source: code/icbd.c@ 21477e9

Last change on this file since 21477e9 was e54f151, checked in by Stuart Henderson <stu@…>, 11 years ago

chdir(/) immediately after chroot
  • Property mode set to 100644
File size: 12.3 KB
RevLine 
[cd7b81d]1/*
2 * Copyright (c) 2009 Mike Belopuhov
3 * Copyright (c) 2007 Oleg Safiullin
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#include <sys/types.h>
19#include <sys/queue.h>
20#include <sys/socket.h>
21#include <sys/stat.h>
[fa271b8]22#include <sys/tree.h>
[c8c9ccf]23#include <netinet/in_systm.h>
[cd7b81d]24#include <netinet/in.h>
[c8c9ccf]25#include <netinet/ip.h>
[cd7b81d]26#include <arpa/inet.h>
27#include <fcntl.h>
28#include <stdio.h>
29#include <stdlib.h>
30#include <unistd.h>
31#include <string.h>
32#include <sysexits.h>
33#include <syslog.h>
34#include <pwd.h>
35#include <login_cap.h>
36#include <locale.h>
37#include <netdb.h>
38#include <event.h>
39#include <errno.h>
40#include <err.h>
41
42#include "icb.h"
43#include "icbd.h"
44
[fa271b8]45uint64_t sessionid;
[1d2125a]46char modtab[ICB_MTABLEN][ICB_MAXNICKLEN];
47int modtabcnt;
[a785c27]48char srvname[MAXHOSTNAMELEN];
49int creategroups;
50int foreground;
[3dba97d]51char logprefix[MAXPATHLEN/2];
52int dologging;
[a785c27]53int verbose;
[cd7b81d]54
55void usage(void);
56void getpeerinfo(struct icb_session *);
57void icbd_accept(int, short, void *);
58void icbd_drop(struct icb_session *, char *);
59void icbd_ioerr(struct bufferevent *, short, void *);
60void icbd_dispatch(struct bufferevent *, void *);
61void icbd_log(struct icb_session *, int, const char *, ...);
62void icbd_grplist(char *);
[1d2125a]63void icbd_modtab(char *);
[cd7b81d]64void icbd_restrict(void);
65void icbd_write(struct icb_session *, char *, ssize_t);
66
[fa271b8]67static inline int icbd_session_cmp(struct icb_session *, struct icb_session *);
68
69RB_HEAD(icbd_sessions, icb_session) icbd_sessions;
70RB_PROTOTYPE(icbd_sessions, icb_session, node, icbd_session_cmp);
71RB_GENERATE(icbd_sessions, icb_session, node, icbd_session_cmp);
72
[cd7b81d]73int
74main(int argc, char *argv[])
75{
76 struct icbd_callbacks ic = { icbd_drop, icbd_log, icbd_write };
77 const char *cause = NULL;
78 int ch, nsocks = 0, save_errno = 0;
79 int inet4 = 0, inet6 = 0;
80
[fa271b8]81 RB_INIT(&icbd_sessions);
82
[cd7b81d]83 /* init group lists before calling icb_addgroup */
84 icb_init(&ic);
85
[3dba97d]86 while ((ch = getopt(argc, argv, "46CdG:M:L:S:v")) != -1)
[cd7b81d]87 switch (ch) {
88 case '4':
89 inet4++;
90 break;
91 case '6':
92 inet6++;
93 break;
94 case 'C':
95 creategroups++;
96 break;
97 case 'd':
98 foreground++;
99 break;
100 case 'G':
101 icbd_grplist(optarg);
102 break;
[3dba97d]103 case 'L':
104 strlcpy(logprefix, optarg, sizeof logprefix);
105 dologging++;
106 break;
[1d2125a]107 case 'M':
108 icbd_modtab(optarg);
109 break;
[a785c27]110 case 'S':
111 strlcpy(srvname, optarg, sizeof srvname);
112 break;
[cd7b81d]113 case 'v':
114 verbose++;
115 break;
116 default:
117 usage();
118 /* NOTREACHED */
119 }
120 argc -= optind;
121 argv += optind;
122
123 /* add group "1" as it's a login group for most of the clients */
124 if (icb_addgroup(NULL, "1", NULL) == NULL)
125 err(EX_UNAVAILABLE, NULL);
126
127 if (argc == 0)
128 argc++;
129
130 if (inet4 && inet6)
[2e37e9f]131 errx(EX_USAGE, "Can't specify both -4 and -6");
[cd7b81d]132
133 tzset();
134 (void)setlocale(LC_ALL, "C");
135
136 if (foreground)
137 openlog("icbd", LOG_PID | LOG_PERROR, LOG_DAEMON);
138 else
139 openlog("icbd", LOG_PID | LOG_NDELAY, LOG_DAEMON);
140
141 if (!foreground && daemon(0, 0) < 0)
142 err(EX_OSERR, NULL);
143
144 (void)event_init();
145
146 for (ch = 0; ch < argc; ch++) {
147 struct addrinfo hints, *res, *res0;
148 struct event *ev;
149 char *addr, *port;
150 int error, s, on = 1;
151
152 addr = port = NULL;
153 if (argv[ch] != NULL) {
154 if (argv[ch][0] != ':')
155 addr = argv[ch];
156 if ((port = strrchr(argv[ch], ':')) != NULL)
157 *port++ = '\0';
158 }
159
160 bzero(&hints, sizeof hints);
161 if (inet4 || inet6)
162 hints.ai_family = inet4 ? PF_INET : PF_INET6;
163 else
164 hints.ai_family = PF_UNSPEC;
165 hints.ai_socktype = SOCK_STREAM;
166 hints.ai_flags = AI_PASSIVE;
167 if ((error = getaddrinfo(addr, port ? port : "icb", &hints,
168 &res0)) != 0) {
169 syslog(LOG_ERR, "%s", gai_strerror(error));
170 return (EX_UNAVAILABLE);
171 }
172
173 for (res = res0; res != NULL; res = res->ai_next) {
174 if ((s = socket(res->ai_family, res->ai_socktype,
175 res->ai_protocol)) < 0) {
176 cause = "socket";
177 save_errno = errno;
178 continue;
179 }
180
181 if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on,
182 sizeof on) < 0) {
183 cause = "SO_REUSEADDR";
184 save_errno = errno;
185 (void)close(s);
186 continue;
187 }
188
189 if (bind(s, res->ai_addr, res->ai_addrlen) < 0) {
190 cause = "bind";
191 save_errno = errno;
192 (void)close(s);
193 continue;
194 }
195
196 (void)listen(s, TCP_BACKLOG);
197
198 if ((ev = calloc(1, sizeof *ev)) == NULL)
199 err(EX_UNAVAILABLE, NULL);
200 event_set(ev, s, EV_READ | EV_PERSIST, icbd_accept, ev);
201 if (event_add(ev, NULL) < 0) {
202 syslog(LOG_ERR, "event_add: %m");
203 return (EX_UNAVAILABLE);
204 }
205
206 nsocks++;
207 }
208
209 freeaddrinfo(res0);
210 }
211
212 if (nsocks == 0) {
213 errno = save_errno;
214 syslog(LOG_ERR, "%s: %m", cause);
215 return (EX_UNAVAILABLE);
216 }
217
[55923b7]218 /* start the logger service */
219 logger_init();
220
[cd7b81d]221 /* start a dns resolver thread */
[b4049f9]222 dns_init();
[cd7b81d]223
224 if (!foreground)
225 icbd_restrict();
226
227 (void)signal(SIGPIPE, SIG_IGN);
228
229 (void)event_dispatch();
230
231 syslog(LOG_ERR, "event_dispatch: %m");
232
233 return (EX_UNAVAILABLE);
234}
235
[fa271b8]236static inline int
237icbd_session_cmp(struct icb_session *a, struct icb_session *b)
238{
239 if (a->id > b->id)
240 return (1);
241 if (a->id < b->id)
242 return (-1);
243 return (0);
244}
245
246inline struct icb_session *
247icbd_session_lookup(uint64_t sid)
248{
249 struct icb_session key;
250
251 key.id = sid;
252 return (RB_FIND(icbd_sessions, &icbd_sessions, &key));
253}
254
[cd7b81d]255void
256icbd_accept(int fd, short event __attribute__((__unused__)),
257 void *arg __attribute__((__unused__)))
258{
259 struct sockaddr_storage ss;
260 struct icb_session *is;
261 socklen_t ss_len = sizeof ss;
[8ef8c4e]262 int s, on = 1, tos = IPTOS_LOWDELAY;
[cd7b81d]263
264 ss.ss_len = ss_len;
265 if ((s = accept(fd, (struct sockaddr *)&ss, &ss_len)) < 0) {
266 syslog(LOG_ERR, "accept: %m");
267 return;
268 }
[c8c9ccf]269 if (ss.ss_family == AF_INET)
270 if (setsockopt(s, IPPROTO_IP, IP_TOS, &tos, sizeof tos) < 0)
271 syslog(LOG_WARNING, "IP_TOS: %m");
[8ef8c4e]272 if (setsockopt(s, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof on) < 0)
273 syslog(LOG_WARNING, "SO_KEEPALIVE: %m");
[cd7b81d]274 if ((is = calloc(1, sizeof *is)) == NULL) {
275 syslog(LOG_ERR, "calloc: %m");
276 (void)close(s);
277 return;
278 }
279 if ((is->bev = bufferevent_new(s, icbd_dispatch, NULL, icbd_ioerr,
280 is)) == NULL) {
281 syslog(LOG_ERR, "bufferevent_new: %m");
282 (void)close(s);
283 free(is);
284 return;
285 }
286 if (bufferevent_enable(is->bev, EV_READ)) {
287 syslog(LOG_ERR, "bufferevent_enable: %m");
288 (void)close(s);
289 bufferevent_free(is->bev);
290 free(is);
291 return;
292 }
293
[fa271b8]294 is->id = sessionid++;
295 RB_INSERT(icbd_sessions, &icbd_sessions, is);
296
[cd7b81d]297 /* save host information */
298 getpeerinfo(is);
299
300 /* start icb conversation */
301 icb_start(is);
302}
303
304__dead void
305usage(void)
306{
[3dba97d]307 extern char *__progname;
308
[cd7b81d]309 (void)fprintf(stderr, "usage: %s [-46Cdv] [-G group1[,group2,...]] "
[3dba97d]310 "[-L prefix] [-M modtab]\n\t[-S name] [[addr][:port] ...]\n",
311 __progname);
[cd7b81d]312 exit(EX_USAGE);
313}
314
315/*
316 * bufferevent functions
317 */
318
319void
320icbd_dispatch(struct bufferevent *bev, void *arg)
321{
322 struct icb_session *is = (struct icb_session *)arg;
323
[c9402c3]324 while (EVBUFFER_LENGTH(EVBUFFER_INPUT(bev)) > 0) {
[cd7b81d]325 if (is->length == 0) {
[c9402c3]326 /* read length */
327 is->rlen = bufferevent_read(bev, is->buffer, 1);
328 is->length = (size_t)(unsigned char)is->buffer[0];
329 if (is->length == 0) {
330 icbd_drop(is, "invalid packet");
331 return;
332 }
[cd7b81d]333 }
[c9402c3]334 /* read as much as we can */
335 is->rlen += bufferevent_read(bev, &is->buffer[is->rlen],
336 is->length);
[cd7b81d]337#ifdef DEBUG
[c9402c3]338 {
339 int i;
340
341 printf("-> read %lu out of %lu from %s:%d:\n",
342 is->rlen, is->length, is->host, is->port);
343 for (i = 0; i < (int)is->rlen; i++)
344 printf(" %02x", (unsigned char)is->buffer[i]);
345 printf("\n");
346 }
[cd7b81d]347#endif
[c9402c3]348 /* see you next time around */
349 if (is->rlen < is->length)
350 return;
351 /* process the message in full */
352 icb_input(is);
353 is->rlen = is->length = 0;
354 }
[cd7b81d]355}
356
357void
358icbd_write(struct icb_session *is, char *buf, ssize_t size)
359{
360 if (bufferevent_write(is->bev, buf, size) == -1)
361 syslog(LOG_ERR, "bufferevent_write: %m");
362#ifdef DEBUG
363 {
364 int i;
365
[c9402c3]366 printf("-> wrote %lu to %s:%d:\n", size, is->host, is->port);
[cd7b81d]367 for (i = 0; i < size; i++)
368 printf(" %02x", (unsigned char)buf[i]);
369 printf("\n");
370 }
371#endif
372}
373
374void
375icbd_drop(struct icb_session *is, char *reason)
376{
377 if (reason) {
378 icb_remove(is, reason);
379 icbd_log(is, LOG_DEBUG, reason);
380 } else
381 icb_remove(is, NULL);
382 (void)evbuffer_write(EVBUFFER_OUTPUT(is->bev), EVBUFFER_FD(is->bev));
383 (void)close(EVBUFFER_FD(is->bev));
384 bufferevent_free(is->bev);
[fa271b8]385 RB_REMOVE(icbd_sessions, &icbd_sessions, is);
[cd7b81d]386 free(is);
387}
388
389void
390icbd_ioerr(struct bufferevent *bev __attribute__((__unused__)), short what,
391 void *arg)
392{
393 struct icb_session *is = (struct icb_session *)arg;
394
395 if (what & EVBUFFER_TIMEOUT)
396 icbd_drop(is, "timeout");
397 else if (what & EVBUFFER_EOF)
398 icbd_drop(is, NULL);
399 else if (what & EVBUFFER_ERROR)
400 icbd_drop(is, (what & EVBUFFER_READ) ? "read error" :
401 "write error");
402}
403
404void
405icbd_log(struct icb_session *is, int level, const char *fmt, ...)
406{
407 char buf[512];
408 va_list ap;
409
410 if (!verbose && level == LOG_DEBUG)
411 return;
412
413 va_start(ap, fmt);
414 (void)vsnprintf(buf, sizeof buf, fmt, ap);
415 va_end(ap);
416 if (is)
417 syslog(level, "%s:%u: %s", is->host, is->port, buf);
418 else
419 syslog(level, "%s", buf);
420}
421
422void
423icbd_restrict(void)
424{
425 struct stat sb;
426 struct passwd *pw;
427
428 if ((pw = getpwnam(ICBD_USER)) == NULL) {
429 syslog(LOG_ERR, "No passwd entry for %s", ICBD_USER);
430 exit(EX_NOUSER);
431 }
432
433 if (setusercontext(NULL, pw, pw->pw_uid,
[d554223]434 LOGIN_SETALL & ~LOGIN_SETUSER) < 0)
[cd7b81d]435 exit(EX_NOPERM);
436
437 if (stat(pw->pw_dir, &sb) == -1) {
438 syslog(LOG_ERR, "%s: %m", pw->pw_name);
439 exit(EX_NOPERM);
440 }
441
442 if (sb.st_uid != 0 || (sb.st_mode & (S_IWGRP|S_IWOTH)) != 0) {
443 syslog(LOG_ERR, "bad directory permissions");
444 exit(EX_NOPERM);
445 }
446
447 if (chroot(pw->pw_dir) < 0) {
448 syslog(LOG_ERR, "%s: %m", pw->pw_dir);
449 exit(EX_UNAVAILABLE);
450 }
451
452 if (chdir("/") < 0) {
453 syslog(LOG_ERR, "/: %m");
454 exit(EX_UNAVAILABLE);
455 }
456
[e54f151]457 if (setuid(pw->pw_uid) < 0) {
458 syslog(LOG_ERR, "%d: %m", pw->pw_uid);
459 exit(EX_NOPERM);
460 }
461
[cd7b81d]462 (void)setproctitle("icbd");
463}
464
465void
466icbd_grplist(char *list)
467{
468 char *s, *s1, *s2;
469 int last = 0;
470
471 if (!list || strlen(list) == 0)
472 return;
473
474 /* "group1[:pass1][,group2[:pass2],...]" */
475 s = list;
476 s1 = s2 = NULL;
477 while (!last && s) {
478 if ((s1 = strchr(s, ',')) != NULL)
479 *s1 = '\0';
480 else {
481 last = 1;
482 s1 = s;
483 }
484 if ((s2 = strchr(s, ':')) != NULL)
485 *s2 = '\0';
486 if (icb_addgroup(NULL, s, s2 ? ++s2 : NULL) == NULL)
487 err(EX_UNAVAILABLE, NULL);
488 s = ++s1;
489 s1 = s2 = NULL;
490 }
491}
492
[1d2125a]493void
494icbd_modtab(char *mtab)
495{
496 FILE *fp;
497 char *buf, *lbuf;
498 size_t len;
499
500 if ((fp = fopen(mtab, "r")) == NULL)
501 err(EX_NOINPUT, "%s", mtab);
502
503 bzero(modtab, ICB_MTABLEN * ICB_MAXNICKLEN);
504 lbuf = NULL;
505 while ((buf = fgetln(fp, &len)) && modtabcnt < ICB_MTABLEN) {
506 if (buf[len - 1] == '\n')
507 buf[len - 1] = '\0';
508 else {
509 /* EOF without EOL, copy and add the NUL */
510 if ((lbuf = malloc(len + 1)) == NULL)
511 err(1, NULL);
512 memcpy(lbuf, buf, len);
513 lbuf[len] = '\0';
514 buf = lbuf;
515 }
516 while (buf[0] == ' ' || buf[0] == '\t')
517 buf++;
518 if (buf[0] == '#' || buf[0] == '\0')
519 continue;
520 strlcpy(modtab[modtabcnt++], buf, ICB_MAXNICKLEN);
521 }
522 free(lbuf);
523
524 qsort(modtab, modtabcnt, ICB_MAXNICKLEN,
525 (int (*)(const void *, const void *))strcmp);
526
527 fclose(fp);
528}
529
[cd7b81d]530time_t
531getmonotime(void)
532{
533 struct timespec ts;
534
535 if (clock_gettime(CLOCK_MONOTONIC, &ts) != 0) {
536 syslog(LOG_ERR, "%m");
537 exit(EX_OSERR);
538 }
539 return (ts.tv_sec);
540}
541
542void
543getpeerinfo(struct icb_session *is)
544{
545 struct sockaddr_storage ss;
[b4049f9]546 struct sockaddr_in *sin = (struct sockaddr_in *)&ss;
547 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&ss;
[cd7b81d]548 socklen_t ss_len = sizeof ss;
549
550 bzero(&ss, sizeof ss);
551 if (getpeername(EVBUFFER_FD(is->bev), (struct sockaddr *)&ss,
552 &ss_len) != 0)
553 return;
554
555 is->port = 0;
556 switch (ss.ss_family) {
557 case AF_INET:
[b4049f9]558 is->port = ntohs(sin->sin_port);
[cd7b81d]559 break;
560
561 case AF_INET6:
[b4049f9]562 is->port = ntohs(sin6->sin6_port);
[cd7b81d]563 break;
564 }
565
[b4049f9]566 inet_ntop(ss.ss_family, ss.ss_family == AF_INET ?
567 (void *)&sin->sin_addr : (void *)&sin6->sin6_addr,
568 is->host, sizeof is->host);
569
[cd7b81d]570 dns_rresolv(is, &ss);
571}
Note: See TracBrowser for help on using the repository browser.