515 lines
14 KiB
C
515 lines
14 KiB
C
/*
|
|
* Licensed to the Apache Software Foundation (ASF) under one
|
|
* or more contributor license agreements. See the NOTICE file
|
|
* distributed with this work for additional information
|
|
* regarding copyright ownership. The ASF licenses this file
|
|
* to you under the Apache License, Version 2.0 (the
|
|
* "License"); you may not use this file except in compliance
|
|
* with the License. You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing,
|
|
* software distributed under the License is distributed on an
|
|
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
* KIND, either express or implied. See the License for the
|
|
* specific language governing permissions and limitations
|
|
* under the License.
|
|
*/
|
|
|
|
#include "config.h"
|
|
|
|
#include "conf.h"
|
|
#include "conf-args.h"
|
|
#include "conf-file.h"
|
|
#include "connection.h"
|
|
#include "log.h"
|
|
#include "proc-map.h"
|
|
|
|
#ifdef ENABLE_SSL
|
|
#include <openssl/ssl.h>
|
|
#endif
|
|
|
|
#include <errno.h>
|
|
#include <fcntl.h>
|
|
#include <libgen.h>
|
|
#include <netdb.h>
|
|
#include <netinet/in.h>
|
|
#include <signal.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <syslog.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/stat.h>
|
|
#include <sys/types.h>
|
|
#include <unistd.h>
|
|
|
|
#define GUACD_DEV_NULL "/dev/null"
|
|
#define GUACD_ROOT "/"
|
|
|
|
/**
|
|
* Redirects the given file descriptor to /dev/null. The given flags must match
|
|
* the read/write flags of the file descriptor given (if the given file
|
|
* descriptor was opened write-only, flags here must be O_WRONLY, etc.).
|
|
*
|
|
* @param fd
|
|
* The file descriptor to redirect to /dev/null.
|
|
*
|
|
* @param flags
|
|
* The flags to use when opening /dev/null as the target for redirection.
|
|
* These flags must match the flags of the file descriptor given.
|
|
*
|
|
* @return
|
|
* Zero on success, non-zero if redirecting the file descriptor fails.
|
|
*/
|
|
static int redirect_fd(int fd, int flags) {
|
|
|
|
/* Attempt to open bit bucket */
|
|
int new_fd = open(GUACD_DEV_NULL, flags);
|
|
if (new_fd < 0)
|
|
return 1;
|
|
|
|
/* If descriptor is different, redirect old to new and close new */
|
|
if (new_fd != fd) {
|
|
dup2(new_fd, fd);
|
|
close(new_fd);
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
/**
|
|
* Turns the current process into a daemon through a series of fork() calls.
|
|
* The standard I/O file desriptors for STDIN, STDOUT, and STDERR will be
|
|
* redirected to /dev/null, and the working directory is changed to root.
|
|
* Execution within the caller of this function will terminate before this
|
|
* function returns, while execution within the daemonized child process will
|
|
* continue.
|
|
*
|
|
* @return
|
|
* Zero if the daemonization process succeeded and we are now in the
|
|
* daemonized child process, or non-zero if daemonization failed and we are
|
|
* still the original caller. This function does not return for the original
|
|
* caller if daemonization succeeds.
|
|
*/
|
|
static int daemonize() {
|
|
|
|
pid_t pid;
|
|
|
|
/* Fork once to ensure we aren't the process group leader */
|
|
pid = fork();
|
|
if (pid < 0) {
|
|
guacd_log(GUAC_LOG_ERROR, "Could not fork() parent: %s", strerror(errno));
|
|
return 1;
|
|
}
|
|
|
|
/* Exit if we are the parent */
|
|
if (pid > 0) {
|
|
guacd_log(GUAC_LOG_DEBUG, "Exiting and passing control to PID %i", pid);
|
|
_exit(0);
|
|
}
|
|
|
|
/* Start a new session (if not already group leader) */
|
|
setsid();
|
|
|
|
/* Fork again so the session group leader exits */
|
|
pid = fork();
|
|
if (pid < 0) {
|
|
guacd_log(GUAC_LOG_ERROR, "Could not fork() group leader: %s", strerror(errno));
|
|
return 1;
|
|
}
|
|
|
|
/* Exit if we are the parent */
|
|
if (pid > 0) {
|
|
guacd_log(GUAC_LOG_DEBUG, "Exiting and passing control to PID %i", pid);
|
|
_exit(0);
|
|
}
|
|
|
|
/* Change to root directory */
|
|
if (chdir(GUACD_ROOT) < 0) {
|
|
guacd_log(GUAC_LOG_ERROR,
|
|
"Unable to change working directory to "
|
|
GUACD_ROOT);
|
|
return 1;
|
|
}
|
|
|
|
/* Reopen the 3 stdxxx to /dev/null */
|
|
|
|
if (redirect_fd(STDIN_FILENO, O_RDONLY)
|
|
|| redirect_fd(STDOUT_FILENO, O_WRONLY)
|
|
|| redirect_fd(STDERR_FILENO, O_WRONLY)) {
|
|
|
|
guacd_log(GUAC_LOG_ERROR,
|
|
"Unable to redirect standard file descriptors to "
|
|
GUACD_DEV_NULL);
|
|
return 1;
|
|
}
|
|
|
|
/* Success */
|
|
return 0;
|
|
|
|
}
|
|
|
|
#ifdef ENABLE_SSL
|
|
#ifdef OPENSSL_REQUIRES_THREADING_CALLBACKS
|
|
/**
|
|
* Array of mutexes, used by OpenSSL.
|
|
*/
|
|
static pthread_mutex_t* guacd_openssl_locks = NULL;
|
|
|
|
/**
|
|
* Called by OpenSSL when locking or unlocking the Nth mutex.
|
|
*
|
|
* @param mode
|
|
* A bitmask denoting the action to be taken on the Nth lock, such as
|
|
* CRYPTO_LOCK or CRYPTO_UNLOCK.
|
|
*
|
|
* @param n
|
|
* The index of the lock to lock or unlock.
|
|
*
|
|
* @param file
|
|
* The filename of the function setting the lock, for debugging purposes.
|
|
*
|
|
* @param line
|
|
* The line number of the function setting the lock, for debugging
|
|
* purposes.
|
|
*/
|
|
static void guacd_openssl_locking_callback(int mode, int n,
|
|
const char* file, int line){
|
|
|
|
/* Lock given mutex upon request */
|
|
if (mode & CRYPTO_LOCK)
|
|
pthread_mutex_lock(&(guacd_openssl_locks[n]));
|
|
|
|
/* Unlock given mutex upon request */
|
|
else if (mode & CRYPTO_UNLOCK)
|
|
pthread_mutex_unlock(&(guacd_openssl_locks[n]));
|
|
|
|
}
|
|
|
|
/**
|
|
* Called by OpenSSL when determining the current thread ID.
|
|
*
|
|
* @return
|
|
* An ID which uniquely identifies the current thread.
|
|
*/
|
|
static unsigned long guacd_openssl_id_callback() {
|
|
return (unsigned long) pthread_self();
|
|
}
|
|
|
|
/**
|
|
* Creates the given number of mutexes, such that OpenSSL will have at least
|
|
* this number of mutexes at its disposal.
|
|
*
|
|
* @param count
|
|
* The number of mutexes (locks) to create.
|
|
*/
|
|
static void guacd_openssl_init_locks(int count) {
|
|
|
|
int i;
|
|
|
|
/* Allocate required number of locks */
|
|
guacd_openssl_locks =
|
|
malloc(sizeof(pthread_mutex_t) * count);
|
|
|
|
/* Initialize each lock */
|
|
for (i=0; i < count; i++)
|
|
pthread_mutex_init(&(guacd_openssl_locks[i]), NULL);
|
|
|
|
}
|
|
|
|
/**
|
|
* Frees the given number of mutexes.
|
|
*
|
|
* @param count
|
|
* The number of mutexes (locks) to free.
|
|
*/
|
|
static void guacd_openssl_free_locks(int count) {
|
|
|
|
int i;
|
|
|
|
/* SSL lock array was not initialized */
|
|
if (guacd_openssl_locks == NULL)
|
|
return;
|
|
|
|
/* Free all locks */
|
|
for (i=0; i < count; i++)
|
|
pthread_mutex_destroy(&(guacd_openssl_locks[i]));
|
|
|
|
/* Free lock array */
|
|
free(guacd_openssl_locks);
|
|
|
|
}
|
|
#endif
|
|
#endif
|
|
|
|
int main(int argc, char* argv[]) {
|
|
|
|
/* Server */
|
|
int socket_fd;
|
|
struct addrinfo* addresses;
|
|
struct addrinfo* current_address;
|
|
char bound_address[1024];
|
|
char bound_port[64];
|
|
int opt_on = 1;
|
|
|
|
struct addrinfo hints = {
|
|
.ai_family = AF_UNSPEC,
|
|
.ai_socktype = SOCK_STREAM,
|
|
.ai_protocol = IPPROTO_TCP
|
|
};
|
|
|
|
/* Client */
|
|
struct sockaddr_in client_addr;
|
|
socklen_t client_addr_len;
|
|
int connected_socket_fd;
|
|
|
|
#ifdef ENABLE_SSL
|
|
SSL_CTX* ssl_context = NULL;
|
|
#endif
|
|
|
|
guacd_proc_map* map = guacd_proc_map_alloc();
|
|
|
|
/* General */
|
|
int retval;
|
|
|
|
/* Load configuration */
|
|
guacd_config* config = guacd_conf_load();
|
|
if (config == NULL || guacd_conf_parse_args(config, argc, argv))
|
|
exit(EXIT_FAILURE);
|
|
|
|
/* If requested, simply print version and exit, without initializing the
|
|
* logging system, etc. */
|
|
if (config->print_version) {
|
|
printf("Guacamole proxy daemon (guacd) version " VERSION "\n");
|
|
exit(EXIT_SUCCESS);
|
|
}
|
|
|
|
/* Init logging as early as possible */
|
|
guacd_log_level = config->max_log_level;
|
|
openlog(GUACD_LOG_NAME, LOG_PID, LOG_DAEMON);
|
|
|
|
/* Log start */
|
|
guacd_log(GUAC_LOG_INFO, "Guacamole proxy daemon (guacd) version " VERSION " started");
|
|
|
|
/* Get addresses for binding */
|
|
if ((retval = getaddrinfo(config->bind_host, config->bind_port,
|
|
&hints, &addresses))) {
|
|
|
|
guacd_log(GUAC_LOG_ERROR, "Error parsing given address or port: %s",
|
|
gai_strerror(retval));
|
|
exit(EXIT_FAILURE);
|
|
|
|
}
|
|
|
|
/* Get socket */
|
|
socket_fd = socket(AF_INET, SOCK_STREAM, 0);
|
|
if (socket_fd < 0) {
|
|
guacd_log(GUAC_LOG_ERROR, "Error opening socket: %s", strerror(errno));
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
/* Allow socket reuse */
|
|
if (setsockopt(socket_fd, SOL_SOCKET, SO_REUSEADDR,
|
|
(void*) &opt_on, sizeof(opt_on))) {
|
|
guacd_log(GUAC_LOG_WARNING, "Unable to set socket options for reuse: %s",
|
|
strerror(errno));
|
|
}
|
|
|
|
/* Attempt binding of each address until success */
|
|
current_address = addresses;
|
|
while (current_address != NULL) {
|
|
|
|
int retval;
|
|
|
|
/* Resolve hostname */
|
|
if ((retval = getnameinfo(current_address->ai_addr,
|
|
current_address->ai_addrlen,
|
|
bound_address, sizeof(bound_address),
|
|
bound_port, sizeof(bound_port),
|
|
NI_NUMERICHOST | NI_NUMERICSERV)))
|
|
guacd_log(GUAC_LOG_ERROR, "Unable to resolve host: %s",
|
|
gai_strerror(retval));
|
|
|
|
/* Attempt to bind socket to address */
|
|
if (bind(socket_fd,
|
|
current_address->ai_addr,
|
|
current_address->ai_addrlen) == 0) {
|
|
|
|
guacd_log(GUAC_LOG_DEBUG, "Successfully bound socket to "
|
|
"host %s, port %s", bound_address, bound_port);
|
|
|
|
/* Done if successful bind */
|
|
break;
|
|
|
|
}
|
|
|
|
/* Otherwise log information regarding bind failure */
|
|
else
|
|
guacd_log(GUAC_LOG_DEBUG, "Unable to bind socket to "
|
|
"host %s, port %s: %s",
|
|
bound_address, bound_port, strerror(errno));
|
|
|
|
current_address = current_address->ai_next;
|
|
|
|
}
|
|
|
|
/* If unable to bind to anything, fail */
|
|
if (current_address == NULL) {
|
|
guacd_log(GUAC_LOG_ERROR, "Unable to bind socket to any addresses.");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
#ifdef ENABLE_SSL
|
|
/* Init SSL if enabled */
|
|
if (config->key_file != NULL || config->cert_file != NULL) {
|
|
|
|
guacd_log(GUAC_LOG_INFO, "Communication will require SSL/TLS.");
|
|
|
|
#ifdef OPENSSL_REQUIRES_THREADING_CALLBACKS
|
|
/* Init threadsafety in OpenSSL */
|
|
guacd_openssl_init_locks(CRYPTO_num_locks());
|
|
CRYPTO_set_id_callback(guacd_openssl_id_callback);
|
|
CRYPTO_set_locking_callback(guacd_openssl_locking_callback);
|
|
#endif
|
|
|
|
/* Init SSL */
|
|
SSL_library_init();
|
|
SSL_load_error_strings();
|
|
ssl_context = SSL_CTX_new(SSLv23_server_method());
|
|
|
|
/* Load key */
|
|
if (config->key_file != NULL) {
|
|
guacd_log(GUAC_LOG_INFO, "Using PEM keyfile %s", config->key_file);
|
|
if (!SSL_CTX_use_PrivateKey_file(ssl_context, config->key_file, SSL_FILETYPE_PEM)) {
|
|
guacd_log(GUAC_LOG_ERROR, "Unable to load keyfile.");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
else
|
|
guacd_log(GUAC_LOG_WARNING, "No PEM keyfile given - SSL/TLS may not work.");
|
|
|
|
/* Load cert file if specified */
|
|
if (config->cert_file != NULL) {
|
|
guacd_log(GUAC_LOG_INFO, "Using certificate file %s", config->cert_file);
|
|
if (!SSL_CTX_use_certificate_chain_file(ssl_context, config->cert_file)) {
|
|
guacd_log(GUAC_LOG_ERROR, "Unable to load certificate.");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
else
|
|
guacd_log(GUAC_LOG_WARNING, "No certificate file given - SSL/TLS may not work.");
|
|
|
|
}
|
|
#endif
|
|
|
|
/* Daemonize if requested */
|
|
if (!config->foreground) {
|
|
|
|
/* Attempt to daemonize process */
|
|
if (daemonize()) {
|
|
guacd_log(GUAC_LOG_ERROR, "Could not become a daemon.");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
}
|
|
|
|
/* Write PID file if requested */
|
|
if (config->pidfile != NULL) {
|
|
|
|
/* Attempt to open pidfile and write PID */
|
|
FILE* pidf = fopen(config->pidfile, "w");
|
|
if (pidf) {
|
|
fprintf(pidf, "%d\n", getpid());
|
|
fclose(pidf);
|
|
}
|
|
|
|
/* Fail if could not write PID file*/
|
|
else {
|
|
guacd_log(GUAC_LOG_ERROR, "Could not write PID file: %s", strerror(errno));
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
}
|
|
|
|
/* Ignore SIGPIPE */
|
|
if (signal(SIGPIPE, SIG_IGN) == SIG_ERR) {
|
|
guacd_log(GUAC_LOG_INFO, "Could not set handler for SIGPIPE to ignore. "
|
|
"SIGPIPE may cause termination of the daemon.");
|
|
}
|
|
|
|
/* Ignore SIGCHLD (force automatic removal of children) */
|
|
if (signal(SIGCHLD, SIG_IGN) == SIG_ERR) {
|
|
guacd_log(GUAC_LOG_INFO, "Could not set handler for SIGCHLD to ignore. "
|
|
"Child processes may pile up in the process table.");
|
|
}
|
|
|
|
/* Log listening status */
|
|
guacd_log(GUAC_LOG_INFO, "Listening on host %s, port %s", bound_address, bound_port);
|
|
|
|
/* Free addresses */
|
|
freeaddrinfo(addresses);
|
|
|
|
/* Listen for connections */
|
|
if (listen(socket_fd, 5) < 0) {
|
|
guacd_log(GUAC_LOG_ERROR, "Could not listen on socket: %s", strerror(errno));
|
|
return 3;
|
|
}
|
|
|
|
/* Daemon loop */
|
|
for (;;) {
|
|
|
|
pthread_t child_thread;
|
|
|
|
/* Accept connection */
|
|
client_addr_len = sizeof(client_addr);
|
|
connected_socket_fd = accept(socket_fd,
|
|
(struct sockaddr*) &client_addr, &client_addr_len);
|
|
|
|
if (connected_socket_fd < 0) {
|
|
guacd_log(GUAC_LOG_ERROR, "Could not accept client connection: %s", strerror(errno));
|
|
continue;
|
|
}
|
|
|
|
/* Create parameters for connection thread */
|
|
guacd_connection_thread_params* params = malloc(sizeof(guacd_connection_thread_params));
|
|
if (params == NULL) {
|
|
guacd_log(GUAC_LOG_ERROR, "Could not create connection thread: %s", strerror(errno));
|
|
continue;
|
|
}
|
|
|
|
params->map = map;
|
|
params->connected_socket_fd = connected_socket_fd;
|
|
|
|
#ifdef ENABLE_SSL
|
|
params->ssl_context = ssl_context;
|
|
#endif
|
|
|
|
/* Spawn thread to handle connection */
|
|
pthread_create(&child_thread, NULL, guacd_connection_thread, params);
|
|
pthread_detach(child_thread);
|
|
|
|
}
|
|
|
|
/* Close socket */
|
|
if (close(socket_fd) < 0) {
|
|
guacd_log(GUAC_LOG_ERROR, "Could not close socket: %s", strerror(errno));
|
|
return 3;
|
|
}
|
|
|
|
#ifdef ENABLE_SSL
|
|
if (ssl_context != NULL) {
|
|
#ifdef OPENSSL_REQUIRES_THREADING_CALLBACKS
|
|
guacd_openssl_free_locks(CRYPTO_num_locks());
|
|
#endif
|
|
SSL_CTX_free(ssl_context);
|
|
}
|
|
#endif
|
|
|
|
return 0;
|
|
|
|
}
|
|
|