UNIX domain socket authentication support added
[oweals/gnunet.git] / src / util / service.c
index 8597fddf604d3f09e0f806210ef9388887d2b1bf..0594149d96e79798697daecf13daaabf57fece8f 100644 (file)
@@ -430,12 +430,8 @@ struct GNUNET_SERVICE_Context
   struct GNUNET_SERVER_Handle *server;
 
   /**
-   * Scheduler for the server.
-   */
-  struct GNUNET_SCHEDULER_Handle *sched;
-
-  /**
-   * NULL-terminated array of addresses to bind to.
+   * NULL-terminated array of addresses to bind to, NULL if we got pre-bound
+   * listen sockets.
    */
   struct sockaddr **addrs;
 
@@ -483,14 +479,19 @@ struct GNUNET_SERVICE_Context
   struct GNUNET_SERVER_MessageHandler *my_handlers;
 
   /**
-   * Idle timeout for server.
+   * Array of the lengths of the entries in addrs.
    */
-  struct GNUNET_TIME_Relative timeout;
+  socklen_t * addrlens;
 
   /**
-   * Maximum buffer size for the server.
+   * NULL-terminated array of listen sockets we should take over.
    */
-  size_t maxbuf;
+  struct GNUNET_NETWORK_Handle **lsocks;
+
+  /**
+   * Idle timeout for server.
+   */
+  struct GNUNET_TIME_Relative timeout;
 
   /**
    * Overall success/failure of the service start.
@@ -511,19 +512,21 @@ struct GNUNET_SERVICE_Context
   int require_found;
 
   /**
-   * Can clients ask us to initiate a shutdown?
+   * Do we require a matching UID for UNIX domain socket
+   * connections?
    */
-  int allow_shutdown;
+  int match_uid;
 
   /**
-   * Our options.
+   * Do we require a matching GID for UNIX domain socket
+   * connections?
    */
-  enum GNUNET_SERVICE_Options options;
+  int match_gid;
 
   /**
-   * Array of the lengths of the entries in addrs.
+   * Our options.
    */
-  socklen_t * addrlens;
+  enum GNUNET_SERVICE_Options options;
 
 };
 
@@ -570,86 +573,6 @@ handle_test (void *cls,
 }
 
 
-static size_t
-transmit_shutdown_deny (void *cls, size_t size, void *buf)
-{
-  struct GNUNET_SERVER_Client *client = cls;
-  struct GNUNET_MessageHeader *msg;
-
-  if (size < sizeof (struct GNUNET_MessageHeader))
-    {
-      return 0;                 /* client disconnected */
-      GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-    }
-  msg = (struct GNUNET_MessageHeader *) buf;
-  msg->type = htons (GNUNET_MESSAGE_TYPE_SHUTDOWN_REFUSE);
-  msg->size = htons (sizeof (struct GNUNET_MessageHeader));
-  GNUNET_SERVER_receive_done (client, GNUNET_OK);
-  GNUNET_SERVER_client_drop(client);
-  return sizeof (struct GNUNET_MessageHeader);
-}
-
-static size_t
-transmit_shutdown_ack (void *cls, size_t size, void *buf)
-{
-  struct GNUNET_SERVER_Client *client = cls;
-  struct GNUNET_MessageHeader *msg;
-
-  if (size < sizeof (struct GNUNET_MessageHeader))
-    {
-      return 0;                 /* client disconnected */
-      GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
-    }
-
-  msg = (struct GNUNET_MessageHeader *) buf;
-  msg->type = htons (GNUNET_MESSAGE_TYPE_SHUTDOWN_ACK);
-  msg->size = htons (sizeof (struct GNUNET_MessageHeader));
-  GNUNET_SERVER_receive_done (client, GNUNET_OK);
-  GNUNET_SERVER_client_drop(client);
-  return sizeof (struct GNUNET_MessageHeader);
-}
-
-/**
- * Handler for SHUTDOWN message.
- *
- * @param cls closure (refers to service)
- * @param client identification of the client
- * @param message the actual message
- */
-static void
-handle_shutdown (void *cls,
-                 struct GNUNET_SERVER_Client *client,
-                 const struct GNUNET_MessageHeader *message)
-{
-  struct GNUNET_SERVICE_Context *service = cls;
-
-  /* FIXME: why is this call necessary???? */
-  GNUNET_SERVER_client_keep(client);
-  if (!service->allow_shutdown)
-    {
-      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
-                  _
-                  ("Received shutdown request, but configured to ignore!\n"));
-      GNUNET_SERVER_notify_transmit_ready (client,
-                                           sizeof(struct GNUNET_MessageHeader),
-                                           GNUNET_TIME_UNIT_FOREVER_REL,
-                                           &transmit_shutdown_deny, client);
-      return;
-    }
-  GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-              _("Initiating shutdown as requested by client.\n"));
-
-  GNUNET_SERVER_notify_transmit_ready (client,
-                                       sizeof(struct GNUNET_MessageHeader),
-                                       GNUNET_TIME_UNIT_FOREVER_REL,
-                                       &transmit_shutdown_ack, client);
-
-  GNUNET_assert (service->sched != NULL);
-  GNUNET_SERVER_client_persist_ (client);
-  GNUNET_SCHEDULER_shutdown (service->sched);
-}
-
-
 /**
  * Default handlers for all services.  Will be copied and the
  * "callback_cls" fields will be replaced with the specific service
@@ -658,8 +581,6 @@ handle_shutdown (void *cls,
 static const struct GNUNET_SERVER_MessageHandler defhandlers[] = {
   {&handle_test, NULL, GNUNET_MESSAGE_TYPE_TEST,
    sizeof (struct GNUNET_MessageHeader)},
-  {&handle_shutdown, NULL, GNUNET_MESSAGE_TYPE_SHUTDOWN,
-   sizeof (struct GNUNET_MessageHeader)},
   {NULL, NULL, 0, 0}
 };
 
@@ -670,9 +591,18 @@ static const struct GNUNET_SERVER_MessageHandler defhandlers[] = {
 
 /**
  * Check if access to the service is allowed from the given address.
+ *
+ * @param cls closure
+ * @param uc credentials, if available, otherwise NULL
+ * @param addr address
+ * @param addrlen length of address
+ * @return GNUNET_YES to allow, GNUNET_NO to deny, GNUNET_SYSERR
+ *   for unknown address family (will be denied).
  */
 static int
-check_access (void *cls, const struct sockaddr *addr, socklen_t addrlen)
+check_access (void *cls, 
+             const struct GNUNET_CONNECTION_Credentials *uc,
+             const struct sockaddr *addr, socklen_t addrlen)
 {
   struct GNUNET_SERVICE_Context *sctx = cls;
   const struct sockaddr_in *i4;
@@ -699,6 +629,25 @@ check_access (void *cls, const struct sockaddr *addr, socklen_t addrlen)
         && ((sctx->v6_denied == NULL) ||
             (!check_ipv6_listed (sctx->v6_denied, &i6->sin6_addr)));
       break;
+    case AF_UNIX:
+      ret = GNUNET_OK; /* always OK for now */
+      if ( (sctx->match_uid == GNUNET_YES) ||
+          (sctx->match_gid == GNUNET_YES) )
+       ret = GNUNET_NO;
+      if ( (uc != NULL) &&
+          ( (sctx->match_uid != GNUNET_YES) ||
+            (uc->uid == geteuid()) ||
+            (uc->uid == getuid()) ) &&
+          ( (sctx->match_gid != GNUNET_YES) ||
+            (uc->gid == getegid()) ||
+            (uc->gid == getgid())) )
+       ret = GNUNET_YES;
+      else
+       GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                   _("Access denied to UID %d / GID %d\n"), 
+                   (uc == NULL) ? -1 : uc->uid,
+                   (uc == NULL) ? -1 : uc->gid);       
+      break;
     default:
       GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                   _("Unknown address family %d\n"), addr->sa_family);
@@ -789,6 +738,47 @@ process_acl6 (struct IPv6NetworkSet **ret,
   return GNUNET_OK;
 }
 
+/**
+ * Add the given UNIX domain path as an address to the
+ * list (as the first entry).
+ *
+ * @param saddrs array to update
+ * @param saddrlens where to store the address length
+ * @param unixpath path to add
+ */
+static void
+add_unixpath (struct sockaddr **saddrs,
+             socklen_t *saddrlens,
+             const char *unixpath)
+{
+#ifdef AF_UNIX  
+  struct sockaddr_un *un;
+  size_t slen;
+
+  un = GNUNET_malloc (sizeof (struct sockaddr_un));
+  un->sun_family = AF_UNIX;
+  slen = strlen (unixpath) + 1;
+  if (slen >= sizeof (un->sun_path))
+    slen = sizeof (un->sun_path) - 1;
+  memcpy (un->sun_path,
+         unixpath,
+         slen);
+  un->sun_path[slen] = '\0';
+#if LINUX
+  un->sun_path[0] = '\0';
+  slen = sizeof (struct sockaddr_un);
+#else
+  slen += sizeof (sa_family_t);
+#endif
+  *saddrs = (struct sockaddr*) un;
+  *saddrlens = slen;
+#else
+  /* this function should never be called 
+     unless AF_UNIX is defined! */
+  GNUNET_assert (0);
+#endif
+}
+
 
 /**
  * Get the list of addresses that a server for the given service
@@ -819,6 +809,7 @@ GNUNET_SERVICE_get_server_addresses (const char *serviceName,
   int disablev6;
   struct GNUNET_NETWORK_Handle *desc;
   unsigned long long port;
+  char *unixpath;
   struct addrinfo hints;
   struct addrinfo *res;
   struct addrinfo *pos;
@@ -832,6 +823,7 @@ GNUNET_SERVICE_get_server_addresses (const char *serviceName,
 
   *addrs = NULL;
   *addr_lens = NULL;
+  desc = NULL;
   if (GNUNET_CONFIGURATION_have_value (cfg,
                                        serviceName, "DISABLEV6"))
     {
@@ -865,22 +857,29 @@ GNUNET_SERVICE_get_server_addresses (const char *serviceName,
       else
         {
           GNUNET_break (GNUNET_OK == GNUNET_NETWORK_socket_close (desc));
+          desc = NULL;
         }
     }
 
-
-  if ((GNUNET_OK !=
-       GNUNET_CONFIGURATION_get_value_number (cfg,
-                                              serviceName,
-                                              "PORT",
-                                              &port)) || (port > 65535))
+  port = 0;
+  if (GNUNET_CONFIGURATION_have_value (cfg,
+                                       serviceName, "PORT"))
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  _
-                  ("Require valid port number for service `%s' in configuration!\n"),
-                  serviceName);
-      return GNUNET_SYSERR;
+      GNUNET_break (GNUNET_OK ==
+                   GNUNET_CONFIGURATION_get_value_number (cfg,
+                                                          serviceName,
+                                                          "PORT",
+                                                          &port));
+      if (port > 65535)
+       {
+         GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                     _
+                     ("Require valid port number for service `%s' in configuration!\n"),
+                     serviceName);
+         return GNUNET_SYSERR;
+       }
     }
+
   if (GNUNET_CONFIGURATION_have_value (cfg,
                                        serviceName, "BINDTO"))
     {
@@ -893,6 +892,78 @@ GNUNET_SERVICE_get_server_addresses (const char *serviceName,
   else
     hostname = NULL;
 
+#ifdef AF_UNIX
+  if (GNUNET_CONFIGURATION_have_value (cfg,
+                                       serviceName, "UNIXPATH"))
+    {
+      GNUNET_assert (GNUNET_OK ==
+                    GNUNET_CONFIGURATION_get_value_string (cfg,
+                                                           serviceName,
+                                                           "UNIXPATH",
+                                                           &unixpath));
+
+      /* probe UNIX support */
+      struct sockaddr_un s_un;
+      if (strlen(unixpath) >= sizeof(s_un.sun_path))
+      {
+         GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                  _("UNIXPATH `%s' too long, maximum length is %llu\n"),unixpath, sizeof(s_un.sun_path));
+             GNUNET_free_non_null (hostname);
+             GNUNET_free (unixpath);
+         return GNUNET_SYSERR;
+      }
+
+      desc = GNUNET_NETWORK_socket_create (AF_UNIX, SOCK_STREAM, 0);
+      if (NULL == desc)
+        {
+          if ((errno == ENOBUFS) ||
+              (errno == ENOMEM) || (errno == ENFILE) || (errno == EACCES))
+            {
+              GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "socket");
+             GNUNET_free_non_null (hostname);
+             GNUNET_free (unixpath);
+              return GNUNET_SYSERR;
+            }
+          GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                      _
+                      ("Disabling UNIX domain socket support for service `%s', failed to create UNIX domain socket: %s\n"),
+                      serviceName, STRERROR (errno));
+         GNUNET_free (unixpath);
+          unixpath = NULL;
+        }
+      else
+       {
+          GNUNET_break (GNUNET_OK == GNUNET_NETWORK_socket_close (desc));
+          desc = NULL;
+       }
+    }
+  else
+    unixpath = NULL;
+#else
+  unixpath = NULL;
+#endif
+
+  if ( (port == 0) &&
+       (unixpath == NULL) )
+    {
+      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                 _("Have neither PORT nor UNIXPATH for service `%s', but one is required\n"),
+                 serviceName);
+      GNUNET_free_non_null(hostname);
+      return GNUNET_SYSERR;
+    }
+  if (port == 0)
+    {
+      saddrs = GNUNET_malloc (2 * sizeof(struct sockaddr*));
+      saddrlens = GNUNET_malloc (2 * sizeof (socklen_t));
+      add_unixpath (saddrs, saddrlens, unixpath);
+      GNUNET_free_non_null (unixpath);
+      GNUNET_free_non_null(hostname);
+      *addrs = saddrs;
+      *addr_lens = saddrlens;
+      return 1;
+    }
+       
   if (hostname != NULL)
     {
 #if DEBUG_SERVICE
@@ -911,6 +982,7 @@ GNUNET_SERVICE_get_server_addresses (const char *serviceName,
                       _("Failed to resolve `%s': %s\n"),
                       hostname, gai_strerror (ret));
           GNUNET_free (hostname);
+         GNUNET_free (unixpath);
           return GNUNET_SYSERR;
         }
       next = res;
@@ -929,12 +1001,20 @@ GNUNET_SERVICE_get_server_addresses (const char *serviceName,
                       disablev6 ? "IPv4 " : "", hostname);
           freeaddrinfo (res);
           GNUNET_free (hostname);
+         GNUNET_free (unixpath);
           return GNUNET_SYSERR;
         }
       resi = i;
-      saddrs = GNUNET_malloc ((i+1) * sizeof(struct sockaddr*));
-      saddrlens = GNUNET_malloc ((i+1) * sizeof (socklen_t));
+      if (NULL != unixpath)
+       resi++;
+      saddrs = GNUNET_malloc ((resi+1) * sizeof(struct sockaddr*));
+      saddrlens = GNUNET_malloc ((resi+1) * sizeof (socklen_t));
       i = 0;
+      if (NULL != unixpath)
+       {
+         add_unixpath (saddrs, saddrlens, unixpath);
+         i++;
+       }
       next = res;
       while (NULL != (pos = next)) 
        {
@@ -977,41 +1057,56 @@ GNUNET_SERVICE_get_server_addresses (const char *serviceName,
         {
           /* V4-only */
          resi = 1;
-         saddrs = GNUNET_malloc (2 * sizeof(struct sockaddr*));
-         saddrlens = GNUNET_malloc (2 * sizeof (socklen_t));
-          saddrlens[0] = sizeof (struct sockaddr_in);
-          saddrs[0] = GNUNET_malloc (saddrlens[0]);
+         if (NULL != unixpath)
+           resi++;
+         i = 0;
+         saddrs = GNUNET_malloc ((resi+1) * sizeof(struct sockaddr*));
+         saddrlens = GNUNET_malloc ((resi+1) * sizeof (socklen_t));
+         if (NULL != unixpath)
+           {
+             add_unixpath (saddrs, saddrlens, unixpath);
+             i++;
+           }
+          saddrlens[i] = sizeof (struct sockaddr_in);
+          saddrs[i] = GNUNET_malloc (saddrlens[i]);
 #if HAVE_SOCKADDR_IN_SIN_LEN
-          ((struct sockaddr_in *) saddrs[0])->sin_len = saddrlens[0];
+          ((struct sockaddr_in *) saddrs[i])->sin_len = saddrlens[i];
 #endif
-          ((struct sockaddr_in *) saddrs[0])->sin_family = AF_INET;
-          ((struct sockaddr_in *) saddrs[0])->sin_port = htons (port);
+          ((struct sockaddr_in *) saddrs[i])->sin_family = AF_INET;
+          ((struct sockaddr_in *) saddrs[i])->sin_port = htons (port);
         }
       else
         {
           /* dual stack */
          resi = 2;
-         saddrs = GNUNET_malloc (3 * sizeof(struct sockaddr*));
-         saddrlens = GNUNET_malloc (3 * sizeof (socklen_t));
-
-          saddrlens[0] = sizeof (struct sockaddr_in6);
-          saddrs[0] = GNUNET_malloc (saddrlens[0]);
+         if (NULL != unixpath)
+           resi++;
+         saddrs = GNUNET_malloc ((resi+1) * sizeof(struct sockaddr*));
+         saddrlens = GNUNET_malloc ((resi+1) * sizeof (socklen_t));
+         i = 0;
+         if (NULL != unixpath)
+           {
+             add_unixpath (saddrs, saddrlens, unixpath);
+             i++;
+           }
+          saddrlens[i] = sizeof (struct sockaddr_in6);
+          saddrs[i] = GNUNET_malloc (saddrlens[i]);
 #if HAVE_SOCKADDR_IN_SIN_LEN
-          ((struct sockaddr_in6 *) saddrs[0])->sin6_len = saddrlens[0];
+          ((struct sockaddr_in6 *) saddrs[i])->sin6_len = saddrlens[0];
 #endif
-          ((struct sockaddr_in6 *) saddrs[0])->sin6_family = AF_INET6;
-          ((struct sockaddr_in6 *) saddrs[0])->sin6_port = htons (port);
-
-          saddrlens[1] = sizeof (struct sockaddr_in);
-          saddrs[1] = GNUNET_malloc (saddrlens[1]);
+          ((struct sockaddr_in6 *) saddrs[i])->sin6_family = AF_INET6;
+          ((struct sockaddr_in6 *) saddrs[i])->sin6_port = htons (port);
+         i++;
+          saddrlens[i] = sizeof (struct sockaddr_in);
+          saddrs[i] = GNUNET_malloc (saddrlens[i]);
 #if HAVE_SOCKADDR_IN_SIN_LEN
-          ((struct sockaddr_in *) saddrs[1])->sin_len = saddrlens[1];
+          ((struct sockaddr_in *) saddrs[i])->sin_len = saddrlens[1];
 #endif
-          ((struct sockaddr_in *) saddrs[1])->sin_family = AF_INET;
-          ((struct sockaddr_in *) saddrs[1])->sin_port = htons (port);
-
+          ((struct sockaddr_in *) saddrs[i])->sin_family = AF_INET;
+          ((struct sockaddr_in *) saddrs[i])->sin_port = htons (port);
         }
     }
+  GNUNET_free_non_null (unixpath);
   *addrs = saddrs;
   *addr_lens = saddrlens;
   return resi;
@@ -1019,15 +1114,14 @@ GNUNET_SERVICE_get_server_addresses (const char *serviceName,
 
 
 /**
- * Setup addr, addrlen, maxbuf, idle_timeout
+ * Setup addr, addrlen, idle_timeout
  * based on configuration!
  *
- * Configuration must specify a "PORT".  It may
- * specify:
+ * Configuration may specify:
+ * - PORT (where to bind to for TCP)
+ * - UNIXPATH (where to bind to for UNIX domain sockets)
  * - TIMEOUT (after how many ms does an inactive service timeout);
- * - MAXBUF (maximum incoming message size supported)
  * - DISABLEV6 (disable support for IPv6, otherwise we use dual-stack)
- * - ALLOW_SHUTDOWN (allow clients to shutdown this service)
  * - BINDTO (hostname or IP address to bind to, otherwise we take everything)
  * - ACCEPT_FROM  (only allow connections from specified IPv4 subnets)
  * - ACCEPT_FROM6 (only allow connections from specified IPv6 subnets)
@@ -1039,9 +1133,15 @@ GNUNET_SERVICE_get_server_addresses (const char *serviceName,
 static int
 setup_service (struct GNUNET_SERVICE_Context *sctx)
 {
-  unsigned long long maxbuf;
   struct GNUNET_TIME_Relative idleout;
   int tolerant;
+#ifndef MINGW
+  const char *lpid;
+  unsigned int pid;
+  const char *nfds;
+  unsigned int cnt;
+  int flags;
+#endif
 
   if (GNUNET_CONFIGURATION_have_value (sctx->cfg,
                                        sctx->serviceName, "TIMEOUT"))
@@ -1061,41 +1161,6 @@ setup_service (struct GNUNET_SERVICE_Context *sctx)
     }
   else
     sctx->timeout = GNUNET_TIME_UNIT_FOREVER_REL;
-  if (GNUNET_CONFIGURATION_have_value (sctx->cfg,
-                                       sctx->serviceName, "MAXBUF"))
-    {
-      if (GNUNET_OK !=
-          GNUNET_CONFIGURATION_get_value_number (sctx->cfg,
-                                                 sctx->serviceName,
-                                                 "MAXBUF", &maxbuf))
-       {
-         GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                     _("Specified value for `%s' of service `%s' is invalid\n"),
-                     "MAXBUF",
-                     sctx->serviceName);
-         return GNUNET_SYSERR;
-       }
-    }
-  else
-    maxbuf = GNUNET_SERVER_MAX_MESSAGE_SIZE;
-  if (GNUNET_CONFIGURATION_have_value (sctx->cfg,
-                                       sctx->serviceName, "ALLOW_SHUTDOWN"))
-    {
-      if (GNUNET_SYSERR ==
-          (sctx->allow_shutdown =
-           GNUNET_CONFIGURATION_get_value_yesno (sctx->cfg, sctx->serviceName,
-                                                 "ALLOW_SHUTDOWN")))
-       {
-         GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                     _("Specified value for `%s' of service `%s' is invalid\n"),
-                     "ALLOW_SHUTDOWN",
-                     sctx->serviceName);
-         return GNUNET_SYSERR;
-       }
-    }
-  else
-    sctx->allow_shutdown = GNUNET_NO;
-
 
   if (GNUNET_CONFIGURATION_have_value (sctx->cfg,
                                        sctx->serviceName, "TOLERANT"))
@@ -1115,23 +1180,55 @@ setup_service (struct GNUNET_SERVICE_Context *sctx)
   else
     tolerant = GNUNET_NO;
 
-  if (GNUNET_SYSERR ==
-      GNUNET_SERVICE_get_server_addresses (sctx->serviceName,
-                                          sctx->cfg,
-                                          &sctx->addrs,
-                                          &sctx->addrlens))
-    return GNUNET_SYSERR;
-  sctx->require_found = tolerant ? GNUNET_NO : GNUNET_YES;
-  sctx->maxbuf = (size_t) maxbuf;
-  if (sctx->maxbuf != maxbuf)
+#ifndef MINGW
+  errno = 0;
+  if ( (NULL != (lpid = getenv ("LISTEN_PID"))) &&
+       (1 == sscanf (lpid, "%u", &pid)) &&
+       (getpid () == (pid_t) pid) &&
+       (NULL != (nfds = getenv ("LISTEN_FDS"))) &&
+       (1 == sscanf (nfds, "%u", &cnt)) &&
+       (cnt > 0) &&
+       (cnt < FD_SETSIZE) &&
+       (cnt + 4 < FD_SETSIZE) )
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
-                  _
-                  ("Value in configuration for `%s' and service `%s' too large!\n"),
-                  "MAXBUF", sctx->serviceName);
-      return GNUNET_SYSERR;
+      sctx->lsocks = GNUNET_malloc (sizeof(struct GNUNET_NETWORK_Handle*) * (cnt+1));
+      while (0 < cnt--)
+       {
+         flags = fcntl (3 + cnt, F_GETFD);      
+         if ( (flags < 0) ||
+              (0 != (flags & FD_CLOEXEC)) ||
+              (NULL == (sctx->lsocks[cnt] = GNUNET_NETWORK_socket_box_native (3 + cnt))) )
+           {
+             GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                         _("Could not access pre-bound socket %u, will try to bind myself\n"),
+                         (unsigned int) 3 +cnt);
+             cnt++;
+             while (sctx->lsocks[cnt] != NULL)
+               GNUNET_break (0 == GNUNET_NETWORK_socket_close (sctx->lsocks[cnt++]));
+             GNUNET_free (sctx->lsocks);
+             sctx->lsocks = NULL;
+             break;
+           }
+       }
+      unsetenv ("LISTEN_PID");
+      unsetenv ("LISTEN_FDS");
     }
+#endif
 
+  if ( (sctx->lsocks == NULL) &&
+       (GNUNET_SYSERR ==
+       GNUNET_SERVICE_get_server_addresses (sctx->serviceName,
+                                            sctx->cfg,
+                                            &sctx->addrs,
+                                            &sctx->addrlens)) )
+    return GNUNET_SYSERR;
+  sctx->require_found = tolerant ? GNUNET_NO : GNUNET_YES;
+  sctx->match_uid = GNUNET_CONFIGURATION_get_value_yesno (sctx->cfg,
+                                                         sctx->serviceName,
+                                                         "UNIX_MATCH_UID");
+  sctx->match_gid = GNUNET_CONFIGURATION_get_value_yesno (sctx->cfg,
+                                                         sctx->serviceName,
+                                                         "UNIX_MATCH_GID");
   process_acl4 (&sctx->v4_denied, sctx, "REJECT_FROM");
   process_acl4 (&sctx->v4_allowed, sctx, "ACCEPT_FROM");
   process_acl6 (&sctx->v6_denied, sctx, "REJECT_FROM6");
@@ -1239,24 +1336,30 @@ service_task (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc)
   struct GNUNET_SERVICE_Context *sctx = cls;
   unsigned int i;
 
-  sctx->sched = tc->sched;
-  sctx->server = GNUNET_SERVER_create (tc->sched,
-                                       &check_access,
-                                       sctx,
-                                       sctx->addrs,
-                                       sctx->addrlens,
-                                       sctx->maxbuf,
-                                       sctx->timeout, sctx->require_found);
+  if (sctx->lsocks != NULL)
+    sctx->server = GNUNET_SERVER_create_with_sockets (&check_access,
+                                                     sctx,
+                                                     sctx->lsocks,
+                                                     sctx->timeout, sctx->require_found);
+  else
+    sctx->server = GNUNET_SERVER_create (&check_access,
+                                        sctx,
+                                        sctx->addrs,
+                                        sctx->addrlens,
+                                        sctx->timeout, sctx->require_found);
   if (sctx->server == NULL)
     {
-      i = 0;
-      while (sctx->addrs[i] != NULL)
+      if (sctx->addrs != NULL)
        {
-         GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                     _("Failed to start `%s' at `%s'\n"),
-                     sctx->serviceName, 
-                     GNUNET_a2s (sctx->addrs[i], sctx->addrlens[i]));
-         i++;
+         i = 0;
+         while (sctx->addrs[i] != NULL)
+           {
+             GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                         _("Failed to start `%s' at `%s'\n"),
+                         sctx->serviceName, 
+                         GNUNET_a2s (sctx->addrs[i], sctx->addrlens[i]));
+             i++;
+           }
        }
       sctx->ret = GNUNET_SYSERR;
       return;
@@ -1265,8 +1368,7 @@ service_task (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc)
     {
       /* install a task that will kill the server
          process if the scheduler ever gets a shutdown signal */
-      GNUNET_SCHEDULER_add_delayed (tc->sched,
-                                    GNUNET_TIME_UNIT_FOREVER_REL,
+      GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_FOREVER_REL,
                                     &shutdown_task, sctx->server);
     }
   sctx->my_handlers = GNUNET_malloc (sizeof (defhandlers));
@@ -1282,16 +1384,19 @@ service_task (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc)
       sctx->ready_confirm_fd = -1;
       write_pid_file (sctx, getpid ());
     }
-  i = 0;
-  while (sctx->addrs[i] != NULL)
+  if (sctx->addrs != NULL)
     {
-      GNUNET_log (GNUNET_ERROR_TYPE_INFO,
-                 _("Service `%s' runs at %s\n"),
-                 sctx->serviceName, 
-                 GNUNET_a2s (sctx->addrs[i], sctx->addrlens[i]));
-      i++;
+      i = 0;
+      while (sctx->addrs[i] != NULL)
+       {
+         GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                     _("Service `%s' runs at %s\n"),
+                     sctx->serviceName, 
+                     GNUNET_a2s (sctx->addrs[i], sctx->addrlens[i]));
+         i++;
+       }
     }
-  sctx->task (sctx->task_cls, tc->sched, sctx->server, sctx->cfg);
+  sctx->task (sctx->task_cls, sctx->server, sctx->cfg);
 }
 
 
@@ -1355,10 +1460,12 @@ detach_terminal (struct GNUNET_SERVICE_Context *sctx)
     return GNUNET_SYSERR;
   /* set stdin/stdout to /dev/null */
   if ((dup2 (nullfd, 0) < 0) || (dup2 (nullfd, 1) < 0))
-    {
+    {      
       GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "dup2");
+      (void) CLOSE (nullfd);
       return GNUNET_SYSERR;
     }
+  (void) CLOSE (nullfd);
   /* Detach from controlling terminal */
   pid = setsid ();
   if (pid == -1)
@@ -1484,8 +1591,8 @@ GNUNET_SERVICE_run (int argc,
   sctx.ready_confirm_fd = -1;
   sctx.ret = GNUNET_OK;
   sctx.timeout = GNUNET_TIME_UNIT_FOREVER_REL;
-  sctx.maxbuf = GNUNET_SERVER_MAX_MESSAGE_SIZE;
   sctx.task = task;
+  sctx.task_cls = task_cls;
   sctx.serviceName = serviceName;
   sctx.cfg = cfg = GNUNET_CONFIGURATION_create ();
   /* setup subsystems */
@@ -1547,13 +1654,11 @@ shutdown:
  * initialized system.
  *
  * @param serviceName our service name
- * @param sched scheduler to use
  * @param cfg configuration to use
  * @return NULL on error, service handle
  */
 struct GNUNET_SERVICE_Context *
 GNUNET_SERVICE_start (const char *serviceName,
-                      struct GNUNET_SCHEDULER_Handle *sched,
                       const struct GNUNET_CONFIGURATION_Handle *cfg)
 {
   int i;
@@ -1563,21 +1668,29 @@ GNUNET_SERVICE_start (const char *serviceName,
   sctx->ready_confirm_fd = -1;  /* no daemonizing */
   sctx->ret = GNUNET_OK;
   sctx->timeout = GNUNET_TIME_UNIT_FOREVER_REL;
-  sctx->maxbuf = GNUNET_SERVER_MAX_MESSAGE_SIZE;
   sctx->serviceName = serviceName;
   sctx->cfg = cfg;
-  sctx->sched = sched;
 
   /* setup subsystems */
-  if ((GNUNET_OK != setup_service (sctx)) ||
-      (NULL == (sctx->server = GNUNET_SERVER_create (sched,
-                                                     &check_access,
-                                                     sctx,
-                                                     sctx->addrs,
-                                                     sctx->addrlens,
-                                                     sctx->maxbuf,
-                                                     sctx->timeout,
-                                                     sctx->require_found))))
+  if (GNUNET_OK != setup_service (sctx))
+    {
+      GNUNET_SERVICE_stop (sctx);
+      return NULL;
+    }
+  if (sctx->lsocks != NULL)
+    sctx->server = GNUNET_SERVER_create_with_sockets (&check_access,
+                                                     sctx,
+                                                     sctx->lsocks,
+                                                     sctx->timeout, sctx->require_found);
+  else
+    sctx->server = GNUNET_SERVER_create (&check_access,
+                                        sctx,
+                                        sctx->addrs,
+                                        sctx->addrlens,
+                                        sctx->timeout,
+                                        sctx->require_found);
+                                        
+  if (NULL == sctx->server)
     {
       GNUNET_SERVICE_stop (sctx);
       return NULL;
@@ -1617,10 +1730,13 @@ GNUNET_SERVICE_stop (struct GNUNET_SERVICE_Context *sctx)
   if (NULL != sctx->server)
     GNUNET_SERVER_destroy (sctx->server);
   GNUNET_free_non_null (sctx->my_handlers);
-  i = 0;
-  while (sctx->addrs[i] != NULL)    
-    GNUNET_free (sctx->addrs[i++]);    
-  GNUNET_free_non_null (sctx->addrs);
+  if (sctx->addrs != NULL)
+    {
+      i = 0;
+      while (sctx->addrs[i] != NULL)    
+       GNUNET_free (sctx->addrs[i++]);    
+      GNUNET_free (sctx->addrs);
+    }
   GNUNET_free_non_null (sctx->addrlens);
   GNUNET_free_non_null (sctx->v4_denied);
   GNUNET_free_non_null (sctx->v6_denied);