source: code/icbd.c@ 8bf5a0a

Last change on this file since 8bf5a0a was 8bf5a0a, checked in by Mike Belopuhov <mike.belopuhov@…>, 15 years ago

no need for preprocessor here; add a comment also
  • Property mode set to 100644
File size: 10.3 KB
RevLine 
[cd7b81d]1/*
2 * Copyright (c) 2009 Mike Belopuhov
3 * Copyright (c) 2007 Oleg Safiullin
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#include <sys/types.h>
19#include <sys/queue.h>
20#include <sys/socket.h>
21#include <sys/stat.h>
22#include <netinet/in.h>
23#include <arpa/inet.h>
24#include <fcntl.h>
25#include <stdio.h>
26#include <stdlib.h>
27#include <unistd.h>
28#include <string.h>
29#include <sysexits.h>
30#include <syslog.h>
31#include <pwd.h>
32#include <login_cap.h>
33#include <locale.h>
34#include <netdb.h>
35#include <event.h>
36#include <errno.h>
37#include <err.h>
38
39#include "icb.h"
40#include "icbd.h"
41
42extern char *__progname;
43
44int creategroups;
45int foreground;
46int verbose;
47
48void usage(void);
49void getpeerinfo(struct icb_session *);
50void icbd_accept(int, short, void *);
51void icbd_drop(struct icb_session *, char *);
52void icbd_ioerr(struct bufferevent *, short, void *);
53void icbd_dispatch(struct bufferevent *, void *);
54void icbd_log(struct icb_session *, int, const char *, ...);
55void icbd_grplist(char *);
56void icbd_restrict(void);
57void icbd_write(struct icb_session *, char *, ssize_t);
58
[8bf5a0a]59/* event.h as it's shipped with OpenBSD doesn't include this prototype */
[1a5d69e]60void bufferevent_setwatermark(struct bufferevent *, short events,
61 size_t lowmark, size_t highmark);
62
[cd7b81d]63int
64main(int argc, char *argv[])
65{
66 struct icbd_callbacks ic = { icbd_drop, icbd_log, icbd_write };
67 const char *cause = NULL;
68 int ch, nsocks = 0, save_errno = 0;
69 int inet4 = 0, inet6 = 0;
70
71 /* init group lists before calling icb_addgroup */
72 icb_init(&ic);
73
74 while ((ch = getopt(argc, argv, "46CdG:v")) != -1)
75 switch (ch) {
76 case '4':
77 inet4++;
78 break;
79 case '6':
80 inet6++;
81 break;
82 case 'C':
83 creategroups++;
84 break;
85 case 'd':
86 foreground++;
87 break;
88 case 'G':
89 icbd_grplist(optarg);
90 break;
91 case 'v':
92 verbose++;
93 break;
94 default:
95 usage();
96 /* NOTREACHED */
97 }
98 argc -= optind;
99 argv += optind;
100
101 /* add group "1" as it's a login group for most of the clients */
102 if (icb_addgroup(NULL, "1", NULL) == NULL)
103 err(EX_UNAVAILABLE, NULL);
104
105 if (argc == 0)
106 argc++;
107
108 if (inet4 && inet6)
109 errx(EX_CONFIG, "Can't specify both -4 and -6");
110
111 tzset();
112 (void)setlocale(LC_ALL, "C");
113
114 if (foreground)
115 openlog("icbd", LOG_PID | LOG_PERROR, LOG_DAEMON);
116 else
117 openlog("icbd", LOG_PID | LOG_NDELAY, LOG_DAEMON);
118
119 if (!foreground && daemon(0, 0) < 0)
120 err(EX_OSERR, NULL);
121
122 (void)event_init();
123
124 for (ch = 0; ch < argc; ch++) {
125 struct addrinfo hints, *res, *res0;
126 struct event *ev;
127 char *addr, *port;
128 int error, s, on = 1;
129
130 addr = port = NULL;
131 if (argv[ch] != NULL) {
132 if (argv[ch][0] != ':')
133 addr = argv[ch];
134 if ((port = strrchr(argv[ch], ':')) != NULL)
135 *port++ = '\0';
136 }
137
138 bzero(&hints, sizeof hints);
139 if (inet4 || inet6)
140 hints.ai_family = inet4 ? PF_INET : PF_INET6;
141 else
142 hints.ai_family = PF_UNSPEC;
143 hints.ai_socktype = SOCK_STREAM;
144 hints.ai_flags = AI_PASSIVE;
145 if ((error = getaddrinfo(addr, port ? port : "icb", &hints,
146 &res0)) != 0) {
147 syslog(LOG_ERR, "%s", gai_strerror(error));
148 return (EX_UNAVAILABLE);
149 }
150
151 for (res = res0; res != NULL; res = res->ai_next) {
152 if ((s = socket(res->ai_family, res->ai_socktype,
153 res->ai_protocol)) < 0) {
154 cause = "socket";
155 save_errno = errno;
156 continue;
157 }
158
159 if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on,
160 sizeof on) < 0) {
161 cause = "SO_REUSEADDR";
162 save_errno = errno;
163 (void)close(s);
164 continue;
165 }
166
167 if (bind(s, res->ai_addr, res->ai_addrlen) < 0) {
168 cause = "bind";
169 save_errno = errno;
170 (void)close(s);
171 continue;
172 }
173
174 (void)listen(s, TCP_BACKLOG);
175
176 if ((ev = calloc(1, sizeof *ev)) == NULL)
177 err(EX_UNAVAILABLE, NULL);
178 event_set(ev, s, EV_READ | EV_PERSIST, icbd_accept, ev);
179 if (event_add(ev, NULL) < 0) {
180 syslog(LOG_ERR, "event_add: %m");
181 return (EX_UNAVAILABLE);
182 }
183
184 nsocks++;
185 }
186
187 freeaddrinfo(res0);
188 }
189
190 if (nsocks == 0) {
191 errno = save_errno;
192 syslog(LOG_ERR, "%s: %m", cause);
193 return (EX_UNAVAILABLE);
194 }
195
196 /* start a dns resolver thread */
197 icbd_dns_init();
198
199 if (!foreground)
200 icbd_restrict();
201
202 (void)signal(SIGPIPE, SIG_IGN);
203
204 (void)event_dispatch();
205
206 syslog(LOG_ERR, "event_dispatch: %m");
207
208 return (EX_UNAVAILABLE);
209}
210
211void
212icbd_dns(int fd, short event, void *arg)
213{
214 struct icb_session *is = arg;
215
216 if (event != EV_READ)
217 return;
218
219 if (verbose)
220 syslog(LOG_DEBUG, "icbd_dns");
221
222 if (read(fd, is->host, sizeof is->host) < 0)
223 syslog(LOG_ERR, "read: %m");
224
225 is->host[sizeof is->host - 1] = '\0';
226
227 if (verbose)
228 syslog(LOG_DEBUG, "icbd_dns: resolved %s", is->host);
229}
230
231void
232icbd_accept(int fd, short event __attribute__((__unused__)),
233 void *arg __attribute__((__unused__)))
234{
235 struct sockaddr_storage ss;
236 struct icb_session *is;
237 socklen_t ss_len = sizeof ss;
238 int s;
239
240 ss.ss_len = ss_len;
241 if ((s = accept(fd, (struct sockaddr *)&ss, &ss_len)) < 0) {
242 syslog(LOG_ERR, "accept: %m");
243 return;
244 }
245 if ((is = calloc(1, sizeof *is)) == NULL) {
246 syslog(LOG_ERR, "calloc: %m");
247 (void)close(s);
248 return;
249 }
250 if ((is->bev = bufferevent_new(s, icbd_dispatch, NULL, icbd_ioerr,
251 is)) == NULL) {
252 syslog(LOG_ERR, "bufferevent_new: %m");
253 (void)close(s);
254 free(is);
255 return;
256 }
257 if (bufferevent_enable(is->bev, EV_READ)) {
258 syslog(LOG_ERR, "bufferevent_enable: %m");
259 (void)close(s);
260 bufferevent_free(is->bev);
261 free(is);
262 return;
263 }
264
265 /* save host information */
266 getpeerinfo(is);
267
268 /* start icb conversation */
269 icb_start(is);
270}
271
272__dead void
273usage(void)
274{
275 (void)fprintf(stderr, "usage: %s [-46Cdv] [-G group1[,group2,...]] "
276 "[[addr][:port] ...]\n", __progname);
277 exit(EX_USAGE);
278}
279
280/*
281 * bufferevent functions
282 */
283
284void
285icbd_dispatch(struct bufferevent *bev, void *arg)
286{
287 struct icb_session *is = (struct icb_session *)arg;
288
289 if (is->length == 0) {
290 bzero(is->buffer, sizeof is->buffer);
291 /* read length */
292 (void)bufferevent_read(bev, is->buffer, 1);
293 /* we're about to read the whole packet */
294 is->length = (size_t)(unsigned char)is->buffer[0];
295 if (is->length == 0) {
296 icbd_drop(is, "invalid packet");
297 return;
298 }
299 if (EVBUFFER_LENGTH(EVBUFFER_INPUT(bev)) < is->length) {
300 /* set watermark to the expected length */
301 bufferevent_setwatermark(bev, EV_READ, is->length, 0);
302 return;
303 }
304 }
305 (void)bufferevent_read(bev, &is->buffer[1], is->length);
306#ifdef DEBUG
307 {
308 int i;
309
310 printf("-> read from %s:%d:\n", is->host, is->port);
311 for (i = 0; i < (int)is->length + 1; i++)
312 printf(" %02x", (unsigned char)is->buffer[i]);
313 printf("\n");
314 }
315#endif
316 icb_input(is);
317 is->length = 0;
318}
319
320void
321icbd_write(struct icb_session *is, char *buf, ssize_t size)
322{
323 if (bufferevent_write(is->bev, buf, size) == -1)
324 syslog(LOG_ERR, "bufferevent_write: %m");
325#ifdef DEBUG
326 {
327 int i;
328
329 printf("-> wrote to %s:%d:\n", is->host, is->port);
330 for (i = 0; i < size; i++)
331 printf(" %02x", (unsigned char)buf[i]);
332 printf("\n");
333 }
334#endif
335}
336
337void
338icbd_drop(struct icb_session *is, char *reason)
339{
340 if (reason) {
341 icb_remove(is, reason);
342 icbd_log(is, LOG_DEBUG, reason);
343 } else
344 icb_remove(is, NULL);
345 (void)evbuffer_write(EVBUFFER_OUTPUT(is->bev), EVBUFFER_FD(is->bev));
346 (void)close(EVBUFFER_FD(is->bev));
347 bufferevent_free(is->bev);
348 free(is);
349}
350
351void
352icbd_ioerr(struct bufferevent *bev __attribute__((__unused__)), short what,
353 void *arg)
354{
355 struct icb_session *is = (struct icb_session *)arg;
356
357 if (what & EVBUFFER_TIMEOUT)
358 icbd_drop(is, "timeout");
359 else if (what & EVBUFFER_EOF)
360 icbd_drop(is, NULL);
361 else if (what & EVBUFFER_ERROR)
362 icbd_drop(is, (what & EVBUFFER_READ) ? "read error" :
363 "write error");
364}
365
366void
367icbd_log(struct icb_session *is, int level, const char *fmt, ...)
368{
369 char buf[512];
370 va_list ap;
371
372 if (!verbose && level == LOG_DEBUG)
373 return;
374
375 va_start(ap, fmt);
376 (void)vsnprintf(buf, sizeof buf, fmt, ap);
377 va_end(ap);
378 if (is)
379 syslog(level, "%s:%u: %s", is->host, is->port, buf);
380 else
381 syslog(level, "%s", buf);
382}
383
384void
385icbd_restrict(void)
386{
387 struct stat sb;
388 struct passwd *pw;
389
390 if ((pw = getpwnam(ICBD_USER)) == NULL) {
391 syslog(LOG_ERR, "No passwd entry for %s", ICBD_USER);
392 exit(EX_NOUSER);
393 }
394
395 if (setusercontext(NULL, pw, pw->pw_uid,
396 LOGIN_SETALL & ~LOGIN_SETUSER) < 0) {
397 syslog(LOG_ERR, "%s: %m", pw->pw_name);
398 exit(EX_NOPERM);
399 }
400
401 if (stat(pw->pw_dir, &sb) == -1) {
402 syslog(LOG_ERR, "%s: %m", pw->pw_name);
403 exit(EX_NOPERM);
404 }
405
406 if (sb.st_uid != 0 || (sb.st_mode & (S_IWGRP|S_IWOTH)) != 0) {
407 syslog(LOG_ERR, "bad directory permissions");
408 exit(EX_NOPERM);
409 }
410
411 if (chroot(pw->pw_dir) < 0) {
412 syslog(LOG_ERR, "%s: %m", pw->pw_dir);
413 exit(EX_UNAVAILABLE);
414 }
415
416 if (setuid(pw->pw_uid) < 0) {
417 syslog(LOG_ERR, "%d: %m", pw->pw_uid);
418 exit(EX_NOPERM);
419 }
420
421 if (chdir("/") < 0) {
422 syslog(LOG_ERR, "/: %m");
423 exit(EX_UNAVAILABLE);
424 }
425
426 (void)setproctitle("icbd");
427}
428
429void
430icbd_grplist(char *list)
431{
432 char *s, *s1, *s2;
433 int last = 0;
434
435 if (!list || strlen(list) == 0)
436 return;
437
438 /* "group1[:pass1][,group2[:pass2],...]" */
439 s = list;
440 s1 = s2 = NULL;
441 while (!last && s) {
442 if ((s1 = strchr(s, ',')) != NULL)
443 *s1 = '\0';
444 else {
445 last = 1;
446 s1 = s;
447 }
448 if ((s2 = strchr(s, ':')) != NULL)
449 *s2 = '\0';
450 if (icb_addgroup(NULL, s, s2 ? ++s2 : NULL) == NULL)
451 err(EX_UNAVAILABLE, NULL);
452 s = ++s1;
453 s1 = s2 = NULL;
454 }
455}
456
457time_t
458getmonotime(void)
459{
460 struct timespec ts;
461
462 if (clock_gettime(CLOCK_MONOTONIC, &ts) != 0) {
463 syslog(LOG_ERR, "%m");
464 exit(EX_OSERR);
465 }
466 return (ts.tv_sec);
467}
468
469void
470getpeerinfo(struct icb_session *is)
471{
472 struct sockaddr_storage ss;
473 socklen_t ss_len = sizeof ss;
474
475 bzero(&ss, sizeof ss);
476 if (getpeername(EVBUFFER_FD(is->bev), (struct sockaddr *)&ss,
477 &ss_len) != 0)
478 return;
479
480 is->port = 0;
481 switch (ss.ss_family) {
482 case AF_INET:
483 is->port = ntohs(((struct sockaddr_in *)&ss)->sin_port);
484 break;
485
486 case AF_INET6:
487 is->port = ntohs(((struct sockaddr_in6 *)&ss)->sin6_port);
488 break;
489 }
490
491 dns_rresolv(is, &ss);
492}
Note: See TracBrowser for help on using the repository browser.