2 * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37 * a tuple describing on what to listen
46 /* the current ones */
48 static struct port_desc
*ports
;
49 static size_t num_ports
;
50 static pid_t bonjour_pid
= -1;
53 * add `family, port, protocol' to the list with duplicate suppresion.
57 add_port(krb5_context context
,
58 int family
, int port
, const char *protocol
)
63 if(strcmp(protocol
, "udp") == 0)
65 else if(strcmp(protocol
, "tcp") == 0)
69 for(i
= 0; i
< num_ports
; i
++){
70 if(ports
[i
].type
== type
71 && ports
[i
].port
== port
72 && ports
[i
].family
== family
)
75 ports
= realloc(ports
, (num_ports
+ 1) * sizeof(*ports
));
77 krb5_err (context
, 1, errno
, "realloc");
78 ports
[num_ports
].family
= family
;
79 ports
[num_ports
].type
= type
;
80 ports
[num_ports
].port
= port
;
85 * add a triple but with service -> port lookup
86 * (this prints warnings for stuff that does not exist)
90 add_port_service(krb5_context context
,
91 int family
, const char *service
, int port
,
94 port
= krb5_getportbyname (context
, service
, protocol
, port
);
95 add_port (context
, family
, port
, protocol
);
99 * add the port with service -> port lookup or string -> number
100 * (no warning is printed)
104 add_port_string (krb5_context context
,
105 int family
, const char *str
, const char *protocol
)
110 sp
= roken_getservbyname (str
, protocol
);
116 port
= htons(strtol(str
, &end
, 0));
120 add_port (context
, family
, port
, protocol
);
124 * add the standard collection of ports for `family'
128 add_standard_ports (krb5_context context
,
129 krb5_kdc_configuration
*config
,
132 add_port_service(context
, family
, "kerberos", 88, "udp");
133 add_port_service(context
, family
, "kerberos", 88, "tcp");
134 add_port_service(context
, family
, "kerberos-sec", 88, "udp");
135 add_port_service(context
, family
, "kerberos-sec", 88, "tcp");
137 add_port_service(context
, family
, "http", 80, "tcp");
138 if(config
->enable_kx509
) {
139 add_port_service(context
, family
, "kca_service", 9878, "udp");
140 add_port_service(context
, family
, "kca_service", 9878, "tcp");
146 * parse the set of space-delimited ports in `str' and add them.
147 * "+" => all the standard ones
148 * otherwise it's port|service[/protocol]
152 parse_ports(krb5_context context
,
153 krb5_kdc_configuration
*config
,
158 char *str_copy
= strdup (str
);
160 p
= strtok_r(str_copy
, " \t", &pos
);
162 if(strcmp(p
, "+") == 0) {
164 add_standard_ports(context
, config
, AF_INET6
);
166 add_standard_ports(context
, config
, AF_INET
);
168 char *q
= strchr(p
, '/');
172 add_port_string(context
, AF_INET6
, p
, q
);
174 add_port_string(context
, AF_INET
, p
, q
);
177 add_port_string(context
, AF_INET6
, p
, "udp");
178 add_port_string(context
, AF_INET6
, p
, "tcp");
180 add_port_string(context
, AF_INET
, p
, "udp");
181 add_port_string(context
, AF_INET
, p
, "tcp");
185 p
= strtok_r(NULL
, " \t", &pos
);
191 * every socket we listen on
202 struct sockaddr_storage __ss
;
205 char addr_string
[128];
209 init_descr(struct descr
*d
)
211 memset(d
, 0, sizeof(*d
));
212 d
->sa
= (struct sockaddr
*)&d
->__ss
;
213 d
->s
= rk_INVALID_SOCKET
;
217 * re-initialize all `n' ->sa in `d'.
221 reinit_descrs (struct descr
*d
, int n
)
225 for (i
= 0; i
< n
; ++i
)
226 d
[i
].sa
= (struct sockaddr
*)&d
[i
].__ss
;
230 * Create the socket (family, type, port) in `d'
234 init_socket(krb5_context context
,
235 krb5_kdc_configuration
*config
,
236 struct descr
*d
, krb5_address
*a
, int family
, int type
, int port
)
239 struct sockaddr_storage __ss
;
240 struct sockaddr
*sa
= (struct sockaddr
*)&__ss
;
241 krb5_socklen_t sa_size
= sizeof(__ss
);
245 ret
= krb5_addr2sockaddr (context
, a
, sa
, &sa_size
, port
);
247 krb5_warn(context
, ret
, "krb5_addr2sockaddr");
248 rk_closesocket(d
->s
);
249 d
->s
= rk_INVALID_SOCKET
;
253 if (sa
->sa_family
!= family
)
256 d
->s
= socket(family
, type
, 0);
257 if(rk_IS_BAD_SOCKET(d
->s
)){
258 krb5_warn(context
, errno
, "socket(%d, %d, 0)", family
, type
);
259 d
->s
= rk_INVALID_SOCKET
;
263 #if defined(HAVE_SETSOCKOPT) && defined(SOL_SOCKET) && defined(SO_REUSEADDR)
266 setsockopt(d
->s
, SOL_SOCKET
, SO_REUSEADDR
, (void *)&one
, sizeof(one
));
272 socket_set_nonblocking(d
->s
, 1);
274 if(rk_IS_SOCKET_ERROR(bind(d
->s
, sa
, sa_size
))){
278 krb5_print_address (a
, a_str
, sizeof(a_str
), &len
);
279 krb5_warn(context
, errno
, "bind %s/%d", a_str
, ntohs(port
));
280 rk_closesocket(d
->s
);
281 d
->s
= rk_INVALID_SOCKET
;
284 if(type
== SOCK_STREAM
&& rk_IS_SOCKET_ERROR(listen(d
->s
, SOMAXCONN
))){
288 krb5_print_address (a
, a_str
, sizeof(a_str
), &len
);
289 krb5_warn(context
, errno
, "listen %s/%d", a_str
, ntohs(port
));
290 rk_closesocket(d
->s
);
291 d
->s
= rk_INVALID_SOCKET
;
297 * Allocate descriptors for all the sockets that we should listen on
298 * and return the number of them.
302 init_sockets(krb5_context context
,
303 krb5_kdc_configuration
*config
,
310 krb5_addresses addresses
;
312 if (explicit_addresses
.len
) {
313 addresses
= explicit_addresses
;
315 ret
= krb5_get_all_server_addrs (context
, &addresses
);
317 krb5_err (context
, 1, ret
, "krb5_get_all_server_addrs");
319 parse_ports(context
, config
, port_str
);
320 d
= malloc(addresses
.len
* num_ports
* sizeof(*d
));
322 krb5_errx(context
, 1, "malloc(%lu) failed",
323 (unsigned long)num_ports
* sizeof(*d
));
325 for (i
= 0; i
< num_ports
; i
++){
326 for (j
= 0; j
< addresses
.len
; ++j
) {
327 init_socket(context
, config
, &d
[num
], &addresses
.val
[j
],
328 ports
[i
].family
, ports
[i
].type
, ports
[i
].port
);
329 if(d
[num
].s
!= rk_INVALID_SOCKET
){
333 krb5_print_address (&addresses
.val
[j
], a_str
,
334 sizeof(a_str
), &len
);
336 kdc_log(context
, config
, 3, "listening on %s port %u/%s",
338 ntohs(ports
[i
].port
),
339 (ports
[i
].type
== SOCK_STREAM
) ? "tcp" : "udp");
345 krb5_free_addresses (context
, &addresses
);
346 d
= realloc(d
, num
* sizeof(*d
));
347 if (d
== NULL
&& num
!= 0)
348 krb5_errx(context
, 1, "realloc(%lu) failed",
349 (unsigned long)num
* sizeof(*d
));
350 reinit_descrs (d
, num
);
360 descr_type(struct descr
*d
)
362 if (d
->type
== SOCK_DGRAM
)
364 else if (d
->type
== SOCK_STREAM
)
370 addr_to_string(krb5_context context
,
371 struct sockaddr
*addr
, size_t addr_len
, char *str
, size_t len
)
374 if(krb5_sockaddr2address(context
, addr
, &a
) == 0) {
375 if(krb5_print_address(&a
, str
, len
, &len
) == 0) {
376 krb5_free_address(context
, &a
);
379 krb5_free_address(context
, &a
);
381 snprintf(str
, len
, "<family=%d>", addr
->sa_family
);
389 send_reply(krb5_context context
,
390 krb5_kdc_configuration
*config
,
391 krb5_boolean prependlength
,
395 kdc_log(context
, config
, 4,
396 "sending %lu bytes to %s", (unsigned long)reply
->length
,
400 l
[0] = (reply
->length
>> 24) & 0xff;
401 l
[1] = (reply
->length
>> 16) & 0xff;
402 l
[2] = (reply
->length
>> 8) & 0xff;
403 l
[3] = reply
->length
& 0xff;
404 if(rk_IS_SOCKET_ERROR(sendto(d
->s
, l
, sizeof(l
), 0, d
->sa
, d
->sock_len
))) {
405 kdc_log (context
, config
,
406 1, "sendto(%s): %s", d
->addr_string
,
407 strerror(rk_SOCK_ERRNO
));
411 if(rk_IS_SOCKET_ERROR(sendto(d
->s
, reply
->data
, reply
->length
, 0, d
->sa
, d
->sock_len
))) {
412 kdc_log (context
, config
, 1, "sendto(%s): %s", d
->addr_string
,
413 strerror(rk_SOCK_ERRNO
));
419 * Handle the request in `buf, len' to socket `d'
423 do_request(krb5_context context
,
424 krb5_kdc_configuration
*config
,
425 void *buf
, size_t len
, krb5_boolean prependlength
,
430 int datagram_reply
= (d
->type
== SOCK_DGRAM
);
432 krb5_kdc_update_time(NULL
);
434 krb5_data_zero(&reply
);
435 ret
= krb5_kdc_process_request(context
, config
,
436 buf
, len
, &reply
, &prependlength
,
437 d
->addr_string
, d
->sa
,
440 krb5_kdc_save_request(context
, request_log
, buf
, len
, &reply
, d
->sa
);
442 send_reply(context
, config
, prependlength
, d
, &reply
);
443 krb5_data_free(&reply
);
446 kdc_log(context
, config
, 1,
447 "Failed processing %lu byte request from %s",
448 (unsigned long)len
, d
->addr_string
);
452 * Handle incoming data to the UDP socket in `d'
456 handle_udp(krb5_context context
,
457 krb5_kdc_configuration
*config
,
463 buf
= malloc(max_request_udp
);
465 kdc_log(context
, config
, 1, "Failed to allocate %lu bytes",
466 (unsigned long)max_request_udp
);
470 d
->sock_len
= sizeof(d
->__ss
);
471 n
= recvfrom(d
->s
, buf
, max_request_udp
, 0, d
->sa
, &d
->sock_len
);
472 if (rk_IS_SOCKET_ERROR(n
)) {
473 if (rk_SOCK_ERRNO
!= EAGAIN
&& rk_SOCK_ERRNO
!= EINTR
)
474 krb5_warn(context
, rk_SOCK_ERRNO
, "recvfrom");
476 addr_to_string (context
, d
->sa
, d
->sock_len
,
477 d
->addr_string
, sizeof(d
->addr_string
));
478 if ((size_t)n
== max_request_udp
) {
480 krb5_warn(context
, errno
,
481 "recvfrom: truncated packet from %s, asking for TCP",
483 krb5_mk_error(context
,
484 KRB5KRB_ERR_RESPONSE_TOO_BIG
,
492 send_reply(context
, config
, FALSE
, d
, &data
);
493 krb5_data_free(&data
);
495 do_request(context
, config
, buf
, n
, FALSE
, d
);
502 clear_descr(struct descr
*d
)
505 memset(d
->buf
, 0, d
->size
);
507 if(d
->s
!= rk_INVALID_SOCKET
)
508 rk_closesocket(d
->s
);
509 d
->s
= rk_INVALID_SOCKET
;
513 /* remove HTTP %-quoting from buf */
517 unsigned char *p
, *q
;
520 for (p
= q
= (unsigned char *)buf
; *p
; p
++, q
++) {
522 if (!(isxdigit(p
[1]) && isxdigit(p
[2])))
525 if (sscanf((char *)p
+ 1, "%2x", &x
) != 1)
538 #define TCP_TIMEOUT 4
541 * accept a new TCP connection on `d[parent]' and store it in `d[child]'
545 add_new_tcp (krb5_context context
,
546 krb5_kdc_configuration
*config
,
547 struct descr
*d
, int parent
, int child
)
554 d
[child
].sock_len
= sizeof(d
[child
].__ss
);
555 s
= accept(d
[parent
].s
, d
[child
].sa
, &d
[child
].sock_len
);
556 if(rk_IS_BAD_SOCKET(s
)) {
557 if (rk_SOCK_ERRNO
!= EAGAIN
&& rk_SOCK_ERRNO
!= EINTR
)
558 krb5_warn(context
, rk_SOCK_ERRNO
, "accept");
563 if (s
>= FD_SETSIZE
) {
564 krb5_warnx(context
, "socket FD too large");
571 d
[child
].timeout
= time(NULL
) + TCP_TIMEOUT
;
572 d
[child
].type
= SOCK_STREAM
;
573 addr_to_string (context
,
574 d
[child
].sa
, d
[child
].sock_len
,
575 d
[child
].addr_string
, sizeof(d
[child
].addr_string
));
579 * Grow `d' to handle at least `n'.
580 * Return != 0 if fails
584 grow_descr (krb5_context context
,
585 krb5_kdc_configuration
*config
,
586 struct descr
*d
, size_t n
)
588 if (d
->size
- d
->len
< n
) {
592 grow
= max(1024, d
->len
+ n
);
593 if (d
->size
+ grow
> max_request_tcp
) {
594 kdc_log(context
, config
, 2, "Request exceeds max request size (%lu bytes).",
595 (unsigned long)d
->size
+ grow
);
599 tmp
= realloc (d
->buf
, d
->size
+ grow
);
601 kdc_log(context
, config
, 1, "Failed to re-allocate %lu bytes.",
602 (unsigned long)d
->size
+ grow
);
613 * Try to handle the TCP data at `d->buf, d->len'.
614 * Return -1 if failed, 0 if succesful, and 1 if data is complete.
618 handle_vanilla_tcp (krb5_context context
,
619 krb5_kdc_configuration
*config
,
625 sp
= krb5_storage_from_mem(d
->buf
, d
->len
);
627 kdc_log (context
, config
, 1, "krb5_storage_from_mem failed");
630 krb5_ret_uint32(sp
, &len
);
631 krb5_storage_free(sp
);
632 if(d
->len
- 4 >= len
) {
633 memmove(d
->buf
, d
->buf
+ 4, d
->len
- 4);
641 * Try to handle the TCP/HTTP data at `d->buf, d->len'.
642 * Return -1 if failed, 0 if succesful, and 1 if data is complete.
646 handle_http_tcp (krb5_context context
,
647 krb5_kdc_configuration
*config
,
657 /* If its a multi line query, truncate off the first line */
658 p
= strstr(s
, "\r\n");
663 t
= strtok_r(s
, " \t", &p
);
665 kdc_log(context
, config
, 2,
666 "Missing HTTP operand (GET) request from %s", d
->addr_string
);
670 t
= strtok_r(NULL
, " \t", &p
);
672 kdc_log(context
, config
, 2,
673 "Missing HTTP GET data in request from %s", d
->addr_string
);
677 data
= malloc(strlen(t
));
679 kdc_log(context
, config
, 1, "Failed to allocate %lu bytes",
680 (unsigned long)strlen(t
));
685 if(de_http(t
) != 0) {
686 kdc_log(context
, config
, 2, "Malformed HTTP request from %s", d
->addr_string
);
687 kdc_log(context
, config
, 4, "HTTP request: %s", t
);
691 proto
= strtok_r(NULL
, " \t", &p
);
693 kdc_log(context
, config
, 2, "Malformed HTTP request from %s", d
->addr_string
);
697 len
= rk_base64_decode(t
, data
);
701 "Server: Heimdal/" VERSION
"\r\n"
702 "Cache-Control: no-cache\r\n"
703 "Pragma: no-cache\r\n"
704 "Content-type: text/html\r\n"
705 "Content-transfer-encoding: 8bit\r\n\r\n"
706 "<TITLE>404 Not found</TITLE>\r\n"
707 "<H1>404 Not found</H1>\r\n"
708 "That page doesn't exist, maybe you are looking for "
709 "<A HREF=\"http://www.h5l.org/\">Heimdal</A>?\r\n";
710 kdc_log(context
, config
, 2, "HTTP request from %s is non KDC request", d
->addr_string
);
711 kdc_log(context
, config
, 4, "HTTP request: %s", t
);
713 if (rk_IS_SOCKET_ERROR(send(d
->s
, proto
, strlen(proto
), 0))) {
714 kdc_log(context
, config
, 1, "HTTP write failed: %s: %s",
715 d
->addr_string
, strerror(rk_SOCK_ERRNO
));
718 if (rk_IS_SOCKET_ERROR(send(d
->s
, msg
, strlen(msg
), 0))) {
719 kdc_log(context
, config
, 1, "HTTP write failed: %s: %s",
720 d
->addr_string
, strerror(rk_SOCK_ERRNO
));
728 "Server: Heimdal/" VERSION
"\r\n"
729 "Cache-Control: no-cache\r\n"
730 "Pragma: no-cache\r\n"
731 "Content-type: application/octet-stream\r\n"
732 "Content-transfer-encoding: binary\r\n\r\n";
733 if (rk_IS_SOCKET_ERROR(send(d
->s
, proto
, strlen(proto
), 0))) {
735 kdc_log(context
, config
, 1, "HTTP write failed: %s: %s",
736 d
->addr_string
, strerror(rk_SOCK_ERRNO
));
739 if (rk_IS_SOCKET_ERROR(send(d
->s
, msg
, strlen(msg
), 0))) {
741 kdc_log(context
, config
, 1, "HTTP write failed: %s: %s",
742 d
->addr_string
, strerror(rk_SOCK_ERRNO
));
746 if ((size_t)len
> d
->len
)
748 memcpy(d
->buf
, data
, len
);
755 http1_request_taste(const unsigned char *req
, size_t len
)
757 return !!((len
>= sizeof("GET ") - 1 &&
758 memcmp(req
, "GET ", sizeof("GET ") - 1) == 0) ||
759 (len
>= sizeof("HEAD ") - 1 &&
760 memcmp(req
, "HEAD ", sizeof("HEAD ") - 1) == 0));
764 http1_request_is_complete(const unsigned char *req
, size_t len
)
767 return http1_request_taste(req
, len
) &&
768 memmem(req
, len
, "\r\n\r\n", sizeof("\r\n\r\n") - 4) != NULL
;
771 * For POST (the MSFT variant of this protocol) we'll need something like
772 * this (plus check for Content-Length/Transfer-Encoding):
774 * const unsigned char *body;
775 * if ((body = memmem(req, len, "\r\n\r\n", sizeof("\r\n\r\n") - 4)) == NULL)
777 * body += sizeof("\r\n\r\n") - 4;
778 * len -= (body - req);
779 * return memmem(body, len, "\r\n\r\n", sizeof("\r\n\r\n") - 4) != NULL;
781 * Since the POST-based variant runs over HTTPS, we'll probably implement
782 * that in a proxy instead of here.
787 * Handle incoming data to the TCP socket in `d[index]'
791 handle_tcp(krb5_context context
,
792 krb5_kdc_configuration
*config
,
793 struct descr
*d
, int idx
, int min_free
)
795 unsigned char buf
[1024];
799 if (d
[idx
].timeout
== 0) {
800 add_new_tcp (context
, config
, d
, idx
, min_free
);
804 n
= recvfrom(d
[idx
].s
, buf
, sizeof(buf
), 0, NULL
, NULL
);
805 if(rk_IS_SOCKET_ERROR(n
)){
806 krb5_warn(context
, rk_SOCK_ERRNO
, "recvfrom failed from %s to %s/%d",
807 d
[idx
].addr_string
, descr_type(d
+ idx
),
811 krb5_warnx(context
, "connection closed before end of data after %lu "
812 "bytes from %s to %s/%d", (unsigned long)d
[idx
].len
,
813 d
[idx
].addr_string
, descr_type(d
+ idx
),
815 clear_descr (d
+ idx
);
818 if (grow_descr (context
, config
, &d
[idx
], n
))
820 memcpy(d
[idx
].buf
+ d
[idx
].len
, buf
, n
);
822 if(d
[idx
].len
> 4 && d
[idx
].buf
[0] == 0) {
823 ret
= handle_vanilla_tcp (context
, config
, &d
[idx
]);
824 } else if (enable_http
&&
825 http1_request_taste(d
[idx
].buf
, d
[idx
].len
)) {
827 if (http1_request_is_complete(d
[idx
].buf
, d
[idx
].len
)) {
828 /* NUL-terminate at the request header ending \r\n\r\n */
829 d
[idx
].buf
[d
[idx
].len
- 4] = '\0';
830 ret
= handle_http_tcp (context
, config
, &d
[idx
]);
832 } else if (d
[idx
].len
> 4) {
833 kdc_log (context
, config
,
834 2, "TCP data of strange type from %s to %s/%d",
835 d
[idx
].addr_string
, descr_type(d
+ idx
),
837 if (d
[idx
].buf
[0] & 0x80) {
840 kdc_log (context
, config
, 2, "TCP extension not supported");
842 ret
= krb5_mk_error(context
,
843 KRB5KRB_ERR_FIELD_TOOLONG
,
852 send_reply(context
, config
, TRUE
, d
+ idx
, &reply
);
853 krb5_data_free(&reply
);
856 clear_descr(d
+ idx
);
861 * ret == 0 -> not enough of request buffered -> wait for more
862 * ret == 1 -> go ahead and perform the request
863 * ret != 0 (really, < 0) -> error, probably ENOMEM, close connection
866 do_request(context
, config
,
867 d
[idx
].buf
, d
[idx
].len
, TRUE
, &d
[idx
]);
870 * Note: this means we don't keep the connection open even where we
871 * the protocol permits it.
874 clear_descr(d
+ idx
);
879 handle_islive(int fd
)
884 ret
= read(fd
, &buf
, 1);
891 realloc_descrs(struct descr
**d
, unsigned int *ndescr
)
896 tmp
= realloc(*d
, (*ndescr
+ 4) * sizeof(**d
));
901 reinit_descrs (*d
, *ndescr
);
902 memset(*d
+ *ndescr
, 0, 4 * sizeof(**d
));
903 for(i
= *ndescr
; i
< *ndescr
+ 4; i
++)
912 next_min_free(krb5_context context
, struct descr
**d
, unsigned int *ndescr
)
917 for(i
= 0; i
< *ndescr
; i
++) {
919 if(rk_IS_BAD_SOCKET(s
))
924 if(!realloc_descrs(d
, ndescr
)) {
926 krb5_warnx(context
, "No memory");
933 loop(krb5_context context
, krb5_kdc_configuration
*config
,
934 struct descr
**dp
, unsigned int *ndescrp
, int islive
)
936 struct descr
*d
= *dp
;
937 unsigned int ndescr
= *ndescrp
;
939 while (exit_flag
== 0) {
940 struct timeval tmout
;
948 FD_SET(islive
, &fds
);
951 for (i
= 0; i
< ndescr
; i
++) {
952 if (!rk_IS_BAD_SOCKET(d
[i
].s
)) {
953 if (d
[i
].type
== SOCK_STREAM
&&
954 d
[i
].timeout
&& d
[i
].timeout
< time(NULL
)) {
955 kdc_log(context
, config
, 2,
956 "TCP-connection from %s expired after %lu bytes",
957 d
[i
].addr_string
, (unsigned long)d
[i
].len
);
961 #ifndef NO_LIMIT_FD_SETSIZE
965 if (max_fd
>= FD_SETSIZE
)
966 krb5_errx(context
, 1, "fd too large");
969 FD_SET(d
[i
].s
, &fds
);
973 tmout
.tv_sec
= TCP_TIMEOUT
;
975 switch(select(max_fd
+ 1, &fds
, 0, 0, &tmout
)){
980 krb5_warn(context
, rk_SOCK_ERRNO
, "select");
984 if (islive
> -1 && FD_ISSET(islive
, &fds
))
985 handle_islive(islive
);
987 for (i
= 0; i
< ndescr
; i
++)
988 if (!rk_IS_BAD_SOCKET(d
[i
].s
) && FD_ISSET(d
[i
].s
, &fds
)) {
989 min_free
= next_min_free(context
, dp
, ndescrp
);
993 if (d
[i
].type
== SOCK_DGRAM
)
994 handle_udp(context
, config
, &d
[i
]);
995 else if (d
[i
].type
== SOCK_STREAM
)
996 handle_tcp(context
, config
, d
, i
, min_free
);
1001 switch (exit_flag
) {
1003 kdc_log(context
, config
, 0,
1004 "KDC worker process exiting because KDC master exited.");
1008 kdc_log(context
, config
, 0, "CPU time limit exceeded");
1013 kdc_log(context
, config
, 0, "Terminated");
1016 kdc_log(context
, config
, 0, "Unexpected exit reason: %d", exit_flag
);
1023 bonjour_kid(krb5_context context
, krb5_kdc_configuration
*config
, const char *argv0
, int *islive
)
1027 if (do_bonjour
> 0) {
1028 bonjour_announce(context
, config
);
1030 while (read(0, &buf
, 1) == 1)
1035 if ((bonjour_pid
= fork()) != 0)
1039 if (dup2(islive
[1], 0) == -1)
1040 err(1, "failed to announce with bonjour (dup)");
1043 execlp(argv0
, "kdc", "--bonjour", NULL
);
1044 err(1, "failed to announce with bonjour (exec)");
1050 kill_kids(pid_t
*pids
, int max_kids
, int sig
)
1054 for (i
=0; i
< max_kids
; i
++)
1057 if (bonjour_pid
> 0)
1058 kill(sig
, bonjour_pid
);
1062 reap_kid(krb5_context context
, krb5_kdc_configuration
*config
,
1063 pid_t
*pids
, int max_kids
, int options
)
1068 int i
= 0; /* quiet warnings */
1071 const char *sev
= "info: ";
1073 pid
= waitpid(-1, &status
, options
);
1077 if (pid
== bonjour_pid
) {
1078 bonjour_pid
= (pid_t
)-1;
1081 for (i
=0; i
< max_kids
; i
++) {
1082 if (pids
[i
] == pid
) {
1083 pids
[i
] = (pid_t
)-1;
1090 if (i
== max_kids
) {
1091 /* should not happen */
1098 if (WIFEXITED(status
))
1099 kdc_log(context
, config
, level
,
1100 "%sKDC reaped %s process: %d, exit status: %d",
1101 sev
, what
, (int)pid
, WEXITSTATUS(status
));
1102 else if (WIFSIGNALED(status
))
1103 kdc_log(context
, config
, level
,
1104 "%sKDC reaped %s process: %d, term signal %d%s",
1105 sev
, what
, (int)pid
, WTERMSIG(status
),
1106 WCOREDUMP(status
) ? " (core dumped)" : "");
1108 kdc_log(context
, config
, level
, "%sKDC reaped %s process: %d",
1109 sev
, what
, (int)pid
);
1115 reap_kids(krb5_context context
, krb5_kdc_configuration
*config
,
1116 pid_t
*pids
, int max_kids
)
1121 if (reap_kid(context
, config
, pids
, max_kids
, WNOHANG
) == 0)
1130 select_sleep(int microseconds
)
1134 tv
.tv_sec
= microseconds
/ 1000000;
1135 tv
.tv_usec
= microseconds
% 1000000;
1136 select(0, NULL
, NULL
, NULL
, &tv
);
1141 start_kdc(krb5_context context
,
1142 krb5_kdc_configuration
*config
, const char *argv0
)
1147 unsigned int ndescr
;
1151 int max_kdcs
= config
->num_kdc_processes
;
1159 bonjour_kid(context
, config
, argv0
, NULL
);
1163 #ifdef _SC_NPROCESSORS_ONLN
1165 max_kdcs
= sysconf(_SC_NPROCESSORS_ONLN
);
1171 pids
= calloc(max_kdcs
, sizeof(*pids
));
1173 krb5_err(context
, 1, errno
, "malloc");
1176 * We open a socketpair of which we hand one end to each of our kids.
1177 * When we exit, for whatever reason, the children will notice an EOF
1178 * on their end and be able to cleanly exit.
1181 if (socketpair(PF_UNIX
, SOCK_STREAM
, 0, islive
) == -1)
1182 krb5_errx(context
, 1, "socketpair");
1183 socket_set_nonblocking(islive
[1], 1);
1186 ndescr
= init_sockets(context
, config
, &d
);
1188 krb5_errx(context
, 1, "No sockets!");
1194 bonjour_kid(context
, config
, argv0
, islive
);
1197 kdc_log(context
, config
, 3, "KDC started master process pid=%d", getpid());
1199 kdc_log(context
, config
, 3, "KDC started pid=%d", getpid());
1202 roken_detach_finish(NULL
, daemon_child
);
1205 if (!testing_flag
) {
1206 /* Note that we might never execute the body of this loop */
1207 while (exit_flag
== 0) {
1209 if (num_kdcs
>= max_kdcs
) {
1210 num_kdcs
-= reap_kid(context
, config
, pids
, max_kdcs
, 0);
1215 num_kdcs
-= reap_kids(context
, config
, pids
, max_kdcs
);
1221 loop(context
, config
, &d
, &ndescr
, islive
[1]);
1224 /* XXXrcd: hmmm, do something useful?? */
1225 kdc_log(context
, config
, 1,
1226 "KDC master process could not fork worker process");
1230 for (i
= 0; i
< max_kdcs
; i
++) {
1236 if (i
>= max_kdcs
) {
1237 /* This should not happen */
1238 kdc_log(context
, config
, 1,
1239 "warning: forked untracked child process: %d",
1242 kdc_log(context
, config
, 3, "KDC worker process started: %d",
1245 /* Slow down the creation of KDCs... */
1246 select_sleep(12500);
1251 /* Closing these sockets should cause the kids to die... */
1256 /* Close our listener sockets before terminating workers */
1257 for (i
= 0; i
< ndescr
; ++i
)
1260 gettimeofday(&tv1
, NULL
);
1263 /* Reap every 10ms, terminate stragglers once a second, give up after 10 */
1266 num_kdcs
-= reap_kids(context
, config
, pids
, max_kdcs
);
1267 if (num_kdcs
== 0 && bonjour_pid
<= 0)
1270 * Using select to sleep will fail with EINTR if we receive a
1271 * SIGCHLD. This is desirable.
1273 select_sleep(10000);
1274 gettimeofday(&tv3
, NULL
);
1275 if (tv3
.tv_sec
- tv1
.tv_sec
> 10 ||
1276 (tv3
.tv_sec
- tv1
.tv_sec
== 10 && tv3
.tv_usec
>= tv1
.tv_usec
))
1278 if (tv3
.tv_sec
- tv2
.tv_sec
> 1 ||
1279 (tv3
.tv_sec
- tv2
.tv_sec
== 1 && tv3
.tv_usec
>= tv2
.tv_usec
)) {
1280 kill_kids(pids
, max_kdcs
, SIGTERM
);
1285 /* Kill stragglers and reap every 200ms, give up after 15s */
1287 kill_kids(pids
, max_kdcs
, SIGKILL
);
1288 num_kdcs
-= reap_kids(context
, config
, pids
, max_kdcs
);
1289 if (num_kdcs
== 0 && bonjour_pid
<= 0)
1291 select_sleep(200000);
1292 gettimeofday(&tv2
, NULL
);
1293 if (tv2
.tv_sec
- tv1
.tv_sec
> 15 ||
1294 (tv2
.tv_sec
- tv1
.tv_sec
== 15 && tv2
.tv_usec
>= tv1
.tv_usec
))
1299 kdc_log(context
, config
, 3, "KDC master process exiting");
1301 loop(context
, config
, &d
, &ndescr
, -1);
1302 kdc_log(context
, config
, 3, "KDC exiting");
1306 loop(context
, config
, &d
, &ndescr
, -1);
1307 kdc_log(context
, config
, 3, "KDC exiting");