3 * $Id: privconn.c,v 1.1 2003/11/29 20:36:07 mdw Exp $
5 * Making privileged connections
7 * (c) 2003 Straylight/Edgeware
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of the `fw' port forwarder.
14 * `fw' is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
19 * `fw' is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with `fw'; if not, write to the Free Software Foundation,
26 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
29 /*----- Revision history --------------------------------------------------*
31 * $Log: privconn.c,v $
32 * Revision 1.1 2003/11/29 20:36:07 mdw
33 * Privileged outgoing connections.
37 /*----- Header files ------------------------------------------------------*/
44 #include <sys/types.h>
47 #include <sys/socket.h>
48 #include <arpa/inet.h>
49 #include <netinet/in.h>
51 #include <mLib/conn.h>
52 #include <mLib/darray.h>
53 #include <mLib/fdflags.h>
54 #include <mLib/fdpass.h>
55 #include <mLib/report.h>
60 /*----- Data structures ---------------------------------------------------*/
62 typedef struct connrec
{
67 typedef struct connrq
{
72 DA_DECL(connrec_v
, connrec
);
74 /*----- Static variables --------------------------------------------------*/
76 static connrec_v cv
= DA_INIT
;
77 static conn
*qhead
= 0, **qtail
= &qhead
;
78 static int kidfd
= -1;
81 /*----- Main code ---------------------------------------------------------*/
85 * Arguments: @const connrq *rq@ = index of connection record
87 * Returns: Connected file descriptor, or @-1@.
89 * Use: Main privileged connection thing.
92 static int doconn(const connrq
*rq
)
94 struct sockaddr_in sin_bind
;
95 struct sockaddr_in sin_peer
;
100 /* --- Check the argument --- */
102 if (rq
->i
< 0 || rq
->i
>= DA_LEN(&cv
)) {
108 /* --- Make a new socket --- */
110 if ((fd
= socket(PF_INET
, SOCK_STREAM
, 0)) < 0)
113 /* --- Bind it to a low-numbered port --- */
115 memset(&sin_bind
, 0, sizeof(sin_bind
));
116 sin_bind
.sin_family
= AF_INET
;
117 sin_bind
.sin_addr
= rq
->bind
;
118 for (i
= 1023; i
>= 512; i
--) {
119 sin_bind
.sin_port
= htons(i
);
120 if (!bind(fd
, (struct sockaddr
*)&sin_bind
, sizeof(sin_bind
)))
122 if (errno
!= EADDRINUSE
)
127 /* --- Connect to the peer --- *
129 * We can find out whether it's connected later, so there's no need to
130 * distinguish these cases.
134 memset(&sin_peer
, 0, sizeof(sin_peer
));
135 sin_peer
.sin_family
= AF_INET
;
136 sin_peer
.sin_addr
= c
->peer
;
137 sin_peer
.sin_port
= c
->port
;
138 fdflags(fd
, O_NONBLOCK
, O_NONBLOCK
, 0, 0);
139 if (connect(fd
, (struct sockaddr
*)&sin_peer
, sizeof(sin_peer
)) < 0 &&
140 errno
!= EINPROGRESS
)
144 /* --- Tidy up on errors --- */
152 /* --- @dochild@ --- *
154 * Arguments: @int fd@ = my file descriptor
158 * Use: Child process for making privileged connections, separated
159 * from main process after initialization.
162 static void dochild(int fd
)
168 #if defined(_SC_OPEN_MAX)
169 int maxfd
= sysconf(_SC_OPEN_MAX
);
170 #elif defined(OPEN_MAX)
171 int maxfd
= OPEN_MAX
;
176 struct sigaction sa_dfl
;
178 /* --- Clear out unnecessary file descriptors --- */
182 for (i
= 3; i
< maxfd
; i
++)
183 if (i
!= fd
) close(i
);
185 /* --- Close off signal handlers --- */
187 sa_dfl
.sa_handler
= SIG_DFL
;
188 sigemptyset(&sa_dfl
.sa_mask
);
190 for (i
= 0; i
< 256; i
++) {
191 if (sigaction(i
, 0, &sa
))
193 if (sa
.sa_handler
!= SIG_DFL
&& sa
.sa_handler
!= SIG_IGN
)
194 sigaction(i
, &sa_dfl
, 0);
197 /* --- Main loop --- */
200 sz
= read(fd
, &rq
, sizeof(rq
));
204 die(1, "read error in privconn child: %s", strerror(errno
));
205 if ((nfd
= doconn(&rq
)) < 0)
208 sz
= fdpass_send(fd
, nfd
, &i
, sizeof(i
));
212 die(1, "short write in privconn child");
216 if (write(fd
, &errno
, sizeof(errno
)) < 0)
217 die(1, "write error in privconn child: %s", strerror(errno
));
222 /* --- @dorecvfd@ --- *
224 * Arguments: @int fd@ = file descriptor (@== kidfd@)
225 * @unsigned mode@ = what's happening (@== SEL_READ@)
226 * @void *p@ = uninteresting (@== 0@)
230 * Use: Receives a file descriptor from the privileged part.
233 void dorecvfd(int fd
, unsigned mode
, void *p
)
239 n
= fdpass_recv(kidfd
, &fd
, &e
, sizeof(e
));
244 qhead
= (conn
*)c
->writer
.next
;
245 if (!qhead
) qtail
= &qhead
;
246 if (n
< 0 || (errno
= e
) != 0)
252 conn_fd(c
, c
->writer
.s
, fd
, c
->func
, c
->p
);
264 for (c
= qhead
; c
; c
= cc
) {
265 cc
= (conn
*)c
->writer
.next
;
273 /* --- @privconn_split@ --- *
275 * Arguments: @sel_state *s@ = select state
279 * Use: Splits off the privileged binding code into a separate
283 void privconn_split(sel_state
*s
)
290 if (socketpair(PF_UNIX
, SOCK_STREAM
, 0, fd
) < 0)
291 die(1, "couldn't create privconn socketpair: %s", strerror(errno
));
293 if ((kid
= fork()) < 0)
294 die(1, "couldn't fork privconn child: %s", strerror(errno
));
301 fdflags(kidfd
, 0, 0, FD_CLOEXEC
, FD_CLOEXEC
);
302 sel_initfile(s
, &sf
, kidfd
, SEL_READ
, dorecvfd
, 0);
306 /* --- @privconn_adddest@ --- *
308 * Arguments: @struct in_addr peer@ = address to connect to
309 * @unsigned port@ = port to connect to
311 * Returns: Index for this destination address, or @-1@ if not
314 * Use: Adds a valid destination for a privileged connection.
317 int privconn_adddest(struct in_addr peer
, unsigned port
)
324 for (i
= 0; i
< DA_LEN(&cv
); i
++) {
326 if (peer
.s_addr
== c
->peer
.s_addr
&& port
== c
->port
)
337 /* --- @privconn_connect@ --- *
339 * Arguments: @conn *c@ = connection structure to fill in
340 * @sel_state *s@ = pointer to select state to attach to
341 * @int i@ = address index to connect to
342 * @struct in_addr bind@ = address to bind to
343 * @void (*func)(int, void *)@ = function to call on connect
344 * @void *p@ = argument for the function
346 * Returns: Zero on success, @-1@ on failure.
348 * Use: Sets up a privileged connection job.
351 int privconn_connect(conn
*c
, sel_state
*s
, int i
, struct in_addr bind
,
352 void (*func
)(int, void *), void *p
)
361 if ((fd
= doconn(&rq
)) < 0)
363 conn_fd(c
, s
, fd
, func
, p
);
367 n
= write(kidfd
, &rq
, sizeof(rq
));
376 qtail
= (conn
**)&c
->writer
.next
;
380 /*----- That's all, folks -------------------------------------------------*/