rexecd.c revision 1.17
1 /* $NetBSD: rexecd.c,v 1.17 2003/08/07 09:46:46 agc Exp $ */ 2 3 /* 4 * Copyright (c) 1983, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 #ifndef lint 34 __COPYRIGHT("@(#) Copyright (c) 1983, 1993\n\ 35 The Regents of the University of California. All rights reserved.\n"); 36 #if 0 37 static char sccsid[] = "from: @(#)rexecd.c 8.1 (Berkeley) 6/4/93"; 38 #else 39 __RCSID("$NetBSD: rexecd.c,v 1.17 2003/08/07 09:46:46 agc Exp $"); 40 #endif 41 #endif /* not lint */ 42 43 #include <sys/param.h> 44 #include <sys/ioctl.h> 45 #include <sys/socket.h> 46 #include <sys/syslog.h> 47 #include <sys/time.h> 48 49 #include <netinet/in.h> 50 51 #include <err.h> 52 #include <errno.h> 53 #include <netdb.h> 54 #include <paths.h> 55 #include <pwd.h> 56 #include <signal.h> 57 #include <stdarg.h> 58 #include <stdio.h> 59 #include <stdlib.h> 60 #include <string.h> 61 #include <unistd.h> 62 #include <poll.h> 63 64 void error __P((const char *, ...)) 65 __attribute__((__format__(__printf__, 1, 2))); 66 int main __P((int, char **)); 67 void doit __P((int, struct sockaddr *)); 68 void getstr __P((char *, int, char *)); 69 70 char username[32 + 1] = "USER="; 71 char homedir[PATH_MAX + 1] = "HOME="; 72 char shell[PATH_MAX + 1] = "SHELL="; 73 char path[sizeof(_PATH_DEFPATH) + sizeof("PATH=")] = "PATH="; 74 char *envinit[] = { homedir, shell, path, username, 0 }; 75 char **environ; 76 int dolog; 77 78 /* 79 * remote execute server: 80 * username\0 81 * password\0 82 * command\0 83 * data 84 */ 85 int 86 main(argc, argv) 87 int argc; 88 char **argv; 89 { 90 struct sockaddr_storage from; 91 int fromlen, ch; 92 93 while ((ch = getopt(argc, argv, "l")) != -1) 94 switch (ch) { 95 case 'l': 96 dolog = 1; 97 openlog("rexecd", LOG_PID, LOG_DAEMON); 98 break; 99 default: 100 exit(1); 101 } 102 103 fromlen = sizeof (from); 104 if (getpeername(0, (struct sockaddr *)&from, &fromlen) < 0) 105 err(1, "getpeername"); 106 107 doit(0, (struct sockaddr *)&from); 108 exit(0); 109 } 110 111 void 112 doit(f, fromp) 113 int f; 114 struct sockaddr *fromp; 115 { 116 struct pollfd fds[2]; 117 char cmdbuf[NCARGS+1], *namep; 118 const char *cp; 119 char user[16], pass[16]; 120 char buf[BUFSIZ], sig; 121 struct passwd *pwd; 122 int s = -1; /* XXX gcc */ 123 int pv[2], pid, cc; 124 int one = 1; 125 in_port_t port; 126 127 (void)signal(SIGINT, SIG_DFL); 128 (void)signal(SIGQUIT, SIG_DFL); 129 (void)signal(SIGTERM, SIG_DFL); 130 dup2(f, 0); 131 dup2(f, 1); 132 dup2(f, 2); 133 (void)alarm(60); 134 port = 0; 135 for (;;) { 136 char c; 137 if (read(f, &c, 1) != 1) { 138 if (dolog) 139 syslog(LOG_ERR, 140 "initial read failed"); 141 exit(1); 142 } 143 if (c == 0) 144 break; 145 port = port * 10 + c - '0'; 146 } 147 (void)alarm(0); 148 if (port != 0) { 149 s = socket(fromp->sa_family, SOCK_STREAM, 0); 150 if (s < 0) { 151 if (dolog) 152 syslog(LOG_ERR, "socket: %m"); 153 exit(1); 154 } 155 (void)alarm(60); 156 switch (fromp->sa_family) { 157 case AF_INET: 158 ((struct sockaddr_in *)fromp)->sin_port = htons(port); 159 break; 160 case AF_INET6: 161 ((struct sockaddr_in6 *)fromp)->sin6_port = htons(port); 162 break; 163 default: 164 syslog(LOG_ERR, "unsupported address family"); 165 exit(1); 166 } 167 if (connect(s, (struct sockaddr *)fromp, fromp->sa_len) < 0) { 168 if (dolog) 169 syslog(LOG_ERR, "connect: %m"); 170 exit(1); 171 } 172 (void)alarm(0); 173 } 174 getstr(user, sizeof(user), "username"); 175 getstr(pass, sizeof(pass), "password"); 176 getstr(cmdbuf, sizeof(cmdbuf), "command"); 177 setpwent(); 178 pwd = getpwnam(user); 179 if (pwd == NULL) { 180 error("Login incorrect.\n"); 181 if (dolog) 182 syslog(LOG_ERR, "no such user %s", user); 183 exit(1); 184 } 185 endpwent(); 186 if (*pwd->pw_passwd != '\0') { 187 namep = crypt(pass, pwd->pw_passwd); 188 if (strcmp(namep, pwd->pw_passwd)) { 189 error("Password incorrect.\n"); /* XXX: wrong! */ 190 if (dolog) 191 syslog(LOG_ERR, "incorrect password for %s", 192 user); 193 exit(1); 194 } 195 } else 196 (void)crypt("dummy password", "PA"); /* must always crypt */ 197 if (chdir(pwd->pw_dir) < 0) { 198 error("No remote directory.\n"); 199 if (dolog) 200 syslog(LOG_ERR, "%s does not exist for %s", pwd->pw_dir, 201 user); 202 exit(1); 203 } 204 (void)write(2, "\0", 1); 205 if (port) { 206 if (pipe(pv) < 0 || (pid = fork()) == -1) { 207 error("Try again.\n"); 208 if (dolog) 209 syslog(LOG_ERR,"pipe or fork failed for %s: %m", 210 user); 211 exit(1); 212 } 213 if (pid) { 214 (void)close(0); 215 (void)close(1); 216 (void)close(2); 217 (void)close(f); 218 (void)close(pv[1]); 219 fds[0].fd = s; 220 fds[1].fd = pv[0]; 221 fds[0].events = fds[1].events = POLLIN; 222 if (ioctl(pv[1], FIONBIO, (char *)&one) < 0) 223 _exit(1); 224 /* should set s nbio! */ 225 do { 226 if (poll(fds, 2, 0) < 0) { 227 close(s); 228 close(pv[0]); 229 _exit(1); 230 } 231 if (fds[0].revents & POLLIN) { 232 if (read(s, &sig, 1) <= 0) 233 fds[0].events = 0; 234 else 235 killpg(pid, sig); 236 } 237 if (fds[1].revents & POLLIN) { 238 cc = read(pv[0], buf, sizeof (buf)); 239 if (cc <= 0) { 240 shutdown(s, 1+1); 241 fds[1].events = 0; 242 } else 243 (void)write(s, buf, cc); 244 } 245 } while ((fds[0].events | fds[1].events) & POLLIN); 246 _exit(0); 247 } 248 (void)close(s); 249 (void)close(pv[0]); 250 if (dup2(pv[1], 2) < 0) { 251 error("Try again.\n"); 252 if (dolog) 253 syslog(LOG_ERR, "dup2 failed for %s", user); 254 exit(1); 255 } 256 } 257 if (*pwd->pw_shell == '\0') 258 pwd->pw_shell = _PATH_BSHELL; 259 if (f > 2) 260 (void)close(f); 261 if (setsid() < 0 || 262 setlogin(pwd->pw_name) < 0 || 263 initgroups(pwd->pw_name, pwd->pw_gid) < 0 || 264 setgid((gid_t)pwd->pw_gid) < 0 || 265 setuid((uid_t)pwd->pw_uid) < 0) { 266 error("Try again.\n"); 267 if (dolog) 268 syslog(LOG_ERR, "could not set permissions for %s: %m", 269 user); 270 exit(1); 271 } 272 (void)strlcat(path, _PATH_DEFPATH, sizeof(path)); 273 environ = envinit; 274 strlcat(homedir, pwd->pw_dir, sizeof(homedir)); 275 strlcat(shell, pwd->pw_shell, sizeof(shell)); 276 strlcat(username, pwd->pw_name, sizeof(username)); 277 cp = strrchr(pwd->pw_shell, '/'); 278 if (cp) 279 cp++; 280 else 281 cp = pwd->pw_shell; 282 if (dolog) 283 syslog(LOG_INFO, "running command for %s: %s", user, cmdbuf); 284 execl(pwd->pw_shell, cp, "-c", cmdbuf, 0); 285 perror(pwd->pw_shell); 286 if (dolog) 287 syslog(LOG_ERR, "execl failed for %s: %m", user); 288 exit(1); 289 } 290 291 void 292 error(const char *fmt, ...) 293 { 294 char buf[BUFSIZ]; 295 va_list ap; 296 297 va_start(ap, fmt); 298 buf[0] = 1; 299 (void)vsnprintf(buf+1, sizeof(buf) - 1, fmt, ap); 300 (void)write(2, buf, strlen(buf)); 301 va_end(ap); 302 } 303 304 void 305 getstr(buf, cnt, err) 306 char *buf; 307 int cnt; 308 char *err; 309 { 310 char c; 311 312 do { 313 if (read(0, &c, 1) != 1) 314 exit(1); 315 *buf++ = c; 316 if (--cnt == 0) { 317 error("%s too long\n", err); 318 exit(1); 319 } 320 } while (c != 0); 321 } 322
Indexes created Mon Sep 22 10:09:38 GMT 2025