Blame

Date:
Message:
initial commit
Actions:
History | Blob | Raw File
  1 8d1b399b 2021-07-22 op /*

  2 8d1b399b 2021-07-22 op  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>

  3 8d1b399b 2021-07-22 op  *

  4 8d1b399b 2021-07-22 op  * Permission to use, copy, modify, and distribute this software for any

  5 8d1b399b 2021-07-22 op  * purpose with or without fee is hereby granted, provided that the above

  6 8d1b399b 2021-07-22 op  * copyright notice and this permission notice appear in all copies.

  7 8d1b399b 2021-07-22 op  *

  8 8d1b399b 2021-07-22 op  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

  9 8d1b399b 2021-07-22 op  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

 10 8d1b399b 2021-07-22 op  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

 11 8d1b399b 2021-07-22 op  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

 12 8d1b399b 2021-07-22 op  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

 13 8d1b399b 2021-07-22 op  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

 14 8d1b399b 2021-07-22 op  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 15 8d1b399b 2021-07-22 op  */

 16 8d1b399b 2021-07-22 op 

 17 8d1b399b 2021-07-22 op #include "compat.h"

 18 8d1b399b 2021-07-22 op 

 19 8d1b399b 2021-07-22 op #include <errno.h>

 20 8d1b399b 2021-07-22 op #include <pwd.h>

 21 8d1b399b 2021-07-22 op #include <signal.h>

 22 8d1b399b 2021-07-22 op #include <stdlib.h>

 23 8d1b399b 2021-07-22 op #include <string.h>

 24 8d1b399b 2021-07-22 op #include <syslog.h>

 25 8d1b399b 2021-07-22 op #include <unistd.h>

 26 8d1b399b 2021-07-22 op 

 27 8d1b399b 2021-07-22 op #include "client.h"

 28 8d1b399b 2021-07-22 op #include "kamid.h"

 29 8d1b399b 2021-07-22 op #include "log.h"

 30 8d1b399b 2021-07-22 op #include "sandbox.h"

 31 8d1b399b 2021-07-22 op 

 32 8d1b399b 2021-07-22 op static struct imsgev	*iev_listener;

 33 8d1b399b 2021-07-22 op 

 34 8d1b399b 2021-07-22 op static __dead void	client_shutdown(void);

 35 8d1b399b 2021-07-22 op static void		client_sig_handler(int, short, void *);

 36 8d1b399b 2021-07-22 op static void		client_dispatch_listener(int, short, void *);

 37 8d1b399b 2021-07-22 op static void		client_privdrop(const char *, const char *);

 38 8d1b399b 2021-07-22 op 

 39 8d1b399b 2021-07-22 op static int		client_imsg_compose_listener(int, uint32_t,

 40 8d1b399b 2021-07-22 op     const void *, uint16_t);

 41 8d1b399b 2021-07-22 op 

 42 8d1b399b 2021-07-22 op __dead void

 43 8d1b399b 2021-07-22 op client(int debug, int verbose)

 44 8d1b399b 2021-07-22 op {

 45 8d1b399b 2021-07-22 op 	struct event	ev_sigint, ev_sigterm;

 46 8d1b399b 2021-07-22 op 

 47 8d1b399b 2021-07-22 op 	log_init(debug, LOG_DAEMON);

 48 8d1b399b 2021-07-22 op 	log_setverbose(verbose);

 49 8d1b399b 2021-07-22 op 

 50 8d1b399b 2021-07-22 op 	setproctitle("client");

 51 8d1b399b 2021-07-22 op 	log_procinit("client");

 52 8d1b399b 2021-07-22 op 

 53 8d1b399b 2021-07-22 op 	log_debug("warming up");

 54 8d1b399b 2021-07-22 op 

 55 8d1b399b 2021-07-22 op 	event_init();

 56 8d1b399b 2021-07-22 op 

 57 8d1b399b 2021-07-22 op 	/* Setup signal handlers */

 58 8d1b399b 2021-07-22 op 	signal_set(&ev_sigint, SIGINT, client_sig_handler, NULL);

 59 8d1b399b 2021-07-22 op 	signal_set(&ev_sigterm, SIGTERM, client_sig_handler, NULL);

 60 8d1b399b 2021-07-22 op 

 61 8d1b399b 2021-07-22 op 	signal_add(&ev_sigint, NULL);

 62 8d1b399b 2021-07-22 op 	signal_add(&ev_sigterm, NULL);

 63 8d1b399b 2021-07-22 op 

 64 8d1b399b 2021-07-22 op 	signal(SIGPIPE, SIG_IGN);

 65 8d1b399b 2021-07-22 op 	signal(SIGHUP, SIG_IGN);

 66 8d1b399b 2021-07-22 op 

 67 8d1b399b 2021-07-22 op 	/* Setup pipe and event handler to the listener process */

 68 8d1b399b 2021-07-22 op 	if ((iev_listener = malloc(sizeof(*iev_listener))) == NULL)

 69 8d1b399b 2021-07-22 op 		fatal(NULL);

 70 8d1b399b 2021-07-22 op 

 71 8d1b399b 2021-07-22 op 	imsg_init(&iev_listener->ibuf, 3);

 72 8d1b399b 2021-07-22 op 	iev_listener->handler = client_dispatch_listener;

 73 8d1b399b 2021-07-22 op 

 74 8d1b399b 2021-07-22 op 	/* Setup event handlers. */

 75 8d1b399b 2021-07-22 op 	iev_listener->events = EV_READ;

 76 8d1b399b 2021-07-22 op 	event_set(&iev_listener->ev, iev_listener->ibuf.fd,

 77 8d1b399b 2021-07-22 op 	    iev_listener->events, iev_listener->handler, iev_listener);

 78 8d1b399b 2021-07-22 op 	event_add(&iev_listener->ev, NULL);

 79 8d1b399b 2021-07-22 op 

 80 8d1b399b 2021-07-22 op 	log_debug("before dispatch");

 81 8d1b399b 2021-07-22 op 	event_dispatch();

 82 8d1b399b 2021-07-22 op 	client_shutdown();

 83 8d1b399b 2021-07-22 op }

 84 8d1b399b 2021-07-22 op 

 85 8d1b399b 2021-07-22 op static __dead void

 86 8d1b399b 2021-07-22 op client_shutdown(void)

 87 8d1b399b 2021-07-22 op {

 88 8d1b399b 2021-07-22 op 	msgbuf_clear(&iev_listener->ibuf.w);

 89 8d1b399b 2021-07-22 op 	close(iev_listener->ibuf.fd);

 90 8d1b399b 2021-07-22 op 

 91 8d1b399b 2021-07-22 op         free(iev_listener);

 92 8d1b399b 2021-07-22 op 

 93 8d1b399b 2021-07-22 op 	log_info("client exiting");

 94 8d1b399b 2021-07-22 op 	exit(0);

 95 8d1b399b 2021-07-22 op }

 96 8d1b399b 2021-07-22 op 

 97 8d1b399b 2021-07-22 op static void

 98 8d1b399b 2021-07-22 op client_sig_handler(int sig, short event, void *d)

 99 8d1b399b 2021-07-22 op {

100 8d1b399b 2021-07-22 op 	/*

101 8d1b399b 2021-07-22 op 	 * Normal signal handler rules don't apply because libevent

102 8d1b399b 2021-07-22 op 	 * decouples for us.

103 8d1b399b 2021-07-22 op 	 */

104 8d1b399b 2021-07-22 op 

105 8d1b399b 2021-07-22 op 	switch (sig) {

106 8d1b399b 2021-07-22 op 	case SIGINT:

107 8d1b399b 2021-07-22 op 	case SIGTERM:

108 8d1b399b 2021-07-22 op 		client_shutdown();

109 8d1b399b 2021-07-22 op 	default:

110 8d1b399b 2021-07-22 op 		fatalx("unexpected signal %d", sig);

111 8d1b399b 2021-07-22 op 	}

112 8d1b399b 2021-07-22 op }

113 8d1b399b 2021-07-22 op 

114 8d1b399b 2021-07-22 op #define AUTH_NONE 0

115 8d1b399b 2021-07-22 op #define AUTH_USER 1

116 8d1b399b 2021-07-22 op #define AUTH_DONE 2

117 8d1b399b 2021-07-22 op 

118 8d1b399b 2021-07-22 op static void

119 8d1b399b 2021-07-22 op client_dispatch_listener(int fd, short event, void *d)

120 8d1b399b 2021-07-22 op {

121 8d1b399b 2021-07-22 op 	static int		 auth = AUTH_NONE;

122 8d1b399b 2021-07-22 op 	static char		 username[64] = {0};

123 8d1b399b 2021-07-22 op 	static char		 dir[PATH_MAX] = {0};

124 8d1b399b 2021-07-22 op 	struct imsg		 imsg;

125 8d1b399b 2021-07-22 op 	struct imsgev		*iev = d;

126 8d1b399b 2021-07-22 op 	struct imsgbuf		*ibuf;

127 8d1b399b 2021-07-22 op 	ssize_t			 n;

128 8d1b399b 2021-07-22 op 	int			 shut = 0;

129 8d1b399b 2021-07-22 op 

130 8d1b399b 2021-07-22 op 	ibuf = &iev->ibuf;

131 8d1b399b 2021-07-22 op 

132 8d1b399b 2021-07-22 op 	if (event & EV_READ) {

133 8d1b399b 2021-07-22 op 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)

134 8d1b399b 2021-07-22 op 			fatal("imsg_read error");

135 8d1b399b 2021-07-22 op 		if (n == 0)	/* Connection closed */

136 8d1b399b 2021-07-22 op 			shut = 1;

137 8d1b399b 2021-07-22 op 	}

138 8d1b399b 2021-07-22 op 	if (event & EV_WRITE) {

139 8d1b399b 2021-07-22 op 		if ((n = msgbuf_write(&ibuf->w)) == -1 && errno != EAGAIN)

140 8d1b399b 2021-07-22 op 			fatal("msgbuf_write");

141 8d1b399b 2021-07-22 op 		if (n == 0)	/* Connection closed */

142 8d1b399b 2021-07-22 op 			shut = 1;

143 8d1b399b 2021-07-22 op 	}

144 8d1b399b 2021-07-22 op 

145 8d1b399b 2021-07-22 op 	for (;;) {

146 8d1b399b 2021-07-22 op 		if ((n = imsg_get(ibuf, &imsg)) == -1)

147 8d1b399b 2021-07-22 op 			fatal("%s: imsg_get error", __func__);

148 8d1b399b 2021-07-22 op 		if (n == 0)	/* No more messages. */

149 8d1b399b 2021-07-22 op 			break;

150 8d1b399b 2021-07-22 op 

151 8d1b399b 2021-07-22 op 		log_debug("client: got message type %d", imsg.hdr.type);

152 8d1b399b 2021-07-22 op 		switch (imsg.hdr.type) {

153 8d1b399b 2021-07-22 op 		case IMSG_AUTH:

154 8d1b399b 2021-07-22 op 			if (auth)

155 8d1b399b 2021-07-22 op 				fatalx("%s: IMSG_AUTH already done", __func__);

156 8d1b399b 2021-07-22 op 			auth = AUTH_USER;

157 8d1b399b 2021-07-22 op 			((char *)imsg.data)[IMSG_DATA_SIZE(imsg)-1] = '\0';

158 8d1b399b 2021-07-22 op 			strlcpy(username, imsg.data, sizeof(username));

159 8d1b399b 2021-07-22 op 			break;

160 8d1b399b 2021-07-22 op 		case IMSG_AUTH_DIR:

161 8d1b399b 2021-07-22 op 			if (auth != AUTH_USER)

162 8d1b399b 2021-07-22 op 				fatalx("%s: IMSG_AUTH_DIR not after IMSG_AUTH",

163 8d1b399b 2021-07-22 op 				    __func__);

164 8d1b399b 2021-07-22 op 			auth = AUTH_DONE;

165 8d1b399b 2021-07-22 op 			((char *)imsg.data)[IMSG_DATA_SIZE(imsg)-1] = '\0';

166 8d1b399b 2021-07-22 op 			strlcpy(dir, imsg.data, sizeof(dir));

167 8d1b399b 2021-07-22 op 			client_privdrop(username, dir);

168 8d1b399b 2021-07-22 op 			memset(username, 0, sizeof(username));

169 8d1b399b 2021-07-22 op 			memset(dir, 0, sizeof(username));

170 8d1b399b 2021-07-22 op 			break;

171 8d1b399b 2021-07-22 op 		case IMSG_BUF:

172 8d1b399b 2021-07-22 op 			/* echo! */

173 8d1b399b 2021-07-22 op 			client_imsg_compose_listener(IMSG_BUF, imsg.hdr.peerid,

174 8d1b399b 2021-07-22 op 			    imsg.data, IMSG_DATA_SIZE(imsg));

175 8d1b399b 2021-07-22 op 			break;

176 8d1b399b 2021-07-22 op 		case IMSG_CONN_GONE:

177 8d1b399b 2021-07-22 op 			log_debug("closing");

178 8d1b399b 2021-07-22 op 			shut = 1;

179 8d1b399b 2021-07-22 op 			break;

180 8d1b399b 2021-07-22 op 		default:

181 8d1b399b 2021-07-22 op 			log_debug("%s: unexpected imsg %d",

182 8d1b399b 2021-07-22 op 			    __func__, imsg.hdr.type);

183 8d1b399b 2021-07-22 op 			break;

184 8d1b399b 2021-07-22 op 		}

185 8d1b399b 2021-07-22 op 		imsg_free(&imsg);

186 8d1b399b 2021-07-22 op 	}

187 8d1b399b 2021-07-22 op 

188 8d1b399b 2021-07-22 op 	if (!shut)

189 8d1b399b 2021-07-22 op 		imsg_event_add(iev);

190 8d1b399b 2021-07-22 op 	else {

191 8d1b399b 2021-07-22 op 		/* This pipe is dead.  Remove its event handler. */

192 8d1b399b 2021-07-22 op 		event_del(&iev->ev);

193 8d1b399b 2021-07-22 op 		log_warnx("pipe closed, shutting down...");

194 8d1b399b 2021-07-22 op 		event_loopexit(NULL);

195 8d1b399b 2021-07-22 op 	}

196 8d1b399b 2021-07-22 op }

197 8d1b399b 2021-07-22 op 

198 8d1b399b 2021-07-22 op static void

199 8d1b399b 2021-07-22 op client_privdrop(const char *username, const char *dir)

200 8d1b399b 2021-07-22 op {

201 8d1b399b 2021-07-22 op 	struct passwd *pw;

202 8d1b399b 2021-07-22 op 

203 8d1b399b 2021-07-22 op 	setproctitle("client %s", username);

204 8d1b399b 2021-07-22 op 

205 8d1b399b 2021-07-22 op 	if ((pw = getpwnam(username)) == NULL)

206 8d1b399b 2021-07-22 op 		fatalx("getpwnam(%s) failed", username);

207 8d1b399b 2021-07-22 op 

208 8d1b399b 2021-07-22 op 	if (chroot(dir) == -1)

209 8d1b399b 2021-07-22 op 		fatal("chroot");

210 8d1b399b 2021-07-22 op 	if (chdir("/") == -1)

211 8d1b399b 2021-07-22 op 		fatal("chdir(\"/\")");

212 8d1b399b 2021-07-22 op 

213 8d1b399b 2021-07-22 op 	if (setgroups(1, &pw->pw_gid) ||

214 8d1b399b 2021-07-22 op 	    setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||

215 8d1b399b 2021-07-22 op 	    setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))

216 8d1b399b 2021-07-22 op 		fatal("can't drop privileges");

217 8d1b399b 2021-07-22 op 

218 8d1b399b 2021-07-22 op 	sandbox_client();

219 8d1b399b 2021-07-22 op 	log_debug("client ready");

220 8d1b399b 2021-07-22 op }

221 8d1b399b 2021-07-22 op 

222 8d1b399b 2021-07-22 op static int

223 8d1b399b 2021-07-22 op client_imsg_compose_listener(int type, uint32_t peerid,

224 8d1b399b 2021-07-22 op     const void *data, uint16_t len)

225 8d1b399b 2021-07-22 op {

226 8d1b399b 2021-07-22 op 	int ret;

227 8d1b399b 2021-07-22 op 

228 8d1b399b 2021-07-22 op 	if ((ret = imsg_compose(&iev_listener->ibuf, type, peerid, 0, -1,

229 8d1b399b 2021-07-22 op 	    data, len)) != -1)

230 8d1b399b 2021-07-22 op 		imsg_event_add(iev_listener);

231 8d1b399b 2021-07-22 op 

232 8d1b399b 2021-07-22 op 	return ret;

233 8d1b399b 2021-07-22 op }