X-Git-Url: https://mattmccutchen.net/rsync/rsync.git/blobdiff_plain/8f3a2d54a6d3ffa7eefa13478c67ccfa9a3df513..b67381d0dcd437cb60cef565264b69137918c69f:/clientserver.c diff --git a/clientserver.c b/clientserver.c index 33e7b444..00efea49 100644 --- a/clientserver.c +++ b/clientserver.c @@ -1,5 +1,7 @@ -/* - Copyright (C) Andrew Tridgell 1998 +/* -*- c-file-style: "linux"; -*- + + Copyright (C) 1998-2001 by Andrew Tridgell + Copyright (C) 2001 by Martin Pool This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -16,7 +18,7 @@ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ -/* the socket based protocol for setting up a connection wit rsyncd */ +/* the socket based protocol for setting up a connection with rsyncd */ #include "rsync.h" @@ -24,15 +26,46 @@ extern int module_id; extern int read_only; extern int verbose; extern int rsync_port; +char *auth_user; +int sanitize_paths = 0; +/* + * Run a client connected to an rsyncd. The alternative to this + * function for remote-shell connections is do_cmd. + */ int start_socket_client(char *host, char *path, int argc, char *argv[]) { int fd, i; char *sargs[MAX_ARGS]; int sargc=0; - char line[1024]; + char line[MAXPATHLEN]; char *p, *user=NULL; extern int remote_version; + extern int am_sender; + extern struct in_addr socket_address; + extern char *shell_cmd; + + if (argc == 0 && !am_sender) { + extern int list_only; + list_only = 1; + } + + /* This is just a friendliness enhancement: if the connection + * is to an rsyncd then there is no point specifying the -e option. + * Note that this is only set if the -e was explicitly specified, + * not if the environment variable just happens to be set. + * See http://lists.samba.org/pipermail/rsync/2000-September/002744.html + */ + if (shell_cmd) { + rprintf(FERROR, "WARNING: --rsh or -e option ignored when " + "connecting to rsync daemon\n"); + /* continue */ + } + + if (*path == '/') { + rprintf(FERROR,"ERROR: The remote path must start with a module name not a /\n"); + return -1; + } p = strchr(host, '@'); if (p) { @@ -44,9 +77,9 @@ int start_socket_client(char *host, char *path, int argc, char *argv[]) if (!user) user = getenv("USER"); if (!user) user = getenv("LOGNAME"); - fd = open_socket_out(host, rsync_port); + fd = open_socket_out(host, rsync_port, &socket_address); if (fd == -1) { - exit_cleanup(1); + exit_cleanup(RERR_SOCKETIO); } server_options(sargs,&sargc); @@ -84,6 +117,9 @@ int start_socket_client(char *host, char *path, int argc, char *argv[]) } if (strcmp(line,"@RSYNCD: OK") == 0) break; + + if (strcmp(line,"@RSYNCD: EXIT") == 0) exit(0); + rprintf(FINFO,"%s\n", line); } @@ -92,6 +128,11 @@ int start_socket_client(char *host, char *path, int argc, char *argv[]) } io_printf(fd,"\n"); + if (remote_version < 23) { + if (remote_version == 22 || (remote_version > 17 && !am_sender)) + io_start_multiplex_in(fd); + } + return client_run(fd, fd, -1, argc, argv); } @@ -102,15 +143,20 @@ static int rsync_module(int fd, int i) int argc=0; char *argv[MAX_ARGS]; char **argp; - char line[1024]; - uid_t uid; - gid_t gid; + char line[MAXPATHLEN]; + uid_t uid = (uid_t)-2; /* canonically "nobody" */ + gid_t gid = (gid_t)-2; char *p; char *addr = client_addr(fd); char *host = client_name(fd); - char *auth; char *name = lp_name(i); + int use_chroot = lp_use_chroot(i); int start_glob=0; + int ret; + char *request=NULL; + extern int am_sender; + extern int remote_version; + extern int am_root; if (!allow_access(addr, host, lp_hosts_allow(i), lp_hosts_deny(i))) { rprintf(FERROR,"rsync denied on module %s from %s (%s)\n", @@ -120,72 +166,113 @@ static int rsync_module(int fd, int i) return -1; } - if (!auth_server(fd, i, addr, "@RSYNCD: AUTHREQD ")) { + if (!claim_connection(lp_lock_file(i), lp_max_connections(i))) { + if (errno) { + rprintf(FERROR,"failed to open lock file %s : %s\n", + lp_lock_file(i), strerror(errno)); + io_printf(fd,"@ERROR: failed to open lock file %s : %s\n", + lp_lock_file(i), strerror(errno)); + } else { + rprintf(FERROR,"max connections (%d) reached\n", + lp_max_connections(i)); + io_printf(fd,"@ERROR: max connections (%d) reached - try again later\n", lp_max_connections(i)); + } + return -1; + } + + + auth_user = auth_server(fd, i, addr, "@RSYNCD: AUTHREQD "); + + if (!auth_user) { rprintf(FERROR,"auth failed on module %s from %s (%s)\n", name, client_name(fd), client_addr(fd)); io_printf(fd,"@ERROR: auth failed on module %s\n",name); return -1; } - if (!claim_connection(lp_lock_file(), lp_max_connections())) { - rprintf(FERROR,"max connections (%d) reached\n", - lp_max_connections()); - io_printf(fd,"@ERROR: max connections (%d) reached - try again later\n", lp_max_connections()); - return -1; - } - - rprintf(FINFO,"rsync on module %s from %s (%s)\n", - name, host, addr); - module_id = i; - if (lp_read_only(i)) - read_only = 1; + am_root = (getuid() == 0); + + if (am_root) { + p = lp_uid(i); + if (!name_to_uid(p, &uid)) { + if (!isdigit(*p)) { + rprintf(FERROR,"Invalid uid %s\n", p); + io_printf(fd,"@ERROR: invalid uid %s\n", p); + return -1; + } + uid = atoi(p); + } - p = lp_uid(i); - if (!name_to_uid(p, &uid)) { - if (!isdigit(*p)) { - rprintf(FERROR,"Invalid uid %s\n", p); - io_printf(fd,"@ERROR: invalid uid\n"); - return -1; - } - uid = atoi(p); + p = lp_gid(i); + if (!name_to_gid(p, &gid)) { + if (!isdigit(*p)) { + rprintf(FERROR,"Invalid gid %s\n", p); + io_printf(fd,"@ERROR: invalid gid %s\n", p); + return -1; + } + gid = atoi(p); + } } + + /* TODO: If we're not root, but the configuration requests + * that we change to some uid other than the current one, then + * log a warning. */ - p = lp_gid(i); - if (!name_to_gid(p, &gid)) { - if (!isdigit(*p)) { - rprintf(FERROR,"Invalid gid %s\n", p); - io_printf(fd,"@ERROR: invalid gid\n"); - return -1; - } - gid = atoi(p); - } + /* TODO: Perhaps take a list of gids, and make them into the + * supplementary groups. */ - p = lp_exclude_from(i); - add_exclude_file(p, 1); + p = lp_include_from(i); + add_exclude_file(p, 1, 1); + + p = lp_include(i); + add_include_line(p); p = lp_exclude_from(i); + add_exclude_file(p, 1, 0); + + p = lp_exclude(i); add_exclude_line(p); - if (chroot(lp_path(i))) { - io_printf(fd,"@ERROR: chroot failed\n"); - return -1; - } + log_init(); - if (chdir("/")) { - io_printf(fd,"@ERROR: chdir failed\n"); - return -1; - } + if (use_chroot) { + if (chroot(lp_path(i))) { + rsyserr(FERROR, errno, "chroot %s failed", lp_path(i)); + io_printf(fd,"@ERROR: chroot failed\n"); + return -1; + } - if (setgid(gid)) { - io_printf(fd,"@ERROR: setgid failed\n"); - return -1; + if (!push_dir("/", 0)) { + rsyserr(FERROR, errno, "chdir %s failed\n", lp_path(i)); + io_printf(fd,"@ERROR: chdir failed\n"); + return -1; + } + + } else { + if (!push_dir(lp_path(i), 0)) { + rsyserr(FERROR, errno, "chdir %s failed\n", lp_path(i)); + io_printf(fd,"@ERROR: chdir failed\n"); + return -1; + } + sanitize_paths = 1; } - if (setuid(uid)) { - io_printf(fd,"@ERROR: setuid failed\n"); - return -1; + if (am_root) { + if (setgid(gid)) { + rsyserr(FERROR, errno, "setgid %d failed", gid); + io_printf(fd,"@ERROR: setgid failed\n"); + return -1; + } + + if (setuid(uid)) { + rsyserr(FERROR, errno, "setuid %d failed", uid); + io_printf(fd,"@ERROR: setuid failed\n"); + return -1; + } + + am_root = (getuid() == 0); } io_printf(fd,"@RSYNCD: OK\n"); @@ -201,18 +288,17 @@ static int rsync_module(int fd, int i) p = line; - if (start_glob && strncmp(p, name, strlen(name)) == 0) { - p += strlen(name); - if (!*p) p = "."; - } - argv[argc] = strdup(p); if (!argv[argc]) { return -1; } if (start_glob) { - glob_expand(argv, &argc, MAX_ARGS); + if (start_glob == 1) { + request = strdup(p); + start_glob++; + } + glob_expand(name, argv, &argc, MAX_ARGS); } else { argc++; } @@ -226,14 +312,62 @@ static int rsync_module(int fd, int i) } } - parse_arguments(argc, argv); + if (sanitize_paths) { + /* + * Note that this is applied to all parameters, whether or not + * they are filenames, but no other legal parameters contain + * the forms that need to be sanitized so it doesn't hurt; + * it is not known at this point which parameters are files + * and which aren't. + */ + for (i = 1; i < argc; i++) { + sanitize_path(argv[i], NULL); + } + } + + argp = argv; + ret = parse_arguments(&argc, (const char ***) &argp, 0); + if (request) { + if (*auth_user) { + rprintf(FINFO,"rsync %s %s from %s@%s (%s)\n", + am_sender?"on":"to", + request, auth_user, host, addr); + } else { + rprintf(FINFO,"rsync %s %s from %s (%s)\n", + am_sender?"on":"to", + request, host, addr); + } + free(request); + } + +#ifndef DEBUG /* don't allow the logs to be flooded too fast */ if (verbose > 1) verbose = 1; +#endif - argc -= optind; - argp = argv + optind; - optind = 0; + if (remote_version < 23) { + if (remote_version == 22 || (remote_version > 17 && am_sender)) + io_start_multiplex_out(fd); + } + + /* For later protocol versions, we don't start multiplexing + * until we've configured nonblocking in start_server. That + * means we're in a sticky situation now: there's no way to + * convey errors to the client. */ + + /* FIXME: Hold off on reporting option processing errors until + * we've set up nonblocking and multiplexed IO and can get the + * message back to them. */ + if (!ret) { + option_error(); + exit_cleanup(RERR_UNSUPPORTED); + } + + if (lp_timeout(i)) { + extern int io_timeout; + io_timeout = lp_timeout(i); + } start_server(fd, fd, argc, argp); @@ -250,6 +384,8 @@ static void send_listing(int fd) for (i=0;i