source: code/icbd.c@ c45628b

Last change on this file since c45628b was c45628b, checked in by Mike Belopuhov <mike.belopuhov@…>, 15 years ago

describe -S option in the manual page; sync usage
  • Property mode set to 100644
File size: 10.4 KB
Line 
1/*
2 * Copyright (c) 2009 Mike Belopuhov
3 * Copyright (c) 2007 Oleg Safiullin
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#include <sys/types.h>
19#include <sys/queue.h>
20#include <sys/socket.h>
21#include <sys/stat.h>
22#include <netinet/in.h>
23#include <arpa/inet.h>
24#include <fcntl.h>
25#include <stdio.h>
26#include <stdlib.h>
27#include <unistd.h>
28#include <string.h>
29#include <sysexits.h>
30#include <syslog.h>
31#include <pwd.h>
32#include <login_cap.h>
33#include <locale.h>
34#include <netdb.h>
35#include <event.h>
36#include <errno.h>
37#include <err.h>
38
39#include "icb.h"
40#include "icbd.h"
41
42extern char *__progname;
43
44char srvname[MAXHOSTNAMELEN];
45int creategroups;
46int foreground;
47int verbose;
48
49void usage(void);
50void getpeerinfo(struct icb_session *);
51void icbd_accept(int, short, void *);
52void icbd_drop(struct icb_session *, char *);
53void icbd_ioerr(struct bufferevent *, short, void *);
54void icbd_dispatch(struct bufferevent *, void *);
55void icbd_log(struct icb_session *, int, const char *, ...);
56void icbd_grplist(char *);
57void icbd_restrict(void);
58void icbd_write(struct icb_session *, char *, ssize_t);
59
60/* event.h as it's shipped with OpenBSD doesn't include this prototype */
61void bufferevent_setwatermark(struct bufferevent *, short events,
62 size_t lowmark, size_t highmark);
63
64int
65main(int argc, char *argv[])
66{
67 struct icbd_callbacks ic = { icbd_drop, icbd_log, icbd_write };
68 const char *cause = NULL;
69 int ch, nsocks = 0, save_errno = 0;
70 int inet4 = 0, inet6 = 0;
71
72 /* init group lists before calling icb_addgroup */
73 icb_init(&ic);
74
75 while ((ch = getopt(argc, argv, "46CdG:S:v")) != -1)
76 switch (ch) {
77 case '4':
78 inet4++;
79 break;
80 case '6':
81 inet6++;
82 break;
83 case 'C':
84 creategroups++;
85 break;
86 case 'd':
87 foreground++;
88 break;
89 case 'G':
90 icbd_grplist(optarg);
91 break;
92 case 'S':
93 strlcpy(srvname, optarg, sizeof srvname);
94 break;
95 case 'v':
96 verbose++;
97 break;
98 default:
99 usage();
100 /* NOTREACHED */
101 }
102 argc -= optind;
103 argv += optind;
104
105 /* add group "1" as it's a login group for most of the clients */
106 if (icb_addgroup(NULL, "1", NULL) == NULL)
107 err(EX_UNAVAILABLE, NULL);
108
109 if (argc == 0)
110 argc++;
111
112 if (inet4 && inet6)
113 errx(EX_CONFIG, "Can't specify both -4 and -6");
114
115 tzset();
116 (void)setlocale(LC_ALL, "C");
117
118 if (foreground)
119 openlog("icbd", LOG_PID | LOG_PERROR, LOG_DAEMON);
120 else
121 openlog("icbd", LOG_PID | LOG_NDELAY, LOG_DAEMON);
122
123 if (!foreground && daemon(0, 0) < 0)
124 err(EX_OSERR, NULL);
125
126 (void)event_init();
127
128 for (ch = 0; ch < argc; ch++) {
129 struct addrinfo hints, *res, *res0;
130 struct event *ev;
131 char *addr, *port;
132 int error, s, on = 1;
133
134 addr = port = NULL;
135 if (argv[ch] != NULL) {
136 if (argv[ch][0] != ':')
137 addr = argv[ch];
138 if ((port = strrchr(argv[ch], ':')) != NULL)
139 *port++ = '\0';
140 }
141
142 bzero(&hints, sizeof hints);
143 if (inet4 || inet6)
144 hints.ai_family = inet4 ? PF_INET : PF_INET6;
145 else
146 hints.ai_family = PF_UNSPEC;
147 hints.ai_socktype = SOCK_STREAM;
148 hints.ai_flags = AI_PASSIVE;
149 if ((error = getaddrinfo(addr, port ? port : "icb", &hints,
150 &res0)) != 0) {
151 syslog(LOG_ERR, "%s", gai_strerror(error));
152 return (EX_UNAVAILABLE);
153 }
154
155 for (res = res0; res != NULL; res = res->ai_next) {
156 if ((s = socket(res->ai_family, res->ai_socktype,
157 res->ai_protocol)) < 0) {
158 cause = "socket";
159 save_errno = errno;
160 continue;
161 }
162
163 if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on,
164 sizeof on) < 0) {
165 cause = "SO_REUSEADDR";
166 save_errno = errno;
167 (void)close(s);
168 continue;
169 }
170
171 if (bind(s, res->ai_addr, res->ai_addrlen) < 0) {
172 cause = "bind";
173 save_errno = errno;
174 (void)close(s);
175 continue;
176 }
177
178 (void)listen(s, TCP_BACKLOG);
179
180 if ((ev = calloc(1, sizeof *ev)) == NULL)
181 err(EX_UNAVAILABLE, NULL);
182 event_set(ev, s, EV_READ | EV_PERSIST, icbd_accept, ev);
183 if (event_add(ev, NULL) < 0) {
184 syslog(LOG_ERR, "event_add: %m");
185 return (EX_UNAVAILABLE);
186 }
187
188 nsocks++;
189 }
190
191 freeaddrinfo(res0);
192 }
193
194 if (nsocks == 0) {
195 errno = save_errno;
196 syslog(LOG_ERR, "%s: %m", cause);
197 return (EX_UNAVAILABLE);
198 }
199
200 /* start a dns resolver thread */
201 icbd_dns_init();
202
203 if (!foreground)
204 icbd_restrict();
205
206 (void)signal(SIGPIPE, SIG_IGN);
207
208 (void)event_dispatch();
209
210 syslog(LOG_ERR, "event_dispatch: %m");
211
212 return (EX_UNAVAILABLE);
213}
214
215void
216icbd_dns(int fd, short event, void *arg)
217{
218 struct icb_session *is = arg;
219
220 if (event != EV_READ)
221 return;
222
223 if (verbose)
224 syslog(LOG_DEBUG, "icbd_dns");
225
226 if (read(fd, is->host, sizeof is->host) < 0)
227 syslog(LOG_ERR, "read: %m");
228
229 is->host[sizeof is->host - 1] = '\0';
230
231 if (verbose)
232 syslog(LOG_DEBUG, "icbd_dns: resolved %s", is->host);
233}
234
235void
236icbd_accept(int fd, short event __attribute__((__unused__)),
237 void *arg __attribute__((__unused__)))
238{
239 struct sockaddr_storage ss;
240 struct icb_session *is;
241 socklen_t ss_len = sizeof ss;
242 int s;
243
244 ss.ss_len = ss_len;
245 if ((s = accept(fd, (struct sockaddr *)&ss, &ss_len)) < 0) {
246 syslog(LOG_ERR, "accept: %m");
247 return;
248 }
249 if ((is = calloc(1, sizeof *is)) == NULL) {
250 syslog(LOG_ERR, "calloc: %m");
251 (void)close(s);
252 return;
253 }
254 if ((is->bev = bufferevent_new(s, icbd_dispatch, NULL, icbd_ioerr,
255 is)) == NULL) {
256 syslog(LOG_ERR, "bufferevent_new: %m");
257 (void)close(s);
258 free(is);
259 return;
260 }
261 if (bufferevent_enable(is->bev, EV_READ)) {
262 syslog(LOG_ERR, "bufferevent_enable: %m");
263 (void)close(s);
264 bufferevent_free(is->bev);
265 free(is);
266 return;
267 }
268
269 /* save host information */
270 getpeerinfo(is);
271
272 /* start icb conversation */
273 icb_start(is);
274}
275
276__dead void
277usage(void)
278{
279 (void)fprintf(stderr, "usage: %s [-46Cdv] [-G group1[,group2,...]] "
280 "[-S name] [[addr][:port] ...]\n", __progname);
281 exit(EX_USAGE);
282}
283
284/*
285 * bufferevent functions
286 */
287
288void
289icbd_dispatch(struct bufferevent *bev, void *arg)
290{
291 struct icb_session *is = (struct icb_session *)arg;
292
293 if (is->length == 0) {
294 bzero(is->buffer, sizeof is->buffer);
295 /* read length */
296 (void)bufferevent_read(bev, is->buffer, 1);
297 /* we're about to read the whole packet */
298 is->length = (size_t)(unsigned char)is->buffer[0];
299 if (is->length == 0) {
300 icbd_drop(is, "invalid packet");
301 return;
302 }
303 if (EVBUFFER_LENGTH(EVBUFFER_INPUT(bev)) < is->length) {
304 /* set watermark to the expected length */
305 bufferevent_setwatermark(bev, EV_READ, is->length, 0);
306 return;
307 }
308 }
309 (void)bufferevent_read(bev, &is->buffer[1], is->length);
310#ifdef DEBUG
311 {
312 int i;
313
314 printf("-> read from %s:%d:\n", is->host, is->port);
315 for (i = 0; i < (int)is->length + 1; i++)
316 printf(" %02x", (unsigned char)is->buffer[i]);
317 printf("\n");
318 }
319#endif
320 icb_input(is);
321 is->length = 0;
322}
323
324void
325icbd_write(struct icb_session *is, char *buf, ssize_t size)
326{
327 if (bufferevent_write(is->bev, buf, size) == -1)
328 syslog(LOG_ERR, "bufferevent_write: %m");
329#ifdef DEBUG
330 {
331 int i;
332
333 printf("-> wrote to %s:%d:\n", is->host, is->port);
334 for (i = 0; i < size; i++)
335 printf(" %02x", (unsigned char)buf[i]);
336 printf("\n");
337 }
338#endif
339}
340
341void
342icbd_drop(struct icb_session *is, char *reason)
343{
344 if (reason) {
345 icb_remove(is, reason);
346 icbd_log(is, LOG_DEBUG, reason);
347 } else
348 icb_remove(is, NULL);
349 (void)evbuffer_write(EVBUFFER_OUTPUT(is->bev), EVBUFFER_FD(is->bev));
350 (void)close(EVBUFFER_FD(is->bev));
351 bufferevent_free(is->bev);
352 free(is);
353}
354
355void
356icbd_ioerr(struct bufferevent *bev __attribute__((__unused__)), short what,
357 void *arg)
358{
359 struct icb_session *is = (struct icb_session *)arg;
360
361 if (what & EVBUFFER_TIMEOUT)
362 icbd_drop(is, "timeout");
363 else if (what & EVBUFFER_EOF)
364 icbd_drop(is, NULL);
365 else if (what & EVBUFFER_ERROR)
366 icbd_drop(is, (what & EVBUFFER_READ) ? "read error" :
367 "write error");
368}
369
370void
371icbd_log(struct icb_session *is, int level, const char *fmt, ...)
372{
373 char buf[512];
374 va_list ap;
375
376 if (!verbose && level == LOG_DEBUG)
377 return;
378
379 va_start(ap, fmt);
380 (void)vsnprintf(buf, sizeof buf, fmt, ap);
381 va_end(ap);
382 if (is)
383 syslog(level, "%s:%u: %s", is->host, is->port, buf);
384 else
385 syslog(level, "%s", buf);
386}
387
388void
389icbd_restrict(void)
390{
391 struct stat sb;
392 struct passwd *pw;
393
394 if ((pw = getpwnam(ICBD_USER)) == NULL) {
395 syslog(LOG_ERR, "No passwd entry for %s", ICBD_USER);
396 exit(EX_NOUSER);
397 }
398
399 if (setusercontext(NULL, pw, pw->pw_uid,
400 LOGIN_SETALL & ~LOGIN_SETUSER) < 0) {
401 syslog(LOG_ERR, "%s: %m", pw->pw_name);
402 exit(EX_NOPERM);
403 }
404
405 if (stat(pw->pw_dir, &sb) == -1) {
406 syslog(LOG_ERR, "%s: %m", pw->pw_name);
407 exit(EX_NOPERM);
408 }
409
410 if (sb.st_uid != 0 || (sb.st_mode & (S_IWGRP|S_IWOTH)) != 0) {
411 syslog(LOG_ERR, "bad directory permissions");
412 exit(EX_NOPERM);
413 }
414
415 if (chroot(pw->pw_dir) < 0) {
416 syslog(LOG_ERR, "%s: %m", pw->pw_dir);
417 exit(EX_UNAVAILABLE);
418 }
419
420 if (setuid(pw->pw_uid) < 0) {
421 syslog(LOG_ERR, "%d: %m", pw->pw_uid);
422 exit(EX_NOPERM);
423 }
424
425 if (chdir("/") < 0) {
426 syslog(LOG_ERR, "/: %m");
427 exit(EX_UNAVAILABLE);
428 }
429
430 (void)setproctitle("icbd");
431}
432
433void
434icbd_grplist(char *list)
435{
436 char *s, *s1, *s2;
437 int last = 0;
438
439 if (!list || strlen(list) == 0)
440 return;
441
442 /* "group1[:pass1][,group2[:pass2],...]" */
443 s = list;
444 s1 = s2 = NULL;
445 while (!last && s) {
446 if ((s1 = strchr(s, ',')) != NULL)
447 *s1 = '\0';
448 else {
449 last = 1;
450 s1 = s;
451 }
452 if ((s2 = strchr(s, ':')) != NULL)
453 *s2 = '\0';
454 if (icb_addgroup(NULL, s, s2 ? ++s2 : NULL) == NULL)
455 err(EX_UNAVAILABLE, NULL);
456 s = ++s1;
457 s1 = s2 = NULL;
458 }
459}
460
461time_t
462getmonotime(void)
463{
464 struct timespec ts;
465
466 if (clock_gettime(CLOCK_MONOTONIC, &ts) != 0) {
467 syslog(LOG_ERR, "%m");
468 exit(EX_OSERR);
469 }
470 return (ts.tv_sec);
471}
472
473void
474getpeerinfo(struct icb_session *is)
475{
476 struct sockaddr_storage ss;
477 socklen_t ss_len = sizeof ss;
478
479 bzero(&ss, sizeof ss);
480 if (getpeername(EVBUFFER_FD(is->bev), (struct sockaddr *)&ss,
481 &ss_len) != 0)
482 return;
483
484 is->port = 0;
485 switch (ss.ss_family) {
486 case AF_INET:
487 is->port = ntohs(((struct sockaddr_in *)&ss)->sin_port);
488 break;
489
490 case AF_INET6:
491 is->port = ntohs(((struct sockaddr_in6 *)&ss)->sin6_port);
492 break;
493 }
494
495 dns_rresolv(is, &ss);
496}
Note: See TracBrowser for help on using the repository browser.