Merge branch 'en/and-cascade-tests'
[gitweb.git] / daemon.c
index 7ccd097e1d1234d06316e8b7f271e86127750f85..13435b46674a3a7b123597ab11751459173f3325 100644 (file)
--- a/daemon.c
+++ b/daemon.c
@@ -5,8 +5,6 @@
 #include "strbuf.h"
 #include "string-list.h"
 
-#include <syslog.h>
-
 #ifndef HOST_NAME_MAX
 #define HOST_NAME_MAX 256
 #endif
@@ -25,10 +23,10 @@ static const char daemon_usage[] =
 "           [--strict-paths] [--base-path=<path>] [--base-path-relaxed]\n"
 "           [--user-path | --user-path=<path>]\n"
 "           [--interpolated-path=<path>]\n"
-"           [--reuseaddr] [--detach] [--pid-file=<file>]\n"
+"           [--reuseaddr] [--pid-file=<file>]\n"
 "           [--(enable|disable|allow-override|forbid-override)=<service>]\n"
 "           [--inetd | [--listen=<host_or_ipaddr>] [--port=<n>]\n"
-"                      [--user=<user> [--group=<group>]]\n"
+"                      [--detach] [--user=<user> [--group=<group>]]\n"
 "           [<directory>...]";
 
 /* List of acceptable pathname prefixes */
@@ -69,12 +67,14 @@ static void logreport(int priority, const char *err, va_list params)
                syslog(priority, "%s", buf);
        } else {
                /*
-                * Since stderr is set to linebuffered mode, the
+                * Since stderr is set to buffered mode, the
                 * logging of different processes will not overlap
+                * unless they overflow the (rather big) buffers.
                 */
                fprintf(stderr, "[%"PRIuMAX"] ", (uintmax_t)getpid());
                vfprintf(stderr, err, params);
                fputc('\n', stderr);
+               fflush(stderr);
        }
 }
 
@@ -516,37 +516,14 @@ static void parse_host_arg(char *extra_args, int buflen)
 }
 
 
-static int execute(struct sockaddr *addr)
+static int execute(void)
 {
        static char line[1000];
        int pktlen, len, i;
+       char *addr = getenv("REMOTE_ADDR"), *port = getenv("REMOTE_PORT");
 
-       if (addr) {
-               char addrbuf[256] = "";
-               int port = -1;
-
-               if (addr->sa_family == AF_INET) {
-                       struct sockaddr_in *sin_addr = (void *) addr;
-                       inet_ntop(addr->sa_family, &sin_addr->sin_addr, addrbuf, sizeof(addrbuf));
-                       port = ntohs(sin_addr->sin_port);
-#ifndef NO_IPV6
-               } else if (addr && addr->sa_family == AF_INET6) {
-                       struct sockaddr_in6 *sin6_addr = (void *) addr;
-
-                       char *buf = addrbuf;
-                       *buf++ = '['; *buf = '\0'; /* stpcpy() is cool */
-                       inet_ntop(AF_INET6, &sin6_addr->sin6_addr, buf, sizeof(addrbuf) - 1);
-                       strcat(buf, "]");
-
-                       port = ntohs(sin6_addr->sin6_port);
-#endif
-               }
-               loginfo("Connection from %s:%d", addrbuf, port);
-               setenv("REMOTE_ADDR", addrbuf, 1);
-       }
-       else {
-               unsetenv("REMOTE_ADDR");
-       }
+       if (addr)
+               loginfo("Connection from %s:%s", addr, port);
 
        alarm(init_timeout ? init_timeout : timeout);
        pktlen = packet_read_line(0, line, sizeof(line));
@@ -616,17 +593,17 @@ static unsigned int live_children;
 
 static struct child {
        struct child *next;
-       pid_t pid;
+       struct child_process cld;
        struct sockaddr_storage address;
 } *firstborn;
 
-static void add_child(pid_t pid, struct sockaddr *addr, int addrlen)
+static void add_child(struct child_process *cld, struct sockaddr *addr, socklen_t addrlen)
 {
        struct child *newborn, **cradle;
 
        newborn = xcalloc(1, sizeof(*newborn));
        live_children++;
-       newborn->pid = pid;
+       memcpy(&newborn->cld, cld, sizeof(*cld));
        memcpy(&newborn->address, addr, addrlen);
        for (cradle = &firstborn; *cradle; cradle = &(*cradle)->next)
                if (!addrcmp(&(*cradle)->address, &newborn->address))
@@ -635,19 +612,6 @@ static void add_child(pid_t pid, struct sockaddr *addr, int addrlen)
        *cradle = newborn;
 }
 
-static void remove_child(pid_t pid)
-{
-       struct child **cradle, *blanket;
-
-       for (cradle = &firstborn; (blanket = *cradle); cradle = &blanket->next)
-               if (blanket->pid == pid) {
-                       *cradle = blanket->next;
-                       live_children--;
-                       free(blanket);
-                       break;
-               }
-}
-
 /*
  * This gets called if the number of connections grows
  * past "max_connections".
@@ -663,7 +627,7 @@ static void kill_some_child(void)
 
        for (; (next = blanket->next); blanket = next)
                if (!addrcmp(&blanket->address, &next->address)) {
-                       kill(blanket->pid, SIGTERM);
+                       kill(blanket->cld.pid, SIGTERM);
                        break;
                }
 }
@@ -673,18 +637,28 @@ static void check_dead_children(void)
        int status;
        pid_t pid;
 
-       while ((pid = waitpid(-1, &status, WNOHANG)) > 0) {
-               const char *dead = "";
-               remove_child(pid);
-               if (!WIFEXITED(status) || (WEXITSTATUS(status) > 0))
-                       dead = " (with error)";
-               loginfo("[%"PRIuMAX"] Disconnected%s", (uintmax_t)pid, dead);
-       }
+       struct child **cradle, *blanket;
+       for (cradle = &firstborn; (blanket = *cradle);)
+               if ((pid = waitpid(blanket->cld.pid, &status, WNOHANG)) > 1) {
+                       const char *dead = "";
+                       if (status)
+                               dead = " (with error)";
+                       loginfo("[%"PRIuMAX"] Disconnected%s", (uintmax_t)pid, dead);
+
+                       /* remove the child */
+                       *cradle = blanket->next;
+                       live_children--;
+                       free(blanket);
+               } else
+                       cradle = &blanket->next;
 }
 
-static void handle(int incoming, struct sockaddr *addr, int addrlen)
+static char **cld_argv;
+static void handle(int incoming, struct sockaddr *addr, socklen_t addrlen)
 {
-       pid_t pid;
+       struct child_process cld = { 0 };
+       char addrbuf[300] = "REMOTE_ADDR=", portbuf[300];
+       char *env[] = { addrbuf, portbuf, NULL };
 
        if (max_connections && live_children >= max_connections) {
                kill_some_child();
@@ -697,22 +671,37 @@ static void handle(int incoming, struct sockaddr *addr, int addrlen)
                }
        }
 
-       if ((pid = fork())) {
-               close(incoming);
-               if (pid < 0) {
-                       logerror("Couldn't fork %s", strerror(errno));
-                       return;
-               }
+       if (addr->sa_family == AF_INET) {
+               struct sockaddr_in *sin_addr = (void *) addr;
+               inet_ntop(addr->sa_family, &sin_addr->sin_addr, addrbuf + 12,
+                   sizeof(addrbuf) - 12);
+               snprintf(portbuf, sizeof(portbuf), "REMOTE_PORT=%d",
+                   ntohs(sin_addr->sin_port));
+#ifndef NO_IPV6
+       } else if (addr && addr->sa_family == AF_INET6) {
+               struct sockaddr_in6 *sin6_addr = (void *) addr;
 
-               add_child(pid, addr, addrlen);
-               return;
+               char *buf = addrbuf + 12;
+               *buf++ = '['; *buf = '\0'; /* stpcpy() is cool */
+               inet_ntop(AF_INET6, &sin6_addr->sin6_addr, buf,
+                   sizeof(addrbuf) - 13);
+               strcat(buf, "]");
+
+               snprintf(portbuf, sizeof(portbuf), "REMOTE_PORT=%d",
+                   ntohs(sin6_addr->sin6_port));
+#endif
        }
 
-       dup2(incoming, 0);
-       dup2(incoming, 1);
-       close(incoming);
+       cld.env = (const char **)env;
+       cld.argv = (const char **)cld_argv;
+       cld.in = incoming;
+       cld.out = dup(incoming);
 
-       exit(execute(addr));
+       if (start_command(&cld))
+               logerror("unable to fork");
+       else
+               add_child(&cld, addr, addrlen);
+       close(incoming);
 }
 
 static void child_handler(int signo)
@@ -914,9 +903,15 @@ static int service_loop(struct socketlist *socklist)
 
                for (i = 0; i < socklist->nr; i++) {
                        if (pfd[i].revents & POLLIN) {
-                               struct sockaddr_storage ss;
-                               unsigned int sslen = sizeof(ss);
-                               int incoming = accept(pfd[i].fd, (struct sockaddr *)&ss, &sslen);
+                               union {
+                                       struct sockaddr sa;
+                                       struct sockaddr_in sai;
+#ifndef NO_IPV6
+                                       struct sockaddr_in6 sai6;
+#endif
+                               } ss;
+                               socklen_t sslen = sizeof(ss);
+                               int incoming = accept(pfd[i].fd, &ss.sa, &sslen);
                                if (incoming < 0) {
                                        switch (errno) {
                                        case EAGAIN:
@@ -927,7 +922,7 @@ static int service_loop(struct socketlist *socklist)
                                                die_errno("accept returned");
                                        }
                                }
-                               handle(incoming, (struct sockaddr *)&ss, sslen);
+                               handle(incoming, &ss.sa, sslen);
                        }
                }
        }
@@ -945,6 +940,62 @@ static void sanitize_stdfds(void)
                close(fd);
 }
 
+#ifdef NO_POSIX_GOODIES
+
+struct credentials;
+
+static void drop_privileges(struct credentials *cred)
+{
+       /* nothing */
+}
+
+static void daemonize(void)
+{
+       die("--detach not supported on this platform");
+}
+
+static struct credentials *prepare_credentials(const char *user_name,
+    const char *group_name)
+{
+       die("--user not supported on this platform");
+}
+
+#else
+
+struct credentials {
+       struct passwd *pass;
+       gid_t gid;
+};
+
+static void drop_privileges(struct credentials *cred)
+{
+       if (cred && (initgroups(cred->pass->pw_name, cred->gid) ||
+           setgid (cred->gid) || setuid(cred->pass->pw_uid)))
+               die("cannot drop privileges");
+}
+
+static struct credentials *prepare_credentials(const char *user_name,
+    const char *group_name)
+{
+       static struct credentials c;
+
+       c.pass = getpwnam(user_name);
+       if (!c.pass)
+               die("user not found - %s", user_name);
+
+       if (!group_name)
+               c.gid = c.pass->pw_gid;
+       else {
+               struct group *group = getgrnam(group_name);
+               if (!group)
+                       die("group not found - %s", group_name);
+
+               c.gid = group->gr_gid;
+       }
+
+       return &c;
+}
+
 static void daemonize(void)
 {
        switch (fork()) {
@@ -962,6 +1013,7 @@ static void daemonize(void)
        close(2);
        sanitize_stdfds();
 }
+#endif
 
 static void store_pid(const char *path)
 {
@@ -972,7 +1024,8 @@ static void store_pid(const char *path)
                die_errno("failed to write pid file '%s'", path);
 }
 
-static int serve(struct string_list *listen_addr, int listen_port, struct passwd *pass, gid_t gid)
+static int serve(struct string_list *listen_addr, int listen_port,
+    struct credentials *cred)
 {
        struct socketlist socklist = { NULL, 0, 0 };
 
@@ -981,10 +1034,7 @@ static int serve(struct string_list *listen_addr, int listen_port, struct passwd
                die("unable to allocate any listen sockets on port %u",
                    listen_port);
 
-       if (pass && gid &&
-           (initgroups(pass->pw_name, gid) || setgid (gid) ||
-            setuid(pass->pw_uid)))
-               die("cannot drop privileges");
+       drop_privileges(cred);
 
        return service_loop(&socklist);
 }
@@ -993,12 +1043,10 @@ int main(int argc, char **argv)
 {
        int listen_port = 0;
        struct string_list listen_addr = STRING_LIST_INIT_NODUP;
-       int inetd_mode = 0;
+       int serve_mode = 0, inetd_mode = 0;
        const char *pid_file = NULL, *user_name = NULL, *group_name = NULL;
        int detach = 0;
-       struct passwd *pass = NULL;
-       struct group *group;
-       gid_t gid = 0;
+       struct credentials *cred = NULL;
        int i;
 
        git_extract_argv0_path(argv[0]);
@@ -1019,6 +1067,10 @@ int main(int argc, char **argv)
                                continue;
                        }
                }
+               if (!strcmp(arg, "--serve")) {
+                       serve_mode = 1;
+                       continue;
+               }
                if (!strcmp(arg, "--inetd")) {
                        inetd_mode = 1;
                        log_syslog = 1;
@@ -1127,10 +1179,10 @@ int main(int argc, char **argv)
                set_die_routine(daemon_die);
        } else
                /* avoid splitting a message in the middle */
-               setvbuf(stderr, NULL, _IOLBF, 0);
+               setvbuf(stderr, NULL, _IOFBF, 4096);
 
-       if (inetd_mode && (group_name || user_name))
-               die("--user and --group are incompatible with --inetd");
+       if (inetd_mode && (detach || group_name || user_name))
+               die("--detach, --user and --group are incompatible with --inetd");
 
        if (inetd_mode && (listen_port || (listen_addr.nr > 0)))
                die("--listen= and --port= are incompatible with --inetd");
@@ -1140,21 +1192,8 @@ int main(int argc, char **argv)
        if (group_name && !user_name)
                die("--group supplied without --user");
 
-       if (user_name) {
-               pass = getpwnam(user_name);
-               if (!pass)
-                       die("user not found - %s", user_name);
-
-               if (!group_name)
-                       gid = pass->pw_gid;
-               else {
-                       group = getgrnam(group_name);
-                       if (!group)
-                               die("group not found - %s", group_name);
-
-                       gid = group->gr_gid;
-               }
-       }
+       if (user_name)
+               cred = prepare_credentials(user_name, group_name);
 
        if (strict_paths && (!ok_paths || !*ok_paths))
                die("option --strict-paths requires a whitelist");
@@ -1164,19 +1203,13 @@ int main(int argc, char **argv)
                    base_path);
 
        if (inetd_mode) {
-               struct sockaddr_storage ss;
-               struct sockaddr *peer = (struct sockaddr *)&ss;
-               socklen_t slen = sizeof(ss);
-
                if (!freopen("/dev/null", "w", stderr))
                        die_errno("failed to redirect stderr to /dev/null");
-
-               if (getpeername(0, peer, &slen))
-                       peer = NULL;
-
-               return execute(peer);
        }
 
+       if (inetd_mode || serve_mode)
+               return execute();
+
        if (detach) {
                daemonize();
                loginfo("Ready to rumble");
@@ -1187,5 +1220,12 @@ int main(int argc, char **argv)
        if (pid_file)
                store_pid(pid_file);
 
-       return serve(&listen_addr, listen_port, pass, gid);
+       /* prepare argv for serving-processes */
+       cld_argv = xmalloc(sizeof (char *) * (argc + 2));
+       for (i = 0; i < argc; ++i)
+               cld_argv[i] = argv[i];
+       cld_argv[argc] = "--serve";
+       cld_argv[argc+1] = NULL;
+
+       return serve(&listen_addr, listen_port, cred);
 }