;
 705
 706         for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + n; fd++) {
 707                 r = add_listen_socket(&context, fd);
 708                 if (r < 0)
 709                         return r;
 710         }
 711
 712         r = sd_event_loop(context.event);
 713         if (r < 0)
 714                 return log_error_errno(r, "Failed to run event loop: %m");
 715
 716         return 0;
 717 }
 718
 719 DEFINE_MAIN_FUNCTION(run);