Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 1 | /* Based on ipsvd utilities written by Gerrit Pape <pape@smarden.org> |
| 2 | * which are released into public domain by the author. |
| 3 | * Homepage: http://smarden.sunsite.dk/ipsvd/ |
| 4 | * |
Denis Vlasenko | d18f52b | 2008-03-02 12:53:15 +0000 | [diff] [blame] | 5 | * Copyright (C) 2007 Denys Vlasenko. |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 6 | * |
Denys Vlasenko | 0ef64bd | 2010-08-16 20:14:46 +0200 | [diff] [blame] | 7 | * Licensed under GPLv2, see file LICENSE in this source tree. |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 8 | */ |
| 9 | |
Denis Vlasenko | 4866e90 | 2008-03-17 09:17:27 +0000 | [diff] [blame] | 10 | /* Based on ipsvd-0.12.1. This tcpsvd accepts all options |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 11 | * which are supported by one from ipsvd-0.12.1, but not all are |
| 12 | * functional. See help text at the end of this file for details. |
| 13 | * |
| 14 | * Code inside "#ifdef SSLSVD" is for sslsvd and is currently unused. |
| 15 | * |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 16 | * Busybox version exports TCPLOCALADDR instead of |
| 17 | * TCPLOCALIP + TCPLOCALPORT pair. ADDR more closely matches reality |
| 18 | * (which is "struct sockaddr_XXX". Port is not a separate entity, |
| 19 | * it's just a part of (AF_INET[6]) sockaddr!). |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 20 | * |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 21 | * TCPORIGDSTADDR is Busybox-specific addition. |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 22 | * |
| 23 | * udp server is hacked up by reusing TCP code. It has the following |
| 24 | * limitation inherent in Unix DGRAM sockets implementation: |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 25 | * - local IP address is retrieved (using recvmsg voodoo) but |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 26 | * child's socket is not bound to it (bind cannot be called on |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 27 | * already bound socket). Thus it still can emit outgoing packets |
Denis Vlasenko | beaca81 | 2007-04-13 16:32:26 +0000 | [diff] [blame] | 28 | * with wrong source IP... |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 29 | * - don't know how to retrieve ORIGDST for udp. |
| 30 | */ |
Denys Vlasenko | 47367e1 | 2016-11-23 09:05:14 +0100 | [diff] [blame] | 31 | //config:config TCPSVD |
Denys Vlasenko | b097a84 | 2018-12-28 03:20:17 +0100 | [diff] [blame] | 32 | //config: bool "tcpsvd (14 kb)" |
Denys Vlasenko | 47367e1 | 2016-11-23 09:05:14 +0100 | [diff] [blame] | 33 | //config: default y |
| 34 | //config: help |
Denys Vlasenko | 72089cf | 2017-07-21 09:50:55 +0200 | [diff] [blame] | 35 | //config: tcpsvd listens on a TCP port and runs a program for each new |
| 36 | //config: connection. |
Denys Vlasenko | 47367e1 | 2016-11-23 09:05:14 +0100 | [diff] [blame] | 37 | //config: |
| 38 | //config:config UDPSVD |
Denys Vlasenko | 4eed2c6 | 2017-07-18 22:01:24 +0200 | [diff] [blame] | 39 | //config: bool "udpsvd (13 kb)" |
Denys Vlasenko | 47367e1 | 2016-11-23 09:05:14 +0100 | [diff] [blame] | 40 | //config: default y |
| 41 | //config: help |
Denys Vlasenko | 72089cf | 2017-07-21 09:50:55 +0200 | [diff] [blame] | 42 | //config: udpsvd listens on an UDP port and runs a program for each new |
| 43 | //config: connection. |
Denys Vlasenko | 47367e1 | 2016-11-23 09:05:14 +0100 | [diff] [blame] | 44 | |
| 45 | //applet:IF_TCPSVD(APPLET_ODDNAME(tcpsvd, tcpudpsvd, BB_DIR_USR_BIN, BB_SUID_DROP, tcpsvd)) |
| 46 | //applet:IF_UDPSVD(APPLET_ODDNAME(udpsvd, tcpudpsvd, BB_DIR_USR_BIN, BB_SUID_DROP, udpsvd)) |
| 47 | |
| 48 | //kbuild:lib-$(CONFIG_TCPSVD) += tcpudp.o tcpudp_perhost.o |
| 49 | //kbuild:lib-$(CONFIG_UDPSVD) += tcpudp.o tcpudp_perhost.o |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 50 | |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 51 | //usage:#define tcpsvd_trivial_usage |
| 52 | //usage: "[-hEv] [-c N] [-C N[:MSG]] [-b N] [-u USER] [-l NAME] IP PORT PROG" |
| 53 | /* with not-implemented options: */ |
| 54 | /* //usage: "[-hpEvv] [-c N] [-C N[:MSG]] [-b N] [-u USER] [-l NAME] [-i DIR|-x CDB] [-t SEC] IP PORT PROG" */ |
| 55 | //usage:#define tcpsvd_full_usage "\n\n" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 56 | //usage: "Create TCP socket, bind to IP:PORT and listen for incoming connections.\n" |
| 57 | //usage: "Run PROG for each connection.\n" |
| 58 | //usage: "\n IP PORT IP:PORT to listen on" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 59 | //usage: "\n PROG ARGS Program to run" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 60 | //usage: "\n -u USER[:GRP] Change to user/group after bind" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 61 | //usage: "\n -c N Up to N connections simultaneously (default 30)" |
| 62 | //usage: "\n -b N Allow backlog of approximately N TCP SYNs (default 20)" |
| 63 | //usage: "\n -C N[:MSG] Allow only up to N connections from the same IP:" |
| 64 | //usage: "\n new connections from this IP address are closed" |
| 65 | //usage: "\n immediately, MSG is written to the peer before close" |
| 66 | //usage: "\n -E Don't set up environment" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 67 | //usage: "\n -h Look up peer's hostname" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 68 | //usage: "\n -l NAME Local hostname (else look up local hostname in DNS)" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 69 | //usage: "\n -v Verbose" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 70 | //usage: "\n" |
| 71 | //usage: "\nEnvironment if no -E:" |
| 72 | //usage: "\nPROTO='TCP'" |
| 73 | //usage: "\nTCPREMOTEADDR='ip:port'" IF_FEATURE_IPV6(" ('[ip]:port' for IPv6)") |
| 74 | //usage: "\nTCPLOCALADDR='ip:port'" |
| 75 | //usage: "\nTCPORIGDSTADDR='ip:port' of destination before firewall" |
| 76 | //usage: "\n Useful for REDIRECTed-to-local connections:" |
| 77 | //usage: "\n iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to 8080" |
| 78 | //usage: "\nTCPCONCURRENCY=num_of_connects_from_this_ip" |
| 79 | //usage: "\nIf -h:" |
| 80 | //usage: "\nTCPLOCALHOST='hostname' (-l NAME is used if specified)" |
| 81 | //usage: "\nTCPREMOTEHOST='hostname'" |
| 82 | |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 83 | //usage: |
| 84 | //usage:#define udpsvd_trivial_usage |
| 85 | //usage: "[-hEv] [-c N] [-u USER] [-l NAME] IP PORT PROG" |
| 86 | //usage:#define udpsvd_full_usage "\n\n" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 87 | //usage: "Create UDP socket, bind to IP:PORT and wait for incoming packets.\n" |
| 88 | //usage: "Run PROG for each packet, redirecting all further packets with same\n" |
| 89 | //usage: "peer ip:port to it.\n" |
| 90 | //usage: "\n IP PORT IP:PORT to listen on" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 91 | //usage: "\n PROG ARGS Program to run" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 92 | //usage: "\n -u USER[:GRP] Change to user/group after bind" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 93 | //usage: "\n -c N Up to N connections simultaneously (default 30)" |
| 94 | //usage: "\n -E Don't set up environment" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 95 | //usage: "\n -h Look up peer's hostname" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 96 | //usage: "\n -l NAME Local hostname (else look up local hostname in DNS)" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 97 | //usage: "\n -v Verbose" |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 98 | //usage: "\n" |
| 99 | //usage: "\nEnvironment if no -E:" |
| 100 | //usage: "\nPROTO='UDP'" |
| 101 | //usage: "\nUDPREMOTEADDR='ip:port'" IF_FEATURE_IPV6(" ('[ip]:port' for IPv6)") |
| 102 | //usage: "\nUDPLOCALADDR='ip:port'" |
| 103 | //usage: "\nIf -h:" |
| 104 | //usage: "\nUDPLOCALHOST='hostname' (-l NAME is used if specified)" |
| 105 | //usage: "\nUDPREMOTEHOST='hostname'" |
Pere Orga | 5bc8c00 | 2011-04-11 03:29:49 +0200 | [diff] [blame] | 106 | |
Denis Vlasenko | b6adbf1 | 2007-05-26 19:00:18 +0000 | [diff] [blame] | 107 | #include "libbb.h" |
Denys Vlasenko | e6a2f4c | 2016-04-21 16:26:30 +0200 | [diff] [blame] | 108 | #include "common_bufsiz.h" |
Jeremie Koenig | 2ea12d8 | 2010-05-27 15:46:25 +0200 | [diff] [blame] | 109 | |
Jeremie Koenig | 2ea12d8 | 2010-05-27 15:46:25 +0200 | [diff] [blame] | 110 | #ifdef __linux__ |
Denys Vlasenko | 7890035 | 2017-01-02 10:46:08 +0100 | [diff] [blame] | 111 | /* from linux/netfilter_ipv4.h: */ |
| 112 | # undef SO_ORIGINAL_DST |
| 113 | # define SO_ORIGINAL_DST 80 |
Jeremie Koenig | 2ea12d8 | 2010-05-27 15:46:25 +0200 | [diff] [blame] | 114 | #endif |
Denis Vlasenko | 165f5b3 | 2008-03-31 20:30:38 +0000 | [diff] [blame] | 115 | |
Denis Vlasenko | 4866e90 | 2008-03-17 09:17:27 +0000 | [diff] [blame] | 116 | // TODO: move into this file: |
| 117 | #include "tcpudp_perhost.h" |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 118 | |
| 119 | #ifdef SSLSVD |
| 120 | #include "matrixSsl.h" |
| 121 | #include "ssl_io.h" |
| 122 | #endif |
| 123 | |
Denis Vlasenko | b925605 | 2007-09-28 10:29:17 +0000 | [diff] [blame] | 124 | struct globals { |
| 125 | unsigned verbose; |
| 126 | unsigned max_per_host; |
| 127 | unsigned cur_per_host; |
| 128 | unsigned cnum; |
Denis Vlasenko | 3f5fdc7 | 2007-10-14 04:55:59 +0000 | [diff] [blame] | 129 | unsigned cmax; |
Denys Vlasenko | d82ea2b | 2018-02-27 13:03:44 +0100 | [diff] [blame] | 130 | struct hcc *cc; |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 131 | char **env_cur; |
| 132 | char *env_var[1]; /* actually bigger */ |
Denys Vlasenko | 98a4c7c | 2010-02-04 15:00:15 +0100 | [diff] [blame] | 133 | } FIX_ALIASING; |
Denys Vlasenko | e6a2f4c | 2016-04-21 16:26:30 +0200 | [diff] [blame] | 134 | #define G (*(struct globals*)bb_common_bufsiz1) |
Denis Vlasenko | b925605 | 2007-09-28 10:29:17 +0000 | [diff] [blame] | 135 | #define verbose (G.verbose ) |
| 136 | #define max_per_host (G.max_per_host) |
| 137 | #define cur_per_host (G.cur_per_host) |
| 138 | #define cnum (G.cnum ) |
| 139 | #define cmax (G.cmax ) |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 140 | #define env_cur (G.env_cur ) |
| 141 | #define env_var (G.env_var ) |
Denis Vlasenko | 7049ff8 | 2008-06-25 09:53:17 +0000 | [diff] [blame] | 142 | #define INIT_G() do { \ |
Denys Vlasenko | 47cfbf3 | 2016-04-21 18:18:48 +0200 | [diff] [blame] | 143 | setup_common_bufsiz(); \ |
Denis Vlasenko | 7049ff8 | 2008-06-25 09:53:17 +0000 | [diff] [blame] | 144 | cmax = 30; \ |
| 145 | env_cur = &env_var[0]; \ |
| 146 | } while (0) |
Denis Vlasenko | b925605 | 2007-09-28 10:29:17 +0000 | [diff] [blame] | 147 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 148 | |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 149 | /* We have to be careful about leaking memory in repeated setenv's */ |
| 150 | static void xsetenv_plain(const char *n, const char *v) |
| 151 | { |
| 152 | char *var = xasprintf("%s=%s", n, v); |
| 153 | *env_cur++ = var; |
| 154 | putenv(var); |
| 155 | } |
| 156 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 157 | static void xsetenv_proto(const char *proto, const char *n, const char *v) |
| 158 | { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 159 | char *var = xasprintf("%s%s=%s", proto, n, v); |
| 160 | *env_cur++ = var; |
| 161 | putenv(var); |
| 162 | } |
| 163 | |
| 164 | static void undo_xsetenv(void) |
| 165 | { |
| 166 | char **pp = env_cur = &env_var[0]; |
| 167 | while (*pp) { |
| 168 | char *var = *pp; |
Denys Vlasenko | dd8adde | 2010-06-24 05:00:50 +0200 | [diff] [blame] | 169 | bb_unsetenv_and_free(var); |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 170 | *pp++ = NULL; |
| 171 | } |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 172 | } |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 173 | |
| 174 | static void sig_term_handler(int sig) |
| 175 | { |
| 176 | if (verbose) |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 177 | bb_error_msg("got signal %u, exit", sig); |
Denis Vlasenko | 400d8bb | 2008-02-24 13:36:01 +0000 | [diff] [blame] | 178 | kill_myself_with_sig(sig); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 179 | } |
| 180 | |
| 181 | /* Little bloated, but tries to give accurate info how child exited. |
| 182 | * Makes easier to spot segfaulting children etc... */ |
| 183 | static void print_waitstat(unsigned pid, int wstat) |
| 184 | { |
| 185 | unsigned e = 0; |
| 186 | const char *cause = "?exit"; |
| 187 | |
| 188 | if (WIFEXITED(wstat)) { |
| 189 | cause++; |
| 190 | e = WEXITSTATUS(wstat); |
| 191 | } else if (WIFSIGNALED(wstat)) { |
| 192 | cause = "signal"; |
| 193 | e = WTERMSIG(wstat); |
| 194 | } |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 195 | bb_error_msg("end %d %s %d", pid, cause, e); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 196 | } |
| 197 | |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 198 | /* Must match getopt32 in main! */ |
| 199 | enum { |
| 200 | OPT_c = (1 << 0), |
| 201 | OPT_C = (1 << 1), |
| 202 | OPT_i = (1 << 2), |
| 203 | OPT_x = (1 << 3), |
| 204 | OPT_u = (1 << 4), |
| 205 | OPT_l = (1 << 5), |
| 206 | OPT_E = (1 << 6), |
| 207 | OPT_b = (1 << 7), |
| 208 | OPT_h = (1 << 8), |
| 209 | OPT_p = (1 << 9), |
| 210 | OPT_t = (1 << 10), |
| 211 | OPT_v = (1 << 11), |
| 212 | OPT_V = (1 << 12), |
| 213 | OPT_U = (1 << 13), /* from here: sslsvd only */ |
| 214 | OPT_slash = (1 << 14), |
| 215 | OPT_Z = (1 << 15), |
| 216 | OPT_K = (1 << 16), |
| 217 | }; |
| 218 | |
| 219 | static void connection_status(void) |
| 220 | { |
Denis Vlasenko | f87f495 | 2007-08-24 10:27:41 +0000 | [diff] [blame] | 221 | /* "only 1 client max" desn't need this */ |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 222 | if (cmax > 1) |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 223 | bb_error_msg("status %u/%u", cnum, cmax); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 224 | } |
| 225 | |
Denis Vlasenko | a60f84e | 2008-07-05 09:18:54 +0000 | [diff] [blame] | 226 | static void sig_child_handler(int sig UNUSED_PARAM) |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 227 | { |
| 228 | int wstat; |
Denis Vlasenko | 3854c5d | 2008-11-06 22:39:57 +0000 | [diff] [blame] | 229 | pid_t pid; |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 230 | |
Denis Vlasenko | fb0eba7 | 2008-01-02 19:55:04 +0000 | [diff] [blame] | 231 | while ((pid = wait_any_nohang(&wstat)) > 0) { |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 232 | if (max_per_host) |
Denys Vlasenko | d82ea2b | 2018-02-27 13:03:44 +0100 | [diff] [blame] | 233 | ipsvd_perhost_remove(G.cc, pid); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 234 | if (cnum) |
| 235 | cnum--; |
| 236 | if (verbose) |
| 237 | print_waitstat(pid, wstat); |
| 238 | } |
| 239 | if (verbose) |
| 240 | connection_status(); |
| 241 | } |
| 242 | |
Denis Vlasenko | 9b49a5e | 2007-10-11 10:05:36 +0000 | [diff] [blame] | 243 | int tcpudpsvd_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE; |
Denis Vlasenko | a60f84e | 2008-07-05 09:18:54 +0000 | [diff] [blame] | 244 | int tcpudpsvd_main(int argc UNUSED_PARAM, char **argv) |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 245 | { |
Denis Vlasenko | 1d42665 | 2008-03-17 09:09:09 +0000 | [diff] [blame] | 246 | char *str_C, *str_t; |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 247 | char *user; |
| 248 | struct hcc *hccp; |
| 249 | const char *instructs; |
| 250 | char *msg_per_host = NULL; |
| 251 | unsigned len_per_host = len_per_host; /* gcc */ |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 252 | #ifndef SSLSVD |
| 253 | struct bb_uidgid_t ugid; |
| 254 | #endif |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 255 | bool tcp; |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 256 | uint16_t local_port; |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 257 | char *preset_local_hostname = NULL; |
| 258 | char *remote_hostname = remote_hostname; /* for compiler */ |
| 259 | char *remote_addr = remote_addr; /* for compiler */ |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 260 | len_and_sockaddr *lsa; |
| 261 | len_and_sockaddr local, remote; |
| 262 | socklen_t sa_len; |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 263 | int pid; |
| 264 | int sock; |
| 265 | int conn; |
| 266 | unsigned backlog = 20; |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 267 | unsigned opts; |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 268 | |
Denis Vlasenko | b925605 | 2007-09-28 10:29:17 +0000 | [diff] [blame] | 269 | INIT_G(); |
| 270 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 271 | tcp = (applet_name[0] == 't'); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 272 | |
Denys Vlasenko | bbe47d9 | 2018-03-11 23:02:50 +0100 | [diff] [blame] | 273 | /* "+": stop on first non-option */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 274 | #ifdef SSLSVD |
Denys Vlasenko | 22542ec | 2017-08-08 21:55:02 +0200 | [diff] [blame] | 275 | opts = getopt32(argv, "^+" |
| 276 | "c:+C:i:x:u:l:Eb:+hpt:vU:/:Z:K:" /* -c NUM, -b NUM */ |
Denys Vlasenko | bbe47d9 | 2018-03-11 23:02:50 +0100 | [diff] [blame] | 277 | "\0" |
Denys Vlasenko | 22542ec | 2017-08-08 21:55:02 +0200 | [diff] [blame] | 278 | /* 3+ args, -i at most once, -p implies -h, -v is a counter */ |
Denys Vlasenko | bbe47d9 | 2018-03-11 23:02:50 +0100 | [diff] [blame] | 279 | "-3:i--i:ph:vv", |
Denis Vlasenko | 1d42665 | 2008-03-17 09:09:09 +0000 | [diff] [blame] | 280 | &cmax, &str_C, &instructs, &instructs, &user, &preset_local_hostname, |
| 281 | &backlog, &str_t, &ssluser, &root, &cert, &key, &verbose |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 282 | ); |
| 283 | #else |
Denys Vlasenko | bbe47d9 | 2018-03-11 23:02:50 +0100 | [diff] [blame] | 284 | opts = getopt32(argv, "^+" |
| 285 | "c:+C:i:x:u:l:Eb:+hpt:v" /* -c NUM, -b NUM */ |
| 286 | "\0" |
| 287 | /* 3+ args, -i at most once, -p implies -h, -v is a counter */ |
| 288 | "-3:i--i:ph:vv", |
Denis Vlasenko | 1d42665 | 2008-03-17 09:09:09 +0000 | [diff] [blame] | 289 | &cmax, &str_C, &instructs, &instructs, &user, &preset_local_hostname, |
| 290 | &backlog, &str_t, &verbose |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 291 | ); |
| 292 | #endif |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 293 | if (opts & OPT_C) { /* -C n[:message] */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 294 | max_per_host = bb_strtou(str_C, &str_C, 10); |
| 295 | if (str_C[0]) { |
| 296 | if (str_C[0] != ':') |
| 297 | bb_show_usage(); |
| 298 | msg_per_host = str_C + 1; |
| 299 | len_per_host = strlen(msg_per_host); |
| 300 | } |
| 301 | } |
| 302 | if (max_per_host > cmax) |
| 303 | max_per_host = cmax; |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 304 | if (opts & OPT_u) { |
Bernhard Reutner-Fischer | d73cbd3 | 2008-07-21 14:41:33 +0000 | [diff] [blame] | 305 | xget_uidgid(&ugid, user); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 306 | } |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 307 | #ifdef SSLSVD |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 308 | if (opts & OPT_U) ssluser = optarg; |
| 309 | if (opts & OPT_slash) root = optarg; |
| 310 | if (opts & OPT_Z) cert = optarg; |
| 311 | if (opts & OPT_K) key = optarg; |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 312 | #endif |
| 313 | argv += optind; |
| 314 | if (!argv[0][0] || LONE_CHAR(argv[0], '0')) |
| 315 | argv[0] = (char*)"0.0.0.0"; |
| 316 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 317 | /* Per-IP flood protection is not thought-out for UDP */ |
| 318 | if (!tcp) |
| 319 | max_per_host = 0; |
| 320 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 321 | bb_sanitize_stdio(); /* fd# 0,1,2 must be opened */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 322 | |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 323 | #ifdef SSLSVD |
| 324 | sslser = user; |
| 325 | client = 0; |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 326 | if ((getuid() == 0) && !(opts & OPT_u)) { |
Jan Luebbe | e789c3b | 2018-02-14 14:05:27 +0100 | [diff] [blame] | 327 | xfunc_error_retval = 100; |
James Byrne | 6937487 | 2019-07-02 11:35:03 +0200 | [diff] [blame] | 328 | bb_simple_error_msg_and_die(bb_msg_you_must_be_root); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 329 | } |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 330 | if (opts & OPT_u) |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 331 | if (!uidgid_get(&sslugid, ssluser, 1)) { |
| 332 | if (errno) { |
Bernhard Reutner-Fischer | d73cbd3 | 2008-07-21 14:41:33 +0000 | [diff] [blame] | 333 | bb_perror_msg_and_die("can't get user/group: %s", ssluser); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 334 | } |
Bernhard Reutner-Fischer | d73cbd3 | 2008-07-21 14:41:33 +0000 | [diff] [blame] | 335 | bb_error_msg_and_die("unknown user/group %s", ssluser); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 336 | } |
| 337 | if (!cert) cert = "./cert.pem"; |
| 338 | if (!key) key = cert; |
| 339 | if (matrixSslOpen() < 0) |
Denys Vlasenko | 6331cf0 | 2009-11-13 09:08:27 +0100 | [diff] [blame] | 340 | fatal("can't initialize ssl"); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 341 | if (matrixSslReadKeys(&keys, cert, key, 0, ca) < 0) { |
| 342 | if (client) |
Denys Vlasenko | 6331cf0 | 2009-11-13 09:08:27 +0100 | [diff] [blame] | 343 | fatal("can't read cert, key, or ca file"); |
| 344 | fatal("can't read cert or key file"); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 345 | } |
| 346 | if (matrixSslNewSession(&ssl, keys, 0, SSL_FLAGS_SERVER) < 0) |
Denys Vlasenko | 6331cf0 | 2009-11-13 09:08:27 +0100 | [diff] [blame] | 347 | fatal("can't create ssl session"); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 348 | #endif |
| 349 | |
| 350 | sig_block(SIGCHLD); |
| 351 | signal(SIGCHLD, sig_child_handler); |
Denis Vlasenko | cf7cf62 | 2008-03-19 19:38:46 +0000 | [diff] [blame] | 352 | bb_signals(BB_FATAL_SIGS, sig_term_handler); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 353 | signal(SIGPIPE, SIG_IGN); |
| 354 | |
| 355 | if (max_per_host) |
Denys Vlasenko | d82ea2b | 2018-02-27 13:03:44 +0100 | [diff] [blame] | 356 | G.cc = ipsvd_perhost_init(cmax); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 357 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 358 | local_port = bb_lookup_port(argv[1], tcp ? "tcp" : "udp", 0); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 359 | lsa = xhost2sockaddr(argv[0], local_port); |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 360 | argv += 2; |
| 361 | |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 362 | sock = xsocket(lsa->u.sa.sa_family, tcp ? SOCK_STREAM : SOCK_DGRAM, 0); |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 363 | setsockopt_reuseaddr(sock); |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 364 | sa_len = lsa->len; /* I presume sockaddr len stays the same */ |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 365 | xbind(sock, &lsa->u.sa, sa_len); |
Denys Vlasenko | 16635cc | 2009-06-13 22:49:08 +0200 | [diff] [blame] | 366 | if (tcp) { |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 367 | xlisten(sock, backlog); |
Denys Vlasenko | 16635cc | 2009-06-13 22:49:08 +0200 | [diff] [blame] | 368 | close_on_exec_on(sock); |
| 369 | } else { /* udp: needed for recv_from_to to work: */ |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 370 | socket_want_pktinfo(sock); |
Denys Vlasenko | 16635cc | 2009-06-13 22:49:08 +0200 | [diff] [blame] | 371 | } |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 372 | /* ndelay_off(sock); - it is the default I think? */ |
| 373 | |
| 374 | #ifndef SSLSVD |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 375 | if (opts & OPT_u) { |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 376 | /* drop permissions */ |
| 377 | xsetgid(ugid.gid); |
| 378 | xsetuid(ugid.uid); |
| 379 | } |
| 380 | #endif |
| 381 | |
| 382 | if (verbose) { |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 383 | char *addr = xmalloc_sockaddr2dotted(&lsa->u.sa); |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 384 | if (opts & OPT_u) |
| 385 | bb_error_msg("listening on %s, starting, uid %u, gid %u", addr, |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 386 | (unsigned)ugid.uid, (unsigned)ugid.gid); |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 387 | else |
| 388 | bb_error_msg("listening on %s, starting", addr); |
| 389 | free(addr); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 390 | } |
| 391 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 392 | /* Main accept() loop */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 393 | |
| 394 | again: |
| 395 | hccp = NULL; |
| 396 | |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 397 | again1: |
| 398 | close(0); |
| 399 | /* It's important to close(0) _before_ wait loop: |
| 400 | * fd#0 can be a shared connection fd. |
| 401 | * If kept open by us, peer can't detect PROG closing it. |
| 402 | */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 403 | while (cnum >= cmax) |
Denis Vlasenko | 3f165fa | 2008-03-17 08:29:08 +0000 | [diff] [blame] | 404 | wait_for_any_sig(); /* expecting SIGCHLD */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 405 | |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 406 | again2: |
| 407 | sig_unblock(SIGCHLD); |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 408 | local.len = remote.len = sa_len; |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 409 | if (tcp) { |
Denys Vlasenko | ec1ea16 | 2016-10-07 15:56:47 +0200 | [diff] [blame] | 410 | /* Accept a connection to fd #0 */ |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 411 | conn = accept(sock, &remote.u.sa, &remote.len); |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 412 | } else { |
Denis Vlasenko | 1ca332b | 2007-04-04 17:49:47 +0000 | [diff] [blame] | 413 | /* In case recv_from_to won't be able to recover local addr. |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 414 | * Also sets port - recv_from_to is unable to do it. */ |
| 415 | local = *lsa; |
Denis Vlasenko | aa9b182 | 2008-03-17 09:10:39 +0000 | [diff] [blame] | 416 | conn = recv_from_to(sock, NULL, 0, MSG_PEEK, |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 417 | &remote.u.sa, &local.u.sa, sa_len); |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 418 | } |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 419 | sig_block(SIGCHLD); |
| 420 | if (conn < 0) { |
| 421 | if (errno != EINTR) |
James Byrne | 6937487 | 2019-07-02 11:35:03 +0200 | [diff] [blame] | 422 | bb_simple_perror_msg(tcp ? "accept" : "recv"); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 423 | goto again2; |
| 424 | } |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 425 | xmove_fd(tcp ? conn : sock, 0); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 426 | |
| 427 | if (max_per_host) { |
| 428 | /* Drop connection immediately if cur_per_host > max_per_host |
| 429 | * (minimizing load under SYN flood) */ |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 430 | remote_addr = xmalloc_sockaddr2dotted_noport(&remote.u.sa); |
Denys Vlasenko | d82ea2b | 2018-02-27 13:03:44 +0100 | [diff] [blame] | 431 | cur_per_host = ipsvd_perhost_add(G.cc, remote_addr, max_per_host, &hccp); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 432 | if (cur_per_host > max_per_host) { |
| 433 | /* ipsvd_perhost_add detected that max is exceeded |
| 434 | * (and did not store ip in connection table) */ |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 435 | free(remote_addr); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 436 | if (msg_per_host) { |
| 437 | /* don't block or test for errors */ |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 438 | send(0, msg_per_host, len_per_host, MSG_DONTWAIT); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 439 | } |
| 440 | goto again1; |
| 441 | } |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 442 | /* NB: remote_addr is not leaked, it is stored in conn table */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 443 | } |
| 444 | |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 445 | if (!tcp) { |
| 446 | /* Voodoo magic: making udp sockets each receive its own |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 447 | * packets is not trivial, and I still not sure |
| 448 | * I do it 100% right. |
| 449 | * 1) we have to do it before fork() |
| 450 | * 2) order is important - is it right now? */ |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 451 | |
Denis Vlasenko | 4cf1d08 | 2008-03-12 23:13:50 +0000 | [diff] [blame] | 452 | /* Open new non-connected UDP socket for further clients... */ |
| 453 | sock = xsocket(lsa->u.sa.sa_family, SOCK_DGRAM, 0); |
| 454 | setsockopt_reuseaddr(sock); |
| 455 | /* Make plain write/send work for old socket by supplying default |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 456 | * destination address. This also restricts incoming packets |
| 457 | * to ones coming from this remote IP. */ |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 458 | xconnect(0, &remote.u.sa, sa_len); |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 459 | /* hole? at this point we have no wildcard udp socket... |
Denis Vlasenko | 7946879 | 2007-04-04 11:02:55 +0000 | [diff] [blame] | 460 | * can this cause clients to get "port unreachable" icmp? |
| 461 | * Yup, time window is very small, but it exists (is it?) */ |
Denis Vlasenko | 4cf1d08 | 2008-03-12 23:13:50 +0000 | [diff] [blame] | 462 | /* ..."open new socket", continued */ |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 463 | xbind(sock, &lsa->u.sa, sa_len); |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 464 | socket_want_pktinfo(sock); |
Denis Vlasenko | 7946879 | 2007-04-04 11:02:55 +0000 | [diff] [blame] | 465 | |
| 466 | /* Doesn't work: |
| 467 | * we cannot replace fd #0 - we will lose pending packet |
| 468 | * which is already buffered for us! And we cannot use fd #1 |
| 469 | * instead - it will "intercept" all following packets, but child |
Denis Vlasenko | f87f495 | 2007-08-24 10:27:41 +0000 | [diff] [blame] | 470 | * does not expect data coming *from fd #1*! */ |
Denis Vlasenko | 7946879 | 2007-04-04 11:02:55 +0000 | [diff] [blame] | 471 | #if 0 |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 472 | /* Make it so that local addr is fixed to localp->u.sa |
Denis Vlasenko | 7946879 | 2007-04-04 11:02:55 +0000 | [diff] [blame] | 473 | * and we don't accidentally accept packets to other local IPs. */ |
| 474 | /* NB: we possibly bind to the _very_ same_ address & port as the one |
| 475 | * already bound in parent! This seems to work in Linux. |
| 476 | * (otherwise we can move socket to fd #0 only if bind succeeds) */ |
| 477 | close(0); |
Denys Vlasenko | ca18311 | 2011-04-07 17:52:20 +0200 | [diff] [blame] | 478 | set_nport(&localp->u.sa, htons(local_port)); |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 479 | xmove_fd(xsocket(localp->u.sa.sa_family, SOCK_DGRAM, 0), 0); |
Denis Vlasenko | 7946879 | 2007-04-04 11:02:55 +0000 | [diff] [blame] | 480 | setsockopt_reuseaddr(0); /* crucial */ |
Bernhard Reutner-Fischer | 8c69afd | 2008-01-29 10:33:34 +0000 | [diff] [blame] | 481 | xbind(0, &localp->u.sa, localp->len); |
Denis Vlasenko | 7946879 | 2007-04-04 11:02:55 +0000 | [diff] [blame] | 482 | #endif |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 483 | } |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 484 | |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 485 | pid = vfork(); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 486 | if (pid == -1) { |
James Byrne | 6937487 | 2019-07-02 11:35:03 +0200 | [diff] [blame] | 487 | bb_simple_perror_msg("vfork"); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 488 | goto again; |
| 489 | } |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 490 | |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 491 | if (pid != 0) { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 492 | /* Parent */ |
Denis Vlasenko | 02fd668 | 2007-04-03 23:23:10 +0000 | [diff] [blame] | 493 | cnum++; |
| 494 | if (verbose) |
| 495 | connection_status(); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 496 | if (hccp) |
| 497 | hccp->pid = pid; |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 498 | /* clean up changes done by vforked child */ |
| 499 | undo_xsetenv(); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 500 | goto again; |
| 501 | } |
| 502 | |
| 503 | /* Child: prepare env, log, and exec prog */ |
| 504 | |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 505 | { /* vfork alert! every xmalloc in this block should be freed! */ |
| 506 | char *local_hostname = local_hostname; /* for compiler */ |
| 507 | char *local_addr = NULL; |
| 508 | char *free_me0 = NULL; |
| 509 | char *free_me1 = NULL; |
| 510 | char *free_me2 = NULL; |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 511 | |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 512 | if (verbose || !(opts & OPT_E)) { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 513 | if (!max_per_host) /* remote_addr is not yet known */ |
| 514 | free_me0 = remote_addr = xmalloc_sockaddr2dotted(&remote.u.sa); |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 515 | if (opts & OPT_h) { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 516 | free_me1 = remote_hostname = xmalloc_sockaddr2host_noport(&remote.u.sa); |
| 517 | if (!remote_hostname) { |
Denys Vlasenko | 6331cf0 | 2009-11-13 09:08:27 +0100 | [diff] [blame] | 518 | bb_error_msg("can't look up hostname for %s", remote_addr); |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 519 | remote_hostname = remote_addr; |
| 520 | } |
| 521 | } |
| 522 | /* Find out local IP peer connected to. |
| 523 | * Errors ignored (I'm not paranoid enough to imagine kernel |
| 524 | * which doesn't know local IP). */ |
| 525 | if (tcp) |
| 526 | getsockname(0, &local.u.sa, &local.len); |
| 527 | /* else: for UDP it is done earlier by parent */ |
| 528 | local_addr = xmalloc_sockaddr2dotted(&local.u.sa); |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 529 | if (opts & OPT_h) { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 530 | local_hostname = preset_local_hostname; |
| 531 | if (!local_hostname) { |
| 532 | free_me2 = local_hostname = xmalloc_sockaddr2host_noport(&local.u.sa); |
| 533 | if (!local_hostname) |
Denys Vlasenko | 6331cf0 | 2009-11-13 09:08:27 +0100 | [diff] [blame] | 534 | bb_error_msg_and_die("can't look up hostname for %s", local_addr); |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 535 | } |
| 536 | /* else: local_hostname is not NULL, but is NOT malloced! */ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 537 | } |
| 538 | } |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 539 | if (verbose) { |
| 540 | pid = getpid(); |
| 541 | if (max_per_host) { |
| 542 | bb_error_msg("concurrency %s %u/%u", |
| 543 | remote_addr, |
| 544 | cur_per_host, max_per_host); |
| 545 | } |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 546 | bb_error_msg((opts & OPT_h) |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 547 | ? "start %u %s-%s (%s-%s)" |
| 548 | : "start %u %s-%s", |
| 549 | pid, |
| 550 | local_addr, remote_addr, |
| 551 | local_hostname, remote_hostname); |
Denis Vlasenko | 64a1512 | 2007-04-04 10:16:15 +0000 | [diff] [blame] | 552 | } |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 553 | |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 554 | if (!(opts & OPT_E)) { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 555 | /* setup ucspi env */ |
| 556 | const char *proto = tcp ? "TCP" : "UDP"; |
| 557 | |
Jeremie Koenig | 2ea12d8 | 2010-05-27 15:46:25 +0200 | [diff] [blame] | 558 | #ifdef SO_ORIGINAL_DST |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 559 | /* Extract "original" destination addr:port |
| 560 | * from Linux firewall. Useful when you redirect |
| 561 | * an outbond connection to local handler, and it needs |
| 562 | * to know where it originally tried to connect */ |
| 563 | if (tcp && getsockopt(0, SOL_IP, SO_ORIGINAL_DST, &local.u.sa, &local.len) == 0) { |
| 564 | char *addr = xmalloc_sockaddr2dotted(&local.u.sa); |
| 565 | xsetenv_plain("TCPORIGDSTADDR", addr); |
| 566 | free(addr); |
| 567 | } |
Jeremie Koenig | 2ea12d8 | 2010-05-27 15:46:25 +0200 | [diff] [blame] | 568 | #endif |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 569 | xsetenv_plain("PROTO", proto); |
| 570 | xsetenv_proto(proto, "LOCALADDR", local_addr); |
| 571 | xsetenv_proto(proto, "REMOTEADDR", remote_addr); |
Denys Vlasenko | d6513cf | 2009-07-19 23:07:13 +0200 | [diff] [blame] | 572 | if (opts & OPT_h) { |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 573 | xsetenv_proto(proto, "LOCALHOST", local_hostname); |
| 574 | xsetenv_proto(proto, "REMOTEHOST", remote_hostname); |
| 575 | } |
| 576 | //compat? xsetenv_proto(proto, "REMOTEINFO", ""); |
| 577 | /* additional */ |
| 578 | if (cur_per_host > 0) /* can not be true for udp */ |
| 579 | xsetenv_plain("TCPCONCURRENCY", utoa(cur_per_host)); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 580 | } |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 581 | free(local_addr); |
| 582 | free(free_me0); |
| 583 | free(free_me1); |
| 584 | free(free_me2); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 585 | } |
| 586 | |
Denis Vlasenko | aefed94 | 2008-03-17 08:35:44 +0000 | [diff] [blame] | 587 | xdup2(0, 1); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 588 | |
Denis Vlasenko | 3fa36e2 | 2008-11-09 00:15:11 +0000 | [diff] [blame] | 589 | signal(SIGPIPE, SIG_DFL); /* this one was SIG_IGNed */ |
| 590 | /* Non-ignored signals revert to SIG_DFL on exec anyway */ |
| 591 | /*signal(SIGCHLD, SIG_DFL);*/ |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 592 | sig_unblock(SIGCHLD); |
| 593 | |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 594 | #ifdef SSLSVD |
Denis Vlasenko | 4cf1d08 | 2008-03-12 23:13:50 +0000 | [diff] [blame] | 595 | strcpy(id, utoa(pid)); |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 596 | ssl_io(0, argv); |
Denys Vlasenko | 41ddd9f | 2010-06-25 01:46:53 +0200 | [diff] [blame] | 597 | bb_perror_msg_and_die("can't execute '%s'", argv[0]); |
Pascal Bellard | 21e8e8d | 2010-07-04 00:57:03 +0200 | [diff] [blame] | 598 | #else |
| 599 | BB_EXECVP_or_die(argv); |
| 600 | #endif |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 601 | } |
| 602 | |
| 603 | /* |
| 604 | tcpsvd [-hpEvv] [-c n] [-C n:msg] [-b n] [-u user] [-l name] |
| 605 | [-i dir|-x cdb] [ -t sec] host port prog |
| 606 | |
| 607 | tcpsvd creates a TCP/IP socket, binds it to the address host:port, |
| 608 | and listens on the socket for incoming connections. |
| 609 | |
| 610 | On each incoming connection, tcpsvd conditionally runs a program, |
| 611 | with standard input reading from the socket, and standard output |
| 612 | writing to the socket, to handle this connection. tcpsvd keeps |
| 613 | listening on the socket for new connections, and can handle |
| 614 | multiple connections simultaneously. |
| 615 | |
| 616 | tcpsvd optionally checks for special instructions depending |
| 617 | on the IP address or hostname of the client that initiated |
| 618 | the connection, see ipsvd-instruct(5). |
| 619 | |
| 620 | host |
| 621 | host either is a hostname, or a dotted-decimal IP address, |
| 622 | or 0. If host is 0, tcpsvd accepts connections to any local |
| 623 | IP address. |
| 624 | * busybox accepts IPv6 addresses and host:port pairs too |
| 625 | In this case second parameter is ignored |
| 626 | port |
| 627 | tcpsvd accepts connections to host:port. port may be a name |
| 628 | from /etc/services or a number. |
| 629 | prog |
| 630 | prog consists of one or more arguments. For each connection, |
| 631 | tcpsvd normally runs prog, with file descriptor 0 reading from |
| 632 | the network, and file descriptor 1 writing to the network. |
| 633 | By default it also sets up TCP-related environment variables, |
| 634 | see tcp-environ(5) |
| 635 | -i dir |
| 636 | read instructions for handling new connections from the instructions |
| 637 | directory dir. See ipsvd-instruct(5) for details. |
| 638 | * ignored by busyboxed version |
| 639 | -x cdb |
| 640 | read instructions for handling new connections from the constant database |
| 641 | cdb. The constant database normally is created from an instructions |
| 642 | directory by running ipsvd-cdb(8). |
| 643 | * ignored by busyboxed version |
| 644 | -t sec |
| 645 | timeout. This option only takes effect if the -i option is given. |
| 646 | While checking the instructions directory, check the time of last access |
| 647 | of the file that matches the clients address or hostname if any, discard |
| 648 | and remove the file if it wasn't accessed within the last sec seconds; |
| 649 | tcpsvd does not discard or remove a file if the user's write permission |
| 650 | is not set, for those files the timeout is disabled. Default is 0, |
| 651 | which means that the timeout is disabled. |
| 652 | * ignored by busyboxed version |
| 653 | -l name |
| 654 | local hostname. Do not look up the local hostname in DNS, but use name |
| 655 | as hostname. This option must be set if tcpsvd listens on port 53 |
| 656 | to avoid loops. |
| 657 | -u user[:group] |
| 658 | drop permissions. Switch user ID to user's UID, and group ID to user's |
| 659 | primary GID after creating and binding to the socket. If user is followed |
| 660 | by a colon and a group name, the group ID is switched to the GID of group |
| 661 | instead. All supplementary groups are removed. |
| 662 | -c n |
| 663 | concurrency. Handle up to n connections simultaneously. Default is 30. |
| 664 | If there are n connections active, tcpsvd defers acceptance of a new |
| 665 | connection until an active connection is closed. |
| 666 | -C n[:msg] |
| 667 | per host concurrency. Allow only up to n connections from the same IP |
| 668 | address simultaneously. If there are n active connections from one IP |
| 669 | address, new incoming connections from this IP address are closed |
| 670 | immediately. If n is followed by :msg, the message msg is written |
| 671 | to the client if possible, before closing the connection. By default |
| 672 | msg is empty. See ipsvd-instruct(5) for supported escape sequences in msg. |
| 673 | |
| 674 | For each accepted connection, the current per host concurrency is |
| 675 | available through the environment variable TCPCONCURRENCY. n and msg |
| 676 | can be overwritten by ipsvd(7) instructions, see ipsvd-instruct(5). |
| 677 | By default tcpsvd doesn't keep track of connections. |
| 678 | -h |
| 679 | Look up the client's hostname in DNS. |
| 680 | -p |
| 681 | paranoid. After looking up the client's hostname in DNS, look up the IP |
| 682 | addresses in DNS for that hostname, and forget about the hostname |
| 683 | if none of the addresses match the client's IP address. You should |
| 684 | set this option if you use hostname based instructions. The -p option |
| 685 | implies the -h option. |
| 686 | * ignored by busyboxed version |
| 687 | -b n |
| 688 | backlog. Allow a backlog of approximately n TCP SYNs. On some systems n |
| 689 | is silently limited. Default is 20. |
| 690 | -E |
| 691 | no special environment. Do not set up TCP-related environment variables. |
| 692 | -v |
Denys Vlasenko | 10ad622 | 2017-04-17 16:13:32 +0200 | [diff] [blame] | 693 | verbose. Print verbose messages to standard output. |
Denis Vlasenko | b933ac1 | 2007-04-03 12:09:46 +0000 | [diff] [blame] | 694 | -vv |
| 695 | more verbose. Print more verbose messages to standard output. |
| 696 | * no difference between -v and -vv in busyboxed version |
| 697 | */ |