--- /dev/null
+/* -*-c-*-
+ *
+ * $Id: privconn.c,v 1.1 2003/11/29 20:36:07 mdw Exp $
+ *
+ * Making privileged connections
+ *
+ * (c) 2003 Straylight/Edgeware
+ */
+
+/*----- Licensing notice --------------------------------------------------*
+ *
+ * This file is part of the `fw' port forwarder.
+ *
+ * `fw' is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * `fw' is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with `fw'; if not, write to the Free Software Foundation,
+ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*----- Revision history --------------------------------------------------*
+ *
+ * $Log: privconn.c,v $
+ * Revision 1.1 2003/11/29 20:36:07 mdw
+ * Privileged outgoing connections.
+ *
+ */
+
+/*----- Header files ------------------------------------------------------*/
+
+#include <assert.h>
+#include <errno.h>
+#include <signal.h>
+#include <string.h>
+
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <sys/socket.h>
+#include <arpa/inet.h>
+#include <netinet/in.h>
+
+#include <mLib/conn.h>
+#include <mLib/darray.h>
+#include <mLib/fdflags.h>
+#include <mLib/fdpass.h>
+#include <mLib/report.h>
+#include <mLib/sel.h>
+
+#include "privconn.h"
+
+/*----- Data structures ---------------------------------------------------*/
+
+typedef struct connrec {
+ struct in_addr peer;
+ unsigned port;
+} connrec;
+
+typedef struct connrq {
+ int i;
+ struct in_addr bind;
+} connrq;
+
+DA_DECL(connrec_v, connrec);
+
+/*----- Static variables --------------------------------------------------*/
+
+static connrec_v cv = DA_INIT;
+static conn *qhead = 0, **qtail = &qhead;
+static int kidfd = -1;
+static sel_file sf;
+
+/*----- Main code ---------------------------------------------------------*/
+
+/* --- @doconn@ --- *
+ *
+ * Arguments: @const connrq *rq@ = index of connection record
+ *
+ * Returns: Connected file descriptor, or @-1@.
+ *
+ * Use: Main privileged connection thing.
+ */
+
+static int doconn(const connrq *rq)
+{
+ struct sockaddr_in sin_bind;
+ struct sockaddr_in sin_peer;
+ int fd;
+ int i;
+ connrec *c;
+
+ /* --- Check the argument --- */
+
+ if (rq->i < 0 || rq->i >= DA_LEN(&cv)) {
+ errno = EINVAL;
+ goto fail_0;
+ }
+ c = &DA(&cv)[rq->i];
+
+ /* --- Make a new socket --- */
+
+ if ((fd = socket(PF_INET, SOCK_STREAM, 0)) < 0)
+ goto fail_0;
+
+ /* --- Bind it to a low-numbered port --- */
+
+ memset(&sin_bind, 0, sizeof(sin_bind));
+ sin_bind.sin_family = AF_INET;
+ sin_bind.sin_addr = rq->bind;
+ for (i = 1023; i >= 512; i--) {
+ sin_bind.sin_port = htons(i);
+ if (!bind(fd, (struct sockaddr *)&sin_bind, sizeof(sin_bind)))
+ goto bound;
+ if (errno != EADDRINUSE)
+ goto fail_1;
+ }
+ goto fail_1;
+
+ /* --- Connect to the peer --- *
+ *
+ * We can find out whether it's connected later, so there's no need to
+ * distinguish these cases.
+ */
+
+bound:
+ memset(&sin_peer, 0, sizeof(sin_peer));
+ sin_peer.sin_family = AF_INET;
+ sin_peer.sin_addr = c->peer;
+ sin_peer.sin_port = c->port;
+ fdflags(fd, O_NONBLOCK, O_NONBLOCK, 0, 0);
+ if (connect(fd, (struct sockaddr *)&sin_peer, sizeof(sin_peer)) < 0 &&
+ errno != EINPROGRESS)
+ goto fail_1;
+ return (fd);
+
+ /* --- Tidy up on errors --- */
+
+fail_1:
+ close(fd);
+fail_0:
+ return (-1);
+}
+
+/* --- @dochild@ --- *
+ *
+ * Arguments: @int fd@ = my file descriptor
+ *
+ * Returns: Never.
+ *
+ * Use: Child process for making privileged connections, separated
+ * from main process after initialization.
+ */
+
+static void dochild(int fd)
+{
+ int i;
+ connrq rq;
+ int nfd;
+ ssize_t sz;
+#if defined(_SC_OPEN_MAX)
+ int maxfd = sysconf(_SC_OPEN_MAX);
+#elif defined(OPEN_MAX)
+ int maxfd = OPEN_MAX;
+#else
+ int maxfd = -1;
+#endif
+ struct sigaction sa;
+ struct sigaction sa_dfl;
+
+ /* --- Clear out unnecessary file descriptors --- */
+
+ if (maxfd < 0)
+ maxfd = 256;
+ for (i = 3; i < maxfd; i++)
+ if (i != fd) close(i);
+
+ /* --- Close off signal handlers --- */
+
+ sa_dfl.sa_handler = SIG_DFL;
+ sigemptyset(&sa_dfl.sa_mask);
+ sa_dfl.sa_flags = 0;
+ for (i = 0; i < 256; i++) {
+ if (sigaction(i, 0, &sa))
+ break;
+ if (sa.sa_handler != SIG_DFL && sa.sa_handler != SIG_IGN)
+ sigaction(i, &sa_dfl, 0);
+ }
+
+ /* --- Main loop --- */
+
+ for (;;) {
+ sz = read(fd, &rq, sizeof(rq));
+ if (!sz)
+ break;
+ if (sz < 0)
+ die(1, "read error in privconn child: %s", strerror(errno));
+ if ((nfd = doconn(&rq)) < 0)
+ goto err;
+ i = 0;
+ sz = fdpass_send(fd, nfd, &i, sizeof(i));
+ if (sz < 0)
+ goto err;
+ if (sz < sizeof(i))
+ die(1, "short write in privconn child");
+ continue;
+
+ err:
+ if (write(fd, &errno, sizeof(errno)) < 0)
+ die(1, "write error in privconn child: %s", strerror(errno));
+ }
+ _exit(0);
+}
+
+/* --- @dorecvfd@ --- *
+ *
+ * Arguments: @int fd@ = file descriptor (@== kidfd@)
+ * @unsigned mode@ = what's happening (@== SEL_READ@)
+ * @void *p@ = uninteresting (@== 0@)
+ *
+ * Returns: ---
+ *
+ * Use: Receives a file descriptor from the privileged part.
+ */
+
+void dorecvfd(int fd, unsigned mode, void *p)
+{
+ conn *c, *cc;
+ ssize_t n;
+ int e;
+
+ n = fdpass_recv(kidfd, &fd, &e, sizeof(e));
+ if (!n)
+ goto close;
+ assert(qhead);
+ c = qhead;
+ qhead = (conn *)c->writer.next;
+ if (!qhead) qtail = &qhead;
+ if (n < 0 || (errno = e) != 0)
+ goto fail;
+ if (fd == -1) {
+ errno = EIO;
+ goto fail;
+ }
+ conn_fd(c, c->writer.s, fd, c->func, c->p);
+ return;
+
+fail:
+ c->func(-1, c->p);
+ return;
+
+close:
+ close(kidfd);
+ kidfd = 0;
+ errno = EIO;
+ sel_rmfile(&sf);
+ for (c = qhead; c; c = cc) {
+ cc = (conn *)c->writer.next;
+ c->func(-1, c->p);
+ }
+ qhead = 0;
+ qtail = &qhead;
+ return;
+}
+
+/* --- @privconn_split@ --- *
+ *
+ * Arguments: @sel_state *s@ = select state
+ *
+ * Returns: ---
+ *
+ * Use: Splits off the privileged binding code into a separate
+ * process.
+ */
+
+void privconn_split(sel_state *s)
+{
+ pid_t kid;
+ int fd[2];
+
+ if (kidfd != -1)
+ return;
+ if (socketpair(PF_UNIX, SOCK_STREAM, 0, fd) < 0)
+ die(1, "couldn't create privconn socketpair: %s", strerror(errno));
+ kidfd = fd[0];
+ if ((kid = fork()) < 0)
+ die(1, "couldn't fork privconn child: %s", strerror(errno));
+ if (!kid) {
+ close(kidfd);
+ dochild(fd[1]);
+ _exit(127);
+ }
+ close(fd[1]);
+ fdflags(kidfd, 0, 0, FD_CLOEXEC, FD_CLOEXEC);
+ sel_initfile(s, &sf, kidfd, SEL_READ, dorecvfd, 0);
+ sel_addfile(&sf);
+}
+
+/* --- @privconn_adddest@ --- *
+ *
+ * Arguments: @struct in_addr peer@ = address to connect to
+ * @unsigned port@ = port to connect to
+ *
+ * Returns: Index for this destination address, or @-1@ if not
+ * available.
+ *
+ * Use: Adds a valid destination for a privileged connection.
+ */
+
+int privconn_adddest(struct in_addr peer, unsigned port)
+{
+ int i;
+ struct connrec *c;
+
+ if (kidfd != -1)
+ return (-1);
+ for (i = 0; i < DA_LEN(&cv); i++) {
+ c = &DA(&cv)[i];
+ if (peer.s_addr == c->peer.s_addr && port == c->port)
+ return (i);
+ }
+ DA_ENSURE(&cv, 1);
+ DA_EXTEND(&cv, 1);
+ c = &DA(&cv)[i];
+ c->peer = peer;
+ c->port = port;
+ return (i);
+}
+
+/* --- @privconn_connect@ --- *
+ *
+ * Arguments: @conn *c@ = connection structure to fill in
+ * @sel_state *s@ = pointer to select state to attach to
+ * @int i@ = address index to connect to
+ * @struct in_addr bind@ = address to bind to
+ * @void (*func)(int, void *)@ = function to call on connect
+ * @void *p@ = argument for the function
+ *
+ * Returns: Zero on success, @-1@ on failure.
+ *
+ * Use: Sets up a privileged connection job.
+ */
+
+int privconn_connect(conn *c, sel_state *s, int i, struct in_addr bind,
+ void (*func)(int, void *), void *p)
+{
+ int fd;
+ connrq rq;
+ ssize_t n;
+
+ rq.i = i;
+ rq.bind = bind;
+ if (kidfd == -1) {
+ if ((fd = doconn(&rq)) < 0)
+ return (-1);
+ conn_fd(c, s, fd, func, p);
+ return (0);
+ }
+
+ n = write(kidfd, &rq, sizeof(rq));
+ if (n < 0)
+ return (-1);
+ c->writer.fd = -1;
+ c->writer.s = s;
+ c->writer.next = 0;
+ c->func = func;
+ c->p = p;
+ *qtail = c;
+ qtail = (conn **)&c->writer.next;
+ return (0);
+}
+
+/*----- That's all, folks -------------------------------------------------*/
~mdw / fwd / blobdiff