1 /* Based on ipsvd utilities written by Gerrit Pape <pape@smarden.org>
2 * which are released into public domain by the author.
3 * Homepage: http://smarden.sunsite.dk/ipsvd/
5 * Copyright (C) 2007 Denis Vlasenko.
7 * Licensed under GPLv2, see file LICENSE in this tarball for details.
10 /* Based on ipsvd ipsvd-0.12.1. This tcpsvd accepts all options
11 * which are supported by one from ipsvd-0.12.1, but not all are
12 * functional. See help text at the end of this file for details.
14 * Code inside "#ifdef SSLSVD" is for sslsvd and is currently unused.
16 * Output of verbose mode matches original (modulo bugs and
17 * unimplemented stuff). Unnatural splitting of IP and PORT
18 * is retained (personally I prefer one-value "IP:PORT" notation -
19 * it is a natural string representation of struct sockaddr_XX).
21 * TCPORIGDST{IP,PORT} is busybox-specific addition
23 * udp server is hacked up by reusing TCP code. It has the following
24 * limitation inherent in Unix DGRAM sockets implementation:
25 * - local IP address is retrieved (using recvmsg voodoo) but
26 * child's socket is not bound to it (bind cannot be called on
27 * already bound socket). Thus it still can emit outgoing packets
28 * with wrong source IP...
29 * - don't know how to retrieve ORIGDST for udp.
33 #include <linux/netfilter_ipv4.h> /* wants <limits.h> */
36 #include "ipsvd_perhost.h"
39 #include "matrixSsl.h"
43 static unsigned verbose;
44 static unsigned max_per_host;
45 static unsigned cur_per_host;
47 static unsigned cmax = 30;
49 static void xsetenv_proto(const char *proto, const char *n, const char *v)
51 putenv(xasprintf("%s%s=%s", proto, n, v));
54 static void sig_term_handler(int sig)
57 printf("%s: info: sigterm received, exit\n", applet_name);
61 /* Little bloated, but tries to give accurate info how child exited.
62 * Makes easier to spot segfaulting children etc... */
63 static void print_waitstat(unsigned pid, int wstat)
66 const char *cause = "?exit";
68 if (WIFEXITED(wstat)) {
70 e = WEXITSTATUS(wstat);
71 } else if (WIFSIGNALED(wstat)) {
75 printf("%s: info: end %d %s %d\n", applet_name, pid, cause, e);
78 /* Must match getopt32 in main! */
93 OPT_U = (1 << 13), /* from here: sslsvd only */
94 OPT_slash = (1 << 14),
99 static void connection_status(void)
101 /* "only 1 client max" don't need this */
103 printf("%s: info: status %u/%u\n", applet_name, cnum, cmax);
106 static void sig_child_handler(int sig)
111 while ((pid = wait_nohang(&wstat)) > 0) {
113 ipsvd_perhost_remove(pid);
117 print_waitstat(pid, wstat);
123 int tcpudpsvd_main(int argc, char **argv);
124 int tcpudpsvd_main(int argc, char **argv)
126 char *str_c, *str_C, *str_b, *str_t;
129 const char *instructs;
130 char *msg_per_host = NULL;
131 unsigned len_per_host = len_per_host; /* gcc */
133 struct bb_uidgid_t ugid;
135 bool need_hostnames, need_remote_ip, tcp;
137 char *local_hostname = NULL;
138 char *remote_hostname = (char*)""; /* "" used if no -h */
139 char *local_addr = local_addr; /* gcc */
140 char *remote_addr = remote_addr; /* gcc */
141 char *remote_ip = remote_addr; /* gcc */
142 len_and_sockaddr *lsa;
143 len_and_sockaddr local, remote;
148 unsigned backlog = 20;
150 tcp = (applet_name[0] == 't');
152 /* 3+ args, -i at most once, -p implies -h, -v is counter */
153 opt_complementary = "-3:?:i--i:ph:vv";
155 getopt32(argc, argv, "+c:C:i:x:u:l:Eb:hpt:vU:/:Z:K:",
156 &str_c, &str_C, &instructs, &instructs, &user, &local_hostname,
157 &str_b, &str_t, &ssluser, &root, &cert, &key, &verbose
160 getopt32(argc, argv, "+c:C:i:x:u:l:Eb:hpt:v",
161 &str_c, &str_C, &instructs, &instructs, &user, &local_hostname,
162 &str_b, &str_t, &verbose
165 if (option_mask32 & OPT_c)
166 cmax = xatou_range(str_c, 1, INT_MAX);
167 if (option_mask32 & OPT_C) { /* -C n[:message] */
168 max_per_host = bb_strtou(str_C, &str_C, 10);
172 msg_per_host = str_C + 1;
173 len_per_host = strlen(msg_per_host);
176 if (max_per_host > cmax)
178 if (option_mask32 & OPT_u) {
179 if (!get_uidgid(&ugid, user, 1))
180 bb_error_msg_and_die("unknown user/group: %s", user);
182 if (option_mask32 & OPT_b)
183 backlog = xatou(str_b);
185 if (option_mask32 & OPT_U) ssluser = optarg;
186 if (option_mask32 & OPT_slash) root = optarg;
187 if (option_mask32 & OPT_Z) cert = optarg;
188 if (option_mask32 & OPT_K) key = optarg;
191 if (!argv[0][0] || LONE_CHAR(argv[0], '0'))
192 argv[0] = (char*)"0.0.0.0";
194 /* Per-IP flood protection is not thought-out for UDP */
198 /* stdout is used for logging, don't buffer */
200 bb_sanitize_stdio(); /* fd# 0,1,2 must be opened */
202 need_hostnames = verbose || !(option_mask32 & OPT_E);
203 need_remote_ip = max_per_host || need_hostnames;
208 if ((getuid() == 0) && !(option_mask32 & OPT_u)) {
209 xfunc_exitcode = 100;
210 bb_error_msg_and_die("fatal: -U ssluser must be set when running as root");
212 if (option_mask32 & OPT_u)
213 if (!uidgid_get(&sslugid, ssluser, 1)) {
215 bb_perror_msg_and_die("fatal: cannot get user/group: %s", ssluser);
217 bb_error_msg_and_die("fatal: unknown user/group '%s'", ssluser);
219 if (!cert) cert = "./cert.pem";
220 if (!key) key = cert;
221 if (matrixSslOpen() < 0)
222 fatal("cannot initialize ssl");
223 if (matrixSslReadKeys(&keys, cert, key, 0, ca) < 0) {
225 fatal("cannot read cert, key, or ca file");
226 fatal("cannot read cert or key file");
228 if (matrixSslNewSession(&ssl, keys, 0, SSL_FLAGS_SERVER) < 0)
229 fatal("cannot create ssl session");
233 signal(SIGCHLD, sig_child_handler);
234 signal(SIGTERM, sig_term_handler);
235 signal(SIGPIPE, SIG_IGN);
238 ipsvd_perhost_init(cmax);
240 local_port = bb_lookup_port(argv[1], tcp ? "tcp" : "udp", 0);
241 lsa = xhost2sockaddr(argv[0], local_port);
242 sock = xsocket(lsa->sa.sa_family, tcp ? SOCK_STREAM : SOCK_DGRAM, 0);
243 setsockopt_reuseaddr(sock);
244 sa_len = lsa->len; /* I presume sockaddr len stays the same */
245 xbind(sock, &lsa->sa, sa_len);
247 xlisten(sock, backlog);
248 else /* udp: needed for recv_from_to to work: */
249 socket_want_pktinfo(sock);
250 /* ndelay_off(sock); - it is the default I think? */
253 if (option_mask32 & OPT_u) {
254 /* drop permissions */
261 char *addr = xmalloc_sockaddr2dotted(&lsa->sa, sa_len);
262 printf("%s: info: listening on %s", applet_name, addr);
265 if (option_mask32 & OPT_u)
266 printf(", uid %u, gid %u",
267 (unsigned)ugid.uid, (unsigned)ugid.gid);
272 /* Main accept() loop */
278 sig_pause(); /* wait for any signal (expecting SIGCHLD) */
280 /* Accept a connection to fd #0 */
284 sig_unblock(SIGCHLD);
287 conn = accept(sock, &remote.sa, &remote.len);
289 /* In case recv_from_to won't be able to recover local addr.
290 * Also sets port - recv_from_to is unable to do it. */
292 conn = recv_from_to(sock, NULL, 0, MSG_PEEK, &remote.sa, &local.sa, sa_len);
297 bb_perror_msg(tcp ? "accept" : "recv");
300 xmove_fd(tcp ? conn : sock, 0);
303 /* Drop connection immediately if cur_per_host > max_per_host
304 * (minimizing load under SYN flood) */
305 remote_ip = xmalloc_sockaddr2dotted_noport(&remote.sa, sa_len);
306 cur_per_host = ipsvd_perhost_add(remote_ip, max_per_host, &hccp);
307 if (cur_per_host > max_per_host) {
308 /* ipsvd_perhost_add detected that max is exceeded
309 * (and did not store ip in connection table) */
312 /* don't block or test for errors */
314 write(0, msg_per_host, len_per_host);
321 /* Voodoo magic: making udp sockets each receive its own
322 * packets is not trivial, and I still not sure
323 * I do it 100% right.
324 * 1) we have to do it before fork()
325 * 2) order is important - is it right now? */
327 /* Make plain write/send work for this socket by supplying default
328 * destination address. This also restricts incoming packets
329 * to ones coming from this remote IP. */
330 xconnect(0, &remote.sa, sa_len);
331 /* hole? at this point we have no wildcard udp socket...
332 * can this cause clients to get "port unreachable" icmp?
333 * Yup, time window is very small, but it exists (is it?) */
334 /* Open new non-connected UDP socket for further clients */
335 sock = xsocket(lsa->sa.sa_family, tcp ? SOCK_STREAM : SOCK_DGRAM, 0);
336 setsockopt_reuseaddr(sock);
337 xbind(sock, &lsa->sa, sa_len);
338 socket_want_pktinfo(sock);
341 * we cannot replace fd #0 - we will lose pending packet
342 * which is already buffered for us! And we cannot use fd #1
343 * instead - it will "intercept" all following packets, but child
344 * do not expect data coming *from fd #1*! */
346 /* Make it so that local addr is fixed to localp->sa
347 * and we don't accidentally accept packets to other local IPs. */
348 /* NB: we possibly bind to the _very_ same_ address & port as the one
349 * already bound in parent! This seems to work in Linux.
350 * (otherwise we can move socket to fd #0 only if bind succeeds) */
352 set_nport(localp, htons(local_port));
353 xmove_fd(xsocket(localp->sa.sa_family, SOCK_DGRAM, 0), 0);
354 setsockopt_reuseaddr(0); /* crucial */
355 xbind(0, &localp->sa, localp->len);
361 bb_perror_msg("fork");
376 /* Child: prepare env, log, and exec prog */
378 /* Closing tcp listening socket */
383 remote_addr = xmalloc_sockaddr2dotted(&remote.sa, sa_len);
385 if (need_hostnames) {
386 if (option_mask32 & OPT_h) {
387 remote_hostname = xmalloc_sockaddr2host_noport(&remote.sa, sa_len);
388 if (!remote_hostname) {
389 bb_error_msg("warning: cannot look up hostname for %s", remote_addr);
390 remote_hostname = (char*)"";
393 /* Find out local IP peer connected to.
394 * Errors ignored (I'm not paranoid enough to imagine kernel
395 * which doesn't know local IP). */
398 getsockname(0, &local.sa, &local.len);
400 local_addr = xmalloc_sockaddr2dotted(&local.sa, sa_len);
401 if (!local_hostname) {
402 local_hostname = xmalloc_sockaddr2host_noport(&local.sa, sa_len);
404 bb_error_msg_and_die("warning: cannot look up hostname for %s"+9, local_addr);
410 printf("%s: info: pid %u from %s\n", applet_name, pid, remote_addr);
412 printf("%s: info: concurrency %u %s %u/%u\n",
413 applet_name, pid, remote_ip, cur_per_host, max_per_host);
414 printf("%s: info: start %u %s:%s :%s:%s\n",
416 local_hostname, local_addr,
417 remote_hostname, remote_addr);
420 if (!(option_mask32 & OPT_E)) {
421 /* setup ucspi env */
422 const char *proto = tcp ? "TCP" : "UDP";
424 /* Extract "original" destination addr:port
425 * from Linux firewall. Useful when you redirect
426 * an outbond connection to local handler, and it needs
427 * to know where it originally tried to connect */
428 if (tcp && getsockopt(0, SOL_IP, SO_ORIGINAL_DST, &lsa->sa, &lsa->len) == 0) {
429 char *addr = xmalloc_sockaddr2dotted(&lsa->sa, sa_len);
430 xsetenv("TCPORIGDSTADDR", addr);
433 xsetenv("PROTO", proto);
434 xsetenv_proto(proto, "LOCALADDR", local_addr);
435 xsetenv_proto(proto, "LOCALHOST", local_hostname);
436 xsetenv_proto(proto, "REMOTEADDR", remote_addr);
437 if (option_mask32 & OPT_h) {
438 xsetenv_proto(proto, "REMOTEHOST", remote_hostname);
440 xsetenv_proto(proto, "REMOTEINFO", "");
442 if (cur_per_host > 0) /* can not be true for udp */
443 xsetenv("TCPCONCURRENCY", utoa(cur_per_host));
448 signal(SIGTERM, SIG_DFL);
449 signal(SIGPIPE, SIG_DFL);
450 signal(SIGCHLD, SIG_DFL);
451 sig_unblock(SIGCHLD);
455 strcpy(id, utoa(pid);
458 BB_EXECVP(argv[0], argv);
460 bb_perror_msg_and_die("exec '%s'", argv[0]);
464 tcpsvd [-hpEvv] [-c n] [-C n:msg] [-b n] [-u user] [-l name]
465 [-i dir|-x cdb] [ -t sec] host port prog
467 tcpsvd creates a TCP/IP socket, binds it to the address host:port,
468 and listens on the socket for incoming connections.
470 On each incoming connection, tcpsvd conditionally runs a program,
471 with standard input reading from the socket, and standard output
472 writing to the socket, to handle this connection. tcpsvd keeps
473 listening on the socket for new connections, and can handle
474 multiple connections simultaneously.
476 tcpsvd optionally checks for special instructions depending
477 on the IP address or hostname of the client that initiated
478 the connection, see ipsvd-instruct(5).
481 host either is a hostname, or a dotted-decimal IP address,
482 or 0. If host is 0, tcpsvd accepts connections to any local
484 * busybox accepts IPv6 addresses and host:port pairs too
485 In this case second parameter is ignored
487 tcpsvd accepts connections to host:port. port may be a name
488 from /etc/services or a number.
490 prog consists of one or more arguments. For each connection,
491 tcpsvd normally runs prog, with file descriptor 0 reading from
492 the network, and file descriptor 1 writing to the network.
493 By default it also sets up TCP-related environment variables,
496 read instructions for handling new connections from the instructions
497 directory dir. See ipsvd-instruct(5) for details.
498 * ignored by busyboxed version
500 read instructions for handling new connections from the constant database
501 cdb. The constant database normally is created from an instructions
502 directory by running ipsvd-cdb(8).
503 * ignored by busyboxed version
505 timeout. This option only takes effect if the -i option is given.
506 While checking the instructions directory, check the time of last access
507 of the file that matches the clients address or hostname if any, discard
508 and remove the file if it wasn't accessed within the last sec seconds;
509 tcpsvd does not discard or remove a file if the user's write permission
510 is not set, for those files the timeout is disabled. Default is 0,
511 which means that the timeout is disabled.
512 * ignored by busyboxed version
514 local hostname. Do not look up the local hostname in DNS, but use name
515 as hostname. This option must be set if tcpsvd listens on port 53
518 drop permissions. Switch user ID to user's UID, and group ID to user's
519 primary GID after creating and binding to the socket. If user is followed
520 by a colon and a group name, the group ID is switched to the GID of group
521 instead. All supplementary groups are removed.
523 concurrency. Handle up to n connections simultaneously. Default is 30.
524 If there are n connections active, tcpsvd defers acceptance of a new
525 connection until an active connection is closed.
527 per host concurrency. Allow only up to n connections from the same IP
528 address simultaneously. If there are n active connections from one IP
529 address, new incoming connections from this IP address are closed
530 immediately. If n is followed by :msg, the message msg is written
531 to the client if possible, before closing the connection. By default
532 msg is empty. See ipsvd-instruct(5) for supported escape sequences in msg.
534 For each accepted connection, the current per host concurrency is
535 available through the environment variable TCPCONCURRENCY. n and msg
536 can be overwritten by ipsvd(7) instructions, see ipsvd-instruct(5).
537 By default tcpsvd doesn't keep track of connections.
539 Look up the client's hostname in DNS.
541 paranoid. After looking up the client's hostname in DNS, look up the IP
542 addresses in DNS for that hostname, and forget about the hostname
543 if none of the addresses match the client's IP address. You should
544 set this option if you use hostname based instructions. The -p option
545 implies the -h option.
546 * ignored by busyboxed version
548 backlog. Allow a backlog of approximately n TCP SYNs. On some systems n
549 is silently limited. Default is 20.
551 no special environment. Do not set up TCP-related environment variables.
553 verbose. Print verbose messsages to standard output.
555 more verbose. Print more verbose messages to standard output.
556 * no difference between -v and -vv in busyboxed version