source: code/icbd.c@ e3a7f9b

Last change on this file since e3a7f9b was e3a7f9b, checked in by Mike Belopuhov <mike.belopuhov@…>, 15 years ago

drop rcsids
  • Property mode set to 100644
File size: 10.1 KB
RevLine 
[cd7b81d]1/*
2 * Copyright (c) 2009 Mike Belopuhov
3 * Copyright (c) 2007 Oleg Safiullin
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#include <sys/types.h>
19#include <sys/queue.h>
20#include <sys/socket.h>
21#include <sys/stat.h>
22#include <netinet/in.h>
23#include <arpa/inet.h>
24#include <fcntl.h>
25#include <stdio.h>
26#include <stdlib.h>
27#include <unistd.h>
28#include <string.h>
29#include <sysexits.h>
30#include <syslog.h>
31#include <pwd.h>
32#include <login_cap.h>
33#include <locale.h>
34#include <netdb.h>
35#include <event.h>
36#include <errno.h>
37#include <err.h>
38
39#include "icb.h"
40#include "icbd.h"
41
42extern char *__progname;
43
44int creategroups;
45int foreground;
46int verbose;
47
48void usage(void);
49void getpeerinfo(struct icb_session *);
50void icbd_accept(int, short, void *);
51void icbd_drop(struct icb_session *, char *);
52void icbd_ioerr(struct bufferevent *, short, void *);
53void icbd_dispatch(struct bufferevent *, void *);
54void icbd_log(struct icb_session *, int, const char *, ...);
55void icbd_grplist(char *);
56void icbd_restrict(void);
57void icbd_write(struct icb_session *, char *, ssize_t);
58
59int
60main(int argc, char *argv[])
61{
62 struct icbd_callbacks ic = { icbd_drop, icbd_log, icbd_write };
63 const char *cause = NULL;
64 int ch, nsocks = 0, save_errno = 0;
65 int inet4 = 0, inet6 = 0;
66
67 /* init group lists before calling icb_addgroup */
68 icb_init(&ic);
69
70 while ((ch = getopt(argc, argv, "46CdG:v")) != -1)
71 switch (ch) {
72 case '4':
73 inet4++;
74 break;
75 case '6':
76 inet6++;
77 break;
78 case 'C':
79 creategroups++;
80 break;
81 case 'd':
82 foreground++;
83 break;
84 case 'G':
85 icbd_grplist(optarg);
86 break;
87 case 'v':
88 verbose++;
89 break;
90 default:
91 usage();
92 /* NOTREACHED */
93 }
94 argc -= optind;
95 argv += optind;
96
97 /* add group "1" as it's a login group for most of the clients */
98 if (icb_addgroup(NULL, "1", NULL) == NULL)
99 err(EX_UNAVAILABLE, NULL);
100
101 if (argc == 0)
102 argc++;
103
104 if (inet4 && inet6)
105 errx(EX_CONFIG, "Can't specify both -4 and -6");
106
107 tzset();
108 (void)setlocale(LC_ALL, "C");
109
110 if (foreground)
111 openlog("icbd", LOG_PID | LOG_PERROR, LOG_DAEMON);
112 else
113 openlog("icbd", LOG_PID | LOG_NDELAY, LOG_DAEMON);
114
115 if (!foreground && daemon(0, 0) < 0)
116 err(EX_OSERR, NULL);
117
118 (void)event_init();
119
120 for (ch = 0; ch < argc; ch++) {
121 struct addrinfo hints, *res, *res0;
122 struct event *ev;
123 char *addr, *port;
124 int error, s, on = 1;
125
126 addr = port = NULL;
127 if (argv[ch] != NULL) {
128 if (argv[ch][0] != ':')
129 addr = argv[ch];
130 if ((port = strrchr(argv[ch], ':')) != NULL)
131 *port++ = '\0';
132 }
133
134 bzero(&hints, sizeof hints);
135 if (inet4 || inet6)
136 hints.ai_family = inet4 ? PF_INET : PF_INET6;
137 else
138 hints.ai_family = PF_UNSPEC;
139 hints.ai_socktype = SOCK_STREAM;
140 hints.ai_flags = AI_PASSIVE;
141 if ((error = getaddrinfo(addr, port ? port : "icb", &hints,
142 &res0)) != 0) {
143 syslog(LOG_ERR, "%s", gai_strerror(error));
144 return (EX_UNAVAILABLE);
145 }
146
147 for (res = res0; res != NULL; res = res->ai_next) {
148 if ((s = socket(res->ai_family, res->ai_socktype,
149 res->ai_protocol)) < 0) {
150 cause = "socket";
151 save_errno = errno;
152 continue;
153 }
154
155 if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on,
156 sizeof on) < 0) {
157 cause = "SO_REUSEADDR";
158 save_errno = errno;
159 (void)close(s);
160 continue;
161 }
162
163 if (bind(s, res->ai_addr, res->ai_addrlen) < 0) {
164 cause = "bind";
165 save_errno = errno;
166 (void)close(s);
167 continue;
168 }
169
170 (void)listen(s, TCP_BACKLOG);
171
172 if ((ev = calloc(1, sizeof *ev)) == NULL)
173 err(EX_UNAVAILABLE, NULL);
174 event_set(ev, s, EV_READ | EV_PERSIST, icbd_accept, ev);
175 if (event_add(ev, NULL) < 0) {
176 syslog(LOG_ERR, "event_add: %m");
177 return (EX_UNAVAILABLE);
178 }
179
180 nsocks++;
181 }
182
183 freeaddrinfo(res0);
184 }
185
186 if (nsocks == 0) {
187 errno = save_errno;
188 syslog(LOG_ERR, "%s: %m", cause);
189 return (EX_UNAVAILABLE);
190 }
191
192 /* start a dns resolver thread */
193 icbd_dns_init();
194
195 if (!foreground)
196 icbd_restrict();
197
198 (void)signal(SIGPIPE, SIG_IGN);
199
200 (void)event_dispatch();
201
202 syslog(LOG_ERR, "event_dispatch: %m");
203
204 return (EX_UNAVAILABLE);
205}
206
207void
208icbd_dns(int fd, short event, void *arg)
209{
210 struct icb_session *is = arg;
211
212 if (event != EV_READ)
213 return;
214
215 if (verbose)
216 syslog(LOG_DEBUG, "icbd_dns");
217
218 if (read(fd, is->host, sizeof is->host) < 0)
219 syslog(LOG_ERR, "read: %m");
220
221 is->host[sizeof is->host - 1] = '\0';
222
223 if (verbose)
224 syslog(LOG_DEBUG, "icbd_dns: resolved %s", is->host);
225}
226
227void
228icbd_accept(int fd, short event __attribute__((__unused__)),
229 void *arg __attribute__((__unused__)))
230{
231 struct sockaddr_storage ss;
232 struct icb_session *is;
233 socklen_t ss_len = sizeof ss;
234 int s;
235
236 ss.ss_len = ss_len;
237 if ((s = accept(fd, (struct sockaddr *)&ss, &ss_len)) < 0) {
238 syslog(LOG_ERR, "accept: %m");
239 return;
240 }
241 if ((is = calloc(1, sizeof *is)) == NULL) {
242 syslog(LOG_ERR, "calloc: %m");
243 (void)close(s);
244 return;
245 }
246 if ((is->bev = bufferevent_new(s, icbd_dispatch, NULL, icbd_ioerr,
247 is)) == NULL) {
248 syslog(LOG_ERR, "bufferevent_new: %m");
249 (void)close(s);
250 free(is);
251 return;
252 }
253 if (bufferevent_enable(is->bev, EV_READ)) {
254 syslog(LOG_ERR, "bufferevent_enable: %m");
255 (void)close(s);
256 bufferevent_free(is->bev);
257 free(is);
258 return;
259 }
260
261 /* save host information */
262 getpeerinfo(is);
263
264 /* start icb conversation */
265 icb_start(is);
266}
267
268__dead void
269usage(void)
270{
271 (void)fprintf(stderr, "usage: %s [-46Cdv] [-G group1[,group2,...]] "
272 "[[addr][:port] ...]\n", __progname);
273 exit(EX_USAGE);
274}
275
276/*
277 * bufferevent functions
278 */
279
280void
281icbd_dispatch(struct bufferevent *bev, void *arg)
282{
283 struct icb_session *is = (struct icb_session *)arg;
284
285 if (is->length == 0) {
286 bzero(is->buffer, sizeof is->buffer);
287 /* read length */
288 (void)bufferevent_read(bev, is->buffer, 1);
289 /* we're about to read the whole packet */
290 is->length = (size_t)(unsigned char)is->buffer[0];
291 if (is->length == 0) {
292 icbd_drop(is, "invalid packet");
293 return;
294 }
295 if (EVBUFFER_LENGTH(EVBUFFER_INPUT(bev)) < is->length) {
296 /* set watermark to the expected length */
297 bufferevent_setwatermark(bev, EV_READ, is->length, 0);
298 return;
299 }
300 }
301 (void)bufferevent_read(bev, &is->buffer[1], is->length);
302#ifdef DEBUG
303 {
304 int i;
305
306 printf("-> read from %s:%d:\n", is->host, is->port);
307 for (i = 0; i < (int)is->length + 1; i++)
308 printf(" %02x", (unsigned char)is->buffer[i]);
309 printf("\n");
310 }
311#endif
312 icb_input(is);
313 is->length = 0;
314}
315
316void
317icbd_write(struct icb_session *is, char *buf, ssize_t size)
318{
319 if (bufferevent_write(is->bev, buf, size) == -1)
320 syslog(LOG_ERR, "bufferevent_write: %m");
321#ifdef DEBUG
322 {
323 int i;
324
325 printf("-> wrote to %s:%d:\n", is->host, is->port);
326 for (i = 0; i < size; i++)
327 printf(" %02x", (unsigned char)buf[i]);
328 printf("\n");
329 }
330#endif
331}
332
333void
334icbd_drop(struct icb_session *is, char *reason)
335{
336 if (reason) {
337 icb_remove(is, reason);
338 icbd_log(is, LOG_DEBUG, reason);
339 } else
340 icb_remove(is, NULL);
341 (void)evbuffer_write(EVBUFFER_OUTPUT(is->bev), EVBUFFER_FD(is->bev));
342 (void)close(EVBUFFER_FD(is->bev));
343 bufferevent_free(is->bev);
344 free(is);
345}
346
347void
348icbd_ioerr(struct bufferevent *bev __attribute__((__unused__)), short what,
349 void *arg)
350{
351 struct icb_session *is = (struct icb_session *)arg;
352
353 if (what & EVBUFFER_TIMEOUT)
354 icbd_drop(is, "timeout");
355 else if (what & EVBUFFER_EOF)
356 icbd_drop(is, NULL);
357 else if (what & EVBUFFER_ERROR)
358 icbd_drop(is, (what & EVBUFFER_READ) ? "read error" :
359 "write error");
360}
361
362void
363icbd_log(struct icb_session *is, int level, const char *fmt, ...)
364{
365 char buf[512];
366 va_list ap;
367
368 if (!verbose && level == LOG_DEBUG)
369 return;
370
371 va_start(ap, fmt);
372 (void)vsnprintf(buf, sizeof buf, fmt, ap);
373 va_end(ap);
374 if (is)
375 syslog(level, "%s:%u: %s", is->host, is->port, buf);
376 else
377 syslog(level, "%s", buf);
378}
379
380void
381icbd_restrict(void)
382{
383 struct stat sb;
384 struct passwd *pw;
385
386 if ((pw = getpwnam(ICBD_USER)) == NULL) {
387 syslog(LOG_ERR, "No passwd entry for %s", ICBD_USER);
388 exit(EX_NOUSER);
389 }
390
391 if (setusercontext(NULL, pw, pw->pw_uid,
392 LOGIN_SETALL & ~LOGIN_SETUSER) < 0) {
393 syslog(LOG_ERR, "%s: %m", pw->pw_name);
394 exit(EX_NOPERM);
395 }
396
397 if (stat(pw->pw_dir, &sb) == -1) {
398 syslog(LOG_ERR, "%s: %m", pw->pw_name);
399 exit(EX_NOPERM);
400 }
401
402 if (sb.st_uid != 0 || (sb.st_mode & (S_IWGRP|S_IWOTH)) != 0) {
403 syslog(LOG_ERR, "bad directory permissions");
404 exit(EX_NOPERM);
405 }
406
407 if (chroot(pw->pw_dir) < 0) {
408 syslog(LOG_ERR, "%s: %m", pw->pw_dir);
409 exit(EX_UNAVAILABLE);
410 }
411
412 if (setuid(pw->pw_uid) < 0) {
413 syslog(LOG_ERR, "%d: %m", pw->pw_uid);
414 exit(EX_NOPERM);
415 }
416
417 if (chdir("/") < 0) {
418 syslog(LOG_ERR, "/: %m");
419 exit(EX_UNAVAILABLE);
420 }
421
422 (void)setproctitle("icbd");
423}
424
425void
426icbd_grplist(char *list)
427{
428 char *s, *s1, *s2;
429 int last = 0;
430
431 if (!list || strlen(list) == 0)
432 return;
433
434 /* "group1[:pass1][,group2[:pass2],...]" */
435 s = list;
436 s1 = s2 = NULL;
437 while (!last && s) {
438 if ((s1 = strchr(s, ',')) != NULL)
439 *s1 = '\0';
440 else {
441 last = 1;
442 s1 = s;
443 }
444 if ((s2 = strchr(s, ':')) != NULL)
445 *s2 = '\0';
446 if (icb_addgroup(NULL, s, s2 ? ++s2 : NULL) == NULL)
447 err(EX_UNAVAILABLE, NULL);
448 s = ++s1;
449 s1 = s2 = NULL;
450 }
451}
452
453time_t
454getmonotime(void)
455{
456 struct timespec ts;
457
458 if (clock_gettime(CLOCK_MONOTONIC, &ts) != 0) {
459 syslog(LOG_ERR, "%m");
460 exit(EX_OSERR);
461 }
462 return (ts.tv_sec);
463}
464
465void
466getpeerinfo(struct icb_session *is)
467{
468 struct sockaddr_storage ss;
469 socklen_t ss_len = sizeof ss;
470
471 bzero(&ss, sizeof ss);
472 if (getpeername(EVBUFFER_FD(is->bev), (struct sockaddr *)&ss,
473 &ss_len) != 0)
474 return;
475
476 is->port = 0;
477 switch (ss.ss_family) {
478 case AF_INET:
479 is->port = ntohs(((struct sockaddr_in *)&ss)->sin_port);
480 break;
481
482 case AF_INET6:
483 is->port = ntohs(((struct sockaddr_in6 *)&ss)->sin6_port);
484 break;
485 }
486
487 dns_rresolv(is, &ss);
488}
Note: See TracBrowser for help on using the repository browser.