s6-networking-2.3.1.1/0002755000000000000000000000000013553343654011274 5ustar s6-networking-2.3.1.1/README.solaris0000644000000000000000000000065312376372746013637 0ustar This package assumes the existence of a POSIX shell in /bin/sh. On Solaris, /bin/sh is not POSIX. Most versions of Solaris provide a POSIX shell in /usr/xpg4/bin/sh. To compile this package on Solaris, you will need to run ./patch-for-solaris before you run ./configure. This script will change the #! invocation of the configure script and various tools so that a POSIX shell is used for the compilation process. s6-networking-2.3.1.1/AUTHORS0000644000000000000000000000045113356137256012342 0ustar Main author: Laurent Bercot Contributors: John Regan Thanks to: Jean Marot Dan J. Bernstein Vallo Kallaste Thomas Pornin Samuel Holland s6-networking-2.3.1.1/INSTALL0000644000000000000000000002143413553361712012322 0ustar Build Instructions ------------------ * Requirements ------------ - A POSIX-compliant C development environment - GNU make version 3.81 or later - skalibs version 2.9.1.0 or later: http://skarnet.org/software/skalibs/ - execline version 2.5.3.0 or later: http://skarnet.org/software/execline/ - s6 version 2.9.0.1 or later: http://skarnet.org/software/s6/ - s6-dns version 2.3.1.1 or later: http://skarnet.org/software/s6-dns/ - Depending on whether you build the SSL tools, libressl version 2.9.2 or later: http://libressl.org/ or bearssl version 0.6 or later: http://bearssl.org/ This software will run on any operating system that implements POSIX.1-2008, available at: http://pubs.opengroup.org/onlinepubs/9699919799/ * Standard usage -------------- ./configure && make && sudo make install will work for most users. It will install the binaries in /bin and the static libraries in /usr/lib/s6-networking. Please note that static libraries in /usr/lib/s6-networking *will not* be found by a default linker invocation: you need -L/usr/lib/s6-networking. Other skarnet.org software automatically handles that case if the default configuration is used, but if you change the configuration, remember to use the appropriate --with-lib configure option. You can strip the binaries and libraries of their extra symbols via "make strip" before the "make install" phase. It will shave a few bytes off them. * Customization ------------- You can customize paths via flags given to configure. See ./configure --help for a list of all available configure options. * Environment variables --------------------- Controlling a build process via environment variables is a big and dangerous hammer. You should try and pass flags to configure instead; nevertheless, a few standard environment variables are recognized. If the CC environment variable is set, its value will override compiler detection by configure. The --host=HOST option will still add a HOST- prefix to the value of CC. The values of CFLAGS, CPPFLAGS and LDFLAGS will be appended to flags auto-detected by configure. To entirely override the flags set by configure instead, use make variables. * Make variables -------------- You can invoke make with a few variables for more configuration. CC, CFLAGS, CPPFLAGS, LDFLAGS, LDLIBS, AR, RANLIB, STRIP, INSTALL and CROSS_COMPILE can all be overridden on the make command line. This is an even bigger hammer than running ./configure with environment variables, so it is advised to only do this when it is the only way of obtaining the behaviour you want. DESTDIR can be given on the "make install" command line in order to install to a staging directory. * Shared libraries ---------------- Software from skarnet.org is small enough that shared libraries are generally not worth using. Static linking is simpler and incurs less runtime overhead and less points of failure: so by default, shared libraries are not built and binaries are linked against the static versions of the skarnet.org libraries. Nevertheless, you can: * build shared libraries: --enable-shared * link binaries against shared libraries: --disable-allstatic * Static binaries --------------- By default, binaries are linked against static versions of all the libraries they depend on, except for the libc. You can enforce linking against the static libc with --enable-static-libc. (If you are using a GNU/Linux system, be aware that the GNU libc behaves badly with static linking and produces huge executables, which is why it is not the default. Other libcs are better suited to static linking, for instance musl: http://musl-libc.org/) * Cross-compilation ----------------- skarnet.org packages centralize all the difficulty of cross-compilation in one place: skalibs. Once you have cross-compiled skalibs, the rest is easy. * Use the --host=HOST option to configure, HOST being the triplet for your target. * Make sure your cross-toolchain binaries (i.e. prefixed with HOST-) are accessible via your PATH environment variable. * Make sure to use the correct version of skalibs for your target, and the correct sysdeps directory, making use of the --with-include, --with-lib, --with-dynlib and --with-sysdeps options as necessary. * The slashpackage convention --------------------------- The slashpackage convention (http://cr.yp.to/slashpackage.html) is a package installation scheme that provides a few guarantees over other conventions such as the FHS, for instance fixed absolute pathnames. skarnet.org packages support it: use the --enable-slashpackage option to configure, or --enable-slashpackage=DIR for a prefixed DIR/package tree. This option will activate slashpackage support during the build and set slashpackage-compatible installation directories. If $package_home is the home of the package, defined as DIR/package/$category/$package-$version with the variables read from the package/info file, then: --dynlibdir is set to $package_home/library.so --bindir is set to $package_home/command --sbindir is also set to $package_home/command (slashpackage differentiates root-only binaries by their Unix rights, not their location in the filesystem) --libexecdir is also set to $package_home/command (slashpackage does not need a specific directory for internal binaries) --libdir is set to $package_home/library --includedir is set to $package_home/include --prefix is pretty much ignored when you use --enable-slashpackage. You should probably not use both --enable-slashpackage and --prefix. When using slashpackage, two additional Makefile targets are available after "make install": - "make update" changes the default version of the software to the freshly installed one. (This is useful when you have several installed versions of the same software, which slashpackage supports.) - "make -L global-links" adds links from /command and /library.so to the default version of the binaries and shared libraries. The "-L" option to make is necessary because targets are symbolic links, and the default make behaviour is to check the pointed file's timestamp and not the symlink's timestamp. * Absolute pathnames ------------------ You may want to use fixed absolute pathnames even if you're not following the slashpackage convention: for instance, the Nix packaging system prefers calling binaries with immutable paths rather than rely on PATH resolution. If you are in that case, use the --enable-absolute-paths option to configure. This will ensure that programs calling binaries from this package will call them with their full installation path (in bindir) without relying on a PATH search. * Out-of-tree builds ------------------ skarnet.org packages do not support out-of-tree builds. They are small, so it does not cost much to duplicate the entire source tree if parallel builds are needed. * SSL support ----------- s6-networking implements UCSPI tools for SSL/TLS connections: s6-tlsclient, s6-tlsserver, s6-tlsc and s6-tlsd. Those are built if you give the --enable-ssl= flag to configure. There are two supported values for : libressl (in which case the tools will be built against libtls) and bearssl (in which case the tools will be built against libbearssl). You should install the relevant header and library files for your chosen implementation, be it LibreSSL or BearSSL, before building a SSL-enabled s6-networking. If your SSL headers and library files are not installed in /usr/include and /usr/lib, you can use the --with-ssl-path=DIR configure option: headers will be searched in DIR/include and libraries will be searched in DIR/lib. For more complex setups, use the generic --with-include and --with-dir configure options. If you choose --enable-ssl=bearssl, then s6-networking will build a "libsbearssl" support library, which s6-tlsc and s6-tlsd will be linked against. This support library depends on libbearssl interfaces. If you choose --enable-ssl=libressl, then s6-networking will build a "libstls" support library, which s6-tlsc and s6-tlsd will be linked against. This support library depends on libtls interfaces, but not on libssl or libcrypto interfaces - so it is possible to use alternative implementations of the libtls API. If your SSL implementation library needs nonstandard -l options to link against it, you can override the CRYPTO_LIB make variable. By default, CRYPTO_LIB is "-lbearssl" when building against BearSSL, and "-ltls -lssl -lcrypto" when building against LibreSSL. As of 2019-02-12, please note that BearSSL is considered beta quality by its author, so use with caution. Nevertheless, it's an incredibly promising library with high-quality interfaces and implementation. When statically linked against BearSSL, the s6-tlsc and s6-tlsd binaries are 1/10th the size of what they are when statically linked against LibreSSL, with a smaller RAM footprint too. s6-networking-2.3.1.1/patch-for-solaris0000755000000000000000000000075112443715247014556 0ustar #!/usr/xpg4/bin/sh patchit () { echo '#!/usr/xpg4/bin/sh' > $1.tmp tail -n +2 $1 >> $1.tmp mv -f $1.tmp $1 chmod 755 $1 } # Solaris doesn't understand POSIX.1-2008 either. sed -e 's/XOPEN_SOURCE=700/XOPEN_SOURCE=600/' < configure > configure.tmp mv -f configure.tmp configure patchit ./configure patchit ./tools/install.sh patchit ./tools/gen-deps.sh echo 'SHELL := /usr/xpg4/bin/sh' > Makefile.tmp echo >> Makefile.tmp cat Makefile >> Makefile.tmp mv -f Makefile.tmp Makefile s6-networking-2.3.1.1/README0000644000000000000000000000130113553367227012147 0ustar s6-networking - small network and client-server tools ----------------------------------------------------- s6-networking is a suite of small networking tools for Unix systems, including command-line client and server management, TCP access control, privilege escalation across UNIX domain sockets, IDENT protocol management, clock synchronization, and secure connections using the TLS protocol. See https://skarnet.org/software/s6-networking/ for details. * Installation ------------ See the INSTALL file. * Contact information ------------------- Laurent Bercot Please use the mailing-list for questions about s6-networking. s6-networking-2.3.1.1/src/0000755000000000000000000000000013016073032012041 5ustar s6-networking-2.3.1.1/src/minidentd/0000755000000000000000000000000013541515353014026 5ustar s6-networking-2.3.1.1/src/minidentd/mgetuid.h0000644000000000000000000000032313035014557015631 0ustar /* ISC license. */ #ifndef MGETUID_H #define MGETUID_H #include #include #include extern uid_t mgetuid (ip46_t const *, uint16_t, ip46_t const *, uint16_t) ; #endif s6-networking-2.3.1.1/src/minidentd/deps-exe/0000755000000000000000000000000013540723124015534 5ustar s6-networking-2.3.1.1/src/minidentd/deps-exe/minidentd0000755000000000000000000000012113540723124017427 0ustar mgetuid.o ${LIBNSSS} -lskarnet ${MAYBEPTHREAD_LIB} ${SOCKET_LIB} ${SYSCLOCK_LIB} s6-networking-2.3.1.1/src/minidentd/mgetuid-linux.c0000644000000000000000000001172113061236757016774 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #include #include #include "mgetuid.h" #ifdef DEBUG #include #define bug(a) do { strerr_warn4x("bug parsing ", a, "remaining: ", cur) ; return 0 ; } while (0) #else #define bug(a) return 0 #endif #define LINESIZE 256 static int skipspace (char **s) { while (**s && ((**s == ' ') || (**s == '\t'))) (*s)++ ; return (int)**s ; } static void reverse_address (char *s, size_t n) { size_t i = n >> 1 ; while (i--) { char tmp = s[i] ; s[i] = s[n-1-i] ; s[n-1-i] = tmp ; } } static int parseline (char *s, size_t len, uid_t *u, char *la, uint16_t *lp, char *ra, uint16_t *rp, int is6) { char *cur = s ; size_t pos ; uint64_t uu ; uint32_t junk ; unsigned int iplen = is6 ? 16 : 4 ; if (!skipspace(&cur)) bug("initial whitespace") ; pos = uint32_scan(cur, &junk) ; /* sl */ if (!pos || (cur-s+1+pos) > len) bug("sl") ; cur += pos ; if ((*cur++) != ':') bug("sl:") ; if (!skipspace(&cur)) bug("sl: SPACE") ; if ((cur - s + 1 + iplen) > len) bug("local_address") ; pos = ucharn_scan(cur, la, iplen) ; /* local_address */ reverse_address(la, iplen) ; if (!pos) bug("local_address") ; cur += pos ; if ((*cur++) != ':') bug("local_address:") ; pos = uint16_xscan(cur, lp) ; /* :port */ if (!pos || (cur-s+pos) > len) bug("local_port") ; cur += pos ; if (!skipspace(&cur)) bug("local_port SPACE") ; if ((cur - s + 1 + iplen) > len) bug("remote_address") ; pos = ucharn_scan(cur, ra, iplen) ; /* remote_address */ reverse_address(ra, iplen) ; if (!pos) bug("remote_address") ; cur += pos ; if ((*cur++) != ':') bug("remote_address:") ; pos = uint16_xscan(cur, rp) ; /* :port */ if (!pos || (cur-s+pos) > len) bug("remote_port") ; cur += pos ; if (!skipspace(&cur)) bug("remote_port SPACE"); pos = uint32_xscan(cur, &junk) ; /* st */ if (!pos || (cur-s+pos) > len) bug("st") ; cur += pos ; if (!skipspace(&cur)) bug("st SPACE") ; pos = uint32_xscan(cur, &junk) ; /* tx_queue */ if (!pos || (cur-s+1+pos) > len) bug("tx_queue") ; cur += pos ; if ((*cur++) != ':') bug("tx_queue:") ; pos = uint32_xscan(cur, &junk) ; /* rx_queue */ if (!pos || (cur-s+pos) > len) bug("rx_queue") ; cur += pos ; if (!skipspace(&cur)) bug("rx_queue SPACE") ; pos = uint32_xscan(cur, &junk) ; /* tr */ if (!pos || (cur-s+1+pos) > len) bug("tr") ; cur += pos ; if ((*cur++) != ':') bug("tr:") ; pos = uint32_xscan(cur, &junk) ; /* tm->when */ if (!pos || (cur-s+pos) > len) bug("tm->when") ; cur += pos ; if (!skipspace(&cur)) bug("tm->when SPACE") ; pos = uint32_xscan(cur, &junk) ; /* retrnsmt */ if (!pos || (cur-s+pos) > len) bug("retrnsmt") ; cur += pos ; if (!skipspace(&cur)) bug("retrnsmt SPACE") ; pos = uint64_scan(cur, &uu) ; /* uid */ if (!pos || (cur-s+1+pos) > len) bug("uid") ; *u = uu ; return 1 ; } #ifdef DEBUG static void debuglog (uint16_t a, uint16_t b, unsigned int c, char const *d, char const *e, int is6) { char sa[UINT16_FMT] ; char sb[UINT16_FMT] ; char sc[UINT_FMT] ; char sd[IP46_FMT] ; char se[IP46_FMT] ; sa[uint16_fmt(sa, a)] = 0 ; sb[uint16_fmt(sb, b)] = 0 ; sc[uint_fmt(sc, c)] = 0 ; sd[is6 ? ip6_fmt(sd, d) : ip4_fmt(sd, d)] = 0 ; se[is6 ? ip6_fmt(se, e) : ip4_fmt(se, e)] = 0 ; buffer_puts(buffer_2, sd) ; buffer_puts(buffer_2, ":") ; buffer_puts(buffer_2, sa) ; buffer_puts(buffer_2, " , ") ; buffer_puts(buffer_2, se) ; buffer_puts(buffer_2, ":") ; buffer_puts(buffer_2, sb) ; buffer_puts(buffer_2, " -> ") ; buffer_puts(buffer_2, sc) ; buffer_putsflush(buffer_2, "\n") ; } #endif uid_t mgetuid (ip46_t const *localaddr, uint16_t localport, ip46_t const *remoteaddr, uint16_t remoteport) { int r ; uid_t u = -2 ; stralloc line = STRALLOC_ZERO ; buffer b ; char y[BUFFER_INSIZE] ; int is6 = ip46_is6(localaddr) ; int fd = open_readb(is6 ? "/proc/net/tcp6" : "/proc/net/tcp") ; if (fd == -1) return -2 ; buffer_init(&b, &buffer_read, fd, y, BUFFER_INSIZE_SMALL) ; if (skagetln(&b, &line, '\n') < 1) goto err ; #ifdef DEBUG line.s[line.len-1] = 0 ; debuglog(localport, remoteport, 65535, localaddr->ip, remoteaddr->ip, is6) ; #endif for (;;) { char la[16] ; char ra[16] ; uid_t nu ; uint16_t lp, rp ; line.len = 0 ; r = skagetln(&b, &line, '\n') ; if (r <= 0) { u = -1 ; break ; } line.s[line.len-1] = 0 ; if (!parseline(line.s, line.len, &nu, la, &lp, ra, &rp, is6)) break ; #ifdef DEBUG debuglog(lp, rp, nu, la, ra, is6) ; #endif if ((lp == localport) && (rp == remoteport) && !memcmp(la, localaddr->ip, is6 ? 16 : 4) && !memcmp(ra, remoteaddr->ip, is6 ? 16 : 4)) { u = nu ; break ; } } stralloc_free(&line) ; err: fd_close(fd) ; return u ; } s6-networking-2.3.1.1/src/minidentd/mgetuid-default.c0000644000000000000000000000054313061236465017255 0ustar /* ISC license. */ #include #include #include #include #include "mgetuid.h" uid_t mgetuid (ip46_t const *localaddr, uint16_t localport, ip46_t const *remoteaddr, uint16_t remoteport) { (void)localaddr ; (void)localport ; (void)remoteaddr ; (void)remoteport ; return (errno = ENOSYS, -2) ; } s6-networking-2.3.1.1/src/minidentd/minidentd.c0000644000000000000000000001530013534450370016143 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "mgetuid.h" #define USAGE "minidentd [ -v ] [ -n | -i | -r ] [ -y file ] [ -t timeout ]" #define dieusage() strerr_dieusage(100, USAGE) static int how = 0 ; static int flagverbose = 0 ; static char const *userfile = ".ident" ; static tain_t deadline ; static unsigned int nquery = 0 ; static char logfmt[UINT_FMT] ; #define godecimal(s) while (*(s) && !strchr("0123456789", *(s))) (s)++ static int parseline (char const *s, uint16_t *localport, uint16_t *remoteport) { size_t pos ; godecimal(s) ; if (!*s) return 0 ; pos = uint16_scan(s, localport) ; if (!pos) return 0 ; s += pos ; if (!*s) return 0 ; s += str_chr(s, ',') ; if (*s) s++ ; godecimal(s) ; if (!*s) return 0 ; if (!uint16_scan(s, remoteport)) return 0 ; return 1 ; } static void formatlr (char *s, uint16_t lp, uint16_t rp) { s += uint16_fmt(s, lp) ; *s++ = ',' ; *s++ = ' ' ; s += uint16_fmt(s, rp) ; *s = 0 ; } static void reply (char const *s, char const *r, char const *info) { buffer_puts(buffer_1small, s) ; buffer_put(buffer_1small, " : ", 3) ; buffer_puts(buffer_1small, r) ; buffer_put(buffer_1small, " : ", 3) ; buffer_puts(buffer_1small, info) ; buffer_put(buffer_1small, "\r\n", 2) ; if (!buffer_timed_flush_g(buffer_1small, &deadline)) strerr_diefu1sys(111, "write to stdout") ; } static void logquery (char const *s) { if (!flagverbose) return ; buffer_puts(buffer_2, PROG) ; buffer_puts(buffer_2, ": info : query ") ; logfmt[uint_fmt(logfmt, ++nquery)] = 0 ; buffer_puts(buffer_2, logfmt) ; buffer_put(buffer_2, ": ", 2) ; buffer_puts(buffer_2, s) ; buffer_putflush(buffer_2, "\n", 1) ; } static void logreply (char const *type, char const *reply1, char const *reply2) { if (!flagverbose) return ; buffer_puts(buffer_2, PROG) ; buffer_puts(buffer_2, ": info: reply type ") ; buffer_puts(buffer_2, type) ; buffer_put(buffer_2, ": ", 2) ; buffer_puts(buffer_2, logfmt) ; buffer_put(buffer_2, ": ", 2) ; buffer_puts(buffer_2, reply1) ; buffer_put(buffer_2, ": ", 2) ; buffer_puts(buffer_2, reply2) ; buffer_putflush(buffer_2, "\n", 1) ; } static int userident (char *s, char const *home) { int fd ; size_t r = 1 ; { size_t homelen = strlen(home) ; size_t userlen = strlen(userfile) ; char tmp[homelen + userlen + 2] ; memcpy(tmp, home, homelen) ; tmp[homelen] = '/' ; memcpy(tmp + homelen + 1, userfile, userlen + 1) ; fd = open_readb(tmp) ; } if (fd == -1) return (errno != ENOENT) ? -1 : 0 ; if (how == 1) { fd_close(fd) ; return 1 ; } r = allread(fd, s, 14) ; fd_close(fd) ; if (!r) return 1 ; s[r] = 0 ; s[byte_chr(s, r, '\n')] = 0 ; return 2 ; } static void doit (char const *s, ip46_t const *localaddr, ip46_t const *remoteaddr) { char lr[15] ; uint16_t localport, remoteport ; struct passwd *pw ; uid_t uid ; if (!parseline(s, &localport, &remoteport)) { reply("0, 0", "ERROR", "INVALID-PORT") ; return ; } formatlr(lr, localport, remoteport) ; logquery(lr) ; uid = mgetuid(localaddr, localport, remoteaddr, remoteport) ; if (uid == -2) { strerr_warnwu1sys("get uid") ; reply(lr, "ERROR", "UNKNOWN-ERROR") ; return ; } else if (uid == -1) { reply(lr, "ERROR", "NO-USER") ; logreply("error", "ERROR", "NO-USER") ; return ; } if (how == 3) { char name[9] ; char fmt[4 + UINT_FMT] = "uid " ; fmt[4 + uint_fmt(fmt+4, uid)] = 0 ; random_name(name, 8) ; reply(lr, "UNIX", name) ; logreply("random", fmt, name) ; return ; } pw = getpwuid(uid) ; if (!pw) { char fmt[UINT_FMT] ; fmt[uint_fmt(fmt, uid)] = 0 ; strerr_warnw2x("unknown uid ", fmt) ; reply(lr, "ERROR", "UNKNOWN-ERROR") ; return ; } if (how) { char s[15] ; int r = userident(s, pw->pw_dir) ; if ((how == 1) || (r == 1)) { reply(lr, "ERROR", "HIDDEN-USER") ; logreply("user", "ERROR", "HIDDEN-USER") ; return ; } else if (r == 2) { reply(lr, "USERID : UNIX", s) ; logreply("user", "UNIX", s) ; return ; } } reply(lr, "USERID : UNIX", pw->pw_name) ; logreply("user", "UNIX", pw->pw_name) ; } int main (int argc, char const *const *argv, char const *const *envp) { stralloc line = STRALLOC_ZERO ; tain_t tto ; ip46_t localaddr, remoteaddr ; PROG = "minidentd" ; { subgetopt_t l = SUBGETOPT_ZERO ; unsigned int t = 0 ; for (;;) { int opt = subgetopt_r(argc, argv, "vniry:t:", &l) ; if (opt == -1) break ; switch (opt) { case 'v' : flagverbose = 1 ; break ; case 'n' : how = 1 ; break ; case 'i' : how = 2 ; break ; case 'r' : how = 3 ; break ; case 'y' : userfile = l.arg ; break ; case 't' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ; default : dieusage() ; } } if (t) tain_from_millisecs(&tto, t) ; else tto = tain_infinite_relative ; argc -= l.ind ; argv += l.ind ; } { char const *proto = env_get2(envp, "PROTO") ; if (!proto) strerr_dienotset(100, "PROTO") ; { char const *x ; size_t protolen = strlen(proto) ; char tmp[protolen + 9] ; memcpy(tmp, proto, protolen) ; memcpy(tmp + protolen, "LOCALIP", 8) ; x = env_get2(envp, tmp) ; if (!x) strerr_dienotset(100, tmp) ; if (!ip46_scan(x, &localaddr)) strerr_dieinvalid(100, tmp) ; memcpy(tmp + protolen, "REMOTEIP", 9) ; x = env_get2(envp, tmp) ; if (!x) strerr_dienotset(100, tmp) ; if (!ip46_scan(x, &remoteaddr)) strerr_dieinvalid(100, tmp) ; } } if (ip46_is6(&localaddr) != ip46_is6(&remoteaddr)) strerr_dief1x(100, "local and remote address not of the same family") ; if (!random_init()) strerr_diefu1sys(111, "init random generator") ; tain_now_set_stopwatch_g() ; for (;;) { int r ; line.len = 0 ; tain_add_g(&deadline, &tto) ; r = timed_getln_g(buffer_0small, &line, '\n', &deadline) ; if (r == -1) { if (errno == ETIMEDOUT) return 1 ; else strerr_diefu1sys(111, "read from stdin") ; } if (!r) break ; line.s[line.len - 1] = 0 ; doit(line.s, &localaddr, &remoteaddr) ; } return 0 ; } s6-networking-2.3.1.1/src/minidentd/deps-lib/0000755000000000000000000000000011553036513015522 5ustar s6-networking-2.3.1.1/src/clock/0000755000000000000000000000000013541515353013146 5ustar s6-networking-2.3.1.1/src/clock/s6-taiclockd.c0000644000000000000000000000276013533717521015604 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #define USAGE "s6-taiclockd [ -i ip ] [ -p port ]" #define dieusage() strerr_dieusage(100, USAGE) int main (int argc, char const *const *argv) { int s ; ip46_t ip = IP46_ZERO ; uint16_t port = 4014 ; subgetopt_t l = SUBGETOPT_ZERO ; PROG = "s6-taiclockd" ; for (;;) { int opt = subgetopt_r(argc, argv, "i:p:", &l) ; if (opt == -1) break ; switch (opt) { case 'i' : if (!ip46_scan(l.arg, &ip)) dieusage() ; break ; case 'p' : if (!uint160_scan(l.arg, &port)) dieusage() ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; s = socket_udp46(ip46_is6(&ip)) ; if (s < 0) strerr_diefu1sys(111, "socket_udp") ; if (ndelay_off(s) < 0) strerr_diefu1sys(111, "ndelay_off") ; if (socket_bind46_reuse(s, &ip, port) < 0) strerr_diefu1sys(111, "socket_bind_reuse") ; for (;;) { char packet[256] ; ssize_t r = socket_recv46(s, packet, 256, &ip, &port) ; if ((r >= 20) && !memcmp(packet, "ctai", 4)) { tain_t now ; packet[0] = 's' ; if (!tain_wallclock_read(&now)) strerr_diefu1sys(111, "tain_wallclock_read") ; tain_pack(packet + 4, &now) ; if (socket_send46(s, packet, r, &ip, port) < 0) strerr_warnwu1sys("socket_send") ; } } } s6-networking-2.3.1.1/src/clock/deps-exe/0000755000000000000000000000000013540723124014654 5ustar s6-networking-2.3.1.1/src/clock/deps-exe/s6-taiclockd0000644000000000000000000000005012443301565017057 0ustar -lskarnet ${SOCKET_LIB} ${SYSCLOCK_LIB} s6-networking-2.3.1.1/src/clock/deps-exe/s6-taiclock0000644000000000000000000000005013540723124016711 0ustar -lskarnet ${SOCKET_LIB} ${SYSCLOCK_LIB} s6-networking-2.3.1.1/src/clock/deps-exe/s6-sntpclock0000644000000000000000000000005013540723124017120 0ustar -lskarnet ${SOCKET_LIB} ${SYSCLOCK_LIB} s6-networking-2.3.1.1/src/clock/deps-exe/s6-clockadd0000644000000000000000000000003212443301436016663 0ustar -lskarnet ${SYSCLOCK_LIB} s6-networking-2.3.1.1/src/clock/deps-exe/s6-clockview0000644000000000000000000000003212443301457017110 0ustar -lskarnet ${SYSCLOCK_LIB} s6-networking-2.3.1.1/src/clock/s6-taiclock.c0000644000000000000000000001357013433236174015440 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #define USAGE "s6-taiclock [ -f ] [ -v verbosity ] [ -r roundtrips ] [ -t triptimeout ] [ -h throttle ] [ -T totaltimeout ] [ -e errmax ] [ -p port ] ipaddress" #define dieusage() strerr_dieusage(100, USAGE) static unsigned int verbosity = 1 ; #define N 28 int tain_exchange (int s, ip46_t const *ip, uint16_t port, tain_t *serversays, tain_t const *deadline) { char query[N] = "ctai" ; char answer[N] ; ip46_t dummyip ; ssize_t r ; uint16_t dummyport ; tain_pack(query+4, &STAMP) ; random_string(query+20, N-20) ; /* cookie */ r = socket_sendnb46_g(s, query, N, ip, port, deadline) ; if (r < 0) return 0 ; if (r < N) return (errno = EPIPE, 0) ; r = socket_recvnb46_g(s, answer, N, &dummyip, &dummyport, deadline) ; if (r < 0) return 0 ; if (r < N) return (errno = EPROTO, 0) ; if (memcmp(answer, "stai", 4)) return (errno = EPROTO, 0) ; if (memcmp(query+20, answer+20, N-20)) return (errno = EPROTO, 0) ; tain_unpack(answer+4, serversays) ; return 1 ; } int main (int argc, char const *const *argv) { tain_t deltamin = TAIN_ZERO ; tain_t deltaoffset ; tain_t deltamax ; tain_t errmax ; tain_t timeouttto, throttletto, globaltto ; tain_t globaldeadline ; unsigned int roundtrips = 10 ; unsigned int i = 0 ; ip46_t ipremote ; int sock ; int flagforce = 0 ; uint16_t portremote = 4014 ; PROG = "s6-taiclock" ; { unsigned int timeout = 2000 ; unsigned int throttle = 0 ; unsigned int bigtimeout = 10000 ; unsigned int emax = 100 ; subgetopt_t l = SUBGETOPT_ZERO ; for (;;) { int opt = subgetopt_r(argc, argv, "fv:r:t:h:T:e:p:", &l) ; if (opt == -1) break ; switch (opt) { case 'f' : flagforce = 1 ; break ; case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ; case 'r' : if (!uint0_scan(l.arg, &roundtrips)) dieusage() ; break ; case 't' : if (!uint0_scan(l.arg, &timeout)) dieusage() ; break ; case 'h' : if (!uint0_scan(l.arg, &throttle)) dieusage() ; break ; case 'T' : if (!uint0_scan(l.arg, &bigtimeout)) dieusage() ; break ; case 'e' : if (!uint0_scan(l.arg, &emax)) dieusage() ; break ; case 'p' : if (!uint160_scan(l.arg, &portremote)) dieusage() ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; if (timeout) tain_from_millisecs(&timeouttto, timeout) ; else timeouttto = tain_infinite_relative ; tain_from_millisecs(&throttletto, throttle) ; if (bigtimeout) tain_from_millisecs(&globaltto, bigtimeout) ; else globaltto = tain_infinite_relative ; tain_from_millisecs(&errmax, emax) ; } if (!argc) dieusage() ; if (!ip46_scan(argv[0], &ipremote)) dieusage() ; if (!random_init()) strerr_diefu1sys(111, "init random generator") ; sock = socket_udp46(ip46_is6(&ipremote)) ; if (sock < 0) strerr_diefu1sys(111, "socket_udp") ; tain_uint(&deltaoffset, 0xffffffffU) ; tain_add(&deltaoffset, &deltaoffset, &deltaoffset) ; /* about 136 years */ tain_add(&deltamax, &deltaoffset, &deltaoffset) ; tain_now_g() ; tain_add_g(&globaldeadline, &globaltto) ; if (!socket_deadlineconnstamp46_g(sock, &ipremote, portremote, &globaldeadline)) strerr_diefu1sys(111, "socket_deadlineconnstamp") ; for (; i < roundtrips ; i++) { tain_t deadline, before, serversays ; tain_add_g(&deadline, &timeouttto) ; if (tain_less(&globaldeadline, &deadline)) deadline = globaldeadline ; tain_copynow(&before) ; if (!tain_exchange(sock, &ipremote, portremote, &serversays, &deadline)) { if (verbosity >= 2) { char fmt[UINT_FMT] ; char fmtr[UINT_FMT] ; fmt[uint_fmt(fmt, i+1)] = 0 ; fmtr[uint_fmt(fmtr, roundtrips)] = 0 ; strerr_warni5sys("TAIA round-trip ", fmt, "/", fmtr, " failed") ; } } else { tain_t cur, min, max ; tain_add(&cur, &serversays, &deltaoffset) ; tain_add(&min, &before, &deltamin) ; tain_add(&max, &before, &deltamax) ; if (tain_less(&cur, &max) && !tain_less(&cur, &min)) tain_sub(&deltamax, &cur, &before) ; tain_add_g(&min, &deltamin) ; tain_add_g(&max, &deltamax) ; if (tain_less(&cur, &max) && !tain_less(&cur, &min)) tain_sub(&deltamin, &cur, &STAMP) ; } tain_add_g(&deadline, &throttletto) ; if (tain_less(&globaldeadline, &deadline)) deadline = globaldeadline ; deepsleepuntil_g(&deadline) ; if (!tain_future(&globaldeadline)) { if (verbosity) { errno = ETIMEDOUT ; strerr_diefu1sys(1, "complete series of TAIA exchanges") ; } else return 1 ; } } { char adj[TAIN_PACK] ; tain_t delta ; if (tain_less(&deltamax, &deltamin)) tain_sub(&delta, &deltamin, &deltamax) ; else tain_sub(&delta, &deltamax, &deltamin) ; if (tain_less(&errmax, &delta)) { if (verbosity) { char fmtd[TAIN_FMT] ; char fmte[TAIN_FMT] ; fmtd[tain_fmt(fmtd, &delta)] = 0 ; fmte[tain_fmt(fmte, &errmax)] = 0 ; strerr_warnw2x("maximum acceptable uncertainty: ", fmte) ; strerr_warnw2x("current calculated uncertainty: ", fmtd) ; } if (!flagforce) strerr_dief1x(111, "time uncertainty too large") ; } tain_add(&delta, &deltamax, &deltamin) ; tain_half(&delta, &delta) ; tain_sub(&delta, &delta, &deltaoffset) ; tain_pack(adj, &delta) ; if (allwrite(1, adj, TAIN_PACK) < TAIN_PACK) strerr_diefu1sys(111, "write to stdout") ; } return 0 ; } s6-networking-2.3.1.1/src/clock/s6-clockview.c0000644000000000000000000000207612443662377015644 0ustar /* ISC license. */ #include #include #include #include #include int main (void) { char buf[TAIN_PACK] ; tain_t now, adj ; localtmn_t l ; char fmt[LOCALTMN_FMT] ; PROG = "s6-clockview" ; if (allread(0, buf, TAIN_PACK) < TAIN_PACK) strerr_diefu1sys(111, "read from stdin") ; tain_unpack(buf, &adj) ; if (!sysclock_get(&now)) strerr_diefu1sys(111, "sysclock_get") ; if (!localtmn_from_sysclock(&l, &now, 1)) strerr_diefu1sys(111, "localtmn_from_sysclock") ; if (buffer_puts(buffer_1, "before: ") < 0) goto fail ; if (buffer_put(buffer_1, fmt, localtmn_fmt(fmt, &l)) < 0) goto fail ; tain_add(&now, &now, &adj) ; if (!localtmn_from_sysclock(&l, &now, 1)) strerr_diefu1sys(111, "localtmn_from_sysclock") ; if (buffer_puts(buffer_1, "\nafter: ") < 0) goto fail ; if (buffer_put(buffer_1, fmt, localtmn_fmt(fmt, &l)) < 0) goto fail ; if (buffer_putflush(buffer_1, "\n", 1) < 0) goto fail ; return 0 ; fail: strerr_diefu1sys(111, "write to stdout") ; } s6-networking-2.3.1.1/src/clock/s6-clockadd.c0000644000000000000000000000302613061234300015370 0ustar /* ISC license. */ #include #include #include #include #include #define USAGE "s6-clockadd [ -f ] [ -e errmax ]" #define dieusage() strerr_dieusage(100, USAGE) int main (int argc, char const *const *argv) { tain_t now, adj ; unsigned int emax = 2000 ; int flagforce = 0 ; PROG = "s6-clockadd" ; { subgetopt_t l = SUBGETOPT_ZERO ; for (;;) { int opt = subgetopt_r(argc, argv, "fe:", &l) ; if (opt == -1) break ; switch (opt) { case 'f' : flagforce = 1 ; break ; case 'e' : if (!uint0_scan(l.arg, &emax)) dieusage() ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; } { char buf[TAIN_PACK] ; if (allread(0, buf, TAIN_PACK) < TAIN_PACK) strerr_diefu1sys(111, "read 16 bytes from stdin") ; tain_unpack(buf, &adj) ; } tain_from_millisecs(&now, emax) ; if (tain_less(&now, &adj)) { tain_t tmp = TAIN_ZERO ; tain_sub(&tmp, &tmp, &adj) ; if (tain_less(&now, &tmp)) { char fmt[UINT_FMT] ; fmt[uint_fmt(fmt, emax)] = 0 ; if (flagforce) strerr_warnw3x("time discrepancy bigger than ", fmt, " milliseconds") ; else strerr_dief3x(1, "time discrepancy bigger than ", fmt, " milliseconds") ; } } if (!sysclock_get(&now)) strerr_diefu1sys(111, "sysclock_get") ; tain_add(&now, &now, &adj) ; if (!sysclock_set(&now)) strerr_diefu1sys(111, "sysclock_set") ; return 0 ; } s6-networking-2.3.1.1/src/clock/s6-sntpclock.c0000644000000000000000000001753313433236150015644 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #define USAGE "s6-sntpclock [ -f ] [ -v verbosity ] [ -r roundtrips ] [ -t triptimeout ] [ -h throttle ] [ -T totaltimeout ] [ -e errmax ] [ -p port ] ipaddress" #define dieusage() strerr_dieusage(100, USAGE) static unsigned int verbosity = 1 ; int ntp_exchange (int s, ip46_t const *ip, uint16_t port, tain_t *stamps, tain_t const *deadline) { char query[48] = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ; char answer[48] = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ; tain_t starttime ; uint64_t ntpstamp ; ip46_t dummyip ; uint16_t dummyport ; ssize_t r ; tain_copynow(&starttime) ; query[0] = 35 ; /* SNTPv4, client */ if (!ntp_from_tain(&ntpstamp, &starttime)) return 0 ; uint64_pack_big(query+24, ntpstamp) ; uint64_pack_big(query+40, ntpstamp) ; if (verbosity >= 3) { char fmtntp[UINT64_XFMT] ; fmtntp[uint64_xfmt(fmtntp, ntpstamp)] = 0 ; strerr_warni2x("NTP stamp[0] sent: ", fmtntp) ; } r = socket_sendnb46_g(s, query, 48, ip, port, deadline) ; if (r < 0) return 0 ; if (r < 48) return (errno = EPIPE, 0) ; r = socket_recvnb46_g(s, answer, 48, &dummyip, &dummyport, deadline) ; if (r < 0) return 0 ; if (r < 48) return (errno = EPROTO, 0) ; if (((answer[0] & 7) != 2) && ((answer[0] & 7) != 4)) return (errno = EPROTO, 0) ; if (!(answer[0] & 56)) return (errno = EPROTO, 0) ; if (memcmp(query+40, answer+24, 8)) return (errno = EPROTO, 0) ; stamps[0] = starttime ; uint64_unpack_big(answer+32, &ntpstamp) ; tain_from_ntp(stamps+1, ntpstamp) ; if (verbosity >= 3) { char fmtntp[UINT64_XFMT] ; fmtntp[uint64_xfmt(fmtntp, ntpstamp)] = 0 ; strerr_warni2x("NTP stamp[1] received: ", fmtntp) ; } uint64_unpack_big(answer+40, &ntpstamp) ; tain_from_ntp(stamps+2, ntpstamp) ; if (verbosity >= 3) { char fmtntp[UINT64_XFMT] ; fmtntp[uint64_xfmt(fmtntp, ntpstamp)] = 0 ; strerr_warni2x("NTP stamp[2] received: ", fmtntp) ; } tain_copynow(&stamps[3]) ; return 1 ; } int main (int argc, char const *const *argv) { tain_t deltamin = TAIN_ZERO ; tain_t deltaoffset ; tain_t deltamax ; tain_t errmax ; tain_t timeouttto, throttletto, globaltto ; tain_t globaldeadline ; unsigned int roundtrips = 10 ; unsigned int i = 0 ; int sock ; int flagforce = 0 ; ip46_t ipremote ; uint16_t portremote = 123 ; PROG = "s6-sntpclock" ; { unsigned int timeout = 2000 ; unsigned int throttle = 0 ; unsigned int bigtimeout = 10000 ; unsigned int emax = 100 ; subgetopt_t l = SUBGETOPT_ZERO ; for (;;) { int opt = subgetopt_r(argc, argv, "fv:r:t:h:T:e:p:", &l) ; if (opt == -1) break ; switch (opt) { case 'f' : flagforce = 1 ; break ; case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ; case 'r' : if (!uint0_scan(l.arg, &roundtrips)) dieusage() ; break ; case 't' : if (!uint0_scan(l.arg, &timeout)) dieusage() ; break ; case 'h' : if (!uint0_scan(l.arg, &throttle)) dieusage() ; break ; case 'T' : if (!uint0_scan(l.arg, &bigtimeout)) dieusage() ; break ; case 'e' : if (!uint0_scan(l.arg, &emax)) dieusage() ; break ; case 'p' : if (!uint160_scan(l.arg, &portremote)) dieusage() ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; if (timeout) tain_from_millisecs(&timeouttto, timeout) ; else timeouttto = tain_infinite_relative ; tain_from_millisecs(&throttletto, throttle) ; if (bigtimeout) tain_from_millisecs(&globaltto, bigtimeout) ; else globaltto = tain_infinite_relative ; tain_from_millisecs(&errmax, emax) ; } if (!argc) dieusage() ; if (!ip46_scan(argv[0], &ipremote)) dieusage() ; sock = socket_udp46(ip46_is6(&ipremote)) ; if (sock < 0) strerr_diefu1sys(111, "socket_udp") ; tain_uint(&deltaoffset, 1072224000U) ; /* about 34 years, which is the best we can do with NTP */ tain_add(&deltamax, &deltaoffset, &deltaoffset) ; tain_now_g() ; tain_add_g(&globaldeadline, &globaltto) ; if (!socket_deadlineconnstamp46_g(sock, &ipremote, portremote, &globaldeadline)) strerr_diefu1sys(111, "socket_deadlineconnstamp") ; for (; i < roundtrips ; i++) { tain_t stamps[4] ; tain_t deadline ; tain_add_g(&deadline, &timeouttto) ; if (tain_less(&globaldeadline, &deadline)) deadline = globaldeadline ; if (verbosity >= 3) { char fmt[UINT_FMT] ; char fmtr[UINT_FMT] ; fmt[uint_fmt(fmt, i+1)] = 0 ; fmtr[uint_fmt(fmtr, roundtrips)] = 0 ; strerr_warni4x("NTP round-trip ", fmt, "/", fmtr) ; } if (!ntp_exchange(sock, &ipremote, portremote, stamps, &deadline)) { if (verbosity >= 2) { char fmt[UINT_FMT] ; char fmtr[UINT_FMT] ; fmt[uint_fmt(fmt, i+1)] = 0 ; fmtr[uint_fmt(fmtr, roundtrips)] = 0 ; strerr_warni5sys("NTP round-trip ", fmt, "/", fmtr, " failed") ; } } else { tain_t cur, min, max ; if (verbosity >= 3) { unsigned int j = 0 ; for (; j < 4 ; j++) { uint64_t ntp ; localtmn_t l ; char fmt[UINT_FMT] ; char fmtntp[UINT64_XFMT] ; char fmttaia[TAIN_FMT] ; char fmtlocal[LOCALTMN_FMT] ; ntp_from_tain(&ntp, &stamps[j]) ; localtmn_from_tain(&l, &stamps[j], 1) ; fmt[uint_fmt(fmt, j)] = 0 ; fmttaia[tain_fmt(fmttaia, &stamps[j])] = 0 ; fmtntp[uint64_xfmt(fmtntp, ntp)] = 0 ; fmtlocal[localtmn_fmt(fmtlocal, &l)] = 0 ; strerr_warni6x("stamp[", fmt, "] : taia: ", fmttaia, ", ntp: ", fmtntp) ; strerr_warni2x("localdate: ", fmtlocal) ; } } tain_add(&cur, &stamps[1], &deltaoffset) ; tain_add(&min, &stamps[0], &deltamin) ; tain_add(&max, &stamps[0], &deltamax) ; if (tain_less(&cur, &max) && !tain_less(&cur, &min)) tain_sub(&deltamax, &cur, &stamps[0]) ; tain_add(&cur, &stamps[2], &deltaoffset) ; tain_add(&min, &stamps[3], &deltamin) ; tain_add(&max, &stamps[3], &deltamax) ; if (tain_less(&cur, &max) && !tain_less(&cur, &min)) tain_sub(&deltamin, &cur, &stamps[3]) ; } tain_add_g(&deadline, &throttletto) ; if (tain_less(&globaldeadline, &deadline)) deadline = globaldeadline ; deepsleepuntil_g(&deadline) ; if (!tain_future(&globaldeadline)) { if (verbosity) { errno = ETIMEDOUT ; strerr_diefu1sys(1, "complete series of SNTP exchanges") ; } else return 1 ; } } { char adj[TAIN_PACK] ; tain_t delta ; if (tain_less(&deltamax, &deltamin)) tain_sub(&delta, &deltamin, &deltamax) ; else tain_sub(&delta, &deltamax, &deltamin) ; if (tain_less(&errmax, &delta)) { if (verbosity) { char fmtd[TAIN_FMT] ; char fmte[TAIN_FMT] ; fmtd[tain_fmt(fmtd, &delta)] = 0 ; fmte[tain_fmt(fmte, &errmax)] = 0 ; strerr_warnw2x("maximum acceptable uncertainty: ", fmte) ; strerr_warnw2x("current calculated uncertainty: ", fmtd) ; } if (!flagforce) strerr_dief1x(111, "time uncertainty too large") ; } tain_add(&delta, &deltamax, &deltamin) ; tain_half(&delta, &delta) ; tain_sub(&delta, &delta, &deltaoffset) ; tain_pack(adj, &delta) ; if (allwrite(1, adj, TAIN_PACK) < TAIN_PACK) strerr_diefu1sys(111, "write to stdout") ; } return 0 ; } s6-networking-2.3.1.1/src/clock/deps-lib/0000755000000000000000000000000011436057316014646 5ustar s6-networking-2.3.1.1/src/libs6net/0000755000000000000000000000000013541515353013601 5ustar s6-networking-2.3.1.1/src/libs6net/s6net_ident_client.c0000644000000000000000000000132713061726457017536 0ustar /* ISC license. */ #include #include #include ssize_t s6net_ident_client (char *s, size_t max, ip46_t const *remoteip, uint16_t remoteport, ip46_t const *localip, uint16_t localport, tain_t const *deadline, tain_t *stamp) { char buf[S6NET_IDENT_REPLY_SIZE] ; size_t len ; ssize_t r = s6net_ident_reply_get(buf, remoteip, remoteport, localip, localport, deadline, stamp) ; if (r < 0) return errno == EPIPE ? (errno = EIO, 0) : -1 ; /* the RFC says so */ len = r ; r = s6net_ident_reply_parse(buf, remoteport, localport) ; if (r <= 0) return r ; if (max + r < len + 1) return (errno = ENAMETOOLONG, -1) ; memcpy(s, buf + r, len - r + 1) ; return len - r + 1 ; } s6-networking-2.3.1.1/src/libs6net/s6net_ident_reply_parse.c0000644000000000000000000000330713433236112020570 0ustar /* ISC license. */ #include #include #include #include #include #include static size_t skipspace (char const *s) { size_t n = 0 ; while ((s[n] == ' ') || (s[n] == '\t')) n++ ; return n ; } ssize_t s6net_ident_reply_parse (char const *s, uint16_t rp, uint16_t lp) { size_t n = 0 ; n += skipspace(s+n) ; if (!s[n]) goto err ; { size_t i ; uint16_t u ; i = uint16_scan(s+n, &u) ; if (!i) goto err ; n += i ; if (u != rp) goto err ; n += skipspace(s+n) ; if (!s[n]) goto err ; if (s[n++] != ',') goto err ; n += skipspace(s+n) ; if (!s[n]) goto err ; i = uint16_scan(s+n, &u) ; if (!i) goto err ; n += i ; if (u != lp) goto err ; } n += skipspace(s+n) ; if (!s[n]) goto err ; if (s[n++] != ':') goto err ; n += skipspace(s+n) ; if (!s[n]) goto err ; if (!strncmp(s+n, "ERROR", 5)) goto ERROR ; if (!strncmp(s+n, "USERID", 6)) goto USERID ; err: return (errno = EPROTO, -1) ; ERROR: n += 5 ; n += skipspace(s+n) ; if (!s[n]) goto err ; if (s[n++] != ':') goto err ; n += skipspace(s+n) ; if (!s[n]) goto err ; if (!strncmp(s+n, "INVALID-PORT", 12)) return (errno = EINVAL, 0) ; if (!strncmp(s+n, "NO-USER", 7)) return (errno = ESRCH, 0) ; if (!strncmp(s+n, "HIDDEN-USER", 11)) return (errno = EPERM, 0) ; if (!strncmp(s+n, "UNKNOWN-ERROR", 13)) return (errno = EIO, 0) ; if (s[n] == 'X') return (errno = EEXIST, 0) ; goto err ; USERID: n += 6 ; n += skipspace(s+n) ; if (!s[n]) goto err ; if (s[n++] != ':') goto err ; n += str_chr(s+n, ':') ; if (!s[n]) goto err ; n++ ; if ((s[n] == ' ') || (s[n] == '\t')) n++ ; return n ; } s6-networking-2.3.1.1/src/libs6net/s6net_ident_error.c0000644000000000000000000000107213061235654017400 0ustar /* ISC license */ #include #include #include #define N 5 static char const *s6net_ident_error_strings[N+1] = { "invalid port", "no such user", "identification denied", "unknown error", "X-error-token", "(invalid error code)" } ; static int const s6net_ident_error_codes[N] = { EINVAL, ESRCH, EPERM, EIO, EEXIST } ; char const *s6net_ident_error_str (int e) { unsigned int i = 0 ; for (; i < N ; i++) if (e == s6net_ident_error_codes[i]) break ; return s6net_ident_error_strings[i] ; } s6-networking-2.3.1.1/src/libs6net/s6net_ident_reply_get.c0000644000000000000000000000274713433236053020250 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include ssize_t s6net_ident_reply_get (char *s, ip46_t const *remoteip, uint16_t remoteport, ip46_t const *localip, uint16_t localport, tain_t const *deadline, tain_t *stamp) { size_t len ; int fd ; if (ip46_is6(remoteip) != ip46_is6(localip)) return (errno = EAFNOSUPPORT, -1) ; fd = socket_tcp46(ip46_is6(remoteip)) ; if (fd < 0) return -1 ; if (socket_bind46(fd, localip, 0) < 0) goto err ; if (!socket_deadlineconnstamp46(fd, remoteip, 113, deadline, stamp)) goto err ; { char buf[S6NET_IDENT_REPLY_SIZE + 1] ; char fmt[UINT16_FMT] ; buffer b = BUFFER_INIT(&buffer_write, fd, buf, 256) ; size_t n = uint16_fmt(fmt, remoteport) ; buffer_putnoflush(&b, fmt, n) ; buffer_putnoflush(&b, " , ", 3) ; n = uint16_fmt(fmt, localport) ; buffer_putnoflush(&b, fmt, n) ; buffer_putnoflush(&b, "\r\n", 2) ; if (!buffer_timed_flush(&b, deadline, stamp)) goto err ; buffer_init(&b, &buffer_read, fd, buf, S6NET_IDENT_REPLY_SIZE + 1) ; if (sanitize_read(timed_getlnmax(&b, s, S6NET_IDENT_REPLY_SIZE, &len, '\n', deadline, stamp)) <= 0) goto err ; } fd_close(fd) ; if (!len--) return (errno = EPROTO, -1) ; s[len] = 0 ; return len ; err: fd_close(fd) ; return -1 ; } s6-networking-2.3.1.1/src/libs6net/deps-exe/0000755000000000000000000000000012452574231015313 5ustar s6-networking-2.3.1.1/src/libs6net/deps-lib/0000755000000000000000000000000012452574234015303 5ustar s6-networking-2.3.1.1/src/libs6net/deps-lib/s6net0000644000000000000000000000014513021006407016246 0ustar s6net_ident_client.o s6net_ident_reply_get.o s6net_ident_reply_parse.o s6net_ident_error.o -lskarnet s6-networking-2.3.1.1/src/stls/0000755000000000000000000000000013523276042013037 5ustar s6-networking-2.3.1.1/src/stls/stls_run.c0000644000000000000000000001707513151103033015050 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include typedef struct tlsbuf_s tlsbuf_t, *tlsbuf_t_ref ; struct tlsbuf_s { buffer b ; unsigned char blockedonother : 1 ; char buf[STLS_BUFSIZE] ; } ; static inline int buffer_tls_flush (struct tls *ctx, tlsbuf_t *b) { struct iovec v[2] ; ssize_t r, w ; buffer_rpeek(&b[0].b, v) ; r = tls_write(ctx, v[0].iov_base, v[0].iov_len) ; switch (r) { case -1 : return -1 ; case TLS_WANT_POLLIN : if (b[1].blockedonother) strerr_dief1x(101, "TLS deadlock") ; b[0].blockedonother = 1 ; case TLS_WANT_POLLOUT : return 0 ; default : break ; } w = r ; if ((size_t)w == v[0].iov_len && v[1].iov_len) { r = tls_write(ctx, v[1].iov_base, v[1].iov_len) ; switch (r) { case TLS_WANT_POLLIN : if (b[1].blockedonother) strerr_dief1x(101, "TLS deadlock") ; b[0].blockedonother = 1 ; case -1 : case TLS_WANT_POLLOUT : buffer_rseek(&b[0].b, w) ; return 0 ; default : break ; } w += r ; } buffer_rseek(&b[0].b, w) ; return 1 ; } static inline int buffer_tls_fill (struct tls *ctx, tlsbuf_t *b) { struct iovec v[2] ; ssize_t r, w ; int ok = 1 ; buffer_wpeek(&b[1].b, v) ; r = tls_read(ctx, v[0].iov_base, v[0].iov_len) ; switch (r) { case 0 : return -2 ; case -1 : return -1 ; case TLS_WANT_POLLOUT : if (b[0].blockedonother) strerr_dief1x(101, "TLS deadlock") ; b[1].blockedonother = 1 ; case TLS_WANT_POLLIN : return 0 ; default : break ; } w = r ; if ((size_t)w == v[0].iov_len && v[1].iov_len) { r = tls_read(ctx, v[1].iov_base, v[1].iov_len) ; switch (r) { case TLS_WANT_POLLOUT : if (b[0].blockedonother) strerr_dief1x(101, "TLS deadlock") ; b[1].blockedonother = 1 ; case -1 : case TLS_WANT_POLLIN : buffer_wseek(&b[1].b, w) ; return 0 ; case 0 : ok = -1 ; errno = EPIPE ; default : break ; } w += r ; } buffer_wseek(&b[1].b, w) ; return ok ; } static void send_closenotify (struct tls *ctx, int const *fds) { iopause_fd x = { .fd = fds[3], .events = IOPAUSE_WRITE } ; while (tls_close(ctx) == TLS_WANT_POLLOUT) iopause_g(&x, 1, 0) ; } static void closeit (struct tls *ctx, int *fds, int brutal) { if (brutal) shutdown(fds[3], SHUT_WR) ; else if (fds[2] >= 0) send_closenotify(ctx, fds) ; fd_close(fds[3]) ; fds[3] = -1 ; } static void handle_signals (pid_t pid, int *e) { for (;;) switch (selfpipe_read()) { case -1 : strerr_diefu1sys(111, "read selfpipe") ; case 0 : return ; case SIGCHLD : { int wstat ; if (wait_pid_nohang(pid, &wstat) == pid) { *e = wstat ; return ; } } } } int stls_run (struct tls *ctx, int *fds, pid_t pid, unsigned int verbosity, uint32_t options, tain_t const *tto) { tlsbuf_t b[2] = { { .blockedonother = 0 }, { .blockedonother = 0 } } ; iopause_fd x[5] = { { .fd = fds[4], .events = IOPAUSE_READ } } ; unsigned int xindex[4] ; unsigned int i = 0 ; int e = -1 ; for (; i < 2 ; i++) { buffer_init(&b[i].b, i ? &buffer_write : &buffer_read, fds[i], b[i].buf, STLS_BUFSIZE) ; if (ndelay_on(fds[2+i]) < 0) strerr_diefu1sys(111, "set fds non-blocking") ; } if (sig_ignore(SIGPIPE) < 0) strerr_diefu1sys(111, "ignore SIGPIPE") ; tain_now_g() ; for (;;) { tain_t deadline ; unsigned int xlen = 1 ; int r ; tain_add_g(&deadline, fds[0] >= 0 && fds[2] >= 0 && buffer_isempty(&b[0].b) && buffer_isempty(&b[1].b) ? tto : &tain_infinite_relative) ; /* poll() preparation */ if (fds[0] >= 0 && buffer_isreadable(&b[0].b)) { x[xlen].fd = fds[0] ; x[xlen].events = IOPAUSE_READ ; xindex[0] = xlen++ ; } else xindex[0] = 5 ; if (fds[1] >= 0 && buffer_iswritable(&b[1].b)) { x[xlen].fd = fds[1] ; x[xlen].events = IOPAUSE_WRITE ; xindex[1] = xlen++ ; } else xindex[1] = 5 ; if (fds[2] >= 0 && !b[1].blockedonother && buffer_isreadable(&b[1].b)) { x[xlen].fd = fds[2] ; x[xlen].events = IOPAUSE_READ ; xindex[2] = xlen++ ; } else xindex[2] = 5 ; if (fds[3] >= 0 && !b[0].blockedonother && buffer_iswritable(&b[0].b)) { x[xlen].fd = fds[3] ; x[xlen].events = IOPAUSE_WRITE ; xindex[3] = xlen++ ; } else xindex[3] = 5 ; if (xlen == 1) break ; /* poll() */ r = iopause_g(x, xlen, &deadline) ; if (r < 0) strerr_diefu1sys(111, "iopause") ; else if (!r) { fd_close(fds[0]) ; fds[0] = -1 ; closeit(ctx, fds, options & 1) ; if (e >= 0) break ; continue ; } while (xlen--) if (x[xlen].revents & IOPAUSE_EXCEPT) x[xlen].revents |= IOPAUSE_READ | IOPAUSE_WRITE ; /* Signal */ if (x[0].revents & IOPAUSE_READ) { handle_signals(pid, &e) ; if (e >= 0 && xindex[0] == 5 && xindex[3] == 5) break ; } /* Flush to local */ if (xindex[1] < 5 && x[xindex[1]].revents & IOPAUSE_WRITE) { r = buffer_flush(&b[1].b) ; if (!r && !error_isagain(errno)) { strerr_warnwu1sys("write to application") ; if (fds[2] >= 0) { if (options & 1) shutdown(fds[2], SHUT_RD) ; fd_close(fds[2]) ; fds[2] = -1 ; xindex[2] = 4 ; } r = 1 ; } if (r && fds[2] < 0) { fd_close(fds[1]) ; fds[1] = -1 ; } } /* Flush to remote */ if (xindex[3] < 5 && x[xindex[3]].revents & IOPAUSE_WRITE) { r = buffer_tls_flush(ctx, b) ; if (r < 0) { strerr_warnwu2x("write to peer: ", tls_error(ctx)) ; fd_close(fds[0]) ; fds[0] = -1 ; } if (r && fds[0] < 0) { closeit(ctx, fds, options & 1) ; if (e >= 0) break ; } } /* Fill from local */ if (xindex[0] < 5 && x[xindex[0]].revents & IOPAUSE_READ) { r = sanitize_read(buffer_fill(&b[0].b)) ; if (r < 0) { if (errno != EPIPE) strerr_warnwu1sys("read from application") ; fd_close(fds[0]) ; fds[0] = -1 ; if (buffer_isempty(&b[0].b)) { closeit(ctx, fds, options & 1) ; if (e >= 0) break ; } } } /* Fill from remote */ if (xindex[2] < 5 && x[xindex[2]].revents & IOPAUSE_READ) { r = buffer_tls_fill(ctx, b) ; if (r < 0) { if (r == -1) strerr_warnwu2x("read from peer: ", tls_error(ctx)) ; if (options & 1) shutdown(fds[2], SHUT_RD) ; /* XXX: We need a way to detect when we've received a close_notify, because then we need to trigger a write and then shut the engine down. This is orthogonal to options&1, it only means that the peer sent a close_notify. As for now, libtls doesn't offer an API to detect that, so we do nothing special - we just wait until our app sends EOF. */ fd_close(fds[2]) ; fds[2] = -1 ; if (buffer_isempty(&b[1].b)) { fd_close(fds[1]) ; fds[1] = -1 ; } } } } if (fds[1] >= 0) fd_close(fds[1]) ; if (fds[0] >= 0) fd_close(fds[0]) ; if (fds[3] >= 0) fd_close(fds[3]) ; if (fds[2] >= 0) fd_close(fds[2]) ; return e ; } s6-networking-2.3.1.1/src/stls/stls_s6tlsd.c0000644000000000000000000000531213125270340015461 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include "stls-internal.h" #define diecfg(cfg, s) strerr_diefu3x(96, (s), ": ", tls_config_error(cfg)) #define diectx(e, ctx, s) strerr_diefu3x(e, (s), ": ", tls_error(ctx)) int stls_s6tlsd (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity) { int fds[5] = { 0, 1, 0, 1 } ; struct tls *cctx ; struct tls *ctx ; struct tls_config *cfg ; pid_t pid ; char const *x ; int wstat ; if (tls_init() < 0) strerr_diefu1sys(111, "tls_init") ; cfg = tls_config_new() ; if (!cfg) strerr_diefu1sys(111, "tls_config_new") ; x = env_get2(envp, "CERTFILE") ; if (!x) strerr_dienotset(100, "CERTFILE") ; if (tls_config_set_cert_file(cfg, x) < 0) diecfg(cfg, "tls_config_set_cert_file") ; x = env_get2(envp, "KEYFILE") ; if (!x) strerr_dienotset(100, "KEYFILE") ; if (tls_config_set_key_file(cfg, x) < 0) diecfg(cfg, "tls_config_set_key_file") ; if (tls_config_set_ciphers(cfg, "secure") < 0) diecfg(cfg, "tls_config_set_ciphers") ; if (tls_config_set_dheparams(cfg, "auto") < 0) diecfg(cfg, "tls_config_set_dheparams") ; if (tls_config_set_ecdhecurve(cfg, "auto") < 0) diecfg(cfg, "tls_config_set_ecdhecurve") ; if (preoptions & 1) { x = env_get2(envp, "CADIR") ; if (x) { if (tls_config_set_ca_path(cfg, x) < 0) diecfg(cfg, "tls_config_set_ca_path") ; } else { x = env_get2(envp, "CAFILE") ; if (x) { if (tls_config_set_ca_file(cfg, x) < 0) diecfg(cfg, "tls_config_set_ca_file") ; } else strerr_dienotset(100, "CADIR or CAFILE") ; } if (preoptions & 4) tls_config_verify_client(cfg) ; else tls_config_verify_client_optional(cfg) ; } else tls_config_insecure_noverifycert(cfg) ; tls_config_set_protocols(cfg, TLS_PROTOCOLS_DEFAULT) ; tls_config_prefer_ciphers_server(cfg) ; ctx = tls_server() ; if (!ctx) strerr_diefu1sys(111, "tls_server") ; if (tls_configure(ctx, cfg) < 0) diectx(97, ctx, "tls_configure") ; tls_config_free(cfg) ; pid = stls_prep_spawn_drop(argv, envp, fds, uid, gid, !!(preoptions & 2)) ; if (tls_accept_fds(ctx, &cctx, fds[2], fds[3]) < 0) diectx(97, ctx, "tls_accept_fds") ; tls_free(ctx) ; if (tls_handshake(cctx) < 0) diectx(97, cctx, "perform SSL handshake") ; wstat = stls_run(cctx, fds, pid, verbosity, options, tto) ; if (wstat < 0 && wait_pid(pid, &wstat) < 0) strerr_diefu1sys(111, "wait_pid") ; return wait_estatus(wstat) ; } s6-networking-2.3.1.1/src/stls/stls_prep_spawn_drop.c0000644000000000000000000000216013064473324017453 0ustar /* ISC license. */ #include #include #include #include #include #include #include "stls-internal.h" pid_t stls_prep_spawn_drop (char const *const *argv, char const *const *envp, int *fds, uid_t uid, gid_t gid, uint32_t options) { pid_t pid ; fds[4] = selfpipe_init() ; if (fds[4] < 0) strerr_diefu1sys(111, "init selfpipe") ; if (selfpipe_trap(SIGCHLD) < 0) strerr_diefu1sys(111, "trap SIGCHLD") ; if (!(options & 1)) pid = child_spawn2(argv[0], argv, envp, fds) ; else { char const modifs[] = "CADIR\0CAFILE\0KEYFILE\0CERTFILE\0TLS_UID\0TLS_GID" ; size_t modiflen = sizeof(modifs) ; size_t n = env_len(envp) ; char const *newenv[n + 7] ; size_t newenvlen = env_merge(newenv, n+7, envp, n, modifs, modiflen) ; if (!newenvlen) return 0 ; pid = child_spawn2(argv[0], argv, newenv, fds) ; } if (!pid) strerr_diefu2sys(111, "spawn ", argv[0]) ; if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ; if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ; return pid ; } s6-networking-2.3.1.1/src/stls/deps-exe/0000755000000000000000000000000013016045571014547 5ustar s6-networking-2.3.1.1/src/stls/stls_s6tlsc.c0000644000000000000000000000522213125270353015464 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include "stls-internal.h" #define diecfg(cfg, s) strerr_diefu3x(96, (s), ": ", tls_config_error(cfg)) #define diectx(e, ctx, s) strerr_diefu3x(e, (s), ": ", tls_error(ctx)) int stls_s6tlsc (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity, char const *servername, int *sfd) { int fds[5] = { sfd[0], sfd[1], sfd[0], sfd[1] } ; struct tls *ctx ; struct tls_config *cfg ; pid_t pid ; char const *x ; int wstat ; if (tls_init() < 0) strerr_diefu1sys(111, "tls_init") ; cfg = tls_config_new() ; if (!cfg) strerr_diefu1sys(111, "tls_config_new") ; x = env_get2(envp, "CADIR") ; if (x) { if (tls_config_set_ca_path(cfg, x) < 0) diecfg(cfg, "tls_config_set_ca_path") ; } else { x = env_get2(envp, "CAFILE") ; if (x) { if (tls_config_set_ca_file(cfg, x) < 0) diecfg(cfg, "tls_config_set_ca_file") ; } else strerr_dief1x(100, "no trust anchor found - please set CADIR or CAFILE") ; } if (preoptions & 1) { x = env_get2(envp, "CERTFILE") ; if (!x) strerr_dienotset(100, "CERTFILE") ; if (tls_config_set_cert_file(cfg, x) < 0) diecfg(cfg, "tls_config_set_cert_file") ; x = env_get2(envp, "KEYFILE") ; if (!x) strerr_dienotset(100, "KEYFILE") ; if (tls_config_set_key_file(cfg, x) < 0) diecfg(cfg, "tls_config_set_key_file") ; } if (tls_config_set_ciphers(cfg, "secure") < 0) diecfg(cfg, "tls_config_set_ciphers") ; if (tls_config_set_dheparams(cfg, "auto") < 0) diecfg(cfg, "tls_config_set_dheparams") ; if (tls_config_set_ecdhecurve(cfg, "auto") < 0) diecfg(cfg, "tls_config_set_ecdhecurve") ; tls_config_verify(cfg) ; tls_config_set_protocols(cfg, TLS_PROTOCOLS_ALL) ; tls_config_prefer_ciphers_server(cfg) ; if (!servername) tls_config_insecure_noverifyname(cfg) ; ctx = tls_client() ; if (!ctx) strerr_diefu1sys(111, "tls_client") ; if (tls_configure(ctx, cfg) < 0) diectx(97, ctx, "tls_configure") ; pid = stls_prep_spawn_drop(argv, envp, fds, uid, gid, !!(preoptions & 2)) ; if (tls_connect_fds(ctx, fds[2], fds[3], servername) < 0) diectx(97, ctx, "tls_connect_fds") ; tls_config_free(cfg) ; if (tls_handshake(ctx) < 0) diectx(97, ctx, "perform SSL handshake") ; wstat = stls_run(ctx, fds, pid, verbosity, options, tto) ; if (wstat < 0 && wait_pid(pid, &wstat) < 0) strerr_diefu1sys(111, "wait_pid") ; return wait_estatus(wstat) ; } s6-networking-2.3.1.1/src/stls/stls-internal.h0000644000000000000000000000034713064473264016020 0ustar /* ISC license. */ #ifndef STLS_INTERNAL_H #define STLS_INTERNAL_H #include #include extern pid_t stls_prep_spawn_drop (char const *const *, char const *const *, int *, uid_t, gid_t, uint32_t) ; #endif s6-networking-2.3.1.1/src/stls/deps-lib/0000755000000000000000000000000013016150463014531 5ustar s6-networking-2.3.1.1/src/stls/deps-lib/stls0000644000000000000000000000011613064473104015442 0ustar stls_prep_spawn_drop.o stls_run.o stls_s6tlsc.o stls_s6tlsd.o -ltls -lskarnet s6-networking-2.3.1.1/src/sbearssl/0000755000000000000000000000000013541515353013671 5ustar s6-networking-2.3.1.1/src/sbearssl/sbearssl_rsa_pkey_from.c0000644000000000000000000000067113061730117020571 0ustar /* ISC license. */ #include #include int sbearssl_rsa_pkey_from (sbearssl_rsa_pkey *l, br_rsa_public_key const *k, stralloc *sa) { if (!stralloc_readyplus(sa, k->nlen + k->elen)) return 0 ; l->n = sa->len ; stralloc_catb(sa, (char const *)k->n, k->nlen) ; l->nlen = k->nlen ; l->e = sa->len ; stralloc_catb(sa, (char const *)k->e, k->elen) ; l->elen = k->elen ; return 1 ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_pem_decode_from_buffer.c0000644000000000000000000000264113433236017022373 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include "sbearssl-internal.h" int sbearssl_pem_decode_from_buffer (buffer *b, genalloc *list, stralloc *sa) { br_pem_decoder_context ctx ; sbearssl_pemobject po ; sbearssl_strallocerr blah = { .sa = sa, .err = 0 } ; size_t listbase = genalloc_len(sbearssl_pemobject, list) ; size_t sabase = sa->len ; int listwasnull = !genalloc_s(sbearssl_pemobject, list) ; int sawasnull = !sa->s ; int inobj = 0 ; int r = -1 ; br_pem_decoder_init(&ctx) ; for (;;) { struct iovec v[2] ; ssize_t rr = buffer_fill(b) ; if (rr < 0) goto rfail ; if (!rr) break ; buffer_rpeek(b, v) ; r = sbearssl_pem_push(&ctx, v[0].iov_base, v[0].iov_len, &po, list, &blah, &inobj) ; if (r) goto fail ; if (v[1].iov_len) { r = sbearssl_pem_push(&ctx, v[1].iov_base, v[1].iov_len, &po, list, &blah, &inobj) ; if (r) goto fail ; } buffer_rseek(b, v[0].iov_len + v[1].iov_len) ; } if (!inobj) return 0 ; errno = EPROTO ; rfail: r = -1 ; fail: if (listwasnull) genalloc_free(sbearssl_pemobject, list) ; else genalloc_setlen(sbearssl_pemobject, list, listbase) ; if (sawasnull) stralloc_free(sa) ; else sa->len = sabase ; return r ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_cert_readfile.c0000644000000000000000000000346213061314453020523 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include int sbearssl_cert_readfile (char const *fn, genalloc *certs, stralloc *sa) { char buf[SBEARSSL_MAXCERTFILESIZE] ; size_t certsbase = genalloc_len(sbearssl_cert, certs) ; size_t sabase = sa->len ; size_t n ; int certswasnull = !genalloc_s(sbearssl_cert, certs) ; int sawasnull = !sa->s ; { ssize_t r = openreadnclose(fn, buf, SBEARSSL_MAXCERTFILESIZE) ; if (r < 0) return r ; n = r ; } if (sbearssl_isder((unsigned char *)buf, n)) { sbearssl_cert cert = { .data = sa->len, .datalen = n } ; if (!stralloc_catb(sa, buf, n)) return -1 ; if (!genalloc_append(sbearssl_cert, certs, &cert)) goto fail ; } else { genalloc pems = GENALLOC_ZERO ; size_t i = 0 ; sbearssl_pemobject *p ; int r = sbearssl_pem_decode_from_string(buf, n, &pems, sa) ; if (r) return r ; p = genalloc_s(sbearssl_pemobject, &pems) ; n = genalloc_len(sbearssl_pemobject, &pems) ; for (; i < n ; i++) { char const *name = sa->s + p[i].name ; if (!strcmp(name, "CERTIFICATE") || !strcmp(name, "X509 CERTIFICATE")) { sbearssl_cert cert = { .data = p[i].data, .datalen = p[i].datalen } ; if (!genalloc_append(sbearssl_cert, certs, &cert)) { genalloc_free(sbearssl_pemobject, &pems) ; goto fail ; } } genalloc_free(sbearssl_pemobject, &pems) ; } } return 0 ; fail: if (certswasnull) genalloc_free(sbearssl_cert, certs) ; else genalloc_setlen(sbearssl_cert, certs, certsbase) ; if (sawasnull) stralloc_free(sa) ; else sa->len = sabase ; return -1 ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_isder.c0000644000000000000000000000077513061727703017053 0ustar /* ISC license. */ #include int sbearssl_isder (unsigned char const *s, size_t len) { size_t dlen = 0 ; unsigned char c ; if (len < 2) return 0 ; if (*s++ != 0x30) return 0 ; c = *s++ ; len -= 2; if (c < 0x80) return (size_t)c == len ; else if (c == 0x80) return 0 ; c -= 0x80 ; if (len < (size_t)c + 2) return 0 ; len -= (size_t)c ; while (c--) { if (dlen > (len >> 8)) return 0 ; dlen = (dlen << 8) + (size_t)*s++ ; } return dlen == len ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_ec_pkey_from.c0000644000000000000000000000051613061727610020375 0ustar /* ISC license. */ #include #include int sbearssl_ec_pkey_from (sbearssl_ec_pkey *l, br_ec_public_key const *k, stralloc *sa) { if (!stralloc_catb(sa, (char const *)k->q, k->qlen)) return 0 ; l->curve = k->curve ; l->q = sa->len - k->qlen ; l->qlen = k->qlen ; return 1 ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_run.c0000644000000000000000000001420513151102703016525 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #include #include #include #include static inline void handle_signals (pid_t pid, int *e) { for (;;) switch (selfpipe_read()) { case -1 : strerr_diefu1sys(111, "read selfpipe") ; case 0 : return ; case SIGCHLD : { int wstat ; if (wait_pid_nohang(pid, &wstat) == pid) { *e = wstat ; return ; } } } } int sbearssl_run (br_ssl_engine_context *ctx, int *fds, pid_t pid, unsigned int verbosity, uint32_t options, tain_t const *tto) { iopause_fd x[5] = { { .fd = fds[4], .events = IOPAUSE_READ } } ; unsigned int xindex[4] ; int markedforflush = 0 ; int e = -1 ; if (ndelay_on(fds[2]) < 0 || ndelay_on(fds[3]) < 0) strerr_diefu1sys(111, "set fds non-blocking") ; if (sig_ignore(SIGPIPE) < 0) strerr_diefu1sys(111, "ignore SIGPIPE") ; for (;;) { tain_t deadline ; unsigned int j = 1 ; unsigned int state = br_ssl_engine_current_state(ctx) ; int r ; if (state & BR_SSL_CLOSED) { r = br_ssl_engine_last_error(ctx) ; if (r) strerr_diefu2x(98, "establish or maintain SSL connection to peer: ", sbearssl_error_str(r)) ; break ; } tain_add_g(&deadline, fds[0] >= 0 && fds[2] >= 0 && state & (BR_SSL_SENDAPP | BR_SSL_RECVREC) ? tto : &tain_infinite_relative) ; if (fds[0] >= 0 && state & BR_SSL_SENDAPP) { x[j].fd = fds[0] ; x[j].events = IOPAUSE_READ ; xindex[0] = j++ ; } else xindex[0] = 5 ; if (fds[1] >= 0 && state & BR_SSL_RECVAPP) { x[j].fd = fds[1] ; x[j].events = IOPAUSE_WRITE ; xindex[1] = j++ ; } else xindex[1] = 5 ; if (fds[2] >= 0 && state & BR_SSL_RECVREC) { x[j].fd = fds[2] ; x[j].events = IOPAUSE_READ ; xindex[2] = j++ ; } else xindex[2] = 5 ; if (fds[3] >= 0 && state & BR_SSL_SENDREC) { x[j].fd = fds[3] ; x[j].events = IOPAUSE_WRITE ; xindex[3] = j++ ; } else xindex[3] = 5 ; if (j == 1) break ; r = iopause_g(x, j, &deadline) ; if (r < 0) strerr_diefu1sys(111, "iopause") ; else if (!r) { fd_close(fds[0]) ; fds[0] = -1 ; if (options & 1) { shutdown(fds[3], SHUT_WR) ; fd_close(fds[3]) ; fds[3] = -1 ; } else br_ssl_engine_close(ctx) ; if (e >= 0) break ; continue ; } while (j--) if (x[j].revents & IOPAUSE_EXCEPT) x[j].revents |= IOPAUSE_READ | IOPAUSE_WRITE ; /* Signal */ if (x[0].revents & IOPAUSE_READ) { handle_signals(pid, &e) ; if (e >= 0 && xindex[0] == 5 && xindex[3] == 5) break ; } /* Flush to local */ if (state & BR_SSL_RECVAPP && x[xindex[1]].events & x[xindex[1]].revents & IOPAUSE_WRITE) { size_t len ; unsigned char const *s = br_ssl_engine_recvapp_buf(ctx, &len) ; size_t w = allwrite(fds[1], (char const *)s, len) ; if (!w) { if (!error_isagain(errno)) strerr_diefu1sys(111, "write to application") ; } else { br_ssl_engine_recvapp_ack(ctx, w) ; if (fds[2] < 0 && w == len) { fd_close(fds[1]) ; fds[1] = -1 ; } state = br_ssl_engine_current_state(ctx) ; } } /* Flush to remote */ if (state & BR_SSL_SENDREC && xindex[3] < 5 && x[xindex[3]].events & x[xindex[3]].revents & IOPAUSE_WRITE) { size_t len ; unsigned char const *s = br_ssl_engine_sendrec_buf(ctx, &len) ; size_t w = allwrite(fds[3], (char const *)s, len) ; if (!w) { if (!error_isagain(errno)) strerr_diefu1sys(111, "write to peer") ; } else { br_ssl_engine_sendrec_ack(ctx, w) ; if (fds[0] < 0 && w == len) { if (options & 1) { shutdown(fds[3], SHUT_WR) ; fd_close(fds[3]) ; fds[3] = -1 ; } else br_ssl_engine_close(ctx) ; if (e >= 0) break ; } state = br_ssl_engine_current_state(ctx) ; } } /* Fill from local */ if (state & BR_SSL_SENDAPP && xindex[0] < 5 && x[xindex[0]].events & IOPAUSE_READ && (markedforflush || x[xindex[0]].revents & IOPAUSE_READ)) { size_t len ; unsigned char *s = br_ssl_engine_sendapp_buf(ctx, &len) ; size_t w = allread(fds[0], (char *)s, len) ; if (!w) { br_ssl_engine_flush(ctx, 0) ; markedforflush = 0 ; if (!error_isagain(errno)) { fd_close(fds[0]) ; fds[0] = -1 ; if (!br_ssl_engine_sendrec_buf(ctx, &len)) { if (options & 1) { shutdown(fds[3], SHUT_WR) ; fd_close(fds[3]) ; fds[3] = -1 ; } else br_ssl_engine_close(ctx) ; if (e >= 0) break ; } } } else { br_ssl_engine_sendapp_ack(ctx, w) ; if (w == len) markedforflush = 1 ; else { br_ssl_engine_flush(ctx, 0) ; markedforflush = 0 ; } } state = br_ssl_engine_current_state(ctx) ; } /* Fill from remote */ if (state & BR_SSL_RECVREC && xindex[2] < 5 && x[xindex[2]].events & x[xindex[2]].revents & IOPAUSE_READ) { size_t len ; unsigned char *s = br_ssl_engine_recvrec_buf(ctx, &len) ; size_t w = allread(fds[2], (char *)s, len) ; if (!w) { if (!error_isagain(errno)) { if (options & 1) shutdown(fds[2], SHUT_RD) ; fd_close(fds[2]) ; fds[2] = -1 ; if (fds[1] >= 0 && !br_ssl_engine_recvapp_buf(ctx, &len)) { fd_close(fds[1]) ; fds[1] = -1 ; } } } else br_ssl_engine_recvrec_ack(ctx, w) ; } } if (fds[1] >= 0) fd_close(fds[1]) ; if (fds[0] >= 0) fd_close(fds[0]) ; if (fds[3] >= 0) fd_close(fds[3]) ; if (fds[2] >= 0) fd_close(fds[2]) ; return e ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_skey_to.c0000644000000000000000000000073313016150463017405 0ustar /* ISC license. */ #include #include #include int sbearssl_skey_to (sbearssl_skey const *l, br_skey *k, char *s) { switch (l->type) { case BR_KEYTYPE_RSA : sbearssl_rsa_skey_to(&l->data.rsa, &k->data.rsa, s) ; break ; case BR_KEYTYPE_EC : sbearssl_ec_skey_to(&l->data.ec, &k->data.ec, s) ; break ; default : return (errno = EINVAL, 0) ; } k->type = l->type ; return 1 ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_pkey_from.c0000644000000000000000000000102113061730067017716 0ustar /* ISC license. */ #include #include #include int sbearssl_pkey_from (sbearssl_pkey *l, br_x509_pkey const *k, stralloc *sa) { switch (k->key_type) { case BR_KEYTYPE_RSA : if (!sbearssl_rsa_pkey_from(&l->data.rsa, &k->key.rsa, sa)) return 0 ; break ; case BR_KEYTYPE_EC : if (!sbearssl_ec_pkey_from(&l->data.ec, &k->key.ec, sa)) return 0 ; break ; default : return (errno = EINVAL, 0) ; } l->type = k->key_type ; return 1 ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_s6tlsc.c0000644000000000000000000000505113064506737017160 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #include #include "sbearssl-internal.h" int sbearssl_s6tlsc (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity, char const *servername, int *sfd) { int fds[5] = { sfd[0], sfd[1], sfd[0], sfd[1] } ; stralloc storage = STRALLOC_ZERO ; genalloc tas = GENALLOC_ZERO ; size_t talen ; pid_t pid ; if (preoptions & 1) strerr_dief1x(100, "client certificates are not supported yet") ; { int r ; char const *x = env_get2(envp, "CADIR") ; if (x) r = sbearssl_ta_readdir(x, &tas, &storage) ; else { x = env_get2(envp, "CAFILE") ; if (!x) strerr_dienotset(100, "CADIR or CAFILE") ; r = sbearssl_ta_readfile(x, &tas, &storage) ; } if (r < 0) strerr_diefu2sys(111, "read trust anchors in ", x) ; else if (r) strerr_diefu4x(96, "read trust anchors in ", x, ": ", sbearssl_error_str(r)) ; talen = genalloc_len(sbearssl_ta, &tas) ; if (!talen) strerr_dief2x(96, "no trust anchor found in ", x) ; } if (!random_init()) strerr_diefu1sys(111, "initialize random generator") ; pid = sbearssl_prep_spawn_drop(argv, envp, fds, uid, gid, !!(preoptions & 2)) ; { unsigned char buf[BR_SSL_BUFSIZE_BIDI] ; br_x509_minimal_context xc ; br_ssl_client_context cc ; br_x509_trust_anchor btas[talen] ; size_t i = talen ; int wstat ; stralloc_shrink(&storage) ; while (i--) sbearssl_ta_to(genalloc_s(sbearssl_ta, &tas) + i, btas + i, storage.s) ; genalloc_free(sbearssl_ta, &tas) ; br_ssl_client_init_full(&cc, &xc, btas, talen) ; random_string((char *)buf, 32) ; br_ssl_engine_inject_entropy(&cc.eng, buf, 32) ; random_finish() ; br_ssl_engine_set_buffer(&cc.eng, buf, sizeof(buf), 1) ; if (!br_ssl_client_reset(&cc, servername, 0)) strerr_diefu2x(97, "reset client context: ", sbearssl_error_str(br_ssl_engine_last_error(&cc.eng))) ; tain_now_g() ; if (!sbearssl_x509_minimal_set_tain(&xc, &STAMP)) strerr_diefu1sys(111, "initialize validation time") ; wstat = sbearssl_run(&cc.eng, fds, pid, verbosity, options, tto) ; if (wstat < 0 && wait_pid(pid, &wstat) < 0) strerr_diefu1sys(111, "wait_pid") ; return wait_estatus(wstat) ; } } s6-networking-2.3.1.1/src/sbearssl/sbearssl_cert_from.c0000644000000000000000000000052013061727340017706 0ustar /* ISC license. */ #include #include int sbearssl_cert_from (sbearssl_cert *sc, br_x509_certificate const *bc, stralloc *sa) { if (!stralloc_catb(sa, (char const *)bc->data, bc->data_len)) return 0 ; sc->data = sa->len - bc->data_len ; sc->datalen = bc->data_len ; return 1 ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_skey_from.c0000644000000000000000000000100613061730464017725 0ustar /* ISC license. */ #include #include #include int sbearssl_skey_from (sbearssl_skey *l, br_skey const *k, stralloc *sa) { switch (k->type) { case BR_KEYTYPE_RSA : if (!sbearssl_rsa_skey_from(&l->data.rsa, &k->data.rsa, sa)) return 0 ; break ; case BR_KEYTYPE_EC : if (!sbearssl_ec_skey_from(&l->data.ec, &k->data.ec, sa)) return 0 ; break ; default : return (errno = EINVAL, 0) ; } l->type = k->type ; return 1 ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_ec_skey_from.c0000644000000000000000000000051713061727637020412 0ustar /* ISC license. */ #include #include int sbearssl_ec_skey_from (sbearssl_ec_skey *l, br_ec_private_key const *k, stralloc *sa) { if (!stralloc_catb(sa, (char const *)k->x, k->xlen)) return 0 ; l->curve = k->curve ; l->x = sa->len - k->xlen ; l->xlen = k->xlen ; return 1 ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_s6tlsd.c0000644000000000000000000000722613064507014017154 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #include #include "sbearssl-internal.h" int sbearssl_s6tlsd (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity) { int fds[5] = { 0, 1, 0, 1 } ; stralloc storage = STRALLOC_ZERO ; sbearssl_skey skey ; genalloc certs = GENALLOC_ZERO ; size_t chainlen ; pid_t pid ; if (preoptions & 1) strerr_dief1x(100, "client certificates are not supported yet") ; { char const *x = env_get2(envp, "KEYFILE") ; int r ; if (!x) strerr_dienotset(100, "KEYFILE") ; r = sbearssl_skey_readfile(x, &skey, &storage) ; if (r < 0) strerr_diefu2sys(111, "read private key in ", x) ; else if (r) strerr_diefu4x(96, "decode private key in ", x, ": ", sbearssl_error_str(r)) ; x = env_get2(envp, "CERTFILE") ; if (!x) strerr_dienotset(100, "CERTFILE") ; r = sbearssl_cert_readbigpem(x, &certs, &storage) ; if (r < 0) strerr_diefu2sys(111, "read certificate chain in ", x) ; else if (r) strerr_diefu4sys(96, "read certificate chain in ", x, ": ", sbearssl_error_str(r)) ; chainlen = genalloc_len(sbearssl_cert, &certs) ; if (!chainlen) strerr_diefu2x(96, "find a certificate in ", x) ; } if (!random_init()) strerr_diefu1sys(111, "initialize random generator") ; pid = sbearssl_prep_spawn_drop(argv, envp, fds, uid, gid, !!(preoptions & 2)) ; { unsigned char buf[BR_SSL_BUFSIZE_BIDI] ; br_ssl_server_context sc ; union br_skey_u key ; br_x509_certificate chain[chainlen] ; size_t i = chainlen ; int wstat ; stralloc_shrink(&storage) ; while (i--) sbearssl_cert_to(genalloc_s(sbearssl_cert, &certs) + i, chain + i, storage.s) ; genalloc_free(sbearssl_cert, &certs) ; switch (skey.type) { case BR_KEYTYPE_RSA : sbearssl_rsa_skey_to(&skey.data.rsa, &key.rsa, storage.s) ; br_ssl_server_init_full_rsa(&sc, chain, chainlen, &key.rsa) ; break ; case BR_KEYTYPE_EC : { int kt, r ; sbearssl_ec_skey_to(&skey.data.ec, &key.ec, storage.s) ; r = sbearssl_ec_issuer_keytype(&kt, &chain[0]) ; switch (r) { case -2 : strerr_dief1x(96, "certificate issuer key type not recognized") ; case -1 : strerr_diefu1sys(111, "get certificate issuer key type") ; case 0 : break ; default : strerr_diefu3x(96, "get certificate issuer key type", ": ", sbearssl_error_str(r)) ; } br_ssl_server_init_full_ec(&sc, chain, chainlen, kt, &key.ec) ; break ; } default : strerr_dief1x(96, "unsupported private key type") ; } { uint32_t flags = BR_OPT_ENFORCE_SERVER_PREFERENCES | BR_OPT_NO_RENEGOTIATION ; if (preoptions & 1) { /* br_ssl_server_set_trust_anchor_names(&sc, x500names, x500n) ; */ if (!(preoptions & 4)) flags |= BR_OPT_TOLERATE_NO_CLIENT_AUTH ; } br_ssl_engine_add_flags(&sc.eng, flags) ; } random_string((char *)buf, 32) ; br_ssl_engine_inject_entropy(&sc.eng, buf, 32) ; random_finish() ; br_ssl_engine_set_buffer(&sc.eng, buf, sizeof(buf), 1) ; br_ssl_server_reset(&sc) ; tain_now_g() ; wstat = sbearssl_run(&sc.eng, fds, pid, verbosity, options, tto) ; if (wstat < 0 && wait_pid(pid, &wstat) < 0) strerr_diefu1sys(111, "wait_pid") ; return wait_estatus(wstat) ; } } s6-networking-2.3.1.1/src/sbearssl/deps-exe/0000755000000000000000000000000013012123101015356 5ustar s6-networking-2.3.1.1/src/sbearssl/sbearssl_rsa_skey_to.c0000644000000000000000000000074513061730160020253 0ustar /* ISC license. */ #include void sbearssl_rsa_skey_to (sbearssl_rsa_skey const *l, br_rsa_private_key *k, char *s) { k->n_bitlen = l->n_bitlen ; k->p = (unsigned char *)s + l->p ; k->plen = l->plen ; k->q = (unsigned char *)s + l->q ; k->qlen = l->qlen ; k->dp = (unsigned char *)s + l->dp ; k->dplen = l->dplen ; k->dq = (unsigned char *)s + l->dq ; k->dqlen = l->dqlen ; k->iq = (unsigned char *)s + l->iq ; k->iqlen = l->iqlen ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_ta_certs.c0000644000000000000000000000160213061730605017532 0ustar /* ISC license. */ #include #include #include #include int sbearssl_ta_certs (genalloc *taga, stralloc *tasa, sbearssl_cert const *certs, size_t certn, char const *certstorage) { size_t tagabase = genalloc_len(sbearssl_ta, taga) ; size_t tasabase = tasa->len ; size_t i = 0 ; int tagawasnull = !genalloc_s(sbearssl_ta, taga) ; int tasawasnull = !tasa->s ; int r ; for (; i < certn ; i++) { sbearssl_ta ta ; r = sbearssl_ta_cert(&ta, certs + i, certstorage, tasa) ; if (r) goto fail ; if (!genalloc_append(sbearssl_ta, taga, &ta)) goto rfail ; } return 0 ; rfail: r = -1 ; fail: if (tagawasnull) genalloc_free(sbearssl_ta, taga) ; else genalloc_setlen(sbearssl_ta, taga, tagabase) ; if (tasawasnull) stralloc_free(tasa) ; else tasa->len = tasabase ; return r ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_ta_readfile.c0000644000000000000000000000213013017571165020167 0ustar /* ISC license. */ #include #include #include #include #include int sbearssl_ta_readfile (char const *file, genalloc *taga, stralloc *tasa) { stralloc certsa = STRALLOC_ZERO ; genalloc certga = GENALLOC_ZERO ; size_t tasabase = tasa->len ; size_t tagabase = genalloc_len(sbearssl_ta, taga) ; int tasawasnull = !tasa->s ; int tagawasnull = !genalloc_s(sbearssl_ta, taga) ; int r = sbearssl_cert_readbigpem(file, &certga, &certsa) ; if (r) return r ; r = sbearssl_ta_certs(taga, tasa, genalloc_s(sbearssl_cert, &certga), genalloc_len(sbearssl_cert, &certga), certsa.s) ; if (r) goto fail ; genalloc_free(sbearssl_ta, &certga) ; stralloc_free(&certsa) ; return 0 ; fail: { int e = errno ; genalloc_free(sbearssl_cert, &certga) ; stralloc_free(&certsa) ; if (tagawasnull) genalloc_free(sbearssl_ta, taga) ; else genalloc_setlen(sbearssl_ta, taga, tagabase) ; if (tasawasnull) stralloc_free(tasa) ; else tasa->len = tasabase ; errno = e ; } return r ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_skey_readfile.c0000644000000000000000000000355513061316352020544 0ustar /* ISC license. */ #include #include #include #include #include #include #include static int decode_key (sbearssl_skey *key, char const *s, size_t len, stralloc *sa) { br_skey_decoder_context ctx ; int ktype ; br_skey_decoder_init(&ctx) ; br_skey_decoder_push(&ctx, s, len) ; ktype = br_skey_decoder_key_type(&ctx) ; switch (ktype) { case 0 : return br_skey_decoder_last_error(&ctx) ; case BR_KEYTYPE_RSA : if (!sbearssl_rsa_skey_from(&key->data.rsa, &ctx.key.rsa, sa)) return -1 ; break ; case BR_KEYTYPE_EC : if (!sbearssl_ec_skey_from(&key->data.ec, &ctx.key.ec, sa)) return -1 ; break ; } key->type = ktype ; return 0 ; } int sbearssl_skey_readfile (char const *fn, sbearssl_skey *key, stralloc *sa) { char buf[SBEARSSL_MAXSKEYFILESIZE] ; stralloc tmp = STRALLOC_ZERO ; genalloc list = GENALLOC_ZERO ; sbearssl_pemobject *p ; size_t n ; size_t i = 0 ; int r = openreadnclose(fn, buf, SBEARSSL_MAXSKEYFILESIZE) ; /* fits in an int */ if (r < 0) return r ; n = r ; if (sbearssl_isder((unsigned char *)buf, n)) return decode_key(key, buf, n, sa) ; r = sbearssl_pem_decode_from_string(buf, n, &list, &tmp) ; if (r) return r ; p = genalloc_s(sbearssl_pemobject, &list) ; n = genalloc_len(sbearssl_pemobject, &list) ; for (; i < n ; i++) { char const *name = tmp.s + p[i].name ; if (!strcmp(name, "RSA PRIVATE KEY") || !strcmp(name, "EC PRIVATE KEY") || !strcmp(name, "PRIVATE KEY")) { r = decode_key(key, tmp.s + p[i].data, p[i].datalen, sa) ; if (r) goto fail ; break ; } } stralloc_free(&tmp) ; if (i < n) return 0 ; r = -1 ; errno = EINVAL ; fail: stralloc_free(&tmp) ; genalloc_free(sbearssl_pemobject, &list) ; return r ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_error_str.c0000644000000000000000000002167613016150463017762 0ustar /* * Copyright (c) 2016 Thomas Pornin * * Permission is hereby granted, free of charge, to any person obtaining * a copy of this software and associated documentation files (the * "Software"), to deal in the Software without restriction, including * without limitation the rights to use, copy, modify, merge, publish, * distribute, sublicense, and/or sell copies of the Software, and to * permit persons to whom the Software is furnished to do so, subject to * the following conditions: * * The above copyright notice and this permission notice shall be * included in all copies or substantial portions of the Software. * * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE * SOFTWARE. */ /* * Modified by Laurent Bercot * for inclusion in the sbearssl support library. */ #include #include struct error_s { int err ; const char *comment ; } ; static struct error_s errors[] = { { BR_ERR_OK, "No error." " (BR_ERR_OK)" }, { BR_ERR_BAD_PARAM, "Caller-provided parameter is incorrect." " (BR_ERR_BAD_PARAM)" }, { BR_ERR_BAD_STATE, "Operation requested by the caller cannot be applied with" " the current context state (e.g. reading data while" " outgoing data is waiting to be sent)." " (BR_BAD_STATE)" }, { BR_ERR_UNSUPPORTED_VERSION, "Incoming protocol or record version is unsupported." " (BR_ERR_UNSUPPORTED_VERSION)" }, { BR_ERR_BAD_VERSION, "Incoming record version does not match the expected version." " (BR_ERR_BAD_VERSION)" }, { BR_ERR_BAD_LENGTH, "Incoming record length is invalid." " (BR_ERR_BAD_LENGTH)" }, { BR_ERR_TOO_LARGE, "Incoming record is too large to be processed, or buffer" " is too small for the handshake message to send." " (BR_ERR_TOO_LARGE)" }, { BR_ERR_BAD_MAC, "Decryption found an invalid padding, or the record MAC is" " not correct." " (BR_ERR_BAD_MAC)" }, { BR_ERR_NO_RANDOM, "No initial entropy was provided, and none can be obtained" " from the OS." " (BR_ERR_NO_RANDOM)" }, { BR_ERR_UNKNOWN_TYPE, "Incoming record type is unknown." " (BR_ERR_UNKNOWN_TYPE)" }, { BR_ERR_UNEXPECTED, "Incoming record or message has wrong type with regards to" " the current engine state." " (BR_ERR_UNEXPECTED)" }, { BR_ERR_BAD_CCS, "ChangeCipherSpec message from the peer has invalid contents." " (BR_ERR_BAD_CCS)" }, { BR_ERR_BAD_ALERT, "Alert message from the peer has invalid contents" " (odd length)." " (BR_ERR_BAD_ALERT)" }, { BR_ERR_BAD_HANDSHAKE, "Incoming handshake message decoding failed." " (BR_ERR_BAD_HANDSHAKE)" }, { BR_ERR_OVERSIZED_ID, "ServerHello contains a session ID which is larger than" " 32 bytes." " (BR_ERR_OVERSIZED_ID)" }, { BR_ERR_BAD_CIPHER_SUITE, "Server wants to use a cipher suite that we did not claim" " to support. This is also reported if we tried to advertise" " a cipher suite that we do not support." " (BR_ERR_BAD_CIPHER_SUITE)" }, { BR_ERR_BAD_COMPRESSION, "Server wants to use a compression that we did not claim" " to support." " (BR_ERR_BAD_COMPRESSION)" }, { BR_ERR_BAD_FRAGLEN, "Server's max fragment length does not match client's." " (BR_ERR_BAD_FRAGLEN)" }, { BR_ERR_BAD_SECRENEG, "Secure renegotiation failed." " (BR_ERR_BAD_SECRENEG)" }, { BR_ERR_EXTRA_EXTENSION, "Server sent an extension type that we did not announce," " or used the same extension type several times in a" " single ServerHello." " (BR_ERR_EXTRA_EXTENSION)" }, { BR_ERR_BAD_SNI, "Invalid Server Name Indication contents (when used by" " the server, this extension shall be empty)." " (BR_ERR_BAD_SNI)" }, { BR_ERR_BAD_HELLO_DONE, "Invalid ServerHelloDone from the server (length is not 0)." " (BR_ERR_BAD_HELLO_DONE)" }, { BR_ERR_LIMIT_EXCEEDED, "Internal limit exceeded (e.g. server's public key is too" " large)." " (BR_ERR_LIMIT_EXCEEDED)" }, { BR_ERR_BAD_FINISHED, "Finished message from peer does not match the expected" " value." " (BR_ERR_BAD_FINISHED)" }, { BR_ERR_RESUME_MISMATCH, "Session resumption attempt with distinct version or cipher" " suite." " (BR_ERR_RESUME_MISMATCH)" }, { BR_ERR_INVALID_ALGORITHM, "Unsupported or invalid algorithm (ECDHE curve, signature" " algorithm, hash function)." " (BR_ERR_INVALID_ALGORITHM)" }, { BR_ERR_BAD_SIGNATURE, "Invalid signature on ServerKeyExchange message." " (BR_ERR_BAD_SIGNATURE)" }, { BR_ERR_IO, "I/O error or premature close on transport stream." " (BR_ERR_IO)" }, { BR_ERR_X509_INVALID_VALUE, "Invalid value in an ASN.1 structure." " (BR_ERR_X509_INVALID_VALUE)" }, { BR_ERR_X509_TRUNCATED, "Truncated certificate or other ASN.1 object." " (BR_ERR_X509_TRUNCATED)" }, { BR_ERR_X509_EMPTY_CHAIN, "Empty certificate chain (no certificate at all)." " (BR_ERR_X509_EMPTY_CHAIN)" }, { BR_ERR_X509_INNER_TRUNC, "Decoding error: inner element extends beyond outer element" " size." " (BR_ERR_X509_INNER_TRUNC)" }, { BR_ERR_X509_BAD_TAG_CLASS, "Decoding error: unsupported tag class (application or" " private)." " (BR_ERR_X509_BAD_TAG_CLASS)" }, { BR_ERR_X509_BAD_TAG_VALUE, "Decoding error: unsupported tag value." " (BR_ERR_X509_BAD_TAG_VALUE)" }, { BR_ERR_X509_INDEFINITE_LENGTH, "Decoding error: indefinite length." " (BR_ERR_X509_INDEFINITE_LENGTH)" }, { BR_ERR_X509_EXTRA_ELEMENT, "Decoding error: extraneous element." " (BR_ERR_X509_EXTRA_ELEMENT)" }, { BR_ERR_X509_UNEXPECTED, "Decoding error: unexpected element." " (BR_ERR_X509_UNEXPECTED)" }, { BR_ERR_X509_NOT_CONSTRUCTED, "Decoding error: expected constructed element, but is" " primitive." " (BR_ERR_X509_NOT_CONSTRUCTED)" }, { BR_ERR_X509_NOT_PRIMITIVE, "Decoding error: expected primitive element, but is" " constructed." " (BR_ERR_X509_NOT_PRIMITIVE)" }, { BR_ERR_X509_PARTIAL_BYTE, "Decoding error: BIT STRING length is not multiple of 8." " (BR_ERR_X509_PARTIAL_BYTE)" }, { BR_ERR_X509_BAD_BOOLEAN, "Decoding error: BOOLEAN value has invalid length." " (BR_ERR_X509_BAD_BOOLEAN)" }, { BR_ERR_X509_OVERFLOW, "Decoding error: value is off-limits." " (BR_ERR_X509_OVERFLOW)" }, { BR_ERR_X509_BAD_DN, "Invalid distinguished name." " (BR_ERR_X509_BAD_DN)" }, { BR_ERR_X509_BAD_TIME, "Invalid date/time representation." " (BR_ERR_X509_BAD_TIME)" }, { BR_ERR_X509_UNSUPPORTED, "Certificate contains unsupported features that cannot be" " ignored." " (BR_ERR_X509_UNSUPPORTED)" }, { BR_ERR_X509_LIMIT_EXCEEDED, "Key or signature size exceeds internal limits." " (BR_ERR_X509_LIMIT_EXCEEDED)" }, { BR_ERR_X509_WRONG_KEY_TYPE, "Key type does not match that which was expected." " (BR_ERR_X509_WRONG_KEY_TYPE)" }, { BR_ERR_X509_BAD_SIGNATURE, "Signature is invalid." " (BR_ERR_X509_BAD_SIGNATURE)" }, { BR_ERR_X509_TIME_UNKNOWN, "Validation time is unknown." " (BR_ERR_X509_TIME_UNKNOWN)" }, { BR_ERR_X509_EXPIRED, "Certificate is expired or not yet valid." " (BR_ERR_X509_EXPIRED)" }, { BR_ERR_X509_DN_MISMATCH, "Issuer/Subject DN mismatch in the chain." " (BR_ERR_X509_DN_MISMATCH)" }, { BR_ERR_X509_BAD_SERVER_NAME, "Expected server name was not found in the chain." " (BR_ERR_X509_BAD_SERVER_NAME)" }, { BR_ERR_X509_CRITICAL_EXTENSION, "Unknown critical extension in certificate." " (BR_ERR_X509_CRITICAL_EXTENSION)" }, { BR_ERR_X509_NOT_CA, "Not a CA, or path length constraint violation." " (BR_ERR_X509_NOT_CA)" }, { BR_ERR_X509_FORBIDDEN_KEY_USAGE, "Key Usage extension prohibits intended usage." " (BR_ERR_X509_FORBIDDEN_KEY_USAGE)" }, { BR_ERR_X509_WEAK_PUBLIC_KEY, "Public key found in certificate is too small." " (BR_ERR_X509_WEAK_PUBLIC_KEY)" }, { BR_ERR_X509_NOT_TRUSTED, "Chain could not be linked to a trust anchor." " (BR_ERR_X509_NOT_TRUSTED)" }, { -1, "Unknown BearSSL error." } } ; char const *sbearssl_error_str (int err) { struct error_s *p = errors ; while (p->err >= 0 && err != p->err) p++ ; return p->comment ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_ec_pkey_to.c0000644000000000000000000000034313061727616020060 0ustar /* ISC license. */ #include void sbearssl_ec_pkey_to (sbearssl_ec_pkey const *l, br_ec_public_key *k, char *s) { k->curve = l->curve ; k->q = (unsigned char *)s + l->q ; k->qlen = l->qlen ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_ta_to.c0000644000000000000000000000044713061730643017044 0ustar /* ISC license. */ #include void sbearssl_ta_to (sbearssl_ta const *sta, br_x509_trust_anchor *bta, char *s) { bta->dn.data = (unsigned char *)s + sta->dn ; bta->dn.len = sta->dnlen ; bta->flags = sta->flags ; sbearssl_pkey_to(&sta->pkey, &bta->pkey, s) ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_x500_from_ta.c0000644000000000000000000000064113061730762020137 0ustar /* ISC license. */ #include #include void sbearssl_x500_from_ta (br_x500_name *names, sbearssl_ta const *sta, size_t n, char *storage, char const *tastorage) { while (n--) { size_t len = sta->dnlen ; memcpy(storage, tastorage + sta->dn, len) ; sta++ ; names->data = (unsigned char *)storage ; names->len = len ; names++ ; storage += len ; } } s6-networking-2.3.1.1/src/sbearssl/sbearssl_pem_decode_from_string.c0000644000000000000000000000175713433235740022441 0ustar /* ISC license. */ #include #include #include #include #include #include #include "sbearssl-internal.h" int sbearssl_pem_decode_from_string (char const *s, size_t len, genalloc *list, stralloc *sa) { br_pem_decoder_context ctx ; sbearssl_pemobject po ; sbearssl_strallocerr blah = { .sa = sa, .err = 0 } ; size_t listbase = genalloc_len(sbearssl_pemobject, list) ; size_t sabase = sa->len ; int listwasnull = !genalloc_s(sbearssl_pemobject, list) ; int sawasnull = !sa->s ; int inobj = 0 ; int r ; br_pem_decoder_init(&ctx) ; r = sbearssl_pem_push(&ctx, s, len, &po, list, &blah, &inobj) ; if (r) goto fail ; if (!inobj) return 0 ; errno = EPROTO ; fail: if (listwasnull) genalloc_free(sbearssl_pemobject, list) ; else genalloc_setlen(sbearssl_pemobject, list, listbase) ; if (sawasnull) stralloc_free(sa) ; else sa->len = sabase ; return r ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_cert_readbigpem.c0000644000000000000000000000277213147006400021045 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include int sbearssl_cert_readbigpem (char const *fn, genalloc *certs, stralloc *sa) { char buf[BUFFER_INSIZE] ; int fd = open_readb(fn) ; buffer b = BUFFER_INIT(&buffer_read, fd, buf, BUFFER_INSIZE) ; genalloc pems = GENALLOC_ZERO ; sbearssl_pemobject *p ; size_t certsbase = genalloc_len(sbearssl_cert, certs) ; size_t sabase = sa->len ; size_t n ; size_t i = 0 ; int certswasnull = !genalloc_s(sbearssl_cert, certs) ; int sawasnull = !sa->s ; int r ; if (fd < 0) return -1 ; r = sbearssl_pem_decode_from_buffer(&b, &pems, sa) ; fd_close(fd) ; if (r) return r ; p = genalloc_s(sbearssl_pemobject, &pems) ; n = genalloc_len(sbearssl_pemobject, &pems) ; for (; i < n ; i++) { char const *name = sa->s + p[i].name ; if (!strcmp(name, "CERTIFICATE") || !strcmp(name, "X509 CERTIFICATE")) { sbearssl_cert sc = { .data = p[i].data, .datalen = p[i].datalen } ; if (!genalloc_append(sbearssl_cert, certs, &sc)) goto fail ; } } genalloc_free(sbearssl_pemobject, &pems) ; return 0 ; fail: if (certswasnull) genalloc_free(sbearssl_cert, certs) ; else genalloc_setlen(sbearssl_cert, certs, certsbase) ; if (sawasnull) stralloc_free(sa) ; else sa->len = sabase ; genalloc_free(sbearssl_pemobject, &pems) ; return r ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_ec_issuer_keytype.c0000644000000000000000000000144113061314536021463 0ustar /* ISC license. */ #include #include #include #include #include "sbearssl-internal.h" int sbearssl_ec_issuer_keytype (int *kt, br_x509_certificate const *cert) { br_x509_decoder_context ctx ; stralloc sa = STRALLOC_ZERO ; struct sbearssl_strallocerr_s blah = { .sa = &sa } ; int r = -1 ; br_x509_decoder_init(&ctx, &sbearssl_append, &blah) ; br_x509_decoder_push(&ctx, cert->data, cert->data_len) ; if (blah.err) { errno = blah.err ; goto fail ; } r = br_x509_decoder_last_error(&ctx) ; if (r) goto fail ; r = br_x509_decoder_get_signer_key_type(&ctx) ; if (!r) { r = -2 ; goto fail ; } stralloc_free(&sa) ; *kt = r ; return 0 ; fail: stralloc_free(&sa) ; return r ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_cert_to.c0000644000000000000000000000033313061727426017374 0ustar /* ISC license. */ #include void sbearssl_cert_to (sbearssl_cert const *sc, br_x509_certificate *bc, char *s) { bc->data = (unsigned char *)s + sc->data ; bc->data_len = sc->datalen ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_pkey_to.c0000644000000000000000000000074213016150463017402 0ustar /* ISC license. */ #include #include #include int sbearssl_pkey_to (sbearssl_pkey const *l, br_x509_pkey *k, char *s) { switch (l->type) { case BR_KEYTYPE_RSA : sbearssl_rsa_pkey_to(&l->data.rsa, &k->key.rsa, s) ; break ; case BR_KEYTYPE_EC : sbearssl_ec_pkey_to(&l->data.ec, &k->key.ec, s) ; break ; default : return (errno = EINVAL, 0) ; } k->key_type = l->type ; return 1 ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_pem_push.c0000644000000000000000000000214313061730037017546 0ustar /* ISC license. */ #include #include #include #include #include "sbearssl-internal.h" int sbearssl_pem_push (br_pem_decoder_context *ctx, char const *s, size_t len, sbearssl_pemobject *po, genalloc *list, sbearssl_strallocerr *blah, int *inobj) { while (len) { size_t tlen = br_pem_decoder_push(ctx, s, len) ; if (blah->err) return (errno = blah->err, -1) ; s += tlen ; len -= tlen ; switch (br_pem_decoder_event(ctx)) { case BR_PEM_BEGIN_OBJ : po->name = blah->sa->len ; if (!stralloc_cats(blah->sa, br_pem_decoder_name(ctx)) || !stralloc_0(blah->sa)) return -1 ; po->data = blah->sa->len ; br_pem_decoder_setdest(ctx, &sbearssl_append, blah) ; *inobj = 1 ; break ; case BR_PEM_END_OBJ : if (*inobj) { po->datalen = blah->sa->len - po->data ; if (!genalloc_append(sbearssl_pemobject, list, po)) return 0 ; *inobj = 0 ; } break ; case BR_PEM_ERROR : return (errno = EINVAL, -1) ; } } return 0 ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_ta_cert.c0000644000000000000000000000225413016150463017351 0ustar /* ISC license. */ #include #include #include #include #include #include "sbearssl-internal.h" int sbearssl_ta_cert (sbearssl_ta *ta, sbearssl_cert const *cert, char const *certstorage, stralloc *tastorage) { br_x509_decoder_context ctx ; sbearssl_ta tta = { .dn = tastorage->len, .flags = 0 } ; struct sbearssl_strallocerr_s blah = { .sa = tastorage } ; size_t tastoragebase = tastorage->len ; int tastoragewasnull = !tastorage->s ; br_x509_pkey *bpk ; int r = -1 ; br_x509_decoder_init(&ctx, &sbearssl_append, &blah) ; br_x509_decoder_push(&ctx, certstorage + cert->data, cert->datalen) ; if (blah.err) { errno = blah.err ; goto fail ; } bpk = br_x509_decoder_get_pkey(&ctx) ; if (!bpk) { r = br_x509_decoder_last_error(&ctx) ; goto fail ; } tta.dnlen = tastorage->len - tastoragebase ; if (br_x509_decoder_isCA(&ctx)) tta.flags |= BR_X509_TA_CA ; if (!sbearssl_pkey_from(&tta.pkey, bpk, tastorage)) goto fail ; *ta = tta ; return 0 ; fail: if (tastoragewasnull) stralloc_free(tastorage) ; else tastorage->len = tastoragebase ; return r ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_ta_from.c0000644000000000000000000000110013061730634017350 0ustar /* ISC license. */ #include #include #include int sbearssl_ta_from (sbearssl_ta *l, br_x509_trust_anchor const *k, stralloc *sa) { size_t sabase = sa->len ; int sawasnull = !sa->s ; sbearssl_ta ta = { .dn = sa->len, .dnlen = k->dn.len, .flags = k->flags } ; if (!stralloc_catb(sa, (char const *)k->dn.data, k->dn.len)) return 0 ; if (!sbearssl_pkey_from(&ta.pkey, &k->pkey, sa)) goto fail ; *l = ta ; return 1 ; fail: if (sawasnull) stralloc_free(sa) ; else sa->len = sabase ; return 0 ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_ta_readdir.c0000644000000000000000000000322013324555777020043 0ustar /* ISC license. */ #include #include #include #include #include #include #include int sbearssl_ta_readdir (char const *dirfn, genalloc *taga, stralloc *tasa) { size_t tasabase = tasa->len ; size_t tagabase = genalloc_len(sbearssl_ta, taga) ; size_t dirfnlen = strlen(dirfn) ; int tasawasnull = !tasa->s ; int tagawasnull = !genalloc_s(sbearssl_ta, taga) ; stralloc certsa = STRALLOC_ZERO ; genalloc certga = GENALLOC_ZERO ; DIR *dir = opendir(dirfn) ; if (!dir) return -1 ; for (;;) { direntry *d ; errno = 0 ; d = readdir(dir) ; if (!d) break ; if (d->d_name[0] == '.') continue ; { size_t dlen = strlen(d->d_name) ; char fn[dirfnlen + dlen + 2] ; memcpy(fn, dirfn, dirfnlen) ; fn[dirfnlen] = '/' ; memcpy(fn + dirfnlen + 1, d->d_name, dlen) ; fn[dirfnlen + 1 + dlen] = 0 ; genalloc_setlen(sbearssl_cert, &certga, 0) ; certsa.len = 0 ; if (sbearssl_cert_readfile(fn, &certga, &certsa)) continue ; } sbearssl_ta_certs(taga, tasa, genalloc_s(sbearssl_cert, &certga), genalloc_len(sbearssl_cert, &certga), certsa.s) ; } if (errno) goto fail ; dir_close(dir) ; genalloc_free(sbearssl_cert, &certga) ; stralloc_free(&certsa) ; return 0 ; fail: dir_close(dir) ; genalloc_free(sbearssl_cert, &certga) ; stralloc_free(&certsa) ; if (tagawasnull) genalloc_free(sbearssl_ta, taga) ; else genalloc_setlen(sbearssl_ta, taga, tagabase) ; if (tasawasnull) stralloc_free(tasa) ; else tasa->len = tasabase ; return -1 ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_rsa_pkey_to.c0000644000000000000000000000041113061730107020237 0ustar /* ISC license. */ #include void sbearssl_rsa_pkey_to (sbearssl_rsa_pkey const *l, br_rsa_public_key *k, char *s) { k->n = (unsigned char *)s + l->n ; k->nlen = l->nlen ; k->e = (unsigned char *)s + l->e ; k->elen = l->elen ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_rsa_skey_from.c0000644000000000000000000000143413061730145020573 0ustar /* ISC license. */ #include #include int sbearssl_rsa_skey_from (sbearssl_rsa_skey *l, br_rsa_private_key const *k, stralloc *sa) { if (!stralloc_readyplus(sa, k->plen + k->qlen + k->dplen + k->dqlen + k->iqlen)) return 0 ; l->n_bitlen = k->n_bitlen ; l->p = sa->len ; stralloc_catb(sa, (char const *)k->p, k->plen) ; l->plen = k->plen ; l->q = sa->len ; stralloc_catb(sa, (char const *)k->q, k->qlen) ; l->qlen = k->qlen ; l->dp = sa->len ; stralloc_catb(sa, (char const *)k->dp, k->dplen) ; l->dplen = k->dplen ; l->dq = sa->len ; stralloc_catb(sa, (char const *)k->dq, k->dqlen) ; l->dqlen = k->dqlen ; l->iq = sa->len ; stralloc_catb(sa, (char const *)k->iq, k->iqlen) ; l->iqlen = k->iqlen ; return 1 ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_append.c0000644000000000000000000000043413061727274017207 0ustar /* ISC license. */ #include #include #include "sbearssl-internal.h" void sbearssl_append (void *stuff, void const *src, size_t len) { sbearssl_strallocerr *blah = stuff ; blah->err = stralloc_catb(blah->sa, (char const *)src, len) ? 0 : errno ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_x509_minimal_set_tai.c0000644000000000000000000000063013061731030021642 0ustar /* ISC license. */ #include #include #include #include #include int sbearssl_x509_minimal_set_tai (br_x509_minimal_context *ctx, tai_t const *t) { uint64_t u ; if (!utc_from_tai(&u, t)) return 0 ; u -= TAI_MAGIC ; br_x509_minimal_set_time(ctx, (uint32_t)(u / 86400 + 719528), u % 86400) ; return 1 ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_x500_name_len.c0000644000000000000000000000034013061730773020264 0ustar /* ISC license. */ #include size_t sbearssl_x500_name_len (sbearssl_ta const *sta, size_t n) { size_t total = 0 ; while (n--) { total += sta->dnlen ; sta++ ; } return total ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_prep_spawn_drop.c0000644000000000000000000000217013064506664021142 0ustar /* ISC license. */ #include #include #include #include #include #include #include "sbearssl-internal.h" pid_t sbearssl_prep_spawn_drop (char const *const *argv, char const *const *envp, int *fds, uid_t uid, gid_t gid, uint32_t options) { pid_t pid ; fds[4] = selfpipe_init() ; if (fds[4] < 0) strerr_diefu1sys(111, "init selfpipe") ; if (selfpipe_trap(SIGCHLD) < 0) strerr_diefu1sys(111, "trap SIGCHLD") ; if (!(options & 1)) pid = child_spawn2(argv[0], argv, envp, fds) ; else { char const modifs[] = "CADIR\0CAFILE\0KEYFILE\0CERTFILE\0TLS_UID\0TLS_GID" ; size_t modiflen = sizeof(modifs) ; size_t n = env_len(envp) ; char const *newenv[n + 7] ; size_t newenvlen = env_merge(newenv, n+7, envp, n, modifs, modiflen) ; if (!newenvlen) return 0 ; pid = child_spawn2(argv[0], argv, newenv, fds) ; } if (!pid) strerr_diefu2sys(111, "spawn ", argv[0]) ; if (gid && setgid(gid) < 0) strerr_diefu1sys(111, "setgid") ; if (uid && setuid(uid) < 0) strerr_diefu1sys(111, "setuid") ; return pid ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl_ec_skey_to.c0000644000000000000000000000034413061727630020060 0ustar /* ISC license. */ #include void sbearssl_ec_skey_to (sbearssl_ec_skey const *l, br_ec_private_key *k, char *s) { k->curve = l->curve ; k->x = (unsigned char *)s + l->x ; k->xlen = l->xlen ; } s6-networking-2.3.1.1/src/sbearssl/sbearssl-internal.h0000644000000000000000000000132013064476606017475 0ustar /* ISC license. */ #ifndef SBEARSSL_INTERNAL_H #define SBEARSSL_INTERNAL_H #include #include #include #include #include #include typedef struct sbearssl_strallocerr_s sbearssl_strallocerr, *sbearssl_strallocerr_ref ; struct sbearssl_strallocerr_s { stralloc *sa ; int err ; } ; extern void sbearssl_append (void *, void const *, size_t) ; extern int sbearssl_pem_push (br_pem_decoder_context *, char const *, size_t, sbearssl_pemobject *, genalloc *, sbearssl_strallocerr *, int *) ; extern pid_t sbearssl_prep_spawn_drop (char const *const *, char const *const *, int *, uid_t, gid_t, uint32_t) ; #endif s6-networking-2.3.1.1/src/sbearssl/deps-lib/0000755000000000000000000000000013016150463015362 5ustar s6-networking-2.3.1.1/src/sbearssl/deps-lib/sbearssl0000644000000000000000000000153113064474240017130 0ustar sbearssl_append.o sbearssl_prep_spawn_drop.o sbearssl_cert_from.o sbearssl_cert_readbigpem.o sbearssl_cert_readfile.o sbearssl_cert_to.o sbearssl_ec_issuer_keytype.o sbearssl_ec_pkey_from.o sbearssl_ec_pkey_to.o sbearssl_ec_skey_from.o sbearssl_ec_skey_to.o sbearssl_error_str.o sbearssl_isder.o sbearssl_pem_decode_from_buffer.o sbearssl_pem_decode_from_string.o sbearssl_pem_push.o sbearssl_pkey_from.o sbearssl_pkey_to.o sbearssl_rsa_pkey_from.o sbearssl_rsa_pkey_to.o sbearssl_rsa_skey_from.o sbearssl_rsa_skey_to.o sbearssl_run.o sbearssl_skey_from.o sbearssl_skey_readfile.o sbearssl_skey_to.o sbearssl_ta_cert.o sbearssl_ta_certs.o sbearssl_ta_from.o sbearssl_ta_readdir.o sbearssl_ta_readfile.o sbearssl_ta_to.o sbearssl_x500_name_len.o sbearssl_x500_from_ta.o sbearssl_x509_minimal_set_tai.o sbearssl_s6tlsc.o sbearssl_s6tlsd.o -lbearssl -lskarnet s6-networking-2.3.1.1/src/include-local/0000755000000000000000000000000012412615566014571 5ustar s6-networking-2.3.1.1/src/conn-tools/0000755000000000000000000000000013541515353014146 5ustar s6-networking-2.3.1.1/src/conn-tools/s6-ident-client.c0000644000000000000000000000410013534450420017205 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #include #include #define USAGE "s6-ident-client [ -t timeout ] ra rp la lp" #define dieusage() strerr_dieusage(100, USAGE) int main (int argc, char const *const *argv) { tain_t deadline ; ip46_t ra, la ; uint16_t rp, lp ; PROG = "s6-ident-client" ; { unsigned int t = 0 ; subgetopt_t l = SUBGETOPT_ZERO ; for (;;) { int opt = subgetopt_r(argc, argv, "t:", &l) ; if (opt == -1) break ; switch (opt) { case 't' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; if (t) tain_from_millisecs(&deadline, t) ; else deadline = tain_infinite_relative ; } if (argc < 4) dieusage() ; if (!ip46_scan(argv[0], &ra)) strerr_dief2x(100, "invalid IP address: ", argv[0]) ; if (!uint160_scan(argv[1], &rp)) strerr_dief2x(100, "invalid port number: ", argv[1]) ; if (!ip46_scan(argv[2], &la)) strerr_dief2x(100, "invalid IP address: ", argv[2]) ; if (!uint160_scan(argv[3], &lp)) strerr_dief2x(100, "invalid port number: ", argv[3]) ; if (ip46_is6(&ra) != ip46_is6(&la)) strerr_dief1x(100, "address family mismatch") ; tain_now_set_stopwatch_g() ; tain_add_g(&deadline, &deadline) ; { char buf[BUFFER_OUTSIZE_SMALL] ; int r = s6net_ident_client_g(buf, BUFFER_OUTSIZE_SMALL, &ra, rp, &la, lp, &deadline) ; if (r < 0) strerr_diefu1sys(errno == ETIMEDOUT ? 99 : 111, "s6net_ident_client") ; else if (!r) { strerr_warnw2x("ident server replied: ", s6net_ident_error_str(errno)) ; return 1 ; } buffer_putnoflush(buffer_1small, buf, r-1) ; } buffer_putnoflush(buffer_1small, "\n", 1) ; if (!buffer_timed_flush_g(buffer_1small, &deadline)) strerr_diefu1sys(111, "write to stdout") ; return 0 ; } s6-networking-2.3.1.1/src/conn-tools/s6-tcpserver4-socketbinder.c0000644000000000000000000000343213263421425021412 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #define USAGE "s6-tcpserver4-socketbinder [ -d | -D ] [ -b backlog ] [ -M | -m ] [ -B ] ip4 port prog..." #define dieusage() strerr_dieusage(100, USAGE) int main (int argc, char const *const *argv, char const *const *envp) { unsigned int backlog = SOMAXCONN ; int flagreuse = 1 ; int flagudp = 0 ; int flagblocking = 0 ; char ip[4] ; uint16_t port ; PROG = "s6-tcpserver4-socketbinder" ; { subgetopt_t l = SUBGETOPT_ZERO ; for (;;) { int opt = subgetopt_r(argc, argv, "DdMmBb:", &l) ; if (opt == -1) break ; switch (opt) { case 'D' : flagreuse = 0 ; break ; case 'd' : flagreuse = 1 ; break ; case 'M' : flagudp = 0 ; break ; case 'm' : flagudp = 1 ; break ; case 'B' : flagblocking = 1 ; break ; case 'b' : if (!uint0_scan(l.arg, &backlog)) dieusage() ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; } if (argc < 3) dieusage() ; if (!ip4_scan(argv[0], ip) || !uint160_scan(argv[1], &port)) dieusage() ; close(0) ; if (flagudp ? socket_udp4_internal(flagblocking ? 0 : DJBUNIX_FLAG_NB) : socket_tcp4_internal(flagblocking ? 0 : DJBUNIX_FLAG_NB)) strerr_diefu1sys(111, "create socket") ; if ((flagreuse ? socket_bind4_reuse(0, ip, port) : socket_bind4(0, ip, port)) < 0) strerr_diefu5sys(111, "bind to ", argv[0], ":", argv[1], " ") ; if (backlog && socket_listen(0, backlog) < 0) strerr_diefu5sys(111, "listen to ", argv[0], ":", argv[1], " ") ; xpathexec_run(argv[2], argv + 2, envp) ; } s6-networking-2.3.1.1/src/conn-tools/s6-tlsserver.c0000644000000000000000000001710413146777600016702 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #define USAGE "s6-tlsserver [ options ] ip port prog...\n" \ "s6-tcpserver options: [ -q | -Q | -v ] [ -4 | -6 ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gidlist ] [ -g gid ] [ -u uid ] [ -U ]\n" \ "s6-tcpserver-access options: [ -W | -w ] [ -D | -d ] [ -H | -h ] [ -R | -r ] [ -P | -p ] [ -l localname ] [ -B banner ] [ -t timeout ] [ -i rulesdir | -x rulesfile ]\n" \ "s6-tlsd options: [ -S | -s ] [ -Y | -y ] [ -K timeout ] [ -Z | -z ]" #define dieusage() strerr_dieusage(100, USAGE) typedef struct options_s options_t, *options_t_ref ; struct options_s { char const *localname ; char const *banner ; char const *rules ; gid_t gids[NGROUPS_MAX] ; size_t gidn ; uid_t uid ; gid_t gid ; unsigned int maxconn ; unsigned int localmaxconn ; unsigned int backlog ; unsigned int timeout ; unsigned int kimeout ; unsigned int verbosity : 2 ; unsigned int flag46 : 2 ; unsigned int flag1 : 1 ; unsigned int flagU : 1 ; unsigned int flagw : 1 ; unsigned int flagD : 1 ; unsigned int flagH : 1 ; unsigned int flagr : 1 ; unsigned int flagp : 1 ; unsigned int ruleswhat : 2 ; unsigned int flagS : 1 ; unsigned int flagy : 1 ; unsigned int flagZ : 1 ; unsigned int doaccess : 1 ; unsigned int doapply : 1 ; } ; #define OPTIONS_ZERO \ { \ .localname = 0, \ .banner = 0, \ .rules = 0, \ .backlog = (unsigned int)-1, \ .gidn = (size_t)-1, \ .uid = 0, \ .gid = 0, \ .maxconn = 0, \ .localmaxconn = 0, \ .timeout = 0, \ .kimeout = 0, \ .verbosity = 1, \ .flag46 = 0, \ .flag1 = 0, \ .flagU = 0, \ .flagw = 0, \ .flagD = 0, \ .flagH = 0, \ .flagr = 0, \ .flagp = 0, \ .ruleswhat = 0, \ .flagS = 0, \ .flagy = 0, \ .flagZ = 0, \ .doaccess = 0, \ .doapply = 0 \ } int main (int argc, char const *const *argv, char const *const *envp) { options_t o = OPTIONS_ZERO ; PROG = "s6-tlsserver" ; { subgetopt_t l = SUBGETOPT_ZERO ; for (;;) { int opt = subgetopt_r(argc, argv, "qQv461c:C:b:G:g:u:UWwDdHhRrPpl:B:t:i:x:SsYyK:Zz", &l) ; if (opt == -1) break ; switch (opt) { case 'q' : o.verbosity = 0 ; break ; case 'Q' : o.verbosity = 1 ; break ; case 'v' : o.verbosity = 2 ; break ; case '4' : o.flag46 = 1 ; break ; case '6' : o.flag46 = 2 ; break ; case '1' : o.flag1 = 1 ; break ; case 'c' : if (!uint0_scan(l.arg, &o.maxconn)) dieusage() ; if (!o.maxconn) o.maxconn = 1 ; break ; case 'C' : if (!uint0_scan(l.arg, &o.localmaxconn)) dieusage() ; if (!o.localmaxconn) o.localmaxconn = 1 ; break ; case 'b' : if (!uint0_scan(l.arg, &o.backlog)) dieusage() ; break ; case 'G' : if (!gid_scanlist(o.gids, NGROUPS_MAX, l.arg, &o.gidn) && *l.arg) dieusage() ; o.doapply = 1 ; break ; case 'g' : if (!gid0_scan(l.arg, &o.gid)) dieusage() ; o.doapply = 1 ; break ; case 'u' : if (!uid0_scan(l.arg, &o.uid)) dieusage() ; o.doapply = 1 ; break ; case 'U' : o.flagU = 1 ; o.uid = 0 ; o.gid = 0 ; o.gidn = (size_t)-1 ; o.doapply = 1 ; break ; case 'W' : o.flagw = 0 ; break ; case 'w' : o.flagw = 1 ; break ; case 'D' : o.flagD = 1 ; o.doaccess = 1 ; break ; case 'd' : o.flagD = 0 ; break ; case 'H' : o.flagH = 1 ; o.doaccess = 1 ; break ; case 'h' : o.flagH = 0 ; break ; case 'R' : o.flagr = 0 ; break ; case 'r' : o.flagr = 1 ; o.doaccess = 1 ; break ; case 'P' : o.flagp = 0 ; break ; case 'p' : o.flagp = 1 ; o.doaccess = 1 ; break ; case 'l' : o.localname = l.arg ; o.doaccess = 1 ; break ; case 'B' : o.banner = l.arg ; o.doaccess = 1 ; break ; case 't' : if (!uint0_scan(l.arg, &o.timeout)) dieusage() ; break ; case 'i' : o.rules = l.arg ; o.ruleswhat = 1 ; o.doaccess = 1 ; break ; case 'x' : o.rules = l.arg ; o.ruleswhat = 2 ; o.doaccess = 1 ; break ; case 'S' : o.flagS = 1 ; break ; case 's' : o.flagS = 0 ; break ; case 'Y' : o.flagy = 0 ; break ; case 'y' : o.flagy = 1 ; break ; case 'K' : if (!uint0_scan(l.arg, &o.kimeout)) dieusage() ; break ; case 'Z' : o.flagZ = 1 ; break ; case 'z' : o.flagZ = 0 ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; if (argc < 3) dieusage() ; } { size_t pos = 0 ; unsigned int m = 0 ; char fmt[UINT_FMT * 5 + UID_FMT + GID_FMT * (NGROUPS_MAX + 1)] ; char const *newargv[45 + argc] ; newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpserver" ; if (o.verbosity != 1) newargv[m++] = o.verbosity ? "-v" : "-q" ; if (o.flag46) newargv[m++] = o.flag46 == 1 ? "-4" : "-6" ; if (o.flag1) newargv[m++] = "-1" ; if (o.maxconn) { newargv[m++] = "-c" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, o.maxconn) ; fmt[pos++] = 0 ; } if (o.localmaxconn) { newargv[m++] = "-C" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, o.localmaxconn) ; fmt[pos++] = 0 ; } if (o.backlog != (unsigned int)-1) { newargv[m++] = "-b" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, o.backlog) ; fmt[pos++] = 0 ; } newargv[m++] = "--" ; newargv[m++] = *argv++ ; newargv[m++] = *argv++ ; if (o.doaccess) { newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpserver-access" ; if (o.verbosity != 1) newargv[m++] = o.verbosity ? "-v2" : "-v0" ; if (o.flagw) newargv[m++] = "-w" ; if (o.flagD) newargv[m++] = "-D" ; if (o.flagH) newargv[m++] = "-H" ; if (o.flagr) newargv[m++] = "-r" ; if (o.flagp) newargv[m++] = "-p" ; if (o.localname) { newargv[m++] = "-l" ; newargv[m++] = o.localname ; } if (o.banner) { newargv[m++] = "-B" ; newargv[m++] = o.banner ; } if (o.timeout) { newargv[m++] = "-t" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, o.timeout) ; fmt[pos++] = 0 ; } if (o.ruleswhat) { newargv[m++] = o.ruleswhat == 1 ? "-i" : "-x" ; newargv[m++] = o.rules ; } newargv[m++] = "--" ; } newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tlsd" ; if (o.verbosity != 1) newargv[m++] = o.verbosity ? "-v2" : "-v0" ; if (o.flagS) newargv[m++] = "-S" ; if (o.flagy) newargv[m++] = "-y" ; if (o.kimeout) { newargv[m++] = "-K" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, o.kimeout) ; fmt[pos++] = 0 ; } if (o.flagZ) newargv[m++] = "-Z" ; newargv[m++] = "--" ; if (o.doapply) { newargv[m++] = S6_EXTBINPREFIX "s6-applyuidgid" ; if (o.gidn != (size_t)-1) { newargv[m++] = "-G" ; newargv[m++] = fmt + pos ; pos += gid_fmtlist(fmt + pos, o.gids, o.gidn) ; fmt[pos++] = 0 ; } if (o.gid) { newargv[m++] = "-g" ; newargv[m++] = fmt + pos ; pos += gid_fmt(fmt + pos, o.gid) ; fmt[pos++] = 0 ; } if (o.uid) { newargv[m++] = "-u" ; newargv[m++] = fmt + pos ; pos += uid_fmt(fmt + pos, o.uid) ; fmt[pos++] = 0 ; } if (o.flagU) newargv[m++] = "-Uz" ; newargv[m++] = "--" ; } while (*argv) newargv[m++] = *argv++ ; newargv[m++] = 0 ; xpathexec_run(newargv[0], newargv, envp) ; } } s6-networking-2.3.1.1/src/conn-tools/s6-tcpserver-access.c0000644000000000000000000003072413534450441020120 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #define USAGE "s6-tcpserver-access [ -v verbosity ] [ -W | -w ] [ -D | -d ] [ -H | -h ] [ -R | -r ] [ -P | -p ] [ -l localname ] [ -B banner ] [ -t timeout ] [ -i rulesdir | -x rulesfile ] prog..." #define dieusage() strerr_dieusage(100, USAGE) #define dienomem() strerr_diefu1sys(111, "update environment") #define X() strerr_dief1x(101, "internal inconsistency. Please submit a bug-report.") static void logit (pid_t pid, ip46_t const *ip, int h) { char fmtpid[PID_FMT] ; char fmtip[IP46_FMT] ; fmtip[ip46_fmt(fmtip, ip)] = 0 ; fmtpid[pid_fmt(fmtpid, pid)] = 0 ; if (h) strerr_warni5x("allow", " pid ", fmtpid, " ip ", fmtip) ; else strerr_warni5sys("deny", " pid ", fmtpid, " ip ", fmtip) ; } static inline void log_accept (pid_t pid, ip46_t const *ip) { logit(pid, ip, 1) ; } static inline void log_deny (pid_t pid, ip46_t const *ip) { logit(pid, ip, 0) ; } int main (int argc, char const *const *argv, char const *const *envp) { s6_accessrules_params_t params = S6_ACCESSRULES_PARAMS_ZERO ; stralloc modifs = STRALLOC_ZERO ; tain_t deadline, tto ; char const *rulestypestr[3] = { "no", "fs", "cdb" } ; char const *rules = 0 ; char const *localname = 0 ; char const *proto ; struct cdb c = CDB_ZERO ; int cdbfd = -1 ; unsigned int rulestype = 0 ; unsigned int verbosity = 1 ; size_t protolen ; s6_accessrules_result_t accepted ; ip46_t remoteip, localip ; int flagfatal = 1, flagnodelay = 0, flagdnslookup = 1, flagident = 0, flagparanoid = 0, e = 0 ; uint16_t remoteport, localport ; PROG = "s6-tcpserver-access" ; { unsigned int timeout = 0 ; subgetopt_t l = SUBGETOPT_ZERO ; for (;;) { int opt = subgetopt_r(argc, argv, "WwDdHhRrPpv:l:B:t:i:x:", &l) ; if (opt == -1) break ; switch (opt) { case 'W' : flagfatal = 0 ; break ; case 'w' : flagfatal = 1 ; break ; case 'D' : flagnodelay = 1 ; break ; case 'd' : flagnodelay = 0 ; break ; case 'H' : flagdnslookup = 0 ; break ; case 'h' : flagdnslookup = 1 ; break ; case 'R' : flagident = 0 ; break ; case 'r' : flagident = 1 ; break ; case 'P' : flagparanoid = 0 ; break ; case 'p' : flagparanoid = 1 ; break ; case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ; case 'l' : localname = l.arg ; break ; case 'B' : { size_t n = strlen(l.arg) ; if (buffer_putnoflush(buffer_1small, l.arg, n) < (ssize_t)n) strerr_dief1x(100, "banner too long") ; break ; } case 't' : if (!uint0_scan(l.arg, &timeout)) dieusage() ; break ; case 'i' : rules = l.arg ; rulestype = 1 ; break ; case 'x' : rules = l.arg ; rulestype = 2 ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; if (timeout) tain_from_millisecs(&tto, timeout) ; else tto = tain_infinite_relative ; } if (!argc) dieusage() ; if (!*argv[0]) dieusage() ; proto = env_get2(envp, "PROTO") ; if (!proto) strerr_dienotset(100, "PROTO") ; protolen = strlen(proto) ; { char const *x ; char tmp[protolen + 11] ; memcpy(tmp, proto, protolen) ; memcpy(tmp + protolen, "REMOTEIP", 9) ; x = env_get2(envp, tmp) ; if (!x) strerr_dienotset(100, tmp) ; if (!ip46_scan(x, &remoteip)) strerr_dieinvalid(100, tmp) ; memcpy(tmp + protolen + 6, "PORT", 5) ; x = env_get2(envp, tmp) ; if (!x) strerr_dienotset(100, tmp) ; if (!uint160_scan(x, &remoteport)) strerr_dieinvalid(100, tmp) ; } if (flagnodelay) { if (socket_tcpnodelay(1) < 0) if (verbosity) strerr_warnwu1sys("socket_tcpnodelay") ; } tain_now_set_stopwatch_g() ; tain_add_g(&deadline, &tto) ; if (!buffer_timed_flush_g(buffer_1small, &deadline)) strerr_diefu1sys(111, "write banner") ; switch (rulestype) { case 0 : if (verbosity >= 2) strerr_warnw1x("invoked without a ruleset!") ; accepted = S6_ACCESSRULES_ALLOW ; break ; case 1 : accepted = s6_accessrules_ip46_fs(&remoteip, (void *)rules, ¶ms) ; break ; case 2 : cdbfd = open_readb(rules) ; if (cdbfd < 0) strerr_diefu2sys(111, "open_readb ", rules) ; if (cdb_init(&c, cdbfd) < 0) strerr_diefu2sys(111, "cdb_init ", rules) ; accepted = s6_accessrules_ip46_cdb(&remoteip, &c, ¶ms) ; if (accepted == S6_ACCESSRULES_ALLOW) { cdb_free(&c) ; fd_close(cdbfd) ; } break ; default : X() ; } switch (accepted) { case S6_ACCESSRULES_ERROR : strerr_diefu6sys(111, "check ", rulestypestr[rulestype], " ruleset for ", "IP", " in ", rules) ; case S6_ACCESSRULES_ALLOW : break ; case S6_ACCESSRULES_DENY : if (verbosity >= 2) { errno = EACCES ; log_deny(getpid(), &remoteip) ; } return 1 ; case S6_ACCESSRULES_NOTFOUND : if (flagdnslookup) break ; if (verbosity >= 2) { errno = ENOENT ; log_deny(getpid(), &remoteip) ; } return 1 ; default: X() ; } { char const *x = 0 ; char idbuf[S6NET_IDENT_ID_SIZE] ; char fmt[IP46_FMT] ; char tmp[protolen + 11] ; if (socket_local46(0, &localip, &localport) < 0) strerr_diefu1sys(111, "socket_local") ; fmt[ip46_fmt(fmt, &localip)] = 0 ; memcpy(tmp, proto, protolen) ; memcpy(tmp + protolen, "LOCALIP", 8) ; if (!env_addmodif(&modifs, tmp, fmt)) dienomem() ; fmt[uint16_fmt(fmt, localport)] = 0 ; memcpy(tmp + protolen + 5, "PORT", 5) ; if (!env_addmodif(&modifs, tmp, fmt)) dienomem() ; memcpy(tmp + protolen, "REMOTEINFO", 11) ; if (flagident) { ssize_t r = s6net_ident_client_g(idbuf, S6NET_IDENT_ID_SIZE, &remoteip, remoteport, &localip, localport, &deadline) ; if (r < 0) { if (verbosity >= 3) strerr_warnwu1sys("s6net_ident_client") ; if (flagfatal) { e = errno == ETIMEDOUT ? 99 : 111 ; goto reject ; } } else if (!r) { if (verbosity >= 3) strerr_warnw2x("ident server replied: ", s6net_ident_error_str(errno)) ; if (flagfatal) { e = 2 ; goto reject ; } } else x = idbuf ; } if (!env_addmodif(&modifs, tmp, x)) dienomem() ; } if (!flagdnslookup) { char tmp[protolen + 11] ; memcpy(tmp, proto, protolen) ; memcpy(tmp + protolen, "LOCALHOST", 10) ; if (!env_addmodif(&modifs, tmp, localname)) dienomem() ; memcpy(tmp + protolen, "REMOTEHOST", 11) ; if (!env_addmodif(&modifs, tmp, 0)) dienomem() ; } else { tain_t infinite ; s6dns_dpag_t data[2] = { S6DNS_DPAG_ZERO, S6DNS_DPAG_ZERO } ; s6dns_resolve_t blob[2] ; char remotebuf[256] ; unsigned int remotelen = 0 ; char tcplocalhost[(protolen << 1) + 21] ; char *tcpremotehost = tcplocalhost + protolen + 10 ; memcpy(tcplocalhost, proto, protolen) ; memcpy(tcplocalhost + protolen, "LOCALHOST", 10) ; memcpy(tcpremotehost, proto, protolen) ; memcpy(tcpremotehost + protolen, "REMOTEHOST", 11) ; tain_add_g(&infinite, &tain_infinite_relative) ; if (!s6dns_init()) { if (verbosity >= 2) strerr_warnwu1sys("init DNS") ; if (flagfatal) { e = 111 ; goto reject ; } } if (localname) { if (!env_addmodif(&modifs, tcplocalhost, localname)) dienomem() ; } else { s6dns_domain_arpafromip46(&blob[0].q, &localip) ; s6dns_domain_encode(&blob[0].q) ; blob[0].qtype = S6DNS_T_PTR ; blob[0].deadline = deadline ; blob[0].parsefunc = &s6dns_message_parse_answer_domain ; blob[0].data = &data[0] ; blob[0].options = S6DNS_O_RECURSIVE ; data[0].rtype = S6DNS_T_PTR ; } s6dns_domain_arpafromip46(&blob[1].q, &remoteip) ; s6dns_domain_encode(&blob[1].q) ; blob[1].qtype = S6DNS_T_PTR ; blob[1].deadline = deadline ; blob[1].parsefunc = &s6dns_message_parse_answer_domain ; blob[1].data = &data[1] ; blob[1].options = S6DNS_O_RECURSIVE ; data[1].rtype = S6DNS_T_PTR ; if (!s6dns_resolven_parse_g(blob + !!localname, 1 + !localname, &infinite)) { if (verbosity >= 3) strerr_warnwu2x("resolve IP addresses: ", s6dns_constants_error_str(errno)) ; if (flagfatal) { e = 111 ; goto reject ; } } else { if (!localname) { if (blob[0].status) { if (!env_addmodif(&modifs, tcplocalhost, 0)) dienomem() ; } else { char s[256] ; unsigned int len = 0 ; if (genalloc_len(s6dns_domain_t, &data[0].ds)) { s6dns_domain_noqualify(genalloc_s(s6dns_domain_t, &data[0].ds)) ; len = s6dns_domain_tostring(s, 255, genalloc_s(s6dns_domain_t, &data[0].ds)) ; } genalloc_free(s6dns_domain_t, &data[0].ds) ; s[len] = 0 ; if (!env_addmodif(&modifs, tcplocalhost, s)) dienomem() ; } } if (!blob[1].status) { if (genalloc_len(s6dns_domain_t, &data[1].ds)) { s6dns_domain_noqualify(genalloc_s(s6dns_domain_t, &data[1].ds)) ; remotelen = s6dns_domain_tostring(remotebuf, 255, genalloc_s(s6dns_domain_t, &data[1].ds)) ; } remotebuf[remotelen] = 0 ; if (flagparanoid) { int r ; data[1].ds.len = 0 ; r = ip46_is6(&remoteip) ? s6dns_resolve_aaaa_g(&data[1].ds, remotebuf, remotelen, 0, &deadline) : s6dns_resolve_a_g(&data[1].ds, remotebuf, remotelen, 0, &deadline) ; if (r <= 0) { if (verbosity >= 3) strerr_warnwu4x("(paranoidly) resolve ", remotebuf, ": ", s6dns_constants_error_str(errno)) ; if (flagfatal) { e = errno == ETIMEDOUT ? 99 : 111 ; goto reject ; } remotelen = 0 ; } else { size_t i = 0 ; for (; i < data[1].ds.len ; i += ip46_is6(&remoteip) ? 16 : 4) if (!memcmp(remoteip.ip, data[1].ds.s + i, ip46_is6(&remoteip) ? 16 : 4)) break ; if (i >= data[1].ds.len) remotelen = 0 ; } } stralloc_free(&data[1].ds) ; } } if (!env_addmodif(&modifs, tcpremotehost, remotelen ? remotebuf : 0)) dienomem() ; if (remotelen && (accepted == S6_ACCESSRULES_NOTFOUND)) { switch (rulestype) { case 1 : accepted = s6_accessrules_reversedns_fs(remotebuf, (void *)rules, ¶ms) ; break ; case 2 : accepted = s6_accessrules_reversedns_cdb(remotebuf, &c, ¶ms) ; break ; default : X() ; } } if ((rulestype == 2) && (accepted != S6_ACCESSRULES_ALLOW)) { cdb_free(&c) ; fd_close(cdbfd) ; } switch (accepted) { case S6_ACCESSRULES_ERROR : strerr_diefu6sys(111, "check ", rulestypestr[rulestype], " ruleset for ", "reverse DNS", " in ", rules) ; case S6_ACCESSRULES_ALLOW : break ; case S6_ACCESSRULES_DENY : if (verbosity >= 2) { errno = EACCES ; log_deny(getpid(), &remoteip) ; } return 1 ; case S6_ACCESSRULES_NOTFOUND : if (verbosity >= 2) { errno = ENOENT ; log_deny(getpid(), &remoteip) ; } return 1 ; default : X() ; } } if (!stralloc_catb(¶ms.env, modifs.s, modifs.len)) dienomem() ; stralloc_free(&modifs) ; if (verbosity) log_accept(getpid(), &remoteip) ; if (params.exec.len) { char *specialargv[4] = { EXECLINE_EXTBINPREFIX "execlineb", "-c", params.exec.s, 0 } ; xpathexec_r((char const *const *)specialargv, envp, env_len(envp), params.env.s, params.env.len) ; } xpathexec_r(argv, envp, env_len(envp), params.env.s, params.env.len) ; reject: if (verbosity >= 2) { char fmtpid[PID_FMT] ; char fmtip[IP46_FMT] ; fmtip[ip46_fmt(fmtip, &remoteip)] = 0 ; fmtpid[pid_fmt(fmtpid, getpid())] = 0 ; strerr_dief5x(e, "reject", " pid ", fmtpid, " ip ", fmtip) ; } else return e ; } s6-networking-2.3.1.1/src/conn-tools/s6-tcpserver6-socketbinder.c0000644000000000000000000000343313263422003021406 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #define USAGE "s6-tcpserver6-socketbinder [ -d | -D ] [ -b backlog ] [ -M | -m ] [ -B ] ip6 port prog..." #define dieusage() strerr_dieusage(100, USAGE) int main (int argc, char const *const *argv, char const *const *envp) { unsigned int backlog = SOMAXCONN ; int flagreuse = 1 ; int flagudp = 0 ; int flagblocking = 0 ; char ip[16] ; uint16_t port ; PROG = "s6-tcpserver6-socketbinder" ; { subgetopt_t l = SUBGETOPT_ZERO ; for (;;) { int opt = subgetopt_r(argc, argv, "DdMmBb:", &l) ; if (opt == -1) break ; switch (opt) { case 'D' : flagreuse = 0 ; break ; case 'd' : flagreuse = 1 ; break ; case 'M' : flagudp = 0 ; break ; case 'm' : flagudp = 1 ; break ; case 'B' : flagblocking = 1 ; break ; case 'b' : if (!uint0_scan(l.arg, &backlog)) dieusage() ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; } if (argc < 3) dieusage() ; if (!ip6_scan(argv[0], ip) || !uint160_scan(argv[1], &port)) dieusage() ; close(0) ; if (flagudp ? socket_udp6_internal(flagblocking ? 0 : DJBUNIX_FLAG_NB) : socket_tcp6_internal(flagblocking ? 0 : DJBUNIX_FLAG_NB)) strerr_diefu1sys(111, "create socket") ; if ((flagreuse ? socket_bind6_reuse(0, ip, port) : socket_bind6(0, ip, port)) < 0) strerr_diefu5sys(111, "bind to ", argv[0], ":", argv[1], " ") ; if (backlog && socket_listen(0, backlog) < 0) strerr_diefu5sys(111, "listen to ", argv[0], ":", argv[1], " ") ; xpathexec_run(argv[2], argv + 2, envp) ; } s6-networking-2.3.1.1/src/conn-tools/s6-tcpserver4.c0000644000000000000000000000757513146777447016776 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #define USAGE "s6-tcpserver4 [ -v verbosity ] [ -d | -D ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gid,gid,... ] [ -g gid ] [ -u uid ] [ -U ] ip port prog..." #define dieusage() strerr_dieusage(100, USAGE) int main (int argc, char const *const *argv, char const *const *envp) { unsigned int verbosity = 1 ; int flag1 = 0 ; int flagU = 0 ; int flagreuse = 1 ; uid_t uid = 0 ; gid_t gid = 0 ; gid_t gids[NGROUPS_MAX] ; size_t gidn = (size_t)-1 ; unsigned int maxconn = 0 ; unsigned int localmaxconn = 0 ; unsigned int backlog = (unsigned int)-1 ; PROG = "s6-tcpserver4" ; { subgetopt_t l = SUBGETOPT_ZERO ; for (;;) { int opt = subgetopt_r(argc, argv, "Dd1Uv:c:C:b:u:g:G:", &l) ; if (opt == -1) break ; switch (opt) { case 'D' : flagreuse = 0 ; break ; case 'd' : flagreuse = 1 ; break ; case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ; case 'c' : if (!uint0_scan(l.arg, &maxconn)) dieusage() ; if (!maxconn) maxconn = 1 ; break ; case 'C' : if (!uint0_scan(l.arg, &localmaxconn)) dieusage() ; if (!localmaxconn) localmaxconn = 1 ; break ; case 'b' : if (!uint0_scan(l.arg, &backlog)) dieusage() ; break ; case 'u' : if (!uid0_scan(l.arg, &uid)) dieusage() ; break ; case 'g' : if (!gid0_scan(l.arg, &gid)) dieusage() ; break ; case 'G' : if (!gid_scanlist(gids, NGROUPS_MAX, l.arg, &gidn) && *l.arg) dieusage() ; break ; case '1' : flag1 = 1 ; break ; case 'U' : flagU = 1 ; uid = 0 ; gid = 0 ; gidn = (size_t)-1 ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; if (argc < 3) dieusage() ; } { size_t pos = 0 ; unsigned int m = 0 ; char fmt[UINT_FMT * 4 + UID_FMT + GID_FMT * (NGROUPS_MAX + 1)] ; char const *newargv[24 + argc] ; newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpserver4-socketbinder" ; if (!flagreuse) newargv[m++] = "-D" ; if (backlog != (unsigned int)-1) { if (!backlog) backlog = 1 ; newargv[m++] = "-b" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, backlog) ; fmt[pos++] = 0 ; } newargv[m++] = "--" ; newargv[m++] = *argv++ ; newargv[m++] = *argv++ ; if (flagU || uid || gid || gidn != (size_t)-1) { newargv[m++] = S6_EXTBINPREFIX "s6-applyuidgid" ; if (flagU) newargv[m++] = "-Uz" ; if (uid) { newargv[m++] = "-u" ; newargv[m++] = fmt + pos ; pos += uid_fmt(fmt + pos, uid) ; fmt[pos++] = 0 ; } if (gid) { newargv[m++] = "-g" ; newargv[m++] = fmt + pos ; pos += gid_fmt(fmt + pos, gid) ; fmt[pos++] = 0 ; } if (gidn != (size_t)-1) { newargv[m++] = "-G" ; newargv[m++] = fmt + pos ; pos += gid_fmtlist(fmt + pos, gids, gidn) ; fmt[pos++] = 0 ; } newargv[m++] = "--" ; } newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpserver4d" ; if (verbosity != 1) { newargv[m++] = "-v" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, verbosity) ; fmt[pos++] = 0 ; } if (flag1) newargv[m++] = "-1" ; if (maxconn) { newargv[m++] = "-c" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, maxconn) ; fmt[pos++] = 0 ; } if (localmaxconn) { newargv[m++] = "-C" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, localmaxconn) ; fmt[pos++] = 0 ; } newargv[m++] = "--" ; while (*argv) newargv[m++] = *argv++ ; newargv[m++] = 0 ; xpathexec_run(newargv[0], newargv, envp) ; } } s6-networking-2.3.1.1/src/conn-tools/s6-getservbyname.c0000644000000000000000000000141613061237566017521 0ustar /* ISC license. */ #include #include #include #include #include #define USAGE "s6-getservbyname service proto" int main (int argc, char const *const *argv) { char fmt[UINT16_FMT] ; uint16_t port ; PROG = "s6-getservbyname" ; if (argc < 3) strerr_dieusage(100, USAGE) ; if (!uint160_scan(argv[1], &port)) { struct servent *se = getservbyname(argv[1], argv[2]) ; uint16_t tmpport ; if (!se) return 1 ; tmpport = (uint16_t)se->s_port ; uint16_unpack_big((char const *)&tmpport, &port) ; } if ((buffer_put(buffer_1small, fmt, uint16_fmt(fmt, port)) < 0) || (buffer_putflush(buffer_1small, "\n", 1) < 1)) strerr_diefu1sys(111, "write to stdout") ; return 0 ; } s6-networking-2.3.1.1/src/conn-tools/s6-tlsd.c0000644000000000000000000000406713534450530015612 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #ifdef S6_NETWORKING_USE_TLS #include #define s6tlsd stls_s6tlsd #else #ifdef S6_NETWORKING_USE_BEARSSL #include #define s6tlsd sbearssl_s6tlsd #else #error No SSL backend configured. #endif #endif #define USAGE "s6-tlsd [ -S | -s ] [ -Y | -y ] [ -v verbosity ] [ -K timeout ] [ -Z | -z ] prog..." #define dieusage() strerr_dieusage(100, USAGE) int main (int argc, char const *const *argv, char const *const *envp) { tain_t tto ; unsigned int verbosity = 1 ; uid_t uid = 0 ; gid_t gid = 0 ; uint32_t preoptions = 2 ; uint32_t options = 1 ; PROG = "s6-tlsd" ; { subgetopt_t l = SUBGETOPT_ZERO ; unsigned int t = 0 ; for (;;) { int opt = subgetopt_r(argc, argv, "SsYyv:K:Zz", &l) ; if (opt == -1) break ; switch (opt) { case 'S' : options &= ~(uint32_t)1 ; break ; case 's' : options |= 1 ; break ; case 'Y' : preoptions |= 1 ; preoptions &= ~(uint32_t)4 ; break ; case 'y' : preoptions |= 5 ; break ; case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ; case 'K' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ; case 'Z' : preoptions &= ~(uint32_t)2 ; break ; case 'z' : preoptions |= 2 ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; if (t) tain_from_millisecs(&tto, t) ; else tto = tain_infinite_relative ; } if (!argc) dieusage() ; if (!getuid()) { char const *x = env_get2(envp, "TLS_UID") ; if (x && !uid0_scan(x, &uid)) strerr_dieinvalid(100, "TLS_UID") ; x = env_get2(envp, "TLS_GID") ; if (x && !gid0_scan(x, &gid)) strerr_dieinvalid(100, "TLS_GID") ; } tain_now_set_stopwatch_g() ; return s6tlsd(argv, envp, &tto, preoptions, options, uid, gid, verbosity) ; } s6-networking-2.3.1.1/src/conn-tools/s6-tcpclient.c0000644000000000000000000003105513534450471016632 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef SKALIBS_IPV6_ENABLED # define USAGE "s6-tcpclient [ -q | -Q | -v ] [ -4 | -6 ] [ -d | -D ] [ -r | -R ] [ -h | -H ] [ -n | -N ] [ -t timeoutinfo ] [ -l localname ] [ -T timeoutconn ] [ -i localip ] [ -p localport ] host port prog..." # define TFLAGS_DEFAULT { 0, 0, { 2, 58 }, IP46_ZERO, 0, 1, 0, 0, 1, 0, 1, 1 } # define OPTSTRING "qQv46dDrRhHnNt:l:T:i:p:" #else # define USAGE "s6-tcpclient [ -q | -Q | -v ] [ -d | -D ] [ -r | -R ] [ -h | -H ] [ -n | -N ] [ -t timeoutinfo ] [ -l localname ] [ -T timeoutconn ] [ -i localip ] [ -p localport ] host port prog..." # define TFLAGS_DEFAULT { 0, 0, { 2, 58 }, IP46_ZERO, 0, 1, 1, 0, 1, 1 } # define OPTSTRING "qQvdDrRhHnNt:l:T:i:p:" #endif #define usage() strerr_dieusage(100, USAGE) #define dienomem() strerr_diefu1sys(111, "allocate") #define MAXIP 16 typedef struct tflags_s tflags, *tflags_ref ; struct tflags_s { char const *localname ; unsigned int timeout ; unsigned int timeoutconn[2] ; ip46_t localip ; uint16_t localport ; unsigned int verbosity : 2 ; #ifdef SKALIBS_IPV6_ENABLED unsigned int ip4 : 1 ; unsigned int ip6 : 1 ; #endif unsigned int delay : 1 ; unsigned int remoteinfo : 1 ; unsigned int remotehost : 1 ; unsigned int qualif : 1 ; } ; static tain_t deadline ; int main (int argc, char const *const *argv) { int s ; int localip = 0; tflags flags = TFLAGS_DEFAULT ; uint16_t remoteport ; PROG = "s6-tcpclient" ; { subgetopt_t l = SUBGETOPT_ZERO ; for (;;) { int opt = subgetopt_r(argc, argv, OPTSTRING, &l) ; if (opt == -1) break ; switch (opt) { case 'q' : if (flags.verbosity) flags.verbosity-- ; break ; case 'Q' : flags.verbosity = 1 ; break ; case 'v' : flags.verbosity++ ; break ; #ifdef SKALIBS_IPV6_ENABLED case '4' : flags.ip4 = 1 ; break ; case '6' : flags.ip6 = 1 ; break ; #endif case 'd' : flags.delay = 1 ; break ; case 'D' : flags.delay = 0 ; break ; case 'r' : flags.remoteinfo = 1 ; break ; case 'R' : flags.remoteinfo = 0 ; break ; case 'h' : flags.remotehost = 1 ; break ; case 'H' : flags.remotehost = 0 ; break ; case 'n' : flags.qualif = 1 ; break ; case 'N' : flags.qualif = 0 ; break ; case 't' : if (!uint0_scan(l.arg, &flags.timeout)) usage() ; break ; case 'l' : flags.localname = l.arg ; break ; case 'T' : { size_t n = uint_scan(l.arg, &flags.timeoutconn[0]) ; if (!n) usage() ; if (!l.arg[n]) { flags.timeoutconn[1] = 0 ; break ; } if (l.arg[n] != '+') usage() ; if (!uint0_scan(l.arg + n + 1, &flags.timeoutconn[1])) usage() ; break ; } case 'i' : if (!ip46_scan(l.arg, &flags.localip)) usage() ; localip = 1 ; break ; case 'p' : if (!uint160_scan(l.arg, &flags.localport)) usage() ; break ; default : usage() ; } } argc -= l.ind ; argv += l.ind ; } if (argc < 3) usage() ; #ifdef SKALIBS_IPV6_ENABLED if (!flags.ip6) flags.ip4 = 1 ; #endif if (!uint160_scan(argv[1], &remoteport)) strerr_dief2x(100, "invalid port number: ", argv[1]) ; tain_now_set_stopwatch_g() ; if (flags.timeout) tain_addsec_g(&deadline, flags.timeout) ; else tain_add_g(&deadline, &tain_infinite_relative) ; if (!s6dns_init()) strerr_diefu1sys(111, "init DNS") ; { ip46_t ip[2][MAXIP] ; unsigned int j = 0 ; size_t n[2] = { 0, 0 } ; if (!**argv || ((**argv == '0') && !argv[0][1])) { #ifdef SKALIBS_IPV6_ENABLED ip46_from_ip6(&ip[0][n[0]++], IP6_LOCAL) ; #endif ip46_from_ip4(&ip[0][n[0]++], IP4_LOCAL) ; } else { if (!flags.remotehost) { #ifdef SKALIBS_IPV6_ENABLED if (flags.ip6 && !flags.ip4) { char ip6[MAXIP << 4] ; size_t i = 0 ; if (!ip6_scanlist(ip6, MAXIP, argv[0], &n[0])) usage() ; for (; i < n[0] ; i++) ip46_from_ip6(&ip[0][i], ip6 + (i << 4)) ; } else if (!flags.ip6) { char ip4[MAXIP << 2] ; size_t i = 0 ; if (!ip4_scanlist(ip4, MAXIP, argv[0], &n[0])) usage() ; for (; i < n[0] ; i++) ip46_from_ip4(&ip[0][i], ip4 + (i << 2)) ; } else #endif if (!ip46_scanlist(ip[0], MAXIP, argv[0], &n[0])) usage() ; } else { #ifdef SKALIBS_IPV6_ENABLED if (flags.ip6 && flags.ip4) { if (!ip46_scanlist(ip[0], MAXIP, argv[0], &n[0])) { genalloc ips = STRALLOC_ZERO ; size_t i = 0 ; if (s6dns_resolve_aaaaa_g(&ips, argv[0], strlen(argv[0]), flags.qualif, &deadline) <= 0) strerr_diefu4x(111, "resolve ", argv[0], ": ", s6dns_constants_error_str(errno)) ; n[0] = genalloc_len(ip46_t, &ips) ; if (n[0] >= MAXIP) n[0] = MAXIP ; for (; i < n[0] ; i++) ip[0][i] = genalloc_s(ip46_t, &ips)[i] ; genalloc_free(ip46_t, &ips) ; } } else if (flags.ip6) { char ip6[MAXIP << 4] ; if (ip6_scanlist(ip6, MAXIP, argv[0], &n[0])) { size_t i = 0 ; for (; i < n[0] ; i++) ip46_from_ip6(&ip[0][i], ip6 + (i << 4)) ; } else { stralloc ip6s = STRALLOC_ZERO ; size_t i = 0 ; if (s6dns_resolve_aaaa_g(&ip6s, argv[0], strlen(argv[0]), flags.qualif, &deadline) <= 0) strerr_diefu4x(111, "resolve ", argv[0], ": ", s6dns_constants_error_str(errno)) ; n[0] = ip6s.len >> 4 ; if (n[0] >= MAXIP) n[0] = MAXIP ; for (; i < n[0] ; i++) ip46_from_ip6(&ip[0][i], ip6s.s + (i << 4)) ; stralloc_free(&ip6s) ; } } else #endif { char ip4[MAXIP << 2] ; if (ip4_scanlist(ip4, MAXIP, argv[0], &n[0])) { size_t i = 0 ; for (; i < n[0] ; i++) ip46_from_ip4(&ip[0][i], ip4 + (i << 2)) ; } else { stralloc ip4s = STRALLOC_ZERO ; size_t i = 0 ; if (s6dns_resolve_a_g(&ip4s, argv[0], strlen(argv[0]), flags.qualif, &deadline) <= 0) strerr_diefu4x(111, "resolve ", argv[0], ": ", s6dns_constants_error_str(errno)) ; n[0] = ip4s.len >> 2 ; if (n[0] >= MAXIP) n[0] = MAXIP ; for (; i < n[0] ; i++) ip46_from_ip4(&ip[0][i], ip4s.s + (i << 2)) ; stralloc_free(&ip4s) ; } } } if (!n[0]) strerr_dief2x(100, "no IP address for ", argv[0]) ; } if (n[0] == 1) { flags.timeoutconn[0] += flags.timeoutconn[1] ; flags.timeoutconn[1] = 0 ; } for (; j < 2 ; j++) { size_t i = 0 ; for (; i < n[j] ; i++) { tain_t localdeadline ; #ifdef SKALIBS_IPV6_ENABLED if(!localip) flags.localip.is6 = ip46_is6(&ip[j][i]); #endif s = socket_tcp46(ip46_is6(&flags.localip)); if (s < 0) strerr_diefu1sys(111, "create socket") ; if (socket_bind46(s, &flags.localip, flags.localport) < 0) strerr_diefu1sys(111, "bind socket") ; tain_addsec_g(&localdeadline, flags.timeoutconn[j]) ; if (tain_less(&deadline, &localdeadline)) localdeadline = deadline ; if (socket_deadlineconnstamp46_g(s, &ip[j][i], remoteport, &localdeadline)) goto connected ; fd_close(s) ; if (!j && flags.timeoutconn[1]) ip[1][n[1]++] = ip[0][i] ; else { char fmtip[IP46_FMT] ; char fmtport[UINT16_FMT] ; fmtip[ip46_fmt(fmtip, &ip[j][i])] = 0 ; fmtport[uint16_fmt(fmtport, remoteport)] = 0 ; strerr_warnwu4sys("connect to ", fmtip, " port ", fmtport) ; } } } strerr_diefu2x(111, "connect to ", "a suitable IP address") ; } connected: if (ndelay_off(s) == -1) strerr_diefu1sys(111, "ndelay_off") ; if (!flags.delay) socket_tcpnodelay(s) ; if (socket_local46(s, &flags.localip, &flags.localport) == -1) strerr_diefu2sys(111, "get local", " address and port") ; { ip46_t remoteip ; char fmtip[IP46_FMT] ; char fmtport[UINT16_FMT] ; if (socket_remote46(s, &remoteip, &remoteport) == -1) strerr_diefu2sys(111, "get remote", " address and port") ; fmtip[ip46_fmt(fmtip, &remoteip)] = 0 ; fmtport[uint16_fmt(fmtport, remoteport)] = 0 ; if (flags.verbosity >= 2) strerr_warni4x("connected to ", fmtip, " port ", fmtport) ; if (!pathexec_env("PROTO", "TCP") || !pathexec_env("TCPREMOTEIP", fmtip) || !pathexec_env("TCPREMOTEPORT", fmtport)) dienomem() ; fmtip[ip46_fmt(fmtip, &flags.localip)] = 0 ; fmtport[uint16_fmt(fmtport, flags.localport)] = 0 ; if (!pathexec_env("TCPLOCALIP", fmtip) || !pathexec_env("TCPLOCALPORT", fmtport)) dienomem() ; if (flags.localname) { if (!pathexec_env("TCPLOCALHOST", flags.localname)) dienomem() ; } /* DNS resolution for TCPLOCALHOST and TCPREMOTEHOST */ if (!flags.localname || flags.remotehost) { s6dns_resolve_t blob[2] ; s6dns_dpag_t data[2] = { S6DNS_DPAG_ZERO, S6DNS_DPAG_ZERO } ; if (!flags.localname) { s6dns_domain_arpafromip46(&blob[0].q, &flags.localip) ; s6dns_domain_encode(&blob[0].q) ; blob[0].qtype = S6DNS_T_PTR ; blob[0].deadline = deadline ; blob[0].parsefunc = &s6dns_message_parse_answer_domain ; blob[0].data = &data[0] ; blob[0].options = S6DNS_O_RECURSIVE ; data[0].rtype = S6DNS_T_PTR ; } if (flags.remotehost) { s6dns_domain_arpafromip46(&blob[1].q, &remoteip) ; s6dns_domain_encode(&blob[1].q) ; blob[1].qtype = S6DNS_T_PTR ; blob[1].deadline = deadline ; blob[1].parsefunc = &s6dns_message_parse_answer_domain ; blob[1].data = &data[1] ; blob[1].options = S6DNS_O_RECURSIVE ; data[1].rtype = S6DNS_T_PTR ; } { tain_t infinite = TAIN_INFINITE ; if (!s6dns_resolven_parse_g(blob + !!flags.localname, !flags.localname + !!flags.remotehost, &infinite)) strerr_diefu2x(111, "resolve IP addresses: ", s6dns_constants_error_str(errno)) ; } if (!flags.localname) { if (blob[0].status) { if (!pathexec_env("TCPLOCALHOST", 0)) dienomem() ; } else { char s[256] ; unsigned int len = 0 ; if (genalloc_len(s6dns_domain_t, &data[0].ds)) len = s6dns_domain_tostring(s, 255, genalloc_s(s6dns_domain_t, &data[0].ds)) ; genalloc_free(s6dns_domain_t, &data[0].ds) ; s[len] = 0 ; if (!pathexec_env("TCPLOCALHOST", s)) dienomem() ; } } if (flags.remotehost) { if (blob[1].status) { if (!pathexec_env("TCPREMOTEHOST", 0)) dienomem() ; } else { char s[256] ; unsigned int len = 0 ; if (genalloc_len(s6dns_domain_t, &data[1].ds)) len = s6dns_domain_tostring(s, 255, genalloc_s(s6dns_domain_t, &data[1].ds)) ; genalloc_free(s6dns_domain_t, &data[1].ds) ; s[len] = 0 ; if (!pathexec_env("TCPREMOTEHOST", s)) dienomem() ; } } } /* TCPREMOTEINFO */ /* Yes, I should have made all the network queries in parallel, not only the DNS ones, but the IDENT one too. Well, that was too much work for an obsolete protocol. Sue me. */ { char idbuf[S6NET_IDENT_ID_SIZE] ; if (flags.remoteinfo) { ssize_t r = s6net_ident_client_g(idbuf, S6NET_IDENT_ID_SIZE, &remoteip, remoteport, &flags.localip, flags.localport, &deadline) ; if (r <= 0) { if (flags.verbosity) { if (r < 0) strerr_warnwu1sys("s6net_ident_client") ; else strerr_warnw2x("ident server replied: ", s6net_ident_error_str(errno)) ; } if (!pathexec_env("TCPREMOTEINFO", "")) dienomem() ; } else if (!pathexec_env("TCPREMOTEINFO", idbuf)) dienomem() ; } } } if (fd_move(6, s) < 0) strerr_diefu2sys(111, "set up fd ", "6") ; if (fd_copy(7, 6) < 0) strerr_diefu2sys(111, "set up fd ", "7") ; xpathexec(argv+2) ; } s6-networking-2.3.1.1/src/conn-tools/deps-exe/0000755000000000000000000000000013540723124015654 5ustar s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-getservbyname0000644000000000000000000000003012443724535021001 0ustar -lskarnet ${SOCKET_LIB} s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-tlsserver0000644000000000000000000000001213016150463020145 0ustar -lskarnet s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-tlsclient0000644000000000000000000000001213016150463020115 0ustar -lskarnet s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-tcpserver-access0000644000000000000000000000010113540723124021371 0ustar ${LIBS6NET} -ls6dns -ls6 -lskarnet ${SOCKET_LIB} ${SYSCLOCK_LIB} s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-tcpserver4d0000644000000000000000000000003012453071676020375 0ustar -lskarnet ${SOCKET_LIB} s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-tcpclient0000644000000000000000000000007413540723124020113 0ustar ${LIBS6NET} -ls6dns -lskarnet ${SOCKET_LIB} ${SYSCLOCK_LIB} s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-tlsc0000644000000000000000000000012713540723124017072 0ustar ${LIBCRYPTOSUPPORT} -lskarnet ${CRYPTO_LIB} ${SOCKET_LIB} ${SPAWN_LIB} ${SYSCLOCK_LIB} s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-tcpserver40000644000000000000000000000003012443356341020223 0ustar -lskarnet ${SOCKET_LIB} s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-tcpserver0000644000000000000000000000001212443303024020125 0ustar -lskarnet s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-tcpserver60000644000000000000000000000003012443356353020230 0ustar -lskarnet ${SOCKET_LIB} s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-tcpserver4-socketbinder0000644000000000000000000000003012453071364022675 0ustar -lskarnet ${SOCKET_LIB} s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-tcpserver6-socketbinder0000644000000000000000000000003012453071370022674 0ustar -lskarnet ${SOCKET_LIB} s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-tlsd0000644000000000000000000000012713540723124017073 0ustar ${LIBCRYPTOSUPPORT} -lskarnet ${CRYPTO_LIB} ${SOCKET_LIB} ${SPAWN_LIB} ${SYSCLOCK_LIB} s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-tcpserver6d0000644000000000000000000000003012453071734020372 0ustar -lskarnet ${SOCKET_LIB} s6-networking-2.3.1.1/src/conn-tools/deps-exe/s6-ident-client0000644000000000000000000000006413540723124020504 0ustar ${LIBS6NET} -lskarnet ${SOCKET_LIB} ${SYSCLOCK_LIB} s6-networking-2.3.1.1/src/conn-tools/s6-tcpserver6d.c0000644000000000000000000002376713466406373017135 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #define ABSOLUTE_MAXCONN 1000 #define USAGE "s6-tcpserver6d [ -v verbosity ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] prog..." typedef struct pidip_s pidip_t, *pidip_t_ref ; struct pidip_s { pid_t pid ; char ip[16] ; } ; typedef struct ipnum_s ipnum_t, *ipnum_t_ref ; struct ipnum_s { char ip[16] ; unsigned int num ; } ; static unsigned int maxconn = 40 ; static unsigned int localmaxconn = 40 ; static unsigned int verbosity = 1 ; static int cont = 1 ; static pidip_t *pidip = 0 ; static unsigned int numconn = 0 ; static ipnum_t *ipnum = 0 ; static unsigned int iplen = 0 ; static char fmtmaxconn[UINT_FMT+1] = "/" ; static char fmtlocalmaxconn[UINT_FMT+1] = "/" ; /* Utility functions */ static inline void dieusage () { strerr_dieusage(100, USAGE) ; } static inline void X (void) { strerr_dief1x(101, "internal inconsistency. Please submit a bug-report.") ; } /* Lookup primitives */ static inline unsigned int lookup_pid (pid_t pid) { unsigned int i = 0 ; for (; i < numconn ; i++) if (pid == pidip[i].pid) break ; return i ; } static inline unsigned int lookup_ip (char const *ip) { unsigned int i = 0 ; for (; i < iplen ; i++) if (!memcmp(ip, ipnum[i].ip, 16)) break ; return i ; } /* Logging */ static void log_start (void) { strerr_warni1x("starting") ; } static inline void log_exit (void) { strerr_warni1x("exiting") ; } static void log_status (void) { char fmt[UINT_FMT] ; fmt[uint_fmt(fmt, numconn)] = 0 ; strerr_warni3x("status: ", fmt, fmtmaxconn) ; } static void log_deny (char const *ip, uint16_t port, unsigned int num) { char fmtip[IP6_FMT] ; char fmtport[UINT16_FMT] ; char fmtnum[UINT_FMT] ; fmtip[ip6_fmt(fmtip, ip)] = 0 ; fmtport[uint16_fmt(fmtport, port)] = 0 ; fmtnum[uint_fmt(fmtnum, num)] = 0 ; strerr_warni7sys("deny ", fmtip, " port ", fmtport, " count ", fmtnum, fmtlocalmaxconn) ; } static void log_accept (pid_t pid, char const *ip, uint16_t port, unsigned int num) { char fmtipport[IP6_FMT + UINT16_FMT + 6] ; char fmtpid[PID_FMT] ; char fmtnum[UINT_FMT] ; size_t n ; n = ip6_fmt(fmtipport, ip) ; memcpy(fmtipport + n, " port ", 6) ; n += 6 ; n += uint16_fmt(fmtipport + n, port) ; fmtipport[n] = 0 ; fmtnum[uint_fmt(fmtnum, num)] = 0 ; fmtpid[pid_fmt(fmtpid, pid)] = 0 ; strerr_warni7x("allow ", fmtipport, " pid ", fmtpid, " count ", fmtnum, fmtlocalmaxconn) ; } static void log_close (pid_t pid, char const *ip, int w) { char fmtpid[PID_FMT] ; char fmtip[IP6_FMT] = "?" ; char fmtw[UINT_FMT] ; fmtpid[pid_fmt(fmtpid, pid)] = 0 ; fmtip[ip6_fmt(fmtip, ip)] = 0 ; fmtw[uint_fmt(fmtw, WIFSIGNALED(w) ? WTERMSIG(w) : WEXITSTATUS(w))] = 0 ; strerr_warni6x("end pid ", fmtpid, " ip ", fmtip, WIFSIGNALED(w) ? " signal " : " exitcode ", fmtw) ; } /* Signal handling */ static void killthem (int sig) { unsigned int i = 0 ; for (; i < numconn ; i++) kill(pidip[i].pid, sig) ; } static void wait_children (void) { for (;;) { unsigned int i ; int w ; pid_t pid = wait_nohang(&w) ; if (pid < 0) if (errno != ECHILD) strerr_diefu1sys(111, "wait_nohang") ; else break ; else if (!pid) break ; i = lookup_pid(pid) ; if (i < numconn) /* it's one of ours ! */ { unsigned int j = lookup_ip(pidip[i].ip) ; if (j >= iplen) X() ; if (!--ipnum[j].num) ipnum[j] = ipnum[--iplen] ; --numconn ; if (verbosity >= 2) { log_close(pid, pidip[i].ip, w) ; log_status() ; } pidip[i] = pidip[numconn] ; } } } static void handle_signals (void) { for (;;) switch (selfpipe_read()) { case -1 : strerr_diefu1sys(111, "read selfpipe") ; case 0 : return ; case SIGCHLD : wait_children() ; break ; case SIGTERM : { if (verbosity >= 2) strerr_warni3x("received ", "SIGTERM,", " quitting") ; cont = 0 ; break ; } case SIGHUP : { if (verbosity >= 2) strerr_warni5x("received ", "SIGHUP,", " sending ", "SIGTERM+SIGCONT", " to all connections") ; killthem(SIGTERM) ; killthem(SIGCONT) ; break ; } case SIGQUIT : { if (verbosity >= 2) strerr_warni6x("received ", "SIGQUIT,", " sending ", "SIGTERM+SIGCONT", " to all connections", " and quitting") ; cont = 0 ; killthem(SIGTERM) ; killthem(SIGCONT) ; break ; } case SIGABRT : { if (verbosity >= 2) strerr_warni6x("received ", "SIGABRT,", " sending ", "SIGKILL", " to all connections", " and quitting") ; cont = 0 ; killthem(SIGKILL) ; break ; } default : X() ; } } /* New connection handling */ static void run_child (int, char const *, uint16_t, unsigned int, char const *const *, char const *const *) gccattr_noreturn ; static void run_child (int s, char const *ip, uint16_t port, unsigned int num, char const *const *argv, char const *const *envp) { char fmt[98] ; size_t n = 0 ; PROG = "s6-tcpserver6 (child)" ; if ((fd_move(0, s) < 0) || (fd_copy(1, 0) < 0)) strerr_diefu1sys(111, "move fds") ; memcpy(fmt+n, "PROTO=TCP\0TCPREMOTEIP=", 22) ; n += 22 ; n += ip6_fmt(fmt+n, ip) ; fmt[n++] = 0 ; memcpy(fmt+n, "TCPREMOTEPORT=", 14) ; n += 14 ; n += uint16_fmt(fmt+n, port) ; fmt[n++] = 0 ; memcpy(fmt+n, "TCPCONNNUM=", 11) ; n += 11 ; n += uint_fmt(fmt+n, num) ; fmt[n++] = 0 ; pathexec_r(argv, envp, env_len(envp), fmt, n) ; strerr_dieexec(111, argv[0]) ; } static void new_connection (int s, char const *ip, uint16_t port, char const *const *argv, char const *const *envp) { unsigned int i = lookup_ip(ip) ; unsigned int num = (i < iplen) ? ipnum[i].num : 0 ; pid_t pid ; if (num >= localmaxconn) { log_deny(ip, port, num) ; return ; } pid = fork() ; if (pid < 0) { if (verbosity) strerr_warnwu1sys("fork") ; return ; } else if (!pid) { selfpipe_finish() ; run_child(s, ip, port, num+1, argv, envp) ; } if (i < iplen) ipnum[i].num = num + 1 ; else { memcpy(ipnum[iplen].ip, ip, 16) ; ipnum[iplen++].num = 1 ; } pidip[numconn].pid = pid ; memcpy(pidip[numconn++].ip, ip, 16) ; if (verbosity >= 2) { log_accept(pid, ip, port, ipnum[i].num) ; log_status() ; } } int main (int argc, char const *const *argv, char const *const *envp) { iopause_fd x[2] = { { .events = IOPAUSE_READ }, { .fd = 0, .events = IOPAUSE_READ | IOPAUSE_EXCEPT } } ; PROG = "s6-tcpserver6d" ; { subgetopt_t l = SUBGETOPT_ZERO ; int flag1 = 0 ; for (;;) { int opt = subgetopt_r(argc, argv, "1c:C:v:", &l) ; if (opt == -1) break ; switch (opt) { case '1' : flag1 = 1 ; break ; case 'c' : if (!uint0_scan(l.arg, &maxconn)) dieusage() ; break ; case 'C' : if (!uint0_scan(l.arg, &localmaxconn)) dieusage() ; break ; case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; if (!argc || !*argv[0]) dieusage() ; { struct stat st ; if (fstat(0, &st) < 0) strerr_diefu1sys(111, "fstat stdin") ; if (!S_ISSOCK(st.st_mode)) strerr_dief1x(100, "stdin is not a socket") ; } if (coe(0) < 0) strerr_diefu1sys(111, "make socket close-on-exec") ; if (flag1) { if (fcntl(1, F_GETFD) < 0) strerr_dief1sys(100, "called with option -1 but stdout said") ; } else close(1) ; if (!maxconn) maxconn = 1 ; if (maxconn > ABSOLUTE_MAXCONN) maxconn = ABSOLUTE_MAXCONN ; if (localmaxconn > maxconn) localmaxconn = maxconn ; x[0].fd = selfpipe_init() ; if (x[0].fd == -1) strerr_diefu1sys(111, "create selfpipe") ; if (sig_ignore(SIGPIPE) < 0) strerr_diefu1sys(111, "ignore SIGPIPE") ; { sigset_t set ; sigemptyset(&set) ; sigaddset(&set, SIGCHLD) ; sigaddset(&set, SIGTERM) ; sigaddset(&set, SIGHUP) ; sigaddset(&set, SIGQUIT) ; sigaddset(&set, SIGABRT) ; if (selfpipe_trapset(&set) < 0) strerr_diefu1sys(111, "trap signals") ; } if (flag1) { uint16_t port ; uint16_t m = 0 ; char ip[16] ; char fmtport[UINT16_FMT] ; if (socket_local6(0, ip, &port) == -1) { if (verbosity) strerr_warnwu1sys("socket_local6") ; } else m = uint16_fmt(fmtport, port) ; fmtport[m++] = '\n' ; allwrite(1, fmtport, m) ; fd_close(1) ; } fmtlocalmaxconn[1+uint_fmt(fmtlocalmaxconn+1, localmaxconn)] = 0 ; if (verbosity >= 2) { fmtmaxconn[1+uint_fmt(fmtmaxconn+1, maxconn)] = 0 ; log_start() ; log_status() ; } } { pidip_t pidip_inyostack[maxconn] ; ipnum_t ipnum_inyostack[maxconn] ; pidip = pidip_inyostack ; ipnum = ipnum_inyostack ; while (cont) { if (iopause_g(x, 1 + (numconn < maxconn), 0) < 0) strerr_diefu1sys(111, "iopause") ; if (x[0].revents & IOPAUSE_EXCEPT) strerr_dief1x(111, "trouble with selfpipe") ; if (x[0].revents & IOPAUSE_READ) { handle_signals() ; continue ; } if (numconn < maxconn) { if (x[1].revents & IOPAUSE_EXCEPT) strerr_dief1x(111, "trouble with socket") ; if (x[1].revents & IOPAUSE_READ) { char ip[16] ; uint16_t port ; int fd = socket_accept6(x[1].fd, ip, &port) ; if (fd < 0) { if (verbosity) strerr_warnwu1sys("accept") ; } else { new_connection(fd, ip, port, argv, envp) ; fd_close(fd) ; } } } } } if (verbosity >= 2) log_exit() ; return 0 ; } s6-networking-2.3.1.1/src/conn-tools/s6-tlsclient.c0000644000000000000000000001313513146777565016664 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #define USAGE "s6-tlsclient [ options ] host port prog...\n" \ "s6-tcpclient options: [ -q | -Q | -v ] [ -4 | -6 ] [ -d | -D ] [ -r | -R ] [ -h | -H ] [ -n | -N ] [ -t timeout ] [ -l localname ] [ -T timeoutconn ] [ -i localip ] [ -p localport ]\n" \ "s6-tlsc options: [ -S | -s ] [ -Y | -y ] [ -K timeout ] [ -k servername ] [ -Z | -z ]" #define dieusage() strerr_dieusage(100, USAGE) typedef struct options_s options_t, *options_t_ref ; struct options_s { char const *localname ; char const *servername ; unsigned int timeout ; unsigned int ximeout ; unsigned int yimeout ; unsigned int kimeout ; uint16_t localport ; ip46full_t localip ; unsigned int verbosity : 2 ; unsigned int flag4 : 1 ; unsigned int flag6 : 1 ; unsigned int flagD : 1 ; unsigned int flagH : 1 ; unsigned int flagr : 1 ; unsigned int flagN : 1 ; unsigned int flagS : 1 ; unsigned int flagy : 1 ; unsigned int flagZ : 1 ; unsigned int doxy : 1 ; } ; #define OPTIONS_ZERO \ { \ .localname = 0, \ .servername = 0, \ .timeout = 0, \ .ximeout = 2, \ .yimeout = 58, \ .kimeout = 0, \ .localport = 0, \ .localip = IP46FULL_ZERO, \ .verbosity = 1, \ .flag4 = 0, \ .flag6 = 0, \ .flagD = 0, \ .flagH = 0, \ .flagr = 0, \ .flagN = 0, \ .flagS = 0, \ .flagy = 0, \ .flagZ = 0, \ .doxy = 0 \ } int main (int argc, char const *const *argv, char const *const *envp) { options_t o = OPTIONS_ZERO ; PROG = "s6-tlsclient" ; { subgetopt_t l = SUBGETOPT_ZERO ; for (;;) { int opt = subgetopt_r(argc, argv, "qQv46DdHhRrnNt:l:T:i:p:SsYyK:k:Zz", &l) ; if (opt == -1) break ; switch (opt) { case 'q' : o.verbosity = 0 ; break ; case 'Q' : o.verbosity = 1 ; break ; case 'v' : o.verbosity = 2 ; break ; case '4' : o.flag4 = 1 ; break ; case '6' : o.flag6 = 1 ; break ; case 'D' : o.flagD = 1 ; break ; case 'd' : o.flagD = 0 ; break ; case 'H' : o.flagH = 1 ; break ; case 'h' : o.flagH = 0 ; break ; case 'R' : o.flagr = 0 ; break ; case 'r' : o.flagr = 1 ; break ; case 'n' : o.flagN = 0 ; break ; case 'N' : o.flagN = 1 ; break ; case 't' : if (!uint0_scan(l.arg, &o.timeout)) dieusage() ; break ; case 'l' : o.localname = l.arg ; break ; case 'T' : { size_t n = uint_scan(l.arg, &o.ximeout) ; if (!n) dieusage() ; o.doxy = 1 ; if (!l.arg[n]) { o.yimeout = 0 ; break ; } if (l.arg[n] != '+') dieusage() ; if (!uint0_scan(l.arg + n + 1, &o.yimeout)) dieusage() ; break ; } case 'i' : if (!ip46full_scan(l.arg, &o.localip)) dieusage() ; break ; case 'p' : if (!uint160_scan(l.arg, &o.localport)) dieusage() ; break ; case 'S' : o.flagS = 1 ; break ; case 's' : o.flagS = 0 ; break ; case 'Y' : o.flagy = 0 ; break ; case 'y' : o.flagy = 1 ; break ; case 'K' : if (!uint0_scan(l.arg, &o.kimeout)) dieusage() ; break ; case 'k' : o.servername = l.arg ; break ; case 'Z' : o.flagZ = 1 ; break ; case 'z' : o.flagZ = 0 ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; if (argc < 3) dieusage() ; } if (!o.servername && !o.flagH) { ip46full_t ip ; if (!ip46full_scan(argv[0], &ip)) o.servername = argv[0] ; } { size_t pos = 0 ; unsigned int m = 0 ; char fmt[UINT_FMT * 4 + UINT16_FMT + IP46_FMT] ; char const *newargv[29 + argc] ; newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpclient" ; if (o.verbosity != 1) newargv[m++] = o.verbosity ? "-v" : "-q" ; if (o.flag4) newargv[m++] = "-4" ; if (o.flag6) newargv[m++] = "-6" ; if (o.flagD) newargv[m++] = "-D" ; if (o.flagH) newargv[m++] = "-H" ; if (o.flagr) newargv[m++] = "-r" ; if (o.flagN) newargv[m++] = "-N" ; if (o.timeout) { newargv[m++] = "-t" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, o.timeout) ; fmt[pos++] = 0 ; } if (o.localname) { newargv[m++] = "-l" ; newargv[m++] = o.localname ; } if (o.doxy) { newargv[m++] = "-T" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, o.ximeout) ; fmt[pos++] = '+' ; pos += uint_fmt(fmt + pos, o.yimeout) ; fmt[pos++] = 0 ; } if (memcmp(o.localip.ip, IP6_ANY, 16)) { newargv[m++] = "-i" ; newargv[m++] = fmt + pos ; pos += ip46full_fmt(fmt + pos, &o.localip) ; fmt[pos++] = 0 ; } if (o.localport) { newargv[m++] = "-p" ; newargv[m++] = fmt + pos ; pos += uint16_fmt(fmt + pos, o.localport) ; fmt[pos++] = 0 ; } newargv[m++] = "--" ; newargv[m++] = *argv++ ; newargv[m++] = *argv++ ; newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tlsc" ; if (o.flagS) newargv[m++] = "-S" ; if (o.flagy) newargv[m++] = "-y" ; if (o.kimeout) { newargv[m++] = "-K" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, o.kimeout) ; fmt[pos++] = 0 ; } if (o.servername) { newargv[m++] = "-k" ; newargv[m++] = o.servername ; } if (o.flagZ) newargv[m++] = "-Z" ; newargv[m++] = "--" ; while (*argv) newargv[m++] = *argv++ ; newargv[m++] = 0 ; xpathexec_run(newargv[0], newargv, envp) ; } } s6-networking-2.3.1.1/src/conn-tools/s6-tcpserver6.c0000644000000000000000000000757513146777460016773 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #define USAGE "s6-tcpserver6 [ -v verbosity ] [ -d | -D ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gid,gid,... ] [ -g gid ] [ -u uid ] [ -U ] ip port prog..." #define dieusage() strerr_dieusage(100, USAGE) int main (int argc, char const *const *argv, char const *const *envp) { unsigned int verbosity = 1 ; int flag1 = 0 ; int flagU = 0 ; int flagreuse = 1 ; uid_t uid = 0 ; gid_t gid = 0 ; gid_t gids[NGROUPS_MAX] ; size_t gidn = (size_t)-1 ; unsigned int maxconn = 0 ; unsigned int localmaxconn = 0 ; unsigned int backlog = (unsigned int)-1 ; PROG = "s6-tcpserver6" ; { subgetopt_t l = SUBGETOPT_ZERO ; for (;;) { int opt = subgetopt_r(argc, argv, "Dd1Uv:c:C:b:u:g:G:", &l) ; if (opt == -1) break ; switch (opt) { case 'D' : flagreuse = 0 ; break ; case 'd' : flagreuse = 1 ; break ; case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ; case 'c' : if (!uint0_scan(l.arg, &maxconn)) dieusage() ; if (!maxconn) maxconn = 1 ; break ; case 'C' : if (!uint0_scan(l.arg, &localmaxconn)) dieusage() ; if (!localmaxconn) localmaxconn = 1 ; break ; case 'b' : if (!uint0_scan(l.arg, &backlog)) dieusage() ; break ; case 'u' : if (!uid0_scan(l.arg, &uid)) dieusage() ; break ; case 'g' : if (!gid0_scan(l.arg, &gid)) dieusage() ; break ; case 'G' : if (!gid_scanlist(gids, NGROUPS_MAX, l.arg, &gidn) && *l.arg) dieusage() ; break ; case '1' : flag1 = 1 ; break ; case 'U' : flagU = 1 ; uid = 0 ; gid = 0 ; gidn = (size_t)-1 ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; if (argc < 3) dieusage() ; } { size_t pos = 0 ; unsigned int m = 0 ; char fmt[UINT_FMT * 4 + UID_FMT + GID_FMT * (NGROUPS_MAX + 1)] ; char const *newargv[24 + argc] ; newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpserver6-socketbinder" ; if (!flagreuse) newargv[m++] = "-D" ; if (backlog != (unsigned int)-1) { if (!backlog) backlog = 1 ; newargv[m++] = "-b" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, backlog) ; fmt[pos++] = 0 ; } newargv[m++] = "--" ; newargv[m++] = *argv++ ; newargv[m++] = *argv++ ; if (flagU || uid || gid || gidn != (size_t)-1) { newargv[m++] = S6_EXTBINPREFIX "s6-applyuidgid" ; if (flagU) newargv[m++] = "-Uz" ; if (uid) { newargv[m++] = "-u" ; newargv[m++] = fmt + pos ; pos += uid_fmt(fmt + pos, uid) ; fmt[pos++] = 0 ; } if (gid) { newargv[m++] = "-g" ; newargv[m++] = fmt + pos ; pos += gid_fmt(fmt + pos, gid) ; fmt[pos++] = 0 ; } if (gidn != (size_t)-1) { newargv[m++] = "-G" ; newargv[m++] = fmt + pos ; pos += gid_fmtlist(fmt + pos, gids, gidn) ; fmt[pos++] = 0 ; } newargv[m++] = "--" ; } newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpserver6d" ; if (verbosity != 1) { newargv[m++] = "-v" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, verbosity) ; fmt[pos++] = 0 ; } if (flag1) newargv[m++] = "-1" ; if (maxconn) { newargv[m++] = "-c" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, maxconn) ; fmt[pos++] = 0 ; } if (localmaxconn) { newargv[m++] = "-C" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, localmaxconn) ; fmt[pos++] = 0 ; } newargv[m++] = "--" ; while (*argv) newargv[m++] = *argv++ ; newargv[m++] = 0 ; xpathexec_run(newargv[0], newargv, envp) ; } } s6-networking-2.3.1.1/src/conn-tools/s6-tcpserver.c0000644000000000000000000001031013146777434016663 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #define USAGE "s6-tcpserver [ -q | -Q | -v ] [ -4 | -6 ] [ -d | -D ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gid,gid,... ] [ -g gid ] [ -u uid ] [ -U ] ip port prog..." #define dieusage() strerr_dieusage(100, USAGE) int main (int argc, char const *const *argv, char const *const *envp) { unsigned int verbosity = 1 ; int flag1 = 0 ; int flagU = 0 ; int flagreuse = 1 ; uid_t uid = 0 ; gid_t gid = 0 ; gid_t gids[NGROUPS_MAX] ; size_t gidn = (size_t)-1 ; unsigned int maxconn = 0 ; unsigned int localmaxconn = 0 ; unsigned int backlog = (unsigned int)-1 ; unsigned int what = 0 ; PROG = "s6-tcpserver" ; { subgetopt_t l = SUBGETOPT_ZERO ; for (;;) { int opt = subgetopt_r(argc, argv, "qQvDd1U46c:C:b:u:g:G:", &l) ; if (opt == -1) break ; switch (opt) { case 'q' : verbosity = 0 ; break ; case 'Q' : verbosity = 1 ; break ; case 'v' : verbosity = 2 ; break ; case 'D' : flagreuse = 0 ; break ; case 'd' : flagreuse = 1 ; break ; case '4' : what = 4 ; break ; case '6' : what = 6 ; break ; case 'c' : if (!uint0_scan(l.arg, &maxconn)) dieusage() ; if (!maxconn) maxconn = 1 ; break ; case 'C' : if (!uint0_scan(l.arg, &localmaxconn)) dieusage() ; if (!localmaxconn) localmaxconn = 1 ; break ; case 'b' : if (!uint0_scan(l.arg, &backlog)) dieusage() ; break ; case 'u' : if (!uid0_scan(l.arg, &uid)) dieusage() ; break ; case 'g' : if (!gid0_scan(l.arg, &gid)) dieusage() ; break ; case 'G' : if (!gid_scanlist(gids, NGROUPS_MAX, l.arg, &gidn) && *l.arg) dieusage() ; break ; case '1' : flag1 = 1 ; break ; case 'U' : flagU = 1 ; uid = 0 ; gid = 0 ; gidn = (size_t)-1 ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; if (argc < 3) dieusage() ; } if (!what) { ip46_t ip ; if (!ip46_scan(argv[0], &ip)) dieusage() ; what = ip46_is6(&ip) ? 6 : 4 ; } { size_t pos = 0 ; unsigned int m = 0 ; char fmt[UINT_FMT * 3 + UID_FMT + GID_FMT * (NGROUPS_MAX + 1)] ; char const *newargv[23 + argc] ; newargv[m++] = what == 6 ? S6_NETWORKING_BINPREFIX "s6-tcpserver6-socketbinder" : S6_NETWORKING_BINPREFIX "s6-tcpserver4-socketbinder" ; if (!flagreuse) newargv[m++] = "-D" ; if (backlog != (unsigned int)-1) { newargv[m++] = "-b" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, backlog) ; fmt[pos++] = 0 ; } newargv[m++] = "--" ; newargv[m++] = *argv++ ; newargv[m++] = *argv++ ; if (flagU || uid || gid || gidn != (size_t)-1) { newargv[m++] = S6_EXTBINPREFIX "s6-applyuidgid" ; if (flagU) newargv[m++] = "-Uz" ; if (uid) { newargv[m++] = "-u" ; newargv[m++] = fmt + pos ; pos += uid_fmt(fmt + pos, uid) ; fmt[pos++] = 0 ; } if (gid) { newargv[m++] = "-g" ; newargv[m++] = fmt + pos ; pos += gid_fmt(fmt + pos, gid) ; fmt[pos++] = 0 ; } if (gidn != (size_t)-1) { newargv[m++] = "-G" ; newargv[m++] = fmt + pos ; pos += gid_fmtlist(fmt + pos, gids, gidn) ; fmt[pos++] = 0 ; } newargv[m++] = "--" ; } newargv[m++] = what == 6 ? S6_NETWORKING_BINPREFIX "s6-tcpserver6d" : S6_NETWORKING_BINPREFIX "s6-tcpserver4d" ; if (!verbosity) newargv[m++] = "-v0" ; else if (verbosity == 2) newargv[m++] = "-v2" ; if (flag1) newargv[m++] = "-1" ; if (maxconn) { newargv[m++] = "-c" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, maxconn) ; fmt[pos++] = 0 ; } if (localmaxconn) { newargv[m++] = "-C" ; newargv[m++] = fmt + pos ; pos += uint_fmt(fmt + pos, localmaxconn) ; fmt[pos++] = 0 ; } newargv[m++] = "--" ; while (*argv) newargv[m++] = *argv++ ; newargv[m++] = 0 ; xpathexec_run(newargv[0], newargv, envp) ; } } s6-networking-2.3.1.1/src/conn-tools/s6-tcpserver4d.c0000644000000000000000000002374213466406301017113 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #define ABSOLUTE_MAXCONN 1000 #define USAGE "s6-tcpserver4d [ -v verbosity ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] prog..." typedef struct pidip_s pidip_t, *pidip_t_ref ; struct pidip_s { pid_t left ; uint32_t right ; } ; static unsigned int maxconn = 40 ; static unsigned int localmaxconn = 40 ; static unsigned int verbosity = 1 ; static int cont = 1 ; static pidip_t *pidip = 0 ; static unsigned int numconn = 0 ; static diuint32 *ipnum = 0 ; static unsigned int iplen = 0 ; static char fmtmaxconn[UINT_FMT+1] = "/" ; static char fmtlocalmaxconn[UINT_FMT+1] = "/" ; /* Utility functions */ static inline void dieusage () { strerr_dieusage(100, USAGE) ; } static inline void X (void) { strerr_dief1x(101, "internal inconsistency. Please submit a bug-report.") ; } /* Lookup primitives */ static inline unsigned int lookup_pid (pid_t pid) { unsigned int i = 0 ; for (; i < numconn ; i++) if (pid == pidip[i].left) break ; return i ; } static inline unsigned int lookup_ip (uint32_t ip) { unsigned int i = 0 ; for (; i < iplen ; i++) if (ip == ipnum[i].left) break ; return i ; } /* Logging */ static void log_start (void) { strerr_warni1x("starting") ; } static inline void log_exit (void) { strerr_warni1x("exiting") ; } static void log_status (void) { char fmt[UINT_FMT] ; fmt[uint_fmt(fmt, numconn)] = 0 ; strerr_warni3x("status: ", fmt, fmtmaxconn) ; } static void log_deny (uint32_t ip, uint16_t port, unsigned int num) { char fmtip[UINT32_FMT] ; char fmtport[UINT16_FMT] ; char fmtnum[UINT_FMT] ; fmtip[ip4_fmtu32(fmtip, ip)] = 0 ; fmtport[uint16_fmt(fmtport, port)] = 0 ; fmtnum[uint_fmt(fmtnum, num)] = 0 ; strerr_warni7sys("deny ", fmtip, ":", fmtport, " count ", fmtnum, fmtlocalmaxconn) ; } static void log_accept (pid_t pid, uint32_t ip, uint16_t port, unsigned int num) { char fmtipport[IP4_FMT + UINT16_FMT + 1] ; char fmtpid[PID_FMT] ; char fmtnum[UINT_FMT] ; size_t n ; n = ip4_fmtu32(fmtipport, ip) ; fmtipport[n++] = ':' ; n += uint16_fmt(fmtipport + n, port) ; fmtipport[n] = 0 ; fmtnum[uint_fmt(fmtnum, num)] = 0 ; fmtpid[pid_fmt(fmtpid, pid)] = 0 ; strerr_warni7x("allow ", fmtipport, " pid ", fmtpid, " count ", fmtnum, fmtlocalmaxconn) ; } static void log_close (pid_t pid, uint32_t ip, int w) { char fmtpid[PID_FMT] ; char fmtip[IP4_FMT] = "?" ; char fmtw[UINT_FMT] ; fmtpid[pid_fmt(fmtpid, pid)] = 0 ; fmtip[ip4_fmtu32(fmtip, ip)] = 0 ; fmtw[uint_fmt(fmtw, WIFSIGNALED(w) ? WTERMSIG(w) : WEXITSTATUS(w))] = 0 ; strerr_warni6x("end pid ", fmtpid, " ip ", fmtip, WIFSIGNALED(w) ? " signal " : " exitcode ", fmtw) ; } /* Signal handling */ static void killthem (int sig) { unsigned int i = 0 ; for (; i < numconn ; i++) kill(pidip[i].left, sig) ; } static void wait_children (void) { for (;;) { unsigned int i ; int w ; pid_t pid = wait_nohang(&w) ; if (pid < 0) if (errno != ECHILD) strerr_diefu1sys(111, "wait_nohang") ; else break ; else if (!pid) break ; i = lookup_pid(pid) ; if (i < numconn) /* it's one of ours ! */ { uint32_t ip = pidip[i].right ; unsigned int j = lookup_ip(ip) ; if (j >= iplen) X() ; if (!--ipnum[j].right) ipnum[j] = ipnum[--iplen] ; pidip[i] = pidip[--numconn] ; if (verbosity >= 2) { log_close(pid, ip, w) ; log_status() ; } } } } static void handle_signals (void) { for (;;) switch (selfpipe_read()) { case -1 : strerr_diefu1sys(111, "read selfpipe") ; case 0 : return ; case SIGCHLD : wait_children() ; break ; case SIGTERM : { if (verbosity >= 2) strerr_warni3x("received ", "SIGTERM,", " quitting") ; cont = 0 ; break ; } case SIGHUP : { if (verbosity >= 2) strerr_warni5x("received ", "SIGHUP,", " sending ", "SIGTERM+SIGCONT", " to all connections") ; killthem(SIGTERM) ; killthem(SIGCONT) ; break ; } case SIGQUIT : { if (verbosity >= 2) strerr_warni6x("received ", "SIGQUIT,", " sending ", "SIGTERM+SIGCONT", " to all connections", " and quitting") ; cont = 0 ; killthem(SIGTERM) ; killthem(SIGCONT) ; break ; } case SIGABRT : { if (verbosity >= 2) strerr_warni6x("received ", "SIGABRT,", " sending ", "SIGKILL", " to all connections", " and quitting") ; cont = 0 ; killthem(SIGKILL) ; break ; } default : X() ; } } /* New connection handling */ static void run_child (int, uint32_t, uint16_t, unsigned int, char const *const *, char const *const *) gccattr_noreturn ; static void run_child (int s, uint32_t ip, uint16_t port, unsigned int num, char const *const *argv, char const *const *envp) { char fmt[74] ; size_t n = 0 ; PROG = "s6-tcpserver (child)" ; if ((fd_move(0, s) < 0) || (fd_copy(1, 0) < 0)) strerr_diefu1sys(111, "move fds") ; memcpy(fmt+n, "PROTO=TCP\0TCPREMOTEIP=", 22) ; n += 22 ; n += ip4_fmtu32(fmt+n, ip) ; fmt[n++] = 0 ; memcpy(fmt+n, "TCPREMOTEPORT=", 14) ; n += 14 ; n += uint16_fmt(fmt+n, port) ; fmt[n++] = 0 ; memcpy(fmt+n, "TCPCONNNUM=", 11) ; n += 11 ; n += uint_fmt(fmt+n, num) ; fmt[n++] = 0 ; pathexec_r(argv, envp, env_len(envp), fmt, n) ; strerr_dieexec(111, argv[0]) ; } static void new_connection (int s, uint32_t ip, uint16_t port, char const *const *argv, char const *const *envp) { unsigned int i = lookup_ip(ip) ; unsigned int num = (i < iplen) ? ipnum[i].right : 0 ; pid_t pid ; if (num >= localmaxconn) { log_deny(ip, port, num) ; return ; } pid = fork() ; if (pid < 0) { if (verbosity) strerr_warnwu1sys("fork") ; return ; } else if (!pid) { selfpipe_finish() ; run_child(s, ip, port, num+1, argv, envp) ; } if (i < iplen) ipnum[i].right = num + 1 ; else { ipnum[iplen].left = ip ; ipnum[iplen++].right = 1 ; } pidip[numconn].left = pid ; pidip[numconn++].right = ip ; if (verbosity >= 2) { log_accept(pid, ip, port, ipnum[i].right) ; log_status() ; } } /* And the main */ int main (int argc, char const *const *argv, char const *const *envp) { iopause_fd x[2] = { { .events = IOPAUSE_READ }, { .fd = 0, .events = IOPAUSE_READ | IOPAUSE_EXCEPT } } ; PROG = "s6-tcpserver4d" ; { subgetopt_t l = SUBGETOPT_ZERO ; int flag1 = 0 ; for (;;) { int opt = subgetopt_r(argc, argv, "1c:C:v:", &l) ; if (opt == -1) break ; switch (opt) { case '1' : flag1 = 1 ; break ; case 'c' : if (!uint0_scan(l.arg, &maxconn)) dieusage() ; break ; case 'C' : if (!uint0_scan(l.arg, &localmaxconn)) dieusage() ; break ; case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ; default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; if (!argc || !*argv[0]) dieusage() ; { struct stat st ; if (fstat(0, &st) < 0) strerr_diefu1sys(111, "fstat stdin") ; if (!S_ISSOCK(st.st_mode)) strerr_dief1x(100, "stdin is not a socket") ; } if (coe(0) < 0) strerr_diefu1sys(111, "make socket close-on-exec") ; if (flag1) { if (fcntl(1, F_GETFD) < 0) strerr_dief1sys(100, "called with option -1 but stdout said") ; } else close(1) ; if (!maxconn) maxconn = 1 ; if (maxconn > ABSOLUTE_MAXCONN) maxconn = ABSOLUTE_MAXCONN ; if (localmaxconn > maxconn) localmaxconn = maxconn ; x[0].fd = selfpipe_init() ; if (x[0].fd == -1) strerr_diefu1sys(111, "create selfpipe") ; if (sig_ignore(SIGPIPE) < 0) strerr_diefu1sys(111, "ignore SIGPIPE") ; { sigset_t set ; sigemptyset(&set) ; sigaddset(&set, SIGCHLD) ; sigaddset(&set, SIGTERM) ; sigaddset(&set, SIGHUP) ; sigaddset(&set, SIGQUIT) ; sigaddset(&set, SIGABRT) ; if (selfpipe_trapset(&set) < 0) strerr_diefu1sys(111, "trap signals") ; } fmtlocalmaxconn[1+uint_fmt(fmtlocalmaxconn+1, localmaxconn)] = 0 ; if (verbosity >= 2) { fmtmaxconn[1+uint_fmt(fmtmaxconn+1, maxconn)] = 0 ; log_start() ; log_status() ; } if (flag1) { uint16_t port ; uint16_t m = 0 ; char ip[4] ; char fmtport[UINT16_FMT] ; if (socket_local4(0, ip, &port) == -1) { if (verbosity) strerr_warnwu1sys("socket_local4") ; } else m = uint16_fmt(fmtport, port) ; fmtport[m++] = '\n' ; allwrite(1, fmtport, m) ; fd_close(1) ; } } { pidip_t pidip_inyostack[maxconn] ; diuint32 ipnum_inyostack[maxconn] ; pidip = pidip_inyostack ; ipnum = ipnum_inyostack ; while (cont) { if (iopause_g(x, 1 + (numconn < maxconn), 0) < 0) strerr_diefu1sys(111, "iopause") ; if (x[0].revents & IOPAUSE_EXCEPT) strerr_dief1x(111, "trouble with selfpipe") ; if (x[0].revents & IOPAUSE_READ) { handle_signals() ; continue ; } if (numconn < maxconn) { if (x[1].revents & IOPAUSE_EXCEPT) strerr_dief1x(111, "trouble with socket") ; if (x[1].revents & IOPAUSE_READ) { char packedip[4] ; uint16_t port ; int fd = socket_accept4(x[1].fd, packedip, &port) ; if (fd < 0) { if (verbosity) strerr_warnwu1sys("accept") ; } else { uint32_t ip ; uint32_unpack_big(packedip, &ip) ; new_connection(fd, ip, port, argv, envp) ; fd_close(fd) ; } } } } } if (verbosity >= 2) log_exit() ; return 0 ; } s6-networking-2.3.1.1/src/conn-tools/deps-lib/0000755000000000000000000000000012443652721015646 5ustar s6-networking-2.3.1.1/src/conn-tools/s6-tlsc.c0000644000000000000000000000504313534450516015610 0ustar /* ISC license. */ #include #include #include #include #include #include #include #include #include #include #ifdef S6_NETWORKING_USE_TLS #include #define s6tlsc stls_s6tlsc #else #ifdef S6_NETWORKING_USE_BEARSSL #include #define s6tlsc sbearssl_s6tlsc #else #error No SSL backend configured. #endif #endif #define USAGE "s6-tlsc [ -S | -s ] [ -Y | -y ] [ -v verbosity ] [ -K timeout ] [ -k servername ] [ -Z | -z ] [ -6 rfd ] [ -7 wfd ] prog..." #define dieusage() strerr_dieusage(100, USAGE) int main (int argc, char const *const *argv, char const *const *envp) { char const *servername = 0 ; tain_t tto ; unsigned int verbosity = 1 ; uid_t uid = 0 ; gid_t gid = 0 ; uint32_t preoptions = 2 ; uint32_t options = 1 ; int fds[2] = { 6, 7 } ; PROG = "s6-tlsc" ; { subgetopt_t l = SUBGETOPT_ZERO ; unsigned int t = 0 ; for (;;) { int opt = subgetopt_r(argc, argv, "SsYyv:K:k:Zz6:7:", &l) ; if (opt == -1) break ; switch (opt) { case 'S' : options &= ~(uint32_t)1 ; break ; case 's' : options |= 1 ; break ; case 'Y' : preoptions &= ~(uint32_t)1 ; break ; case 'y' : preoptions |= 1 ; break ; case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ; case 'K' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ; case 'k' : servername = l.arg ; break ; case 'Z' : preoptions &= ~(uint32_t)2 ; break ; case 'z' : preoptions |= 2 ; break ; case '6' : { unsigned int fd ; if (!uint0_scan(l.arg, &fd)) dieusage() ; fds[0] = fd ; break ; } case '7' : { unsigned int fd ; if (!uint0_scan(l.arg, &fd)) dieusage() ; fds[1] = fd ; break ; } default : dieusage() ; } } argc -= l.ind ; argv += l.ind ; if (t) tain_from_millisecs(&tto, t) ; else tto = tain_infinite_relative ; } if (!argc) dieusage() ; if (!getuid()) { char const *x = env_get2(envp, "TLS_UID") ; if (x && !uid0_scan(x, &uid)) strerr_dieinvalid(100, "TLS_UID") ; x = env_get2(envp, "TLS_GID") ; if (x && !gid0_scan(x, &gid)) strerr_dieinvalid(100, "TLS_GID") ; } tain_now_set_stopwatch_g() ; return s6tlsc(argv, envp, &tto, preoptions, options, uid, gid, verbosity, servername, fds) ; } s6-networking-2.3.1.1/src/include/0000755000000000000000000000000012443272574013503 5ustar s6-networking-2.3.1.1/src/include/s6-networking/0000755000000000000000000000000013541515353016213 5ustar s6-networking-2.3.1.1/src/include/s6-networking/stls.h0000644000000000000000000000115713064477706017366 0ustar /* ISC license. */ #ifndef STLS_H #define STLS_H #include #include #include #include #define STLS_BUFSIZE (16384 + 325 + 1) /* Engine */ extern int stls_run (struct tls *, int *, pid_t, unsigned int, uint32_t, tain_t const *) ; /* s6-tlsc and s6-tlsd implementations */ extern int stls_s6tlsc (char const *const *, char const *const *, tain_t const *, uint32_t, uint32_t, uid_t, gid_t, unsigned int, char const *, int *) ; extern int stls_s6tlsd (char const *const *, char const *const *, tain_t const *, uint32_t, uint32_t, uid_t, gid_t, unsigned int) ; #endif s6-networking-2.3.1.1/src/include/s6-networking/sbearssl.h0000644000000000000000000001335013064477730020212 0ustar /* ISC license. */ #ifndef SBEARSSL_H #define SBEARSSL_H #include #include #include #include #include #include #include /* * Support library for bearssl. * Provides types for relocatable objects (instead of pointers, * indices, with storage in a stralloc), conversion functions * from/to native bearssl types, and a higher-level API to * read secret keys / certificate chains / trust anchors from * the filesystem. */ #define SBEARSSL_MAXSKEYFILESIZE 8192 #define SBEARSSL_MAXCERTFILESIZE 8192 /* Utility functions */ extern int sbearssl_isder (unsigned char const *, size_t) ; extern int sbearssl_x509_minimal_set_tai (br_x509_minimal_context *, tai_t const *) ; #define sbearssl_x509_minimal_set_tain(ctx, a) sbearssl_x509_minimal_set_tai(ctx, tain_secp(a)) /* Certificates (x509-encoded) */ typedef struct sbearssl_cert_s sbearssl_cert, *sbearssl_cert_ref ; struct sbearssl_cert_s { size_t data ; size_t datalen ; } ; extern int sbearssl_cert_from (sbearssl_cert *, br_x509_certificate const *, stralloc *) ; extern void sbearssl_cert_to (sbearssl_cert const *, br_x509_certificate *, char *) ; extern int sbearssl_cert_readfile (char const *, genalloc *, stralloc *) ; extern int sbearssl_cert_readbigpem (char const *, genalloc *, stralloc *) ; /* Private keys */ typedef struct sbearssl_rsa_skey_s sbearssl_rsa_skey, *sbearssl_rsa_skey_ref ; struct sbearssl_rsa_skey_s { uint32_t n_bitlen ; size_t p ; size_t plen ; size_t q ; size_t qlen ; size_t dp ; size_t dplen ; size_t dq ; size_t dqlen ; size_t iq ; size_t iqlen ; } ; extern int sbearssl_rsa_skey_from (sbearssl_rsa_skey *, br_rsa_private_key const *, stralloc *) ; extern void sbearssl_rsa_skey_to (sbearssl_rsa_skey const *, br_rsa_private_key *, char *) ; typedef struct sbearssl_ec_skey_s sbearssl_ec_skey, *sbearssl_ec_skey_ref ; struct sbearssl_ec_skey_s { int curve ; size_t x ; size_t xlen ; } ; extern int sbearssl_ec_skey_from (sbearssl_ec_skey *, br_ec_private_key const *, stralloc *) ; extern void sbearssl_ec_skey_to (sbearssl_ec_skey const *, br_ec_private_key *, char *) ; extern int sbearssl_ec_issuer_keytype (int *, br_x509_certificate const *) ; union sbearssl_skey_u { sbearssl_rsa_skey rsa ; sbearssl_ec_skey ec ; } ; typedef struct sbearssl_skey_s sbearssl_skey, *sbearssl_skey_ref ; struct sbearssl_skey_s { unsigned int type ; union sbearssl_skey_u data ; } ; union br_skey_u { br_rsa_private_key rsa ; br_ec_private_key ec ; } ; typedef struct br_skey_s br_skey, *br_skey_ref ; struct br_skey_s { unsigned char type ; union br_skey_u data ; } ; extern int sbearssl_skey_from (sbearssl_skey *, br_skey const *, stralloc *) ; extern int sbearssl_skey_to (sbearssl_skey const *, br_skey *, char *) ; extern int sbearssl_skey_readfile (char const *, sbearssl_skey *, stralloc *) ; /* Public keys */ typedef struct sbearssl_rsa_pkey_s sbearssl_rsa_pkey, *sbearssl_rsa_pkey_ref ; struct sbearssl_rsa_pkey_s { size_t n ; size_t nlen ; size_t e ; size_t elen ; } ; extern int sbearssl_rsa_pkey_from (sbearssl_rsa_pkey *, br_rsa_public_key const *, stralloc *) ; extern void sbearssl_rsa_pkey_to (sbearssl_rsa_pkey const *, br_rsa_public_key *, char *) ; typedef struct sbearssl_ec_pkey_s sbearssl_ec_pkey, *sbearssl_ec_pkey_ref ; struct sbearssl_ec_pkey_s { int curve ; size_t q ; size_t qlen ; } ; extern int sbearssl_ec_pkey_from (sbearssl_ec_pkey *, br_ec_public_key const *, stralloc *) ; extern void sbearssl_ec_pkey_to (sbearssl_ec_pkey const *, br_ec_public_key *, char *) ; union sbearssl_pkey_u { sbearssl_rsa_pkey rsa ; sbearssl_ec_pkey ec ; } ; typedef struct sbearssl_pkey_s sbearssl_pkey, *sbearssl_pkey_ref ; struct sbearssl_pkey_s { unsigned char type ; union sbearssl_pkey_u data ; } ; extern int sbearssl_pkey_from (sbearssl_pkey *, br_x509_pkey const *, stralloc *) ; extern int sbearssl_pkey_to (sbearssl_pkey const *, br_x509_pkey *, char *) ; /* Generic PEM */ typedef struct sbearssl_pemobject_s sbearssl_pemobject, *sbearssl_pemobject_ref ; struct sbearssl_pemobject_s { size_t name ; size_t data ; size_t datalen ; } ; extern int sbearssl_pem_decode_from_string (char const *, size_t, genalloc *, stralloc *) ; extern int sbearssl_pem_decode_from_buffer (buffer *, genalloc *, stralloc *) ; /* Trust anchors */ typedef struct sbearssl_ta_s sbearssl_ta, *sbearssl_ta_ref ; struct sbearssl_ta_s { size_t dn ; size_t dnlen ; unsigned int flags ; sbearssl_pkey pkey ; } ; extern int sbearssl_ta_from (sbearssl_ta *, br_x509_trust_anchor const *, stralloc *) ; extern void sbearssl_ta_to (sbearssl_ta const *, br_x509_trust_anchor *, char *) ; extern int sbearssl_ta_cert (sbearssl_ta *, sbearssl_cert const *, char const *, stralloc *) ; extern int sbearssl_ta_certs (genalloc *, stralloc *, sbearssl_cert const *, size_t, char const *) ; extern int sbearssl_ta_readfile (char const *, genalloc *, stralloc *) ; extern int sbearssl_ta_readdir (char const *, genalloc *, stralloc *) ; extern size_t sbearssl_x500_name_len (sbearssl_ta const *, size_t) ; /* extern void sbearssl_x500_from_ta (br_x500_name *, sbearssl_ta const *, size_t, char *, char const *) ; */ /* Errors */ extern char const *sbearssl_error_str (int) ; /* Engine */ extern int sbearssl_run (br_ssl_engine_context *, int *, pid_t, unsigned int, uint32_t, tain_t const *) ; /* s6-tlsc and s6-tlsd implementations */ extern int sbearssl_s6tlsc (char const *const *, char const *const *, tain_t const *, uint32_t, uint32_t, uid_t, gid_t, unsigned int, char const *, int *) ; extern int sbearssl_s6tlsd (char const *const *, char const *const *, tain_t const *, uint32_t, uint32_t, uid_t, gid_t, unsigned int) ; #endif s6-networking-2.3.1.1/src/include/s6-networking/ident.h0000644000000000000000000000160613061236273017470 0ustar /* ISC license. */ #ifndef IDENT1413_H #define IDENT1413_H #include #include #include #include #define S6NET_IDENT_ID_SIZE 512 #define S6NET_IDENT_REPLY_SIZE 1024 /* High-level */ extern ssize_t s6net_ident_client (char *, size_t, ip46_t const *, uint16_t, ip46_t const *, uint16_t, tain_t const *, tain_t *) ; #define s6net_ident_client_g(s, max, ra, rp, la, lp, deadline) s6net_ident_client(s, max, ra, rp, la, lp, (deadline), &STAMP) extern char const *s6net_ident_error_str (int) ; /* Low-level */ extern ssize_t s6net_ident_reply_get (char *, ip46_t const *, uint16_t, ip46_t const *, uint16_t, tain_t const *, tain_t *) ; #define s6net_ident_reply_get_g(s, ra, rp, la, lp, deadline) s6net_ident_reply_get(s, ra, rp, la, lp, (deadline), &STAMP) extern ssize_t s6net_ident_reply_parse (char const *, uint16_t, uint16_t) ; #endif s6-networking-2.3.1.1/src/include/s6-networking/s6net.h0000644000000000000000000000013613021007251017405 0ustar /* ISC license. */ #ifndef S6NET_H #define S6NET_H #include #endif s6-networking-2.3.1.1/package/0002755000000000000000000000000013016150463012653 5ustar s6-networking-2.3.1.1/package/deps.mak0000644000000000000000000004142313553364330014310 0ustar # # This file has been generated by tools/gen-deps.sh # src/include/s6-networking/s6net.h: src/include/s6-networking/ident.h src/sbearssl/sbearssl-internal.h: src/include/s6-networking/sbearssl.h src/clock/s6-clockadd.o src/clock/s6-clockadd.lo: src/clock/s6-clockadd.c src/clock/s6-clockview.o src/clock/s6-clockview.lo: src/clock/s6-clockview.c src/clock/s6-sntpclock.o src/clock/s6-sntpclock.lo: src/clock/s6-sntpclock.c src/clock/s6-taiclock.o src/clock/s6-taiclock.lo: src/clock/s6-taiclock.c src/clock/s6-taiclockd.o src/clock/s6-taiclockd.lo: src/clock/s6-taiclockd.c src/conn-tools/s6-getservbyname.o src/conn-tools/s6-getservbyname.lo: src/conn-tools/s6-getservbyname.c src/conn-tools/s6-ident-client.o src/conn-tools/s6-ident-client.lo: src/conn-tools/s6-ident-client.c src/include/s6-networking/ident.h src/conn-tools/s6-tcpclient.o src/conn-tools/s6-tcpclient.lo: src/conn-tools/s6-tcpclient.c src/include/s6-networking/ident.h src/conn-tools/s6-tcpserver-access.o src/conn-tools/s6-tcpserver-access.lo: src/conn-tools/s6-tcpserver-access.c src/include/s6-networking/ident.h src/conn-tools/s6-tcpserver.o src/conn-tools/s6-tcpserver.lo: src/conn-tools/s6-tcpserver.c src/include/s6-networking/config.h src/conn-tools/s6-tcpserver4-socketbinder.o src/conn-tools/s6-tcpserver4-socketbinder.lo: src/conn-tools/s6-tcpserver4-socketbinder.c src/conn-tools/s6-tcpserver4.o src/conn-tools/s6-tcpserver4.lo: src/conn-tools/s6-tcpserver4.c src/include/s6-networking/config.h src/conn-tools/s6-tcpserver4d.o src/conn-tools/s6-tcpserver4d.lo: src/conn-tools/s6-tcpserver4d.c src/conn-tools/s6-tcpserver6-socketbinder.o src/conn-tools/s6-tcpserver6-socketbinder.lo: src/conn-tools/s6-tcpserver6-socketbinder.c src/conn-tools/s6-tcpserver6.o src/conn-tools/s6-tcpserver6.lo: src/conn-tools/s6-tcpserver6.c src/include/s6-networking/config.h src/conn-tools/s6-tcpserver6d.o src/conn-tools/s6-tcpserver6d.lo: src/conn-tools/s6-tcpserver6d.c src/conn-tools/s6-tlsc.o src/conn-tools/s6-tlsc.lo: src/conn-tools/s6-tlsc.c src/include/s6-networking/config.h src/include/s6-networking/sbearssl.h src/include/s6-networking/stls.h src/conn-tools/s6-tlsclient.o src/conn-tools/s6-tlsclient.lo: src/conn-tools/s6-tlsclient.c src/include/s6-networking/config.h src/conn-tools/s6-tlsd.o src/conn-tools/s6-tlsd.lo: src/conn-tools/s6-tlsd.c src/include/s6-networking/config.h src/include/s6-networking/sbearssl.h src/include/s6-networking/stls.h src/conn-tools/s6-tlsserver.o src/conn-tools/s6-tlsserver.lo: src/conn-tools/s6-tlsserver.c src/include/s6-networking/config.h src/libs6net/s6net_ident_client.o src/libs6net/s6net_ident_client.lo: src/libs6net/s6net_ident_client.c src/include/s6-networking/ident.h src/libs6net/s6net_ident_error.o src/libs6net/s6net_ident_error.lo: src/libs6net/s6net_ident_error.c src/include/s6-networking/ident.h src/libs6net/s6net_ident_reply_get.o src/libs6net/s6net_ident_reply_get.lo: src/libs6net/s6net_ident_reply_get.c src/include/s6-networking/ident.h src/libs6net/s6net_ident_reply_parse.o src/libs6net/s6net_ident_reply_parse.lo: src/libs6net/s6net_ident_reply_parse.c src/include/s6-networking/ident.h src/minidentd/mgetuid-default.o src/minidentd/mgetuid-default.lo: src/minidentd/mgetuid-default.c src/minidentd/mgetuid.h src/minidentd/mgetuid-linux.o src/minidentd/mgetuid-linux.lo: src/minidentd/mgetuid-linux.c src/minidentd/mgetuid.h src/minidentd/minidentd.o src/minidentd/minidentd.lo: src/minidentd/minidentd.c src/minidentd/mgetuid.h src/sbearssl/sbearssl_append.o src/sbearssl/sbearssl_append.lo: src/sbearssl/sbearssl_append.c src/sbearssl/sbearssl-internal.h src/sbearssl/sbearssl_cert_from.o src/sbearssl/sbearssl_cert_from.lo: src/sbearssl/sbearssl_cert_from.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_cert_readbigpem.o src/sbearssl/sbearssl_cert_readbigpem.lo: src/sbearssl/sbearssl_cert_readbigpem.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_cert_readfile.o src/sbearssl/sbearssl_cert_readfile.lo: src/sbearssl/sbearssl_cert_readfile.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_cert_to.o src/sbearssl/sbearssl_cert_to.lo: src/sbearssl/sbearssl_cert_to.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_ec_issuer_keytype.o src/sbearssl/sbearssl_ec_issuer_keytype.lo: src/sbearssl/sbearssl_ec_issuer_keytype.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl-internal.h src/sbearssl/sbearssl_ec_pkey_from.o src/sbearssl/sbearssl_ec_pkey_from.lo: src/sbearssl/sbearssl_ec_pkey_from.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_ec_pkey_to.o src/sbearssl/sbearssl_ec_pkey_to.lo: src/sbearssl/sbearssl_ec_pkey_to.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_ec_skey_from.o src/sbearssl/sbearssl_ec_skey_from.lo: src/sbearssl/sbearssl_ec_skey_from.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_ec_skey_to.o src/sbearssl/sbearssl_ec_skey_to.lo: src/sbearssl/sbearssl_ec_skey_to.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_error_str.o src/sbearssl/sbearssl_error_str.lo: src/sbearssl/sbearssl_error_str.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_isder.o src/sbearssl/sbearssl_isder.lo: src/sbearssl/sbearssl_isder.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_pem_decode_from_buffer.o src/sbearssl/sbearssl_pem_decode_from_buffer.lo: src/sbearssl/sbearssl_pem_decode_from_buffer.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl-internal.h src/sbearssl/sbearssl_pem_decode_from_string.o src/sbearssl/sbearssl_pem_decode_from_string.lo: src/sbearssl/sbearssl_pem_decode_from_string.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl-internal.h src/sbearssl/sbearssl_pem_push.o src/sbearssl/sbearssl_pem_push.lo: src/sbearssl/sbearssl_pem_push.c src/sbearssl/sbearssl-internal.h src/sbearssl/sbearssl_pkey_from.o src/sbearssl/sbearssl_pkey_from.lo: src/sbearssl/sbearssl_pkey_from.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_pkey_to.o src/sbearssl/sbearssl_pkey_to.lo: src/sbearssl/sbearssl_pkey_to.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_prep_spawn_drop.o src/sbearssl/sbearssl_prep_spawn_drop.lo: src/sbearssl/sbearssl_prep_spawn_drop.c src/sbearssl/sbearssl-internal.h src/sbearssl/sbearssl_rsa_pkey_from.o src/sbearssl/sbearssl_rsa_pkey_from.lo: src/sbearssl/sbearssl_rsa_pkey_from.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_rsa_pkey_to.o src/sbearssl/sbearssl_rsa_pkey_to.lo: src/sbearssl/sbearssl_rsa_pkey_to.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_rsa_skey_from.o src/sbearssl/sbearssl_rsa_skey_from.lo: src/sbearssl/sbearssl_rsa_skey_from.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_rsa_skey_to.o src/sbearssl/sbearssl_rsa_skey_to.lo: src/sbearssl/sbearssl_rsa_skey_to.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_run.o src/sbearssl/sbearssl_run.lo: src/sbearssl/sbearssl_run.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_s6tlsc.o src/sbearssl/sbearssl_s6tlsc.lo: src/sbearssl/sbearssl_s6tlsc.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl-internal.h src/sbearssl/sbearssl_s6tlsd.o src/sbearssl/sbearssl_s6tlsd.lo: src/sbearssl/sbearssl_s6tlsd.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl-internal.h src/sbearssl/sbearssl_skey_from.o src/sbearssl/sbearssl_skey_from.lo: src/sbearssl/sbearssl_skey_from.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_skey_readfile.o src/sbearssl/sbearssl_skey_readfile.lo: src/sbearssl/sbearssl_skey_readfile.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_skey_to.o src/sbearssl/sbearssl_skey_to.lo: src/sbearssl/sbearssl_skey_to.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_ta_cert.o src/sbearssl/sbearssl_ta_cert.lo: src/sbearssl/sbearssl_ta_cert.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl-internal.h src/sbearssl/sbearssl_ta_certs.o src/sbearssl/sbearssl_ta_certs.lo: src/sbearssl/sbearssl_ta_certs.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_ta_from.o src/sbearssl/sbearssl_ta_from.lo: src/sbearssl/sbearssl_ta_from.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_ta_readdir.o src/sbearssl/sbearssl_ta_readdir.lo: src/sbearssl/sbearssl_ta_readdir.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_ta_readfile.o src/sbearssl/sbearssl_ta_readfile.lo: src/sbearssl/sbearssl_ta_readfile.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_ta_to.o src/sbearssl/sbearssl_ta_to.lo: src/sbearssl/sbearssl_ta_to.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_x500_from_ta.o src/sbearssl/sbearssl_x500_from_ta.lo: src/sbearssl/sbearssl_x500_from_ta.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_x500_name_len.o src/sbearssl/sbearssl_x500_name_len.lo: src/sbearssl/sbearssl_x500_name_len.c src/include/s6-networking/sbearssl.h src/sbearssl/sbearssl_x509_minimal_set_tai.o src/sbearssl/sbearssl_x509_minimal_set_tai.lo: src/sbearssl/sbearssl_x509_minimal_set_tai.c src/include/s6-networking/sbearssl.h src/stls/stls_prep_spawn_drop.o src/stls/stls_prep_spawn_drop.lo: src/stls/stls_prep_spawn_drop.c src/stls/stls-internal.h src/stls/stls_run.o src/stls/stls_run.lo: src/stls/stls_run.c src/include/s6-networking/stls.h src/stls/stls_s6tlsc.o src/stls/stls_s6tlsc.lo: src/stls/stls_s6tlsc.c src/include/s6-networking/stls.h src/stls/stls-internal.h src/stls/stls_s6tlsd.o src/stls/stls_s6tlsd.lo: src/stls/stls_s6tlsd.c src/include/s6-networking/stls.h src/stls/stls-internal.h s6-clockadd: EXTRA_LIBS := -lskarnet ${SYSCLOCK_LIB} s6-clockadd: src/clock/s6-clockadd.o s6-clockview: EXTRA_LIBS := -lskarnet ${SYSCLOCK_LIB} s6-clockview: src/clock/s6-clockview.o s6-sntpclock: EXTRA_LIBS := -lskarnet ${SOCKET_LIB} ${SYSCLOCK_LIB} s6-sntpclock: src/clock/s6-sntpclock.o s6-taiclock: EXTRA_LIBS := -lskarnet ${SOCKET_LIB} ${SYSCLOCK_LIB} s6-taiclock: src/clock/s6-taiclock.o s6-taiclockd: EXTRA_LIBS := -lskarnet ${SOCKET_LIB} ${SYSCLOCK_LIB} s6-taiclockd: src/clock/s6-taiclockd.o s6-getservbyname: EXTRA_LIBS := -lskarnet ${SOCKET_LIB} s6-getservbyname: src/conn-tools/s6-getservbyname.o s6-ident-client: EXTRA_LIBS := -lskarnet ${SOCKET_LIB} ${SYSCLOCK_LIB} s6-ident-client: src/conn-tools/s6-ident-client.o ${LIBS6NET} s6-tcpclient: EXTRA_LIBS := -ls6dns -lskarnet ${SOCKET_LIB} ${SYSCLOCK_LIB} s6-tcpclient: src/conn-tools/s6-tcpclient.o ${LIBS6NET} s6-tcpserver: EXTRA_LIBS := -lskarnet s6-tcpserver: src/conn-tools/s6-tcpserver.o s6-tcpserver-access: EXTRA_LIBS := -ls6dns -ls6 -lskarnet ${SOCKET_LIB} ${SYSCLOCK_LIB} s6-tcpserver-access: src/conn-tools/s6-tcpserver-access.o ${LIBS6NET} s6-tcpserver4: EXTRA_LIBS := -lskarnet ${SOCKET_LIB} s6-tcpserver4: src/conn-tools/s6-tcpserver4.o s6-tcpserver4-socketbinder: EXTRA_LIBS := -lskarnet ${SOCKET_LIB} s6-tcpserver4-socketbinder: src/conn-tools/s6-tcpserver4-socketbinder.o s6-tcpserver4d: EXTRA_LIBS := -lskarnet ${SOCKET_LIB} s6-tcpserver4d: src/conn-tools/s6-tcpserver4d.o s6-tcpserver6: EXTRA_LIBS := -lskarnet ${SOCKET_LIB} s6-tcpserver6: src/conn-tools/s6-tcpserver6.o s6-tcpserver6-socketbinder: EXTRA_LIBS := -lskarnet ${SOCKET_LIB} s6-tcpserver6-socketbinder: src/conn-tools/s6-tcpserver6-socketbinder.o s6-tcpserver6d: EXTRA_LIBS := -lskarnet ${SOCKET_LIB} s6-tcpserver6d: src/conn-tools/s6-tcpserver6d.o s6-tlsc: EXTRA_LIBS := -lskarnet ${CRYPTO_LIB} ${SOCKET_LIB} ${SPAWN_LIB} ${SYSCLOCK_LIB} s6-tlsc: src/conn-tools/s6-tlsc.o ${LIBCRYPTOSUPPORT} s6-tlsclient: EXTRA_LIBS := -lskarnet s6-tlsclient: src/conn-tools/s6-tlsclient.o s6-tlsd: EXTRA_LIBS := -lskarnet ${CRYPTO_LIB} ${SOCKET_LIB} ${SPAWN_LIB} ${SYSCLOCK_LIB} s6-tlsd: src/conn-tools/s6-tlsd.o ${LIBCRYPTOSUPPORT} s6-tlsserver: EXTRA_LIBS := -lskarnet s6-tlsserver: src/conn-tools/s6-tlsserver.o ifeq ($(strip $(STATIC_LIBS_ARE_PIC)),) libs6net.a.xyzzy: src/libs6net/s6net_ident_client.o src/libs6net/s6net_ident_reply_get.o src/libs6net/s6net_ident_reply_parse.o src/libs6net/s6net_ident_error.o else libs6net.a.xyzzy: src/libs6net/s6net_ident_client.lo src/libs6net/s6net_ident_reply_get.lo src/libs6net/s6net_ident_reply_parse.lo src/libs6net/s6net_ident_error.lo endif libs6net.so.xyzzy: EXTRA_LIBS := -lskarnet libs6net.so.xyzzy: src/libs6net/s6net_ident_client.lo src/libs6net/s6net_ident_reply_get.lo src/libs6net/s6net_ident_reply_parse.lo src/libs6net/s6net_ident_error.lo minidentd: EXTRA_LIBS := -lskarnet ${MAYBEPTHREAD_LIB} ${SOCKET_LIB} ${SYSCLOCK_LIB} minidentd: src/minidentd/minidentd.o src/minidentd/mgetuid.o ${LIBNSSS} ifeq ($(strip $(STATIC_LIBS_ARE_PIC)),) libsbearssl.a.xyzzy: src/sbearssl/sbearssl_append.o src/sbearssl/sbearssl_prep_spawn_drop.o src/sbearssl/sbearssl_cert_from.o src/sbearssl/sbearssl_cert_readbigpem.o src/sbearssl/sbearssl_cert_readfile.o src/sbearssl/sbearssl_cert_to.o src/sbearssl/sbearssl_ec_issuer_keytype.o src/sbearssl/sbearssl_ec_pkey_from.o src/sbearssl/sbearssl_ec_pkey_to.o src/sbearssl/sbearssl_ec_skey_from.o src/sbearssl/sbearssl_ec_skey_to.o src/sbearssl/sbearssl_error_str.o src/sbearssl/sbearssl_isder.o src/sbearssl/sbearssl_pem_decode_from_buffer.o src/sbearssl/sbearssl_pem_decode_from_string.o src/sbearssl/sbearssl_pem_push.o src/sbearssl/sbearssl_pkey_from.o src/sbearssl/sbearssl_pkey_to.o src/sbearssl/sbearssl_rsa_pkey_from.o src/sbearssl/sbearssl_rsa_pkey_to.o src/sbearssl/sbearssl_rsa_skey_from.o src/sbearssl/sbearssl_rsa_skey_to.o src/sbearssl/sbearssl_run.o src/sbearssl/sbearssl_skey_from.o src/sbearssl/sbearssl_skey_readfile.o src/sbearssl/sbearssl_skey_to.o src/sbearssl/sbearssl_ta_cert.o src/sbearssl/sbearssl_ta_certs.o src/sbearssl/sbearssl_ta_from.o src/sbearssl/sbearssl_ta_readdir.o src/sbearssl/sbearssl_ta_readfile.o src/sbearssl/sbearssl_ta_to.o src/sbearssl/sbearssl_x500_name_len.o src/sbearssl/sbearssl_x500_from_ta.o src/sbearssl/sbearssl_x509_minimal_set_tai.o src/sbearssl/sbearssl_s6tlsc.o src/sbearssl/sbearssl_s6tlsd.o else libsbearssl.a.xyzzy: src/sbearssl/sbearssl_append.lo src/sbearssl/sbearssl_prep_spawn_drop.lo src/sbearssl/sbearssl_cert_from.lo src/sbearssl/sbearssl_cert_readbigpem.lo src/sbearssl/sbearssl_cert_readfile.lo src/sbearssl/sbearssl_cert_to.lo src/sbearssl/sbearssl_ec_issuer_keytype.lo src/sbearssl/sbearssl_ec_pkey_from.lo src/sbearssl/sbearssl_ec_pkey_to.lo src/sbearssl/sbearssl_ec_skey_from.lo src/sbearssl/sbearssl_ec_skey_to.lo src/sbearssl/sbearssl_error_str.lo src/sbearssl/sbearssl_isder.lo src/sbearssl/sbearssl_pem_decode_from_buffer.lo src/sbearssl/sbearssl_pem_decode_from_string.lo src/sbearssl/sbearssl_pem_push.lo src/sbearssl/sbearssl_pkey_from.lo src/sbearssl/sbearssl_pkey_to.lo src/sbearssl/sbearssl_rsa_pkey_from.lo src/sbearssl/sbearssl_rsa_pkey_to.lo src/sbearssl/sbearssl_rsa_skey_from.lo src/sbearssl/sbearssl_rsa_skey_to.lo src/sbearssl/sbearssl_run.lo src/sbearssl/sbearssl_skey_from.lo src/sbearssl/sbearssl_skey_readfile.lo src/sbearssl/sbearssl_skey_to.lo src/sbearssl/sbearssl_ta_cert.lo src/sbearssl/sbearssl_ta_certs.lo src/sbearssl/sbearssl_ta_from.lo src/sbearssl/sbearssl_ta_readdir.lo src/sbearssl/sbearssl_ta_readfile.lo src/sbearssl/sbearssl_ta_to.lo src/sbearssl/sbearssl_x500_name_len.lo src/sbearssl/sbearssl_x500_from_ta.lo src/sbearssl/sbearssl_x509_minimal_set_tai.lo src/sbearssl/sbearssl_s6tlsc.lo src/sbearssl/sbearssl_s6tlsd.lo endif libsbearssl.so.xyzzy: EXTRA_LIBS := -lbearssl -lskarnet libsbearssl.so.xyzzy: src/sbearssl/sbearssl_append.lo src/sbearssl/sbearssl_prep_spawn_drop.lo src/sbearssl/sbearssl_cert_from.lo src/sbearssl/sbearssl_cert_readbigpem.lo src/sbearssl/sbearssl_cert_readfile.lo src/sbearssl/sbearssl_cert_to.lo src/sbearssl/sbearssl_ec_issuer_keytype.lo src/sbearssl/sbearssl_ec_pkey_from.lo src/sbearssl/sbearssl_ec_pkey_to.lo src/sbearssl/sbearssl_ec_skey_from.lo src/sbearssl/sbearssl_ec_skey_to.lo src/sbearssl/sbearssl_error_str.lo src/sbearssl/sbearssl_isder.lo src/sbearssl/sbearssl_pem_decode_from_buffer.lo src/sbearssl/sbearssl_pem_decode_from_string.lo src/sbearssl/sbearssl_pem_push.lo src/sbearssl/sbearssl_pkey_from.lo src/sbearssl/sbearssl_pkey_to.lo src/sbearssl/sbearssl_rsa_pkey_from.lo src/sbearssl/sbearssl_rsa_pkey_to.lo src/sbearssl/sbearssl_rsa_skey_from.lo src/sbearssl/sbearssl_rsa_skey_to.lo src/sbearssl/sbearssl_run.lo src/sbearssl/sbearssl_skey_from.lo src/sbearssl/sbearssl_skey_readfile.lo src/sbearssl/sbearssl_skey_to.lo src/sbearssl/sbearssl_ta_cert.lo src/sbearssl/sbearssl_ta_certs.lo src/sbearssl/sbearssl_ta_from.lo src/sbearssl/sbearssl_ta_readdir.lo src/sbearssl/sbearssl_ta_readfile.lo src/sbearssl/sbearssl_ta_to.lo src/sbearssl/sbearssl_x500_name_len.lo src/sbearssl/sbearssl_x500_from_ta.lo src/sbearssl/sbearssl_x509_minimal_set_tai.lo src/sbearssl/sbearssl_s6tlsc.lo src/sbearssl/sbearssl_s6tlsd.lo ifeq ($(strip $(STATIC_LIBS_ARE_PIC)),) libstls.a.xyzzy: src/stls/stls_prep_spawn_drop.o src/stls/stls_run.o src/stls/stls_s6tlsc.o src/stls/stls_s6tlsd.o else libstls.a.xyzzy: src/stls/stls_prep_spawn_drop.lo src/stls/stls_run.lo src/stls/stls_s6tlsc.lo src/stls/stls_s6tlsd.lo endif libstls.so.xyzzy: EXTRA_LIBS := -ltls -lskarnet libstls.so.xyzzy: src/stls/stls_prep_spawn_drop.lo src/stls/stls_run.lo src/stls/stls_s6tlsc.lo src/stls/stls_s6tlsd.lo s6-networking-2.3.1.1/package/deps-build0000644000000000000000000000016113336524273014633 0ustar /package/prog/skalibs /package/admin/nsss $usensss /package/admin/execline /package/admin/s6 /package/web/s6-dns s6-networking-2.3.1.1/package/targets.mak0000644000000000000000000000167113016150463015021 0ustar BIN_TARGETS := \ s6-getservbyname \ s6-ident-client \ s6-tcpclient \ s6-tcpserver \ s6-tcpserver4 \ s6-tcpserver4d \ s6-tcpserver4-socketbinder \ s6-tcpserver6 \ s6-tcpserver6d \ s6-tcpserver6-socketbinder \ s6-tcpserver-access \ s6-clockadd \ s6-clockview \ s6-sntpclock \ s6-taiclock \ s6-taiclockd \ minidentd LIBEXEC_TARGETS := LIB_DEFS := S6NET=s6net EXTRA_TARGETS := src/minidentd/mgetuid.c src/minidentd/mgetuid.c: src/minidentd/mgetuid-linux.c src/minidentd/mgetuid-default.c @if grep -q -iF -- -linux $(sysdeps)/target 2>/dev/null ; then \ ln -sf mgetuid-linux.c src/minidentd/mgetuid.c ; \ else \ ln -sf mgetuid-default.c src/minidentd/mgetuid.c ; \ fi ifneq ($(SSL_IMPL),) BIN_TARGETS += s6-tlsclient s6-tlsc s6-tlsserver s6-tlsd ifeq ($(SSL_IMPL),tls) LIB_DEFS += CRYPTOSUPPORT=stls CRYPTO_LIB := -ltls -lssl -lcrypto else ifeq ($(SSL_IMPL),bearssl) LIB_DEFS += CRYPTOSUPPORT=sbearssl CRYPTO_LIB := -lbearssl endif endif s6-networking-2.3.1.1/package/modes0000644000000000000000000000070113016150463013701 0ustar s6-getservbyname 0755 s6-ident-client 0755 s6-tcpclient 0755 s6-tcpserver4 0755 s6-tcpserver4d 0755 s6-tcpserver4-socketbinder 0755 s6-tcpserver6 0755 s6-tcpserver6d 0755 s6-tcpserver6-socketbinder 0755 s6-tcpserver 0755 s6-tcpserver-access 0755 s6-clockadd 0700 s6-clockview 0755 s6-sntpclock 0755 s6-taiclock 0755 s6-taiclockd 0755 minidentd 0755 s6-tlsclient 0755 s6-tlsc 0755 s6-tlsserver 0755 s6-tlsd 0755 s6-networking-2.3.1.1/package/info0000644000000000000000000000012413553361665013542 0ustar package=s6-networking version=2.3.1.1 category=net package_macro_name=S6_NETWORKING s6-networking-2.3.1.1/COPYING0000644000000000000000000000137013415644630012321 0ustar Copyright (c) 2011-2019 Laurent Bercot Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. s6-networking-2.3.1.1/configure0000755000000000000000000003511413553343654013205 0ustar #!/bin/sh cd `dirname "$0"` . package/info usage () { cat </dev/null 2>&1 && { echo "$1" ; return 0 ; } $1 EOF echo "$1" | sed -e "s/'/'\\\\''/g" -e "1s/^/'/" -e "\$s/\$/'/" -e "s#^'\([-[:alnum:]_,./:]*\)=\(.*\)\$#\1='\2#" -e "s|\*/|* /|g" } fail () { echo "$*" exit 1 } fnmatch () { eval "case \"\$2\" in $1) return 0 ;; *) return 1 ;; esac" } cmdexists () { type "$1" >/dev/null 2>&1 } trycc () { test -z "$CC_AUTO" && cmdexists "$1" && CC_AUTO="$*" } stripdir () { while eval "fnmatch '*/' \"\${$1}\"" ; do eval "$1=\${$1%/}" done } tryflag () { echo "Checking whether compiler accepts $2 ..." echo "typedef int x;" > "$tmpc" if $CC_AUTO $CPPFLAGS_AUTO $CPPFLAGS $CPPFLAGS_POST $CFLAGS_AUTO $CFLAGS $CFLAGS_POST "$2" -c -o /dev/null "$tmpc" >/dev/null 2>&1 ; then echo " ... yes" eval "$1=\"\${$1} \$2\"" eval "$1=\${$1# }" return 0 else echo " ... no" return 1 fi } tryldflag () { echo "Checking whether linker accepts $2 ..." echo "typedef int x;" > "$tmpc" if $CC_AUTO $CFLAGS_AUTO $CFLAGS $CFLAGS_POST $LDFLAGS_AUTO $LDFLAGS $LDFLAGS_POST -nostdlib "$2" -o /dev/null "$tmpc" >/dev/null 2>&1 ; then echo " ... yes" eval "$1=\"\${$1} \$2\"" eval "$1=\${$1# }" return 0 else echo " ... no" return 1 fi } # Actual script CC_AUTO= CPPFLAGS_AUTO="-D_POSIX_C_SOURCE=200809L -D_XOPEN_SOURCE=700 -iquote src/include-local -Isrc/include" CPPFLAGS_POST="$CPPFLAGS" CPPFLAGS= CFLAGS_AUTO="-pipe -Wall" CFLAGS_POST="$CFLAGS" CFLAGS=-O2 LDFLAGS_AUTO= LDFLAGS_POST="$LDFLAGS" LDFLAGS= LDFLAGS_NOSHARED= LDFLAGS_SHARED=-shared prefix= exec_prefix='$prefix' dynlibdir='$prefix/lib' libexecdir='$exec_prefix/libexec' bindir='$exec_prefix/bin' libdir='$prefix/lib/$package' includedir='$prefix/include' sysdeps='$prefix/lib/skalibs/sysdeps' manualsysdeps=false shared=false static=true allpic=true slashpackage=false abspath=false usensss=false sproot= home= exthome= allstatic=true evenmorestatic=false addincpath='' addlibspath='' addlibdpath='' vpaths='' vpathd='' build= ssl= for arg ; do case "$arg" in --help) usage ;; --prefix=*) prefix=${arg#*=} ;; --exec-prefix=*) exec_prefix=${arg#*=} ;; --dynlibdir=*) dynlibdir=${arg#*=} ;; --libexecdir=*) libexecdir=${arg#*=} ;; --bindir=*) bindir=${arg#*=} ;; --libdir=*) libdir=${arg#*=} ;; --includedir=*) includedir=${arg#*=} ;; --with-sysdeps=*) sysdeps=${arg#*=} manualsysdeps=true ;; --with-include=*) var=${arg#*=} ; stripdir var ; addincpath="$addincpath -I$var" ;; --with-lib=*) var=${arg#*=} ; stripdir var ; addlibspath="$addlibspath -L$var" ; vpaths="$vpaths $var" ;; --with-dynlib=*) var=${arg#*=} ; stripdir var ; addlibdpath="$addlibdpath -L$var" ; vpathd="$vpathd $var" ;; --enable-shared|--enable-shared=yes) shared=true ;; --disable-shared|--enable-shared=no) shared=false ;; --enable-static|--enable-static=yes) static=true ;; --disable-static|--enable-static=no) static=false ;; --enable-allstatic|--enable-allstatic=yes) allstatic=true ;; --disable-allstatic|--enable-allstatic=no) allstatic=false ; evenmorestatic=false ;; --enable-static-libc|--enable-static-libc=yes) allstatic=true ; evenmorestatic=true ;; --disable-static-libc|--enable-static-libc=no) evenmorestatic=false ;; --enable-all-pic|--enable-all-pic=yes) allpic=true ;; --disable-all-pic|--enable-all-pic=no) allpic=false ;; --enable-slashpackage=*) sproot=${arg#*=} ; slashpackage=true ; ;; --enable-slashpackage) sproot= ; slashpackage=true ;; --disable-slashpackage) sproot= ; slashpackage=false ;; --enable-absolute-paths|--enable-absolute-paths=yes) abspath=true ;; --disable-absolute-paths|--enable-absolute-paths=no) abspath=false ;; --enable-nsss|--enable-nsss=yes) usensss=true ;; --disable-nsss|--enable-nsss=no) usensss=false ;; --enable-ssl=libressl) ssl=tls ;; --enable-ssl=bearssl) ssl=bearssl ;; --disable-ssl|--enable-ssl=none) ssl= ;; --with-ssl-path=*) var=${arg#*=} ; stripdir var ; addincpath="$addincpath -I$var/include" ; addlibspath="$addlibspath -L$var/lib" ; vpaths="$vpaths $var/lib" ; addlibdpath="$addlibdpath -L$var/lib" ; vpathd="$vpathd $var/lib" ;; --enable-*|--disable-*|--with-*|--without-*|--*dir=*) ;; --host=*|--target=*) target=${arg#*=} ;; --build=*) build=${arg#*=} ;; -* ) echo "$0: unknown option $arg" ;; *=*) ;; *) target=$arg ;; esac done # Add /usr in the default default case if test -z "$prefix" ; then if test "$libdir" = '$prefix/lib/$package' ; then libdir=/usr/lib/$package fi if test "$includedir" = '$prefix/include' ; then includedir=/usr/include fi if test "$sysdeps" = '$prefix/lib/skalibs/sysdeps' ; then sysdeps=/usr/lib/skalibs/sysdeps fi fi # Expand installation directories stripdir prefix for i in exec_prefix dynlibdir libexecdir bindir libdir includedir sysdeps sproot ; do eval tmp=\${$i} eval $i=$tmp stripdir $i done # Get usable temp filenames i=0 set -C while : ; do i=$(($i+1)) tmpc="./tmp-configure-$$-$PPID-$i.c" tmpe="./tmp-configure-$$-$PPID-$i.tmp" 2>|/dev/null > "$tmpc" && break 2>|/dev/null > "$tmpe" && break test "$i" -gt 50 && fail "$0: cannot create temporary files" done set +C trap 'rm -f "$tmpc" "$tmpe"' EXIT ABRT INT QUIT TERM HUP # Set slashpackage values if $slashpackage ; then home=${sproot}/package/${category}/${package}-${version} exthome=${sproot}/package/${category}/${package} if $manualsysdeps ; then : else sysdeps=${sproot}/package/prog/skalibs/sysdeps fi extbinprefix=${exthome}/command dynlibdir=${home}/library.so bindir=${home}/command libdir=${home}/library libexecdir=$bindir includedir=${home}/include while read dep condvar ; do if test -n "$condvar" ; then eval "cond=$condvar" else cond=true fi if $cond ; then addincpath="$addincpath -I${sproot}${dep}/include" vpaths="$vpaths ${sproot}${dep}/library" addlibspath="$addlibspath -L${sproot}${dep}/library" vpathd="$vpathd ${sproot}${dep}/library.so" addlibdpath="$addlibdpath -L${sproot}${dep}/library.so" fi done < package/deps-build fi # Find a C compiler to use if test -n "$target" && test x${build} != x${target} ; then cross=${target}- else cross= fi echo "Checking for C compiler..." trycc ${CC} if test -n "$CC_AUTO" ; then b=`basename "$CC"` adjust_cross=false if test "$b" != "$CC" ; then adjust_cross=true echo "$0: warning: compiler $CC is declared with its own path. If it's not accessible via PATH, you will need to pass AR, RANLIB and STRIP make variables to the make invocation." 1>&2 fi if test -n "$cross" ; then if test "$b" = "${b##$cross}" ; then echo "$0: warning: compiler $CC is declared as a cross-compiler for target $target but does not start with prefix ${cross}" 1>&2 elif $adjust_cross ; then cross=`dirname "$CC"`/"$cross" fi fi fi trycc ${cross}gcc trycc ${cross}clang trycc ${cross}cc test -n "$CC_AUTO" || { echo "$0: cannot find a C compiler" ; exit 1 ; } echo " ... $CC_AUTO" echo "Checking whether C compiler works... " echo "typedef int x;" > "$tmpc" if $CC_AUTO $CPPFLAGS_AUTO $CPPFLAGS $CPPFLAGS_POST $CFLAGS_AUTO $CFLAGS $CFLAGS_POST -c -o /dev/null "$tmpc" 2>"$tmpe" ; then echo " ... yes" else echo " ... no. Compiler output follows:" cat < "$tmpe" exit 1 fi echo "Checking target system type..." if test -z "$target" ; then if test -n "$build" ; then target=$build ; else target=$($CC_AUTO -dumpmachine 2>/dev/null) || target=unknown fi fi echo " ... $target" if test ! -d $sysdeps || test ! -f $sysdeps/target ; then echo "$0: error: $sysdeps is not a valid sysdeps directory" exit 1 fi if [ "x$target" != "x$(cat $sysdeps/target)" ] ; then echo "$0: error: target $target does not match the contents of $sysdeps/target" exit 1 fi spawn_lib=$(cat $sysdeps/spawn.lib) socket_lib=$(cat $sysdeps/socket.lib) sysclock_lib=$(cat $sysdeps/sysclock.lib) timer_lib=$(cat $sysdeps/timer.lib) util_lib=$(cat $sysdeps/util.lib) if $allpic ; then tryflag CPPFLAGS_AUTO -fPIC fi tryflag CFLAGS_AUTO -std=c99 tryflag CFLAGS -fomit-frame-pointer tryflag CFLAGS_AUTO -fno-exceptions tryflag CFLAGS_AUTO -fno-unwind-tables tryflag CFLAGS_AUTO -fno-asynchronous-unwind-tables tryflag CFLAGS_AUTO -Wa,--noexecstack tryflag CFLAGS -fno-stack-protector tryflag CPPFLAGS_AUTO -Werror=implicit-function-declaration tryflag CPPFLAGS_AUTO -Werror=implicit-int tryflag CPPFLAGS_AUTO -Werror=pointer-sign tryflag CPPFLAGS_AUTO -Werror=pointer-arith tryflag CPPFLAGS_AUTO -Wno-unused-value tryflag CFLAGS_AUTO -ffunction-sections tryflag CFLAGS_AUTO -fdata-sections tryldflag LDFLAGS_AUTO -Wl,--sort-section=alignment tryldflag LDFLAGS_AUTO -Wl,--sort-common CPPFLAGS_AUTO="${CPPFLAGS_AUTO}${addincpath}" if $evenmorestatic ; then LDFLAGS_NOSHARED=-static fi if $shared ; then tryldflag LDFLAGS -Wl,--hash-style=both fi LDFLAGS_SHARED="${LDFLAGS_SHARED}${addlibdpath}" if $allstatic ; then LDFLAGS_NOSHARED="${LDFLAGS_NOSHARED}${addlibspath}" tryldflag LDFLAGS_NOSHARED -Wl,--gc-sections else LDFLAGS_NOSHARED="${LDFLAGS_NOSHARED}${addlibdpath}" fi if test -z "$vpaths" ; then while read dep ; do base=$(basename $dep) ; vpaths="$vpaths /usr/lib/$base" addlibspath="$addlibspath -L/usr/lib/$base" done < package/deps-build fi echo "Creating config.mak..." cmdline=$(quote "$0") for i ; do cmdline="$cmdline $(quote "$i")" ; done exec 3>&1 1>config.mak cat << EOF # This file was generated by: # $cmdline # Any changes made here will be lost if configure is re-run. target := $target package := $package prefix := $prefix exec_prefix := $exec_prefix dynlibdir := $dynlibdir libexecdir := $libexecdir bindir := $bindir libdir := $libdir includedir := $includedir sysdeps := $sysdeps slashpackage := $slashpackage sproot := $sproot version := $version home := $home exthome := $exthome SPAWN_LIB := ${spawn_lib} SOCKET_LIB := ${socket_lib} SYSCLOCK_LIB := ${sysclock_lib} TIMER_LIB := ${timer_lib} UTIL_LIB := ${util_lib} CC := $CC_AUTO CPPFLAGS_AUTO := $CPPFLAGS_AUTO CPPFLAGS := $CPPFLAGS $CPPFLAGS_POST CFLAGS_AUTO := $CFLAGS_AUTO CFLAGS := $CFLAGS $CFLAGS_POST LDFLAGS_AUTO := $LDFLAGS_AUTO LDFLAGS := $LDFLAGS $LDFLAGS_POST LDFLAGS_SHARED := $LDFLAGS_SHARED LDFLAGS_NOSHARED := $LDFLAGS_NOSHARED CROSS_COMPILE := $cross vpath lib%.a$vpaths vpath lib%.so$vpathd EOF if $allstatic ; then echo ".LIBPATTERNS := lib%.a" echo "DO_ALLSTATIC := 1" else echo ".LIBPATTERNS := lib%.so" fi if $static ; then echo "DO_STATIC := 1" else echo "DO_STATIC :=" fi if $shared ; then echo "DO_SHARED := 1" else echo "DO_SHARED :=" fi if $allpic ; then echo "STATIC_LIBS_ARE_PIC := 1" else echo "STATIC_LIBS_ARE_PIC :=" fi if $usensss ; then echo "LIBNSSS := -lnsss" echo "MAYBEPTHREAD_LIB := -lpthread" else echo "LIBNSSS :=" echo "MAYBEPTHREAD_LIB :=" fi if test -n $ssl ; then echo "SSL_IMPL := $ssl" else echo "SSL_IMPL :=" fi exec 1>&3 3>&- echo " ... done." echo "Creating src/include/${package}/config.h..." mkdir -p -m 0755 src/include/${package} exec 3>&1 1> src/include/${package}/config.h cat <&3 3>&- echo " ... done." s6-networking-2.3.1.1/tools/0002755000000000000000000000000013553363665012440 5ustar s6-networking-2.3.1.1/tools/install.sh0000755000000000000000000000167512365207173014443 0ustar #!/bin/sh usage() { echo "usage: $0 [-D] [-l] [-m mode] src dst" 1>&2 exit 1 } mkdirp=false symlink=false mode=0755 while getopts Dlm: name ; do case "$name" in D) mkdirp=true ;; l) symlink=true ;; m) mode=$OPTARG ;; ?) usage ;; esac done shift $(($OPTIND - 1)) test "$#" -eq 2 || usage src=$1 dst=$2 tmp="$dst.tmp.$$" case "$dst" in */) echo "$0: $dst ends in /" 1>&2 ; exit 1 ;; esac set -C set -e if $mkdirp ; then umask 022 case "$2" in */*) mkdir -p "${dst%/*}" ;; esac fi trap 'rm -f "$tmp"' EXIT INT QUIT TERM HUP umask 077 if $symlink ; then ln -s "$src" "$tmp" else cat < "$1" > "$tmp" chmod "$mode" "$tmp" fi mv -f "$tmp" "$dst" if test -d "$dst" ; then rm -f "$dst/$(basename $tmp)" if $symlink ; then mkdir "$tmp" ln -s "$src" "$tmp/$(basename $dst)" mv -f "$tmp/$(basename $dst)" "${dst%/*}" rmdir "$tmp" else echo "$0: $dst is a directory" 1>&2 exit 1 fi fi s6-networking-2.3.1.1/tools/gen-deps.sh0000755000000000000000000000474313553363665014507 0ustar #!/bin/sh -e . package/info echo '#' echo '# This file has been generated by tools/gen-deps.sh' echo '#' echo for dir in src/include/${package} src/* ; do for file in $(ls -1 $dir | grep -- \\.h$) ; do { grep -F -- "#include <${package}/" < ${dir}/$file | cut -d'<' -f2 | cut -d'>' -f1 ; grep -- '#include ".*\.h"' < ${dir}/$file | cut -d'"' -f2 } | sort -u | { deps= while read dep ; do if echo $dep | grep -q "^${package}/" ; then deps="$deps src/include/$dep" elif test -f "${dir}/$dep" ; then deps="$deps ${dir}/$dep" else deps="$deps src/include-local/$dep" fi done if test -n "$deps" ; then echo "${dir}/${file}:${deps}" fi } done done for dir in src/* ; do for file in $(ls -1 $dir | grep -- \\.c$) ; do { grep -F -- "#include <${package}/" < ${dir}/$file | cut -d'<' -f2 | cut -d'>' -f1 ; grep -- '#include ".*\.h"' < ${dir}/$file | cut -d'"' -f2 } | sort -u | { deps=" ${dir}/$file" while read dep ; do if echo $dep | grep -q "^${package}/" ; then deps="$deps src/include/$dep" elif test -f "${dir}/$dep" ; then deps="$deps ${dir}/$dep" else deps="$deps src/include-local/$dep" fi done o=$(echo $file | sed s/\\.c$/.o/) lo=$(echo $file | sed s/\\.c$/.lo/) echo "${dir}/${o} ${dir}/${lo}:${deps}" } done done echo for dir in $(ls -1 src | grep -v ^include) ; do for file in $(ls -1 src/$dir/deps-lib) ; do deps= libs= while read dep ; do if echo $dep | grep -q -e ^-l -e '^\${.*_LIB}' ; then libs="$libs $dep" else deps="$deps src/$dir/$dep" fi done < src/$dir/deps-lib/$file echo 'ifeq ($(strip $(STATIC_LIBS_ARE_PIC)),)' echo "lib${file}.a.xyzzy:$deps" echo else echo "lib${file}.a.xyzzy:$(echo "$deps" | sed 's/\.o/.lo/g')" echo endif echo "lib${file}.so.xyzzy: EXTRA_LIBS :=$libs" echo "lib${file}.so.xyzzy:$(echo "$deps" | sed 's/\.o/.lo/g')" done for file in $(ls -1 src/$dir/deps-exe) ; do deps= libs= while read dep ; do if echo $dep | grep -q -- \\.o$ ; then dep="src/$dir/$dep" fi if echo $dep | grep -q -e ^-l -e '^\${.*_LIB}' ; then libs="$libs $dep" else deps="$deps $dep" fi done < src/$dir/deps-exe/$file echo "$file: EXTRA_LIBS :=$libs" echo "$file: src/$dir/$file.o$deps" done done s6-networking-2.3.1.1/README.macosx0000644000000000000000000000025512376420466013444 0ustar This package will compile and run on Darwin (MacOS X), but the building of shared libraries is not supported. Make sure you use the --disable-shared option to configure. s6-networking-2.3.1.1/NEWS0000644000000000000000000000226213553361735011773 0ustar Changelog for s6-networking. In 2.3.1.1 ---------- - Bugfixes. In 2.3.1.0 ---------- - Adaptation to skalibs-2.9.0.0. In 2.3.0.4 ---------- - Compatibility with skalibs-2.8.0.0. - Conforming to the documentation, s6-tcpserver[46]d now prints its local port to stdout when it is ready, as a notification message. - Everything builds as PIC by default. In 2.3.0.3 ---------- - Compatibility with skalibs-2.7.0.0. - Optional nsss support added. In 2.3.0.2 ---------- - Bugfix release. - Compatibility with skalibs-2.6.0.0. In 2.3.0.1 ---------- - Bugfix release. In 2.3.0.0 ---------- - Added this NEWS file. :) - Major types overhaul to make them more POSIXly correct: compatibility with skalibs-2.5.0.0. - Fixed the "s6-tls[cd] does not die and the zombie application hangs around" bug. (It's really a workaround for a TCP bug.) - s6-tls[cd] ported to bearssl-0.3. Client certificates still not supported with BearSSL because Thomas is slooooooow at implementing the high-level server functions I asked him for :P - The meaning of the -Y option in s6-tlsd has changed: it now means "ask for an optional client certificate". Only valid with a LibreSSL backend for now. s6-networking-2.3.1.1/Makefile0000644000000000000000000001125513515356574012741 0ustar # # This Makefile requires GNU make. # # Do not make changes here. # Use the included .mak files. # it: all make_need := 3.81 ifeq "" "$(strip $(filter $(make_need), $(firstword $(sort $(make_need) $(MAKE_VERSION)))))" fail := $(error Your make ($(MAKE_VERSION)) is too old. You need $(make_need) or newer) endif CC = $(error Please use ./configure first) STATIC_LIBS := SHARED_LIBS := INTERNAL_LIBS := EXTRA_TARGETS := LIB_DEFS := define library_definition LIB$(firstword $(subst =, ,$(1))) := lib$(lastword $(subst =, ,$(1))).$(if $(DO_ALLSTATIC),a,so).xyzzy ifdef DO_SHARED SHARED_LIBS += lib$(lastword $(subst =, ,$(1))).so.xyzzy endif ifdef DO_STATIC STATIC_LIBS += lib$(lastword $(subst =, ,$(1))).a.xyzzy endif endef -include config.mak include package/targets.mak $(foreach var,$(LIB_DEFS),$(eval $(call library_definition,$(var)))) include package/deps.mak version_m := $(basename $(version)) version_M := $(basename $(version_m)) version_l := $(basename $(version_M)) CPPFLAGS_ALL := $(CPPFLAGS_AUTO) $(CPPFLAGS) CFLAGS_ALL := $(CFLAGS_AUTO) $(CFLAGS) ifeq ($(strip $(STATIC_LIBS_ARE_PIC)),) CFLAGS_SHARED := -fPIC else CFLAGS_SHARED := endif LDFLAGS_ALL := $(LDFLAGS_AUTO) $(LDFLAGS) AR := $(CROSS_COMPILE)ar RANLIB := $(CROSS_COMPILE)ranlib STRIP := $(CROSS_COMPILE)strip INSTALL := ./tools/install.sh ALL_BINS := $(LIBEXEC_TARGETS) $(BIN_TARGETS) ALL_LIBS := $(SHARED_LIBS) $(STATIC_LIBS) $(INTERNAL_LIBS) ALL_INCLUDES := $(wildcard src/include/$(package)/*.h) all: $(ALL_LIBS) $(ALL_BINS) $(ALL_INCLUDES) clean: @exec rm -f $(ALL_LIBS) $(ALL_BINS) $(wildcard src/*/*.o src/*/*.lo) $(EXTRA_TARGETS) distclean: clean @exec rm -f config.mak src/include/$(package)/config.h tgz: distclean @. package/info && \ rm -rf /tmp/$$package-$$version && \ cp -a . /tmp/$$package-$$version && \ cd /tmp && \ tar -zpcv --owner=0 --group=0 --numeric-owner --exclude=.git* -f /tmp/$$package-$$version.tar.gz $$package-$$version && \ exec rm -rf /tmp/$$package-$$version strip: $(ALL_LIBS) $(ALL_BINS) ifneq ($(strip $(STATIC_LIBS)),) exec $(STRIP) -x -R .note -R .comment -R .note.GNU-stack $(STATIC_LIBS) endif ifneq ($(strip $(ALL_BINS)$(SHARED_LIBS)),) exec $(STRIP) -R .note -R .comment -R .note.GNU-stack $(ALL_BINS) $(SHARED_LIBS) endif install: install-dynlib install-libexec install-bin install-lib install-include install-dynlib: $(SHARED_LIBS:lib%.so.xyzzy=$(DESTDIR)$(dynlibdir)/lib%.so) install-libexec: $(LIBEXEC_TARGETS:%=$(DESTDIR)$(libexecdir)/%) install-bin: $(BIN_TARGETS:%=$(DESTDIR)$(bindir)/%) install-lib: $(STATIC_LIBS:lib%.a.xyzzy=$(DESTDIR)$(libdir)/lib%.a) install-include: $(ALL_INCLUDES:src/include/$(package)/%.h=$(DESTDIR)$(includedir)/$(package)/%.h) install-data: $(ALL_DATA:src/etc/%=$(DESTDIR)$(datadir)/%) ifneq ($(exthome),) $(DESTDIR)$(exthome): $(DESTDIR)$(home) exec $(INSTALL) -l $(notdir $(home)) $(DESTDIR)$(exthome) update: $(DESTDIR)$(exthome) global-links: $(DESTDIR)$(exthome) $(SHARED_LIBS:lib%.so.xyzzy=$(DESTDIR)$(sproot)/library.so/lib%.so.$(version_M)) $(BIN_TARGETS:%=$(DESTDIR)$(sproot)/command/%) $(DESTDIR)$(sproot)/command/%: $(DESTDIR)$(home)/command/% exec $(INSTALL) -D -l ..$(subst $(sproot),,$(exthome))/command/$( s6-networking: the s6-clockview program

s6-networking
Software
skarnet.org

The s6-clockview program

s6-clockview prints the time discrepancy between the local system clock and the time provided by a time server.

Interface 

     s6-taiclock server | s6-clockview
  • s6-clockview reads its stdin, expecting input from a program such s6-taiclock or s6-sntpclock (which get time from a time server).
  • It prints the local system time, and the time given by the server, in human-readable form, then exits 0.
s6-networking-2.3.1.1/doc/index.html0000644000000000000000000001514313553362054014033 0ustar s6-networking - small networking utilities

Software
www.skarnet.org

s6-networking

What is it ?

s6-networking is a suite of small networking utilities for Unix systems. It includes command-line client and server management, TCP access control, privilege escalation across UNIX domain sockets, IDENT protocol management and clock synchronization. Optionally, it also includes command-line TLS/SSL tools for secure communications.

If the underlying skalibs has been compiled with IPv6 support, s6-networking is IPv6-ready.

Installation

Requirements

  • A POSIX-compliant system with a standard C development environment
  • GNU make, version 3.81 or later
  • skalibs version 2.9.1.0 or later. It's a build-time requirement. It's also a run-time requirement if you link against the shared version of the skalibs library.
  • execline version 2.5.3.0 or later. It's a build-time and run-time requirement.
  • s6 version 2.9.0.1 or later. It's a build-time and run-time requirement.
  • s6-dns version 2.3.1.1 or later. It's a build-time requirement. It's also a run-time requirement if you link against the shared version of the s6-dns libraries.
  • If you want to build the secure communication tools:
    • Either LibreSSL version 2.9.2 or later
    • Or BearSSL version 0.6 or later. This is a beta version.
    The chosen library is a build-time requirement, and also a run-time requirement if you link against its shared version.

Licensing

s6-networking is free software. It is available under the ISC license.

Download

  • The current released version of s6-networking is 2.3.1.1.
  • Alternatively, you can checkout a copy of the s6-networking git repository: 
     git clone git://git.skarnet.org/s6-networking
  • There's also a GitHub mirror of the s6-networking git repository.

Compilation

  • See the enclosed INSTALL file for installation details.

Upgrade notes

  • This page lists the differences to be aware of between the previous versions of s6-networking and the current one.

Reference

Commands

All these commands exit 111 if they encounter a temporary error or hardware error, and 100 if they encounter a permanent error - such as a misuse. Short-lived commands exit 0 on success. Other exit codes are documented in the relevant page.

System clock synchronization

UCSPI TCP implementation

UCSPI tools for secure communication (TLS protocol) over TCP

TCP access control

IDENT protocol implementation

Miscellaneous utilities

Libraries

Related resources

s6-networking discussion

  • s6-networking is discussed on the skaware mailing-list.

Similar work

  • ucspi-tcp is the original inspiration for s6-networking. It works, but is unfortunately unmaintained by the author. s6-networking follows the same design principles.
  • ipsvd is a similar program suite.
s6-networking-2.3.1.1/doc/s6-tcpserver.html0000644000000000000000000000562313111013165015253 0ustar s6-networking: the s6-tcpserver program

s6-networking
Software
skarnet.org

The s6-tcpserver program

s6-tcpserver is an UCSPI tool for TCP connections, i.e. a super-server. It accepts connections from clients, and forks a program to handle each connection.

Interface 

     s6-tcpserver [ -q | -Q | -v ] [ -4 | -6 ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gidlist ] [ -g gid ] [ -u uid ] [ -U ] ip port prog...
  • s6-tcpserver executes into s6-tcpserver4 or s6-tcpserver6 depending on whether ip is an IPv4 or IPv6 address. It modifies some of its option syntax to match s6-tcpserver4 and s6-tcpserver6's.
  • s6-tcpserver4 or s6-tcpserver6 handles the connection itself.

Options

  • -q : be quiet. This is converted into -v 0 for s6-tcpserver4 or s6-tcpserver6.
  • -Q : be normally quiet. This is converted into -v 1 for s6-tcpserver4 or s6-tcpserver6. This is the default.
  • -v : be verbose. This is converted into -v 2 for s6-tcpserver4 or s6-tcpserver6.
  • -4 : IPv4 only. Interpret ip as IPv4; if it is invalid, exit 100.
  • -6 : IPv6 only. Interpret ip as IPv6; if it is invalid, exit 100. If neither the -4 nor the -6 option is given, s6-tcpserver will parse ip to determine its family.
  • Every other option is passed verbatim to s6-tcpserver4 or s6-tcpserver6.

Notes

  • s6-tcpserver executes either into s6-tcpserver4, which only serves IPv4, or into IPv6, which only serves IPv6. It will not bind to every available IP address of the machine whether they are v4 or v6; on the other hand, it can bind to every available IPv4 address (if ip is 0.0.0.0) or to every available IPv6 address (if ip is ::). Two instances of s6-tcpserver can cover every available address.
s6-networking-2.3.1.1/doc/s6-tcpserver6d.html0000644000000000000000000001041313417672043015515 0ustar s6-networking: the s6-tcpserver6d program

s6-networking
Software
skarnet.org

The s6-tcpserver6d program

s6-tcpserver6d is the serving part of the s6-tcpserver6 super-server. It assumes that its stdin is a bound and listening TCP/IPv6 socket, and it accepts connections from clients connecting to it, forking a program to handle each connection.

Interface 

     s6-tcpserver6d [ -1 ] [ -v verbosity ] [ -c maxconn ] [ -C localmaxconn ] prog...
  • s6-tcpserver6d accepts connections from clients to an already bound and listening TCP socket which is its standard input.
  • For every TCP connection to this socket, it forks. The child sets some environment variables, then executes prog... with stdin reading from the network socket and stdout writing to it.
  • Depending on the verbosity level, it logs what it does to stderr.
  • It runs until killed by a signal. Depending on the received signal, it may kill its children before exiting.

Environment variables

For each connection, an instance of prog... is spawned with the following variables set:

  • PROTO: always set to TCP
  • TCPREMOTEIP: set to the originating address
  • TCPREMOTEPORT: set to the originating port
  • TCPCONNNUM: set to the number of connections originating from the same IP address

Options

  • -1 : write a newline to stdout, and close stdout, right before entering the client-accepting loop. If stdout is suitably redirected, this can be used by monitoring programs to check when the server is accepting connections, for instance s6's readiness notification mechanism.
  • -v verbosity : be more or less verbose. By default, verbosity is 1: print warning messages to stderr. 0 means only print fatal error messages ; 2 means print status and connection information for every client.
  • -c maxconn : accept at most maxconn concurrent connections. Default is 40. It is impossible to set it higher than 1000.
  • -C localmaxconn : accept at most localmaxconn connections from the same IP address. Default is 40. It is impossible to set it higher than maxconn.

Signals

  • SIGTERM: exit.
  • SIGHUP: send a SIGTERM and a SIGCONT to all children.
  • SIGQUIT: send a SIGTERM and a SIGCONT to all children, then exit.
  • SIGABRT: send a SIGKILL to all children, then exit.

Notes

  • Unlike its ancestor tcpserver, s6-tcpserver6d performs just the bare minimum: the point is to have a very small and very fast process to serve connections with the least possible overhead. Features such as additional environment variables, access control and DNS resolution are provided via the s6-tcpserver-access program.
  • s6-tcpserver6d is meant to be execve'd into by a program that gets the listening socket. That program is normally s6-tcpserver6-socketbinder, which creates the socket itself; but it can be a different one if the socket is to be retrieved by another means, for instance by fd-passing from a fd-holding daemon (some people call this "socket activation").
s6-networking-2.3.1.1/doc/s6-tlsd.html0000644000000000000000000002425713111013165014210 0ustar s6-networking: the s6-tlsd program

s6-networking
Software
skarnet.org

The s6-tlsd program

s6-tlsd is a program that performs the server side of a TLS or SSL connection over an existing TCP connection, then spawns an application. It is meant to make network communications secure even for applications that do not natively support TLS/SSL.

s6-networking does not include cryptographic software. All the crypto used in s6-tlsd is provided by the chosen SSL backend: BearSSL or LibreSSL, depending on the options given when configuring s6-networking.

Interface 

     s6-tlsd [ -S | -s ] [ -Y | -y ] [ -Z | -z ] [ -v verbosity ] [ -K kimeout ] [ -- ] prog...
  • s6-tlsd expects to have an open TCP connection it can talk to on its stdin (for reading) and stdout (for writing).
  • It spawns prog... as a child process, interposing itself between it and the network. In other words: prog still reads cleartext on its stdin and writes cleartext on its stdout, but those will actually be pipes to s6-tlsd, which will read ciphertext from its own stdin (the network) and write ciphertext to its own stdout (the network).
  • It initiates the server side of a TLS/SSL handshake over the network connection, expecting a TLS/SSL client on the other side.
  • It manages the encryption/decryption of all the messages between prog and the client. prog speaks plaintext, but only ciphertext is sent on the network.
  • When prog exits, s6-tlsd exits.

Exit codes

  • 96: error while configuring the TLS/SSL context - for instance, invalid private key or server certificate files.
  • 97: error while setting up the TLS/SSL client engine.
  • 98: TLS/SSL error while running the engine.
  • 100: wrong usage.
  • 111: system call failed.

If the TLS/SSL connection closes cleanly, s6-tlsd waits for prog to exit, then exits with an approximation of prog's exit code.

Protocol version and parameters

During the TLS/SSL handshake, s6-tlsd tries the versions of the protocol that is supported by default by the backend, with the default algorithms and cipher suites; the backend normally ensures that the most secure combination is tried first, with slow degradation until the client and the server agree.

As a server, s6-tlsd can be conservative in its choice of protocols. It is currently not very conservative when using the BearSSL backend; it could become more so in the future, by defining a custom server profile that supports only TLS-1.2 but with several algorithms and cipher suites.

Environment variables

Read

s6-tlsd expects to have the following environment variables set:

  • KEYFILE: a path to the file containing the server's private key, DER- or PEM-encoded.
  • CERTFILE: a path to the file containing the server's certificate, DER- or PEM-encoded. If PEM-encoded, the file can actually contain a chain of certificates.

If one of those variables is unset, s6-tlsd will refuse to run.

If you are using client certificats, s6-tlsd also requires either one of the following variables to be set:

  • CADIR: a directory where trust anchors (i.e. root or intermediate CA certificates) can be found, one per file, DER- or PEM-encoded.
  • CAFILE: a file containing the whole set of trust anchors, PEM-encoded.

If s6-tlsd is run as root, it can also read two more environment variables, TLS_UID and TLS_GID, which contain a numeric uid and a numeric gid; s6-tlsd then drops its root privileges to this uid/gid after spawning prog.... This ensures that the TLS/engine and the application run with different privileges.

Note that prog... should drop its own root privileges by its own means: the s6-applyuidgid program is a way of doing it. If the s6-tlsd invocation actually comes from a s6-tlsserver command line, and privilege-dropping options (-G, -g, -u or -U) have been given to s6-tlsserver, then s6-applyuidgid directly follows s6-tlsd on the command line, in order to also drop the child's privileges before executing the application. The point of that setup is:

  • To read the private key file as root
  • To run the application as a non-root user
  • To run s6-tlsd as a different non-root user
  • That way, even if s6-tlsd, the application, or both, get compromised, the private key is still secure.

Written

Unless the -Z option has been given to s6-tlsd, prog... is run with all the TLS/SSL variables unset: CADIR, CAFILE, KEYFILE, CERTFILE, TLS_UID and TLS_GID. The goal is for s6-tlsd to be, by default, as invisible as possible.

SSL close handling

If prog initiates the end of the session by sending EOF, there are two ways for the TLS/SSL layer to handle it.

  • It can send a close_notify alert, and wait for an acknowledgement from the peer, at which point the connection is closed. The advantage of this setup is that it is secure even when the application protocol is not auto-terminated, i.e. when it does not know when its data stops. Old protocols such as HTTP-0.9 are in this case. The drawback of this setup is that it breaks full-duplex: once a peer has sent the close_notify, it must discard all the incoming records that are not a close_notify from the other peer. So if a client sends EOF while it is still receiving data from the server, the connection closes immediately and the data can be truncated.
  • It can simply transmit the EOF, shutting down half the TCP connection, and wait for the EOF back. The advantage of this setup is that it maintains full-duplex: a client can send EOF after its initial request, and still receive a complete answer from the server. The drawback is that it is insecure when the application protocol is not auto-terminated.

Nowadays (2017), most protocols are auto-terminated, so it is not dangerous anymore to use EOF tranmission, and that is the default for s6-tlsd. Nevertheless, by using the -S option, you can force it to use the close_notify method if your application requires it to be secure.

s6-tlsd options

  • -v verbosity : Be more or less verbose. Default for verbosity is 1. 0 is quiet, 2 is verbose, more than 2 is debug output. This option currently has no effect.
  • -Z : do not clean the environment of s6-tlsd-related variables before spawning prog....
  • -z : clean the environment of s6-tlsd-related variables before spawning prog.... This is the default.
  • -S : send a close_notify alert and break the connection when prog sends EOF.
  • -s : transmit EOF by half-closing the TCP connection without using close_notify. This is the default.
  • -Y : Require an optional client certificate.
  • -y : Require a mandatory client certificate. The default, with neither the -Y nor the -y option, is not to require a client certificate at all.
  • -K kimeout : close the connection if kimeout milliseconds elapse without any data being received from either side. The default is 0, which means infinite timeout (never kill the connection).

Notes

  • The goal of the s6-tlsd interface (and its client-side companion s6-tlsc) is to make it so that if you have a client, run by the command line client... that speaks a cleartext protocol to a server run by the command line server..., then if the server has the proper private key and certificate, and the client has the proper list of trust anchors, you can just change the client command line to s6-tlsc client... and the server command line to s6-tlsd server... without changing the client or the server themselves, and the communication between them will be secure.
s6-networking-2.3.1.1/doc/s6-tcpserver4d.html0000644000000000000000000001053513417671755015531 0ustar s6-networking: the s6-tcpserver4d program

s6-networking
Software
skarnet.org

The s6-tcpserver4d program

s6-tcpserver4d is the serving part of the s6-tcpserver4 super-server. It assumes that its stdin is a bound and listening TCP/IPv4 socket, and it accepts connections from clients connecting to it, forking a program to handle each connection.

Interface 

     s6-tcpserver4d [ -1 ] [ -v verbosity ] [ -c maxconn ] [ -C localmaxconn ] prog...
  • s6-tcpserver4d accepts connections from clients to an already bound and listening TCP socket which is its standard input.
  • For every TCP connection to this socket, it forks. The child sets some environment variables, then executes prog... with stdin reading from the network socket and stdout writing to it.
  • Depending on the verbosity level, it logs what it does to stderr.
  • It runs until killed by a signal. Depending on the received signal, it may kill its children before exiting.

Environment variables

For each connection, an instance of prog... is spawned with the following variables set:

  • PROTO: always set to TCP
  • TCPREMOTEIP: set to the originating address
  • TCPREMOTEPORT: set to the originating port
  • TCPCONNNUM: set to the number of connections originating from the same IP address

Options

  • -1 : write a newline to stdout, and close stdout, right before entering the client-accepting loop. If stdout is suitably redirected, this can be used by monitoring programs to check when the server is accepting connections. This can be used with s6's readiness notification mechanism to make sure subsequent services do not start before the server is ready.
  • -v verbosity : be more or less verbose. By default, verbosity is 1: print warning messages to stderr. 0 means only print fatal error messages ; 2 means print status and connection information for every client.
  • -c maxconn : accept at most maxconn concurrent connections. Default is 40. It is impossible to set it higher than 1000.
  • -C localmaxconn : accept at most localmaxconn connections from the same IP address. Default is 40. It is impossible to set it higher than maxconn.

Signals

  • SIGTERM: exit.
  • SIGHUP: send a SIGTERM and a SIGCONT to all children.
  • SIGQUIT: send a SIGTERM and a SIGCONT to all children, then exit.
  • SIGABRT: send a SIGKILL to all children, then exit.

Notes

  • Unlike its ancestor tcpserver, s6-tcpserver4d performs just the bare minimum: the point is to have a very small and very fast process to serve connections with the least possible overhead. Features such as additional environment variables, access control and DNS resolution are provided via the s6-tcpserver-access program.
  • s6-tcpserver4d is meant to be execve'd into by a program that gets the listening socket. That program is normally s6-tcpserver4-socketbinder, which creates the socket itself; but it can be a different one if the socket is to be retrieved by another means, for instance by fd-passing from a fd-holding daemon (some people call this "socket activation").
s6-networking-2.3.1.1/doc/s6-tcpserver4-socketbinder.html0000644000000000000000000000670113263422375020026 0ustar s6-networking: the s6-tcpserver4-socketbinder program

s6-networking
Software
skarnet.org

The s6-tcpserver4-socketbinder program

s6-tcpserver4-socketbinder binds an INET domain socket to an IPv4 address and port, then executes a program.

Interface 

     s6-tcpserver4-socketbinder [ -d | -D ] [ -b backlog ] [ -M | -m ] [ -B ] ip port prog...
  • s6-tcpserver4-socketbinder creates an TCP socket and binds it to IPv4 address ip, port port. It prepares the socket to accept connections by calling listen().
  • It then execs into prog... with the open socket as its standard input.

Options

  • -d : allow instant rebinding to the same IP and port even if it has been used not long ago - this is the SO_REUSEADDR flag to setsockopt() and is generally used with server programs. This is the default.
  • -D : disallow instant rebinding to the same path.
  • -b backlog : set a maximum of backlog backlog connections on the socket - extra connection attempts will rejected by the kernel. The default is SOMAXCONN, i.e. the maximum number allowed by the system. If backlog is 0, then the socket will be created, but it will not be listening.
  • -M : create a TCP socket. This is the default.
  • -m : create a UDP socket. Note that by default UDP sockets are not connection-mode, and listen() will fail - so you should always give the -b0 option to s6-tcpserver4-socketbinder along with -m.
  • -B : create a blocking socket. Default is non-blocking.

Notes

  • The socket is provided non-blocking by default.
  • s6-tcpserver4-socketbinder is part of a set of basic blocks used to build a flexible TCP/IPv4 super-server. It normally should be given a command line crafted to make it execute into s6-tcpserver4d to accept connections from clients, or into a program such as s6-applyuidgid to drop privileges before doing so.
  • The s6-tcpserver4 program does exactly this. It implements a full TCP/IPv4 super-server by building a command line starting with s6-tcpserver4-socketbinder and ending with s6-tcpserver4d followed by the application program, and executing into it.
s6-networking-2.3.1.1/doc/s6-tcpserver6-socketbinder.html0000644000000000000000000000670113263422435020025 0ustar s6-networking: the s6-tcpserver6-socketbinder program

s6-networking
Software
skarnet.org

The s6-tcpserver6-socketbinder program

s6-tcpserver6-socketbinder binds an INET domain socket to an IPv6 address and port, then executes a program.

Interface 

     s6-tcpserver6-socketbinder [ -d | -D ] [ -b backlog ] [ -M | -m ] [ -B ] ip port prog...
  • s6-tcpserver6-socketbinder creates an TCP socket and binds it to IPv6 address ip, port port. It prepares the socket to accept connections by calling listen().
  • It then execs into prog... with the open socket as its standard input.

Options

  • -d : allow instant rebinding to the same IP and port even if it has been used not long ago - this is the SO_REUSEADDR flag to setsockopt() and is generally used with server programs. This is the default.
  • -D : disallow instant rebinding to the same path.
  • -b backlog : set a maximum of backlog backlog connections on the socket - extra connection attempts will rejected by the kernel. The default is SOMAXCONN, i.e. the maximum number allowed by the system. If backlog is 0, then the socket will be created, but it will not be listening.
  • -M : create a TCP socket. This is the default.
  • -m : create a UDP socket. Note that by default UDP sockets are not connection-mode, and listen() will fail - so you should always give the -b0 option to s6-tcpserver6-socketbinder along with -m.
  • -B : create a blocking socket. Default is non-blocking.

Notes

  • The socket is provided non-blocking by default.
  • s6-tcpserver6-socketbinder is part of a set of basic blocks used to build a flexible TCP/IPv6 super-server. It normally should be given a command line crafted to make it execute into s6-tcpserver6d to accept connections from clients, or into a program such as s6-applyuidgid to drop privileges before doing so.
  • The s6-tcpserver6 program does exactly this. It implements a full TCP/IPv6 super-server by building a command line starting with s6-tcpserver6-socketbinder and ending with s6-tcpserver6d followed by the application program, and executing into it.
s6-networking-2.3.1.1/doc/libsbearssl/0000755000000000000000000000000013111013165014321 5ustar s6-networking-2.3.1.1/doc/libsbearssl/index.html0000644000000000000000000005523313541336262016343 0ustar s6-networking: the sbearssl library interface

s6-networking
Software
skarnet.org

The sbearssl library interface

General information

libsbearssl is a support library for the s6-tlsc and s6-tlsd executables when they're built against the BearSSL backend. Among other things, it offers interfaces to read private keys and certificates from a Unix filesystem, which BearSSL does not provide on its own.

Compiling

  • Make sure the s6-networking headers, as well as the skalibs headers, and the bearssl.h header, are visible in your header search path.
  • Use #include <s6-networking/sbearssl.h>

Linking

  • Make sure the s6-networking libraries, as well as the skalibs libraries, and the BearSSL libraries, are visible in your library search path.
  • Link against -lsbearssl, -lskarnet, -lbearssl, `cat $sysdeps/socket.lib`, `cat $sysdeps/spawn.lib`, and `cat $sysdeps/sysclock.lib`, where $sysdeps is your skalibs sysdeps directory.

Programming

General concepts

BearSSL provides engines to decode PEM objects and X.509 certificates, and to run a TLS/SSL connection. However, it does not store such objects: it never allocates memory, and does not interact with the filesystem. sbearssl provides functions to address this.

When reading an object into memory, sbearssl stores all the bytes of the object in a stralloc, and the sbearssl_* structures contain indices of bytes in that stralloc. That allows the structures to remain valid even when the stralloc contents get reallocated and move to some other place in the heap. After you have finished adding data to the stralloc and are sure its contents will not move again, you can use the sbearssl_*_to functions to convert sbearssl_* structures to the corresponding br_* structures (native BearSSL), which contain pointers to memory.

Private keys (typically for servers)

BearSSL handles two types of private keys: RSA keys and EC keys (i.e. points on an elliptic curve). sbearssl adds some generic functions to handle keys no matter their type.

int sbearssl_rsa_skey_from (sbearssl_rsa_skey *l, br_rsa_private_key const *k, stralloc *sa)

Converts the RSA private key from BearSSL format (reading from a structure pointed to by k) to sbearssl format (writing to a structure pointed to by l). The data from *k's contents are copied into the stralloc in *sa. The function returns 1 on success and 0 (and sets errno) on failure.

void sbearssl_rsa_skey_to (sbearssl_rsa_skey const *l, br_rsa_private_key *k, char *s)

Converts the RSA private key from sbearssl format (reading from a structure pointed to by l) to BearSSL format (writing to a structure pointed to by k). The indices in l must refer to data stored in the string s.

int sbearssl_ec_skey_from (sbearssl_ec_skey *l, br_ec_private_key const *k, stralloc *sa)

Converts the EC private key from BearSSL format (reading from a structure pointed to by k) to sbearssl format (writing to a structure pointed to by l). The data from *k's contents are copied into the stralloc in *sa. The function returns 1 on success and 0 (and sets errno) on failure.

void sbearssl_ec_skey_to (sbearssl_ec_skey const *l, br_ec_private_key *k, char *s)

Converts the EC private key from sbearssl format (reading from a structure pointed to by l) to BearSSL format (writing to a structure pointed to by k). The indices in l must refer to data stored in the string s.

int sbearssl_skey_from (sbearssl_skey *l, br_skey const *k, stralloc *sa)

Converts the private key from BearSSL format (reading from a structure pointed to by k) to sbearssl format (writing to a structure pointed to by l). The data from *k's contents are copied into the stralloc in *sa. The function returns 1 on success and 0 (and sets errno) on failure.

void sbearssl_skey_to (sbearssl_skey const *l, br_skey *k, char *s)

Converts the private key from sbearssl format (reading from a structure pointed to by l) to BearSSL format (writing to a structure pointed to by k). The indices in l must refer to data stored in the string s.

int sbearssl_skey_readfile (char const *fn, sbearssl_skey *key, stralloc *sa)

Reads a private key from the file named fn and stores it in sbearssl format into the structure in *key, the bytes of the key being added to the stralloc in *sa.

The private key in fn can be either DER-encoded (binary format) or PEM-encoded (text format).

The function returns 0 on success. It returns a negative value in case of a system error, in which case errno identifies the error. It returns a positive value in case of an error returned by a BearSSL decoder, in which case an appropriate message can be obtained with the sbearssl_error_str() function.

Public keys

BearSSL handles two types of public keys: RSA keys and EC keys (i.e. points on an elliptic curve). sbearssl adds some generic functions to handle keys no matter their type.

You normally should not handle public keys directly; you should handle x509 certificate chains instead.

int sbearssl_rsa_pkey_from (sbearssl_rsa_pkey *l, br_rsa_public_key const *k, stralloc *sa)

Converts the RSA public key from BearSSL format (reading from a structure pointed to by k) to sbearssl format (writing to a structure pointed to by l). The data from *k's contents are copied into the stralloc in *sa. The function returns 1 on success and 0 (and sets errno) on failure.

void sbearssl_rsa_pkey_to (sbearssl_rsa_pkey const *l, br_rsa_public_key *k, char *s)

Converts the RSA public key from sbearssl format (reading from a structure pointed to by l) to BearSSL format (writing to a structure pointed to by k). The indices in l must refer to data stored in the string s.

int sbearssl_ec_pkey_from (sbearssl_ec_skey *l, br_ec_public_key const *k, stralloc *sa)

Converts the EC public key from BearSSL format (reading from a structure pointed to by k) to sbearssl format (writing to a structure pointed to by l). The data from *k's contents are copied into the stralloc in *sa. The function returns 1 on success and 0 (and sets errno) on failure.

void sbearssl_ec_pkey_to (sbearssl_ec_pkey const *l, br_ec_public_key *k, char *s)

Converts the EC public key from sbearssl format (reading from a structure pointed to by l) to BearSSL format (writing to a structure pointed to by k). The indices in l must refer to data stored in the string s.

int sbearssl_pkey_from (sbearssl_pkey *l, br_x509_pkey const *k, stralloc *sa)

Converts the public key from BearSSL format (reading from a structure pointed to by k) to sbearssl format (writing to a structure pointed to by l). The data from *k's contents are copied into the stralloc in *sa. The function returns 1 on success and 0 (and sets errno) on failure.

void sbearssl_pkey_to (sbearssl_pkey const *l, br_x509_pkey *k, char *s)

Converts the public key from sbearssl format (reading from a structure pointed to by l) to BearSSL format (writing to a structure pointed to by k). The indices in l must refer to data stored in the string s.

Generic PEM objects

You normally should not have to call these functions directly. Instead, you should use the higher-level functions for private keys, X509 certificate chains and trust anchors, which will perform the PEM decoding for you.

int sbearssl_pem_decode_from_buffer (buffer *b, genalloc *list, stralloc *sa)

Decodes a PEM object, reading from the buffer in *b. The decoded bytes are appended to *sa. list points to a genalloc containing objects of type sbearssl_pemobject. One sbearssl_pemobject is appended to the genalloc per PEM entity decoded from the byte stream read from the buffer.

The function returns 0 on success. It returns a negative value in case of a system error, in which case errno identifies the error. It returns a positive value in case of an error returned by a BearSSL decoder, in which case an appropriate message can be obtained with the sbearssl_error_str() function.

int sbearssl_pem_decode_from_string (char const *s, size_t len, genalloc *list, stralloc *sa)

Decodes a PEM object from the len bytes pointed to by s. The decoded bytes are appended to *sa. list points to a genalloc containing objects of type sbearssl_pemobject. One sbearssl_pemobject is appended to the genalloc per PEM entity found in the bytes in s.

The function returns 0 on success. It returns a negative value in case of a system error, in which case errno identifies the error. It returns a positive value in case of an error returned by a BearSSL decoder, in which case an appropriate message can be obtained with the sbearssl_error_str() function.

X.509 certificates (typically for servers)

int sbearssl_cert_from (sbearssl_cert *l, br_x509_certificate const *k, stralloc *sa)

Converts a certificate from BearSSL format (reading from a structure pointed to by k) to sbearssl format (writing to a structure pointed to by l). The data from *k's contents are copied into the stralloc in *sa. The function returns 1 on success and 0 (and sets errno) on failure.

void sbearssl_cert_to (sbearssl_cert const *l, br_x509_certificate *k, char *s)

Converts a certificate from sbearssl format (reading from a structure pointed to by l) to BearSSL format (writing to a structure pointed to by k). The indices in l must refer to data stored in the string s.

int sbearssl_cert_readfile (char const *fn, genalloc *list, stralloc *sa)

Reads one or more certificates from the file named fn and appends them to the genalloc in *list, which is a dynamically growing list of sbearssl_cert structures. The bytes of the (maybe PEM-decoded, but still DER-encoded) certificate are appended to the stralloc in *sa.

The fn file can be either DER-encoded (binary format) or PEM-encoded (text format). If it is DER-encoded, it must contain exactly one X.509 certificate. If it is PEM-encoded, it may contain a chain of certificates as long as the PEM file fits within the size limits.

fn must not be bigger than SBEARSSL_MAXCERTFILESIZE, which is 8 kB. This function is meant to read individual certificates, not files containing large certificate chains or sets of trust anchors. To do that, use sbearssl_cert_readbigpem() instead.

The function returns 0 on success. It returns a negative value in case of a system error, in which case errno identifies the error. It returns a positive value in case of an error returned by a BearSSL decoder, in which case an appropriate message can be obtained with the sbearssl_error_str() function.

int sbearssl_cert_readbigpem (char const *fn, genalloc *, stralloc *sa)

Reads one or more PEM-encoded certificates from the file named fn and appends them to the genalloc in *list, which is a dynamically growing list of sbearssl_cert structures. The bytes of the PEM-decoded (but still DER-encoded) certificates are appended to the stralloc in *sa.

The function will refuse to read a file that is not valid PEM. Inside the file, It will ignore PEM objects that are not X.509 certificates.

The function returns 0 on success. It returns a negative value in case of a system error, in which case errno identifies the error. It returns a positive value in case of an error returned by a BearSSL decoder, in which case an appropriate message can be obtained with the sbearssl_error_str() function.

Trust anchors (typically for clients)

BearSSL clients do not use X.509-encoded certificates, they use sets of trust anchors, i.e. structures decoded from certificates representing (intermediate or) root CAs.

int sbearssl_ta_from (sbearssl_ta *l, br_x509_trust_anchor const *k, stralloc *sa)

Converts a trust anchor from BearSSL format (reading from a structure pointed to by k) to sbearssl format (writing to a structure pointed to by l). The data from *k's contents are copied into the stralloc in *sa. The function returns 1 on success and 0 (and sets errno) on failure.

void sbearssl_ta_to (sbearssl_ta const *l, br_x509_trust_anchor *k, char *s)

Converts a trust anchor from sbearssl format (reading from a structure pointed to by l) to BearSSL format (writing to a structure pointed to by k). The indices in l must refer to data stored in the string s.

int sbearssl_ta_readfile (char const *fn, genalloc *list, stralloc *sa)

Reads a set of trust anchors from a PEM file named fn which must contain a list of (intermediate or) root CA certificates. The trust anchors are appended to the genalloc in *list, which is a dynamically growing list of sbearssl_ta structures. The contents of the trust anchors are appended to *sa, which is a stralloc used for storage.

The function returns 0 on success. It returns a negative value in case of a system error, in which case errno identifies the error. It returns a positive value in case of an error returned by a BearSSL decoder, in which case an appropriate message can be obtained with the sbearssl_error_str() function.

int sbearssl_ta_readdir (char const *dir, genalloc *list, stralloc *sa)

Reads a set of trust anchors from a directory named dir, which must contain a list of (intermediate or) root CA certificates stored as individual DER- or PEM-encoded files. The trust anchors are appended to the genalloc in *list, which is a dynamically growing list of sbearssl_ta structures. The contents of the trust anchors are appended to *sa, which is a stralloc used for storage.

The function ignores files that do not contain valid DER or PEM objects containing X.509 certificates representing certification authorities.

The function returns 0 on success. It returns a negative value in case of a system error, in which case errno identifies the error. It returns a positive value in case of an error returned by a BearSSL decoder, in which case an appropriate message can be obtained with the sbearssl_error_str() function.

Miscellaneous utilities

You probably shouldn't need to call any of these functions directly, except for the first one.

char const *sbearssl_error_str (int err)

Returns a fixed string containing an error message corresponding to the err code, which must be non-negative. The return value from a few sbearssl functions, if positive, can be interpreted via this function.

int sbearssl_isder (unsigned char const *s, size_t len)

Tests whether the array of len bytes pointed to by s looks like a DER-encoded object. Returns 1 if it does and 0 otherwise.

int sbearssl_x509_minimal_set_tai (br_x509_minimal_context *ctx, tai_t t)

Sets the validation time for the X.509 context in *ctx to the absolute time contained in *t, which is a tai_t. Returns 1 if it succeeds, or 0 if it fails - probably because *t does not represent a valid time.

int sbearssl_x509_minimal_set_tain (br_x509_minimal_context *ctx, tain_t a)

Same as the above function, except the time is given as a tain_t, i.e. a tai_t plus nanoseconds (which are simply ignored).

Running the TLS/SSL engine (both clients and servers)

int sbearssl_run (br_ssl_engine_context *ctx, int *fds, pid_t pid, unsigned int verbosity, uint32_t options, tain_t const *tto)

This function runs a full-duplex TLS/SSL engine, reading/writing clear text from/to two file descriptors, and writing/reading ciphertext to/from two other file descriptors, until the connection is closed both ways (either with a SSL close, or with EOF) or a given subprocess dies.

  • ctx is a pointer to a fully initialized context, connected to fds[2] and fds[3]. The TLS/SSL handshake does not have to be completed.
  • fds is an array of 5 file descriptors, in this order: fd reading clear text, fd writing clear text, fd reading ciphertext, fd writing ciphertext, selfpipe.
  • pid is the pid of the application subprocess. When a SIGCHLD is detected on the selfpipe, the newly deceased process is reaped, and if it was pid, then the function returns as soon as it doesn't have anything left to write to the network peer.
  • verbosity defines the engine's verbosity: the higher the more verbose. This parameter is currently ignored.
  • options is a bitfield.
    • bit 0 tells the engine how to behave when the local application closes the connection (i.e. when the engine reads EOF on fds[0]). If the bit is clear, then the engine will perform as SSL close: it will send a SSL close_notify, and stop processing incoming records, waiting for a peer acknowledgement of the close_notify. If the bit is set, then the engine will not send a close_notify but simply transmit EOF to the peer, while continuing to process incoming records until it gets EOF back. close_notify is secure when handling protocols that are not auto-terminated (such as HTTP 0.9), but it does not permit separate closing of both ways. EOF allows full-duplex until the very end, but is insecure if the application protocol does not know in advance how many bytes it should get. Modern application protocols should all work with EOF.
  • tto is a pointer to a tain_t containing a relative time (i.e. a timeout) If *tto time elapses with no application data being exchanged, the engine will forcibly close the connection (with the method defined by options & 1). You can use &tain_infinite_relative as a value for tto if you don't want the engine to ever timeout.

sbearssl_run will make the process die with an appropriate error message if it encounters an unrecoverable error. If there were no problems and the SSL/TLS connection closed cleanly, it returns -1. If the application subprocess dies early, sbearssl_run returns the wstat for that subprocess, i.e. the integer containing the information about its exit code or crash signal. No matter how sbearssl_run returns, the first four descriptors in fds are closed, but the selfpipe is untouched and the caller should free ctx itself.

int sbearssl_s6tlsc (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity, char const *servername, int *sfd)

This function implements s6-tlsc on top of BearSSL. It has no other practical purpose; you're better off directly invoking s6-tlsc.

int sbearssl_s6tlsd (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity)

This function implements s6-tlsd on top of BearSSL. It has no other practical purpose; you're better off directly invoking s6-tlsd.

s6-networking-2.3.1.1/doc/s6-taiclockd.html0000644000000000000000000000317313111013156015171 0ustar s6-networking: the s6-taiclockd program

s6-networking
Software
skarnet.org

The s6-taiclockd program

s6-taiclockd is a server for the TAICLOCK protocol. It's a long-lived program listening to the network and answering to TAICLOCK clients such as s6-taiclock.

Interface 

     s6-taiclockd [ -i ip ] [ -p port ]
  • s6-taiclockd listens to all network addresses on UDP port 4014.
  • Whenever it receives a TAICLOCK request, it answers immediately with the TAI time given by its local system clock.
  • It runs until killed by a signal.

Options

  • -i ip : bind to ip instead of all available addresses. ip can be IPv4 or IPv6.
  • -p port : bind to port port instead of 4014.
s6-networking-2.3.1.1/doc/s6-tcpserver-access.html0000644000000000000000000002510113111013156016503 0ustar s6-networking: the s6-tcpserver-access program

s6-networking
Software
skarnet.org

The s6-tcpserver-access program

s6-tcpserver-access is a command-line TCP access control tool, and additionally performs some fine-tuning on a TCP socket. It is meant to be run after s6-tcpserver and before the application program on the s6-tcpserver command line, just like tcpwrappers' tcpd program.

Interface 

     s6-tcpserver-access [ -v verbosity ] [ -W | -w ] [ -D | -d ] [ -H | -h ] [ -R | -r ] [ -P | -p ] [ -l localname ] [ -B banner ] [ -t timeout ] [ -i rulesdir | -x rulesfile ] prog...
  • s6-tcpserver-access checks it is run under a UCSPI server tool such as s6-tcpserver, s6-tcpserver4 or s6-tcpserver6, or their stripped-down versions s6-tcpserver4d or s6-tcpserver6d.
  • It checks that the remote end of the connection fits the accepted criteria defined by the database contained in rulesdir or rulesfile. If the database tells it to reject the connection, the program exits 1.
  • It sets up a few additional environment variables.
  • It executes into prog..., unless the first matching rule in the rule database includes instructions to override prog....

Environment variables

s6-tcpserver-access expects to inherit some environment variables from its parent:

  • PROTO: normally TCP, but could be anything else, like SSL.
  • ${PROTO}REMOTEIP: the remote address of the socket, i.e. the client's IP address. This can be IPv4 or (if the underlying skalibs supports it) IPv6.
  • ${PROTO}REMOTEPORT: the remote port of the socket.

Additionally, it exports the following variables before executing into prog...:

  • ${PROTO}LOCALIP: set to the local address of the socket.
  • ${PROTO}LOCALPORT: set to the local port of the socket.
  • ${PROTO}REMOTEINFO: normally unset, but set to the information retrieved from ${PROTO}REMOTEIP via the IDENT protocol if the -r option has been given.
  • ${PROTO}REMOTEHOST: set to the remote host name obtained from a DNS lookup. Unset if the -H option has been given.
  • ${PROTO}LOCALHOST: set to the local host name obtained from a DNS lookup. If the -l option has been given, set to localname instead.

Also, the access rules database can instruct s6-tcpserver-access to set up, or unset, more environment variables, depending on the client address.

Options

  • -v verbosity : be more or less verbose, i.e. print more or less information to stderr:
    • 0: only log error messages.
    • 1: only log error and warning messages, and accepted connections. This is the default.
    • 2: also log rejected connections and more warning messages.
    • 3: also log detailed warning messages from DNS and IDENT resolution.
  • -W : non-fatal. If errors happen during DNS or IDENT resolution, the connection process is not aborted. However, incorrect or incomplete results might still prevent a legitimate connection from being authenticated against a DNS name. This is the default.
  • -w : fatal. Errors during DNS or IDENT resolution will drop the connection.
  • -D : disable Nagle's algorithm. Sets the TCP_NODELAY flag on the network socket.
  • -d : enable Nagle's algorithm. This is the default.
  • -H : disable DNS lookups for the ${PROTO}LOCALHOST and ${PROTO}REMOTEHOST environment variables.
  • -h : enable DNS lookups. This is the default.
  • -R : disable IDENT lookups for the ${PROTO}REMOTEINFO environment variable. This is the default.
  • -r : enable IDENT lookups. This should only be done for legacy programs that need it.
  • -P : no paranoid DNS lookups. This is the default.
  • -p : paranoid. After looking up a name for the remote host, s6-tcpserver-access will lookup IP addresses for this name, and drop the connection if none of the results matches the address the connection is originating from. Note that this still does not replace real authentication via a cryptographic protocol.
  • -l localname : use localname as the value for the ${PROTO}LOCALHOST environment variable, instead of looking it up in the DNS.
  • -B banner : print banner to the network as soon as the connection is attempted, even before checking client credentials. The point is to speed up network protocols that start with a server-side message.
  • -t timeout : set a timeout on all the operations performed by s6-tcpserver-access. If it is not able to do its job in timeout milliseconds, it will instantly exit 99. The default is 0, meaning no such timeout.
  • -i rulesdir : check client credentials against a filesystem-based database in the rulesdir directory.
  • -x rulesfile : check client credentials against a cdb database in the rulesfile file. -i and -x are mutually exclusive. If none of those options is given, no credential checking will be performed, and a warning will be emitted on every connection if verbosity is 2 or more.

Access rule checking

s6-tcpserver-access checks its client connection against a ruleset. This ruleset can be implemented:

  • either in the filesystem as an arborescence of directories and files, if the -i option has been given. This option is the most flexible one: the directory format is simple enough for scripts to understand and modify it, and the ruleset can be changed dynamically. This is practical, for instance, for roaming users.
  • or in a CDB file, if the -x option has been given. This option is the most efficient one if the ruleset is static enough: a lot less system calls are needed to perform searches in a CDB than in the filesystem.

The exact format of the ruleset is described on the s6-accessrules-cdb-from-fs page.

s6-tcpserver-access first gets the remote address ip of the client and converts it to canonical form. Then it checks it with the s6_accessrules_keycheck_ip46() function. In other words, it tries to match broader and broader network prefixes of ip, from ip4/ip_32 to ip4/0.0.0.0_0 if ip is v4, or from ip6/ip_128 to ip6/::_0 if ip is v6. If the result is:

  • S6_ACCESSRULES_ERROR: it immediately exits 111.
  • S6_ACCESSRULES_DENY: it immediately exits 1.
  • S6_ACCESSRULES_ALLOW: it grants access.
  • S6_ACCESSRULES_NOTFOUND: more information is needed.

    • In the last case, if DNS lookups have been deactivated (-H) then access is denied. But if s6-tcpserver-access is authorized to perform DNS lookups, then it gets the remote name of the client, remotehost, and checks it with the s6_accessrules_keycheck_reversedns() function. In other words, it tries to match shorter and shorter suffixes of remotehost, from reversedns/remotehost to reversedns/@. This time, the connection is denied is the result is anything else than S6_ACCESSRULES_ALLOW.

    Note that even if the access check succeeds, the connection can still be denied if paranoid mode has been requested (-p) and a forward DNS query on remotehost does not match ip.

    Environment and executable modifications

    s6-tcpserver-access interprets non-empty env subdirectories and exec files it finds in the matching rule of the ruleset, as explained in the s6-accessrules-cdb-from-fs page.

    • An env subdirectory is interpreted as if the s6-envdir command had been called before executing prog: the environment is modified according to the contents of env.
    • An exec file containing newprog completely bypasses the rest of s6-tcpserver-access' command line. After environment modifications, if any, s6-tcpserver-access execs into execlineb -c newprog.

    Notes

    • s6-tcpserver-access works with s6-tcpserver4d, handling IPv4 addresses, as well as s6-tcpserver6d, handling IPv6 addresses. It will automatically detect the remote address type and match it against the correct subdatabase.
    • s6-tcpserver-access may perform several DNS queries. For efficiency purposes, it does as many of them as possible in parallel. However, if asked to do an IDENT query, it does not parallelize it with DNS queries. Take that into account when estimating a proper timeout value.
    s6-networking-2.3.1.1/doc/s6-tcpclient.html0000644000000000000000000001360413111013156015221 0ustar s6-networking: the s6-tcpclient program

    s6-networking
    Software
    skarnet.org

    The s6-tcpclient program

    s6-tcpclient is an UCSPI client tool for INET domain sockets. It establishes a TCP connection to a server, then executes into a program.

    Interface 

         s6-tcpclient [ -q | -Q | -v ] [ -4 | -6 ] [ -d | -D ] [ -r | -R ] [ -h | -H ] [ -n | -N ] [ -t timeout ] [ -l localname ] [ -T timeoutconn ] [ -i localip ] [ -p localport ] host port prog...
    • s6-tcpclient establishes a TCP connection to host host port port.
    • It executes into prog... with descriptor 6 reading from the network and descriptor 7 writing to it.

    Host address determination

    • host may be an IP address, in which case s6-tcpclient will connect to that IP address. If the underlying skalibs has been compiled with IPv6 support, host can be an IPv6 address as well as an IPv4 one.
    • host may be a domain name, in which case a DNS resolution will be performed on it, and a connection will be tried to all the resulting IP addresses in a round-robin fashion, twice: first with a small timeout, then with a longer timeout. The first address to answer wins. The connection attempt fails if no address in the list is able to answer.

    Environment variables

    prog... is run with the following variables set:

    • PROTO: always set to TCP
    • TCPREMOTEIP: set to the chosen IP address of host.
    • TCPREMOTEPORT: set to port.
    • TCPREMOTEHOST: if the -H has been given, set to the name obtained by a reverse DNS resolution of the IP address chosen for host. Else unset.
    • TCPLOCALHOST: if the -l option has been given, set to localname. Else set to the name obtained by a reverse DNS resolution of the IP address chosen for the local host.
    • TCPREMOTEINFO: if the -r option has been given, set to the information given by an IDENT server on host about the current connection (very unreliable). Else unset.

    Options

    • -q : be quiet.
    • -Q : be normally verbose. This is the default.
    • -v : be verbose.
    • -4 : (only valid if the underlying skalibs has IPv6 support) Interpret host as an IPv4 address or make A queries to determine its addresses.
    • -6 : (only valid if the underlying skalibs has IPv6 support) Interpret host as an IPv6 address or make AAAA queries to determine its addresses. This option and the previous one are not mutually exclusive: if both are given, both IPv6 and IPv4 addresses will be tried and IPv6 addresses will be given priority. If neither option is given, only IPv4 address will be tried.
    • -d : don't use the TCP_NODELAY socket option. This is the default.
    • -D : use the TCP_NODELAY socket option, which disables Nagle's algorithm.
    • -r : try and obtain a TCPREMOTEINFO string via the IDENT protocol. This is obsolete and unreliable, and should only be used for compatibility with legacy programs.
    • -R : do not use the IDENT protocol. This is the default.
    • -h : try and obtain the remote host name via DNS. This is the default.
    • -H : do not try and obtain the remote host name via DNS.
    • -n : qualify host when resolving it to find suitable IP addresses. This is the default.
    • -N : do not qualify host.
    • -t :timeout : put a global timeout on the connection attempt. If no fully functional connection has been established after timeout seconds, abort the program. By default, timeout is 0, which means no timeout.
    • -i localip : use localip as the local socket address for the connection. By default, address selection is left to the operating system.
    • -p localport : use localport as the local socket port for the connection. By default, port selection is left to the operating system.
    • -l localname : use localname as the value of the TCPLOCALPATH environment variable instead of looking it up via the DNS.
    • -T :timeoutconn : configure the connection timeouts. timeoutconn must be of the form x+y, where x and y are integers. x is the first timeout and y is the second one: all suitable addresses for host are first tried with a timeout of x seconds, and if all of them fail, then they are tried again with a timeout of y seconds. (Be aware that the timeout specified with the -t option overrides everything.) By default, x is 2 and y is 58.
    s6-networking-2.3.1.1/doc/s6-clockadd.html0000644000000000000000000000362713111013156015004 0ustar s6-networking: the s6-clockadd program

    s6-networking
    Software
    skarnet.org

    The s6-clockadd program

    s6-clockadd adjusts the system clock depending on the input provided by a time client.

    Interface 

         s6-taiclock server | s6-clockadd [ -f ] [ -e errmax ]
    • s6-clockadd reads its stdin, expecting input from a program such s6-taiclock or s6-sntpclock (which get time from a time server).
    • It sets the system clock so the system time becomes the one given by the server. Then it exits 0.

    Options

    • -f : force. Normally, s6-clockadd exits 1 if the time discrepancy read from stdin is bigger than errmax milliseconds. If this option is set, it will print a warning message, but still set the system time and exit 0.
    • -e errmax : accept a maximum time discrepancy of errmax milliseconds. By default, errmax is 2000.

    Notes

    • s6-clockadd must be run as root. The client getting the time from a time server, however, does not have to.
    s6-networking-2.3.1.1/doc/libstls/0000755000000000000000000000000013111013156013470 5ustar s6-networking-2.3.1.1/doc/libstls/index.html0000644000000000000000000001360413541336242015504 0ustar s6-networking: the stls library interface

    s6-networking
    Software
    skarnet.org

    The stls library interface

    General information

    libstls is a small support library for the s6-tlsc and s6-tlsd executables when they're built against the LibreSSL backend. You can use it in your own programs, but since libtls is already relatively high-level, it's probably not very useful.

    Compiling

    • Make sure the s6-networking headers, as well as the skalibs headers, and the tls.h header, are visible in your header search path.
    • Use #include <s6-networking/stls.h>

    Linking

    • Make sure the s6-networking libraries, as well as the skalibs libraries, and the LibreSSL libraries, are visible in your library search path.
    • Link against -lstls, -lskarnet, -ltls, -lssl, -lcrypto, `cat $sysdeps/socket.lib`, `cat $sysdeps/spawn.lib`, and `cat $sysdeps/sysclock.lib`, where $sysdeps is your skalibs sysdeps directory.

    Programming

    Running the TLS/SSL engine

    int stls_run (struct tls *ctx, int *fds, pid_t pid, unsigned int verbosity, uint32_t options, tain_t const *tto)

    This function runs a full-duplex TLS/SSL engine, reading/writing clear text from/to two file descriptors, and writing/reading ciphertext to/from two other file descriptors, until the connection is closed both ways (either with a SSL close, or with EOF) or a given subprocess dies.

    • ctx is a pointer to a fully initialized context, connected to fds[2] and fds[3]. The TLS handshake must already be completed.
    • fds is an array of 5 file descriptors, in this order: fd reading clear text, fd writing clear text, fd reading ciphertext, fd writing ciphertext, selfpipe.
    • pid is the pid of the application subprocess. When a SIGCHLD is detected on the selfpipe, the newly deceased process is reaped, and if it was pid, then the function returns as soon as it doesn't have anything left to write to the network peer.
    • verbosity defines the engine's verbosity: the higher the more verbose. This parameter is currently ignored.
    • options is a bitfield.
      • bit 0 tells the engine how to behave when the local application closes the connection (i.e. when the engine reads EOF on fds[0]). If the bit is clear, then the engine will perform as SSL close: it will send a SSL close_notify, and stop processing incoming records, waiting for a peer acknowledgement of the close_notify. If the bit is set, then the engine will not send a close_notify but simply transmit EOF to the peer, while continuing to process incoming records until it gets EOF back. close_notify is secure when handling protocols that are not auto-terminated (such as HTTP 0.9), but it does not permit separate closing of both ways. EOF allows full-duplex until the very end, but is insecure if the application protocol does not know in advance how many bytes it should get. Modern application protocols should all work with EOF.
    • tto is a pointer to a tain_t containing a relative time (i.e. a timeout). If *tto time elapses with no application data being exchanged, the engine will forcibly close the connection (with the method defined by options & 1). You can use &tain_infinite_relative as a value for tto if you don't want the engine to ever timeout.

    stls_run will make the process die with an appropriate error message if it encounters an unrecoverable error. If there were no problems and the SSL/TLS connection closed cleanly, it returns -1. If the application subprocess dies early, stls_run returns the wstat for that subprocess, i.e. the integer containing the information about its exit code or crash signal. No matter how stls_run returns, the first four descriptors in fds are closed, but the selfpipe is untouched and the caller should free ctx itself.

    int stls_s6tlsc (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity, char const *servername, int *sfd)

    This function implements s6-tlsc on top of LibreSSL. It has no other practical purpose; you're better off directly invoking s6-tlsc.

    int stls_s6tlsd (char const *const *argv, char const *const *envp, tain_t const *tto, uint32_t preoptions, uint32_t options, uid_t uid, gid_t gid, unsigned int verbosity)

    This function implements s6-tlsd on top of LibreSSL. It has no other practical purpose; you're better off directly invoking s6-tlsd.

    s6-networking-2.3.1.1/doc/libs6net/0000755000000000000000000000000013111013156013542 5ustar s6-networking-2.3.1.1/doc/libs6net/index.html0000644000000000000000000000344113541336166015561 0ustar s6-networking: the s6net library interface

    s6-networking
    Software
    skarnet.org

    The s6net library interface

    General information

    libs6net is a collection of networking-related utility C interfaces, used in the s6-networking executables.

    Compiling

    • Make sure the s6-networking headers, as well as the skalibs headers, are visible in your header search path.
    • Use #include <s6-networking/s6net.h>

    Linking

    • Make sure the s6-networking libraries, as well as the skalibs libraries, are visible in your library search path.
    • Link against -ls6net, -lskarnet, `cat $sysdeps/socket.lib` and `cat $sysdeps/sysclock.lib`, $sysdeps being your skalibs sysdeps directory.

    Programming

    The s6-networking/s6net.h header is actually a concatenation of other headers: the libs6net is separated into several modules, each of them with its own header.

    s6-networking-2.3.1.1/doc/libs6net/ident.html0000644000000000000000000001105013111013156015530 0ustar s6-networking: the ident library interface

    libs6net
    s6-networking
    Software
    skarnet.org

    The ident library interface

    The following functions and structures are declared in the s6-networking/ident.h header, and implemented in the libs6net.a or libs6net.so library.

    General information

    ident provides a C IDENT client, following RFC 1413.

    Please note that this protocol is of historical interest exclusively; this client, as well as the minidentd server, is only provided for convenience and interoperability with legacy systems. The IDENT protocol absolutely cannot be relied on for any kind of authentication or secure operation.

    Functions

    Check the s6-networking/ident.h header for the exact function prototypes.

    Main interface

    ssize_t s6net_ident_client (char *s, size_t max, ip46_t const *remoteip, uint16_t remoteport, ip46_t const *localip, uint16_t localport, tain_t const *deadline, tain_t *stamp)

    Makes an IDENT request to a server listening on IP remoteip port 113 about the connection from IP remoteip port remoteport to IP localip port localport. Writes the answer into preallocated string s of max length max, and returns the number of bytes in the answer.

    • An ip46_t is a structure holding either an IPv4 address or an IPv6 address.
    • If an error occurs, the function returns -1 and sets errno to a suitable value. If no answer can be gotten from the server, the function returns 0 and sets errno to a suitable value.
    • If max is too small for s to hold the answer, the function returns -1 ENAMETOOLONG. This can be avoided by using S6NET_IDENT_REPLY_SIZE as max.
    • Negative answers are mapped to errno in the following way:
      • INVALID-PORT is reported as EINVAL
      • NO-USER is reported as ESRCH
      • HIDDEN-USER is reported as EPERM
      • UNKNOWN-ERROR is reported as EIO
      • extended error codes are reported as EEXIST
    • *deadline and *stamp are absolute dates: *stamp must be an accurate enough approximation of the current time, and is automatically updated when the function returns. If no answer has been gotten from the server by *deadline, then the call is aborted and returns -1 ETIMEDOUT.

    char const *s6net_ident_error_str (int e)

    Maps an error code representing a negative answer (i.e. errno when s6net_ident_client returned 0) to a suitable string.

    Low-level functions

    ssize_t s6net_ident_reply_get (char *s, ip46_t const *ra, uint16_t rp, ip46_t const *la, uint16_t lp, tain_t const *deadline, tain_t *stamp)

    The network part of s6net_ident_client. Connects to *ra:113 and asks the server about (*ra:rp, *la:lp), aborting if *deadline goes by. Writes the server answer into s; at least S6NET_IDENT_REPLY_SIZE bytes must be preallocated in s. Returns -1 if an error occurs, or the number of bytes written into s.

    ssize_t s6net_ident_reply_parse (char const *s, uint16_t rp, uint16_t lp)

    The local part of s6net_ident_client. Parses the server answer in s for the connection from port rp to port lp. Returns -1 EPROTO if the answer does not make sense, 0 if the answer is negative, or a positive number if the answer is positive. This number is an index where the ID can be found in s.

    s6-networking-2.3.1.1/doc/s6-tlsclient.html0000644000000000000000000001175413111013156015241 0ustar s6-networking: the s6-tlsclient program

    s6-networking
    Software
    skarnet.org

    The s6-tlsclient program

    s6-tlsclient is an UCSPI client tool for TLS/SSL connections over INET domain sockets. It establishes a TCP connection to a server and a TLS transport over it, then executes into a program.

    Interface 

         s6-tlsclient [ options ] [ -- ] host port prog...
    • s6-tlsclient rewrites itself into a command line involving:
      • s6-tcpclient, which establishes a TCP connection to host host port port.
      • s6-tlsc, which establishes a TLS transport (client-side) over that connection.
      • prog..., your client program, which is run as a child of s6-tlsc.
    • It runs until the connection closes.
    • It exits either with a s6-tlsc error code (and error message), or with an approximation of prog's exit code.

    prog is expected to read from its peer on descriptor 6 and write to its peer on descriptor 7. Since there will be a s6-tlsc program between prog and the network to perform the SSL encryption/decryption, those descriptors will not be a network socket - they will be pipes.

    Server name determination for SNI

    If the -H option is not given to s6-tlsclient, then host will be used as the server name to verify. You can use the -k option to override this default. Please note that if you use the -H option and do not provide a server name via -k, SNI will not be used, which may be a security risk.

    Environment variables

    Read

    The following variables should be set before invoking s6-tlsclient, because they will be used by s6-tlsc:

    • CADIR
    • CAFILE (alternative to CADIR)
    • KEYFILE (if you're using a client certificate)
    • CERTFILE (if you're using a client certificate)
    • TLS_UID and TLS_GID (if you run s6-tlsclient as root)

    Setting either CADIR or CAFILE is mandatory.

    Written

    prog... is run with the following variables added to, or removed from, its environment by s6-tcpclient:

    • PROTO
    • TCPREMOTEIP
    • TCPREMOTEPORT
    • TCPREMOTEHOST
    • TCPLOCALHOST
    • TCPREMOTEINFO

    Unless the -Z option is given to s6-tlsclient, the CADIR, CAFILE, KEYFILE, CERTFILE, TLS_UID and TLS_GID variables will not appear in prog's environment.

    Options

    s6-tlsclient accepts a myriad of options, most of which are passed as is to the correct executable. Not giving any options will generally work: the defaults are sensible.

    Options passed as is to s6-tcpclient

    • -q, -Q, -v
    • -4, -6
    • -d, -D
    • -r, -R
    • -h, -H, -l localname
    • -n, -N
    • -t timeout
    • -i localip, -p localport
    • -T timeoutconn

    Options passed as is to s6-tlsc

    • -Z, -z
    • -S, -s
    • -Y, -y
    • -k servername
    • -K kimeout

    Example

    CADIR=/etc/ssl/certs s6-tlsclient skarnet.org 443 s6-ioconnect

    This will open a connection to the skarnet.org web server over TLS and verify its certificate via the trust anchors listed in the /etc/ssl/certs directory. It will then branch your terminal to it: try typing GET / HTTP/1.0 then hitting return twice.

    s6-networking-2.3.1.1/doc/upgrade.html0000644000000000000000000001524713553362133014356 0ustar s6-networking: how to upgrade

    s6-networking
    Software
    skarnet.org

    What has changed in s6-networking

    in 2.3.1.1

    • skalibs dependency bumped to 2.9.1.0.
    • execline dependency bumped to 2.5.3.0.
    • s6 dependency bumped to 2.9.0.1.
    • s6-dns dependency bumped to 2.3.1.1.

    in 2.3.1.0

    • LibreSSL dependency bumped to 2.9.2.
    • skalibs dependency bumped to 2.9.0.0.
    • execline dependency bumped to 2.5.2.0.
    • s6 dependency bumped to 2.9.0.0.
    • s6-dns dependency bumped to 2.3.1.0.

    in 2.3.0.4

    • BearSSL dependency bumped to 0.6.
    • skalibs dependency bumped to 2.8.0.0.
    • execline dependency bumped to 2.5.1.0.
    • s6 dependency bumped to 2.8.0.0.
    • s6-dns dependency bumped to 2.3.0.2.
    • Everything now builds as PIC by default no matter the toolchain's settings. Use the --disable-all-pic configure option to build executables and static libraries as non-PIC.

    in 2.3.0.3

    • Optional nsss support added.
    • LibreSSL dependency bumped to 2.7.4.
    • skalibs dependency bumped to 2.7.0.0.
    • execline dependency bumped to 2.5.0.1.
    • s6 dependency bumped to 2.7.2.0.
    • s6-dns dependency bumped to 2.3.0.1.

    in 2.3.0.2

    • BearSSL dependency bumped to 0.5.
    • skalibs dependency bumped to 2.6.0.0.
    • execline dependency bumped to 2.3.0.2.
    • s6 dependency bumped to 2.6.1.0.
    • s6-dns dependency bumped to 2.2.0.1.

    in 2.3.0.1

    • BearSSL dependency bumped to 0.4.
    • skalibs dependency bumped to 2.5.1.0.
    • execline dependency bumped to 2.3.0.1.
    • s6 dependency bumped to 2.5.1.0.

    in 2.3.0.0

    • LibreSSL dependency bumped to 2.4.5.
    • BearSSL dependency bumped to 0.3.
    • skalibs dependency bumped to 2.5.0.0.
    • execline dependency bumped to 2.3.0.0.
    • s6 dependency bumped to 2.5.0.0.
    • s6-dns dependency bumped to 2.2.0.0.
    • The meaning of the -Y option in s6-tlsd has changed. Now it means "ask for an optional client certificate".

    in 2.2.1.0

    in 2.2.0.0

    in 2.1.1.0

    • skalibs dependency bumped to 2.3.10.0.
    • execline dependency bumped to 2.1.5.0.
    • s6 dependency bumped to 2.3.0.0.
    • s6-dns dependency bumped to 2.0.1.0.

    in 2.1.0.4

    • GNU make dependency pushed back to 3.81.
    • skalibs dependency bumped to 2.3.8.0.
    • execline dependency bumped to 2.1.4.2.
    • s6 dependency bumped to 2.2.2.0.
    • s6-dns dependency bumped to 2.0.0.7.

    in 2.1.0.3

    • skalibs dependency bumped to 2.3.7.1.
    • execline dependency bumped to 2.1.4.1.
    • s6 dependency bumped to 2.2.1.1
    • s6-dns dependency bumped to 2.0.0.6

    in 2.1.0.2

    • skalibs dependency bumped to 2.3.6.1.
    • execline dependency bumped to 2.1.3.1.
    • s6 dependency bumped to 2.2.0.1
    • s6-dns dependency bumped to 2.0.0.5

    in 2.1.0.1

    • skalibs dependency bumped to 2.3.3.0.
    • execline dependency bumped to 2.1.1.1.
    • s6 dependency bumped to 2.1.3.0
    • s6-dns dependency bumped to 2.0.0.3

    in 2.1.0.0

    • skalibs dependency bumped to 2.2.1.0.
    • execline dependency bumped to 2.0.2.0.
    • s6 dependency bumped to 2.1.0.0
    • The access control functions and Unix domain programs have moved over to s6. The access control function names have changed.

    in 2.0.1.0

    • skalibs dependency bumped to 2.2.0.0.
    • execline dependency bumped to 2.0.1.1.
    • s6 dependency introduced (2.0.1.0)
    • s6-dns dependency bumped to 2.0.0.2.
    • Separation of superservers into socketbinders and d's.

    in 2.0.0.1

    • skalibs dependency bumped to 2.1.0.0.

    in 2.0.0.0

    • The build system has completely changed. It is now a standard ./configure && make && sudo make install build system. See the enclosed INSTALL file for details.
    • slashpackage is not activated by default.
    • shared libraries are not used by default.
    • skalibs dependency bumped to 2.0.0.0.
    • execline dependency bumped to 2.0.0.0.
    • s6-dns dependency bumped to 2.0.0.0.
    s6-networking-2.3.1.1/doc/minidentd.html0000644000000000000000000000571613111013156014666 0ustar s6-networking: the minidentd program

    s6-networking
    Software
    skarnet.org

    The minidentd program

    minidentd is a small UCSPI server application that answers IDENT requests.

    Interface 

         minidentd [ -v ] [ -n | -i | -r ] [ -y file ] [ -t timeout ]

    minidentd reads a series of IDENT requests on stdin and answers them on stdout. It logs what it's doing on stderr. The environment variables xLOCALIP and xREMOTEIP, where x is the value of the PROTO environment variable, must contain the IDENT server address and the IDENT client address, respectively.

    minidentd exits 0 on success, 100 on a usage error and 111 on a system call failure.

    minidentd does not contact the network directly. It's meant to run under a superserver like s6-tcpserver. minidentd will work with IPv4 as well as IPv6.

    Options

    • -v : verbose mode. Log queries and replies..
    • -n : send ERROR : HIDDEN-USER replies if the user has a .ident file in his home directory.
    • -i : user-defined answers. The first 14 chars of the user's .ident file, up to EOF or newline, are used instead of the user name. If the file exists and is empty, send ERROR : HIDDEN-USER. If it doesn't exist, send a normal reply.
    • -r : send random replies.
    • -y file : valid with -n or -i. Use file instead of .ident.
    • -t timeout : close connection after timeout milliseconds without a client request.

    Notes

    • minidentd works only under Linux (2.2 or later); on other systems, it will compile and run, but report an error for every request. The problem is that there is no portable Unix way of listing active outgoing TCP connections with the relevant uids. On Linux, minidentd parses the /proc/net/tcp or /proc/net/tcp6 virtual file. Other systems have their own way of doing this, if you want your system to be supported by minidentd, please contact the author.
    s6-networking-2.3.1.1/doc/s6-sntpclock.html0000644000000000000000000001736113111013156015240 0ustar s6-networking: the s6-sntpclock program

    s6-networking
    Software
    skarnet.org

    The s6-sntpclock program

    s6-sntpclock is a small SNTP client. It connects to a SNTP or NTP server, computes an estimated discrepancy between the local clock time and the absolute time given by the server, and outputs it on stdout.

    Interface 

         s6-sntpclock [ -f ] [ -v verbosity ] [ -r roundtrips ] [ -t triptimeout ] [ -h throttle ] [ -T totaltimeout ] [ -e errmax ] [ -p port ] ipaddress | s6-clockview
    • s6-sntpclock exchanges SNTPv4 messages with a SNTP server listening on ipaddress, UDP port 123. ipaddress can be IPv4 or IPv6.
    • It computes the mean difference between the absolute time given by the system clock and the one given by the server.
    • It prints the difference to stdout in a format understood by s6-clockadd and s6-clockview. It then exits 0.

    Options

    • -f : force. Normally, s6-sntpclock exits 111 if it cannot compute a time with a smaller uncertainty than errmax. If this option is set, it will output a time difference and exit 0 even if the error is too big.
    • -v verbosity : be more or less verbose. By default, verbosity is 1. 0 means only print fatal error messages; 3 means trace every exchange with the server.
    • -r roundtrips : perform roundtrips exchanges with the server. By default, roundtrip is 10. A lower value yields a higher time uncertainty; a higher value puts more load on the server.
    • -t triptimeout : if a SNTP exchange with the server takes more than triptimeout milliseconds, abort this exchange and move on to the next one. By default, triptimeout is 2000.
    • -h throttle : wait throttle milliseconds between exchanges with the server. A lower value gets the final result earlier, but exerts more load on the server. A higher value puts a lighter load on the server, but delays the computation. By default, throttle is 0. It is recommended to set it to a reasonable nonzero value when increasing roundtrips.
    • -T totaltimeout : if the whole operation takes more than totaltimeout milliseconds, abort and exit 1. By default, totaltimeout is 10000.
    • -e errmax : accept a maximum time uncertainty of errmax milliseconds. By default, errmax is 100.
    • -p port : contact a server on port port. By default, port is 123.

    Notes

    • There are a lot of infelicities in the NTP protocol (which SNTP is a subset of). The biggest offender is probably that NTP cannot handle a time difference of more than 34 years: if the time given by the NTP server is more than 34 years away from the time given by the system clock, then NTP just cannot compute. This is a problem for CMOS-less systems, where the system clock is initialized to the Unix Epoch. The solution is to first manually initialize the system clock with a program such as date or s6-clock to a closer time (such as 2013-01-01, which will be good up to 2047), then contact the NTP server.
    • A less obvious problem with NTP is that it works with UTC time, which means that it gives inaccurate results when close to a leap second, up to one second off when used during a leap second, and this is bound to the use of UTC: there is nothing you can do about it. The only solution to get reliable results even around a leap second is to use linear time such as TAI; the s6-taiclock and s6-taiclockd programs provide tools to do so.

    A word on ntpd

    From a Unix software engineering standpoint, the well-known ntpd program is an eldritch abomination. The main reason for it is that, just like its lovely cousin BIND, ntpd performs a lot of different tasks in a unique process, instead of separating what could, and should, be separated. This is confusing for both the programmer and the software user.

    • The term "NTP server" means two different things:
      • A program that serves NTP time to the Internet and can be accessed by NTP clients.
      • A daemon, i.e. a long-lived process, that runs on a machine and handles NTP-related stuff such as keeping the system clock accurate.
      The former is the real meaning of "NTP server". The latter is a common usage for the term, but comes from a misuse of "server" to mean "daemon". ntpd does not help clear the misunderstanding since it does both. It acts as an NTP server, and as an NTP client getting its time from lower-strata NTP servers, and as a local system clock management daemon. Those are already 3 separate tasks.
    • Local system clock management itself involves several duties. There is the regular setting of the system clock, which can be done with a loop over a simple program such as s6-clockadd. There is also control of the clock skew, which s6-networking does not provide because there is no portable interface for that; there is such a tool in the clockspeed package.
    • ntpd includes a complete cryptographic key management system for the crypto part of NTP. NTP is not the only protocol that uses cryptography and asymmetric keys; managing keys in a separate tool, not in the NTP daemon itself, would be simpler and smarter.
    • ntpd provides monitoring support for client and server timekeeping performance. This would be best implemented as a separate specific log analyzing tool.

    And of course, no matter how many layers of complexity you add onto ntpd, it will never be able to give accurate time in the vicinity of a leap second, since the very protocol is flawed by design - but the ntpd authors cannot be blamed for that. Also, the ntpd writers, not the designers, should be praised: the history of ntpd security flaws is remarkably small, which is quite a feat for a huge monolithic root daemon.

    Network synchronization is important, NTP has its perks and valid use cases, and its existence is a good thing. However, I wish that the main NTP implementation weren't written as a big fat clumsy process running as root. s6-sntpclock together with s6-clockadd aims to provide a small, simple tool to keep system clocks, especially in embedded devices, synchronized to a NTP server.

    s6-networking-2.3.1.1/doc/s6-tcpserver4.html0000644000000000000000000001336213111013156015336 0ustar s6-networking: the s6-tcpserver4 program

    s6-networking
    Software
    skarnet.org

    The s6-tcpserver4 program

    s6-tcpserver4 is a super-server for IPv4 TCP connections. It accepts connections from clients, and forks a program to handle each connection.

    Interface 

         s6-tcpserver4 [ -1 ] [ -v verbosity ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gidlist ] [ -g gid ] [ -u uid ] [ -U ] ip port prog...
    • s6-tcpserver4 binds to local IPv4 address ip, port port.
    • It closes its stdin and stdout.
    • For every TCP connection to this address and port, it forks. The child sets some environment variables, then executes prog... with stdin reading from the network socket and stdout writing to it.
    • Depending on the verbosity level, it logs what it does to stderr.
    • It runs until killed by a signal. Depending on the received signal, it may kill its children before exiting.
    • s6-tcpserver4 actually doesn't do any of this itself. It is a wrapper, rewriting the command line and executing into a chain of programs that perform those duties.

    Environment variables

    For each connection, an instance of prog... is spawned with the following variables set:

    • PROTO: always set to TCP
    • TCPREMOTEIP: set to the originating address
    • TCPREMOTEPORT: set to the originating port
    • TCPCONNNUM: set to the number of connections originating from the same IP address

    Options

    • -1 : write port to stdout, before closing it, right after binding and listening to the network socket. If stdout is suitably redirected, this can be used by monitoring programs to check when the server is ready to accept connections.
    • -v verbosity : be more or less verbose. By default, verbosity is 1: print warning messages to stderr. 0 means only print fatal error messages ; 2 means print status and connection information for every client.
    • -c maxconn : accept at most maxconn concurrent connections. Default is 40. It is impossible to set it higher than 1000.
    • -C localmaxconn : accept at most localmaxconn connections from the same IP address. Default is 40. It is impossible to set it higher than maxconn.
    • -b backlog : set a maximum of backlog backlog connections on the socket. Extra connection attempts will rejected by the kernel.
    • -G gidlist : change s6-tcpserver4's supplementary group list to gidlist after binding the socket. This is only valid when run as root. gidlist must be a comma-separated list of numerical group IDs.
    • -g gid : change s6-tcpserver4's groupid to gid after binding the socket. This is only valid when run as root.
    • -u uid : change s6-tcpserver4's userid to uid after binding the socket. This is only valid when run as root.
    • -U : change s6-tcpserver4's user id, group id and supplementary group list according to the values of the UID, GID and GIDLIST environment variables after binding the socket. This is only valid when run as root. This can be used with the s6-envuidgid program to easily script a service that binds to a privileged socket then drops its privileges to those of a named non-root account.

    Signals

    • SIGTERM: exit.
    • SIGHUP: send a SIGTERM and a SIGCONT to all children.
    • SIGQUIT: send a SIGTERM and a SIGCONT to all children, then exit.
    • SIGABRT: send a SIGKILL to all children, then exit.

    Notes

    • Unlike its ancestor tcpserver, s6-tcpserver4 performs just the bare minimum: the point is to have a very small and very fast process to serve connections with the least possible overhead. Features such as additional environment variables, access control and DNS resolution are provided via the s6-tcpserver-access program.
    • In previous releases of s6-networking, s6-tcpserver4 was monolithic: it did the work of s6-tcpserver4-socketbinder, s6-applyuidgid and s6-tcpserver4d itself. The functionality has now been split into several different programs because some service startup schemes require the daemon to get its socket from an external program instead of creating and binding it itself. The most obvious application of this is upgrading a long-lived process without losing existing connections.
    s6-networking-2.3.1.1/doc/s6-tlsc.html0000644000000000000000000002363613111013156014207 0ustar s6-networking: the s6-tlsc program

    s6-networking
    Software
    skarnet.org

    The s6-tlsc program

    s6-tlsc is a program that establishes a TLS or SSL client connection over an existing TCP connection, then spawns an application. It is meant to make network communications secure even for applications that do not natively support TLS/SSL.

    s6-networking does not include cryptographic software. All the crypto used in s6-tlsc is provided by the chosen SSL backend: BearSSL or LibreSSL, depending on the options given when configuring s6-networking.

    Interface 

         s6-tlsc [ -S | -s ] [ -Y | -y ] [ -Z | -z ] [ -v verbosity ] [ -K kimeout ] [ -k servername ] [ -6 rfd ] [ -7 wfd ] [ -- ] prog...
    • s6-tlsc expects to have an open TCP connection it can talk to on its (by default) descriptors 6 (for reading) and 7 (for writing).
    • It spawns prog... as a child process, interposing itself between it and the network.
    • It initiates a TLS/SSL handshake over the network connection, expecting a TLS/SSL server on the other side.
    • It manages the encryption/decryption of all the messages between prog and the server. prog speaks plaintext, but only ciphertext is sent on the network.
    • When prog exits, s6-tlsc exits.

    Exit codes

    • 96: error while configuring the TLS/SSL context - for instance, invalid trust anchor set.
    • 97: error while setting up the TLS/SSL client engine.
    • 98: TLS/SSL error while running the engine.
    • 100: wrong usage.
    • 111: system call failed.

    If the TLS/SSL connection closes cleanly, s6-tlsc waits for prog to exit, then exits with an approximation of prog's exit code.

    Protocol version and parameters

    During the TLS/SSL handshake, s6-tlsc tries every version of the protocol that is supported by the backend, with all supported algorithms and cipher suites; the backend normally ensures that the most secure combination is tried first, with slow degradation until the client and the server agree.

    As a client, it is better for s6-tlsc to adapt to as many servers as possible, that's why it adopts a liberal approach to protocol versions.

    Environment variables

    Read

    s6-tlsc expects to have one of the CADIR or CAFILE environment variables set. It will refuse to run if both are unset. If both are set, CADIR has priority. The value of that variable is:

    • for CADIR: a directory where trust anchors (i.e. root or intermediate CA certificates) can be found, one per file, DER- or PEM-encoded.
    • for CAFILE: a file containing the whole set of trust anchors, PEM-encoded.

    If you are using client certificates, s6-tlsc also reads two more environment variables: KEYFILE contains the path to a file containing the private key, DER- or PEM-encoded; and CERTFILE contains the path to a file containing the client certificate, DER- or PEM-encoded.

    If s6-tlsc is run as root, it can also read two other environment variables, TLS_UID and TLS_GID, which contain a numeric uid and a numeric gid; s6-tlsc then drops its root privileges to this uid/gid after spawning prog.... This ensures that the TLS/engine and the application run with different privileges. Note that prog... should drop its own root privileges by its own means: the s6-applyuidgid program is a way of doing it.

    Written

    Unless the -Z option has been given to s6-tlsc, prog... is run with all the TLS/SSL variables unset: CADIR, CAFILE, KEYFILE, CERTFILE, TLS_UID and TLS_GID. The goal is for s6-tlsc to be, by default, as invisible as possible.

    Server name determination for SNI

    The -k servername option is important to s6-tlsc: it tells it to send servername as the name to require a certificate for. Not setting this option allows s6-tlsc to proceed without SNI, which may be a security risk.

    The s6-tlsclient program can automatically craft a -k option for s6-tlsc if the host argument that is given to it is a host name. But if you're invoking s6-tlsc directly, do not forget to give it this option.

    SSL close handling

    If prog initiates the end of the session by sending EOF, there are two ways for the TLS/SSL layer to handle it.

    • It can send a close_notify alert, and wait for an acknowledgement from the peer, at which point the connection is closed. The advantage of this setup is that it is secure even when the application protocol is not auto-terminated, i.e. when it does not know when its data stops. Old protocols such as HTTP-0.9 are in this case. The drawback of this setup is that it breaks full-duplex: once a peer has sent the close_notify, it must discard all the incoming records that are not a close_notify from the other peer. So if a client sends EOF while it is still receiving data from the server, the connection closes immediately and the data can be truncated.
    • It can simply transmit the EOF, shutting down half the TCP connection, and wait for the EOF back. The advantage of this setup is that it maintains full-duplex: a client can send EOF after its initial request, and still receive a complete answer from the server. The drawback is that it is insecure when the application protocol is not auto-terminated.

    Nowadays (2017), most protocols are auto-terminated, so it is not dangerous anymore to use EOF tranmission, and that is the default for s6-tlsc. Nevertheless, by using the -S option, you can force it to use the close_notify method if your application requires it to be secure.

    s6-tlsc options

    • -v verbosity : Be more or less verbose. Default for verbosity is 1. 0 is quiet, 2 is verbose, more than 2 is debug output. This option currently has no effect.
    • -Z : do not clean the environment of s6-tlsc-related variables before spawning prog....
    • -z : clean the environment of s6-tlsc-related variables before spawning prog.... This is the default.
    • -S : send a close_notify alert and break the connection when prog sends EOF.
    • -s : transmit EOF by half-closing the TCP connection without using close_notify. This is the default.
    • -Y : Do not send a client certificate. This is the default.
    • -y : Send a client certificate.
    • -k servername : use Server Name Indication, and send servername. The default is not to use SNI, which may be a security risk.
    • -K kimeout : close the connection if kimeout milliseconds elapse without any data being received from either side. The default is 0, which means infinite timeout (never kill the connection).
    • -6 rfd : expect an open file descriptor numbered rfd to read network (ciphertext) data from. Make sure prog also reads its data from its own fd rfd. Default is 6.
    • -7 wfd : expect an open file descriptor numbered wfd to write network (ciphertext) data to. Make sure prog also writes its data to its own fd wfd. Default is 7.

    Notes

    • The goal of the s6-tlsc interface (and its server-side companion s6-tlsd) is to make it so that if you have a client, run by the command line client... that speaks a cleartext protocol to a server run by the command line server..., then if the server has the proper private key and certificate, and the client has the proper list of trust anchors, you can just change the client command line to s6-tlsc client... and the server command line to s6-tlsd server... without changing the client or the server themselves, and the communication between them will be secure.
    s6-networking-2.3.1.1/doc/s6-taiclock.html0000644000000000000000000001171213111013156015023 0ustar s6-networking: the s6-taiclock program

    s6-networking
    Software
    skarnet.org

    The s6-taiclock program

    s6-taiclock is a client for the TAICLOCK protocol. It connects to a TAICLOCK server, computes an estimated discrepancy between the local clock time and the absolute time given by the server, and outputs it on stdout.

    Interface 

         s6-taiclock [ -f ] [ -v verbosity ] [ -r roundtrips ] [ -t triptimeout ] [ -h throttle ] [ -T totaltimeout ] [ -e errmax ] [ -p port ] ipaddress | s6-clockview
    • s6-taiclock exchanges TAICLOCK messages with a server such as s6-taiclockd listening on ipaddress, UDP port 4014. ipaddress can be IPv4 or IPv6.
    • It computes the mean difference between the absolute time given by the system clock and the one given by the server.
    • It prints the difference to stdout in a format understood by s6-clockadd and s6-clockview. It then exits 0.

    Options

    • -f : force. Normally, s6-taiclock exits 111 if it cannot compute a time with a smaller uncertainty than errmax. If this option is set, it will output a time difference and exit 0 even if the error is too big.
    • -v verbosity : be more or less verbose. By default, verbosity is 1. 0 means only print fatal error messages; 2 means print advanced warnings.
    • -r roundtrips : perform roundtrips exchanges with the server. By default, roundtrip is 10. A lower value yields a higher time uncertainty; a higher value puts more load on the server.
    • -t triptimeout : if a TAICLOCK exchange with the server takes more than triptimeout milliseconds, abort this exchange and move on to the next one. By default, triptimeout is 2000.
    • -h throttle : wait throttle milliseconds between exchanges with the server. A lower value gets the final result earlier, but exerts more load on the server. A higher value puts a lighter load on the server, but delays the computation. By default, throttle is 0. It is recommended to set it to a reasonable nonzero value when increasing roundtrips.
    • -T totaltimeout : if the whole operation takes more than totaltimeout milliseconds, abort and exit 1. By default, totaltimeout is 10000.
    • -e errmax : accept a maximum time uncertainty of errmax milliseconds. By default, errmax is 100.
    • -p port : contact a server on port port. By default, port is 4014.

    Notes

    On the usage of NTP vs. TAICLOCK

    • TAICLOCK is not as generic or failproof as NTP. It is not as resistant to network latency. It has been designed to broadcast time on a local area network, whereas NTP has been designed to broadcast time over the whole Internet.
    • TAICLOCK will produce faster results on a LAN; moreover, the point of TAICLOCK is to broadcast TAI instead of UTC, so it is more accurate around a leap second.
    • The Internet is much more reliable latency-wise today than it was when dialout connections and broken routing protocols were the norm. So it is possible to use TAICLOCK across a WAN if the accuracy expectations are not too strict.
    • TAICLOCK is much easier to implement. The s6-sntpclock client binary code (statically linked on a i386) is 50% bigger than the s6-taiclock client. Also, the s6-taiclockd server is extremely small (close to 50% smaller than the client), whereas NTP servers, even SNTP servers, are behemoths requiring a project of their own.

    Related work

    • The clockspeed package is the original inspiration for the clock management part of s6-networking. Unfortunately, it is unmaintained.
    s6-networking-2.3.1.1/doc/s6-tlsserver.html0000644000000000000000000001601713111013156015266 0ustar s6-networking: the s6-tlsserver program

    s6-networking
    Software
    skarnet.org

    The s6-tlsserver program

    s6-tlsserver is an UCSPI server tool for TLS/SSL connections over INET domain sockets. It acts as a TCP superserver that listens to connections, accepts them, and for each connection, establishes a TLS transport over it, then executes into a program.

    Interface 

         s6-tlsserver [ options ] [ -- ] ip port prog...
    • s6-tlsserver rewrites itself into a command line involving:
      • s6-tcpserver, which listens to TCP connections on IP address ip port port and forks a command line for every connection. Note that s6-tcpserver also rewrites itself into a more complex commnd line (the final long-lived process being s6-tcpserver4d or s6-tcpserver6d), so your end command line may look a lot longer in ps than what you originally wrote. This is normal and healthy.
      • (if applicable) s6-tcpserver-access, which performs TCP access control and various operations on the TCP connection.
      • s6-tlsd, which establishes a TLS transport (server-side) over a connection.
      • (if applicable) s6-applyuidgid, which drops root privileges.
      • prog..., your client program, which is run as a child of s6-tlsd.
    • It runs until it is killed by a signal.

    prog is expected to read from its peer on its standard input and write to its peer on its standard output. Since there will be a s6-tlsd program between prog and the network to perform the SSL encryption/decryption, those descriptors will not be a network socket - they will be pipes.

    Signals

    s6-tlsserver reacts to the same signals as s6-tcpserver4d or s6-tcpserver6d, one of which is the long-lived process hanging around.

    Environment variables

    Read

    The following variables should be set before invoking s6-tlsserver, because they will be used by every s6-tlsd invocation:

    • KEYFILE
    • CERTFILE
    • TLS_UID and TLS_GID (if you run s6-tlsserver as root)
    • CADIR (if you want client certificates)
    • CAFILE (if you want client certificates, alternative to CADIR)

    Setting both KEYFILE and CERTFILE is mandatory.

    Written

    prog... is run with the following variables added to, or removed from, its environment by s6-tcpserver4d or s6-tcpserver6d, and possibly by s6-tcpserver-access:

    • PROTO
    • TCPREMOTEIP
    • TCPREMOTEPORT
    • TCPCONNNUM
    • TCPLOCALIP
    • TCPLOCALPORT
    • TCPREMOTEHOST
    • TCPLOCALHOST
    • TCPREMOTEINFO

    Depending on TCP access rules (if the -i or -x option has been given), it is possible that prog's environment undergoes more modifications. Also, since s6-tlsd is always run after s6-tcpserver-access, it is possible to set different TLS/SSL parameters (typically a different KEYFILE and CERTFILE) depending on the client connection, by writing the correct set of TCP access rules.

    Unless the -Z option is given to s6-tlsserver, the CADIR, CAFILE, KEYFILE, CERTFILE, TLS_UID and TLS_GID variables will not appear in prog's environment.

    Options

    s6-tlsserver accepts a myriad of options, most of which are passed as is to the correct executable. Not giving any options will generally work, but unless you're running a very public server (such as a Web server) or base your access control on client certificates, you probably still want TCP access rules.

    Options passed as is to s6-tcpserver

    • -q, -Q, -v
    • -4, -6
    • -1
    • -c maxconn
    • -C localmaxconn
    • -b backlog

    Options passed as is to s6-tcpserver-access

    • The verbosity level, if not default, as -v0 or -v2
    • -w, -W
    • -d, -D
    • -r, -R
    • -p, -P
    • -h, -H, -l localname
    • -B banner
    • -t timeout
    • -i rulesdir, -x rulesfile

    Options passed as is to s6-tlsd

    • -Z, -z
    • -S, -s
    • -Y, -y
    • -k servername
    • -K kimeout

    Options passed to s6-applyuidgid

    • -u uid, -g gid, -G gidlist
    • -U (passed as -Uz)

    Example

    As root: KEYFILE=/etc/ssl/private/mykey.der CERTFILE=/etc/ssl/public/mycert.pem \ TLS_UID=65534 TLS_UID=65536 \ s6-envuidgid www s6-tlsserver -U -- 1.2.3.4 443 httpd

    This will start a server listening to 1.2.3.4 on TCP port 443, and for every connection, spawn the httpd program reading queries on stdin and replying on stdout, as user www, with a TLS layer protecting the connection, the TLS engine running as user nobody (65534:65534). The server is authentified by the certificate in /etc/ssl/public/mycert.pem that it sends to the client, and the private key in /etc/ssl/private/mykey.der that it keeps to itself.

    s6-networking-2.3.1.1/doc/s6-tcpserver6.html0000644000000000000000000001327713111013156015345 0ustar s6-networking: the s6-tcpserver6 program

    s6-networking
    Software
    skarnet.org

    The s6-tcpserver6 program

    s6-tcpserver6 is a super-server for IPv6 TCP connections. It accepts connections from clients, and forks a program to handle each connection.

    Interface 

         s6-tcpserver6 [ -1 ] [ -v verbosity ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gidlist ] [ -g gid ] [ -u uid ] [ -U ] ip port prog...
    • s6-tcpserver6 binds to local IPv6 address ip, port port.
    • It closes its stdin and stdout.
    • For every TCP connection to this address and port, it forks. The child sets some environment variables, then executes prog... with stdin reading from the network socket and stdout writing to it.
    • Depending on the verbosity level, it logs what it does to stderr.
    • It runs until killed by a signal. Depending on the received signal, it may kill its children before exiting.
    • s6-tcpserver6 actually doesn't do any of this itself. It is a wrapper, rewriting the command line and executing into a chain of programs that perform those duties.

    Environment variables

    For each connection, an instance of prog... is spawned with the following variables set:

    • PROTO: always set to TCP
    • TCPREMOTEIP: set to the originating address, in canonical IPv6 form
    • TCPREMOTEPORT: set to the originating port
    • TCPCONNNUM: set to the number of connections originating from the same IPv6 address

    Options

    • -1 : write port to stdout, before closing it, right after binding and listening to the network socket. If stdout is suitably redirected, this can be used by monitoring programs to check when the server is ready to accept connections.
    • -v verbosity : be more or less verbose. By default, verbosity is 1: print warning messages to stderr. 0 means only print fatal error messages ; 2 means print status and connection information for every client.
    • -c maxconn : accept at most maxconn concurrent connections. Default is 40. It is impossible to set it higher than 1000.
    • -C localmaxconn : accept at most localmaxconn connections from the same IP address. Default is 40. It is impossible to set it higher than maxconn.
    • -b backlog : set a maximum of backlog backlog connections on the socket. Extra connection attempts will rejected by the kernel.
    • -G gidlist : change s6-tcpserver6's supplementary group list to gidlist after binding the socket. This is only valid when run as root. gidlist must be a comma-separated list of numerical group IDs.
    • -g gid : change s6-tcpserver6's groupid to gid after binding the socket. This is only valid when run as root.
    • -u uid : change s6-tcpserver6's userid to uid after binding the socket. This is only valid when run as root.
    • -U : change s6-tcpserver6's user id, group id and supplementary group list according to the values of the UID, GID and GIDLIST environment variables after binding the socket. This is only valid when run as root. This can be used with the s6-envuidgid program to easily script a service that binds to a privileged socket then drops its privileges to those of a named non-root account.

    Signals

    • SIGTERM: exit.
    • SIGHUP: send a SIGTERM and a SIGCONT to all children.
    • SIGQUIT: send a SIGTERM and a SIGCONT to all children, then exit.
    • SIGABRT: send a SIGKILL to all children, then exit.

    Notes

    • s6-tcpserver6 will only serve real IPv6 addresses; it does not default to an IPv4 address. The s6-tcpserver4 program should be used to serve IPv4 addresses.
    • s6-tcpserver6 will only work if the underlying skalibs has been compiled with IPv6 support.
    • In previous releases of s6-networking, s6-tcpserver6 was monolithic: it did the work of s6-tcpserver6-socketbinder, s6-applyuidgid and s6-tcpserver6d itself. The functionality has now been split into several different programs because some service startup schemes require the daemon to get its socket from an external program instead of creating and binding it itself. The most obvious application of this is upgrading a long-lived process without losing existing connections.
    s6-networking-2.3.1.1/doc/s6-getservbyname.html0000644000000000000000000000307313477447574016144 0ustar s6-networking: the s6-getservbyname program

    s6-networking
    Software
    skarnet.org

    The s6-getservbyname program

    s6-getservbyname is a simple command-line interface to the getservbyname() function, converting a service name and protocol into a port number.

    Interface 

         s6-getservbyname name proto
    • s6-getservbyname looks up the network services database for an entry containing name name and protocol proto.
    • It prints the corresponding port number to stdout, then exits 0.
    • If it cannot find a related entry, it exits 1.

    Example

    On a standard machine with a correct /etc/services file and a non-garbled NSS configuration: s6-getservbyname smtp tcp prints 25.

    s6-networking-2.3.1.1/doc/s6-ident-client.html0000644000000000000000000000356313111013156015616 0ustar s6-networking: the s6-ident-client program

    s6-networking
    Software
    skarnet.org

    The s6-ident-client program

    s6-ident-client is a command-line client application that performs IDENT (RFC 1413) queries.

    Interface 

         s6-ident-client [ -t millisecs ] remoteaddr remoteport localaddr localport
    • s6-ident-client contacts the IDENT server on address remoteaddr port 113 and asks it about the connection from address remoteaddr port remoteport to address localaddr port localport.
    • It prints the answer to stdout.
    • It exits 0 if the answer is positive or 1 if the answer is negative, in which case it also prints an informative message to stderr.
    • remoteaddr and localaddr can be either IPv4 or IPv6 addresses; however, they must both be of the same type.

    Options

    • -t millisecs : if no answer has been obtained within millisecs milliseconds, s6-ident-client will exit 99 with an error message. By default, millisecs is 0, which means no time limit.