source: code/icbd.c@ 1a5d69e

Last change on this file since 1a5d69e was 1a5d69e, checked in by Mike Belopuhov <mike.belopuhov@…>, 15 years ago

add a bufferevent_setwatermark prototype, so it compiles on OpenBSD fine; small correction in the README
  • Property mode set to 100644
File size: 10.3 KB
Line 
1/*
2 * Copyright (c) 2009 Mike Belopuhov
3 * Copyright (c) 2007 Oleg Safiullin
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#include <sys/types.h>
19#include <sys/queue.h>
20#include <sys/socket.h>
21#include <sys/stat.h>
22#include <netinet/in.h>
23#include <arpa/inet.h>
24#include <fcntl.h>
25#include <stdio.h>
26#include <stdlib.h>
27#include <unistd.h>
28#include <string.h>
29#include <sysexits.h>
30#include <syslog.h>
31#include <pwd.h>
32#include <login_cap.h>
33#include <locale.h>
34#include <netdb.h>
35#include <event.h>
36#include <errno.h>
37#include <err.h>
38
39#include "icb.h"
40#include "icbd.h"
41
42extern char *__progname;
43
44int creategroups;
45int foreground;
46int verbose;
47
48void usage(void);
49void getpeerinfo(struct icb_session *);
50void icbd_accept(int, short, void *);
51void icbd_drop(struct icb_session *, char *);
52void icbd_ioerr(struct bufferevent *, short, void *);
53void icbd_dispatch(struct bufferevent *, void *);
54void icbd_log(struct icb_session *, int, const char *, ...);
55void icbd_grplist(char *);
56void icbd_restrict(void);
57void icbd_write(struct icb_session *, char *, ssize_t);
58
59#ifndef bufferevent_setwatermark
60void bufferevent_setwatermark(struct bufferevent *, short events,
61 size_t lowmark, size_t highmark);
62#endif
63
64int
65main(int argc, char *argv[])
66{
67 struct icbd_callbacks ic = { icbd_drop, icbd_log, icbd_write };
68 const char *cause = NULL;
69 int ch, nsocks = 0, save_errno = 0;
70 int inet4 = 0, inet6 = 0;
71
72 /* init group lists before calling icb_addgroup */
73 icb_init(&ic);
74
75 while ((ch = getopt(argc, argv, "46CdG:v")) != -1)
76 switch (ch) {
77 case '4':
78 inet4++;
79 break;
80 case '6':
81 inet6++;
82 break;
83 case 'C':
84 creategroups++;
85 break;
86 case 'd':
87 foreground++;
88 break;
89 case 'G':
90 icbd_grplist(optarg);
91 break;
92 case 'v':
93 verbose++;
94 break;
95 default:
96 usage();
97 /* NOTREACHED */
98 }
99 argc -= optind;
100 argv += optind;
101
102 /* add group "1" as it's a login group for most of the clients */
103 if (icb_addgroup(NULL, "1", NULL) == NULL)
104 err(EX_UNAVAILABLE, NULL);
105
106 if (argc == 0)
107 argc++;
108
109 if (inet4 && inet6)
110 errx(EX_CONFIG, "Can't specify both -4 and -6");
111
112 tzset();
113 (void)setlocale(LC_ALL, "C");
114
115 if (foreground)
116 openlog("icbd", LOG_PID | LOG_PERROR, LOG_DAEMON);
117 else
118 openlog("icbd", LOG_PID | LOG_NDELAY, LOG_DAEMON);
119
120 if (!foreground && daemon(0, 0) < 0)
121 err(EX_OSERR, NULL);
122
123 (void)event_init();
124
125 for (ch = 0; ch < argc; ch++) {
126 struct addrinfo hints, *res, *res0;
127 struct event *ev;
128 char *addr, *port;
129 int error, s, on = 1;
130
131 addr = port = NULL;
132 if (argv[ch] != NULL) {
133 if (argv[ch][0] != ':')
134 addr = argv[ch];
135 if ((port = strrchr(argv[ch], ':')) != NULL)
136 *port++ = '\0';
137 }
138
139 bzero(&hints, sizeof hints);
140 if (inet4 || inet6)
141 hints.ai_family = inet4 ? PF_INET : PF_INET6;
142 else
143 hints.ai_family = PF_UNSPEC;
144 hints.ai_socktype = SOCK_STREAM;
145 hints.ai_flags = AI_PASSIVE;
146 if ((error = getaddrinfo(addr, port ? port : "icb", &hints,
147 &res0)) != 0) {
148 syslog(LOG_ERR, "%s", gai_strerror(error));
149 return (EX_UNAVAILABLE);
150 }
151
152 for (res = res0; res != NULL; res = res->ai_next) {
153 if ((s = socket(res->ai_family, res->ai_socktype,
154 res->ai_protocol)) < 0) {
155 cause = "socket";
156 save_errno = errno;
157 continue;
158 }
159
160 if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on,
161 sizeof on) < 0) {
162 cause = "SO_REUSEADDR";
163 save_errno = errno;
164 (void)close(s);
165 continue;
166 }
167
168 if (bind(s, res->ai_addr, res->ai_addrlen) < 0) {
169 cause = "bind";
170 save_errno = errno;
171 (void)close(s);
172 continue;
173 }
174
175 (void)listen(s, TCP_BACKLOG);
176
177 if ((ev = calloc(1, sizeof *ev)) == NULL)
178 err(EX_UNAVAILABLE, NULL);
179 event_set(ev, s, EV_READ | EV_PERSIST, icbd_accept, ev);
180 if (event_add(ev, NULL) < 0) {
181 syslog(LOG_ERR, "event_add: %m");
182 return (EX_UNAVAILABLE);
183 }
184
185 nsocks++;
186 }
187
188 freeaddrinfo(res0);
189 }
190
191 if (nsocks == 0) {
192 errno = save_errno;
193 syslog(LOG_ERR, "%s: %m", cause);
194 return (EX_UNAVAILABLE);
195 }
196
197 /* start a dns resolver thread */
198 icbd_dns_init();
199
200 if (!foreground)
201 icbd_restrict();
202
203 (void)signal(SIGPIPE, SIG_IGN);
204
205 (void)event_dispatch();
206
207 syslog(LOG_ERR, "event_dispatch: %m");
208
209 return (EX_UNAVAILABLE);
210}
211
212void
213icbd_dns(int fd, short event, void *arg)
214{
215 struct icb_session *is = arg;
216
217 if (event != EV_READ)
218 return;
219
220 if (verbose)
221 syslog(LOG_DEBUG, "icbd_dns");
222
223 if (read(fd, is->host, sizeof is->host) < 0)
224 syslog(LOG_ERR, "read: %m");
225
226 is->host[sizeof is->host - 1] = '\0';
227
228 if (verbose)
229 syslog(LOG_DEBUG, "icbd_dns: resolved %s", is->host);
230}
231
232void
233icbd_accept(int fd, short event __attribute__((__unused__)),
234 void *arg __attribute__((__unused__)))
235{
236 struct sockaddr_storage ss;
237 struct icb_session *is;
238 socklen_t ss_len = sizeof ss;
239 int s;
240
241 ss.ss_len = ss_len;
242 if ((s = accept(fd, (struct sockaddr *)&ss, &ss_len)) < 0) {
243 syslog(LOG_ERR, "accept: %m");
244 return;
245 }
246 if ((is = calloc(1, sizeof *is)) == NULL) {
247 syslog(LOG_ERR, "calloc: %m");
248 (void)close(s);
249 return;
250 }
251 if ((is->bev = bufferevent_new(s, icbd_dispatch, NULL, icbd_ioerr,
252 is)) == NULL) {
253 syslog(LOG_ERR, "bufferevent_new: %m");
254 (void)close(s);
255 free(is);
256 return;
257 }
258 if (bufferevent_enable(is->bev, EV_READ)) {
259 syslog(LOG_ERR, "bufferevent_enable: %m");
260 (void)close(s);
261 bufferevent_free(is->bev);
262 free(is);
263 return;
264 }
265
266 /* save host information */
267 getpeerinfo(is);
268
269 /* start icb conversation */
270 icb_start(is);
271}
272
273__dead void
274usage(void)
275{
276 (void)fprintf(stderr, "usage: %s [-46Cdv] [-G group1[,group2,...]] "
277 "[[addr][:port] ...]\n", __progname);
278 exit(EX_USAGE);
279}
280
281/*
282 * bufferevent functions
283 */
284
285void
286icbd_dispatch(struct bufferevent *bev, void *arg)
287{
288 struct icb_session *is = (struct icb_session *)arg;
289
290 if (is->length == 0) {
291 bzero(is->buffer, sizeof is->buffer);
292 /* read length */
293 (void)bufferevent_read(bev, is->buffer, 1);
294 /* we're about to read the whole packet */
295 is->length = (size_t)(unsigned char)is->buffer[0];
296 if (is->length == 0) {
297 icbd_drop(is, "invalid packet");
298 return;
299 }
300 if (EVBUFFER_LENGTH(EVBUFFER_INPUT(bev)) < is->length) {
301 /* set watermark to the expected length */
302 bufferevent_setwatermark(bev, EV_READ, is->length, 0);
303 return;
304 }
305 }
306 (void)bufferevent_read(bev, &is->buffer[1], is->length);
307#ifdef DEBUG
308 {
309 int i;
310
311 printf("-> read from %s:%d:\n", is->host, is->port);
312 for (i = 0; i < (int)is->length + 1; i++)
313 printf(" %02x", (unsigned char)is->buffer[i]);
314 printf("\n");
315 }
316#endif
317 icb_input(is);
318 is->length = 0;
319}
320
321void
322icbd_write(struct icb_session *is, char *buf, ssize_t size)
323{
324 if (bufferevent_write(is->bev, buf, size) == -1)
325 syslog(LOG_ERR, "bufferevent_write: %m");
326#ifdef DEBUG
327 {
328 int i;
329
330 printf("-> wrote to %s:%d:\n", is->host, is->port);
331 for (i = 0; i < size; i++)
332 printf(" %02x", (unsigned char)buf[i]);
333 printf("\n");
334 }
335#endif
336}
337
338void
339icbd_drop(struct icb_session *is, char *reason)
340{
341 if (reason) {
342 icb_remove(is, reason);
343 icbd_log(is, LOG_DEBUG, reason);
344 } else
345 icb_remove(is, NULL);
346 (void)evbuffer_write(EVBUFFER_OUTPUT(is->bev), EVBUFFER_FD(is->bev));
347 (void)close(EVBUFFER_FD(is->bev));
348 bufferevent_free(is->bev);
349 free(is);
350}
351
352void
353icbd_ioerr(struct bufferevent *bev __attribute__((__unused__)), short what,
354 void *arg)
355{
356 struct icb_session *is = (struct icb_session *)arg;
357
358 if (what & EVBUFFER_TIMEOUT)
359 icbd_drop(is, "timeout");
360 else if (what & EVBUFFER_EOF)
361 icbd_drop(is, NULL);
362 else if (what & EVBUFFER_ERROR)
363 icbd_drop(is, (what & EVBUFFER_READ) ? "read error" :
364 "write error");
365}
366
367void
368icbd_log(struct icb_session *is, int level, const char *fmt, ...)
369{
370 char buf[512];
371 va_list ap;
372
373 if (!verbose && level == LOG_DEBUG)
374 return;
375
376 va_start(ap, fmt);
377 (void)vsnprintf(buf, sizeof buf, fmt, ap);
378 va_end(ap);
379 if (is)
380 syslog(level, "%s:%u: %s", is->host, is->port, buf);
381 else
382 syslog(level, "%s", buf);
383}
384
385void
386icbd_restrict(void)
387{
388 struct stat sb;
389 struct passwd *pw;
390
391 if ((pw = getpwnam(ICBD_USER)) == NULL) {
392 syslog(LOG_ERR, "No passwd entry for %s", ICBD_USER);
393 exit(EX_NOUSER);
394 }
395
396 if (setusercontext(NULL, pw, pw->pw_uid,
397 LOGIN_SETALL & ~LOGIN_SETUSER) < 0) {
398 syslog(LOG_ERR, "%s: %m", pw->pw_name);
399 exit(EX_NOPERM);
400 }
401
402 if (stat(pw->pw_dir, &sb) == -1) {
403 syslog(LOG_ERR, "%s: %m", pw->pw_name);
404 exit(EX_NOPERM);
405 }
406
407 if (sb.st_uid != 0 || (sb.st_mode & (S_IWGRP|S_IWOTH)) != 0) {
408 syslog(LOG_ERR, "bad directory permissions");
409 exit(EX_NOPERM);
410 }
411
412 if (chroot(pw->pw_dir) < 0) {
413 syslog(LOG_ERR, "%s: %m", pw->pw_dir);
414 exit(EX_UNAVAILABLE);
415 }
416
417 if (setuid(pw->pw_uid) < 0) {
418 syslog(LOG_ERR, "%d: %m", pw->pw_uid);
419 exit(EX_NOPERM);
420 }
421
422 if (chdir("/") < 0) {
423 syslog(LOG_ERR, "/: %m");
424 exit(EX_UNAVAILABLE);
425 }
426
427 (void)setproctitle("icbd");
428}
429
430void
431icbd_grplist(char *list)
432{
433 char *s, *s1, *s2;
434 int last = 0;
435
436 if (!list || strlen(list) == 0)
437 return;
438
439 /* "group1[:pass1][,group2[:pass2],...]" */
440 s = list;
441 s1 = s2 = NULL;
442 while (!last && s) {
443 if ((s1 = strchr(s, ',')) != NULL)
444 *s1 = '\0';
445 else {
446 last = 1;
447 s1 = s;
448 }
449 if ((s2 = strchr(s, ':')) != NULL)
450 *s2 = '\0';
451 if (icb_addgroup(NULL, s, s2 ? ++s2 : NULL) == NULL)
452 err(EX_UNAVAILABLE, NULL);
453 s = ++s1;
454 s1 = s2 = NULL;
455 }
456}
457
458time_t
459getmonotime(void)
460{
461 struct timespec ts;
462
463 if (clock_gettime(CLOCK_MONOTONIC, &ts) != 0) {
464 syslog(LOG_ERR, "%m");
465 exit(EX_OSERR);
466 }
467 return (ts.tv_sec);
468}
469
470void
471getpeerinfo(struct icb_session *is)
472{
473 struct sockaddr_storage ss;
474 socklen_t ss_len = sizeof ss;
475
476 bzero(&ss, sizeof ss);
477 if (getpeername(EVBUFFER_FD(is->bev), (struct sockaddr *)&ss,
478 &ss_len) != 0)
479 return;
480
481 is->port = 0;
482 switch (ss.ss_family) {
483 case AF_INET:
484 is->port = ntohs(((struct sockaddr_in *)&ss)->sin_port);
485 break;
486
487 case AF_INET6:
488 is->port = ntohs(((struct sockaddr_in6 *)&ss)->sin6_port);
489 break;
490 }
491
492 dns_rresolv(is, &ss);
493}
Note: See TracBrowser for help on using the repository browser.