1 /* $OpenBSD: ypldap.c,v 1.16 2015/11/02 10:06:06 jmatthew Exp $ */ 2 3 /* 4 * Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 #include <sys/types.h> 20 #include <sys/param.h> 21 #include <sys/queue.h> 22 #include <sys/socket.h> 23 #include <sys/signal.h> 24 #include <sys/tree.h> 25 #include <sys/wait.h> 26 27 #include <netinet/in.h> 28 #include <arpa/inet.h> 29 30 #include <err.h> 31 #include <errno.h> 32 #include <event.h> 33 #include <unistd.h> 34 #include <pwd.h> 35 #include <stdio.h> 36 #include <stdlib.h> 37 #include <string.h> 38 #include <limits.h> 39 40 #include "ypldap.h" 41 42 enum ypldap_process_type ypldap_process; 43 44 __dead2 void usage(void); 45 int check_child(pid_t, const char *); 46 void main_sig_handler(int, short, void *); 47 void main_shutdown(void); 48 void main_dispatch_client(int, short, void *); 49 void main_configure_client(struct env *); 50 void main_init_timer(int, short, void *); 51 void main_start_update(struct env *); 52 void main_trash_update(struct env *); 53 void main_end_update(struct env *); 54 int main_create_user_groups(struct env *); 55 void purge_config(struct env *); 56 void reconfigure(struct env *); 57 58 int pipe_main2client[2]; 59 60 pid_t client_pid = 0; 61 char *conffile = YPLDAP_CONF_FILE; 62 int opts = 0; 63 64 void 65 usage(void) 66 { 67 extern const char *__progname; 68 69 fprintf(stderr, "usage: %s [-dnv] [-D macro=value] [-f file]\n", 70 __progname); 71 exit(1); 72 } 73 74 int 75 check_child(pid_t pid, const char *pname) 76 { 77 int status; 78 79 if (waitpid(pid, &status, WNOHANG) > 0) { 80 if (WIFEXITED(status)) { 81 log_warnx("check_child: lost child %s exited", pname); 82 return (1); 83 } 84 if (WIFSIGNALED(status)) { 85 log_warnx("check_child: lost child %s terminated; " 86 "signal %d", pname, WTERMSIG(status)); 87 return (1); 88 } 89 } 90 return (0); 91 } 92 93 /* ARGUSED */ 94 void 95 main_sig_handler(int sig, short event, void *p) 96 { 97 int die = 0; 98 99 switch (sig) { 100 case SIGTERM: 101 case SIGINT: 102 die = 1; 103 /* FALLTHROUGH */ 104 case SIGCHLD: 105 if (check_child(client_pid, "ldap client")) { 106 client_pid = 0; 107 die = 1; 108 } 109 if (die) 110 main_shutdown(); 111 break; 112 case SIGHUP: 113 /* reconfigure */ 114 break; 115 default: 116 fatalx("unexpected signal"); 117 } 118 } 119 120 void 121 main_shutdown(void) 122 { 123 _exit(0); 124 } 125 126 void 127 main_start_update(struct env *env) 128 { 129 env->update_trashed = 0; 130 131 log_debug("starting directory update"); 132 env->sc_user_line_len = 0; 133 env->sc_group_line_len = 0; 134 if ((env->sc_user_names_t = calloc(1, 135 sizeof(*env->sc_user_names_t))) == NULL || 136 (env->sc_group_names_t = calloc(1, 137 sizeof(*env->sc_group_names_t))) == NULL) 138 fatal(NULL); 139 RB_INIT(env->sc_user_names_t); 140 RB_INIT(env->sc_group_names_t); 141 } 142 143 /* 144 * XXX: Currently this function should only be called when updating is 145 * finished. A notification should be sent to ldapclient that it should stop 146 * sending new pwd/grp entries before it can be called from different places. 147 */ 148 void 149 main_trash_update(struct env *env) 150 { 151 struct userent *ue; 152 struct groupent *ge; 153 154 env->update_trashed = 1; 155 156 while ((ue = RB_ROOT(env->sc_user_names_t)) != NULL) { 157 RB_REMOVE(user_name_tree, 158 env->sc_user_names_t, ue); 159 free(ue->ue_line); 160 free(ue->ue_netid_line); 161 free(ue); 162 } 163 free(env->sc_user_names_t); 164 env->sc_user_names_t = NULL; 165 while ((ge = RB_ROOT(env->sc_group_names_t)) 166 != NULL) { 167 RB_REMOVE(group_name_tree, 168 env->sc_group_names_t, ge); 169 free(ge->ge_line); 170 free(ge); 171 } 172 free(env->sc_group_names_t); 173 env->sc_group_names_t = NULL; 174 } 175 176 int 177 main_create_user_groups(struct env *env) 178 { 179 struct userent *ue; 180 struct userent ukey; 181 struct groupent *ge; 182 gid_t pw_gid; 183 char *bp, *cp; 184 char *p; 185 const char *errstr = NULL; 186 size_t len; 187 188 RB_FOREACH(ue, user_name_tree, env->sc_user_names_t) { 189 bp = cp = ue->ue_line; 190 191 /* name */ 192 bp += strlen(bp) + 1; 193 194 /* password */ 195 bp += strcspn(bp, ":") + 1; 196 197 /* uid */ 198 bp += strcspn(bp, ":") + 1; 199 200 /* gid */ 201 bp[strcspn(bp, ":")] = '\0'; 202 203 pw_gid = (gid_t)strtonum(bp, 0, GID_MAX, &errstr); 204 if (errstr) { 205 log_warnx("main: failed to parse gid for uid: %d\n", ue->ue_uid); 206 return (-1); 207 } 208 209 /* bring gid column back to its proper state */ 210 bp[strlen(bp)] = ':'; 211 212 if ((ue->ue_netid_line = calloc(1, LINE_WIDTH)) == NULL) { 213 return (-1); 214 } 215 216 if (snprintf(ue->ue_netid_line, LINE_WIDTH-1, "%d:%d", ue->ue_uid, pw_gid) >= LINE_WIDTH) { 217 218 return (-1); 219 } 220 221 ue->ue_gid = pw_gid; 222 } 223 224 RB_FOREACH(ge, group_name_tree, env->sc_group_names_t) { 225 bp = cp = ge->ge_line; 226 227 /* name */ 228 bp += strlen(bp) + 1; 229 230 /* password */ 231 bp += strcspn(bp, ":") + 1; 232 233 /* gid */ 234 bp += strcspn(bp, ":") + 1; 235 236 cp = bp; 237 if (*bp == '\0') 238 continue; 239 bp = cp; 240 for (;;) { 241 if (!(cp = strsep(&bp, ","))) 242 break; 243 ukey.ue_line = cp; 244 if ((ue = RB_FIND(user_name_tree, env->sc_user_names_t, 245 &ukey)) == NULL) { 246 /* User not found */ 247 log_warnx("main: unknown user %s in group %s\n", 248 ukey.ue_line, ge->ge_line); 249 if (bp != NULL) 250 *(bp-1) = ','; 251 continue; 252 } 253 if (bp != NULL) 254 *(bp-1) = ','; 255 256 /* Make sure the new group doesn't equal to the main gid */ 257 if (ge->ge_gid == ue->ue_gid) 258 continue; 259 260 len = strlen(ue->ue_netid_line); 261 p = ue->ue_netid_line + len; 262 263 if ((snprintf(p, LINE_WIDTH-len-1, ",%d", 264 ge->ge_gid)) >= (int)(LINE_WIDTH-len)) { 265 return (-1); 266 } 267 } 268 } 269 270 return (0); 271 } 272 273 void 274 main_end_update(struct env *env) 275 { 276 struct userent *ue; 277 struct groupent *ge; 278 279 if (env->update_trashed) 280 return; 281 282 log_debug("updates are over, cleaning up trees now"); 283 284 if (main_create_user_groups(env) == -1) { 285 main_trash_update(env); 286 return; 287 } 288 289 if (env->sc_user_names == NULL) { 290 env->sc_user_names = env->sc_user_names_t; 291 env->sc_user_lines = NULL; 292 env->sc_user_names_t = NULL; 293 294 env->sc_group_names = env->sc_group_names_t; 295 env->sc_group_lines = NULL; 296 env->sc_group_names_t = NULL; 297 298 flatten_entries(env); 299 goto make_uids; 300 } 301 302 /* 303 * clean previous tree. 304 */ 305 while ((ue = RB_ROOT(env->sc_user_names)) != NULL) { 306 RB_REMOVE(user_name_tree, env->sc_user_names, 307 ue); 308 free(ue->ue_netid_line); 309 free(ue); 310 } 311 free(env->sc_user_names); 312 free(env->sc_user_lines); 313 314 env->sc_user_names = env->sc_user_names_t; 315 env->sc_user_lines = NULL; 316 env->sc_user_names_t = NULL; 317 318 while ((ge = RB_ROOT(env->sc_group_names)) != NULL) { 319 RB_REMOVE(group_name_tree, 320 env->sc_group_names, ge); 321 free(ge); 322 } 323 free(env->sc_group_names); 324 free(env->sc_group_lines); 325 326 env->sc_group_names = env->sc_group_names_t; 327 env->sc_group_lines = NULL; 328 env->sc_group_names_t = NULL; 329 330 331 flatten_entries(env); 332 333 /* 334 * trees are flat now. build up uid, gid and netid trees. 335 */ 336 337 make_uids: 338 RB_INIT(&env->sc_user_uids); 339 RB_INIT(&env->sc_group_gids); 340 RB_FOREACH(ue, user_name_tree, env->sc_user_names) 341 RB_INSERT(user_uid_tree, 342 &env->sc_user_uids, ue); 343 RB_FOREACH(ge, group_name_tree, env->sc_group_names) 344 RB_INSERT(group_gid_tree, 345 &env->sc_group_gids, ge); 346 347 } 348 349 void 350 main_dispatch_client(int fd, short events, void *p) 351 { 352 int n; 353 int shut = 0; 354 struct env *env = p; 355 struct imsgev *iev = env->sc_iev; 356 struct imsgbuf *ibuf = &iev->ibuf; 357 struct idm_req ir; 358 struct imsg imsg; 359 360 if ((events & (EV_READ | EV_WRITE)) == 0) 361 fatalx("unknown event"); 362 363 if (events & EV_READ) { 364 if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN) 365 fatal("imsg_read error"); 366 if (n == 0) 367 shut = 1; 368 } 369 if (events & EV_WRITE) { 370 if ((n = msgbuf_write(&ibuf->w)) == -1 && errno != EAGAIN) 371 fatal("msgbuf_write"); 372 if (n == 0) 373 shut = 1; 374 goto done; 375 } 376 377 for (;;) { 378 if ((n = imsg_get(ibuf, &imsg)) == -1) 379 fatal("main_dispatch_client: imsg_get error"); 380 if (n == 0) 381 break; 382 383 switch (imsg.hdr.type) { 384 case IMSG_START_UPDATE: 385 main_start_update(env); 386 break; 387 case IMSG_PW_ENTRY: { 388 struct userent *ue; 389 size_t len; 390 391 if (env->update_trashed) 392 break; 393 394 (void)memcpy(&ir, imsg.data, sizeof(ir)); 395 if ((ue = calloc(1, sizeof(*ue))) == NULL || 396 (ue->ue_line = strdup(ir.ir_line)) == NULL) { 397 /* 398 * should cancel tree update instead. 399 */ 400 fatal("out of memory"); 401 } 402 ue->ue_uid = ir.ir_key.ik_uid; 403 len = strlen(ue->ue_line) + 1; 404 ue->ue_line[strcspn(ue->ue_line, ":")] = '\0'; 405 if (RB_INSERT(user_name_tree, env->sc_user_names_t, 406 ue) != NULL) { /* dup */ 407 free(ue->ue_line); 408 free(ue); 409 } else 410 env->sc_user_line_len += len; 411 break; 412 } 413 case IMSG_GRP_ENTRY: { 414 struct groupent *ge; 415 size_t len; 416 417 if (env->update_trashed) 418 break; 419 420 (void)memcpy(&ir, imsg.data, sizeof(ir)); 421 if ((ge = calloc(1, sizeof(*ge))) == NULL || 422 (ge->ge_line = strdup(ir.ir_line)) == NULL) { 423 /* 424 * should cancel tree update instead. 425 */ 426 fatal("out of memory"); 427 } 428 ge->ge_gid = ir.ir_key.ik_gid; 429 len = strlen(ge->ge_line) + 1; 430 ge->ge_line[strcspn(ge->ge_line, ":")] = '\0'; 431 if (RB_INSERT(group_name_tree, env->sc_group_names_t, 432 ge) != NULL) { /* dup */ 433 free(ge->ge_line); 434 free(ge); 435 } else 436 env->sc_group_line_len += len; 437 break; 438 } 439 case IMSG_TRASH_UPDATE: 440 main_trash_update(env); 441 break; 442 case IMSG_END_UPDATE: { 443 main_end_update(env); 444 break; 445 } 446 default: 447 log_debug("main_dispatch_client: unexpected imsg %d", 448 imsg.hdr.type); 449 break; 450 } 451 imsg_free(&imsg); 452 } 453 454 done: 455 if (!shut) 456 imsg_event_add(iev); 457 else { 458 log_debug("king bula sez: ran into dead pipe"); 459 event_del(&iev->ev); 460 event_loopexit(NULL); 461 } 462 } 463 464 void 465 main_configure_client(struct env *env) 466 { 467 struct idm *idm; 468 struct imsgev *iev = env->sc_iev; 469 470 imsg_compose_event(iev, IMSG_CONF_START, 0, 0, -1, env, sizeof(*env)); 471 TAILQ_FOREACH(idm, &env->sc_idms, idm_entry) { 472 imsg_compose_event(iev, IMSG_CONF_IDM, 0, 0, -1, 473 idm, sizeof(*idm)); 474 } 475 imsg_compose_event(iev, IMSG_CONF_END, 0, 0, -1, NULL, 0); 476 } 477 478 void 479 main_init_timer(int fd, short event, void *p) 480 { 481 struct env *env = p; 482 483 main_configure_client(env); 484 } 485 486 void 487 purge_config(struct env *env) 488 { 489 struct idm *idm; 490 491 while ((idm = TAILQ_FIRST(&env->sc_idms)) != NULL) { 492 TAILQ_REMOVE(&env->sc_idms, idm, idm_entry); 493 free(idm); 494 } 495 } 496 497 int 498 main(int argc, char *argv[]) 499 { 500 int c; 501 int debug; 502 struct passwd *pw; 503 struct env env; 504 struct event ev_sigint; 505 struct event ev_sigterm; 506 struct event ev_sigchld; 507 struct event ev_sighup; 508 struct event ev_timer; 509 struct timeval tv; 510 511 debug = 0; 512 ypldap_process = PROC_MAIN; 513 514 log_init(1); 515 516 while ((c = getopt(argc, argv, "dD:nf:v")) != -1) { 517 switch (c) { 518 case 'd': 519 debug = 2; 520 break; 521 case 'D': 522 if (cmdline_symset(optarg) < 0) 523 log_warnx("could not parse macro definition %s", 524 optarg); 525 break; 526 case 'n': 527 debug = 2; 528 opts |= YPLDAP_OPT_NOACTION; 529 break; 530 case 'f': 531 conffile = optarg; 532 break; 533 case 'v': 534 opts |= YPLDAP_OPT_VERBOSE; 535 break; 536 default: 537 usage(); 538 } 539 } 540 541 argc -= optind; 542 argv += optind; 543 544 if (argc) 545 usage(); 546 547 RB_INIT(&env.sc_user_uids); 548 RB_INIT(&env.sc_group_gids); 549 550 if (parse_config(&env, conffile, opts)) 551 exit(1); 552 if (opts & YPLDAP_OPT_NOACTION) { 553 fprintf(stderr, "configuration OK\n"); 554 exit(0); 555 } 556 557 if (geteuid()) 558 errx(1, "need root privileges"); 559 560 log_init(debug); 561 562 if (!debug) { 563 if (daemon(1, 0) == -1) 564 err(1, "failed to daemonize"); 565 } 566 567 log_info("startup%s", (debug > 1)?" [debug mode]":""); 568 569 if (socketpair(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK, PF_UNSPEC, 570 pipe_main2client) == -1) 571 fatal("socketpair"); 572 573 client_pid = ldapclient(pipe_main2client); 574 575 setproctitle("parent"); 576 event_init(); 577 578 signal_set(&ev_sigint, SIGINT, main_sig_handler, &env); 579 signal_set(&ev_sigterm, SIGTERM, main_sig_handler, &env); 580 signal_set(&ev_sighup, SIGHUP, main_sig_handler, &env); 581 signal_set(&ev_sigchld, SIGCHLD, main_sig_handler, &env); 582 signal_add(&ev_sigint, NULL); 583 signal_add(&ev_sigterm, NULL); 584 signal_add(&ev_sighup, NULL); 585 signal_add(&ev_sigchld, NULL); 586 587 close(pipe_main2client[1]); 588 if ((env.sc_iev = calloc(1, sizeof(*env.sc_iev))) == NULL) 589 fatal(NULL); 590 imsg_init(&env.sc_iev->ibuf, pipe_main2client[0]); 591 env.sc_iev->handler = main_dispatch_client; 592 593 env.sc_iev->events = EV_READ; 594 env.sc_iev->data = &env; 595 event_set(&env.sc_iev->ev, env.sc_iev->ibuf.fd, env.sc_iev->events, 596 env.sc_iev->handler, &env); 597 event_add(&env.sc_iev->ev, NULL); 598 599 yp_init(&env); 600 601 if ((pw = getpwnam(YPLDAP_USER)) == NULL) 602 fatal("getpwnam"); 603 604 #ifndef DEBUG 605 if (setgroups(1, &pw->pw_gid) || 606 setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) || 607 setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid)) 608 fatal("cannot drop privileges"); 609 #else 610 #warning disabling privilege revocation in debug mode 611 #endif 612 613 memset(&tv, 0, sizeof(tv)); 614 evtimer_set(&ev_timer, main_init_timer, &env); 615 evtimer_add(&ev_timer, &tv); 616 617 yp_enable_events(); 618 event_dispatch(); 619 main_shutdown(); 620 621 return (0); 622 } 623 624 void 625 imsg_event_add(struct imsgev *iev) 626 { 627 if (iev->handler == NULL) { 628 imsg_flush(&iev->ibuf); 629 return; 630 } 631 632 iev->events = EV_READ; 633 if (iev->ibuf.w.queued) 634 iev->events |= EV_WRITE; 635 636 event_del(&iev->ev); 637 event_set(&iev->ev, iev->ibuf.fd, iev->events, iev->handler, iev->data); 638 event_add(&iev->ev, NULL); 639 } 640 641 int 642 imsg_compose_event(struct imsgev *iev, u_int16_t type, u_int32_t peerid, 643 pid_t pid, int fd, void *data, u_int16_t datalen) 644 { 645 int ret; 646 647 if ((ret = imsg_compose(&iev->ibuf, type, peerid, 648 pid, fd, data, datalen)) != -1) 649 imsg_event_add(iev); 650 return (ret); 651 } 652