6N/A

6N/A#include "config.h"

15N/A

6N/A#include <stdio.h>

6N/A#include <unistd.h>

6N/A#include <fcntl.h>

6N/A#include <sys/types.h>

6N/A#include <sys/stat.h>

6N/A#include <sys/socket.h>

6N/A#include <sys/un.h>

6N/A#include <string.h>

6N/A#include <sys/time.h>

6N/A#include <errno.h>

6N/A#include <popt.h>

6N/A#include "util/util.h"

6N/A#include "db/sysdb.h"

6N/A#include "confdb/confdb.h"

15N/A#include "dbus/dbus.h"

15N/A#include "sbus/sssd_dbus.h"

15N/A#include "responder/common/responder.h"

15N/A#include "responder/common/responder_packet.h"

15N/A#include "providers/data_provider.h"

15N/A#include "monitor/monitor_interfaces.h"

15N/A#include "sbus/sbus_client.h"

15N/A

15N/Astatic errno_t set_nonblocking(int fd)

15N/A{

6N/A int v;

6N/A int ferr;

6N/A errno_t error;

6N/A

6N/A /* Get the current flags for this file descriptor */

6N/A v = fcntl(fd, F_GETFL, 0);

6N/A

6N/A errno = 0;

6N/A /* Set the non-blocking flag on this fd */

6N/A ferr = fcntl(fd, F_SETFL, v | O_NONBLOCK);

6N/A if (ferr < 0) {

6N/A error = errno;

6N/A DEBUG(0, ("Unable to set fd non-blocking: [%d][%s]\n",

6N/A error, strerror(error)));

6N/A return error;

6N/A }

6N/A return EOK;

6N/A}

6N/A

6N/Astatic errno_t set_close_on_exec(int fd)

6N/A{

6N/A int v;

6N/A int ferr;

6N/A errno_t error;

6N/A

6N/A /* Get the current flags for this file descriptor */

15N/A v = fcntl(fd, F_GETFD, 0);

6N/A

6N/A errno = 0;

6N/A /* Set the close-on-exec flags on this fd */

26N/A ferr = fcntl(fd, F_SETFD, v | FD_CLOEXEC);

6N/A if (ferr < 0) {

6N/A error = errno;

6N/A DEBUG(0, ("Unable to set fd close-on-exec: [%d][%s]\n",

6N/A error, strerror(error)));

6N/A return error;

6N/A }

6N/A return EOK;

6N/A}

6N/A

6N/Astatic int client_destructor(struct cli_ctx *ctx)

15N/A{

15N/A errno_t ret;

15N/A

15N/A if ((ctx->cfd > 0) && close(ctx->cfd) < 0) {

15N/A ret = errno;

15N/A DEBUG(SSSDBG_CRIT_FAILURE,

15N/A ("Failed to close fd [%d]: [%s]\n",

15N/A ctx->cfd, strerror(ret)));

15N/A }

15N/A

15N/A DEBUG(SSSDBG_TRACE_INTERNAL,

15N/A ("Terminated client [%p][%d]\n",

15N/A ctx, ctx->cfd));

15N/A return 0;

15N/A}

15N/A

15N/Astatic errno_t get_client_cred(struct cli_ctx *cctx)

15N/A{

15N/A#ifdef HAVE_UCRED

15N/A int ret;

15N/A struct ucred client_cred;

15N/A socklen_t client_cred_len = sizeof(client_cred);

15N/A

15N/A cctx->client_euid = -1;

15N/A cctx->client_egid = -1;

15N/A cctx->client_pid = -1;

15N/A

15N/A ret = getsockopt(cctx->cfd, SOL_SOCKET, SO_PEERCRED, &client_cred,

15N/A &client_cred_len);

15N/A if (ret != EOK) {

15N/A ret = errno;

15N/A DEBUG(1, ("getsock failed [%d][%s].\n", ret, strerror(ret)));

15N/A return ret;

15N/A }

15N/A if (client_cred_len != sizeof(struct ucred)) {

15N/A DEBUG(1, ("getsockopt returned unexpected message size.\n"));

6N/A return ENOMSG;

6N/A }

6N/A

6N/A cctx->client_euid = client_cred.uid;

6N/A cctx->client_egid = client_cred.gid;

6N/A cctx->client_pid = client_cred.pid;

6N/A

6N/A DEBUG(9, ("Client creds: euid[%d] egid[%d] pid[%d].\n",

6N/A cctx->client_euid, cctx->client_egid, cctx->client_pid));

6N/A#endif

6N/A

6N/A return EOK;

6N/A}

6N/A

6N/Astatic void client_send(struct cli_ctx *cctx)

6N/A{

6N/A int ret;

6N/A

6N/A ret = sss_packet_send(cctx->creq->out, cctx->cfd);

6N/A if (ret == EAGAIN) {

6N/A /* not all data was sent, loop again */

6N/A return;

6N/A }

6N/A if (ret != EOK) {

6N/A DEBUG(0, ("Failed to send data, aborting client!\n"));

6N/A talloc_free(cctx);

6N/A return;

6N/A }

6N/A

6N/A /* ok all sent */

6N/A TEVENT_FD_NOT_WRITEABLE(cctx->cfde);

6N/A TEVENT_FD_READABLE(cctx->cfde);

6N/A talloc_free(cctx->creq);

6N/A cctx->creq = NULL;

6N/A return;

6N/A}

32N/A

32N/Astatic void client_recv(struct cli_ctx *cctx)

32N/A{

32N/A int ret;

32N/A

32N/A if (!cctx->creq) {

32N/A cctx->creq = talloc_zero(cctx, struct cli_request);

32N/A if (!cctx->creq) {

32N/A DEBUG(0, ("Failed to alloc request, aborting client!\n"));

32N/A talloc_free(cctx);

32N/A return;

32N/A }

32N/A }

32N/A

32N/A if (!cctx->creq->in) {

32N/A ret = sss_packet_new(cctx->creq, SSS_PACKET_MAX_RECV_SIZE,

32N/A 0, &cctx->creq->in);

32N/A if (ret != EOK) {

32N/A DEBUG(0, ("Failed to alloc request, aborting client!\n"));

32N/A talloc_free(cctx);

32N/A return;

32N/A }

32N/A }

32N/A

32N/A ret = sss_packet_recv(cctx->creq->in, cctx->cfd);

32N/A switch (ret) {

32N/A case EOK:

32N/A /* do not read anymore */

32N/A TEVENT_FD_NOT_READABLE(cctx->cfde);

32N/A /* execute command */

32N/A ret = sss_cmd_execute(cctx, cctx->rctx->sss_cmds);

32N/A if (ret != EOK) {

32N/A DEBUG(0, ("Failed to execute request, aborting client!\n"));

32N/A talloc_free(cctx);

32N/A }

6N/A /* past this point cctx can be freed at any time by callbacks

6N/A return;

6N/A

6N/A case EAGAIN:

6N/A /* need to read still some data, loop again */

6N/A break;

6N/A

6N/A case EINVAL:

6N/A DEBUG(6, ("Invalid data from client, closing connection!\n"));

6N/A talloc_free(cctx);

6N/A break;

6N/A

11N/A case ENODATA:

11N/A DEBUG(5, ("Client disconnected!\n"));

11N/A talloc_free(cctx);

11N/A break;

11N/A

11N/A default:

6N/A DEBUG(6, ("Failed to read request, aborting client!\n"));

6N/A talloc_free(cctx);

11N/A }

11N/A

11N/A return;

11N/A}

6N/A

6N/Astatic void client_fd_handler(struct tevent_context *ev,

6N/A struct tevent_fd *fde,

6N/A uint16_t flags, void *ptr)

6N/A{

6N/A struct cli_ctx *cctx = talloc_get_type(ptr, struct cli_ctx);

6N/A

6N/A if (flags & TEVENT_FD_READ) {

6N/A client_recv(cctx);

6N/A return;

6N/A }

11N/A if (flags & TEVENT_FD_WRITE) {

11N/A client_send(cctx);

11N/A return;

11N/A }

11N/A}

11N/A

11N/Astruct accept_fd_ctx {

11N/A struct resp_ctx *rctx;

11N/A bool is_private;

11N/A};

6N/A

6N/Astatic void accept_fd_handler(struct tevent_context *ev,

6N/A struct tevent_fd *fde,

6N/A uint16_t flags, void *ptr)

6N/A{

6N/A /* accept and attach new event handler */

6N/A struct accept_fd_ctx *accept_ctx =

6N/A talloc_get_type(ptr, struct accept_fd_ctx);

6N/A struct resp_ctx *rctx = accept_ctx->rctx;

6N/A struct cli_ctx *cctx;

6N/A socklen_t len;

6N/A struct stat stat_buf;

6N/A int ret;

11N/A int fd = accept_ctx->is_private ? rctx->priv_lfd : rctx->lfd;

11N/A int client_fd;

11N/A

11N/A if (accept_ctx->is_private) {

11N/A ret = stat(rctx->priv_sock_name, &stat_buf);

11N/A if (ret == -1) {

11N/A DEBUG(1, ("stat on privileged pipe failed: [%d][%s].\n", errno,

11N/A strerror(errno)));

11N/A return;

11N/A }

6N/A

6N/A if ( ! (stat_buf.st_uid == 0 && stat_buf.st_gid == 0 &&

(stat_buf.st_mode&(S_IFSOCK|S_IRUSR|S_IWUSR)) == stat_buf.st_mode)) {

DEBUG(1, ("privileged pipe has an illegal status.\n"));

/* TODO: what is the best response to this condition? Terminate? */

return;

}

}

cctx = talloc_zero(rctx, struct cli_ctx);

if (!cctx) {

struct sockaddr_un addr;

DEBUG(0, ("Out of memory trying to setup client context%s!\n",

accept_ctx->is_private ? " on privileged pipe": ""));

/* accept and close to signal the client we have a problem */

memset(&addr, 0, sizeof(addr));

len = sizeof(addr);

client_fd = accept(fd, (struct sockaddr *)&addr, &len);

if (client_fd == -1) {

return;

}

close(client_fd);

return;

}

len = sizeof(cctx->addr);

cctx->cfd = accept(fd, (struct sockaddr *)&cctx->addr, &len);

if (cctx->cfd == -1) {

DEBUG(1, ("Accept failed [%s]\n", strerror(errno)));

talloc_free(cctx);

return;

}

cctx->priv = accept_ctx->is_private;

ret = get_client_cred(cctx);

if (ret != EOK) {

DEBUG(2, ("get_client_cred failed, "

"client cred may not be available.\n"));

}

cctx->cfde = tevent_add_fd(ev, cctx, cctx->cfd,

TEVENT_FD_READ, client_fd_handler, cctx);

if (!cctx->cfde) {

close(cctx->cfd);

talloc_free(cctx);

DEBUG(2, ("Failed to queue client handler%\n",

accept_ctx->is_private ? " on privileged pipe" : ""));

}

cctx->ev = ev;

cctx->rctx = rctx;

talloc_set_destructor(cctx, client_destructor);

DEBUG(4, ("Client connected%s!\n",

accept_ctx->is_private ? " to privileged pipe" : ""));

return;

}

static int sss_dp_init(struct resp_ctx *rctx,

struct sbus_interface *intf,

const char *cli_name,

struct sss_domain_info *domain)

{

struct be_conn *be_conn;

int ret;

be_conn = talloc_zero(rctx, struct be_conn);

if (!be_conn) return ENOMEM;

be_conn->cli_name = cli_name;

be_conn->domain = domain;

be_conn->intf = intf;

be_conn->rctx = rctx;

/* Set up SBUS connection to the monitor */

ret = dp_get_sbus_address(be_conn, &be_conn->sbus_address, domain->name);

if (ret != EOK) {

DEBUG(0, ("Could not locate DP address.\n"));

return ret;

}

ret = sbus_client_init(rctx, rctx->ev,

be_conn->sbus_address,

intf, &be_conn->conn,

NULL, NULL);

if (ret != EOK) {

DEBUG(0, ("Failed to connect to monitor services.\n"));

return ret;

}

DLIST_ADD_END(rctx->be_conns, be_conn, struct be_conn *);

/* Identify ourselves to the DP */

ret = dp_common_send_id(be_conn->conn,

DATA_PROVIDER_VERSION,

cli_name);

if (ret != EOK) {

DEBUG(0, ("Failed to identify to the DP!\n"));

return ret;

}

return EOK;

}

static int set_unix_socket(struct resp_ctx *rctx)

{

struct sockaddr_un addr;

errno_t ret;

struct accept_fd_ctx *accept_ctx;

#if 0

char *default_pipe;

int ret;

default_pipe = talloc_asprintf(rctx, "%s/%s", PIPE_PATH,

rctx->sss_pipe_name);

if (!default_pipe) {

return ENOMEM;

}

ret = confdb_get_string(rctx->cdb, rctx,

rctx->confdb_socket_path, "unixSocket",

default_pipe, &rctx->sock_name);

if (ret != EOK) {

talloc_free(default_pipe);

return ret;

}

talloc_free(default_pipe);

default_pipe = talloc_asprintf(rctx, "%s/private/%s", PIPE_PATH,

rctx->sss_pipe_name);

if (!default_pipe) {

return ENOMEM;

}

ret = confdb_get_string(rctx->cdb, rctx,

rctx->confdb_socket_path, "privUnixSocket",

default_pipe, &rctx->priv_sock_name);

if (ret != EOK) {

talloc_free(default_pipe);

return ret;

}

talloc_free(default_pipe);

#endif

if (rctx->sock_name != NULL ) {

rctx->lfd = socket(AF_UNIX, SOCK_STREAM, 0);

if (rctx->lfd == -1) {

return EIO;

}

/* Set the umask so that permissions are set right on the socket.

umask(0111);

ret = set_nonblocking(rctx->lfd);

if (ret != EOK) {

goto failed;

}

ret = set_close_on_exec(rctx->lfd);

if (ret != EOK) {

goto failed;

}

memset(&addr, 0, sizeof(addr));

addr.sun_family = AF_UNIX;

strncpy(addr.sun_path, rctx->sock_name, sizeof(addr.sun_path)-1);

addr.sun_path[sizeof(addr.sun_path)-1] = '\0';

/* make sure we have no old sockets around */

unlink(rctx->sock_name);

if (bind(rctx->lfd, (struct sockaddr *)&addr, sizeof(addr)) == -1) {

DEBUG(0,("Unable to bind on socket '%s'\n", rctx->sock_name));

goto failed;

}

if (listen(rctx->lfd, 10) != 0) {

DEBUG(0,("Unable to listen on socket '%s'\n", rctx->sock_name));

goto failed;

}

accept_ctx = talloc_zero(rctx, struct accept_fd_ctx);

if(!accept_ctx) goto failed;

accept_ctx->rctx = rctx;

accept_ctx->is_private = false;

rctx->lfde = tevent_add_fd(rctx->ev, rctx, rctx->lfd,

TEVENT_FD_READ, accept_fd_handler,

accept_ctx);

if (!rctx->lfde) {

DEBUG(0, ("Failed to queue handler on pipe\n"));

goto failed;

}

}

if (rctx->priv_sock_name != NULL ) {

/* create privileged pipe */

rctx->priv_lfd = socket(AF_UNIX, SOCK_STREAM, 0);

if (rctx->priv_lfd == -1) {

close(rctx->lfd);

return EIO;

}

umask(0177);

ret = set_nonblocking(rctx->priv_lfd);

if (ret != EOK) {

goto failed;

}

ret = set_close_on_exec(rctx->priv_lfd);

if (ret != EOK) {

goto failed;

}

memset(&addr, 0, sizeof(addr));

addr.sun_family = AF_UNIX;

strncpy(addr.sun_path, rctx->priv_sock_name, sizeof(addr.sun_path)-1);

addr.sun_path[sizeof(addr.sun_path)-1] = '\0';

unlink(rctx->priv_sock_name);

if (bind(rctx->priv_lfd, (struct sockaddr *)&addr, sizeof(addr)) == -1) {

DEBUG(0,("Unable to bind on socket '%s'\n", rctx->priv_sock_name));

goto failed;

}

if (listen(rctx->priv_lfd, 10) != 0) {

DEBUG(0,("Unable to listen on socket '%s'\n", rctx->priv_sock_name));

goto failed;

}

accept_ctx = talloc_zero(rctx, struct accept_fd_ctx);

if(!accept_ctx) goto failed;

accept_ctx->rctx = rctx;

accept_ctx->is_private = true;

rctx->priv_lfde = tevent_add_fd(rctx->ev, rctx, rctx->priv_lfd,

TEVENT_FD_READ, accept_fd_handler,

accept_ctx);

if (!rctx->priv_lfde) {

DEBUG(0, ("Failed to queue handler on privileged pipe\n"));

goto failed;

}

}

/* we want default permissions on created files to be very strict,

umask(0177);

return EOK;

failed:

/* we want default permissions on created files to be very strict,

umask(0177);

close(rctx->lfd);

close(rctx->priv_lfd);

return EIO;

}

int sss_process_init(TALLOC_CTX *mem_ctx,

struct tevent_context *ev,

struct confdb_ctx *cdb,

struct sss_cmd_table sss_cmds[],

const char *sss_pipe_name,

const char *sss_priv_pipe_name,

const char *confdb_service_path,

const char *svc_name,

uint16_t svc_version,

struct sbus_interface *monitor_intf,

const char *cli_name,

struct sbus_interface *dp_intf,

struct resp_ctx **responder_ctx)

{

struct resp_ctx *rctx;

struct sss_domain_info *dom;

int ret;

rctx = talloc_zero(mem_ctx, struct resp_ctx);

if (!rctx) {

DEBUG(0, ("fatal error initializing resp_ctx\n"));

return ENOMEM;

}

rctx->ev = ev;

rctx->cdb = cdb;

rctx->sss_cmds = sss_cmds;

rctx->sock_name = sss_pipe_name;

rctx->priv_sock_name = sss_priv_pipe_name;

rctx->confdb_service_path = confdb_service_path;

ret = confdb_get_int(rctx->cdb, rctx->confdb_service_path,

CONFDB_RESPONDER_GET_DOMAINS_TIMEOUT,

GET_DOMAINS_DEFAULT_TIMEOUT, &rctx->domains_timeout);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE,

("Cannnot get the default domain timeout [%d]: %s\n",

ret, strerror(ret)));

return ret;

}

if (rctx->domains_timeout < 0) {

DEBUG(SSSDBG_CONF_SETTINGS, ("timeout can't be set to negative value, setting default\n"));

rctx->domains_timeout = GET_DOMAINS_DEFAULT_TIMEOUT;

}

ret = confdb_get_domains(rctx->cdb, &rctx->domains);

if (ret != EOK) {

DEBUG(0, ("fatal error setting up domain map\n"));

return ret;

}

ret = sss_monitor_init(rctx, rctx->ev, monitor_intf,

svc_name, svc_version, rctx,

&rctx->mon_conn);

if (ret != EOK) {

DEBUG(0, ("fatal error setting up message bus\n"));

return ret;

}

for (dom = rctx->domains; dom; dom = dom->next) {

/* skip local domain, it doesn't have a backend */

if (strcasecmp(dom->provider, "local") == 0) {

continue;

}

ret = sss_names_init(rctx->cdb, rctx->cdb, dom->name, &dom->names);

if (ret != EOK) {

DEBUG(SSSDBG_FATAL_FAILURE,

("fatal error initializing regex data for domain: %s\n",

dom->name));

return ret;

}

ret = sss_dp_init(rctx, dp_intf, cli_name, dom);

if (ret != EOK) {

DEBUG(0, ("fatal error setting up backend connector\n"));

return ret;

}

}

ret = sysdb_init(rctx, cdb, NULL, false, &rctx->db_list);

if (ret != EOK) {

DEBUG(0, ("fatal error initializing resp_ctx\n"));

return ret;

}

/* after all initializations we are ready to listen on our socket */

ret = set_unix_socket(rctx);

if (ret != EOK) {

DEBUG(0, ("fatal error initializing socket\n"));

return ret;

}

/* Create DP request table */

ret = sss_hash_create(rctx, 30, &rctx->dp_request_table);

if (ret != EOK) {

DEBUG(SSSDBG_FATAL_FAILURE,

("Could not create hash table for the request queue\n"));

return ret;

}

DEBUG(1, ("Responder Initialization complete\n"));

*responder_ctx = rctx;

return EOK;

}

int sss_dp_get_domain_conn(struct resp_ctx *rctx, const char *domain,

struct be_conn **_conn)

{

struct be_conn *iter;

if (!rctx->be_conns) return ENOENT;

for (iter = rctx->be_conns; iter; iter = iter->next) {

if (strcasecmp(domain, iter->domain->name) == 0) break;

}

if (!iter) return ENOENT;

*_conn = iter;

return EOK;

}

struct sss_domain_info *

responder_get_domain(TALLOC_CTX *sd_mem_ctx, struct resp_ctx *rctx,

const char *domain)

{

time_t now = time(NULL);

time_t time_diff;

struct sss_domain_info *dom;

struct sss_domain_info *ret_dom = NULL;

int i;

for (dom = rctx->domains; dom; dom = dom->next) {

if (strcasecmp(dom->name, domain) == 0) {

ret_dom = dom;

break;

}

for (i = 0; i < dom->subdomain_count; i++) {

if (strcasecmp(dom->subdomains[i]->name, domain) == 0 ||

(dom->subdomains[i]->flat_name != NULL &&

strcasecmp(dom->subdomains[i]->flat_name, domain) == 0)) {

/* Sub-domains may come and go, so we better copy the struct

ret_dom = copy_subdomain(sd_mem_ctx, dom->subdomains[i]);

break;

}

}

time_diff = now - dom->subdomains_last_checked.tv_sec;

if (i < dom->subdomain_count && time_diff < rctx->domains_timeout) break;

}

/* FIXME: we might want to return a real error, e.g. if copy_subdomain

if (!ret_dom) {

DEBUG(SSSDBG_OP_FAILURE, ("Unknown domain [%s], checking for"

"possible subdomains!\n", domain));

}

return ret_dom;

}

int responder_logrotate(DBusMessage *message,

struct sbus_connection *conn)

{

errno_t ret;

struct resp_ctx *rctx = talloc_get_type(sbus_conn_get_private_data(conn),

struct resp_ctx);

ret = monitor_common_rotate_logs(rctx->cdb, rctx->confdb_service_path);

if (ret != EOK) return ret;

return monitor_common_pong(message, conn);

}

void responder_set_fd_limit(rlim_t fd_limit)

{

struct rlimit current_limit, new_limit;

int limret;

/* First, let's see if we have permission to just set

new_limit.rlim_cur = fd_limit;

new_limit.rlim_max = fd_limit;

limret = setrlimit(RLIMIT_NOFILE, &new_limit);

if (limret == 0) {

DEBUG(SSSDBG_CONF_SETTINGS,

("Maximum file descriptors set to [%d]\n",

new_limit.rlim_cur));

return;

}

/* We couldn't set the soft and hard limits to this

/* Determine the maximum hard limit */

limret = getrlimit(RLIMIT_NOFILE, &current_limit);

if (limret == 0) {

DEBUG(SSSDBG_TRACE_INTERNAL,

("Current fd limit: [%d]\n",

current_limit.rlim_cur));

/* Choose the lesser of the requested and the hard limit */

if (current_limit.rlim_max < fd_limit) {

new_limit.rlim_cur = current_limit.rlim_max;

} else {

new_limit.rlim_cur = fd_limit;

}

new_limit.rlim_max = current_limit.rlim_max;

limret = setrlimit(RLIMIT_NOFILE, &new_limit);

if (limret == 0) {

DEBUG(SSSDBG_CONF_SETTINGS,

("Maximum file descriptors set to [%d]\n",

new_limit.rlim_cur));

} else {

DEBUG(SSSDBG_CRIT_FAILURE,

("Could not set new fd limits. Proceeding with [%d]\n",

current_limit.rlim_cur));

}

} else {

DEBUG(SSSDBG_CRIT_FAILURE,

("Could not determine fd limits. "

"Proceeding with system values\n"));

}

}