usr.sbin/ypldap/ypldap.c

   1 /*      $OpenBSD: ypldap.c,v 1.16 2015/11/02 10:06:06 jmatthew Exp $ */
   2 /*      $FreeBSD */
   3
   4 /*
   5  * Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org>
   6  *
   7  * Permission to use, copy, modify, and distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18  */
  19
  20 #include <sys/types.h>
  21 #include <sys/param.h>
  22 #include <sys/queue.h>
  23 #include <sys/socket.h>
  24 #include <sys/signal.h>
  25 #include <sys/tree.h>
  26 #include <sys/wait.h>
  27
  28 #include <netinet/in.h>
  29 #include <arpa/inet.h>
  30
  31 #include <err.h>
  32 #include <errno.h>
  33 #include <event.h>
  34 #include <unistd.h>
  35 #include <pwd.h>
  36 #include <stdio.h>
  37 #include <stdlib.h>
  38 #include <string.h>
  39 #include <limits.h>
  40
  41 #include "ypldap.h"
  42
  43 __dead2 void     usage(void);
  44 int              check_child(pid_t, const char *);
  45 void             main_sig_handler(int, short, void *);
  46 void             main_shutdown(void);
  47 void             main_dispatch_client(int, short, void *);
  48 void             main_configure_client(struct env *);
  49 void             main_init_timer(int, short, void *);
  50 void             main_start_update(struct env *);
  51 void             main_trash_update(struct env *);
  52 void             main_end_update(struct env *);
  53 int              main_create_user_groups(struct env *);
  54 void             purge_config(struct env *);
  55 void             reconfigure(struct env *);
  56
  57 int              pipe_main2client[2];
  58
  59 pid_t            client_pid = 0;
  60 char            *conffile = YPLDAP_CONF_FILE;
  61 int              opts = 0;
  62
  63 void
  64 usage(void)
  65 {
  66         extern const char       *__progname;
  67
  68         fprintf(stderr, "usage: %s [-dnv] [-D macro=value] [-f file]\n",
  69             __progname);
  70         exit(1);
  71 }
  72
  73 int
  74 check_child(pid_t pid, const char *pname)
  75 {
  76         int     status;
  77
  78         if (waitpid(pid, &status, WNOHANG) > 0) {
  79                 if (WIFEXITED(status)) {
  80                         log_warnx("check_child: lost child %s exited", pname);
  81                         return (1);
  82                 }
  83                 if (WIFSIGNALED(status)) {
  84                         log_warnx("check_child: lost child %s terminated; "
  85                             "signal %d", pname, WTERMSIG(status));
  86                         return (1);
  87                 }
  88         }
  89         return (0);
  90 }
  91
  92 /* ARGUSED */
  93 void
  94 main_sig_handler(int sig, short event, void *p)
  95 {
  96         int              die = 0;
  97
  98         switch (sig) {
  99         case SIGTERM:
 100         case SIGINT:
 101                 die = 1;
 102                 /* FALLTHROUGH */
 103         case SIGCHLD:
 104                 if (check_child(client_pid, "ldap client")) {
 105                         client_pid = 0;
 106                         die = 1;
 107                 }
 108                 if (die)
 109                         main_shutdown();
 110                 break;
 111         case SIGHUP:
 112                 /* reconfigure */
 113                 break;
 114         default:
 115                 fatalx("unexpected signal");
 116         }
 117 }
 118
 119 void
 120 main_shutdown(void)
 121 {
 122         _exit(0);
 123 }
 124
 125 void
 126 main_start_update(struct env *env)
 127 {
 128         env->update_trashed = 0;
 129
 130         log_debug("starting directory update");
 131         env->sc_user_line_len = 0;
 132         env->sc_group_line_len = 0;
 133         if ((env->sc_user_names_t = calloc(1,
 134             sizeof(*env->sc_user_names_t))) == NULL ||
 135             (env->sc_group_names_t = calloc(1,
 136             sizeof(*env->sc_group_names_t))) == NULL)
 137                 fatal(NULL);
 138         RB_INIT(env->sc_user_names_t);
 139         RB_INIT(env->sc_group_names_t);
 140 }
 141
 142 /*
 143  * XXX: Currently this function should only be called when updating is
 144  * finished. A notification should be send to ldapclient that it should stop
 145  * sending new pwd/grp entries before it can be called from different places.
 146  */
 147 void
 148 main_trash_update(struct env *env)
 149 {
 150         struct userent  *ue;
 151         struct groupent *ge;
 152
 153         env->update_trashed = 1;
 154
 155         while ((ue = RB_ROOT(env->sc_user_names_t)) != NULL) {
 156                 RB_REMOVE(user_name_tree,
 157                     env->sc_user_names_t, ue);
 158                 free(ue->ue_line);
 159                 free(ue->ue_netid_line);
 160                 free(ue);
 161         }
 162         free(env->sc_user_names_t);
 163         env->sc_user_names_t = NULL;
 164         while ((ge = RB_ROOT(env->sc_group_names_t))
 165             != NULL) {
 166                 RB_REMOVE(group_name_tree,
 167                     env->sc_group_names_t, ge);
 168                 free(ge->ge_line);
 169                 free(ge);
 170         }
 171         free(env->sc_group_names_t);
 172         env->sc_group_names_t = NULL;
 173 }
 174
 175 int
 176 main_create_user_groups(struct env *env)
 177 {
 178         struct userent          *ue;
 179         struct userent           ukey;
 180         struct groupent         *ge;
 181         gid_t                    pw_gid;
 182         char                    *bp, *cp;
 183         char                    *p;
 184         const char              *errstr = NULL;
 185         size_t                   len;
 186
 187         RB_FOREACH(ue, user_name_tree, env->sc_user_names_t) {
 188                 bp = cp = ue->ue_line;
 189
 190                 /* name */
 191                 bp += strlen(bp) + 1;
 192
 193                 /* password */
 194                 bp += strcspn(bp, ":") + 1;
 195
 196                 /* uid */
 197                 bp += strcspn(bp, ":") + 1;
 198
 199                 /* gid */
 200                 bp[strcspn(bp, ":")] = '\0';
 201
 202                 pw_gid = (gid_t)strtonum(bp, 0, GID_MAX, &errstr);
 203                 if (errstr) {
 204                         log_warnx("main: failed to parse gid for uid: %d\n", ue->ue_uid);
 205                         return (-1);
 206                 }
 207
 208                 /* bring gid column back to its proper state */
 209                 bp[strlen(bp)] = ':';
 210
 211                 if ((ue->ue_netid_line = calloc(1, LINE_WIDTH)) == NULL) {
 212                         return (-1);
 213                 }
 214
 215                 if (snprintf(ue->ue_netid_line, LINE_WIDTH-1, "%d:%d", ue->ue_uid, pw_gid) >= LINE_WIDTH) {
 216
 217                         return (-1);
 218                 }
 219
 220                 ue->ue_gid = pw_gid;
 221         }
 222
 223         RB_FOREACH(ge, group_name_tree, env->sc_group_names_t) {
 224                 bp = cp = ge->ge_line;
 225
 226                 /* name */
 227                 bp += strlen(bp) + 1;
 228
 229                 /* password */
 230                 bp += strcspn(bp, ":") + 1;
 231
 232                 /* gid */
 233                 bp += strcspn(bp, ":") + 1;
 234
 235                 cp = bp;
 236                 if (*bp == '\0')
 237                         continue;
 238                 bp = cp;
 239                 for (;;) {
 240                         if (!(cp = strsep(&bp, ",")))
 241                                 break;
 242                         ukey.ue_line = cp;
 243                         if ((ue = RB_FIND(user_name_tree, env->sc_user_names_t,
 244                             &ukey)) == NULL) {
 245                                 /* User not found */
 246                                 log_warnx("main: unknown user %s in group %s\n",
 247                                    ukey.ue_line, ge->ge_line);
 248                                 if (bp != NULL)
 249                                         *(bp-1) = ',';
 250                                 continue;
 251                         }
 252                         if (bp != NULL)
 253                                 *(bp-1) = ',';
 254
 255                         /* Make sure the new group doesn't equal to the main gid */
 256                         if (ge->ge_gid == ue->ue_gid)
 257                                 continue;
 258
 259                         len = strlen(ue->ue_netid_line);
 260                         p = ue->ue_netid_line + len;
 261
 262                         if ((snprintf(p, LINE_WIDTH-len-1, ",%d",
 263                                 ge->ge_gid)) >= (int)(LINE_WIDTH-len)) {
 264                                 return (-1);
 265                         }
 266                 }
 267         }
 268
 269         return (0);
 270 }
 271
 272 void
 273 main_end_update(struct env *env)
 274 {
 275         struct userent          *ue;
 276         struct groupent         *ge;
 277
 278         if (env->update_trashed)
 279                 return;
 280
 281         log_debug("updates are over, cleaning up trees now");
 282
 283         if (main_create_user_groups(env) == -1) {
 284                 main_trash_update(env);
 285                 return;
 286         }
 287
 288         if (env->sc_user_names == NULL) {
 289                 env->sc_user_names = env->sc_user_names_t;
 290                 env->sc_user_lines = NULL;
 291                 env->sc_user_names_t = NULL;
 292
 293                 env->sc_group_names = env->sc_group_names_t;
 294                 env->sc_group_lines = NULL;
 295                 env->sc_group_names_t = NULL;
 296
 297                 flatten_entries(env);
 298                 goto make_uids;
 299         }
 300
 301         /*
 302          * clean previous tree.
 303          */
 304         while ((ue = RB_ROOT(env->sc_user_names)) != NULL) {
 305                 RB_REMOVE(user_name_tree, env->sc_user_names,
 306                     ue);
 307                 free(ue->ue_netid_line);
 308                 free(ue);
 309         }
 310         free(env->sc_user_names);
 311         free(env->sc_user_lines);
 312
 313         env->sc_user_names = env->sc_user_names_t;
 314         env->sc_user_lines = NULL;
 315         env->sc_user_names_t = NULL;
 316
 317         while ((ge = RB_ROOT(env->sc_group_names)) != NULL) {
 318                 RB_REMOVE(group_name_tree,
 319                     env->sc_group_names, ge);
 320                 free(ge);
 321         }
 322         free(env->sc_group_names);
 323         free(env->sc_group_lines);
 324
 325         env->sc_group_names = env->sc_group_names_t;
 326         env->sc_group_lines = NULL;
 327         env->sc_group_names_t = NULL;
 328
 329
 330         flatten_entries(env);
 331
 332         /*
 333          * trees are flat now. build up uid, gid and netid trees.
 334          */
 335
 336 make_uids:
 337         RB_INIT(&env->sc_user_uids);
 338         RB_INIT(&env->sc_group_gids);
 339         RB_FOREACH(ue, user_name_tree, env->sc_user_names)
 340                 RB_INSERT(user_uid_tree,
 341                     &env->sc_user_uids, ue);
 342         RB_FOREACH(ge, group_name_tree, env->sc_group_names)
 343                 RB_INSERT(group_gid_tree,
 344                     &env->sc_group_gids, ge);
 345
 346 }
 347
 348 void
 349 main_dispatch_client(int fd, short events, void *p)
 350 {
 351         int              n;
 352         int              shut = 0;
 353         struct env      *env = p;
 354         struct imsgev   *iev = env->sc_iev;
 355         struct imsgbuf  *ibuf = &iev->ibuf;
 356         struct idm_req   ir;
 357         struct imsg      imsg;
 358
 359         if ((events & (EV_READ | EV_WRITE)) == 0)
 360                 fatalx("unknown event");
 361
 362         if (events & EV_READ) {
 363                 if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
 364                         fatal("imsg_read error");
 365                 if (n == 0)
 366                         shut = 1;
 367         }
 368         if (events & EV_WRITE) {
 369                 if ((n = msgbuf_write(&ibuf->w)) == -1 && errno != EAGAIN)
 370                         fatal("msgbuf_write");
 371                 if (n == 0)
 372                         shut = 1;
 373                 goto done;
 374         }
 375
 376         for (;;) {
 377                 if ((n = imsg_get(ibuf, &imsg)) == -1)
 378                         fatal("main_dispatch_client: imsg_get error");
 379                 if (n == 0)
 380                         break;
 381
 382                 switch (imsg.hdr.type) {
 383                 case IMSG_START_UPDATE:
 384                         main_start_update(env);
 385                         break;
 386                 case IMSG_PW_ENTRY: {
 387                         struct userent  *ue;
 388                         size_t           len;
 389
 390                         if (env->update_trashed)
 391                                 break;
 392
 393                         (void)memcpy(&ir, imsg.data, sizeof(ir));
 394                         if ((ue = calloc(1, sizeof(*ue))) == NULL ||
 395                             (ue->ue_line = strdup(ir.ir_line)) == NULL) {
 396                                 /*
 397                                  * should cancel tree update instead.
 398                                  */
 399                                 fatal("out of memory");
 400                         }
 401                         ue->ue_uid = ir.ir_key.ik_uid;
 402                         len = strlen(ue->ue_line) + 1;
 403                         ue->ue_line[strcspn(ue->ue_line, ":")] = '\0';
 404                         if (RB_INSERT(user_name_tree, env->sc_user_names_t,
 405                             ue) != NULL) { /* dup */
 406                                 free(ue->ue_line);
 407                                 free(ue);
 408                         } else
 409                                 env->sc_user_line_len += len;
 410                         break;
 411                 }
 412                 case IMSG_GRP_ENTRY: {
 413                         struct groupent *ge;
 414                         size_t           len;
 415
 416                         if (env->update_trashed)
 417                                 break;
 418
 419                         (void)memcpy(&ir, imsg.data, sizeof(ir));
 420                         if ((ge = calloc(1, sizeof(*ge))) == NULL ||
 421                             (ge->ge_line = strdup(ir.ir_line)) == NULL) {
 422                                 /*
 423                                  * should cancel tree update instead.
 424                                  */
 425                                 fatal("out of memory");
 426                         }
 427                         ge->ge_gid = ir.ir_key.ik_gid;
 428                         len = strlen(ge->ge_line) + 1;
 429                         ge->ge_line[strcspn(ge->ge_line, ":")] = '\0';
 430                         if (RB_INSERT(group_name_tree, env->sc_group_names_t,
 431                             ge) != NULL) { /* dup */
 432                                 free(ge->ge_line);
 433                                 free(ge);
 434                         } else
 435                                 env->sc_group_line_len += len;
 436                         break;
 437                 }
 438                 case IMSG_TRASH_UPDATE:
 439                         main_trash_update(env);
 440                         break;
 441                 case IMSG_END_UPDATE: {
 442                         main_end_update(env);
 443                         break;
 444                 }
 445                 default:
 446                         log_debug("main_dispatch_client: unexpected imsg %d",
 447                            imsg.hdr.type);
 448                         break;
 449                 }
 450                 imsg_free(&imsg);
 451         }
 452
 453 done:
 454         if (!shut)
 455                 imsg_event_add(iev);
 456         else {
 457                 log_debug("king bula sez: ran into dead pipe");
 458                 event_del(&iev->ev);
 459                 event_loopexit(NULL);
 460         }
 461 }
 462
 463 void
 464 main_configure_client(struct env *env)
 465 {
 466         struct idm      *idm;
 467         struct imsgev   *iev = env->sc_iev;
 468
 469         imsg_compose_event(iev, IMSG_CONF_START, 0, 0, -1, env, sizeof(*env));
 470         TAILQ_FOREACH(idm, &env->sc_idms, idm_entry) {
 471                 imsg_compose_event(iev, IMSG_CONF_IDM, 0, 0, -1,
 472                     idm, sizeof(*idm));
 473         }
 474         imsg_compose_event(iev, IMSG_CONF_END, 0, 0, -1, NULL, 0);
 475 }
 476
 477 void
 478 main_init_timer(int fd, short event, void *p)
 479 {
 480         struct env      *env = p;
 481
 482         main_configure_client(env);
 483 }
 484
 485 void
 486 purge_config(struct env *env)
 487 {
 488         struct idm      *idm;
 489
 490         while ((idm = TAILQ_FIRST(&env->sc_idms)) != NULL) {
 491                 TAILQ_REMOVE(&env->sc_idms, idm, idm_entry);
 492                 free(idm);
 493         }
 494 }
 495
 496 int
 497 main(int argc, char *argv[])
 498 {
 499         int              c;
 500         int              debug;
 501         struct passwd   *pw;
 502         struct env       env;
 503         struct event     ev_sigint;
 504         struct event     ev_sigterm;
 505         struct event     ev_sigchld;
 506         struct event     ev_sighup;
 507         struct event     ev_timer;
 508         struct timeval   tv;
 509
 510         debug = 0;
 511         ypldap_process = PROC_MAIN;
 512
 513         log_init(1);
 514
 515         while ((c = getopt(argc, argv, "dD:nf:v")) != -1) {
 516                 switch (c) {
 517                 case 'd':
 518                         debug = 2;
 519                         break;
 520                 case 'D':
 521                         if (cmdline_symset(optarg) < 0)
 522                                 log_warnx("could not parse macro definition %s",
 523                                     optarg);
 524                         break;
 525                 case 'n':
 526                         debug = 2;
 527                         opts |= YPLDAP_OPT_NOACTION;
 528                         break;
 529                 case 'f':
 530                         conffile = optarg;
 531                         break;
 532                 case 'v':
 533                         opts |= YPLDAP_OPT_VERBOSE;
 534                         break;
 535                 default:
 536                         usage();
 537                 }
 538         }
 539
 540         argc -= optind;
 541         argv += optind;
 542
 543         if (argc)
 544                 usage();
 545
 546         RB_INIT(&env.sc_user_uids);
 547         RB_INIT(&env.sc_group_gids);
 548
 549         if (parse_config(&env, conffile, opts))
 550                 exit(1);
 551         if (opts & YPLDAP_OPT_NOACTION) {
 552                 fprintf(stderr, "configuration OK\n");
 553                 exit(0);
 554         }
 555
 556         if (geteuid())
 557                 errx(1, "need root privileges");
 558
 559         log_init(debug);
 560
 561         if (!debug) {
 562                 if (daemon(1, 0) == -1)
 563                         err(1, "failed to daemonize");
 564         }
 565
 566         log_info("startup%s", (debug > 1)?" [debug mode]":"");
 567
 568         if (socketpair(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK, PF_UNSPEC,
 569             pipe_main2client) == -1)
 570                 fatal("socketpair");
 571
 572         client_pid = ldapclient(pipe_main2client);
 573
 574         setproctitle("parent");
 575         event_init();
 576
 577         signal_set(&ev_sigint, SIGINT, main_sig_handler, &env);
 578         signal_set(&ev_sigterm, SIGTERM, main_sig_handler, &env);
 579         signal_set(&ev_sighup, SIGHUP, main_sig_handler, &env);
 580         signal_set(&ev_sigchld, SIGCHLD, main_sig_handler, &env);
 581         signal_add(&ev_sigint, NULL);
 582         signal_add(&ev_sigterm, NULL);
 583         signal_add(&ev_sighup, NULL);
 584         signal_add(&ev_sigchld, NULL);
 585
 586         close(pipe_main2client[1]);
 587         if ((env.sc_iev = calloc(1, sizeof(*env.sc_iev))) == NULL)
 588                 fatal(NULL);
 589         imsg_init(&env.sc_iev->ibuf, pipe_main2client[0]);
 590         env.sc_iev->handler = main_dispatch_client;
 591
 592         env.sc_iev->events = EV_READ;
 593         env.sc_iev->data = &env;
 594         event_set(&env.sc_iev->ev, env.sc_iev->ibuf.fd, env.sc_iev->events,
 595              env.sc_iev->handler, &env);
 596         event_add(&env.sc_iev->ev, NULL);
 597
 598         yp_init(&env);
 599
 600         if ((pw = getpwnam(YPLDAP_USER)) == NULL)
 601                 fatal("getpwnam");
 602
 603 #ifndef DEBUG
 604         if (setgroups(1, &pw->pw_gid) ||
 605             setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
 606             setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))
 607                 fatal("cannot drop privileges");
 608 #else
 609 #warning disabling privilege revocation in debug mode
 610 #endif
 611
 612         memset(&tv, 0, sizeof(tv));
 613         evtimer_set(&ev_timer, main_init_timer, &env);
 614         evtimer_add(&ev_timer, &tv);
 615
 616         yp_enable_events();
 617         event_dispatch();
 618         main_shutdown();
 619
 620         return (0);
 621 }
 622
 623 void
 624 imsg_event_add(struct imsgev *iev)
 625 {
 626         if (iev->handler == NULL) {
 627                 imsg_flush(&iev->ibuf);
 628                 return;
 629         }
 630
 631         iev->events = EV_READ;
 632         if (iev->ibuf.w.queued)
 633                 iev->events |= EV_WRITE;
 634
 635         event_del(&iev->ev);
 636         event_set(&iev->ev, iev->ibuf.fd, iev->events, iev->handler, iev->data);
 637         event_add(&iev->ev, NULL);
 638 }
 639
 640 int
 641 imsg_compose_event(struct imsgev *iev, u_int16_t type, u_int32_t peerid,
 642     pid_t pid, int fd, void *data, u_int16_t datalen)
 643 {
 644         int     ret;
 645
 646         if ((ret = imsg_compose(&iev->ibuf, type, peerid,
 647             pid, fd, data, datalen)) != -1)
 648                 imsg_event_add(iev);
 649         return (ret);
 650 }