usr.sbin/ypldap/ypldap.c

   1 /*      $OpenBSD: ypldap.c,v 1.16 2015/11/02 10:06:06 jmatthew Exp $ */
   2 /*      $FreeBSD */
   3
   4 /*
   5  * Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org>
   6  *
   7  * Permission to use, copy, modify, and distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18  */
  19
  20 #include <sys/types.h>
  21 #include <sys/param.h>
  22 #include <sys/queue.h>
  23 #include <sys/socket.h>
  24 #include <sys/signal.h>
  25 #include <sys/tree.h>
  26 #include <sys/wait.h>
  27
  28 #include <netinet/in.h>
  29 #include <arpa/inet.h>
  30
  31 #include <err.h>
  32 #include <errno.h>
  33 #include <event.h>
  34 #include <unistd.h>
  35 #include <pwd.h>
  36 #include <stdio.h>
  37 #include <stdlib.h>
  38 #include <string.h>
  39 #include <limits.h>
  40
  41 #include "ypldap.h"
  42
  43 enum ypldap_process_type                ypldap_process;
  44
  45 __dead2 void     usage(void);
  46 int              check_child(pid_t, const char *);
  47 void             main_sig_handler(int, short, void *);
  48 void             main_shutdown(void);
  49 void             main_dispatch_client(int, short, void *);
  50 void             main_configure_client(struct env *);
  51 void             main_init_timer(int, short, void *);
  52 void             main_start_update(struct env *);
  53 void             main_trash_update(struct env *);
  54 void             main_end_update(struct env *);
  55 int              main_create_user_groups(struct env *);
  56 void             purge_config(struct env *);
  57 void             reconfigure(struct env *);
  58
  59 int              pipe_main2client[2];
  60
  61 pid_t            client_pid = 0;
  62 char            *conffile = YPLDAP_CONF_FILE;
  63 int              opts = 0;
  64
  65 void
  66 usage(void)
  67 {
  68         extern const char       *__progname;
  69
  70         fprintf(stderr, "usage: %s [-dnv] [-D macro=value] [-f file]\n",
  71             __progname);
  72         exit(1);
  73 }
  74
  75 int
  76 check_child(pid_t pid, const char *pname)
  77 {
  78         int     status;
  79
  80         if (waitpid(pid, &status, WNOHANG) > 0) {
  81                 if (WIFEXITED(status)) {
  82                         log_warnx("check_child: lost child %s exited", pname);
  83                         return (1);
  84                 }
  85                 if (WIFSIGNALED(status)) {
  86                         log_warnx("check_child: lost child %s terminated; "
  87                             "signal %d", pname, WTERMSIG(status));
  88                         return (1);
  89                 }
  90         }
  91         return (0);
  92 }
  93
  94 /* ARGUSED */
  95 void
  96 main_sig_handler(int sig, short event, void *p)
  97 {
  98         int              die = 0;
  99
 100         switch (sig) {
 101         case SIGTERM:
 102         case SIGINT:
 103                 die = 1;
 104                 /* FALLTHROUGH */
 105         case SIGCHLD:
 106                 if (check_child(client_pid, "ldap client")) {
 107                         client_pid = 0;
 108                         die = 1;
 109                 }
 110                 if (die)
 111                         main_shutdown();
 112                 break;
 113         case SIGHUP:
 114                 /* reconfigure */
 115                 break;
 116         default:
 117                 fatalx("unexpected signal");
 118         }
 119 }
 120
 121 void
 122 main_shutdown(void)
 123 {
 124         _exit(0);
 125 }
 126
 127 void
 128 main_start_update(struct env *env)
 129 {
 130         env->update_trashed = 0;
 131
 132         log_debug("starting directory update");
 133         env->sc_user_line_len = 0;
 134         env->sc_group_line_len = 0;
 135         if ((env->sc_user_names_t = calloc(1,
 136             sizeof(*env->sc_user_names_t))) == NULL ||
 137             (env->sc_group_names_t = calloc(1,
 138             sizeof(*env->sc_group_names_t))) == NULL)
 139                 fatal(NULL);
 140         RB_INIT(env->sc_user_names_t);
 141         RB_INIT(env->sc_group_names_t);
 142 }
 143
 144 /*
 145  * XXX: Currently this function should only be called when updating is
 146  * finished. A notification should be send to ldapclient that it should stop
 147  * sending new pwd/grp entries before it can be called from different places.
 148  */
 149 void
 150 main_trash_update(struct env *env)
 151 {
 152         struct userent  *ue;
 153         struct groupent *ge;
 154
 155         env->update_trashed = 1;
 156
 157         while ((ue = RB_ROOT(env->sc_user_names_t)) != NULL) {
 158                 RB_REMOVE(user_name_tree,
 159                     env->sc_user_names_t, ue);
 160                 free(ue->ue_line);
 161                 free(ue->ue_netid_line);
 162                 free(ue);
 163         }
 164         free(env->sc_user_names_t);
 165         env->sc_user_names_t = NULL;
 166         while ((ge = RB_ROOT(env->sc_group_names_t))
 167             != NULL) {
 168                 RB_REMOVE(group_name_tree,
 169                     env->sc_group_names_t, ge);
 170                 free(ge->ge_line);
 171                 free(ge);
 172         }
 173         free(env->sc_group_names_t);
 174         env->sc_group_names_t = NULL;
 175 }
 176
 177 int
 178 main_create_user_groups(struct env *env)
 179 {
 180         struct userent          *ue;
 181         struct userent           ukey;
 182         struct groupent         *ge;
 183         gid_t                    pw_gid;
 184         char                    *bp, *cp;
 185         char                    *p;
 186         const char              *errstr = NULL;
 187         size_t                   len;
 188
 189         RB_FOREACH(ue, user_name_tree, env->sc_user_names_t) {
 190                 bp = cp = ue->ue_line;
 191
 192                 /* name */
 193                 bp += strlen(bp) + 1;
 194
 195                 /* password */
 196                 bp += strcspn(bp, ":") + 1;
 197
 198                 /* uid */
 199                 bp += strcspn(bp, ":") + 1;
 200
 201                 /* gid */
 202                 bp[strcspn(bp, ":")] = '\0';
 203
 204                 pw_gid = (gid_t)strtonum(bp, 0, GID_MAX, &errstr);
 205                 if (errstr) {
 206                         log_warnx("main: failed to parse gid for uid: %d\n", ue->ue_uid);
 207                         return (-1);
 208                 }
 209
 210                 /* bring gid column back to its proper state */
 211                 bp[strlen(bp)] = ':';
 212
 213                 if ((ue->ue_netid_line = calloc(1, LINE_WIDTH)) == NULL) {
 214                         return (-1);
 215                 }
 216
 217                 if (snprintf(ue->ue_netid_line, LINE_WIDTH-1, "%d:%d", ue->ue_uid, pw_gid) >= LINE_WIDTH) {
 218
 219                         return (-1);
 220                 }
 221
 222                 ue->ue_gid = pw_gid;
 223         }
 224
 225         RB_FOREACH(ge, group_name_tree, env->sc_group_names_t) {
 226                 bp = cp = ge->ge_line;
 227
 228                 /* name */
 229                 bp += strlen(bp) + 1;
 230
 231                 /* password */
 232                 bp += strcspn(bp, ":") + 1;
 233
 234                 /* gid */
 235                 bp += strcspn(bp, ":") + 1;
 236
 237                 cp = bp;
 238                 if (*bp == '\0')
 239                         continue;
 240                 bp = cp;
 241                 for (;;) {
 242                         if (!(cp = strsep(&bp, ",")))
 243                                 break;
 244                         ukey.ue_line = cp;
 245                         if ((ue = RB_FIND(user_name_tree, env->sc_user_names_t,
 246                             &ukey)) == NULL) {
 247                                 /* User not found */
 248                                 log_warnx("main: unknown user %s in group %s\n",
 249                                    ukey.ue_line, ge->ge_line);
 250                                 if (bp != NULL)
 251                                         *(bp-1) = ',';
 252                                 continue;
 253                         }
 254                         if (bp != NULL)
 255                                 *(bp-1) = ',';
 256
 257                         /* Make sure the new group doesn't equal to the main gid */
 258                         if (ge->ge_gid == ue->ue_gid)
 259                                 continue;
 260
 261                         len = strlen(ue->ue_netid_line);
 262                         p = ue->ue_netid_line + len;
 263
 264                         if ((snprintf(p, LINE_WIDTH-len-1, ",%d",
 265                                 ge->ge_gid)) >= (int)(LINE_WIDTH-len)) {
 266                                 return (-1);
 267                         }
 268                 }
 269         }
 270
 271         return (0);
 272 }
 273
 274 void
 275 main_end_update(struct env *env)
 276 {
 277         struct userent          *ue;
 278         struct groupent         *ge;
 279
 280         if (env->update_trashed)
 281                 return;
 282
 283         log_debug("updates are over, cleaning up trees now");
 284
 285         if (main_create_user_groups(env) == -1) {
 286                 main_trash_update(env);
 287                 return;
 288         }
 289
 290         if (env->sc_user_names == NULL) {
 291                 env->sc_user_names = env->sc_user_names_t;
 292                 env->sc_user_lines = NULL;
 293                 env->sc_user_names_t = NULL;
 294
 295                 env->sc_group_names = env->sc_group_names_t;
 296                 env->sc_group_lines = NULL;
 297                 env->sc_group_names_t = NULL;
 298
 299                 flatten_entries(env);
 300                 goto make_uids;
 301         }
 302
 303         /*
 304          * clean previous tree.
 305          */
 306         while ((ue = RB_ROOT(env->sc_user_names)) != NULL) {
 307                 RB_REMOVE(user_name_tree, env->sc_user_names,
 308                     ue);
 309                 free(ue->ue_netid_line);
 310                 free(ue);
 311         }
 312         free(env->sc_user_names);
 313         free(env->sc_user_lines);
 314
 315         env->sc_user_names = env->sc_user_names_t;
 316         env->sc_user_lines = NULL;
 317         env->sc_user_names_t = NULL;
 318
 319         while ((ge = RB_ROOT(env->sc_group_names)) != NULL) {
 320                 RB_REMOVE(group_name_tree,
 321                     env->sc_group_names, ge);
 322                 free(ge);
 323         }
 324         free(env->sc_group_names);
 325         free(env->sc_group_lines);
 326
 327         env->sc_group_names = env->sc_group_names_t;
 328         env->sc_group_lines = NULL;
 329         env->sc_group_names_t = NULL;
 330
 331
 332         flatten_entries(env);
 333
 334         /*
 335          * trees are flat now. build up uid, gid and netid trees.
 336          */
 337
 338 make_uids:
 339         RB_INIT(&env->sc_user_uids);
 340         RB_INIT(&env->sc_group_gids);
 341         RB_FOREACH(ue, user_name_tree, env->sc_user_names)
 342                 RB_INSERT(user_uid_tree,
 343                     &env->sc_user_uids, ue);
 344         RB_FOREACH(ge, group_name_tree, env->sc_group_names)
 345                 RB_INSERT(group_gid_tree,
 346                     &env->sc_group_gids, ge);
 347
 348 }
 349
 350 void
 351 main_dispatch_client(int fd, short events, void *p)
 352 {
 353         int              n;
 354         int              shut = 0;
 355         struct env      *env = p;
 356         struct imsgev   *iev = env->sc_iev;
 357         struct imsgbuf  *ibuf = &iev->ibuf;
 358         struct idm_req   ir;
 359         struct imsg      imsg;
 360
 361         if ((events & (EV_READ | EV_WRITE)) == 0)
 362                 fatalx("unknown event");
 363
 364         if (events & EV_READ) {
 365                 if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
 366                         fatal("imsg_read error");
 367                 if (n == 0)
 368                         shut = 1;
 369         }
 370         if (events & EV_WRITE) {
 371                 if ((n = msgbuf_write(&ibuf->w)) == -1 && errno != EAGAIN)
 372                         fatal("msgbuf_write");
 373                 if (n == 0)
 374                         shut = 1;
 375                 goto done;
 376         }
 377
 378         for (;;) {
 379                 if ((n = imsg_get(ibuf, &imsg)) == -1)
 380                         fatal("main_dispatch_client: imsg_get error");
 381                 if (n == 0)
 382                         break;
 383
 384                 switch (imsg.hdr.type) {
 385                 case IMSG_START_UPDATE:
 386                         main_start_update(env);
 387                         break;
 388                 case IMSG_PW_ENTRY: {
 389                         struct userent  *ue;
 390                         size_t           len;
 391
 392                         if (env->update_trashed)
 393                                 break;
 394
 395                         (void)memcpy(&ir, imsg.data, sizeof(ir));
 396                         if ((ue = calloc(1, sizeof(*ue))) == NULL ||
 397                             (ue->ue_line = strdup(ir.ir_line)) == NULL) {
 398                                 /*
 399                                  * should cancel tree update instead.
 400                                  */
 401                                 fatal("out of memory");
 402                         }
 403                         ue->ue_uid = ir.ir_key.ik_uid;
 404                         len = strlen(ue->ue_line) + 1;
 405                         ue->ue_line[strcspn(ue->ue_line, ":")] = '\0';
 406                         if (RB_INSERT(user_name_tree, env->sc_user_names_t,
 407                             ue) != NULL) { /* dup */
 408                                 free(ue->ue_line);
 409                                 free(ue);
 410                         } else
 411                                 env->sc_user_line_len += len;
 412                         break;
 413                 }
 414                 case IMSG_GRP_ENTRY: {
 415                         struct groupent *ge;
 416                         size_t           len;
 417
 418                         if (env->update_trashed)
 419                                 break;
 420
 421                         (void)memcpy(&ir, imsg.data, sizeof(ir));
 422                         if ((ge = calloc(1, sizeof(*ge))) == NULL ||
 423                             (ge->ge_line = strdup(ir.ir_line)) == NULL) {
 424                                 /*
 425                                  * should cancel tree update instead.
 426                                  */
 427                                 fatal("out of memory");
 428                         }
 429                         ge->ge_gid = ir.ir_key.ik_gid;
 430                         len = strlen(ge->ge_line) + 1;
 431                         ge->ge_line[strcspn(ge->ge_line, ":")] = '\0';
 432                         if (RB_INSERT(group_name_tree, env->sc_group_names_t,
 433                             ge) != NULL) { /* dup */
 434                                 free(ge->ge_line);
 435                                 free(ge);
 436                         } else
 437                                 env->sc_group_line_len += len;
 438                         break;
 439                 }
 440                 case IMSG_TRASH_UPDATE:
 441                         main_trash_update(env);
 442                         break;
 443                 case IMSG_END_UPDATE: {
 444                         main_end_update(env);
 445                         break;
 446                 }
 447                 default:
 448                         log_debug("main_dispatch_client: unexpected imsg %d",
 449                            imsg.hdr.type);
 450                         break;
 451                 }
 452                 imsg_free(&imsg);
 453         }
 454
 455 done:
 456         if (!shut)
 457                 imsg_event_add(iev);
 458         else {
 459                 log_debug("king bula sez: ran into dead pipe");
 460                 event_del(&iev->ev);
 461                 event_loopexit(NULL);
 462         }
 463 }
 464
 465 void
 466 main_configure_client(struct env *env)
 467 {
 468         struct idm      *idm;
 469         struct imsgev   *iev = env->sc_iev;
 470
 471         imsg_compose_event(iev, IMSG_CONF_START, 0, 0, -1, env, sizeof(*env));
 472         TAILQ_FOREACH(idm, &env->sc_idms, idm_entry) {
 473                 imsg_compose_event(iev, IMSG_CONF_IDM, 0, 0, -1,
 474                     idm, sizeof(*idm));
 475         }
 476         imsg_compose_event(iev, IMSG_CONF_END, 0, 0, -1, NULL, 0);
 477 }
 478
 479 void
 480 main_init_timer(int fd, short event, void *p)
 481 {
 482         struct env      *env = p;
 483
 484         main_configure_client(env);
 485 }
 486
 487 void
 488 purge_config(struct env *env)
 489 {
 490         struct idm      *idm;
 491
 492         while ((idm = TAILQ_FIRST(&env->sc_idms)) != NULL) {
 493                 TAILQ_REMOVE(&env->sc_idms, idm, idm_entry);
 494                 free(idm);
 495         }
 496 }
 497
 498 int
 499 main(int argc, char *argv[])
 500 {
 501         int              c;
 502         int              debug;
 503         struct passwd   *pw;
 504         struct env       env;
 505         struct event     ev_sigint;
 506         struct event     ev_sigterm;
 507         struct event     ev_sigchld;
 508         struct event     ev_sighup;
 509         struct event     ev_timer;
 510         struct timeval   tv;
 511
 512         debug = 0;
 513         ypldap_process = PROC_MAIN;
 514
 515         log_init(1);
 516
 517         while ((c = getopt(argc, argv, "dD:nf:v")) != -1) {
 518                 switch (c) {
 519                 case 'd':
 520                         debug = 2;
 521                         break;
 522                 case 'D':
 523                         if (cmdline_symset(optarg) < 0)
 524                                 log_warnx("could not parse macro definition %s",
 525                                     optarg);
 526                         break;
 527                 case 'n':
 528                         debug = 2;
 529                         opts |= YPLDAP_OPT_NOACTION;
 530                         break;
 531                 case 'f':
 532                         conffile = optarg;
 533                         break;
 534                 case 'v':
 535                         opts |= YPLDAP_OPT_VERBOSE;
 536                         break;
 537                 default:
 538                         usage();
 539                 }
 540         }
 541
 542         argc -= optind;
 543         argv += optind;
 544
 545         if (argc)
 546                 usage();
 547
 548         RB_INIT(&env.sc_user_uids);
 549         RB_INIT(&env.sc_group_gids);
 550
 551         if (parse_config(&env, conffile, opts))
 552                 exit(1);
 553         if (opts & YPLDAP_OPT_NOACTION) {
 554                 fprintf(stderr, "configuration OK\n");
 555                 exit(0);
 556         }
 557
 558         if (geteuid())
 559                 errx(1, "need root privileges");
 560
 561         log_init(debug);
 562
 563         if (!debug) {
 564                 if (daemon(1, 0) == -1)
 565                         err(1, "failed to daemonize");
 566         }
 567
 568         log_info("startup%s", (debug > 1)?" [debug mode]":"");
 569
 570         if (socketpair(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK, PF_UNSPEC,
 571             pipe_main2client) == -1)
 572                 fatal("socketpair");
 573
 574         client_pid = ldapclient(pipe_main2client);
 575
 576         setproctitle("parent");
 577         event_init();
 578
 579         signal_set(&ev_sigint, SIGINT, main_sig_handler, &env);
 580         signal_set(&ev_sigterm, SIGTERM, main_sig_handler, &env);
 581         signal_set(&ev_sighup, SIGHUP, main_sig_handler, &env);
 582         signal_set(&ev_sigchld, SIGCHLD, main_sig_handler, &env);
 583         signal_add(&ev_sigint, NULL);
 584         signal_add(&ev_sigterm, NULL);
 585         signal_add(&ev_sighup, NULL);
 586         signal_add(&ev_sigchld, NULL);
 587
 588         close(pipe_main2client[1]);
 589         if ((env.sc_iev = calloc(1, sizeof(*env.sc_iev))) == NULL)
 590                 fatal(NULL);
 591         imsg_init(&env.sc_iev->ibuf, pipe_main2client[0]);
 592         env.sc_iev->handler = main_dispatch_client;
 593
 594         env.sc_iev->events = EV_READ;
 595         env.sc_iev->data = &env;
 596         event_set(&env.sc_iev->ev, env.sc_iev->ibuf.fd, env.sc_iev->events,
 597              env.sc_iev->handler, &env);
 598         event_add(&env.sc_iev->ev, NULL);
 599
 600         yp_init(&env);
 601
 602         if ((pw = getpwnam(YPLDAP_USER)) == NULL)
 603                 fatal("getpwnam");
 604
 605 #ifndef DEBUG
 606         if (setgroups(1, &pw->pw_gid) ||
 607             setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
 608             setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))
 609                 fatal("cannot drop privileges");
 610 #else
 611 #warning disabling privilege revocation in debug mode
 612 #endif
 613
 614         memset(&tv, 0, sizeof(tv));
 615         evtimer_set(&ev_timer, main_init_timer, &env);
 616         evtimer_add(&ev_timer, &tv);
 617
 618         yp_enable_events();
 619         event_dispatch();
 620         main_shutdown();
 621
 622         return (0);
 623 }
 624
 625 void
 626 imsg_event_add(struct imsgev *iev)
 627 {
 628         if (iev->handler == NULL) {
 629                 imsg_flush(&iev->ibuf);
 630                 return;
 631         }
 632
 633         iev->events = EV_READ;
 634         if (iev->ibuf.w.queued)
 635                 iev->events |= EV_WRITE;
 636
 637         event_del(&iev->ev);
 638         event_set(&iev->ev, iev->ibuf.fd, iev->events, iev->handler, iev->data);
 639         event_add(&iev->ev, NULL);
 640 }
 641
 642 int
 643 imsg_compose_event(struct imsgev *iev, u_int16_t type, u_int32_t peerid,
 644     pid_t pid, int fd, void *data, u_int16_t datalen)
 645 {
 646         int     ret;
 647
 648         if ((ret = imsg_compose(&iev->ibuf, type, peerid,
 649             pid, fd, data, datalen)) != -1)
 650                 imsg_event_add(iev);
 651         return (ret);
 652 }