From: Mark Wooding Date: Sun, 21 Oct 2012 14:10:46 +0000 (+0100) Subject: configure.ac, yaid.c: Make it be a proper Unix daemon. X-Git-Tag: 1.0.0~5 X-Git-Url: https://git.distorted.org.uk/~mdw/yaid/commitdiff_plain/74716d82c226627463ff2b1b98888670c762502d configure.ac, yaid.c: Make it be a proper Unix daemon. Forks into background, drops privilege, proper logging, and all the usual trappings. --- diff --git a/configure.ac b/configure.ac index eebc30d..682cb36 100644 --- a/configure.ac +++ b/configure.ac @@ -58,6 +58,14 @@ esac AC_SUBST([SYS]) dnl-------------------------------------------------------------------------- +dnl Paths for interesting files. + +mdw_DEFINE_PATHS([ + mdw_DEFINE_PATH([POLICYFILE], [${sysconfdir}/yaid.policy], + [read global policy from this file.]) +]) + +dnl-------------------------------------------------------------------------- dnl Produce output. AC_CONFIG_HEADER([config/config.h]) diff --git a/yaid.c b/yaid.c index 1d45fb8..601aa51 100644 --- a/yaid.c +++ b/yaid.c @@ -76,6 +76,9 @@ struct proxy { static sel_state sel; /* I/O multiplexer state */ +static const char *pidfile = 0; /* Where to write daemon's pid */ + +static const char *policyfile = POLICYFILE; /* Filename for global policy */ static const struct policy default_policy = POLICY_INIT(A_NAME); static policy_v policy = DA_INIT; /* Vector of global policy rules */ static fwatch polfw; /* Watch policy file for changes */ @@ -84,6 +87,10 @@ static unsigned char tokenbuf[4096]; /* Random-ish data for tokens */ static size_t tokenptr = sizeof(tokenbuf); /* Current read position */ static int randfd; /* File descriptor for random data */ +static unsigned flags = 0; /* Various interesting flags */ +#define F_SYSLOG 1u /* Use syslog for logging */ +#define F_RUNNING 2u /* Running properly now */ + /*----- Ident protocol parsing --------------------------------------------*/ /* Advance *PP over whitespace characters. */ @@ -217,6 +224,9 @@ void logmsg(const struct query *q, int prio, const char *msg, ...) { va_list ap; dstr d = DSTR_INIT; + time_t t; + struct tm *tm; + char buf[64]; va_start(ap, msg); if (q) { @@ -227,7 +237,18 @@ void logmsg(const struct query *q, int prio, const char *msg, ...) } dstr_vputf(&d, msg, &ap); va_end(ap); - fprintf(stderr, "yaid: %s\n", d.buf); + + if (!(flags & F_RUNNING)) + moan("%s", d.buf); + else if (flags & F_SYSLOG) + syslog(prio, "%s", d.buf); + else { + t = time(0); + tm = localtime(&t); + strftime(buf, sizeof(buf), "%Y-%m-%d %H:%M:%S %z", tm); + fprintf(stderr, "%s %s: %s\n", buf, QUIS, d.buf); + } + dstr_destroy(&d); } @@ -622,9 +643,9 @@ static void client_line(char *line, size_t len, void *p) /* See if the policy file has changed since we last looked. If so, try to * read the new version. */ - if (fwatch_update(&polfw, "yaid.policy")) { - logmsg(0, LOG_INFO, "reload master policy file `%s'", "yaid.policy"); - load_policy_file("yaid.policy", &policy); + if (fwatch_update(&polfw, policyfile)) { + logmsg(0, LOG_INFO, "reload master policy file `%s'", policyfile); + load_policy_file(policyfile, &policy); } /* Read the local and remote port numbers into the query structure. */ @@ -882,37 +903,208 @@ static int make_listening_socket(const struct addrops *ao, int port) return (0); } +/* Quit because of a fatal signal. */ +static void quit(int sig, void *p) +{ + const char *signame = p; + + logmsg(0, LOG_NOTICE, "shutting down on %s", signame); + if (pidfile) unlink(pidfile); + exit(0); +} + +/* Answer whether the string pointed to by P consists entirely of digits. */ +static int numericp(const char *p) +{ + while (*p) + if (!isdigit((unsigned char)*p++)) return (0); + return (1); +} + +static void usage(FILE *fp) +{ + pquis(fp, "Usage: $ [-Dl] [-G GROUP] [-U USER] [-P FILE] " + "[-c FILE] [-p PORT]\n"); +} + +static void version(FILE *fp) + { pquis(fp, "$, version " VERSION "\n"); } + +static void help(FILE *fp) +{ + version(fp); fputc('\n', fp); + usage(fp); + fputs("\n\ +Yet Another Ident Daemon. Really, the world doesn't need such a thing.\n\ +It's just a shame none of the others do the right things.\n\ +\n\ +Options:\n\ +\n\ + -h, --help Show this help message.\n\ + -v, --version Show the version number.\n\ + -u, --usage Show a very short usage summary.\n\ +\n\ + -D, --daemon Become a daemon, running in the background.\n\ + -G, --group=GROUP Set group after initialization.\n\ + -P, --pidfile=FILE Write process id to FILE.\n\ + -U, --user=USER Set user after initialization.\n\ + -c, --config=FILE Read global policy from FILE.\n\ + -l, --syslog Write log messages using syslog(3).\n\ + -p, --port=PORT Listen for connections on this port.\n", + fp); +} + int main(int argc, char *argv[]) { int port = 113; + uid_t u = -1; + gid_t g = -1; + struct passwd *pw = 0; + struct group *gr; + struct servent *s; + sig sigint, sigterm; + FILE *fp = 0; + int i; + unsigned f = 0; +#define f_bogus 1u +#define f_daemon 2u const struct addrops *ao; int any = 0; ego(argv[0]); - fwatch_init(&polfw, "yaid.policy"); + /* Parse command-line options. */ + for (;;) { + const struct option opts[] = { + { "help", 0, 0, 'h' }, + { "version", 0, 0, 'v' }, + { "usage", 0, 0, 'u' }, + { "daemon", 0, 0, 'D' }, + { "group", OPTF_ARGREQ, 0, 'G' }, + { "pidfile", OPTF_ARGREQ, 0, 'P' }, + { "user", OPTF_ARGREQ, 0, 'U' }, + { "config", OPTF_ARGREQ, 0, 'c' }, + { "syslog", 0, 0, 'l' }, + { "port", OPTF_ARGREQ, 0, 'p' }, + { 0, 0, 0, 0 } + }; + + if ((i = mdwopt(argc, argv, "hvuDG:P:U:c:lp:", opts, 0, 0, 0)) < 0) + break; + switch (i) { + case 'h': help(stdout); exit(0); + case 'v': version(stdout); exit(0); + case 'u': usage(stdout); exit(0); + case 'D': f |= f_daemon; break; + case 'P': pidfile = optarg; break; + case 'c': policyfile = optarg; break; + case 'l': flags |= F_SYSLOG; break; + case 'G': + if (numericp(optarg)) + g = atoi(optarg); + else if ((gr = getgrnam(optarg)) == 0) + die(1, "unknown group `%s'", optarg); + else + g = gr->gr_gid; + break; + case 'U': + if (numericp(optarg)) + u = atoi(optarg); + else if ((pw = getpwnam(optarg)) == 0) + die(1, "unknown user `%s'", optarg); + else + u = pw->pw_uid; + break; + case 'p': + if (numericp(optarg)) + port = atoi(optarg); + else if ((s = getservbyname(optarg, "tcp")) == 0) + die(1, "unknown service name `%s'", optarg); + else + port = ntohs(s->s_port); + break; + default: f |= f_bogus; break; + } + } + if (optind < argc) f |= f_bogus; + if (f & f_bogus) { usage(stderr); exit(1); } + + /* If a user has been requested, but no group, then find the user's primary + * group. If the user was given by name, then we already have a password + * entry and should use that, in case two differently-named users have the + * same uid but distinct gids. + */ + if (u != -1 && g == -1) { + if (!pw && (pw = getpwuid(u)) == 0) { + die(1, "failed to find password entry for user %d: " + "request group explicitly", u); + } + g = pw->pw_gid; + } + + /* Initialize system-specific machinery. */ init_sys(); - if (load_policy_file("yaid.policy", &policy)) + + /* Load the global policy rules. */ + fwatch_init(&polfw, policyfile); + if (load_policy_file(policyfile, &policy)) exit(1); - { int i; - for (i = 0; i < DA_LEN(&policy); i++) - print_policy(&DA(&policy)[i]); - } + /* Open the random data source. */ if ((randfd = open("/dev/urandom", O_RDONLY)) < 0) { die(1, "failed to open `/dev/urandom' for reading: %s", strerror(errno)); } + /* Set up the I/O event system. */ sel_init(&sel); + + /* Watch for some interesting signals. */ + sig_init(&sel); + sig_add(&sigint, SIGINT, quit, "SIGINT"); + sig_add(&sigterm, SIGTERM, quit, "SIGTERM"); + + /* Listen for incoming connections. */ for (ao = addroptab; ao->name; ao++) if (!make_listening_socket(ao, port)) any = 1; - if (!any) - die(1, "no IP protocols supported"); + if (!any) die(1, "no IP protocols supported"); + + /* Open the pidfile now, in case it's somewhere we can't write. */ + if (pidfile && (fp = fopen(pidfile, "w")) == 0) { + die(1, "failed to open pidfile `%s' for writing: %s", + pidfile, strerror(errno)); + } + + /* If we're meant to use syslog, then open the log. */ + if (flags & F_SYSLOG) + openlog(QUIS, 0, LOG_DAEMON); + + /* Drop privileges. */ + if ((g != -1 && (setegid(g) || setgid(g) || + (getuid() == 0 && setgroups(1, &g)))) || + (u != -1 && setuid(u))) + die(1, "failed to drop privileges: %s", strerror(errno)); - for (;;) - if (sel_select(&sel)) die(1, "select failed: %s", strerror(errno)); + /* Become a background process, if requested. */ + if ((f & f_daemon) && daemonize()) + die(1, "failed to become daemon: %s", strerror(errno)); + + /* Write the process id to the pidfile. */ + if (fp) { + fprintf(fp, "%d\n", getpid()); + fclose(fp); + } + + /* And now we're going. */ + flags |= F_RUNNING; + + /* Read events and process them. */ + for (;;) { + if (sel_select(&sel) && errno != EINTR) + die(1, "select failed: %s", strerror(errno)); + } + /* This just keeps the compiler happy. */ return (0); } diff --git a/yaid.h b/yaid.h index daae4f6..4011787 100644 --- a/yaid.h +++ b/yaid.h @@ -50,24 +50,29 @@ #include #include +#include #include #include #include #include +#include #include #include #include +#include #include #include #include #include +#include #include #include #include #include +#include /*----- Address family handling -------------------------------------------*/