X-Git-Url: https://git.librecmc.org/?a=blobdiff_plain;f=printutils%2Flpd.c;h=43c22948ff868020ced54365edd8df401b348b40;hb=0d602e9386cc651ca0ba534b309fce0582fa8e99;hp=45ad6d7e50e9d6499bdc3d2069cf8edd759d5609;hpb=a79428998d76c1758ca12546e5db945a0cd64518;p=oweals%2Fbusybox.git diff --git a/printutils/lpd.c b/printutils/lpd.c index 45ad6d7e5..43c22948f 100644 --- a/printutils/lpd.c +++ b/printutils/lpd.c @@ -9,56 +9,68 @@ /* * A typical usage of BB lpd looks as follows: - * # tcpsvd -E 0 515 lpd SPOOLDIR [HELPER-PROG [ARGS...]] - * - * This means a network listener is started on port 515 (default for LP protocol). - * When a client connection is made (via lpr) lpd first change its working directory to SPOOLDIR. - * - * SPOOLDIR is the spool directory which contains printing queues + * # tcpsvd -E 0 515 lpd [SPOOLDIR] [HELPER-PROG [ARGS...]] + * + * This starts TCP listener on port 515 (default for LP protocol). + * When a client connection is made (via lpr) lpd first changes its + * working directory to SPOOLDIR (current dir is the default). + * + * SPOOLDIR is the spool directory which contains printing queues * and should have the following structure: - * + * * SPOOLDIR/ - * - * ... - * - * + * + * ... + * + * * can be of two types: - * A. a printer character device or an ordinary file a link to such; - * B. a directory. - * - * In case A lpd just dumps the data it receives from client (lpr) to the + * A. a printer character device, an ordinary file or a link to such; + * B. a directory. + * + * In case A lpd just dumps the data it receives from client (lpr) to the * end of queue file/device. This is non-spooling mode. - * - * In case B lpd enters spooling mode. It reliably saves client data along with control info - * in two unique files under the queue directory. These files are named dfAXXXHHHH and cfAXXXHHHH, - * where XXX is the job number and HHHH is the client hostname. Unless a printing helper application + * + * In case B lpd enters spooling mode. It reliably saves client data along + * with control info in two unique files under the queue directory. These + * files are named dfAXXXHHHH and cfAXXXHHHH, where XXX is the job number + * and HHHH is the client hostname. Unless a printing helper application * is specified lpd is done at this point. - * - * If HELPER-PROG (with optional arguments) is specified then lpd continues to process client data: - * 1. it reads and parses control file (cfA...). The parse process results in setting environment - * variables whose values were passed in control file; when parsing is complete, lpd deletes - * control file. - * 2. it spawns specified helper application. It is then the helper application who is responsible - * for both actual printing and deleting processed data file. - * - * A good lpr passes control files which when parsed provide the following variables: + * + * NB: file names are produced by peer! They actually may be anything at all. + * lpd only sanitizes them (by removing most non-alphanumerics). + * + * If HELPER-PROG (with optional arguments) is specified then lpd continues + * to process client data: + * 1. it reads and parses control file (cfA...). The parse process + * results in setting environment variables whose values were passed + * in control file; when parsing is complete, lpd deletes control file. + * 2. it spawns specified helper application. It is then + * the helper application who is responsible for both actual printing + * and deleting of processed data file. + * + * A good lpr passes control files which when parsed provides the following + * variables: * $H = host which issues the job * $P = user who prints * $C = class of printing (what is printed on banner page) * $J = the name of the job * $L = print banner page * $M = the user to whom a mail should be sent if a problem occurs + * + * We specifically filter out and NOT provide: * $l = name of datafile ("dfAxxx") - file whose content are to be printed - * + * + * lpd provides $DATAFILE instead - the ACTUAL name + * of the datafile under which it was saved. + * $l would be not reliable (you would be at mercy of remote peer). + * * Thus, a typical helper can be something like this: * #!/bin/sh - * cat "$l" >/dev/lp0 - * mv -f "$l" save/ - * + * cat ./"$DATAFILE" >/dev/lp0 + * mv -f ./"$DATAFILE" save/ */ -#include "libbb.h" -// TODO: xmalloc_reads is vulnerable to remote OOM attack! +#include "libbb.h" // strip argument of bad chars static char *sane(char *str) @@ -66,7 +78,7 @@ static char *sane(char *str) char *s = str; char *p = s; while (*s) { - if (isalnum(*s) || '-' == *s) { + if (isalnum(*s) || '-' == *s || '_' == *s) { *p++ = *s; } s++; @@ -75,87 +87,50 @@ static char *sane(char *str) return str; } -static void exec_helper(const char *fname, char **argv) +static char *xmalloc_read_stdin(void) { - char *p, *q, *file; - char *our_env[12]; - int env_idx; - - // read control file - file = q = xmalloc_open_read_close(fname, NULL); - // delete control file - unlink(fname); - // parse control file by "\n" - env_idx = 0; - while ((p = strchr(q, '\n')) != NULL - && isalpha(*q) - && env_idx < ARRAY_SIZE(our_env) - ) { - *p++ = '\0'; - // here q is a line of - // let us set environment string = - // N.B. setenv is leaky! - // We have to use putenv(malloced_str), - // and unsetenv+free (in parent) - our_env[env_idx] = xasprintf("%c=%s", *q, q+1); - putenv(our_env[env_idx]); - env_idx++; - // next line, plz! - q = p; - } - - if (vfork() == 0) { - // CHILD - // we are the helper. we wanna be silent - // this call reopens stdio fds to "/dev/null" - // (no daemonization is done) - bb_daemonize_or_rexec(DAEMON_DEVNULL_STDIO | DAEMON_ONLY_SANITIZE, NULL); - BB_EXECVP(*argv, argv); - _exit(127); - } - - // PARENT (or vfork error) - // clean up... - free(file); - while (--env_idx >= 0) { - *strchrnul(our_env[env_idx], '=') = '\0'; - unsetenv(our_env[env_idx]); - } + // SECURITY: + size_t max = 4 * 1024; // more than enough for commands! + return xmalloc_reads(STDIN_FILENO, NULL, &max); } int lpd_main(int argc, char *argv[]) MAIN_EXTERNALLY_VISIBLE; -int lpd_main(int argc ATTRIBUTE_UNUSED, char *argv[]) +int lpd_main(int argc UNUSED_PARAM, char *argv[]) { - int spooling; + int spooling = spooling; // for compiler char *s, *queue; + char *filenames[2]; - // read command - s = xmalloc_reads(STDIN_FILENO, NULL); + // goto spool directory + if (*++argv) + xchdir(*argv++); + // error messages of xfuncs will be sent over network + xdup2(STDOUT_FILENO, STDERR_FILENO); + + // nullify ctrl/data filenames + memset(filenames, 0, sizeof(filenames)); + + // read command + s = queue = xmalloc_read_stdin(); // we understand only "receive job" command - if (2 != *s) { + if (2 != *queue) { unsupported_cmd: printf("Command %02x %s\n", (unsigned char)s[0], "is not supported"); - return EXIT_FAILURE; + goto err_exit; } - // goto spool directory - if (*++argv) - xchdir(*argv++); - - // parse command: "\x2QUEUE_NAME\n" - queue = s + 1; - *strchrnul(s, '\n') = '\0'; - + // parse command: "2 | QUEUE_NAME | '\n'" + queue++; // protect against "/../" attacks + // *strchrnul(queue, '\n') = '\0'; - redundant, sane() will do if (!*sane(queue)) return EXIT_FAILURE; // queue is a directory -> chdir to it and enter spooling mode - spooling = chdir(queue) + 1; /* 0: cannot chdir, 1: done */ - - xdup2(STDOUT_FILENO, STDERR_FILENO); + spooling = chdir(queue) + 1; // 0: cannot chdir, 1: done + // we don't free(s), we might need "queue" var later while (1) { char *fname; @@ -165,30 +140,94 @@ int lpd_main(int argc ATTRIBUTE_UNUSED, char *argv[]) int expected_len, real_len; // signal OK - write(STDOUT_FILENO, "", 1); + safe_write(STDOUT_FILENO, "", 1); // get subcommand - s = xmalloc_reads(STDIN_FILENO, NULL); - if (!s) - return EXIT_SUCCESS; // probably EOF + // valid s must be of form: "SUBCMD | LEN | space | FNAME" + // N.B. we bail out on any error + s = xmalloc_read_stdin(); + if (!s) { // (probably) EOF + char *p, *q, var[2]; + + // non-spooling mode or no spool helper specified + if (!spooling || !*argv) + return EXIT_SUCCESS; // the only non-error exit + // spooling mode but we didn't see both ctrlfile & datafile + if (spooling != 7) + goto err_exit; // reject job + + // spooling mode and spool helper specified -> exec spool helper + // (we exit 127 if helper cannot be executed) + var[1] = '\0'; + // read and delete ctrlfile + q = xmalloc_xopen_read_close(filenames[0], NULL); + unlink(filenames[0]); + // provide datafile name + // we can use leaky setenv since we are about to exec or exit + xsetenv("DATAFILE", filenames[1]); + // parse control file by "\n" + while ((p = strchr(q, '\n')) != NULL && isalpha(*q)) { + *p++ = '\0'; + // q is a line of , + // we are setting environment string =. + // Ignoring "l", exporting others: + if (*q != 'l') { + var[0] = *q++; + xsetenv(var, q); + } + q = p; // next line + } + // helper should not talk over network. + // this call reopens stdio fds to "/dev/null" + // (no daemonization is done) + bb_daemonize_or_rexec(DAEMON_DEVNULL_STDIO | DAEMON_ONLY_SANITIZE, NULL); + BB_EXECVP(*argv, argv); + exit(127); + } + + // validate input. // we understand only "control file" or "data file" cmds if (2 != s[0] && 3 != s[0]) goto unsupported_cmd; - + if (spooling & (1 << (s[0]-1))) { + printf("Duplicated subcommand\n"); + goto err_exit; + } + // get filename *strchrnul(s, '\n') = '\0'; - // valid s must be of form: SUBCMD | LEN | SP | FNAME - // N.B. we bail out on any error fname = strchr(s, ' '); if (!fname) { - printf("Command %02x %s\n", - (unsigned char)s[0], "lacks filename"); - return EXIT_FAILURE; +// bad_fname: + printf("No or bad filename\n"); + goto err_exit; } *fname++ = '\0'; +// // s[0]==2: ctrlfile, must start with 'c' +// // s[0]==3: datafile, must start with 'd' +// if (fname[0] != s[0] + ('c'-2)) +// goto bad_fname; + // get length + expected_len = bb_strtou(s + 1, NULL, 10); + if (errno || expected_len < 0) { + printf("Bad length\n"); + goto err_exit; + } + if (2 == s[0] && expected_len > 16 * 1024) { + // SECURITY: + // ctrlfile can't be big (we want to read it back later!) + printf("File is too big\n"); + goto err_exit; + } + + // open the file if (spooling) { // spooling mode: dump both files // job in flight has mode 0200 "only writable" - fd = xopen3(sane(fname), O_CREAT | O_WRONLY | O_TRUNC | O_EXCL, 0200); + sane(fname); + fd = open3_or_warn(fname, O_CREAT | O_WRONLY | O_TRUNC | O_EXCL, 0200); + if (fd < 0) + goto err_exit; + filenames[s[0] - 2] = xstrdup(fname); } else { // non-spooling mode: // 2: control file (ignoring), 3: data file @@ -196,35 +235,48 @@ int lpd_main(int argc ATTRIBUTE_UNUSED, char *argv[]) if (3 == s[0]) fd = xopen(queue, O_RDWR | O_APPEND); } - expected_len = xatoi_u(s + 1); + + // signal OK + safe_write(STDOUT_FILENO, "", 1); + + // copy the file real_len = bb_copyfd_size(STDIN_FILENO, fd, expected_len); - if (spooling && real_len != expected_len) { - unlink(fname); // don't keep corrupted files + if (real_len != expected_len) { printf("Expected %d but got %d bytes\n", expected_len, real_len); - return EXIT_FAILURE; + goto err_exit; + } + // get EOF indicator, see whether it is NUL (ok) + // (and don't trash s[0]!) + if (safe_read(STDIN_FILENO, &s[1], 1) != 1 || s[1] != 0) { + // don't send error msg to peer - it obviously + // doesn't follow the protocol, so probably + // it can't understand us either + goto err_exit; } - // chmod completely downloaded file as "readable+writable" ... + if (spooling) { + // chmod completely downloaded file as "readable+writable" fchmod(fd, 0600); - // ... and accumulate dump state. - // N.B. after all files are dumped spooling should be 1+2+3==6 - spooling += s[0]; + // accumulate dump state + // N.B. after all files are dumped spooling should be 1+2+4==7 + spooling |= (1 << (s[0]-1)); // bit 1: ctrlfile; bit 2: datafile } - close(fd); // NB: can do close(-1). Who cares? - // are all files dumped? -> spawn spool helper - if (6 == spooling && *argv) { - fname[0] = 'c'; // pass control file name - exec_helper(fname, argv); - } - // get ACK and see whether it is NUL (ok) - if (read(STDIN_FILENO, s, 1) != 1 || s[0] != 0) { - // don't send error msg to peer - it obviously - // don't follow the protocol, so probably - // it can't understand us either - return EXIT_FAILURE; - } free(s); - } /* while (1) */ + close(fd); // NB: can do close(-1). Who cares? + + // NB: don't do "signal OK" write here, it will be done + // at the top of the loop + } // while (1) + + err_exit: + // don't keep corrupted files + if (spooling) { +#define i spooling + for (i = 2; --i >= 0; ) + if (filenames[i]) + unlink(filenames[i]); + } + return EXIT_FAILURE; }