X-Git-Url: https://git.distorted.org.uk/~mdw/fwd/blobdiff_plain/ad4499e38234f977ed8c3b0ae689f470db5916cc..8938f77b2c12ccea6731a1eba7d788b2ba22348f:/fw.c

diff --git a/fw.c b/fw.c
index 6f886e5..9c29808 100644
--- a/fw.c
+++ b/fw.c
@@ -61,6 +61,7 @@
 #include "fattr.h"
 #include "file.h"
 #include "fw.h"
+#include "mantext.h"
 #include "privconn.h"
 #include "scan.h"
 #include "socket.h"
@@ -468,100 +469,15 @@ Other options:\n\
 static void grammar(FILE *fp)
 {
   version(fp);
-  pquis(fp, "\n\
-Grammar summary\n\
-\n\
-Basic syntax\n\
-	FILE ::= EMPTY | FILE STMT [`;']\n\
-	STMT ::= OPTION-STMT | FW-STMT\n\
-	FW-STMT ::= `fw' SOURCE OPTIONS [`to'|`->'] TARGET OPTIONS\n\
-	OPTIONS ::= `{' OPTION-SEQ `}'\n\
-	OPTION-SEQ ::= EMPTY | OPTION-STMT [`;'] OPTION-SEQ\n\
-\n\
-Option syntax\n\
-	OPTION-STMT ::= Q-OPTION\n\
-	Q-OPTION ::= OPTION\n\
-	     | PREFIX `.' Q-OPTION\n\
-	     | PREFIX `{' OPTION-SEQ `}'\n\
-	PREFIX ::= WORD\n\
-\n\
-File source and target\n\
-	SOURCE ::= FILE\n\
-	TARGET ::= FILE\n\
-	FILE ::= `file' [`.'] FSPEC [`,' FSPEC]\n\
-	FSPEC ::= FD-SPEC | NAME-SPEC | NULL-SPEC\n\
-	FD-SPEC ::= [[`:']`fd'[`:']] NUMBER|`stdin'|`stdout'\n\
-	NAME-SPEC ::= [[`:']`name'[`:']] FILE-NAME\n\
-	FILE-NAME ::= PATH-SEQ | [ PATH-SEQ ]\n\
-	PATH-SEQ ::= PATH-ELT | PATH-SEQ PATH-ELT\n\
-	PATH-ELT ::= `/' | WORD\n\
-	NULL-SPEC ::= [`:']`null'[`:']\n\
-\n\
-Exec source and target\n\
-	SOURCE ::= EXEC\n\
-	TARGET ::= EXEC\n\
-	EXEC ::= `exec' [`.'] CMD-SPEC\n\
-	CMD-SPEC ::= SHELL-CMD | [PROG-NAME] `[' ARGV0 ARG-SEQ `]'\n\
-	ARG-SEQ ::= WORD | ARG-SEQ WORD\n\
-	SHELL-CMD ::= WORD\n\
-	ARGV0 ::= WORD\n\
-\n\
-Socket source and target\n\
-	SOURCE ::= SOCKET-SOURCE\n\
-	TARGET ::= SOCKET-TARGET\n\
-	SOCKET-SOURCE ::= [`socket'[`.']] [[`:']ADDR-TYPE[`:']] SOURCE-ADDR\n\
-	SOCKET-TARGET ::= [`socket'[`.']] [[`:']ADDR-TYPE[`:']] TARGET-ADDR\n\
-\n\
-	INET-SOURCE-ADDR ::= [`port'] PORT\n\
-	INET-TARGET-ADDR ::= ADDRESS [`:'] PORT\n\
-	ADDRESS ::= ADDR-ELT | ADDRESS ADDR-ELT\n\
-	ADDR-ELT ::= `.' | WORD\n\
-\n\
-	UNIX-SOURCE-ADDR ::= FILE-NAME\n\
-	UNIX-TARGET-ADDR ::= FILE-NAME\n\
-");
+  fputs("\nGrammar summary\n\n", fp);
+  fputs(grammar_text, fp);
 }
 
 static void options(FILE *fp)
 {
   version(fp);
-  pquis(fp, "\n\
-Options summary\n\
-\n\
-File attributes (`fattr')\n\
-	prefix.FATTR.MODE [=] MODE\n\
-	prefix.FATTR.OWNER [=] USER\n\
-	prefix.FATTR.GROUP [=] GROUP\n\
-\n\
-File options\n\
-	file.create [=] yes|no\n\
-	file.open [=] no|truncate|append\n\
-	file.fattr.*\n\
-\n\
-Exec options\n\
-	exec.logging [=] yes|no\n\
-	exec.dir [=] FILE-NAME\n\
-	exec.root [=] FILE-NAME\n\
-	exec.user [=] USER\n\
-	exec.group [=] GROUP\n\
-	exec.rlimit.LIMIT[.hard|.soft] [=] VALUE\n\
-	exec.env.clear\n\
-	exec.env.unset VAR\n\
-	exec.env.[set] VAR [=] VALUE\n\
-\n\
-Socket options\n\
-	socket.conn [=] NUMBER|unlimited|one-shot\n\
-	socket.listen [=] NUMBER\n\
-	socket.logging [=] yes|no\n\
-\n\
-	socket.inet.source.[allow|deny] [host] ADDR [/ ADDR]\n\
-	socket.inet.source.[allow|deny] priv-port\n\
-	socket.inet.source.addr [=] any|ADDR\n\
-	socket.inet.dest.addr [=] any|ADDR\n\
-	socket.inet.dest.priv-port [=] yes|no\n\
-\n\
-	socket.unix.fattr.*\n\
-");
+  fputs("\nOption summary\n\n", fp);
+  fputs(option_text, fp);
 }
 
 /* --- @main@ --- *
@@ -763,20 +679,6 @@ int main(int argc, char *argv[])
     sig_add(&s_hup, SIGHUP, fw_reload, 0);
   }
 
-  /* --- Drop privileges --- */
-
-  if (drop != (uid_t)-1)
-    privconn_split(sel);
-#ifdef HAVE_SETGROUPS
-  if ((dropg != (gid_t)-1 && (setgid(dropg) || setgroups(1, &dropg))) ||
-      (drop != (uid_t)-1 && setuid(drop)))
-    die(1, "couldn't drop privileges: %s", strerror(errno));
-#else
-  if ((dropg != (gid_t)-1 && setgid(dropg)) ||
-      (drop != (uid_t)-1 && setuid(drop)))
-    die(1, "couldn't drop privileges: %s", strerror(errno));
-#endif
-
   /* --- Fork into the background --- */
 
   if (f & f_fork) {
@@ -814,6 +716,20 @@ int main(int argc, char *argv[])
     openlog(QUIS, 0, LOG_DAEMON);
   }
 
+  /* --- Drop privileges --- */
+
+  if (drop != (uid_t)-1)
+    privconn_split(sel);
+#ifdef HAVE_SETGROUPS
+  if ((dropg != (gid_t)-1 && (setgid(dropg) || setgroups(1, &dropg))) ||
+      (drop != (uid_t)-1 && setuid(drop)))
+    die(1, "couldn't drop privileges: %s", strerror(errno));
+#else
+  if ((dropg != (gid_t)-1 && setgid(dropg)) ||
+      (drop != (uid_t)-1 && setuid(drop)))
+    die(1, "couldn't drop privileges: %s", strerror(errno));
+#endif
+
   /* --- Let rip --- */
 
   if (!(flags & FW_SET))