source: code/icbd.c@ e26e899

Last change on this file since e26e899 was 4c07461, checked in by Mike Belopuhov <mike@…>, 8 years ago

setusercontext(3) conflicts with rc.d framework
  • Property mode set to 100644
File size: 13.1 KB
RevLine 
[cd7b81d]1/*
2 * Copyright (c) 2009 Mike Belopuhov
3 * Copyright (c) 2007 Oleg Safiullin
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#include <sys/types.h>
19#include <sys/queue.h>
20#include <sys/socket.h>
21#include <sys/stat.h>
[c8c9ccf]22#include <netinet/in_systm.h>
[cd7b81d]23#include <netinet/in.h>
[c8c9ccf]24#include <netinet/ip.h>
[cd7b81d]25#include <arpa/inet.h>
26#include <fcntl.h>
[d27dc1e]27#include <limits.h>
28#include <signal.h>
[cd7b81d]29#include <stdio.h>
30#include <stdlib.h>
31#include <unistd.h>
32#include <string.h>
33#include <sysexits.h>
34#include <syslog.h>
35#include <pwd.h>
36#include <locale.h>
[3347cd9]37#include <ctype.h>
[cd7b81d]38#include <netdb.h>
39#include <event.h>
40#include <errno.h>
41#include <err.h>
[e87ab6d]42#include <resolv.h>
[cd7b81d]43
44#include "icb.h"
45#include "icbd.h"
46
[82d3c1f]47struct stat modtabst;
[d27dc1e]48char modtabpath[PATH_MAX];
[1d2125a]49char modtab[ICB_MTABLEN][ICB_MAXNICKLEN];
50int modtabcnt;
[d27dc1e]51char srvname[NI_MAXHOST];
[a785c27]52int creategroups;
53int foreground;
[d27dc1e]54char logprefix[PATH_MAX/2];
[460786f]55int dodns = 1;
[3dba97d]56int dologging;
[a785c27]57int verbose;
[cd7b81d]58
59void usage(void);
60void getpeerinfo(struct icb_session *);
61void icbd_accept(int, short, void *);
[6e89d69]62void icbd_paused(int, short, void *);
[cd7b81d]63void icbd_drop(struct icb_session *, char *);
64void icbd_ioerr(struct bufferevent *, short, void *);
65void icbd_dispatch(struct bufferevent *, void *);
66void icbd_log(struct icb_session *, int, const char *, ...);
67void icbd_restrict(void);
[7882a6f]68void icbd_send(struct icb_session *, char *, ssize_t);
[cd7b81d]69
[6e89d69]70struct icbd_listener {
71 struct event ev, pause;
72};
73
[cd7b81d]74int
75main(int argc, char *argv[])
76{
77 const char *cause = NULL;
78 int ch, nsocks = 0, save_errno = 0;
79 int inet4 = 0, inet6 = 0;
[677a45b]80 char group[ICB_MAXGRPLEN], *grplist = NULL;
81 char *ptr = NULL;
[cd7b81d]82
83 /* init group lists before calling icb_addgroup */
[7882a6f]84 icb_init();
[cd7b81d]85
[460786f]86 while ((ch = getopt(argc, argv, "46CdG:M:nL:S:v")) != -1)
[cd7b81d]87 switch (ch) {
88 case '4':
89 inet4++;
90 break;
91 case '6':
92 inet6++;
93 break;
94 case 'C':
95 creategroups++;
96 break;
97 case 'd':
98 foreground++;
99 break;
100 case 'G':
[677a45b]101 grplist = optarg;
[cd7b81d]102 break;
[3dba97d]103 case 'L':
104 strlcpy(logprefix, optarg, sizeof logprefix);
105 dologging++;
106 break;
[1d2125a]107 case 'M':
[270fd23]108 strlcpy(modtabpath, optarg, sizeof modtabpath);
[1d2125a]109 break;
[460786f]110 case 'n':
111 dodns = 0;
112 break;
[a785c27]113 case 'S':
114 strlcpy(srvname, optarg, sizeof srvname);
115 break;
[cd7b81d]116 case 'v':
117 verbose++;
118 break;
119 default:
120 usage();
121 /* NOTREACHED */
122 }
123 argc -= optind;
124 argv += optind;
125
126 /* add group "1" as it's a login group for most of the clients */
[677a45b]127 if (icb_addgroup(NULL, "1") == NULL)
[cd7b81d]128 err(EX_UNAVAILABLE, NULL);
129
[677a45b]130 if (grplist) {
131 while (icb_token(grplist, strlen(grplist), &ptr, group,
[176b6ef]132 ICB_MAXGRPLEN, ',', 0) > 0)
[677a45b]133 if (icb_addgroup(NULL, group) == NULL)
134 err(EX_UNAVAILABLE, NULL);
135 }
136
[cd7b81d]137 if (argc == 0)
138 argc++;
139
140 if (inet4 && inet6)
[2e37e9f]141 errx(EX_USAGE, "Can't specify both -4 and -6");
[cd7b81d]142
143 tzset();
144 (void)setlocale(LC_ALL, "C");
145
146 if (foreground)
147 openlog("icbd", LOG_PID | LOG_PERROR, LOG_DAEMON);
148 else
149 openlog("icbd", LOG_PID | LOG_NDELAY, LOG_DAEMON);
150
151 if (!foreground && daemon(0, 0) < 0)
152 err(EX_OSERR, NULL);
153
154 (void)event_init();
155
156 for (ch = 0; ch < argc; ch++) {
157 struct addrinfo hints, *res, *res0;
[6e89d69]158 struct icbd_listener *l;
[cd7b81d]159 char *addr, *port;
160 int error, s, on = 1;
161
162 addr = port = NULL;
163 if (argv[ch] != NULL) {
164 if (argv[ch][0] != ':')
165 addr = argv[ch];
166 if ((port = strrchr(argv[ch], ':')) != NULL)
167 *port++ = '\0';
168 }
169
170 bzero(&hints, sizeof hints);
171 if (inet4 || inet6)
172 hints.ai_family = inet4 ? PF_INET : PF_INET6;
173 else
174 hints.ai_family = PF_UNSPEC;
175 hints.ai_socktype = SOCK_STREAM;
176 hints.ai_flags = AI_PASSIVE;
177 if ((error = getaddrinfo(addr, port ? port : "icb", &hints,
178 &res0)) != 0) {
179 syslog(LOG_ERR, "%s", gai_strerror(error));
180 return (EX_UNAVAILABLE);
181 }
182
183 for (res = res0; res != NULL; res = res->ai_next) {
184 if ((s = socket(res->ai_family, res->ai_socktype,
185 res->ai_protocol)) < 0) {
186 cause = "socket";
187 save_errno = errno;
188 continue;
189 }
190
191 if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on,
192 sizeof on) < 0) {
193 cause = "SO_REUSEADDR";
194 save_errno = errno;
195 (void)close(s);
196 continue;
197 }
198
199 if (bind(s, res->ai_addr, res->ai_addrlen) < 0) {
200 cause = "bind";
201 save_errno = errno;
202 (void)close(s);
203 continue;
204 }
205
206 (void)listen(s, TCP_BACKLOG);
207
[6e89d69]208 if ((l = calloc(1, sizeof *l)) == NULL)
[cd7b81d]209 err(EX_UNAVAILABLE, NULL);
[bacf9da]210 event_set(&l->ev, s, EV_READ | EV_PERSIST,
211 icbd_accept, l);
[6e89d69]212 if (event_add(&l->ev, NULL) < 0) {
[cd7b81d]213 syslog(LOG_ERR, "event_add: %m");
214 return (EX_UNAVAILABLE);
215 }
[6e89d69]216 evtimer_set(&l->pause, icbd_paused, l);
[cd7b81d]217
218 nsocks++;
219 }
220
221 freeaddrinfo(res0);
222 }
223
224 if (nsocks == 0) {
225 errno = save_errno;
226 syslog(LOG_ERR, "%s: %m", cause);
227 return (EX_UNAVAILABLE);
228 }
229
[55923b7]230 /* start the logger service */
231 logger_init();
232
[e87ab6d]233 /* initialize resolver */
234 res_init();
[cd7b81d]235
[67f3e60]236 icbd_restrict();
[cd7b81d]237
[82d3c1f]238 icbd_modupdate();
239
[cd7b81d]240 (void)signal(SIGPIPE, SIG_IGN);
241
242 (void)event_dispatch();
243
244 syslog(LOG_ERR, "event_dispatch: %m");
245
246 return (EX_UNAVAILABLE);
247}
248
249void
250icbd_accept(int fd, short event __attribute__((__unused__)),
[6e89d69]251 void *arg)
[cd7b81d]252{
[6e89d69]253 struct icbd_listener *l = arg;
[cd7b81d]254 struct sockaddr_storage ss;
[6e89d69]255 struct timeval p = { 1, 0 };
[cd7b81d]256 struct icb_session *is;
257 socklen_t ss_len = sizeof ss;
[8ef8c4e]258 int s, on = 1, tos = IPTOS_LOWDELAY;
[cd7b81d]259
260 ss.ss_len = ss_len;
[6e89d69]261 s = accept(fd, (struct sockaddr *)&ss, &ss_len);
262 if (s == -1) {
263 switch (errno) {
264 case EINTR:
265 case EWOULDBLOCK:
266 case ECONNABORTED:
267 return;
268 case EMFILE:
269 case ENFILE:
270 event_del(&l->ev);
271 evtimer_add(&l->pause, &p);
272 return;
273 default:
274 syslog(LOG_ERR, "accept: %m");
275 return;
276 }
[cd7b81d]277 }
[6e89d69]278
[c8c9ccf]279 if (ss.ss_family == AF_INET)
280 if (setsockopt(s, IPPROTO_IP, IP_TOS, &tos, sizeof tos) < 0)
281 syslog(LOG_WARNING, "IP_TOS: %m");
[8ef8c4e]282 if (setsockopt(s, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof on) < 0)
283 syslog(LOG_WARNING, "SO_KEEPALIVE: %m");
[cd7b81d]284 if ((is = calloc(1, sizeof *is)) == NULL) {
285 syslog(LOG_ERR, "calloc: %m");
286 (void)close(s);
287 return;
288 }
289 if ((is->bev = bufferevent_new(s, icbd_dispatch, NULL, icbd_ioerr,
290 is)) == NULL) {
291 syslog(LOG_ERR, "bufferevent_new: %m");
292 (void)close(s);
293 free(is);
294 return;
295 }
296 if (bufferevent_enable(is->bev, EV_READ)) {
297 syslog(LOG_ERR, "bufferevent_enable: %m");
298 (void)close(s);
299 bufferevent_free(is->bev);
300 free(is);
301 return;
302 }
303
304 /* save host information */
305 getpeerinfo(is);
306
307 /* start icb conversation */
308 icb_start(is);
309}
310
[6e89d69]311void
312icbd_paused(int fd __attribute__((__unused__)),
313 short events __attribute__((__unused__)), void *arg)
314{
315 struct icbd_listener *l = arg;
316 event_add(&l->ev, NULL);
317}
318
[cd7b81d]319__dead void
320usage(void)
321{
[3dba97d]322 extern char *__progname;
323
[cd7b81d]324 (void)fprintf(stderr, "usage: %s [-46Cdv] [-G group1[,group2,...]] "
[3dba97d]325 "[-L prefix] [-M modtab]\n\t[-S name] [[addr][:port] ...]\n",
326 __progname);
[cd7b81d]327 exit(EX_USAGE);
328}
329
330/*
331 * bufferevent functions
332 */
[e13307d]333void
334icbd_ioerr(struct bufferevent *bev __attribute__((__unused__)), short what,
335 void *arg)
336{
337 struct icb_session *is = (struct icb_session *)arg;
338
339 if (what & EVBUFFER_TIMEOUT)
340 icbd_drop(is, "timeout");
341 else if (what & EVBUFFER_EOF)
342 icbd_drop(is, NULL);
343 else if (what & EVBUFFER_ERROR)
344 icbd_drop(is, (what & EVBUFFER_READ) ? "read error" :
345 "write error");
346}
[cd7b81d]347
348void
349icbd_dispatch(struct bufferevent *bev, void *arg)
350{
351 struct icb_session *is = (struct icb_session *)arg;
[a2fadb4]352 unsigned char length;
[de86230]353 size_t res;
[cd7b81d]354
[c9402c3]355 while (EVBUFFER_LENGTH(EVBUFFER_INPUT(bev)) > 0) {
[cd7b81d]356 if (is->length == 0) {
[c9402c3]357 /* read length */
[a2fadb4]358 bufferevent_read(bev, &length, 1);
359 if (length == 0) {
360 /*
361 * An extension has been proposed:
362 * if length is 0, the packet is part of an
363 * "extended packet". The packet should be
364 * treated as if length was 255 and the next
365 * packet received from the sender should be
366 * appended to this packet.
367 *
368 * This server doesn't support this yet.
369 */
[c9402c3]370 icbd_drop(is, "invalid packet");
371 return;
372 }
[a2fadb4]373 is->length = (size_t)length;
374 is->rlen = 0;
[cd7b81d]375 }
[c9402c3]376 /* read as much as we can */
[de86230]377 res = bufferevent_read(bev, &is->buffer[is->rlen],
378 is->length - is->rlen);
379 is->rlen += res;
[cd7b81d]380#ifdef DEBUG
[c9402c3]381 {
382 int i;
383
384 printf("-> read %lu out of %lu from %s:%d:\n",
385 is->rlen, is->length, is->host, is->port);
386 for (i = 0; i < (int)is->rlen; i++)
[3347cd9]387 printf(isprint(is->buffer[i]) ? "%c" :
388 "\\x%02x", (unsigned char)is->buffer[i]);
[c9402c3]389 printf("\n");
390 }
[cd7b81d]391#endif
[c9402c3]392 /* see you next time around */
393 if (is->rlen < is->length)
394 return;
[a2fadb4]395 /* null-terminate the data */
396 is->buffer[MIN(is->rlen, ICB_MSGSIZE - 1)] = '\0';
[c9402c3]397 /* process the message in full */
[d45051e]398 if (icb_input(is))
399 return;
[863edf1]400 /* cleanup the input buffer */
401 memset(is->buffer, 0, ICB_MSGSIZE);
[c9402c3]402 is->rlen = is->length = 0;
403 }
[cd7b81d]404}
405
406void
[7882a6f]407icbd_send(struct icb_session *is, char *buf, ssize_t size)
[cd7b81d]408{
409 if (bufferevent_write(is->bev, buf, size) == -1)
410 syslog(LOG_ERR, "bufferevent_write: %m");
411#ifdef DEBUG
412 {
413 int i;
414
[c9402c3]415 printf("-> wrote %lu to %s:%d:\n", size, is->host, is->port);
[cd7b81d]416 for (i = 0; i < size; i++)
[3347cd9]417 printf(isprint(buf[i]) ? "%c" : "\\x%02x",
418 (unsigned char)buf[i]);
[cd7b81d]419 printf("\n");
420 }
421#endif
422}
423
424void
425icbd_drop(struct icb_session *is, char *reason)
426{
427 if (reason) {
428 icb_remove(is, reason);
429 icbd_log(is, LOG_DEBUG, reason);
430 } else
431 icb_remove(is, NULL);
[863edf1]432
433 /* cleanup the input buffer */
434 memset(is->buffer, 0, ICB_MSGSIZE);
435 is->rlen = is->length = 0;
436
[cd7b81d]437 (void)close(EVBUFFER_FD(is->bev));
438 bufferevent_free(is->bev);
[120eedd]439 if (!ISSETF(is->flags, ICB_SF_DNSINPROGRESS))
440 free(is);
441 else
442 SETF(is->flags, ICB_SF_PENDINGDROP);
[cd7b81d]443}
444
445void
446icbd_log(struct icb_session *is, int level, const char *fmt, ...)
447{
448 char buf[512];
449 va_list ap;
450
451 if (!verbose && level == LOG_DEBUG)
452 return;
453
454 va_start(ap, fmt);
455 (void)vsnprintf(buf, sizeof buf, fmt, ap);
456 va_end(ap);
457 if (is)
458 syslog(level, "%s:%u: %s", is->host, is->port, buf);
459 else
460 syslog(level, "%s", buf);
461}
462
463void
464icbd_restrict(void)
465{
466 struct stat sb;
467 struct passwd *pw;
468
469 if ((pw = getpwnam(ICBD_USER)) == NULL) {
470 syslog(LOG_ERR, "No passwd entry for %s", ICBD_USER);
471 exit(EX_NOUSER);
472 }
473
474 if (stat(pw->pw_dir, &sb) == -1) {
475 syslog(LOG_ERR, "%s: %m", pw->pw_name);
476 exit(EX_NOPERM);
477 }
478
479 if (sb.st_uid != 0 || (sb.st_mode & (S_IWGRP|S_IWOTH)) != 0) {
480 syslog(LOG_ERR, "bad directory permissions");
481 exit(EX_NOPERM);
482 }
483
484 if (chroot(pw->pw_dir) < 0) {
485 syslog(LOG_ERR, "%s: %m", pw->pw_dir);
486 exit(EX_UNAVAILABLE);
487 }
488
[cdd2ff5]489 if (chdir("/") < 0) {
[ad8b08d]490 syslog(LOG_ERR, "/" ICBD_HOME ": %m");
[cd7b81d]491 exit(EX_UNAVAILABLE);
492 }
493
[cdd2ff5]494 chdir(ICBD_HOME);
495
[e54f151]496 if (setuid(pw->pw_uid) < 0) {
497 syslog(LOG_ERR, "%d: %m", pw->pw_uid);
498 exit(EX_NOPERM);
499 }
500
[411aa63]501 if (dodns) {
502 if (pledge("stdio inet rpath dns", NULL) == -1) {
503 syslog(LOG_ERR, "pledge");
504 exit(EX_NOPERM);
505 }
506 } else {
507 if (pledge("stdio inet rpath", NULL) == -1) {
508 syslog(LOG_ERR, "pledge");
509 exit(EX_NOPERM);
510 }
511 }
512
[cd7b81d]513 (void)setproctitle("icbd");
514}
515
[1d2125a]516void
[82d3c1f]517icbd_modupdate(void)
[1d2125a]518{
[82d3c1f]519 struct stat st;
[1d2125a]520 FILE *fp;
521 char *buf, *lbuf;
522 size_t len;
523
[82d3c1f]524 if (strlen(modtabpath) == 0)
525 return;
526 if (stat(modtabpath, &st)) {
[709589d]527 syslog(LOG_ERR, "stat %s: %m", modtabpath);
[82d3c1f]528 return;
529 }
530 /* see if there are any changes */
531 if (timespeccmp(&st.st_mtim, &modtabst.st_mtim, ==) ||
532 st.st_size == 0)
533 return;
534
[709589d]535 if ((fp = fopen(modtabpath, "r")) == NULL) {
536 syslog(LOG_ERR, "open %s: %m", modtabpath);
537 return;
538 }
[1d2125a]539
[2cdab10]540 modtabcnt = 0;
[1d2125a]541 bzero(modtab, ICB_MTABLEN * ICB_MAXNICKLEN);
542 lbuf = NULL;
543 while ((buf = fgetln(fp, &len)) && modtabcnt < ICB_MTABLEN) {
544 if (buf[len - 1] == '\n')
545 buf[len - 1] = '\0';
546 else {
547 /* EOF without EOL, copy and add the NUL */
548 if ((lbuf = malloc(len + 1)) == NULL)
549 err(1, NULL);
550 memcpy(lbuf, buf, len);
551 lbuf[len] = '\0';
552 buf = lbuf;
553 }
554 while (buf[0] == ' ' || buf[0] == '\t')
555 buf++;
556 if (buf[0] == '#' || buf[0] == '\0')
557 continue;
558 strlcpy(modtab[modtabcnt++], buf, ICB_MAXNICKLEN);
559 }
560 free(lbuf);
561
562 qsort(modtab, modtabcnt, ICB_MAXNICKLEN,
563 (int (*)(const void *, const void *))strcmp);
564
565 fclose(fp);
[709589d]566
567 memcpy(&modtabst, &st, sizeof modtabst);
[1d2125a]568}
569
[cd7b81d]570time_t
571getmonotime(void)
572{
573 struct timespec ts;
574
575 if (clock_gettime(CLOCK_MONOTONIC, &ts) != 0) {
576 syslog(LOG_ERR, "%m");
577 exit(EX_OSERR);
578 }
579 return (ts.tv_sec);
580}
581
582void
583getpeerinfo(struct icb_session *is)
584{
[e68221b]585 struct sockaddr_in *sin = (struct sockaddr_in *)&is->ss;
586 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&is->ss;
587 socklen_t ss_len = sizeof is->ss;
[cd7b81d]588
[e68221b]589 bzero(&is->ss, sizeof is->ss);
590 if (getpeername(EVBUFFER_FD(is->bev), (struct sockaddr *)&is->ss,
[cd7b81d]591 &ss_len) != 0)
592 return;
593
594 is->port = 0;
[e68221b]595 switch (is->ss.ss_family) {
[cd7b81d]596 case AF_INET:
[b4049f9]597 is->port = ntohs(sin->sin_port);
[cd7b81d]598 break;
599
600 case AF_INET6:
[b4049f9]601 is->port = ntohs(sin6->sin6_port);
[cd7b81d]602 break;
603 }
604
[e68221b]605 inet_ntop(is->ss.ss_family, is->ss.ss_family == AF_INET ?
[b4049f9]606 (void *)&sin->sin_addr : (void *)&sin6->sin6_addr,
607 is->host, sizeof is->host);
608
[e68221b]609 dns_resolve(is);
[cd7b81d]610}
Note: See TracBrowser for help on using the repository browser.