1 /* $OpenBSD: ypldap.c,v 1.24 2023/03/31 03:38:26 jmatthew Exp $ */
2
3 /*
4 * Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19 #include <sys/types.h>
20 #include <sys/queue.h>
21 #include <sys/socket.h>
22 #include <sys/signal.h>
23 #include <sys/tree.h>
24 #include <sys/wait.h>
25
26 #include <netinet/in.h>
27 #include <arpa/inet.h>
28
29 #include <err.h>
30 #include <errno.h>
31 #include <event.h>
32 #include <unistd.h>
33 #include <pwd.h>
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <string.h>
37 #include <limits.h>
38
39 #include "ypldap.h"
40 #include "log.h"
41
42 __dead void usage(void);
43 int check_child(pid_t, const char *);
44 void main_sig_handler(int, short, void *);
45 void main_shutdown(void);
46 void main_dispatch_client(int, short, void *);
47 void main_configure_client(struct env *);
48 void main_init_timer(int, short, void *);
49 void main_start_update(struct env *);
50 void main_trash_update(struct env *);
51 void main_end_update(struct env *);
52 int main_create_user_groups(struct env *);
53 void purge_config(struct env *);
54 void reconfigure(struct env *);
55
56 int pipe_main2client[2];
57
58 pid_t client_pid = 0;
59 char *conffile = YPLDAP_CONF_FILE;
60 int opts = 0;
61
62 enum privsep_procid ypldap_process;
63
64 void
usage(void)65 usage(void)
66 {
67 extern const char *__progname;
68
69 fprintf(stderr, "usage: %s [-dnv] [-D macro=value] [-f file]\n",
70 __progname);
71 exit(1);
72 }
73
74 int
check_child(pid_t pid,const char * pname)75 check_child(pid_t pid, const char *pname)
76 {
77 int status;
78
79 if (waitpid(pid, &status, WNOHANG) > 0) {
80 if (WIFEXITED(status)) {
81 log_warnx("check_child: lost child %s exited", pname);
82 return (1);
83 }
84 if (WIFSIGNALED(status)) {
85 log_warnx("check_child: lost child %s terminated; "
86 "signal %d", pname, WTERMSIG(status));
87 return (1);
88 }
89 }
90 return (0);
91 }
92
93 /* ARGUSED */
94 void
main_sig_handler(int sig,short event,void * p)95 main_sig_handler(int sig, short event, void *p)
96 {
97 int die = 0;
98
99 switch (sig) {
100 case SIGTERM:
101 case SIGINT:
102 die = 1;
103 /* FALLTHROUGH */
104 case SIGCHLD:
105 if (check_child(client_pid, "ldap client")) {
106 client_pid = 0;
107 die = 1;
108 }
109 if (die)
110 main_shutdown();
111 break;
112 case SIGHUP:
113 /* reconfigure */
114 break;
115 default:
116 fatalx("unexpected signal");
117 }
118 }
119
120 void
main_shutdown(void)121 main_shutdown(void)
122 {
123 _exit(0);
124 }
125
126 void
main_start_update(struct env * env)127 main_start_update(struct env *env)
128 {
129 env->update_trashed = 0;
130
131 log_debug("starting directory update");
132 env->sc_user_line_len = 0;
133 env->sc_group_line_len = 0;
134 if ((env->sc_user_names_t = calloc(1,
135 sizeof(*env->sc_user_names_t))) == NULL ||
136 (env->sc_group_names_t = calloc(1,
137 sizeof(*env->sc_group_names_t))) == NULL)
138 fatal(NULL);
139 RB_INIT(env->sc_user_names_t);
140 RB_INIT(env->sc_group_names_t);
141 }
142
143 /*
144 * XXX: Currently this function should only be called when updating is
145 * finished. A notification should be send to ldapclient that it should stop
146 * sending new pwd/grp entries before it can be called from different places.
147 */
148 void
main_trash_update(struct env * env)149 main_trash_update(struct env *env)
150 {
151 struct userent *ue;
152 struct groupent *ge;
153
154 env->update_trashed = 1;
155
156 while ((ue = RB_ROOT(env->sc_user_names_t)) != NULL) {
157 RB_REMOVE(user_name_tree,
158 env->sc_user_names_t, ue);
159 free(ue->ue_line);
160 free(ue->ue_netid_line);
161 free(ue);
162 }
163 free(env->sc_user_names_t);
164 env->sc_user_names_t = NULL;
165 while ((ge = RB_ROOT(env->sc_group_names_t))
166 != NULL) {
167 RB_REMOVE(group_name_tree,
168 env->sc_group_names_t, ge);
169 free(ge->ge_line);
170 free(ge);
171 }
172 free(env->sc_group_names_t);
173 env->sc_group_names_t = NULL;
174 }
175
176 int
main_create_user_groups(struct env * env)177 main_create_user_groups(struct env *env)
178 {
179 struct userent *ue;
180 struct userent ukey;
181 struct groupent *ge;
182 gid_t pw_gid;
183 char *bp, *cp;
184 char *p;
185 const char *errstr = NULL;
186 size_t len;
187
188 RB_FOREACH(ue, user_name_tree, env->sc_user_names_t) {
189 bp = cp = ue->ue_line;
190
191 /* name */
192 bp += strlen(bp) + 1;
193
194 /* password */
195 bp += strcspn(bp, ":") + 1;
196
197 /* uid */
198 bp += strcspn(bp, ":") + 1;
199
200 /* gid */
201 bp[strcspn(bp, ":")] = '\0';
202
203 pw_gid = (gid_t)strtonum(bp, 0, GID_MAX, &errstr);
204 if (errstr) {
205 log_warnx("main: failed to parse gid for uid: %d",
206 ue->ue_uid);
207 return (-1);
208 }
209
210 /* bring gid column back to its proper state */
211 bp[strlen(bp)] = ':';
212
213 if ((ue->ue_netid_line = calloc(1, LINE_WIDTH)) == NULL) {
214 return (-1);
215 }
216
217 if (snprintf(ue->ue_netid_line, LINE_WIDTH-1, "%d:%d", ue->ue_uid, pw_gid) >= LINE_WIDTH) {
218
219 return (-1);
220 }
221
222 ue->ue_gid = pw_gid;
223 }
224
225 RB_FOREACH(ge, group_name_tree, env->sc_group_names_t) {
226 bp = cp = ge->ge_line;
227
228 /* name */
229 bp += strlen(bp) + 1;
230
231 /* password */
232 bp += strcspn(bp, ":") + 1;
233
234 /* gid */
235 bp += strcspn(bp, ":") + 1;
236
237 cp = bp;
238 if (*bp == '\0')
239 continue;
240 bp = cp;
241 for (;;) {
242 if (!(cp = strsep(&bp, ",")))
243 break;
244 ukey.ue_line = cp;
245 if ((ue = RB_FIND(user_name_tree, env->sc_user_names_t,
246 &ukey)) == NULL) {
247 /* User not found */
248 log_warnx("main: unknown user %s in group %s",
249 ukey.ue_line, ge->ge_line);
250 if (bp != NULL)
251 *(bp-1) = ',';
252 continue;
253 }
254 if (bp != NULL)
255 *(bp-1) = ',';
256
257 /* Make sure the new group doesn't equal to the main gid */
258 if (ge->ge_gid == ue->ue_gid)
259 continue;
260
261 len = strlen(ue->ue_netid_line);
262 p = ue->ue_netid_line + len;
263
264 if ((snprintf(p, LINE_WIDTH-len-1, ",%d",
265 ge->ge_gid)) >= (int)(LINE_WIDTH-len)) {
266 return (-1);
267 }
268 }
269 }
270
271 return (0);
272 }
273
274 void
main_end_update(struct env * env)275 main_end_update(struct env *env)
276 {
277 struct userent *ue;
278 struct groupent *ge;
279
280 if (env->update_trashed)
281 return;
282
283 log_debug("updates are over, cleaning up trees now");
284
285 if (main_create_user_groups(env) == -1) {
286 main_trash_update(env);
287 return;
288 }
289
290 if (env->sc_user_names == NULL) {
291 env->sc_user_names = env->sc_user_names_t;
292 env->sc_user_lines = NULL;
293 env->sc_user_names_t = NULL;
294
295 env->sc_group_names = env->sc_group_names_t;
296 env->sc_group_lines = NULL;
297 env->sc_group_names_t = NULL;
298
299 flatten_entries(env);
300 goto make_uids;
301 }
302
303 /*
304 * clean previous tree.
305 */
306 while ((ue = RB_ROOT(env->sc_user_names)) != NULL) {
307 RB_REMOVE(user_name_tree, env->sc_user_names,
308 ue);
309 free(ue->ue_netid_line);
310 free(ue);
311 }
312 free(env->sc_user_names);
313 free(env->sc_user_lines);
314
315 env->sc_user_names = env->sc_user_names_t;
316 env->sc_user_lines = NULL;
317 env->sc_user_names_t = NULL;
318
319 while ((ge = RB_ROOT(env->sc_group_names)) != NULL) {
320 RB_REMOVE(group_name_tree,
321 env->sc_group_names, ge);
322 free(ge);
323 }
324 free(env->sc_group_names);
325 free(env->sc_group_lines);
326
327 env->sc_group_names = env->sc_group_names_t;
328 env->sc_group_lines = NULL;
329 env->sc_group_names_t = NULL;
330
331
332 flatten_entries(env);
333
334 /*
335 * trees are flat now. build up uid, gid and netid trees.
336 */
337
338 make_uids:
339 RB_INIT(&env->sc_user_uids);
340 RB_INIT(&env->sc_group_gids);
341 RB_FOREACH(ue, user_name_tree, env->sc_user_names)
342 RB_INSERT(user_uid_tree,
343 &env->sc_user_uids, ue);
344 RB_FOREACH(ge, group_name_tree, env->sc_group_names)
345 RB_INSERT(group_gid_tree,
346 &env->sc_group_gids, ge);
347
348 }
349
350 void
main_dispatch_client(int fd,short events,void * p)351 main_dispatch_client(int fd, short events, void *p)
352 {
353 int n;
354 int shut = 0;
355 struct env *env = p;
356 struct imsgev *iev = env->sc_iev;
357 struct imsgbuf *ibuf = &iev->ibuf;
358 struct idm_req ir;
359 struct imsg imsg;
360
361 if ((events & (EV_READ | EV_WRITE)) == 0)
362 fatalx("unknown event");
363
364 if (events & EV_READ) {
365 if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
366 fatal("imsg_read error");
367 if (n == 0)
368 shut = 1;
369 }
370 if (events & EV_WRITE) {
371 if ((n = msgbuf_write(&ibuf->w)) == -1 && errno != EAGAIN)
372 fatal("msgbuf_write");
373 if (n == 0)
374 shut = 1;
375 goto done;
376 }
377
378 for (;;) {
379 if ((n = imsg_get(ibuf, &imsg)) == -1)
380 fatal("main_dispatch_client: imsg_get error");
381 if (n == 0)
382 break;
383
384 switch (imsg.hdr.type) {
385 case IMSG_START_UPDATE:
386 main_start_update(env);
387 break;
388 case IMSG_PW_ENTRY: {
389 struct userent *ue;
390 size_t len;
391
392 if (env->update_trashed)
393 break;
394
395 (void)memcpy(&ir, imsg.data, n - IMSG_HEADER_SIZE);
396 if ((ue = calloc(1, sizeof(*ue))) == NULL ||
397 (ue->ue_line = strdup(ir.ir_line)) == NULL) {
398 /*
399 * should cancel tree update instead.
400 */
401 fatal("out of memory");
402 }
403 ue->ue_uid = ir.ir_key.ik_uid;
404 len = strlen(ue->ue_line) + 1;
405 ue->ue_line[strcspn(ue->ue_line, ":")] = '\0';
406 if (RB_INSERT(user_name_tree, env->sc_user_names_t,
407 ue) != NULL) { /* dup */
408 free(ue->ue_line);
409 free(ue);
410 } else
411 env->sc_user_line_len += len;
412 break;
413 }
414 case IMSG_GRP_ENTRY: {
415 struct groupent *ge;
416 size_t len;
417
418 if (env->update_trashed)
419 break;
420
421 (void)memcpy(&ir, imsg.data, n - IMSG_HEADER_SIZE);
422 if ((ge = calloc(1, sizeof(*ge))) == NULL ||
423 (ge->ge_line = strdup(ir.ir_line)) == NULL) {
424 /*
425 * should cancel tree update instead.
426 */
427 fatal("out of memory");
428 }
429 ge->ge_gid = ir.ir_key.ik_gid;
430 len = strlen(ge->ge_line) + 1;
431 ge->ge_line[strcspn(ge->ge_line, ":")] = '\0';
432 if (RB_INSERT(group_name_tree, env->sc_group_names_t,
433 ge) != NULL) { /* dup */
434 free(ge->ge_line);
435 free(ge);
436 } else
437 env->sc_group_line_len += len;
438 break;
439 }
440 case IMSG_TRASH_UPDATE:
441 main_trash_update(env);
442 break;
443 case IMSG_END_UPDATE: {
444 main_end_update(env);
445 break;
446 }
447 default:
448 log_debug("main_dispatch_client: unexpected imsg %d",
449 imsg.hdr.type);
450 break;
451 }
452 imsg_free(&imsg);
453 }
454
455 done:
456 if (!shut)
457 imsg_event_add(iev);
458 else {
459 log_debug("king bula sez: ran into dead pipe");
460 event_del(&iev->ev);
461 event_loopexit(NULL);
462 }
463 }
464
465 void
main_configure_client(struct env * env)466 main_configure_client(struct env *env)
467 {
468 struct idm *idm;
469 struct imsgev *iev = env->sc_iev;
470
471 imsg_compose_event(iev, IMSG_CONF_START, 0, 0, -1, env, sizeof(*env));
472 TAILQ_FOREACH(idm, &env->sc_idms, idm_entry) {
473 imsg_compose_event(iev, IMSG_CONF_IDM, 0, 0, -1,
474 idm, sizeof(*idm));
475 }
476 imsg_compose_event(iev, IMSG_CONF_END, 0, 0, -1, NULL, 0);
477 }
478
479 void
main_init_timer(int fd,short event,void * p)480 main_init_timer(int fd, short event, void *p)
481 {
482 struct env *env = p;
483
484 main_configure_client(env);
485 }
486
487 void
purge_config(struct env * env)488 purge_config(struct env *env)
489 {
490 struct idm *idm;
491
492 while ((idm = TAILQ_FIRST(&env->sc_idms)) != NULL) {
493 TAILQ_REMOVE(&env->sc_idms, idm, idm_entry);
494 free(idm);
495 }
496 }
497
498 int
main(int argc,char * argv[])499 main(int argc, char *argv[])
500 {
501 int c;
502 int debug;
503 struct passwd *pw;
504 struct env env;
505 struct event ev_sigint;
506 struct event ev_sigterm;
507 struct event ev_sigchld;
508 struct event ev_sighup;
509 struct event ev_timer;
510 struct timeval tv;
511
512 debug = 0;
513 ypldap_process = PROC_MAIN;
514 log_procname = log_procnames[ypldap_process];
515
516 log_init(1);
517
518 while ((c = getopt(argc, argv, "dD:nf:v")) != -1) {
519 switch (c) {
520 case 'd':
521 debug = 2;
522 log_verbose(debug);
523 break;
524 case 'D':
525 if (cmdline_symset(optarg) < 0)
526 log_warnx("could not parse macro definition %s",
527 optarg);
528 break;
529 case 'n':
530 debug = 2;
531 opts |= YPLDAP_OPT_NOACTION;
532 break;
533 case 'f':
534 conffile = optarg;
535 break;
536 case 'v':
537 opts |= YPLDAP_OPT_VERBOSE;
538 break;
539 default:
540 usage();
541 }
542 }
543
544 argc -= optind;
545 argv += optind;
546
547 if (argc)
548 usage();
549
550 RB_INIT(&env.sc_user_uids);
551 RB_INIT(&env.sc_group_gids);
552
553 if (parse_config(&env, conffile, opts))
554 exit(1);
555 if (opts & YPLDAP_OPT_NOACTION) {
556 fprintf(stderr, "configuration OK\n");
557 exit(0);
558 }
559
560 if (geteuid())
561 errx(1, "need root privileges");
562
563 log_init(debug);
564
565 if (!debug) {
566 if (daemon(1, 0) == -1)
567 err(1, "failed to daemonize");
568 }
569
570 log_info("startup%s", (debug > 1)?" [debug mode]":"");
571
572 if (socketpair(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK, PF_UNSPEC,
573 pipe_main2client) == -1)
574 fatal("socketpair");
575
576 client_pid = ldapclient(pipe_main2client);
577
578 setproctitle("parent");
579 event_init();
580
581 signal_set(&ev_sigint, SIGINT, main_sig_handler, &env);
582 signal_set(&ev_sigterm, SIGTERM, main_sig_handler, &env);
583 signal_set(&ev_sighup, SIGHUP, main_sig_handler, &env);
584 signal_set(&ev_sigchld, SIGCHLD, main_sig_handler, &env);
585 signal_add(&ev_sigint, NULL);
586 signal_add(&ev_sigterm, NULL);
587 signal_add(&ev_sighup, NULL);
588 signal_add(&ev_sigchld, NULL);
589
590 close(pipe_main2client[1]);
591 if ((env.sc_iev = calloc(1, sizeof(*env.sc_iev))) == NULL)
592 fatal(NULL);
593 imsg_init(&env.sc_iev->ibuf, pipe_main2client[0]);
594 env.sc_iev->handler = main_dispatch_client;
595
596 env.sc_iev->events = EV_READ;
597 env.sc_iev->data = &env;
598 event_set(&env.sc_iev->ev, env.sc_iev->ibuf.fd, env.sc_iev->events,
599 env.sc_iev->handler, &env);
600 event_add(&env.sc_iev->ev, NULL);
601
602 yp_init(&env);
603
604 if ((pw = getpwnam(YPLDAP_USER)) == NULL)
605 fatal("getpwnam");
606
607 #ifndef DEBUG
608 if (setgroups(1, &pw->pw_gid) ||
609 setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
610 setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))
611 fatal("cannot drop privileges");
612 #else
613 #warning disabling privilege revocation in debug mode
614 #endif
615
616 if (pledge("stdio inet", NULL) == -1)
617 fatal("pledge");
618
619 memset(&tv, 0, sizeof(tv));
620 evtimer_set(&ev_timer, main_init_timer, &env);
621 evtimer_add(&ev_timer, &tv);
622
623 yp_enable_events();
624 event_dispatch();
625 main_shutdown();
626
627 return (0);
628 }
629
630 void
imsg_event_add(struct imsgev * iev)631 imsg_event_add(struct imsgev *iev)
632 {
633 if (iev->handler == NULL) {
634 imsg_flush(&iev->ibuf);
635 return;
636 }
637
638 iev->events = EV_READ;
639 if (iev->ibuf.w.queued)
640 iev->events |= EV_WRITE;
641
642 event_del(&iev->ev);
643 event_set(&iev->ev, iev->ibuf.fd, iev->events, iev->handler, iev->data);
644 event_add(&iev->ev, NULL);
645 }
646
647 int
imsg_compose_event(struct imsgev * iev,u_int16_t type,u_int32_t peerid,pid_t pid,int fd,void * data,u_int16_t datalen)648 imsg_compose_event(struct imsgev *iev, u_int16_t type, u_int32_t peerid,
649 pid_t pid, int fd, void *data, u_int16_t datalen)
650 {
651 int ret;
652
653 if ((ret = imsg_compose(&iev->ibuf, type, peerid,
654 pid, fd, data, datalen)) != -1)
655 imsg_event_add(iev);
656 return (ret);
657 }
658