bb282d0fb75c7591a667ea7b285c3b2cfa7f6d55
3 * Making privileged connections
5 * (c) 2003 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of the `fw' port forwarder.
12 * `fw' is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License as published by
14 * the Free Software Foundation; either version 2 of the License, or
15 * (at your option) any later version.
17 * `fw' is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with `fw'; if not, write to the Free Software Foundation,
24 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
27 /*----- Header files ------------------------------------------------------*/
34 #include <sys/types.h>
37 #include <sys/socket.h>
38 #include <arpa/inet.h>
39 #include <netinet/in.h>
41 #include <mLib/conn.h>
42 #include <mLib/darray.h>
43 #include <mLib/fdflags.h>
44 #include <mLib/fdpass.h>
45 #include <mLib/report.h>
50 /*----- Data structures ---------------------------------------------------*/
52 typedef struct connrec
{
57 typedef struct connrq
{
62 DA_DECL(connrec_v
, connrec
);
64 /*----- Static variables --------------------------------------------------*/
66 static connrec_v cv
= DA_INIT
;
67 static conn
*qhead
= 0, **qtail
= &qhead
;
68 static int kidfd
= -1;
71 /*----- Main code ---------------------------------------------------------*/
75 * Arguments: @const connrq *rq@ = index of connection record
77 * Returns: Connected file descriptor, or @-1@.
79 * Use: Main privileged connection thing.
82 static int doconn(const connrq
*rq
)
84 struct sockaddr_in sin_bind
;
85 struct sockaddr_in sin_peer
;
90 /* --- Check the argument --- */
92 if (rq
->i
< 0 || rq
->i
>= DA_LEN(&cv
)) {
98 /* --- Make a new socket --- */
100 if ((fd
= socket(PF_INET
, SOCK_STREAM
, 0)) < 0)
103 /* --- Bind it to a low-numbered port --- */
105 memset(&sin_bind
, 0, sizeof(sin_bind
));
106 sin_bind
.sin_family
= AF_INET
;
107 sin_bind
.sin_addr
= rq
->bind
;
108 for (i
= 1023; i
>= 512; i
--) {
109 sin_bind
.sin_port
= htons(i
);
110 if (!bind(fd
, (struct sockaddr
*)&sin_bind
, sizeof(sin_bind
)))
112 if (errno
!= EADDRINUSE
)
117 /* --- Connect to the peer --- *
119 * We can find out whether it's connected later, so there's no need to
120 * distinguish these cases.
124 memset(&sin_peer
, 0, sizeof(sin_peer
));
125 sin_peer
.sin_family
= AF_INET
;
126 sin_peer
.sin_addr
= c
->peer
;
127 sin_peer
.sin_port
= c
->port
;
128 fdflags(fd
, O_NONBLOCK
, O_NONBLOCK
, 0, 0);
129 if (connect(fd
, (struct sockaddr
*)&sin_peer
, sizeof(sin_peer
)) < 0 &&
130 errno
!= EINPROGRESS
)
134 /* --- Tidy up on errors --- */
142 /* --- @dochild@ --- *
144 * Arguments: @int fd@ = my file descriptor
148 * Use: Child process for making privileged connections, separated
149 * from main process after initialization.
152 static void dochild(int fd
)
158 #if defined(_SC_OPEN_MAX)
159 int maxfd
= sysconf(_SC_OPEN_MAX
);
160 #elif defined(OPEN_MAX)
161 int maxfd
= OPEN_MAX
;
166 struct sigaction sa_dfl
;
168 /* --- Clear out unnecessary file descriptors --- */
172 for (i
= 3; i
< maxfd
; i
++)
173 if (i
!= fd
) close(i
);
175 /* --- Close off signal handlers --- */
177 sa_dfl
.sa_handler
= SIG_DFL
;
178 sigemptyset(&sa_dfl
.sa_mask
);
180 for (i
= 0; i
< 256; i
++) {
181 if (sigaction(i
, 0, &sa
))
183 if (sa
.sa_handler
!= SIG_DFL
&& sa
.sa_handler
!= SIG_IGN
)
184 sigaction(i
, &sa_dfl
, 0);
187 /* --- Main loop --- */
190 sz
= read(fd
, &rq
, sizeof(rq
));
194 die(1, "read error in privconn child: %s", strerror(errno
));
195 if ((nfd
= doconn(&rq
)) < 0)
198 sz
= fdpass_send(fd
, nfd
, &i
, sizeof(i
));
202 die(1, "short write in privconn child");
206 if (write(fd
, &errno
, sizeof(errno
)) < 0)
207 die(1, "write error in privconn child: %s", strerror(errno
));
212 /* --- @dorecvfd@ --- *
214 * Arguments: @int fd@ = file descriptor (@== kidfd@)
215 * @unsigned mode@ = what's happening (@== SEL_READ@)
216 * @void *p@ = uninteresting (@== 0@)
220 * Use: Receives a file descriptor from the privileged part.
223 void dorecvfd(int fd
, unsigned mode
, void *p
)
229 n
= fdpass_recv(kidfd
, &fd
, &e
, sizeof(e
));
234 qhead
= (conn
*)c
->writer
.next
;
235 if (!qhead
) qtail
= &qhead
;
236 if (n
< 0 || (errno
= e
) != 0)
242 conn_fd(c
, c
->writer
.s
, fd
, c
->func
, c
->p
);
254 for (c
= qhead
; c
; c
= cc
) {
255 cc
= (conn
*)c
->writer
.next
;
263 /* --- @privconn_split@ --- *
265 * Arguments: @sel_state *s@ = select state
269 * Use: Splits off the privileged binding code into a separate
273 void privconn_split(sel_state
*s
)
278 if (kidfd
!= -1 || DA_LEN(&cv
) == 0)
280 if (socketpair(PF_UNIX
, SOCK_STREAM
, 0, fd
) < 0)
281 die(1, "couldn't create privconn socketpair: %s", strerror(errno
));
283 if ((kid
= fork()) < 0)
284 die(1, "couldn't fork privconn child: %s", strerror(errno
));
291 fdflags(kidfd
, 0, 0, FD_CLOEXEC
, FD_CLOEXEC
);
292 sel_initfile(s
, &sf
, kidfd
, SEL_READ
, dorecvfd
, 0);
296 /* --- @privconn_adddest@ --- *
298 * Arguments: @struct in_addr peer@ = address to connect to
299 * @unsigned port@ = port to connect to
301 * Returns: Index for this destination address, or @-1@ if not
304 * Use: Adds a valid destination for a privileged connection.
307 int privconn_adddest(struct in_addr peer
, unsigned port
)
314 for (i
= 0; i
< DA_LEN(&cv
); i
++) {
316 if (peer
.s_addr
== c
->peer
.s_addr
&& port
== c
->port
)
327 /* --- @privconn_connect@ --- *
329 * Arguments: @conn *c@ = connection structure to fill in
330 * @sel_state *s@ = pointer to select state to attach to
331 * @int i@ = address index to connect to
332 * @struct in_addr bind@ = address to bind to
333 * @void (*func)(int, void *)@ = function to call on connect
334 * @void *p@ = argument for the function
336 * Returns: Zero on success, @-1@ on failure.
338 * Use: Sets up a privileged connection job.
341 int privconn_connect(conn
*c
, sel_state
*s
, int i
, struct in_addr bind
,
342 void (*func
)(int, void *), void *p
)
351 if ((fd
= doconn(&rq
)) < 0)
353 conn_fd(c
, s
, fd
, func
, p
);
357 n
= write(kidfd
, &rq
, sizeof(rq
));
366 qtail
= (conn
**)&c
->writer
.next
;
370 /*----- That's all, folks -------------------------------------------------*/