3 * $Id: privconn.c,v 1.3 2004/04/08 01:36:25 mdw Exp $
5 * Making privileged connections
7 * (c) 2003 Straylight/Edgeware
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of the `fw' port forwarder.
14 * `fw' is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
19 * `fw' is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with `fw'; if not, write to the Free Software Foundation,
26 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
29 /*----- Header files ------------------------------------------------------*/
36 #include <sys/types.h>
39 #include <sys/socket.h>
40 #include <arpa/inet.h>
41 #include <netinet/in.h>
43 #include <mLib/conn.h>
44 #include <mLib/darray.h>
45 #include <mLib/fdflags.h>
46 #include <mLib/fdpass.h>
47 #include <mLib/report.h>
52 /*----- Data structures ---------------------------------------------------*/
54 typedef struct connrec
{
59 typedef struct connrq
{
64 DA_DECL(connrec_v
, connrec
);
66 /*----- Static variables --------------------------------------------------*/
68 static connrec_v cv
= DA_INIT
;
69 static conn
*qhead
= 0, **qtail
= &qhead
;
70 static int kidfd
= -1;
73 /*----- Main code ---------------------------------------------------------*/
77 * Arguments: @const connrq *rq@ = index of connection record
79 * Returns: Connected file descriptor, or @-1@.
81 * Use: Main privileged connection thing.
84 static int doconn(const connrq
*rq
)
86 struct sockaddr_in sin_bind
;
87 struct sockaddr_in sin_peer
;
92 /* --- Check the argument --- */
94 if (rq
->i
< 0 || rq
->i
>= DA_LEN(&cv
)) {
100 /* --- Make a new socket --- */
102 if ((fd
= socket(PF_INET
, SOCK_STREAM
, 0)) < 0)
105 /* --- Bind it to a low-numbered port --- */
107 memset(&sin_bind
, 0, sizeof(sin_bind
));
108 sin_bind
.sin_family
= AF_INET
;
109 sin_bind
.sin_addr
= rq
->bind
;
110 for (i
= 1023; i
>= 512; i
--) {
111 sin_bind
.sin_port
= htons(i
);
112 if (!bind(fd
, (struct sockaddr
*)&sin_bind
, sizeof(sin_bind
)))
114 if (errno
!= EADDRINUSE
)
119 /* --- Connect to the peer --- *
121 * We can find out whether it's connected later, so there's no need to
122 * distinguish these cases.
126 memset(&sin_peer
, 0, sizeof(sin_peer
));
127 sin_peer
.sin_family
= AF_INET
;
128 sin_peer
.sin_addr
= c
->peer
;
129 sin_peer
.sin_port
= c
->port
;
130 fdflags(fd
, O_NONBLOCK
, O_NONBLOCK
, 0, 0);
131 if (connect(fd
, (struct sockaddr
*)&sin_peer
, sizeof(sin_peer
)) < 0 &&
132 errno
!= EINPROGRESS
)
136 /* --- Tidy up on errors --- */
144 /* --- @dochild@ --- *
146 * Arguments: @int fd@ = my file descriptor
150 * Use: Child process for making privileged connections, separated
151 * from main process after initialization.
154 static void dochild(int fd
)
160 #if defined(_SC_OPEN_MAX)
161 int maxfd
= sysconf(_SC_OPEN_MAX
);
162 #elif defined(OPEN_MAX)
163 int maxfd
= OPEN_MAX
;
168 struct sigaction sa_dfl
;
170 /* --- Clear out unnecessary file descriptors --- */
174 for (i
= 3; i
< maxfd
; i
++)
175 if (i
!= fd
) close(i
);
177 /* --- Close off signal handlers --- */
179 sa_dfl
.sa_handler
= SIG_DFL
;
180 sigemptyset(&sa_dfl
.sa_mask
);
182 for (i
= 0; i
< 256; i
++) {
183 if (sigaction(i
, 0, &sa
))
185 if (sa
.sa_handler
!= SIG_DFL
&& sa
.sa_handler
!= SIG_IGN
)
186 sigaction(i
, &sa_dfl
, 0);
189 /* --- Main loop --- */
192 sz
= read(fd
, &rq
, sizeof(rq
));
196 die(1, "read error in privconn child: %s", strerror(errno
));
197 if ((nfd
= doconn(&rq
)) < 0)
200 sz
= fdpass_send(fd
, nfd
, &i
, sizeof(i
));
204 die(1, "short write in privconn child");
208 if (write(fd
, &errno
, sizeof(errno
)) < 0)
209 die(1, "write error in privconn child: %s", strerror(errno
));
214 /* --- @dorecvfd@ --- *
216 * Arguments: @int fd@ = file descriptor (@== kidfd@)
217 * @unsigned mode@ = what's happening (@== SEL_READ@)
218 * @void *p@ = uninteresting (@== 0@)
222 * Use: Receives a file descriptor from the privileged part.
225 void dorecvfd(int fd
, unsigned mode
, void *p
)
231 n
= fdpass_recv(kidfd
, &fd
, &e
, sizeof(e
));
236 qhead
= (conn
*)c
->writer
.next
;
237 if (!qhead
) qtail
= &qhead
;
238 if (n
< 0 || (errno
= e
) != 0)
244 conn_fd(c
, c
->writer
.s
, fd
, c
->func
, c
->p
);
256 for (c
= qhead
; c
; c
= cc
) {
257 cc
= (conn
*)c
->writer
.next
;
265 /* --- @privconn_split@ --- *
267 * Arguments: @sel_state *s@ = select state
271 * Use: Splits off the privileged binding code into a separate
275 void privconn_split(sel_state
*s
)
280 if (kidfd
!= -1 || DA_LEN(&cv
) == 0)
282 if (socketpair(PF_UNIX
, SOCK_STREAM
, 0, fd
) < 0)
283 die(1, "couldn't create privconn socketpair: %s", strerror(errno
));
285 if ((kid
= fork()) < 0)
286 die(1, "couldn't fork privconn child: %s", strerror(errno
));
293 fdflags(kidfd
, 0, 0, FD_CLOEXEC
, FD_CLOEXEC
);
294 sel_initfile(s
, &sf
, kidfd
, SEL_READ
, dorecvfd
, 0);
298 /* --- @privconn_adddest@ --- *
300 * Arguments: @struct in_addr peer@ = address to connect to
301 * @unsigned port@ = port to connect to
303 * Returns: Index for this destination address, or @-1@ if not
306 * Use: Adds a valid destination for a privileged connection.
309 int privconn_adddest(struct in_addr peer
, unsigned port
)
316 for (i
= 0; i
< DA_LEN(&cv
); i
++) {
318 if (peer
.s_addr
== c
->peer
.s_addr
&& port
== c
->port
)
329 /* --- @privconn_connect@ --- *
331 * Arguments: @conn *c@ = connection structure to fill in
332 * @sel_state *s@ = pointer to select state to attach to
333 * @int i@ = address index to connect to
334 * @struct in_addr bind@ = address to bind to
335 * @void (*func)(int, void *)@ = function to call on connect
336 * @void *p@ = argument for the function
338 * Returns: Zero on success, @-1@ on failure.
340 * Use: Sets up a privileged connection job.
343 int privconn_connect(conn
*c
, sel_state
*s
, int i
, struct in_addr bind
,
344 void (*func
)(int, void *), void *p
)
353 if ((fd
= doconn(&rq
)) < 0)
355 conn_fd(c
, s
, fd
, func
, p
);
359 n
= write(kidfd
, &rq
, sizeof(rq
));
368 qtail
= (conn
**)&c
->writer
.next
;
372 /*----- That's all, folks -------------------------------------------------*/