27 |
|
|
28 |
/* TCP wrappers */ |
/* TCP wrappers */ |
29 |
#ifdef USE_LIBWRAP |
#ifdef USE_LIBWRAP |
30 |
#include <tcpd.h> |
# include <tcpd.h> |
31 |
int deny_severity = LOG_INFO; |
int deny_severity = LOG_INFO; |
32 |
int allow_severity = LOG_INFO; |
int allow_severity = LOG_INFO; |
33 |
#endif /* USE_LIBWRAP */ |
#endif /* USE_LIBWRAP */ |
45 |
void |
void |
46 |
daemonize(void) |
daemonize(void) |
47 |
{ |
{ |
48 |
#ifdef HAVE_DAEMON |
#ifdef HAVE_DAEMON |
49 |
if (daemon(0, 0) == -1) |
if (daemon(0, 0) == -1) |
50 |
anubis_error(HARD, _("daemon() failed. %s."), strerror(errno)); |
anubis_error(HARD, _("daemon() failed. %s."), strerror(errno)); |
51 |
#else |
#else |
52 |
chdir("/"); |
chdir("/"); |
53 |
umask(0); |
umask(0); |
54 |
switch(fork()) |
switch(fork()) |
67 |
close(0); |
close(0); |
68 |
close(1); |
close(1); |
69 |
close(2); |
close(2); |
70 |
#endif /* HAVE_DAEMON */ |
#endif /* HAVE_DAEMON */ |
71 |
|
|
72 |
signal(SIGHUP, SIG_IGN); |
signal(SIGHUP, SIG_IGN); |
73 |
topt |= T_DAEMON; |
topt |= T_DAEMON; |
74 |
|
|
75 |
#ifdef HAVE_SYSLOG |
#ifdef HAVE_SYSLOG |
76 |
openlog("anubis", LOG_PID, 0); |
openlog("anubis", LOG_PID, 0); |
77 |
syslog(LOG_INFO, _("%s daemon startup succeeded."), version); |
syslog(LOG_INFO, _("%s daemon startup succeeded."), version); |
78 |
#endif /* HAVE_SYSLOG */ |
#endif /* HAVE_SYSLOG */ |
79 |
|
|
80 |
return; |
return; |
81 |
} |
} |
105 |
{ |
{ |
106 |
char buf[LINEBUFFER+1]; |
char buf[LINEBUFFER+1]; |
107 |
|
|
108 |
#ifdef HAVE_SNPRINTF |
#ifdef HAVE_SNPRINTF |
109 |
snprintf(buf, LINEBUFFER, |
snprintf(buf, LINEBUFFER, |
110 |
#else |
#else |
111 |
sprintf(buf, |
sprintf(buf, |
112 |
#endif /* HAVE_SNPRINTF */ |
#endif /* HAVE_SNPRINTF */ |
113 |
"421 %s Service not available, closing transmission channel."CRLF, |
"421 %s Service not available, closing transmission channel."CRLF, |
114 |
(topt & T_LOCAL_MTA) ? "localhost" : session.mta); |
(topt & T_LOCAL_MTA) ? "localhost" : session.mta); |
115 |
|
|
147 |
int sd_client = 0; |
int sd_client = 0; |
148 |
int sd_server = 0; |
int sd_server = 0; |
149 |
socklen_t addrlen; |
socklen_t addrlen; |
150 |
#ifdef USE_LIBWRAP |
#ifdef USE_LIBWRAP |
151 |
struct request_info req; |
struct request_info req; |
152 |
#endif /* USE_LIBWRAP */ |
#endif /* USE_LIBWRAP */ |
153 |
#ifdef HAVE_PAM |
#ifdef HAVE_PAM |
154 |
int pam_retval; |
int pam_retval; |
155 |
#endif /* HAVE_PAM */ |
#endif /* HAVE_PAM */ |
156 |
|
|
157 |
addrlen = sizeof(addr); |
addrlen = sizeof(addr); |
158 |
signal(SIGCHLD, sig_cld); |
signal(SIGCHLD, sig_cld); |
175 |
Check the TCP wrappers settings. |
Check the TCP wrappers settings. |
176 |
*/ |
*/ |
177 |
|
|
178 |
#ifdef USE_LIBWRAP |
#ifdef USE_LIBWRAP |
179 |
request_init(&req, RQ_DAEMON, "anubis", RQ_FILE, sd_client, 0); |
request_init(&req, RQ_DAEMON, "anubis", RQ_FILE, sd_client, 0); |
180 |
fromhost(&req); |
fromhost(&req); |
181 |
if (hosts_access(&req) == 0) { |
if (hosts_access(&req) == 0) { |
184 |
service_unavailable(sd_client); |
service_unavailable(sd_client); |
185 |
continue; |
continue; |
186 |
} |
} |
187 |
#endif /* USE_LIBWRAP */ |
#endif /* USE_LIBWRAP */ |
188 |
|
|
189 |
/* |
/* |
190 |
Read the system configuration file (SUPERVISOR). |
Read the system configuration file (SUPERVISOR). |
191 |
*/ |
*/ |
192 |
|
|
193 |
if (!(topt & T_NORC)) { |
if (!(topt & T_NORC)) { |
194 |
open_rcfile(SUPERVISOR); |
open_rcfile(CF_SUPERVISOR); |
195 |
read_rcfile(SUPERVISOR); |
process_rcfile(CF_SUPERVISOR); |
|
close_rcfile(); /* SUPERVISOR */ |
|
196 |
} |
} |
197 |
|
|
198 |
nchild++; |
nchild++; |
211 |
anubis_error(HARD, _("daemon: Can't fork. %s."), strerror(errno)); |
anubis_error(HARD, _("daemon: Can't fork. %s."), strerror(errno)); |
212 |
else if (childpid == 0) { /* a child process */ |
else if (childpid == 0) { /* a child process */ |
213 |
int rs = 0; |
int rs = 0; |
214 |
|
int cs = 0; |
215 |
signal(SIGCHLD, SIG_IGN); |
signal(SIGCHLD, SIG_IGN); |
216 |
|
|
217 |
rs = auth_ident(&addr, session.client, sizeof(session.client)); |
rs = auth_ident(&addr, |
218 |
|
session.client, |
219 |
if (topt & T_TRANSLATION_MAP) { |
sizeof(session.client)); |
220 |
int cs = 0; |
|
221 |
if (rs) |
parse_transmap(&cs, |
222 |
parse_transmap(&cs, session.client, inet_ntoa(addr.sin_addr), |
rs ? session.client : 0, |
223 |
session.client, sizeof(session.client)); |
inet_ntoa(addr.sin_addr), |
224 |
else |
session.client, |
225 |
parse_transmap(&cs, 0, inet_ntoa(addr.sin_addr), |
sizeof(session.client)); |
226 |
session.client, sizeof(session.client)); |
|
227 |
|
if (cs == 1) { |
228 |
if (cs == 1) { |
topt |= T_SUPERCLIENT; |
229 |
|
anubis_changeowner(session.client); |
230 |
|
auth_tunnel(); |
231 |
|
} |
232 |
|
else if (rs |
233 |
|
&& cs == -1 |
234 |
|
&& ntohl(addr.sin_addr.s_addr) |
235 |
|
== INADDR_LOOPBACK) { |
236 |
|
if (check_username(session.client)) { |
237 |
topt |= T_SUPERCLIENT; |
topt |= T_SUPERCLIENT; |
238 |
anubis_changeowner(session.client); |
anubis_changeowner(session.client); |
239 |
auth_tunnel(); |
auth_tunnel(); |
240 |
} |
} |
|
else if (rs && cs == -1 |
|
|
&& ntohl(addr.sin_addr.s_addr) == INADDR_LOOPBACK) { |
|
|
if (check_username(session.client)) { |
|
|
topt |= T_SUPERCLIENT; |
|
|
anubis_changeowner(session.client); |
|
|
auth_tunnel(); |
|
|
} |
|
|
else |
|
|
set_unprivileged_user(); |
|
|
} |
|
|
else |
|
|
set_unprivileged_user(); |
|
|
} |
|
|
else { |
|
|
if (rs && ntohl(addr.sin_addr.s_addr) == INADDR_LOOPBACK) { |
|
|
if (check_username(session.client)) { |
|
|
topt |= T_SUPERCLIENT; |
|
|
anubis_changeowner(session.client); |
|
|
auth_tunnel(); |
|
|
} |
|
|
else |
|
|
set_unprivileged_user(); |
|
|
} |
|
241 |
else |
else |
242 |
set_unprivileged_user(); |
set_unprivileged_user(); |
243 |
} |
} |
244 |
|
else |
245 |
|
set_unprivileged_user(); |
246 |
|
|
247 |
if (!(topt & T_LOCAL_MTA) && (strlen(session.mta) == 0)) { |
if (!(topt & T_LOCAL_MTA) |
248 |
|
&& strlen(session.mta) == 0) { |
249 |
anubis_error(HARD, _("The MTA has not been specified. " |
anubis_error(HARD, _("The MTA has not been specified. " |
250 |
"Set the REMOTE-MTA or LOCAL-MTA.")); |
"Set the REMOTE-MTA or LOCAL-MTA.")); |
251 |
close_socket(sd_client); |
close_socket(sd_client); |
315 |
smtp_session((void *)sd_client, (void *)sd_server); |
smtp_session((void *)sd_client, (void *)sd_server); |
316 |
alarm(0); |
alarm(0); |
317 |
|
|
318 |
#ifdef HAVE_TLS |
#ifdef HAVE_TLS |
319 |
end_tls(SERVER, secure.server); |
end_tls(SERVER, secure.server); |
320 |
end_tls(CLIENT, secure.client); |
end_tls(CLIENT, secure.client); |
321 |
secure.server = 0; |
secure.server = 0; |
322 |
secure.client = 0; |
secure.client = 0; |
323 |
#endif /* HAVE_TLS */ |
#endif /* HAVE_TLS */ |
324 |
|
|
325 |
#ifdef HAVE_SSL |
#ifdef HAVE_SSL |
326 |
end_ssl(SERVER, secure.server, secure.ctx_server); |
end_ssl(SERVER, secure.server, secure.ctx_server); |
327 |
end_ssl(CLIENT, secure.client, secure.ctx_client); |
end_ssl(CLIENT, secure.client, secure.ctx_client); |
328 |
secure.server = 0; |
secure.server = 0; |
329 |
secure.client = 0; |
secure.client = 0; |
330 |
secure.ctx_server = 0; |
secure.ctx_server = 0; |
331 |
secure.ctx_client = 0; |
secure.ctx_client = 0; |
332 |
#endif /* HAVE_SSL */ |
#endif /* HAVE_SSL */ |
333 |
} |
} |
334 |
close_socket(sd_server); |
close_socket(sd_server); |
335 |
close_socket(sd_client); |
close_socket(sd_client); |
|
close_rcfile(); /* CLIENT */ |
|
336 |
|
|
337 |
if (topt & T_ERROR) |
if (topt & T_ERROR) |
338 |
info(NORMAL, _("Connection terminated.")); |
info(NORMAL, _("Connection terminated.")); |
339 |
else |
else |
340 |
info(NORMAL, _("Connection closed successfully.")); |
info(NORMAL, _("Connection closed successfully.")); |
341 |
|
|
342 |
#ifdef HAVE_PAM |
#ifdef HAVE_PAM |
343 |
pam_retval = pam_close_session(pamh, 0); |
pam_retval = pam_close_session(pamh, 0); |
344 |
if (pam_retval == PAM_SUCCESS) |
if (pam_retval == PAM_SUCCESS) |
345 |
info(VERBOSE, _("PAM: Session closed.")); |
info(VERBOSE, _("PAM: Session closed.")); |
348 |
info(NORMAL, _("PAM: failed to release authenticator.")); |
info(NORMAL, _("PAM: failed to release authenticator.")); |
349 |
quit(EXIT_FAILURE); |
quit(EXIT_FAILURE); |
350 |
} |
} |
351 |
#endif /* HAVE_PAM */ |
#endif /* HAVE_PAM */ |
352 |
|
|
353 |
quit(0); |
quit(0); |
354 |
} |
} |
375 |
*/ |
*/ |
376 |
|
|
377 |
if (!(topt & T_NORC)) { |
if (!(topt & T_NORC)) { |
378 |
open_rcfile(SUPERVISOR); |
open_rcfile(CF_SUPERVISOR); |
379 |
read_rcfile(SUPERVISOR); |
process_rcfile(CF_SUPERVISOR); |
|
close_rcfile(); /* SUPERVISOR */ |
|
380 |
} |
} |
381 |
|
|
382 |
anubis_getlogin(session.client, sizeof(session.client)); |
anubis_getlogin(session.client, sizeof(session.client)); |
386 |
options.termlevel = NORMAL; |
options.termlevel = NORMAL; |
387 |
anubis_error(HARD, _("The MTA has not been specified. " |
anubis_error(HARD, _("The MTA has not been specified. " |
388 |
"Set the REMOTE-MTA or LOCAL-MTA.")); |
"Set the REMOTE-MTA or LOCAL-MTA.")); |
|
close_rcfile(); /* CLIENT */ |
|
389 |
free_mem(); |
free_mem(); |
390 |
return; |
return; |
391 |
} |
} |
399 |
|
|
400 |
if (sd_server == -1) { |
if (sd_server == -1) { |
401 |
service_unavailable(sd_client); |
service_unavailable(sd_client); |
|
close_rcfile(); /* CLIENT */ |
|
402 |
free_mem(); |
free_mem(); |
403 |
return; |
return; |
404 |
} |
} |
407 |
smtp_session((void *)sd_client, (void *)sd_server); |
smtp_session((void *)sd_client, (void *)sd_server); |
408 |
|
|
409 |
close_socket(sd_server); |
close_socket(sd_server); |
|
close_rcfile(); /* CLIENT */ |
|
410 |
free_mem(); |
free_mem(); |
411 |
return; |
return; |
412 |
} |
} |