/* -*-c-*-
*
- * $Id: fw.c,v 1.3 1999/07/26 23:30:42 mdw Exp $
+ * $Id: fw.c,v 1.8 2000/03/23 23:19:19 mdw Exp $
*
* Port forwarding thingy
*
/*----- Revision history --------------------------------------------------*
*
* $Log: fw.c,v $
+ * Revision 1.8 2000/03/23 23:19:19 mdw
+ * Fix changed options in parser table.
+ *
+ * Revision 1.7 2000/03/23 00:37:33 mdw
+ * Add option to change user and group after initialization. Naughtily
+ * reassign short equivalents of --grammar and --options.
+ *
+ * Revision 1.6 1999/12/22 15:44:10 mdw
+ * Make syslog a separate option, and do it better.
+ *
+ * Revision 1.5 1999/10/22 22:47:50 mdw
+ * Grammar changes. Also, don't enable SIGINT if it's currently ignored.
+ *
+ * Revision 1.4 1999/10/10 16:46:12 mdw
+ * New resolver to initialize. Also, include options for grammar and
+ * options references.
+ *
* Revision 1.3 1999/07/26 23:30:42 mdw
* Major reconstruction work for new design.
*
#include <unistd.h>
#include <syslog.h>
+#include <grp.h>
+#include <pwd.h>
+
+#include <mLib/bres.h>
#include <mLib/dstr.h>
#include <mLib/mdwopt.h>
#include <mLib/quis.h>
#include <mLib/sig.h>
#include <mLib/sub.h>
-#include "bres.h"
#include "conf.h"
#include "endpt.h"
#include "exec.h"
t = time(0);
tm = localtime(&t);
DENSURE(&d, 64);
- d.len += strftime(d.buf, d.sz, "%Y-%m-%d %H:%M:%S", tm);
- DPUTC(&d, ' ');
+ d.len += strftime(d.buf, d.sz, "%Y-%m-%d %H:%M:%S ", tm);
va_start(ap, fmt);
dstr_vputf(&d, fmt, ap);
va_end(ap);
static void version(FILE *fp)
{
- fprintf(fp, "%s version " VERSION "\n", QUIS);
+ pquis(fp, "$ version " VERSION "\n");
}
static void usage(FILE *fp)
{
- fprintf(stderr, "Usage: %s [-db] [-f file] [config statements...]\n",
- QUIS);
+ pquis(fp, "Usage: $ [-dql] [-f file] [config statements...]\n");
}
static void help(FILE *fp)
version(fp);
fputc('\n', fp);
usage(fp);
- fputs("\n\
+ pquis(fp, "\n\
An excessively full-featured port-forwarder, which subsumes large chunks\n\
of the functionality of inetd, netcat, and normal cat. Options available\n\
are:\n\
\n\
--h, --help Display this help message.\n\
--v, --version Display the program's version number.\n\
--u, --usage Display a terse usage summary.\n\
+-h, --help Display this help message.\n\
+-v, --version Display the program's version number.\n\
+-u, --usage Display a terse usage summary.\n\
\n\
--f, --file=FILE Read configuration from a file.\n\
--d, --daemon Fork into background after initializing.\n\
+-G, --grammar Show a summary of the configuration language.\n\
+-O, --options Show a summary of the source and target options.\n\
+\n\
+-f, --file=FILE Read configuration from a file.\n\
+-q, --quiet Don't emit any logging information.\n\
+-d, --daemon Fork into background after initializing.\n\
+-l, --syslog Send log output to the system logger.\n\
+-s, --setuid=USER Change uid to USER after initializing sources.\n\
+-g, --setgid=GRP Change gid to GRP after initializing sources.\n\
\n\
Configuration may be supplied in one or more configuration files, or on\n\
the command line (or both). If no `-f' option is present, and no\n\
continue to the end of the line. Each command line argument is considered\n\
to be a separate line.\n\
\n\
-The syntax is too complicated to describe here. Read the manual.\n\
-", fp);
+The grammar is fairly complicated. For a summary, run `$ --grammar'.\n\
+For a summary of the various options, run `$ --options'.\n\
+");
+}
+
+/* --- Other helpful options --- */
+
+static void grammar(FILE *fp)
+{
+ version(fp);
+ pquis(fp, "\n\
+Grammar summary\n\
+\n\
+Basic syntax\n\
+ file ::= empty | file stmt [`;']\n\
+ stmt ::= option-stmt | fw-stmt\n\
+ fw-stmt ::= `fw' source options [`to'|`->'] target options\n\
+ options ::= `{' option-seq `}'\n\
+ option-seq ::= empty | option-stmt [`;'] option-seq\n\
+\n\
+Option syntax\n\
+ option-stmt ::= q-option\n\
+ q-option ::= option\n\
+ | prefix `.' q-option\n\
+ | prefix `{' option-seq `}'\n\
+ prefix ::= word\n\
+\n\
+File source and target\n\
+ source ::= file\n\
+ target ::= file\n\
+ file ::= `file' [`.'] fspec [`,' fspec]\n\
+ fspec ::= fd-spec | name-spec | null-spec\n\
+ fd-spec ::= [[`:']`fd'[`:']] number|`stdin'|`stdout'\n\
+ name-spec ::= [[`:']`file'[`:']] file-name\n\
+ file-name ::= path-seq | [ path-seq ]\n\
+ path-seq ::= path-elt | path-seq path-elt\n\
+ path-elt ::= `/' | word\n\
+ null-spec ::= [`:']`null'[`:']\n\
+\n\
+Exec source and target\n\
+ source ::= exec\n\
+ target ::= exec\n\
+ exec ::= `exec' [`.'] cmd-spec\n\
+ cmd-spec ::= shell-cmd | [prog-name] `[' argv0 arg-seq `]'\n\
+ arg-seq ::= word | arg-seq word\n\
+ shell-cmd ::= word\n\
+ argv0 ::= word\n\
+\n\
+Socket source and target\n\
+ source ::= socket-source\n\
+ target ::= socket-target\n\
+ socket-source ::= [`socket'[`.']] [[`:']addr-type[`:']] source-addr\n\
+ socket-target ::= [`socket'[`.']] [[`:']addr-type[`:']] target-addr\n\
+\n\
+ inet-source-addr ::= [port] port\n\
+ inet-target-addr ::= address [`:'] port\n\
+ address ::= addr-elt | address addr-elt\n\
+ addr-elt ::= `.' | word\n\
+\n\
+ unix-source-addr ::= file-name\n\
+ unix-target-addr ::= file-name\n\
+");
+}
+
+static void options(FILE *fp)
+{
+ version(fp);
+ pquis(fp, "\n\
+Options summary\n\
+\n\
+File attributes (`fattr')\n\
+ prefix.fattr.mode [=] mode\n\
+ prefix.fattr.owner [=] user\n\
+ prefix.fattr.group [=] group\n\
+\n\
+File options\n\
+ file.create [=] yes|no\n\
+ file.open [=] no|truncate|append\n\
+ file.fattr.*\n\
+\n\
+Exec options\n\
+ exec.logging [=] yes|no\n\
+ exec.dir [=] file-name\n\
+ exec.root [=] file-name\n\
+ exec.user [=] user\n\
+ exec.group [=] group\n\
+ exec.rlimit.limit[.hard|.soft] [=] value\n\
+ exec.env.clear\n\
+ exec.env.unset var\n\
+ exec.env.[set] var [=] value\n\
+\n\
+Socket options\n\
+ socket.conn [=] number|unlimited|one-shot\n\
+ socket.logging [=] yes|no\n\
+ socket.inet.[allow|deny] [from] address [/ address]\n\
+ socket.unix.fattr.*\n\
+");
}
/* --- @main@ --- *
sel_state sst;
sig s_term, s_int;
scanner sc;
+ uid_t drop = -1;
+ gid_t dropg = -1;
enum {
f_bogus = 1,
f_file = 2,
+ f_syslog = 4,
f_fork = 8
};
sub_init();
sig_init(sel);
bres_init(sel);
+ bres_exec(0);
exec_init();
fattr_init(&fattr_global);
scan_create(&sc);
- /* --- Set up some signal handlers --- */
+ /* --- Set up some signal handlers --- *
+ *
+ * Don't enable @SIGINT@ if the caller already disabled it.
+ */
+
+ {
+ struct sigaction sa;
+
+ sig_add(&s_term, SIGTERM, fw_tidy, 0);
+ sigaction(SIGINT, 0, &sa);
+ if (sa.sa_handler != SIG_IGN)
+ sig_add(&s_int, SIGINT, fw_tidy, 0);
+ }
- sig_add(&s_term, SIGTERM, fw_tidy, 0);
- sig_add(&s_int, SIGINT, fw_tidy, 0);
atexit(fw_exit);
/* --- Parse command line options --- */
{ "version", 0, 0, 'v' },
{ "usage", 0, 0, 'u' },
+ /* --- Other help options --- */
+
+ { "grammar", 0, 0, 'G' },
+ { "options", 0, 0, 'O' },
+
/* --- Other useful arguments --- */
{ "file", OPTF_ARGREQ, 0, 'f' },
{ "fork", 0, 0, 'd' },
{ "daemon", 0, 0, 'd' },
+ { "syslog", 0, 0, 'l' },
+ { "log", 0, 0, 'l' },
{ "quiet", 0, 0, 'q' },
+ { "setuid", OPTF_ARGREQ, 0, 's' },
+ { "uid", OPTF_ARGREQ, 0, 's' },
+ { "setgid", OPTF_ARGREQ, 0, 'g' },
+ { "gid", OPTF_ARGREQ, 0, 'g' },
/* --- Magic terminator --- */
{ 0, 0, 0, 0 }
};
- int i = mdwopt(argc, argv, "+hvu f:d", opts, 0, 0, 0);
+ int i = mdwopt(argc, argv, "+hvu GO f:dls:g:", opts, 0, 0, 0);
if (i < 0)
break;
usage(stdout);
exit(0);
break;
+ case 'G':
+ grammar(stdout);
+ exit(0);
+ break;
+ case 'O':
+ options(stdout);
+ exit(0);
+ break;
case 'f':
if (strcmp(optarg, "-") == 0)
scan_add(&sc, scan_file(stdin, "<stdin>", SCF_NOCLOSE));
case 'd':
f |= f_fork;
break;
+ case 'l':
+ f |= f_syslog;
+ break;
case 'q':
flags |= FW_QUIET;
break;
+ case 's':
+ if (isdigit((unsigned char )optarg[0])) {
+ char *q;
+ drop = strtol(optarg, &q, 0);
+ if (*q)
+ die(1, "bad uid `%s'", optarg);
+ } else {
+ struct passwd *pw = getpwnam(optarg);
+ if (!pw)
+ die(1, "unknown user `%s'", optarg);
+ drop = pw->pw_uid;
+ }
+ break;
+ case 'g':
+ if (isdigit((unsigned char )optarg[0])) {
+ char *q;
+ dropg = strtol(optarg, &q, 0);
+ if (*q)
+ die(1, "bad gid `%s'", optarg);
+ } else {
+ struct group *gr = getgrnam(optarg);
+ if (!gr)
+ die(1, "unknown group `%s'", optarg);
+ dropg = gr->gr_gid;
+ }
+ break;
default:
f |= f_bogus;
break;
conf_parse(&sc);
+ /* --- Drop privileges --- */
+
+#ifdef HAVE_SETGROUPS
+ if ((dropg != -1 && (setgid(dropg) || setgroups(1, &dropg))) ||
+#else
+ if ((dropg != -1 && setgid(dropg)) ||
+#endif
+ (drop != -1 && setuid(drop)))
+ die(1, "couldn't drop privileges: %s", strerror(errno));
+
/* --- Fork into the background --- */
if (f & f_fork) {
kid = fork();
if (kid != 0)
_exit(0);
+ }
+ if (f & f_syslog) {
flags |= FW_SYSLOG;
openlog(QUIS, 0, LOG_DAEMON);
}
~mdw / fwd / blobdiff