source: code/icbd.c@ c8c9ccf

Last change on this file since c8c9ccf was c8c9ccf, checked in by Mike Belopuhov <mike.belopuhov@…>, 15 years ago

set tos bits to low delay, remove excessive logging in dns resolver
  • Property mode set to 100644
File size: 10.6 KB
Line 
1/*
2 * Copyright (c) 2009 Mike Belopuhov
3 * Copyright (c) 2007 Oleg Safiullin
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#include <sys/types.h>
19#include <sys/queue.h>
20#include <sys/socket.h>
21#include <sys/stat.h>
22#include <netinet/in_systm.h>
23#include <netinet/in.h>
24#include <netinet/ip.h>
25#include <arpa/inet.h>
26#include <fcntl.h>
27#include <stdio.h>
28#include <stdlib.h>
29#include <unistd.h>
30#include <string.h>
31#include <sysexits.h>
32#include <syslog.h>
33#include <pwd.h>
34#include <login_cap.h>
35#include <locale.h>
36#include <netdb.h>
37#include <event.h>
38#include <errno.h>
39#include <err.h>
40
41#include "icb.h"
42#include "icbd.h"
43
44extern char *__progname;
45
46char srvname[MAXHOSTNAMELEN];
47int creategroups;
48int foreground;
49int verbose;
50
51void usage(void);
52void getpeerinfo(struct icb_session *);
53void icbd_accept(int, short, void *);
54void icbd_drop(struct icb_session *, char *);
55void icbd_ioerr(struct bufferevent *, short, void *);
56void icbd_dispatch(struct bufferevent *, void *);
57void icbd_log(struct icb_session *, int, const char *, ...);
58void icbd_grplist(char *);
59void icbd_restrict(void);
60void icbd_write(struct icb_session *, char *, ssize_t);
61
62/* event.h as it's shipped with OpenBSD doesn't include this prototype */
63void bufferevent_setwatermark(struct bufferevent *, short events,
64 size_t lowmark, size_t highmark);
65
66int
67main(int argc, char *argv[])
68{
69 struct icbd_callbacks ic = { icbd_drop, icbd_log, icbd_write };
70 const char *cause = NULL;
71 int ch, nsocks = 0, save_errno = 0;
72 int inet4 = 0, inet6 = 0;
73
74 /* init group lists before calling icb_addgroup */
75 icb_init(&ic);
76
77 while ((ch = getopt(argc, argv, "46CdG:S:v")) != -1)
78 switch (ch) {
79 case '4':
80 inet4++;
81 break;
82 case '6':
83 inet6++;
84 break;
85 case 'C':
86 creategroups++;
87 break;
88 case 'd':
89 foreground++;
90 break;
91 case 'G':
92 icbd_grplist(optarg);
93 break;
94 case 'S':
95 strlcpy(srvname, optarg, sizeof srvname);
96 break;
97 case 'v':
98 verbose++;
99 break;
100 default:
101 usage();
102 /* NOTREACHED */
103 }
104 argc -= optind;
105 argv += optind;
106
107 /* add group "1" as it's a login group for most of the clients */
108 if (icb_addgroup(NULL, "1", NULL) == NULL)
109 err(EX_UNAVAILABLE, NULL);
110
111 if (argc == 0)
112 argc++;
113
114 if (inet4 && inet6)
115 errx(EX_CONFIG, "Can't specify both -4 and -6");
116
117 tzset();
118 (void)setlocale(LC_ALL, "C");
119
120 if (foreground)
121 openlog("icbd", LOG_PID | LOG_PERROR, LOG_DAEMON);
122 else
123 openlog("icbd", LOG_PID | LOG_NDELAY, LOG_DAEMON);
124
125 if (!foreground && daemon(0, 0) < 0)
126 err(EX_OSERR, NULL);
127
128 (void)event_init();
129
130 for (ch = 0; ch < argc; ch++) {
131 struct addrinfo hints, *res, *res0;
132 struct event *ev;
133 char *addr, *port;
134 int error, s, on = 1;
135
136 addr = port = NULL;
137 if (argv[ch] != NULL) {
138 if (argv[ch][0] != ':')
139 addr = argv[ch];
140 if ((port = strrchr(argv[ch], ':')) != NULL)
141 *port++ = '\0';
142 }
143
144 bzero(&hints, sizeof hints);
145 if (inet4 || inet6)
146 hints.ai_family = inet4 ? PF_INET : PF_INET6;
147 else
148 hints.ai_family = PF_UNSPEC;
149 hints.ai_socktype = SOCK_STREAM;
150 hints.ai_flags = AI_PASSIVE;
151 if ((error = getaddrinfo(addr, port ? port : "icb", &hints,
152 &res0)) != 0) {
153 syslog(LOG_ERR, "%s", gai_strerror(error));
154 return (EX_UNAVAILABLE);
155 }
156
157 for (res = res0; res != NULL; res = res->ai_next) {
158 if ((s = socket(res->ai_family, res->ai_socktype,
159 res->ai_protocol)) < 0) {
160 cause = "socket";
161 save_errno = errno;
162 continue;
163 }
164
165 if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on,
166 sizeof on) < 0) {
167 cause = "SO_REUSEADDR";
168 save_errno = errno;
169 (void)close(s);
170 continue;
171 }
172
173 if (bind(s, res->ai_addr, res->ai_addrlen) < 0) {
174 cause = "bind";
175 save_errno = errno;
176 (void)close(s);
177 continue;
178 }
179
180 (void)listen(s, TCP_BACKLOG);
181
182 if ((ev = calloc(1, sizeof *ev)) == NULL)
183 err(EX_UNAVAILABLE, NULL);
184 event_set(ev, s, EV_READ | EV_PERSIST, icbd_accept, ev);
185 if (event_add(ev, NULL) < 0) {
186 syslog(LOG_ERR, "event_add: %m");
187 return (EX_UNAVAILABLE);
188 }
189
190 nsocks++;
191 }
192
193 freeaddrinfo(res0);
194 }
195
196 if (nsocks == 0) {
197 errno = save_errno;
198 syslog(LOG_ERR, "%s: %m", cause);
199 return (EX_UNAVAILABLE);
200 }
201
202 /* start a dns resolver thread */
203 icbd_dns_init();
204
205 if (!foreground)
206 icbd_restrict();
207
208 (void)signal(SIGPIPE, SIG_IGN);
209
210 (void)event_dispatch();
211
212 syslog(LOG_ERR, "event_dispatch: %m");
213
214 return (EX_UNAVAILABLE);
215}
216
217void
218icbd_dns(int fd, short event, void *arg)
219{
220 struct icb_session *is = arg;
221
222 if (event != EV_READ)
223 return;
224
225 if (read(fd, is->host, sizeof is->host) < 0)
226 syslog(LOG_ERR, "read: %m");
227
228 is->host[sizeof is->host - 1] = '\0';
229
230 if (verbose)
231 syslog(LOG_DEBUG, "icbd_dns: resolved %s", is->host);
232}
233
234void
235icbd_accept(int fd, short event __attribute__((__unused__)),
236 void *arg __attribute__((__unused__)))
237{
238 struct sockaddr_storage ss;
239 struct icb_session *is;
240 socklen_t ss_len = sizeof ss;
241 int s, tos = IPTOS_LOWDELAY;
242
243 ss.ss_len = ss_len;
244 if ((s = accept(fd, (struct sockaddr *)&ss, &ss_len)) < 0) {
245 syslog(LOG_ERR, "accept: %m");
246 return;
247 }
248 if (ss.ss_family == AF_INET)
249 if (setsockopt(s, IPPROTO_IP, IP_TOS, &tos, sizeof tos) < 0)
250 syslog(LOG_WARNING, "IP_TOS: %m");
251 if ((is = calloc(1, sizeof *is)) == NULL) {
252 syslog(LOG_ERR, "calloc: %m");
253 (void)close(s);
254 return;
255 }
256 if ((is->bev = bufferevent_new(s, icbd_dispatch, NULL, icbd_ioerr,
257 is)) == NULL) {
258 syslog(LOG_ERR, "bufferevent_new: %m");
259 (void)close(s);
260 free(is);
261 return;
262 }
263 if (bufferevent_enable(is->bev, EV_READ)) {
264 syslog(LOG_ERR, "bufferevent_enable: %m");
265 (void)close(s);
266 bufferevent_free(is->bev);
267 free(is);
268 return;
269 }
270
271 /* save host information */
272 getpeerinfo(is);
273
274 /* start icb conversation */
275 icb_start(is);
276}
277
278__dead void
279usage(void)
280{
281 (void)fprintf(stderr, "usage: %s [-46Cdv] [-G group1[,group2,...]] "
282 "[-S name] [[addr][:port] ...]\n", __progname);
283 exit(EX_USAGE);
284}
285
286/*
287 * bufferevent functions
288 */
289
290void
291icbd_dispatch(struct bufferevent *bev, void *arg)
292{
293 struct icb_session *is = (struct icb_session *)arg;
294
295 if (is->length == 0) {
296 bzero(is->buffer, sizeof is->buffer);
297 /* read length */
298 (void)bufferevent_read(bev, is->buffer, 1);
299 /* we're about to read the whole packet */
300 is->length = (size_t)(unsigned char)is->buffer[0];
301 if (is->length == 0) {
302 icbd_drop(is, "invalid packet");
303 return;
304 }
305 if (EVBUFFER_LENGTH(EVBUFFER_INPUT(bev)) < is->length) {
306 /* set watermark to the expected length */
307 bufferevent_setwatermark(bev, EV_READ, is->length, 0);
308 return;
309 }
310 }
311 (void)bufferevent_read(bev, &is->buffer[1], is->length);
312#ifdef DEBUG
313 {
314 int i;
315
316 printf("-> read from %s:%d:\n", is->host, is->port);
317 for (i = 0; i < (int)is->length + 1; i++)
318 printf(" %02x", (unsigned char)is->buffer[i]);
319 printf("\n");
320 }
321#endif
322 icb_input(is);
323 is->length = 0;
324}
325
326void
327icbd_write(struct icb_session *is, char *buf, ssize_t size)
328{
329 if (bufferevent_write(is->bev, buf, size) == -1)
330 syslog(LOG_ERR, "bufferevent_write: %m");
331#ifdef DEBUG
332 {
333 int i;
334
335 printf("-> wrote to %s:%d:\n", is->host, is->port);
336 for (i = 0; i < size; i++)
337 printf(" %02x", (unsigned char)buf[i]);
338 printf("\n");
339 }
340#endif
341}
342
343void
344icbd_drop(struct icb_session *is, char *reason)
345{
346 if (reason) {
347 icb_remove(is, reason);
348 icbd_log(is, LOG_DEBUG, reason);
349 } else
350 icb_remove(is, NULL);
351 (void)evbuffer_write(EVBUFFER_OUTPUT(is->bev), EVBUFFER_FD(is->bev));
352 (void)close(EVBUFFER_FD(is->bev));
353 bufferevent_free(is->bev);
354 free(is);
355}
356
357void
358icbd_ioerr(struct bufferevent *bev __attribute__((__unused__)), short what,
359 void *arg)
360{
361 struct icb_session *is = (struct icb_session *)arg;
362
363 if (what & EVBUFFER_TIMEOUT)
364 icbd_drop(is, "timeout");
365 else if (what & EVBUFFER_EOF)
366 icbd_drop(is, NULL);
367 else if (what & EVBUFFER_ERROR)
368 icbd_drop(is, (what & EVBUFFER_READ) ? "read error" :
369 "write error");
370}
371
372void
373icbd_log(struct icb_session *is, int level, const char *fmt, ...)
374{
375 char buf[512];
376 va_list ap;
377
378 if (!verbose && level == LOG_DEBUG)
379 return;
380
381 va_start(ap, fmt);
382 (void)vsnprintf(buf, sizeof buf, fmt, ap);
383 va_end(ap);
384 if (is)
385 syslog(level, "%s:%u: %s", is->host, is->port, buf);
386 else
387 syslog(level, "%s", buf);
388}
389
390void
391icbd_restrict(void)
392{
393 struct stat sb;
394 struct passwd *pw;
395
396 if ((pw = getpwnam(ICBD_USER)) == NULL) {
397 syslog(LOG_ERR, "No passwd entry for %s", ICBD_USER);
398 exit(EX_NOUSER);
399 }
400
401 if (setusercontext(NULL, pw, pw->pw_uid,
402 LOGIN_SETALL & ~LOGIN_SETUSER) < 0) {
403 syslog(LOG_ERR, "%s: %m", pw->pw_name);
404 exit(EX_NOPERM);
405 }
406
407 if (stat(pw->pw_dir, &sb) == -1) {
408 syslog(LOG_ERR, "%s: %m", pw->pw_name);
409 exit(EX_NOPERM);
410 }
411
412 if (sb.st_uid != 0 || (sb.st_mode & (S_IWGRP|S_IWOTH)) != 0) {
413 syslog(LOG_ERR, "bad directory permissions");
414 exit(EX_NOPERM);
415 }
416
417 if (chroot(pw->pw_dir) < 0) {
418 syslog(LOG_ERR, "%s: %m", pw->pw_dir);
419 exit(EX_UNAVAILABLE);
420 }
421
422 if (setuid(pw->pw_uid) < 0) {
423 syslog(LOG_ERR, "%d: %m", pw->pw_uid);
424 exit(EX_NOPERM);
425 }
426
427 if (chdir("/") < 0) {
428 syslog(LOG_ERR, "/: %m");
429 exit(EX_UNAVAILABLE);
430 }
431
432 (void)setproctitle("icbd");
433}
434
435void
436icbd_grplist(char *list)
437{
438 char *s, *s1, *s2;
439 int last = 0;
440
441 if (!list || strlen(list) == 0)
442 return;
443
444 /* "group1[:pass1][,group2[:pass2],...]" */
445 s = list;
446 s1 = s2 = NULL;
447 while (!last && s) {
448 if ((s1 = strchr(s, ',')) != NULL)
449 *s1 = '\0';
450 else {
451 last = 1;
452 s1 = s;
453 }
454 if ((s2 = strchr(s, ':')) != NULL)
455 *s2 = '\0';
456 if (icb_addgroup(NULL, s, s2 ? ++s2 : NULL) == NULL)
457 err(EX_UNAVAILABLE, NULL);
458 s = ++s1;
459 s1 = s2 = NULL;
460 }
461}
462
463time_t
464getmonotime(void)
465{
466 struct timespec ts;
467
468 if (clock_gettime(CLOCK_MONOTONIC, &ts) != 0) {
469 syslog(LOG_ERR, "%m");
470 exit(EX_OSERR);
471 }
472 return (ts.tv_sec);
473}
474
475void
476getpeerinfo(struct icb_session *is)
477{
478 struct sockaddr_storage ss;
479 socklen_t ss_len = sizeof ss;
480
481 bzero(&ss, sizeof ss);
482 if (getpeername(EVBUFFER_FD(is->bev), (struct sockaddr *)&ss,
483 &ss_len) != 0)
484 return;
485
486 is->port = 0;
487 switch (ss.ss_family) {
488 case AF_INET:
489 is->port = ntohs(((struct sockaddr_in *)&ss)->sin_port);
490 break;
491
492 case AF_INET6:
493 is->port = ntohs(((struct sockaddr_in6 *)&ss)->sin6_port);
494 break;
495 }
496
497 dns_rresolv(is, &ss);
498}
Note: See TracBrowser for help on using the repository browser.