Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 1 | /* Based on ipsvd utilities written by Gerrit Pape <pape@smarden.org> |
| 2 | * which are released into public domain by the author. |
| 3 | * Homepage: http://smarden.sunsite.dk/ipsvd/ |
| 4 | * |
Denis Vlasenko | d18f52b | 2008-03-02 12:53:15 +0000 | [diff] [blame] | 5 | * Copyright (C) 2007 Denys Vlasenko. |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 6 | * |
Denys Vlasenko | 0ef64bd | 2010-08-16 20:14:46 +0200 | [diff] [blame] | 7 | * Licensed under GPLv2, see file LICENSE in this source tree. |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 8 | */ |
| 9 | |
Denis Vlasenko | 4866e90 | 2008-03-17 09:17:27 +0000 | [diff] [blame] | 10 | /* Based on ipsvd-0.12.1. This tcpsvd accepts all options |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 11 | * which are supported by one from ipsvd-0.12.1, but not all are |
| 12 | * functional. See help text at the end of this file for details. |
| 13 | * |
| 14 | * Code inside "#ifdef SSLSVD" is for sslsvd and is currently unused. |
| 15 | * |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 16 | * Busybox version exports TCPLOCALADDR instead of |
| 17 | * TCPLOCALIP + TCPLOCALPORT pair. ADDR more closely matches reality |
| 18 | * (which is "struct sockaddr_XXX". Port is not a separate entity, |
| 19 | * it's just a part of (AF_INET[6]) sockaddr!). |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 20 | * |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 21 | * TCPORIGDSTADDR is Busybox-specific addition. |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 22 | * |
| 23 | * udp server is hacked up by reusing TCP code. It has the following |
| 24 | * limitation inherent in Unix DGRAM sockets implementation: |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 25 | * - local IP address is retrieved (using recvmsg voodoo) but |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 26 | * child's socket is not bound to it (bind cannot be called on |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 27 | * already bound socket). Thus it still can emit outgoing packets |
Denis Vlasenko | beaca81 | 2007-04-13 16:32:26 +0000 | [diff] [blame] | 28 | * with wrong source IP... |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 29 | * - don't know how to retrieve ORIGDST for udp. |
| 30 | */ |
| 31 | |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 32 | //usage:#define tcpsvd_trivial_usage |
| 33 | //usage: "[-hEv] [-c N] [-C N[:MSG]] [-b N] [-u USER] [-l NAME] IP PORT PROG" |
| 34 | /* with not-implemented options: */ |
| 35 | /* //usage: "[-hpEvv] [-c N] [-C N[:MSG]] [-b N] [-u USER] [-l NAME] [-i DIR|-x CDB] [-t SEC] IP PORT PROG" */ |
| 36 | //usage:#define tcpsvd_full_usage "\n\n" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 37 | //usage: "Create TCP socket, bind to IP:PORT and listen for incoming connections.\n" |
| 38 | //usage: "Run PROG for each connection.\n" |
| 39 | //usage: "\n IP PORT IP:PORT to listen on" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 40 | //usage: "\n PROG ARGS Program to run" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 41 | //usage: "\n -u USER[:GRP] Change to user/group after bind" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 42 | //usage: "\n -c N Up to N connections simultaneously (default 30)" |
| 43 | //usage: "\n -b N Allow backlog of approximately N TCP SYNs (default 20)" |
| 44 | //usage: "\n -C N[:MSG] Allow only up to N connections from the same IP:" |
| 45 | //usage: "\n new connections from this IP address are closed" |
| 46 | //usage: "\n immediately, MSG is written to the peer before close" |
| 47 | //usage: "\n -E Don't set up environment" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 48 | //usage: "\n -h Look up peer's hostname" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 49 | //usage: "\n -l NAME Local hostname (else look up local hostname in DNS)" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 50 | //usage: "\n -v Verbose" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 51 | //usage: "\n" |
| 52 | //usage: "\nEnvironment if no -E:" |
| 53 | //usage: "\nPROTO='TCP'" |
| 54 | //usage: "\nTCPREMOTEADDR='ip:port'" IF_FEATURE_IPV6(" ('[ip]:port' for IPv6)") |
| 55 | //usage: "\nTCPLOCALADDR='ip:port'" |
| 56 | //usage: "\nTCPORIGDSTADDR='ip:port' of destination before firewall" |
| 57 | //usage: "\n Useful for REDIRECTed-to-local connections:" |
| 58 | //usage: "\n iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to 8080" |
| 59 | //usage: "\nTCPCONCURRENCY=num_of_connects_from_this_ip" |
| 60 | //usage: "\nIf -h:" |
| 61 | //usage: "\nTCPLOCALHOST='hostname' (-l NAME is used if specified)" |
| 62 | //usage: "\nTCPREMOTEHOST='hostname'" |
| 63 | |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 64 | //usage: |
| 65 | //usage:#define udpsvd_trivial_usage |
| 66 | //usage: "[-hEv] [-c N] [-u USER] [-l NAME] IP PORT PROG" |
| 67 | //usage:#define udpsvd_full_usage "\n\n" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 68 | //usage: "Create UDP socket, bind to IP:PORT and wait for incoming packets.\n" |
| 69 | //usage: "Run PROG for each packet, redirecting all further packets with same\n" |
| 70 | //usage: "peer ip:port to it.\n" |
| 71 | //usage: "\n IP PORT IP:PORT to listen on" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 72 | //usage: "\n PROG ARGS Program to run" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 73 | //usage: "\n -u USER[:GRP] Change to user/group after bind" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 74 | //usage: "\n -c N Up to N connections simultaneously (default 30)" |
| 75 | //usage: "\n -E Don't set up environment" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 76 | //usage: "\n -h Look up peer's hostname" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 77 | //usage: "\n -l NAME Local hostname (else look up local hostname in DNS)" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 78 | //usage: "\n -v Verbose" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 79 | //usage: "\n" |
| 80 | //usage: "\nEnvironment if no -E:" |
| 81 | //usage: "\nPROTO='UDP'" |
| 82 | //usage: "\nUDPREMOTEADDR='ip:port'" IF_FEATURE_IPV6(" ('[ip]:port' for IPv6)") |
| 83 | //usage: "\nUDPLOCALADDR='ip:port'" |
| 84 | //usage: "\nIf -h:" |
| 85 | //usage: "\nUDPLOCALHOST='hostname' (-l NAME is used if specified)" |
| 86 | //usage: "\nUDPREMOTEHOST='hostname'" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 87 | |
Denis Vlasenko | b6adbf1 | 2007-05-26 19:00:18 +0000 | [diff] [blame] | 88 | #include "libbb.h" |
Denys Vlasenko | e6a2f4c | 2016-04-21 16:26:30 +0200 | [diff] [blame] | 89 | #include "common_bufsiz.h" |
Jeremie Koenig | 2ea12d8 | 2010-05-27 15:46:25 +0200 | [diff] [blame] | 90 | |
Denis Vlasenko | 165f5b3 | 2008-03-31 20:30:38 +0000 | [diff] [blame] | 91 | /* Wants <limits.h> etc, thus included after libbb.h: */ |
Jeremie Koenig | 2ea12d8 | 2010-05-27 15:46:25 +0200 | [diff] [blame] | 92 | #ifdef __linux__ |
Denis Vlasenko | c0cd9f2 | 2008-06-07 12:23:44 +0000 | [diff] [blame] | 93 | #include <linux/types.h> /* for __be32 etc */ |
Denis Vlasenko | 165f5b3 | 2008-03-31 20:30:38 +0000 | [diff] [blame] | 94 | #include <linux/netfilter_ipv4.h> |
Jeremie Koenig | 2ea12d8 | 2010-05-27 15:46:25 +0200 | [diff] [blame] | 95 | #endif |
Denis Vlasenko | 165f5b3 | 2008-03-31 20:30:38 +0000 | [diff] [blame] | 96 | |
Denis Vlasenko | 4866e90 | 2008-03-17 09:17:27 +0000 | [diff] [blame] | 97 | // TODO: move into this file: |
| 98 | #include "tcpudp_perhost.h" |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 99 | |
| 100 | #ifdef SSLSVD |
| 101 | #include "matrixSsl.h" |
| 102 | #include "ssl_io.h" |
| 103 | #endif |
| 104 | |
Denis Vlasenko | b925605 | 2007-09-28 10:29:17 +0000 | [diff] [blame] | 105 | struct globals { |
| 106 | unsigned verbose; |
| 107 | unsigned max_per_host; |
| 108 | unsigned cur_per_host; |
| 109 | unsigned cnum; |
Denis Vlasenko | 3f5fdc7 | 2007-10-14 04:55:59 +0000 | [diff] [blame] | 110 | unsigned cmax; |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 111 | char **env_cur; |
| 112 | char *env_var[1]; /* actually bigger */ |
Denys Vlasenko | 98a4c7c | 2010-02-04 15:00:15 +0100 | [diff] [blame] | 113 | } FIX_ALIASING; |
Denys Vlasenko | e6a2f4c | 2016-04-21 16:26:30 +0200 | [diff] [blame] | 114 | #define G (*(struct globals*)bb_common_bufsiz1) |
Denis Vlasenko | b925605 | 2007-09-28 10:29:17 +0000 | [diff] [blame] | 115 | #define verbose (G.verbose ) |
| 116 | #define max_per_host (G.max_per_host) |
| 117 | #define cur_per_host (G.cur_per_host) |
| 118 | #define cnum (G.cnum ) |
| 119 | #define cmax (G.cmax ) |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 120 | #define env_cur (G.env_cur ) |
| 121 | #define env_var (G.env_var ) |
Denis Vlasenko | 7049ff8 | 2008-06-25 09:53:17 +0000 | [diff] [blame] | 122 | #define INIT_G() do { \ |
Denys Vlasenko | 47cfbf3 | 2016-04-21 18:18:48 +0200 | [diff] [blame] | 123 | setup_common_bufsiz(); \ |
Denis Vlasenko | 7049ff8 | 2008-06-25 09:53:17 +0000 | [diff] [blame] | 124 | cmax = 30; \ |
| 125 | env_cur = &env_var[0]; \ |
| 126 | } while (0) |
Denis Vlasenko | b925605 | 2007-09-28 10:29:17 +0000 | [diff] [blame] | 127 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 128 | |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 129 | /* We have to be careful about leaking memory in repeated setenv's */ |
| 130 | static void xsetenv_plain(const char *n, const char *v) |
| 131 | { |
| 132 | char *var = xasprintf("%s=%s", n, v); |
| 133 | *env_cur++ = var; |
| 134 | putenv(var); |
| 135 | } |
| 136 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 137 | static void xsetenv_proto(const char *proto, const char *n, const char *v) |
| 138 | { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 139 | char *var = xasprintf("%s%s=%s", proto, n, v); |
| 140 | *env_cur++ = var; |
| 141 | putenv(var); |
| 142 | } |
| 143 | |
| 144 | static void undo_xsetenv(void) |
| 145 | { |
| 146 | char **pp = env_cur = &env_var[0]; |
| 147 | while (*pp) { |
| 148 | char *var = *pp; |
Denys Vlasenko | dd8adde | 2010-06-24 05:00:50 +0200 | [diff] [blame] | 149 | bb_unsetenv_and_free(var); |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 150 | *pp++ = NULL; |
| 151 | } |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 152 | } |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 153 | |
| 154 | static void sig_term_handler(int sig) |
| 155 | { |
| 156 | if (verbose) |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 157 | bb_error_msg("got signal %u, exit", sig); |
Denis Vlasenko | 400d8bb | 2008-02-24 13:36:01 +0000 | [diff] [blame] | 158 | kill_myself_with_sig(sig); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 159 | } |
| 160 | |
| 161 | /* Little bloated, but tries to give accurate info how child exited. |
| 162 | * Makes easier to spot segfaulting children etc... */ |
| 163 | static void print_waitstat(unsigned pid, int wstat) |
| 164 | { |
| 165 | unsigned e = 0; |
| 166 | const char *cause = "?exit"; |
| 167 | |
| 168 | if (WIFEXITED(wstat)) { |
| 169 | cause++; |
| 170 | e = WEXITSTATUS(wstat); |
| 171 | } else if (WIFSIGNALED(wstat)) { |
| 172 | cause = "signal"; |
| 173 | e = WTERMSIG(wstat); |
| 174 | } |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 175 | bb_error_msg("end %d %s %d", pid, cause, e); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 176 | } |
| 177 | |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 178 | /* Must match getopt32 in main! */ |
| 179 | enum { |
| 180 | OPT_c = (1 << 0), |
| 181 | OPT_C = (1 << 1), |
| 182 | OPT_i = (1 << 2), |
| 183 | OPT_x = (1 << 3), |
| 184 | OPT_u = (1 << 4), |
| 185 | OPT_l = (1 << 5), |
| 186 | OPT_E = (1 << 6), |
| 187 | OPT_b = (1 << 7), |
| 188 | OPT_h = (1 << 8), |
| 189 | OPT_p = (1 << 9), |
| 190 | OPT_t = (1 << 10), |
| 191 | OPT_v = (1 << 11), |
| 192 | OPT_V = (1 << 12), |
| 193 | OPT_U = (1 << 13), /* from here: sslsvd only */ |
| 194 | OPT_slash = (1 << 14), |
| 195 | OPT_Z = (1 << 15), |
| 196 | OPT_K = (1 << 16), |
| 197 | }; |
| 198 | |
| 199 | static void connection_status(void) |
| 200 | { |
Denis Vlasenko | f87f495 | 2007-08-24 10:27:41 +0000 | [diff] [blame] | 201 | /* "only 1 client max" desn't need this */ |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 202 | if (cmax > 1) |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 203 | bb_error_msg("status %u/%u", cnum, cmax); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 204 | } |
| 205 | |
Denis Vlasenko | a60f84e | 2008-07-05 09:18:54 +0000 | [diff] [blame] | 206 | static void sig_child_handler(int sig UNUSED_PARAM) |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 207 | { |
| 208 | int wstat; |
Denis Vlasenko | 3854c5d | 2008-11-06 22:39:57 +0000 | [diff] [blame] | 209 | pid_t pid; |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 210 | |
Denis Vlasenko | fb0eba7 | 2008-01-02 19:55:04 +0000 | [diff] [blame] | 211 | while ((pid = wait_any_nohang(&wstat)) > 0) { |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 212 | if (max_per_host) |
| 213 | ipsvd_perhost_remove(pid); |
| 214 | if (cnum) |
| 215 | cnum--; |
| 216 | if (verbose) |
| 217 | print_waitstat(pid, wstat); |
| 218 | } |
| 219 | if (verbose) |
| 220 | connection_status(); |
| 221 | } |
| 222 | |
Denis Vlasenko | 9b49a5e | 2007-10-11 10:05:36 +0000 | [diff] [blame] | 223 | int tcpudpsvd_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE; |
Denis Vlasenko | a60f84e | 2008-07-05 09:18:54 +0000 | [diff] [blame] | 224 | int tcpudpsvd_main(int argc UNUSED_PARAM, char **argv) |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 225 | { |
Denis Vlasenko | 1d42665 | 2008-03-17 09:09:09 +0000 | [diff] [blame] | 226 | char *str_C, *str_t; |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 227 | char *user; |
| 228 | struct hcc *hccp; |
| 229 | const char *instructs; |
| 230 | char *msg_per_host = NULL; |
| 231 | unsigned len_per_host = len_per_host; /* gcc */ |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 232 | #ifndef SSLSVD |
| 233 | struct bb_uidgid_t ugid; |
| 234 | #endif |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 235 | bool tcp; |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 236 | uint16_t local_port; |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 237 | char *preset_local_hostname = NULL; |
| 238 | char *remote_hostname = remote_hostname; /* for compiler */ |
| 239 | char *remote_addr = remote_addr; /* for compiler */ |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 240 | len_and_sockaddr *lsa; |
| 241 | len_and_sockaddr local, remote; |
| 242 | socklen_t sa_len; |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 243 | int pid; |
| 244 | int sock; |
| 245 | int conn; |
| 246 | unsigned backlog = 20; |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 247 | unsigned opts; |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 248 | |
Denis Vlasenko | b925605 | 2007-09-28 10:29:17 +0000 | [diff] [blame] | 249 | INIT_G(); |
| 250 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 251 | tcp = (applet_name[0] == 't'); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 252 | |
Denis Vlasenko | 1d42665 | 2008-03-17 09:09:09 +0000 | [diff] [blame] | 253 | /* 3+ args, -i at most once, -p implies -h, -v is counter, -b N, -c N */ |
Denys Vlasenko | 237bedd | 2016-07-06 21:58:02 +0200 | [diff] [blame] | 254 | opt_complementary = "-3:i--i:ph:vv"; |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 255 | #ifdef SSLSVD |
Denys Vlasenko | 237bedd | 2016-07-06 21:58:02 +0200 | [diff] [blame] | 256 | opts = getopt32(argv, "+c:+C:i:x:u:l:Eb:+hpt:vU:/:Z:K:", |
Denis Vlasenko | 1d42665 | 2008-03-17 09:09:09 +0000 | [diff] [blame] | 257 | &cmax, &str_C, &instructs, &instructs, &user, &preset_local_hostname, |
| 258 | &backlog, &str_t, &ssluser, &root, &cert, &key, &verbose |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 259 | ); |
| 260 | #else |
Denis Vlasenko | 1d42665 | 2008-03-17 09:09:09 +0000 | [diff] [blame] | 261 | /* "+": stop on first non-option */ |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 262 | opts = getopt32(argv, "+c:+C:i:x:u:l:Eb:hpt:v", |
Denis Vlasenko | 1d42665 | 2008-03-17 09:09:09 +0000 | [diff] [blame] | 263 | &cmax, &str_C, &instructs, &instructs, &user, &preset_local_hostname, |
| 264 | &backlog, &str_t, &verbose |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 265 | ); |
| 266 | #endif |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 267 | if (opts & OPT_C) { /* -C n[:message] */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 268 | max_per_host = bb_strtou(str_C, &str_C, 10); |
| 269 | if (str_C[0]) { |
| 270 | if (str_C[0] != ':') |
| 271 | bb_show_usage(); |
| 272 | msg_per_host = str_C + 1; |
| 273 | len_per_host = strlen(msg_per_host); |
| 274 | } |
| 275 | } |
| 276 | if (max_per_host > cmax) |
| 277 | max_per_host = cmax; |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 278 | if (opts & OPT_u) { |
Bernhard Reutner-Fischer | d73cbd3 | 2008-07-21 14:41:33 +0000 | [diff] [blame] | 279 | xget_uidgid(&ugid, user); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 280 | } |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 281 | #ifdef SSLSVD |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 282 | if (opts & OPT_U) ssluser = optarg; |
| 283 | if (opts & OPT_slash) root = optarg; |
| 284 | if (opts & OPT_Z) cert = optarg; |
| 285 | if (opts & OPT_K) key = optarg; |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 286 | #endif |
| 287 | argv += optind; |
| 288 | if (!argv[0][0] || LONE_CHAR(argv[0], '0')) |
| 289 | argv[0] = (char*)"0.0.0.0"; |
| 290 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 291 | /* Per-IP flood protection is not thought-out for UDP */ |
| 292 | if (!tcp) |
| 293 | max_per_host = 0; |
| 294 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 295 | bb_sanitize_stdio(); /* fd# 0,1,2 must be opened */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 296 | |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 297 | #ifdef SSLSVD |
| 298 | sslser = user; |
| 299 | client = 0; |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 300 | if ((getuid() == 0) && !(opts & OPT_u)) { |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 301 | xfunc_exitcode = 100; |
Denys Vlasenko | b2e5fc3 | 2009-11-25 14:52:47 +0100 | [diff] [blame] | 302 | bb_error_msg_and_die(bb_msg_you_must_be_root); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 303 | } |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 304 | if (opts & OPT_u) |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 305 | if (!uidgid_get(&sslugid, ssluser, 1)) { |
| 306 | if (errno) { |
Bernhard Reutner-Fischer | d73cbd3 | 2008-07-21 14:41:33 +0000 | [diff] [blame] | 307 | bb_perror_msg_and_die("can't get user/group: %s", ssluser); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 308 | } |
Bernhard Reutner-Fischer | d73cbd3 | 2008-07-21 14:41:33 +0000 | [diff] [blame] | 309 | bb_error_msg_and_die("unknown user/group %s", ssluser); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 310 | } |
| 311 | if (!cert) cert = "./cert.pem"; |
| 312 | if (!key) key = cert; |
| 313 | if (matrixSslOpen() < 0) |
Denys Vlasenko | 6331cf0 | 2009-11-13 09:08:27 +0100 | [diff] [blame] | 314 | fatal("can't initialize ssl"); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 315 | if (matrixSslReadKeys(&keys, cert, key, 0, ca) < 0) { |
| 316 | if (client) |
Denys Vlasenko | 6331cf0 | 2009-11-13 09:08:27 +0100 | [diff] [blame] | 317 | fatal("can't read cert, key, or ca file"); |
| 318 | fatal("can't read cert or key file"); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 319 | } |
| 320 | if (matrixSslNewSession(&ssl, keys, 0, SSL_FLAGS_SERVER) < 0) |
Denys Vlasenko | 6331cf0 | 2009-11-13 09:08:27 +0100 | [diff] [blame] | 321 | fatal("can't create ssl session"); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 322 | #endif |
| 323 | |
| 324 | sig_block(SIGCHLD); |
| 325 | signal(SIGCHLD, sig_child_handler); |
Denis Vlasenko | cf7cf62 | 2008-03-19 19:38:46 +0000 | [diff] [blame] | 326 | bb_signals(BB_FATAL_SIGS, sig_term_handler); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 327 | signal(SIGPIPE, SIG_IGN); |
| 328 | |
| 329 | if (max_per_host) |
| 330 | ipsvd_perhost_init(cmax); |
| 331 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 332 | local_port = bb_lookup_port(argv[1], tcp ? "tcp" : "udp", 0); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 333 | lsa = xhost2sockaddr(argv[0], local_port); |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 334 | argv += 2; |
| 335 | |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 336 | sock = xsocket(lsa->u.sa.sa_family, tcp ? SOCK_STREAM : SOCK_DGRAM, 0); |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 337 | setsockopt_reuseaddr(sock); |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 338 | sa_len = lsa->len; /* I presume sockaddr len stays the same */ |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 339 | xbind(sock, &lsa->u.sa, sa_len); |
Denys Vlasenko | 16635cc | 2009-06-13 22:49:08 +0200 | [diff] [blame] | 340 | if (tcp) { |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 341 | xlisten(sock, backlog); |
Denys Vlasenko | 16635cc | 2009-06-13 22:49:08 +0200 | [diff] [blame] | 342 | close_on_exec_on(sock); |
| 343 | } else { /* udp: needed for recv_from_to to work: */ |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 344 | socket_want_pktinfo(sock); |
Denys Vlasenko | 16635cc | 2009-06-13 22:49:08 +0200 | [diff] [blame] | 345 | } |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 346 | /* ndelay_off(sock); - it is the default I think? */ |
| 347 | |
| 348 | #ifndef SSLSVD |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 349 | if (opts & OPT_u) { |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 350 | /* drop permissions */ |
| 351 | xsetgid(ugid.gid); |
| 352 | xsetuid(ugid.uid); |
| 353 | } |
| 354 | #endif |
| 355 | |
| 356 | if (verbose) { |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 357 | char *addr = xmalloc_sockaddr2dotted(&lsa->u.sa); |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 358 | if (opts & OPT_u) |
| 359 | bb_error_msg("listening on %s, starting, uid %u, gid %u", addr, |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 360 | (unsigned)ugid.uid, (unsigned)ugid.gid); |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 361 | else |
| 362 | bb_error_msg("listening on %s, starting", addr); |
| 363 | free(addr); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 364 | } |
| 365 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 366 | /* Main accept() loop */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 367 | |
| 368 | again: |
| 369 | hccp = NULL; |
| 370 | |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 371 | again1: |
| 372 | close(0); |
| 373 | /* It's important to close(0) _before_ wait loop: |
| 374 | * fd#0 can be a shared connection fd. |
| 375 | * If kept open by us, peer can't detect PROG closing it. |
| 376 | */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 377 | while (cnum >= cmax) |
Denis Vlasenko | 3f165fa | 2008-03-17 08:29:08 +0000 | [diff] [blame] | 378 | wait_for_any_sig(); /* expecting SIGCHLD */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 379 | |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 380 | again2: |
| 381 | sig_unblock(SIGCHLD); |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 382 | local.len = remote.len = sa_len; |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 383 | if (tcp) { |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 384 | /* Accept a connection to fd #0 */ |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 385 | conn = accept(sock, &remote.u.sa, &remote.len); |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 386 | } else { |
Denis Vlasenko | 1ca332b | 2007-04-04 17:49:47 +0000 | [diff] [blame] | 387 | /* In case recv_from_to won't be able to recover local addr. |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 388 | * Also sets port - recv_from_to is unable to do it. */ |
| 389 | local = *lsa; |
Denis Vlasenko | aa9b182 | 2008-03-17 09:10:39 +0000 | [diff] [blame] | 390 | conn = recv_from_to(sock, NULL, 0, MSG_PEEK, |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 391 | &remote.u.sa, &local.u.sa, sa_len); |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 392 | } |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 393 | sig_block(SIGCHLD); |
| 394 | if (conn < 0) { |
| 395 | if (errno != EINTR) |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 396 | bb_perror_msg(tcp ? "accept" : "recv"); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 397 | goto again2; |
| 398 | } |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 399 | xmove_fd(tcp ? conn : sock, 0); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 400 | |
| 401 | if (max_per_host) { |
| 402 | /* Drop connection immediately if cur_per_host > max_per_host |
| 403 | * (minimizing load under SYN flood) */ |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 404 | remote_addr = xmalloc_sockaddr2dotted_noport(&remote.u.sa); |
| 405 | cur_per_host = ipsvd_perhost_add(remote_addr, max_per_host, &hccp); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 406 | if (cur_per_host > max_per_host) { |
| 407 | /* ipsvd_perhost_add detected that max is exceeded |
| 408 | * (and did not store ip in connection table) */ |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 409 | free(remote_addr); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 410 | if (msg_per_host) { |
| 411 | /* don't block or test for errors */ |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 412 | send(0, msg_per_host, len_per_host, MSG_DONTWAIT); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 413 | } |
| 414 | goto again1; |
| 415 | } |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 416 | /* NB: remote_addr is not leaked, it is stored in conn table */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 417 | } |
| 418 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 419 | if (!tcp) { |
| 420 | /* Voodoo magic: making udp sockets each receive its own |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 421 | * packets is not trivial, and I still not sure |
| 422 | * I do it 100% right. |
| 423 | * 1) we have to do it before fork() |
| 424 | * 2) order is important - is it right now? */ |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 425 | |
Denis Vlasenko | 4cf1d08 | 2008-03-12 23:13:50 +0000 | [diff] [blame] | 426 | /* Open new non-connected UDP socket for further clients... */ |
| 427 | sock = xsocket(lsa->u.sa.sa_family, SOCK_DGRAM, 0); |
| 428 | setsockopt_reuseaddr(sock); |
| 429 | /* Make plain write/send work for old socket by supplying default |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 430 | * destination address. This also restricts incoming packets |
| 431 | * to ones coming from this remote IP. */ |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 432 | xconnect(0, &remote.u.sa, sa_len); |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 433 | /* hole? at this point we have no wildcard udp socket... |
Denis Vlasenko | 7946879 | 2007-04-04 11:02:55 +0000 | [diff] [blame] | 434 | * can this cause clients to get "port unreachable" icmp? |
| 435 | * Yup, time window is very small, but it exists (is it?) */ |
Denis Vlasenko | 4cf1d08 | 2008-03-12 23:13:50 +0000 | [diff] [blame] | 436 | /* ..."open new socket", continued */ |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 437 | xbind(sock, &lsa->u.sa, sa_len); |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 438 | socket_want_pktinfo(sock); |
Denis Vlasenko | 7946879 | 2007-04-04 11:02:55 +0000 | [diff] [blame] | 439 | |
| 440 | /* Doesn't work: |
| 441 | * we cannot replace fd #0 - we will lose pending packet |
| 442 | * which is already buffered for us! And we cannot use fd #1 |
| 443 | * instead - it will "intercept" all following packets, but child |
Denis Vlasenko | f87f495 | 2007-08-24 10:27:41 +0000 | [diff] [blame] | 444 | * does not expect data coming *from fd #1*! */ |
Denis Vlasenko | 7946879 | 2007-04-04 11:02:55 +0000 | [diff] [blame] | 445 | #if 0 |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 446 | /* Make it so that local addr is fixed to localp->u.sa |
Denis Vlasenko | 7946879 | 2007-04-04 11:02:55 +0000 | [diff] [blame] | 447 | * and we don't accidentally accept packets to other local IPs. */ |
| 448 | /* NB: we possibly bind to the _very_ same_ address & port as the one |
| 449 | * already bound in parent! This seems to work in Linux. |
| 450 | * (otherwise we can move socket to fd #0 only if bind succeeds) */ |
| 451 | close(0); |
Denys Vlasenko | ca18311 | 2011-04-07 17:52:20 +0200 | [diff] [blame] | 452 | set_nport(&localp->u.sa, htons(local_port)); |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 453 | xmove_fd(xsocket(localp->u.sa.sa_family, SOCK_DGRAM, 0), 0); |
Denis Vlasenko | 7946879 | 2007-04-04 11:02:55 +0000 | [diff] [blame] | 454 | setsockopt_reuseaddr(0); /* crucial */ |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 455 | xbind(0, &localp->u.sa, localp->len); |
Denis Vlasenko | 7946879 | 2007-04-04 11:02:55 +0000 | [diff] [blame] | 456 | #endif |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 457 | } |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 458 | |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 459 | pid = vfork(); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 460 | if (pid == -1) { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 461 | bb_perror_msg("vfork"); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 462 | goto again; |
| 463 | } |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 464 | |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 465 | if (pid != 0) { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 466 | /* Parent */ |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 467 | cnum++; |
| 468 | if (verbose) |
| 469 | connection_status(); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 470 | if (hccp) |
| 471 | hccp->pid = pid; |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 472 | /* clean up changes done by vforked child */ |
| 473 | undo_xsetenv(); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 474 | goto again; |
| 475 | } |
| 476 | |
| 477 | /* Child: prepare env, log, and exec prog */ |
| 478 | |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 479 | { /* vfork alert! every xmalloc in this block should be freed! */ |
| 480 | char *local_hostname = local_hostname; /* for compiler */ |
| 481 | char *local_addr = NULL; |
| 482 | char *free_me0 = NULL; |
| 483 | char *free_me1 = NULL; |
| 484 | char *free_me2 = NULL; |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 485 | |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 486 | if (verbose || !(opts & OPT_E)) { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 487 | if (!max_per_host) /* remote_addr is not yet known */ |
| 488 | free_me0 = remote_addr = xmalloc_sockaddr2dotted(&remote.u.sa); |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 489 | if (opts & OPT_h) { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 490 | free_me1 = remote_hostname = xmalloc_sockaddr2host_noport(&remote.u.sa); |
| 491 | if (!remote_hostname) { |
Denys Vlasenko | 6331cf0 | 2009-11-13 09:08:27 +0100 | [diff] [blame] | 492 | bb_error_msg("can't look up hostname for %s", remote_addr); |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 493 | remote_hostname = remote_addr; |
| 494 | } |
| 495 | } |
| 496 | /* Find out local IP peer connected to. |
| 497 | * Errors ignored (I'm not paranoid enough to imagine kernel |
| 498 | * which doesn't know local IP). */ |
| 499 | if (tcp) |
| 500 | getsockname(0, &local.u.sa, &local.len); |
| 501 | /* else: for UDP it is done earlier by parent */ |
| 502 | local_addr = xmalloc_sockaddr2dotted(&local.u.sa); |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 503 | if (opts & OPT_h) { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 504 | local_hostname = preset_local_hostname; |
| 505 | if (!local_hostname) { |
| 506 | free_me2 = local_hostname = xmalloc_sockaddr2host_noport(&local.u.sa); |
| 507 | if (!local_hostname) |
Denys Vlasenko | 6331cf0 | 2009-11-13 09:08:27 +0100 | [diff] [blame] | 508 | bb_error_msg_and_die("can't look up hostname for %s", local_addr); |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 509 | } |
| 510 | /* else: local_hostname is not NULL, but is NOT malloced! */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 511 | } |
| 512 | } |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 513 | if (verbose) { |
| 514 | pid = getpid(); |
| 515 | if (max_per_host) { |
| 516 | bb_error_msg("concurrency %s %u/%u", |
| 517 | remote_addr, |
| 518 | cur_per_host, max_per_host); |
| 519 | } |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 520 | bb_error_msg((opts & OPT_h) |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 521 | ? "start %u %s-%s (%s-%s)" |
| 522 | : "start %u %s-%s", |
| 523 | pid, |
| 524 | local_addr, remote_addr, |
| 525 | local_hostname, remote_hostname); |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 526 | } |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 527 | |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 528 | if (!(opts & OPT_E)) { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 529 | /* setup ucspi env */ |
| 530 | const char *proto = tcp ? "TCP" : "UDP"; |
| 531 | |
Jeremie Koenig | 2ea12d8 | 2010-05-27 15:46:25 +0200 | [diff] [blame] | 532 | #ifdef SO_ORIGINAL_DST |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 533 | /* Extract "original" destination addr:port |
| 534 | * from Linux firewall. Useful when you redirect |
| 535 | * an outbond connection to local handler, and it needs |
| 536 | * to know where it originally tried to connect */ |
| 537 | if (tcp && getsockopt(0, SOL_IP, SO_ORIGINAL_DST, &local.u.sa, &local.len) == 0) { |
| 538 | char *addr = xmalloc_sockaddr2dotted(&local.u.sa); |
| 539 | xsetenv_plain("TCPORIGDSTADDR", addr); |
| 540 | free(addr); |
| 541 | } |
Jeremie Koenig | 2ea12d8 | 2010-05-27 15:46:25 +0200 | [diff] [blame] | 542 | #endif |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 543 | xsetenv_plain("PROTO", proto); |
| 544 | xsetenv_proto(proto, "LOCALADDR", local_addr); |
| 545 | xsetenv_proto(proto, "REMOTEADDR", remote_addr); |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 546 | if (opts & OPT_h) { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 547 | xsetenv_proto(proto, "LOCALHOST", local_hostname); |
| 548 | xsetenv_proto(proto, "REMOTEHOST", remote_hostname); |
| 549 | } |
| 550 | //compat? xsetenv_proto(proto, "REMOTEINFO", ""); |
| 551 | /* additional */ |
| 552 | if (cur_per_host > 0) /* can not be true for udp */ |
| 553 | xsetenv_plain("TCPCONCURRENCY", utoa(cur_per_host)); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 554 | } |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 555 | free(local_addr); |
| 556 | free(free_me0); |
| 557 | free(free_me1); |
| 558 | free(free_me2); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 559 | } |
| 560 | |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 561 | xdup2(0, 1); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 562 | |
Denis Vlasenko | 3fa36e2 | 2008-11-09 00:15:11 +0000 | [diff] [blame] | 563 | signal(SIGPIPE, SIG_DFL); /* this one was SIG_IGNed */ |
| 564 | /* Non-ignored signals revert to SIG_DFL on exec anyway */ |
| 565 | /*signal(SIGCHLD, SIG_DFL);*/ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 566 | sig_unblock(SIGCHLD); |
| 567 | |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 568 | #ifdef SSLSVD |
Denis Vlasenko | 4cf1d08 | 2008-03-12 23:13:50 +0000 | [diff] [blame] | 569 | strcpy(id, utoa(pid)); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 570 | ssl_io(0, argv); |
Denys Vlasenko | 41ddd9f | 2010-06-25 01:46:53 +0200 | [diff] [blame] | 571 | bb_perror_msg_and_die("can't execute '%s'", argv[0]); |
Pascal Bellard | 21e8e8d | 2010-07-04 00:57:03 +0200 | [diff] [blame] | 572 | #else |
| 573 | BB_EXECVP_or_die(argv); |
| 574 | #endif |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 575 | } |
| 576 | |
| 577 | /* |
| 578 | tcpsvd [-hpEvv] [-c n] [-C n:msg] [-b n] [-u user] [-l name] |
| 579 | [-i dir|-x cdb] [ -t sec] host port prog |
| 580 | |
| 581 | tcpsvd creates a TCP/IP socket, binds it to the address host:port, |
| 582 | and listens on the socket for incoming connections. |
| 583 | |
| 584 | On each incoming connection, tcpsvd conditionally runs a program, |
| 585 | with standard input reading from the socket, and standard output |
| 586 | writing to the socket, to handle this connection. tcpsvd keeps |
| 587 | listening on the socket for new connections, and can handle |
| 588 | multiple connections simultaneously. |
| 589 | |
| 590 | tcpsvd optionally checks for special instructions depending |
| 591 | on the IP address or hostname of the client that initiated |
| 592 | the connection, see ipsvd-instruct(5). |
| 593 | |
| 594 | host |
| 595 | host either is a hostname, or a dotted-decimal IP address, |
| 596 | or 0. If host is 0, tcpsvd accepts connections to any local |
| 597 | IP address. |
| 598 | * busybox accepts IPv6 addresses and host:port pairs too |
| 599 | In this case second parameter is ignored |
| 600 | port |
| 601 | tcpsvd accepts connections to host:port. port may be a name |
| 602 | from /etc/services or a number. |
| 603 | prog |
| 604 | prog consists of one or more arguments. For each connection, |
| 605 | tcpsvd normally runs prog, with file descriptor 0 reading from |
| 606 | the network, and file descriptor 1 writing to the network. |
| 607 | By default it also sets up TCP-related environment variables, |
| 608 | see tcp-environ(5) |
| 609 | -i dir |
| 610 | read instructions for handling new connections from the instructions |
| 611 | directory dir. See ipsvd-instruct(5) for details. |
| 612 | * ignored by busyboxed version |
| 613 | -x cdb |
| 614 | read instructions for handling new connections from the constant database |
| 615 | cdb. The constant database normally is created from an instructions |
| 616 | directory by running ipsvd-cdb(8). |
| 617 | * ignored by busyboxed version |
| 618 | -t sec |
| 619 | timeout. This option only takes effect if the -i option is given. |
| 620 | While checking the instructions directory, check the time of last access |
| 621 | of the file that matches the clients address or hostname if any, discard |
| 622 | and remove the file if it wasn't accessed within the last sec seconds; |
| 623 | tcpsvd does not discard or remove a file if the user's write permission |
| 624 | is not set, for those files the timeout is disabled. Default is 0, |
| 625 | which means that the timeout is disabled. |
| 626 | * ignored by busyboxed version |
| 627 | -l name |
| 628 | local hostname. Do not look up the local hostname in DNS, but use name |
| 629 | as hostname. This option must be set if tcpsvd listens on port 53 |
| 630 | to avoid loops. |
| 631 | -u user[:group] |
| 632 | drop permissions. Switch user ID to user's UID, and group ID to user's |
| 633 | primary GID after creating and binding to the socket. If user is followed |
| 634 | by a colon and a group name, the group ID is switched to the GID of group |
| 635 | instead. All supplementary groups are removed. |
| 636 | -c n |
| 637 | concurrency. Handle up to n connections simultaneously. Default is 30. |
| 638 | If there are n connections active, tcpsvd defers acceptance of a new |
| 639 | connection until an active connection is closed. |
| 640 | -C n[:msg] |
| 641 | per host concurrency. Allow only up to n connections from the same IP |
| 642 | address simultaneously. If there are n active connections from one IP |
| 643 | address, new incoming connections from this IP address are closed |
| 644 | immediately. If n is followed by :msg, the message msg is written |
| 645 | to the client if possible, before closing the connection. By default |
| 646 | msg is empty. See ipsvd-instruct(5) for supported escape sequences in msg. |
| 647 | |
| 648 | For each accepted connection, the current per host concurrency is |
| 649 | available through the environment variable TCPCONCURRENCY. n and msg |
| 650 | can be overwritten by ipsvd(7) instructions, see ipsvd-instruct(5). |
| 651 | By default tcpsvd doesn't keep track of connections. |
| 652 | -h |
| 653 | Look up the client's hostname in DNS. |
| 654 | -p |
| 655 | paranoid. After looking up the client's hostname in DNS, look up the IP |
| 656 | addresses in DNS for that hostname, and forget about the hostname |
| 657 | if none of the addresses match the client's IP address. You should |
| 658 | set this option if you use hostname based instructions. The -p option |
| 659 | implies the -h option. |
| 660 | * ignored by busyboxed version |
| 661 | -b n |
| 662 | backlog. Allow a backlog of approximately n TCP SYNs. On some systems n |
| 663 | is silently limited. Default is 20. |
| 664 | -E |
| 665 | no special environment. Do not set up TCP-related environment variables. |
| 666 | -v |
| 667 | verbose. Print verbose messsages to standard output. |
| 668 | -vv |
| 669 | more verbose. Print more verbose messages to standard output. |
| 670 | * no difference between -v and -vv in busyboxed version |
| 671 | */ |