*/
struct GNUNET_SERVER_Handle *server;
- /**
- * Scheduler for the server.
- */
- struct GNUNET_SCHEDULER_Handle *sched;
-
/**
* NULL-terminated array of addresses to bind to, NULL if we got pre-bound
* listen sockets.
*/
int require_found;
+ /**
+ * Do we require a matching UID for UNIX domain socket
+ * connections?
+ */
+ int match_uid;
+
+ /**
+ * Do we require a matching GID for UNIX domain socket
+ * connections?
+ */
+ int match_gid;
+
/**
* Our options.
*/
/**
* Check if access to the service is allowed from the given address.
+ *
+ * @param cls closure
+ * @param uc credentials, if available, otherwise NULL
+ * @param addr address
+ * @param addrlen length of address
+ * @return GNUNET_YES to allow, GNUNET_NO to deny, GNUNET_SYSERR
+ * for unknown address family (will be denied).
*/
static int
-check_access (void *cls, const struct sockaddr *addr, socklen_t addrlen)
+check_access (void *cls,
+ const struct GNUNET_CONNECTION_Credentials *uc,
+ const struct sockaddr *addr, socklen_t addrlen)
{
struct GNUNET_SERVICE_Context *sctx = cls;
const struct sockaddr_in *i4;
(!check_ipv6_listed (sctx->v6_denied, &i6->sin6_addr)));
break;
case AF_UNIX:
- /* FIXME: support checking UID/GID in the future... */
ret = GNUNET_OK; /* always OK for now */
+ if ( (sctx->match_uid == GNUNET_YES) ||
+ (sctx->match_gid == GNUNET_YES) )
+ ret = GNUNET_NO;
+ if ( (uc != NULL) &&
+ ( (sctx->match_uid != GNUNET_YES) ||
+ (uc->uid == geteuid()) ||
+ (uc->uid == getuid()) ) &&
+ ( (sctx->match_gid != GNUNET_YES) ||
+ (uc->gid == getegid()) ||
+ (uc->gid == getgid())) )
+ ret = GNUNET_YES;
+ else
+ GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+ _("Access denied to UID %d / GID %d\n"),
+ (uc == NULL) ? -1 : uc->uid,
+ (uc == NULL) ? -1 : uc->gid);
break;
default:
GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
if (GNUNET_CONFIGURATION_have_value (cfg,
serviceName, "UNIXPATH"))
{
- GNUNET_break (GNUNET_OK ==
+ GNUNET_assert (GNUNET_OK ==
GNUNET_CONFIGURATION_get_value_string (cfg,
serviceName,
"UNIXPATH",
&unixpath));
/* probe UNIX support */
+ struct sockaddr_un s_un;
+ if (strlen(unixpath) >= sizeof(s_un.sun_path))
+ {
+ GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+ _("UNIXPATH `%s' too long, maximum length is %llu\n"),unixpath, sizeof(s_un.sun_path));
+ GNUNET_free_non_null (hostname);
+ GNUNET_free (unixpath);
+ return GNUNET_SYSERR;
+ }
+
desc = GNUNET_NETWORK_socket_create (AF_UNIX, SOCK_STREAM, 0);
if (NULL == desc)
{
saddrlens = GNUNET_malloc (2 * sizeof (socklen_t));
add_unixpath (saddrs, saddrlens, unixpath);
GNUNET_free_non_null (unixpath);
+ GNUNET_free_non_null(hostname);
*addrs = saddrs;
*addr_lens = saddrlens;
return 1;
{
struct GNUNET_TIME_Relative idleout;
int tolerant;
+#ifndef MINGW
const char *lpid;
unsigned int pid;
const char *nfds;
unsigned int cnt;
int flags;
+#endif
if (GNUNET_CONFIGURATION_have_value (sctx->cfg,
sctx->serviceName, "TIMEOUT"))
(getpid () == (pid_t) pid) &&
(NULL != (nfds = getenv ("LISTEN_FDS"))) &&
(1 == sscanf (nfds, "%u", &cnt)) &&
- (cnt > 0) )
+ (cnt > 0) &&
+ (cnt < FD_SETSIZE) &&
+ (cnt + 4 < FD_SETSIZE) )
{
sctx->lsocks = GNUNET_malloc (sizeof(struct GNUNET_NETWORK_Handle*) * (cnt+1));
while (0 < cnt--)
&sctx->addrlens)) )
return GNUNET_SYSERR;
sctx->require_found = tolerant ? GNUNET_NO : GNUNET_YES;
-
+ sctx->match_uid = GNUNET_CONFIGURATION_get_value_yesno (sctx->cfg,
+ sctx->serviceName,
+ "UNIX_MATCH_UID");
+ sctx->match_gid = GNUNET_CONFIGURATION_get_value_yesno (sctx->cfg,
+ sctx->serviceName,
+ "UNIX_MATCH_GID");
process_acl4 (&sctx->v4_denied, sctx, "REJECT_FROM");
process_acl4 (&sctx->v4_allowed, sctx, "ACCEPT_FROM");
process_acl6 (&sctx->v6_denied, sctx, "REJECT_FROM6");
struct GNUNET_SERVICE_Context *sctx = cls;
unsigned int i;
- sctx->sched = tc->sched;
if (sctx->lsocks != NULL)
- sctx->server = GNUNET_SERVER_create_with_sockets (tc->sched,
- &check_access,
+ sctx->server = GNUNET_SERVER_create_with_sockets (&check_access,
sctx,
sctx->lsocks,
sctx->timeout, sctx->require_found);
else
- sctx->server = GNUNET_SERVER_create (tc->sched,
- &check_access,
+ sctx->server = GNUNET_SERVER_create (&check_access,
sctx,
sctx->addrs,
sctx->addrlens,
{
/* install a task that will kill the server
process if the scheduler ever gets a shutdown signal */
- GNUNET_SCHEDULER_add_delayed (tc->sched,
- GNUNET_TIME_UNIT_FOREVER_REL,
+ GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_FOREVER_REL,
&shutdown_task, sctx->server);
}
sctx->my_handlers = GNUNET_malloc (sizeof (defhandlers));
i++;
}
}
- sctx->task (sctx->task_cls, tc->sched, sctx->server, sctx->cfg);
+ sctx->task (sctx->task_cls, sctx->server, sctx->cfg);
}
return GNUNET_SYSERR;
/* set stdin/stdout to /dev/null */
if ((dup2 (nullfd, 0) < 0) || (dup2 (nullfd, 1) < 0))
- {
+ {
GNUNET_log_strerror (GNUNET_ERROR_TYPE_ERROR, "dup2");
+ (void) CLOSE (nullfd);
return GNUNET_SYSERR;
}
+ (void) CLOSE (nullfd);
/* Detach from controlling terminal */
pid = setsid ();
if (pid == -1)
sctx.ret = GNUNET_OK;
sctx.timeout = GNUNET_TIME_UNIT_FOREVER_REL;
sctx.task = task;
+ sctx.task_cls = task_cls;
sctx.serviceName = serviceName;
sctx.cfg = cfg = GNUNET_CONFIGURATION_create ();
/* setup subsystems */
* initialized system.
*
* @param serviceName our service name
- * @param sched scheduler to use
* @param cfg configuration to use
* @return NULL on error, service handle
*/
struct GNUNET_SERVICE_Context *
GNUNET_SERVICE_start (const char *serviceName,
- struct GNUNET_SCHEDULER_Handle *sched,
const struct GNUNET_CONFIGURATION_Handle *cfg)
{
int i;
sctx->timeout = GNUNET_TIME_UNIT_FOREVER_REL;
sctx->serviceName = serviceName;
sctx->cfg = cfg;
- sctx->sched = sched;
/* setup subsystems */
if (GNUNET_OK != setup_service (sctx))
return NULL;
}
if (sctx->lsocks != NULL)
- sctx->server = GNUNET_SERVER_create_with_sockets (sched,
- &check_access,
+ sctx->server = GNUNET_SERVER_create_with_sockets (&check_access,
sctx,
sctx->lsocks,
sctx->timeout, sctx->require_found);
else
- sctx->server = GNUNET_SERVER_create (sched,
- &check_access,
+ sctx->server = GNUNET_SERVER_create (&check_access,
sctx,
sctx->addrs,
sctx->addrlens,
projects / oweals / gnunet.git / blobdiff