blob: fbd1f1c45ffcce82b9c5808352693f5fc231d1ff [file] [log] [blame]
Denis Vlasenkob933ac12007-04-03 12:09:46 +00001/* Based on ipsvd utilities written by Gerrit Pape <pape@smarden.org>
2 * which are released into public domain by the author.
3 * Homepage: http://smarden.sunsite.dk/ipsvd/
4 *
Denis Vlasenkod18f52b2008-03-02 12:53:15 +00005 * Copyright (C) 2007 Denys Vlasenko.
Denis Vlasenkob933ac12007-04-03 12:09:46 +00006 *
Denys Vlasenko0ef64bd2010-08-16 20:14:46 +02007 * Licensed under GPLv2, see file LICENSE in this source tree.
Denis Vlasenkob933ac12007-04-03 12:09:46 +00008 */
9
Denis Vlasenko4866e902008-03-17 09:17:27 +000010/* Based on ipsvd-0.12.1. This tcpsvd accepts all options
Denis Vlasenko02fd6682007-04-03 23:23:10 +000011 * which are supported by one from ipsvd-0.12.1, but not all are
12 * functional. See help text at the end of this file for details.
13 *
14 * Code inside "#ifdef SSLSVD" is for sslsvd and is currently unused.
15 *
Denis Vlasenkoaefed942008-03-17 08:35:44 +000016 * Busybox version exports TCPLOCALADDR instead of
17 * TCPLOCALIP + TCPLOCALPORT pair. ADDR more closely matches reality
18 * (which is "struct sockaddr_XXX". Port is not a separate entity,
19 * it's just a part of (AF_INET[6]) sockaddr!).
Denis Vlasenko02fd6682007-04-03 23:23:10 +000020 *
Denis Vlasenkoaefed942008-03-17 08:35:44 +000021 * TCPORIGDSTADDR is Busybox-specific addition.
Denis Vlasenko02fd6682007-04-03 23:23:10 +000022 *
23 * udp server is hacked up by reusing TCP code. It has the following
24 * limitation inherent in Unix DGRAM sockets implementation:
Denis Vlasenko64a15122007-04-04 10:16:15 +000025 * - local IP address is retrieved (using recvmsg voodoo) but
Denis Vlasenko02fd6682007-04-03 23:23:10 +000026 * child's socket is not bound to it (bind cannot be called on
Denis Vlasenko64a15122007-04-04 10:16:15 +000027 * already bound socket). Thus it still can emit outgoing packets
Denis Vlasenkobeaca812007-04-13 16:32:26 +000028 * with wrong source IP...
Denis Vlasenko02fd6682007-04-03 23:23:10 +000029 * - don't know how to retrieve ORIGDST for udp.
30 */
31
Pere Orga5bc8c002011-04-11 03:29:49 +020032//usage:#define tcpsvd_trivial_usage
33//usage: "[-hEv] [-c N] [-C N[:MSG]] [-b N] [-u USER] [-l NAME] IP PORT PROG"
34/* with not-implemented options: */
35/* //usage: "[-hpEvv] [-c N] [-C N[:MSG]] [-b N] [-u USER] [-l NAME] [-i DIR|-x CDB] [-t SEC] IP PORT PROG" */
36//usage:#define tcpsvd_full_usage "\n\n"
37//usage: "Create TCP socket, bind to IP:PORT and listen\n"
38//usage: "for incoming connection. Run PROG for each connection.\n"
Denys Vlasenko4abcb8b2011-07-25 16:35:44 +020039//usage: "\n IP IP to listen on, 0 = all"
Pere Orga5bc8c002011-04-11 03:29:49 +020040//usage: "\n PORT Port to listen on"
41//usage: "\n PROG ARGS Program to run"
42//usage: "\n -l NAME Local hostname (else looks up local hostname in DNS)"
43//usage: "\n -u USER[:GRP] Change to user/group after bind"
44//usage: "\n -c N Handle up to N connections simultaneously"
45//usage: "\n -b N Allow a backlog of approximately N TCP SYNs"
Denys Vlasenko4abcb8b2011-07-25 16:35:44 +020046//usage: "\n -C N[:MSG] Allow only up to N connections from the same IP"
Pere Orga5bc8c002011-04-11 03:29:49 +020047//usage: "\n New connections from this IP address are closed"
48//usage: "\n immediately. MSG is written to the peer before close"
49//usage: "\n -h Look up peer's hostname"
50//usage: "\n -E Don't set up environment variables"
51//usage: "\n -v Verbose"
52//usage:
53//usage:#define udpsvd_trivial_usage
54//usage: "[-hEv] [-c N] [-u USER] [-l NAME] IP PORT PROG"
55//usage:#define udpsvd_full_usage "\n\n"
56//usage: "Create UDP socket, bind to IP:PORT and wait\n"
57//usage: "for incoming packets. Run PROG for each packet,\n"
58//usage: "redirecting all further packets with same peer ip:port to it.\n"
Denys Vlasenko4abcb8b2011-07-25 16:35:44 +020059//usage: "\n IP IP to listen on, 0 = all"
Pere Orga5bc8c002011-04-11 03:29:49 +020060//usage: "\n PORT Port to listen on"
61//usage: "\n PROG ARGS Program to run"
62//usage: "\n -l NAME Local hostname (else looks up local hostname in DNS)"
63//usage: "\n -u USER[:GRP] Change to user/group after bind"
64//usage: "\n -c N Handle up to N connections simultaneously"
65//usage: "\n -h Look up peer's hostname"
66//usage: "\n -E Don't set up environment variables"
67//usage: "\n -v Verbose"
68
Denis Vlasenkob6adbf12007-05-26 19:00:18 +000069#include "libbb.h"
Denys Vlasenkoe6a2f4c2016-04-21 16:26:30 +020070#include "common_bufsiz.h"
Jeremie Koenig2ea12d82010-05-27 15:46:25 +020071
Denis Vlasenko165f5b32008-03-31 20:30:38 +000072/* Wants <limits.h> etc, thus included after libbb.h: */
Jeremie Koenig2ea12d82010-05-27 15:46:25 +020073#ifdef __linux__
Denis Vlasenkoc0cd9f22008-06-07 12:23:44 +000074#include <linux/types.h> /* for __be32 etc */
Denis Vlasenko165f5b32008-03-31 20:30:38 +000075#include <linux/netfilter_ipv4.h>
Jeremie Koenig2ea12d82010-05-27 15:46:25 +020076#endif
Denis Vlasenko165f5b32008-03-31 20:30:38 +000077
Denis Vlasenko4866e902008-03-17 09:17:27 +000078// TODO: move into this file:
79#include "tcpudp_perhost.h"
Denis Vlasenko02fd6682007-04-03 23:23:10 +000080
81#ifdef SSLSVD
82#include "matrixSsl.h"
83#include "ssl_io.h"
84#endif
85
Denis Vlasenkob9256052007-09-28 10:29:17 +000086struct globals {
87 unsigned verbose;
88 unsigned max_per_host;
89 unsigned cur_per_host;
90 unsigned cnum;
Denis Vlasenko3f5fdc72007-10-14 04:55:59 +000091 unsigned cmax;
Denis Vlasenkoaefed942008-03-17 08:35:44 +000092 char **env_cur;
93 char *env_var[1]; /* actually bigger */
Denys Vlasenko98a4c7c2010-02-04 15:00:15 +010094} FIX_ALIASING;
Denys Vlasenkoe6a2f4c2016-04-21 16:26:30 +020095#define G (*(struct globals*)bb_common_bufsiz1)
Denis Vlasenkob9256052007-09-28 10:29:17 +000096#define verbose (G.verbose )
97#define max_per_host (G.max_per_host)
98#define cur_per_host (G.cur_per_host)
99#define cnum (G.cnum )
100#define cmax (G.cmax )
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000101#define env_cur (G.env_cur )
102#define env_var (G.env_var )
Denis Vlasenko7049ff82008-06-25 09:53:17 +0000103#define INIT_G() do { \
Denys Vlasenko47cfbf32016-04-21 18:18:48 +0200104 setup_common_bufsiz(); \
Denis Vlasenko7049ff82008-06-25 09:53:17 +0000105 cmax = 30; \
106 env_cur = &env_var[0]; \
107} while (0)
Denis Vlasenkob9256052007-09-28 10:29:17 +0000108
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000109
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000110/* We have to be careful about leaking memory in repeated setenv's */
111static void xsetenv_plain(const char *n, const char *v)
112{
113 char *var = xasprintf("%s=%s", n, v);
114 *env_cur++ = var;
115 putenv(var);
116}
117
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000118static void xsetenv_proto(const char *proto, const char *n, const char *v)
119{
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000120 char *var = xasprintf("%s%s=%s", proto, n, v);
121 *env_cur++ = var;
122 putenv(var);
123}
124
125static void undo_xsetenv(void)
126{
127 char **pp = env_cur = &env_var[0];
128 while (*pp) {
129 char *var = *pp;
Denys Vlasenkodd8adde2010-06-24 05:00:50 +0200130 bb_unsetenv_and_free(var);
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000131 *pp++ = NULL;
132 }
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000133}
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000134
135static void sig_term_handler(int sig)
136{
137 if (verbose)
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000138 bb_error_msg("got signal %u, exit", sig);
Denis Vlasenko400d8bb2008-02-24 13:36:01 +0000139 kill_myself_with_sig(sig);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000140}
141
142/* Little bloated, but tries to give accurate info how child exited.
143 * Makes easier to spot segfaulting children etc... */
144static void print_waitstat(unsigned pid, int wstat)
145{
146 unsigned e = 0;
147 const char *cause = "?exit";
148
149 if (WIFEXITED(wstat)) {
150 cause++;
151 e = WEXITSTATUS(wstat);
152 } else if (WIFSIGNALED(wstat)) {
153 cause = "signal";
154 e = WTERMSIG(wstat);
155 }
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000156 bb_error_msg("end %d %s %d", pid, cause, e);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000157}
158
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000159/* Must match getopt32 in main! */
160enum {
161 OPT_c = (1 << 0),
162 OPT_C = (1 << 1),
163 OPT_i = (1 << 2),
164 OPT_x = (1 << 3),
165 OPT_u = (1 << 4),
166 OPT_l = (1 << 5),
167 OPT_E = (1 << 6),
168 OPT_b = (1 << 7),
169 OPT_h = (1 << 8),
170 OPT_p = (1 << 9),
171 OPT_t = (1 << 10),
172 OPT_v = (1 << 11),
173 OPT_V = (1 << 12),
174 OPT_U = (1 << 13), /* from here: sslsvd only */
175 OPT_slash = (1 << 14),
176 OPT_Z = (1 << 15),
177 OPT_K = (1 << 16),
178};
179
180static void connection_status(void)
181{
Denis Vlasenkof87f4952007-08-24 10:27:41 +0000182 /* "only 1 client max" desn't need this */
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000183 if (cmax > 1)
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000184 bb_error_msg("status %u/%u", cnum, cmax);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000185}
186
Denis Vlasenkoa60f84e2008-07-05 09:18:54 +0000187static void sig_child_handler(int sig UNUSED_PARAM)
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000188{
189 int wstat;
Denis Vlasenko3854c5d2008-11-06 22:39:57 +0000190 pid_t pid;
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000191
Denis Vlasenkofb0eba72008-01-02 19:55:04 +0000192 while ((pid = wait_any_nohang(&wstat)) > 0) {
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000193 if (max_per_host)
194 ipsvd_perhost_remove(pid);
195 if (cnum)
196 cnum--;
197 if (verbose)
198 print_waitstat(pid, wstat);
199 }
200 if (verbose)
201 connection_status();
202}
203
Denis Vlasenko9b49a5e2007-10-11 10:05:36 +0000204int tcpudpsvd_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
Denis Vlasenkoa60f84e2008-07-05 09:18:54 +0000205int tcpudpsvd_main(int argc UNUSED_PARAM, char **argv)
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000206{
Denis Vlasenko1d426652008-03-17 09:09:09 +0000207 char *str_C, *str_t;
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000208 char *user;
209 struct hcc *hccp;
210 const char *instructs;
211 char *msg_per_host = NULL;
212 unsigned len_per_host = len_per_host; /* gcc */
Denis Vlasenko64a15122007-04-04 10:16:15 +0000213#ifndef SSLSVD
214 struct bb_uidgid_t ugid;
215#endif
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000216 bool tcp;
Denis Vlasenko64a15122007-04-04 10:16:15 +0000217 uint16_t local_port;
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000218 char *preset_local_hostname = NULL;
219 char *remote_hostname = remote_hostname; /* for compiler */
220 char *remote_addr = remote_addr; /* for compiler */
Denis Vlasenko64a15122007-04-04 10:16:15 +0000221 len_and_sockaddr *lsa;
222 len_and_sockaddr local, remote;
223 socklen_t sa_len;
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000224 int pid;
225 int sock;
226 int conn;
227 unsigned backlog = 20;
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200228 unsigned opts;
Denis Vlasenko64a15122007-04-04 10:16:15 +0000229
Denis Vlasenkob9256052007-09-28 10:29:17 +0000230 INIT_G();
231
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000232 tcp = (applet_name[0] == 't');
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000233
Denis Vlasenko1d426652008-03-17 09:09:09 +0000234 /* 3+ args, -i at most once, -p implies -h, -v is counter, -b N, -c N */
Denys Vlasenko237bedd2016-07-06 21:58:02 +0200235 opt_complementary = "-3:i--i:ph:vv";
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000236#ifdef SSLSVD
Denys Vlasenko237bedd2016-07-06 21:58:02 +0200237 opts = getopt32(argv, "+c:+C:i:x:u:l:Eb:+hpt:vU:/:Z:K:",
Denis Vlasenko1d426652008-03-17 09:09:09 +0000238 &cmax, &str_C, &instructs, &instructs, &user, &preset_local_hostname,
239 &backlog, &str_t, &ssluser, &root, &cert, &key, &verbose
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000240 );
241#else
Denis Vlasenko1d426652008-03-17 09:09:09 +0000242 /* "+": stop on first non-option */
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200243 opts = getopt32(argv, "+c:C:i:x:u:l:Eb:hpt:v",
Denis Vlasenko1d426652008-03-17 09:09:09 +0000244 &cmax, &str_C, &instructs, &instructs, &user, &preset_local_hostname,
245 &backlog, &str_t, &verbose
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000246 );
247#endif
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200248 if (opts & OPT_C) { /* -C n[:message] */
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000249 max_per_host = bb_strtou(str_C, &str_C, 10);
250 if (str_C[0]) {
251 if (str_C[0] != ':')
252 bb_show_usage();
253 msg_per_host = str_C + 1;
254 len_per_host = strlen(msg_per_host);
255 }
256 }
257 if (max_per_host > cmax)
258 max_per_host = cmax;
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200259 if (opts & OPT_u) {
Bernhard Reutner-Fischerd73cbd32008-07-21 14:41:33 +0000260 xget_uidgid(&ugid, user);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000261 }
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000262#ifdef SSLSVD
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200263 if (opts & OPT_U) ssluser = optarg;
264 if (opts & OPT_slash) root = optarg;
265 if (opts & OPT_Z) cert = optarg;
266 if (opts & OPT_K) key = optarg;
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000267#endif
268 argv += optind;
269 if (!argv[0][0] || LONE_CHAR(argv[0], '0'))
270 argv[0] = (char*)"0.0.0.0";
271
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000272 /* Per-IP flood protection is not thought-out for UDP */
273 if (!tcp)
274 max_per_host = 0;
275
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000276 bb_sanitize_stdio(); /* fd# 0,1,2 must be opened */
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000277
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000278#ifdef SSLSVD
279 sslser = user;
280 client = 0;
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200281 if ((getuid() == 0) && !(opts & OPT_u)) {
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000282 xfunc_exitcode = 100;
Denys Vlasenkob2e5fc32009-11-25 14:52:47 +0100283 bb_error_msg_and_die(bb_msg_you_must_be_root);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000284 }
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200285 if (opts & OPT_u)
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000286 if (!uidgid_get(&sslugid, ssluser, 1)) {
287 if (errno) {
Bernhard Reutner-Fischerd73cbd32008-07-21 14:41:33 +0000288 bb_perror_msg_and_die("can't get user/group: %s", ssluser);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000289 }
Bernhard Reutner-Fischerd73cbd32008-07-21 14:41:33 +0000290 bb_error_msg_and_die("unknown user/group %s", ssluser);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000291 }
292 if (!cert) cert = "./cert.pem";
293 if (!key) key = cert;
294 if (matrixSslOpen() < 0)
Denys Vlasenko6331cf02009-11-13 09:08:27 +0100295 fatal("can't initialize ssl");
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000296 if (matrixSslReadKeys(&keys, cert, key, 0, ca) < 0) {
297 if (client)
Denys Vlasenko6331cf02009-11-13 09:08:27 +0100298 fatal("can't read cert, key, or ca file");
299 fatal("can't read cert or key file");
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000300 }
301 if (matrixSslNewSession(&ssl, keys, 0, SSL_FLAGS_SERVER) < 0)
Denys Vlasenko6331cf02009-11-13 09:08:27 +0100302 fatal("can't create ssl session");
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000303#endif
304
305 sig_block(SIGCHLD);
306 signal(SIGCHLD, sig_child_handler);
Denis Vlasenkocf7cf622008-03-19 19:38:46 +0000307 bb_signals(BB_FATAL_SIGS, sig_term_handler);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000308 signal(SIGPIPE, SIG_IGN);
309
310 if (max_per_host)
311 ipsvd_perhost_init(cmax);
312
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000313 local_port = bb_lookup_port(argv[1], tcp ? "tcp" : "udp", 0);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000314 lsa = xhost2sockaddr(argv[0], local_port);
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000315 argv += 2;
316
Bernhard Reutner-Fischer8c69afd2008-01-29 10:33:34 +0000317 sock = xsocket(lsa->u.sa.sa_family, tcp ? SOCK_STREAM : SOCK_DGRAM, 0);
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000318 setsockopt_reuseaddr(sock);
Denis Vlasenko64a15122007-04-04 10:16:15 +0000319 sa_len = lsa->len; /* I presume sockaddr len stays the same */
Bernhard Reutner-Fischer8c69afd2008-01-29 10:33:34 +0000320 xbind(sock, &lsa->u.sa, sa_len);
Denys Vlasenko16635cc2009-06-13 22:49:08 +0200321 if (tcp) {
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000322 xlisten(sock, backlog);
Denys Vlasenko16635cc2009-06-13 22:49:08 +0200323 close_on_exec_on(sock);
324 } else { /* udp: needed for recv_from_to to work: */
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000325 socket_want_pktinfo(sock);
Denys Vlasenko16635cc2009-06-13 22:49:08 +0200326 }
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000327 /* ndelay_off(sock); - it is the default I think? */
328
329#ifndef SSLSVD
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200330 if (opts & OPT_u) {
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000331 /* drop permissions */
332 xsetgid(ugid.gid);
333 xsetuid(ugid.uid);
334 }
335#endif
336
337 if (verbose) {
Bernhard Reutner-Fischer8c69afd2008-01-29 10:33:34 +0000338 char *addr = xmalloc_sockaddr2dotted(&lsa->u.sa);
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200339 if (opts & OPT_u)
340 bb_error_msg("listening on %s, starting, uid %u, gid %u", addr,
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000341 (unsigned)ugid.uid, (unsigned)ugid.gid);
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200342 else
343 bb_error_msg("listening on %s, starting", addr);
344 free(addr);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000345 }
346
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000347 /* Main accept() loop */
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000348
349 again:
350 hccp = NULL;
351
352 while (cnum >= cmax)
Denis Vlasenko3f165fa2008-03-17 08:29:08 +0000353 wait_for_any_sig(); /* expecting SIGCHLD */
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000354
355 /* Accept a connection to fd #0 */
356 again1:
357 close(0);
358 again2:
359 sig_unblock(SIGCHLD);
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000360 local.len = remote.len = sa_len;
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000361 if (tcp) {
Bernhard Reutner-Fischer8c69afd2008-01-29 10:33:34 +0000362 conn = accept(sock, &remote.u.sa, &remote.len);
Denis Vlasenko64a15122007-04-04 10:16:15 +0000363 } else {
Denis Vlasenko1ca332b2007-04-04 17:49:47 +0000364 /* In case recv_from_to won't be able to recover local addr.
Denis Vlasenko64a15122007-04-04 10:16:15 +0000365 * Also sets port - recv_from_to is unable to do it. */
366 local = *lsa;
Denis Vlasenkoaa9b1822008-03-17 09:10:39 +0000367 conn = recv_from_to(sock, NULL, 0, MSG_PEEK,
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000368 &remote.u.sa, &local.u.sa, sa_len);
Denis Vlasenko64a15122007-04-04 10:16:15 +0000369 }
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000370 sig_block(SIGCHLD);
371 if (conn < 0) {
372 if (errno != EINTR)
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000373 bb_perror_msg(tcp ? "accept" : "recv");
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000374 goto again2;
375 }
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000376 xmove_fd(tcp ? conn : sock, 0);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000377
378 if (max_per_host) {
379 /* Drop connection immediately if cur_per_host > max_per_host
380 * (minimizing load under SYN flood) */
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000381 remote_addr = xmalloc_sockaddr2dotted_noport(&remote.u.sa);
382 cur_per_host = ipsvd_perhost_add(remote_addr, max_per_host, &hccp);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000383 if (cur_per_host > max_per_host) {
384 /* ipsvd_perhost_add detected that max is exceeded
385 * (and did not store ip in connection table) */
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000386 free(remote_addr);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000387 if (msg_per_host) {
388 /* don't block or test for errors */
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000389 send(0, msg_per_host, len_per_host, MSG_DONTWAIT);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000390 }
391 goto again1;
392 }
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000393 /* NB: remote_addr is not leaked, it is stored in conn table */
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000394 }
395
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000396 if (!tcp) {
397 /* Voodoo magic: making udp sockets each receive its own
Denis Vlasenko64a15122007-04-04 10:16:15 +0000398 * packets is not trivial, and I still not sure
399 * I do it 100% right.
400 * 1) we have to do it before fork()
401 * 2) order is important - is it right now? */
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000402
Denis Vlasenko4cf1d082008-03-12 23:13:50 +0000403 /* Open new non-connected UDP socket for further clients... */
404 sock = xsocket(lsa->u.sa.sa_family, SOCK_DGRAM, 0);
405 setsockopt_reuseaddr(sock);
406 /* Make plain write/send work for old socket by supplying default
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000407 * destination address. This also restricts incoming packets
408 * to ones coming from this remote IP. */
Bernhard Reutner-Fischer8c69afd2008-01-29 10:33:34 +0000409 xconnect(0, &remote.u.sa, sa_len);
Denis Vlasenko64a15122007-04-04 10:16:15 +0000410 /* hole? at this point we have no wildcard udp socket...
Denis Vlasenko79468792007-04-04 11:02:55 +0000411 * can this cause clients to get "port unreachable" icmp?
412 * Yup, time window is very small, but it exists (is it?) */
Denis Vlasenko4cf1d082008-03-12 23:13:50 +0000413 /* ..."open new socket", continued */
Bernhard Reutner-Fischer8c69afd2008-01-29 10:33:34 +0000414 xbind(sock, &lsa->u.sa, sa_len);
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000415 socket_want_pktinfo(sock);
Denis Vlasenko79468792007-04-04 11:02:55 +0000416
417 /* Doesn't work:
418 * we cannot replace fd #0 - we will lose pending packet
419 * which is already buffered for us! And we cannot use fd #1
420 * instead - it will "intercept" all following packets, but child
Denis Vlasenkof87f4952007-08-24 10:27:41 +0000421 * does not expect data coming *from fd #1*! */
Denis Vlasenko79468792007-04-04 11:02:55 +0000422#if 0
Bernhard Reutner-Fischer8c69afd2008-01-29 10:33:34 +0000423 /* Make it so that local addr is fixed to localp->u.sa
Denis Vlasenko79468792007-04-04 11:02:55 +0000424 * and we don't accidentally accept packets to other local IPs. */
425 /* NB: we possibly bind to the _very_ same_ address & port as the one
426 * already bound in parent! This seems to work in Linux.
427 * (otherwise we can move socket to fd #0 only if bind succeeds) */
428 close(0);
Denys Vlasenkoca183112011-04-07 17:52:20 +0200429 set_nport(&localp->u.sa, htons(local_port));
Bernhard Reutner-Fischer8c69afd2008-01-29 10:33:34 +0000430 xmove_fd(xsocket(localp->u.sa.sa_family, SOCK_DGRAM, 0), 0);
Denis Vlasenko79468792007-04-04 11:02:55 +0000431 setsockopt_reuseaddr(0); /* crucial */
Bernhard Reutner-Fischer8c69afd2008-01-29 10:33:34 +0000432 xbind(0, &localp->u.sa, localp->len);
Denis Vlasenko79468792007-04-04 11:02:55 +0000433#endif
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000434 }
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000435
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000436 pid = vfork();
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000437 if (pid == -1) {
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000438 bb_perror_msg("vfork");
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000439 goto again;
440 }
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000441
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000442 if (pid != 0) {
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000443 /* Parent */
Denis Vlasenko02fd6682007-04-03 23:23:10 +0000444 cnum++;
445 if (verbose)
446 connection_status();
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000447 if (hccp)
448 hccp->pid = pid;
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000449 /* clean up changes done by vforked child */
450 undo_xsetenv();
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000451 goto again;
452 }
453
454 /* Child: prepare env, log, and exec prog */
455
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000456 { /* vfork alert! every xmalloc in this block should be freed! */
457 char *local_hostname = local_hostname; /* for compiler */
458 char *local_addr = NULL;
459 char *free_me0 = NULL;
460 char *free_me1 = NULL;
461 char *free_me2 = NULL;
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000462
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200463 if (verbose || !(opts & OPT_E)) {
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000464 if (!max_per_host) /* remote_addr is not yet known */
465 free_me0 = remote_addr = xmalloc_sockaddr2dotted(&remote.u.sa);
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200466 if (opts & OPT_h) {
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000467 free_me1 = remote_hostname = xmalloc_sockaddr2host_noport(&remote.u.sa);
468 if (!remote_hostname) {
Denys Vlasenko6331cf02009-11-13 09:08:27 +0100469 bb_error_msg("can't look up hostname for %s", remote_addr);
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000470 remote_hostname = remote_addr;
471 }
472 }
473 /* Find out local IP peer connected to.
474 * Errors ignored (I'm not paranoid enough to imagine kernel
475 * which doesn't know local IP). */
476 if (tcp)
477 getsockname(0, &local.u.sa, &local.len);
478 /* else: for UDP it is done earlier by parent */
479 local_addr = xmalloc_sockaddr2dotted(&local.u.sa);
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200480 if (opts & OPT_h) {
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000481 local_hostname = preset_local_hostname;
482 if (!local_hostname) {
483 free_me2 = local_hostname = xmalloc_sockaddr2host_noport(&local.u.sa);
484 if (!local_hostname)
Denys Vlasenko6331cf02009-11-13 09:08:27 +0100485 bb_error_msg_and_die("can't look up hostname for %s", local_addr);
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000486 }
487 /* else: local_hostname is not NULL, but is NOT malloced! */
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000488 }
489 }
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000490 if (verbose) {
491 pid = getpid();
492 if (max_per_host) {
493 bb_error_msg("concurrency %s %u/%u",
494 remote_addr,
495 cur_per_host, max_per_host);
496 }
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200497 bb_error_msg((opts & OPT_h)
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000498 ? "start %u %s-%s (%s-%s)"
499 : "start %u %s-%s",
500 pid,
501 local_addr, remote_addr,
502 local_hostname, remote_hostname);
Denis Vlasenko64a15122007-04-04 10:16:15 +0000503 }
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000504
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200505 if (!(opts & OPT_E)) {
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000506 /* setup ucspi env */
507 const char *proto = tcp ? "TCP" : "UDP";
508
Jeremie Koenig2ea12d82010-05-27 15:46:25 +0200509#ifdef SO_ORIGINAL_DST
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000510 /* Extract "original" destination addr:port
511 * from Linux firewall. Useful when you redirect
512 * an outbond connection to local handler, and it needs
513 * to know where it originally tried to connect */
514 if (tcp && getsockopt(0, SOL_IP, SO_ORIGINAL_DST, &local.u.sa, &local.len) == 0) {
515 char *addr = xmalloc_sockaddr2dotted(&local.u.sa);
516 xsetenv_plain("TCPORIGDSTADDR", addr);
517 free(addr);
518 }
Jeremie Koenig2ea12d82010-05-27 15:46:25 +0200519#endif
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000520 xsetenv_plain("PROTO", proto);
521 xsetenv_proto(proto, "LOCALADDR", local_addr);
522 xsetenv_proto(proto, "REMOTEADDR", remote_addr);
Denys Vlasenkod6513cf2009-07-19 23:07:13 +0200523 if (opts & OPT_h) {
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000524 xsetenv_proto(proto, "LOCALHOST", local_hostname);
525 xsetenv_proto(proto, "REMOTEHOST", remote_hostname);
526 }
527 //compat? xsetenv_proto(proto, "REMOTEINFO", "");
528 /* additional */
529 if (cur_per_host > 0) /* can not be true for udp */
530 xsetenv_plain("TCPCONCURRENCY", utoa(cur_per_host));
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000531 }
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000532 free(local_addr);
533 free(free_me0);
534 free(free_me1);
535 free(free_me2);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000536 }
537
Denis Vlasenkoaefed942008-03-17 08:35:44 +0000538 xdup2(0, 1);
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000539
Denis Vlasenko3fa36e22008-11-09 00:15:11 +0000540 signal(SIGPIPE, SIG_DFL); /* this one was SIG_IGNed */
541 /* Non-ignored signals revert to SIG_DFL on exec anyway */
542 /*signal(SIGCHLD, SIG_DFL);*/
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000543 sig_unblock(SIGCHLD);
544
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000545#ifdef SSLSVD
Denis Vlasenko4cf1d082008-03-12 23:13:50 +0000546 strcpy(id, utoa(pid));
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000547 ssl_io(0, argv);
Denys Vlasenko41ddd9f2010-06-25 01:46:53 +0200548 bb_perror_msg_and_die("can't execute '%s'", argv[0]);
Pascal Bellard21e8e8d2010-07-04 00:57:03 +0200549#else
550 BB_EXECVP_or_die(argv);
551#endif
Denis Vlasenkob933ac12007-04-03 12:09:46 +0000552}
553
554/*
555tcpsvd [-hpEvv] [-c n] [-C n:msg] [-b n] [-u user] [-l name]
556 [-i dir|-x cdb] [ -t sec] host port prog
557
558tcpsvd creates a TCP/IP socket, binds it to the address host:port,
559and listens on the socket for incoming connections.
560
561On each incoming connection, tcpsvd conditionally runs a program,
562with standard input reading from the socket, and standard output
563writing to the socket, to handle this connection. tcpsvd keeps
564listening on the socket for new connections, and can handle
565multiple connections simultaneously.
566
567tcpsvd optionally checks for special instructions depending
568on the IP address or hostname of the client that initiated
569the connection, see ipsvd-instruct(5).
570
571host
572 host either is a hostname, or a dotted-decimal IP address,
573 or 0. If host is 0, tcpsvd accepts connections to any local
574 IP address.
575 * busybox accepts IPv6 addresses and host:port pairs too
576 In this case second parameter is ignored
577port
578 tcpsvd accepts connections to host:port. port may be a name
579 from /etc/services or a number.
580prog
581 prog consists of one or more arguments. For each connection,
582 tcpsvd normally runs prog, with file descriptor 0 reading from
583 the network, and file descriptor 1 writing to the network.
584 By default it also sets up TCP-related environment variables,
585 see tcp-environ(5)
586-i dir
587 read instructions for handling new connections from the instructions
588 directory dir. See ipsvd-instruct(5) for details.
589 * ignored by busyboxed version
590-x cdb
591 read instructions for handling new connections from the constant database
592 cdb. The constant database normally is created from an instructions
593 directory by running ipsvd-cdb(8).
594 * ignored by busyboxed version
595-t sec
596 timeout. This option only takes effect if the -i option is given.
597 While checking the instructions directory, check the time of last access
598 of the file that matches the clients address or hostname if any, discard
599 and remove the file if it wasn't accessed within the last sec seconds;
600 tcpsvd does not discard or remove a file if the user's write permission
601 is not set, for those files the timeout is disabled. Default is 0,
602 which means that the timeout is disabled.
603 * ignored by busyboxed version
604-l name
605 local hostname. Do not look up the local hostname in DNS, but use name
606 as hostname. This option must be set if tcpsvd listens on port 53
607 to avoid loops.
608-u user[:group]
609 drop permissions. Switch user ID to user's UID, and group ID to user's
610 primary GID after creating and binding to the socket. If user is followed
611 by a colon and a group name, the group ID is switched to the GID of group
612 instead. All supplementary groups are removed.
613-c n
614 concurrency. Handle up to n connections simultaneously. Default is 30.
615 If there are n connections active, tcpsvd defers acceptance of a new
616 connection until an active connection is closed.
617-C n[:msg]
618 per host concurrency. Allow only up to n connections from the same IP
619 address simultaneously. If there are n active connections from one IP
620 address, new incoming connections from this IP address are closed
621 immediately. If n is followed by :msg, the message msg is written
622 to the client if possible, before closing the connection. By default
623 msg is empty. See ipsvd-instruct(5) for supported escape sequences in msg.
624
625 For each accepted connection, the current per host concurrency is
626 available through the environment variable TCPCONCURRENCY. n and msg
627 can be overwritten by ipsvd(7) instructions, see ipsvd-instruct(5).
628 By default tcpsvd doesn't keep track of connections.
629-h
630 Look up the client's hostname in DNS.
631-p
632 paranoid. After looking up the client's hostname in DNS, look up the IP
633 addresses in DNS for that hostname, and forget about the hostname
634 if none of the addresses match the client's IP address. You should
635 set this option if you use hostname based instructions. The -p option
636 implies the -h option.
637 * ignored by busyboxed version
638-b n
639 backlog. Allow a backlog of approximately n TCP SYNs. On some systems n
640 is silently limited. Default is 20.
641-E
642 no special environment. Do not set up TCP-related environment variables.
643-v
644 verbose. Print verbose messsages to standard output.
645-vv
646 more verbose. Print more verbose messages to standard output.
647 * no difference between -v and -vv in busyboxed version
648*/