src/main/exec.c

   1 /*
   2  * exec.c       Execute external programs.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000-2004,2006  The FreeRADIUS server project
  21  */
  22
  23 #include <freeradius-devel/ident.h>
  24 RCSID("$Id$")
  25
  26 #include <freeradius-devel/radiusd.h>
  27 #include <freeradius-devel/rad_assert.h>
  28
  29 #include <sys/file.h>
  30
  31 #include <fcntl.h>
  32 #include <ctype.h>
  33 #include <signal.h>
  34
  35 #ifdef HAVE_SYS_WAIT_H
  36 #       include <sys/wait.h>
  37 #endif
  38 #ifndef WEXITSTATUS
  39 #       define WEXITSTATUS(stat_val) ((unsigned)(stat_val) >> 8)
  40 #endif
  41 #ifndef WIFEXITED
  42 #       define WIFEXITED(stat_val) (((stat_val) & 255) == 0)
  43 #endif
  44
  45 #define MAX_ARGV (256)
  46
  47 #define USEC 1000000
  48 static void tv_sub(struct timeval *end, struct timeval *start,
  49                    struct timeval *elapsed)
  50 {
  51         elapsed->tv_sec = end->tv_sec - start->tv_sec;
  52         if (elapsed->tv_sec > 0) {
  53                 elapsed->tv_sec--;
  54                 elapsed->tv_usec = USEC;
  55         } else {
  56                 elapsed->tv_usec = 0;
  57         }
  58         elapsed->tv_usec += end->tv_usec;
  59         elapsed->tv_usec -= start->tv_usec;
  60
  61         if (elapsed->tv_usec >= USEC) {
  62                 elapsed->tv_usec -= USEC;
  63                 elapsed->tv_sec++;
  64         }
  65 }
  66
  67
  68 /*
  69  *      Start a process
  70  */
  71 pid_t radius_start_program(const char *cmd, REQUEST *request,
  72                         int exec_wait,
  73                         int *input_fd,
  74                         int *output_fd,
  75                         VALUE_PAIR *input_pairs,
  76                         int shell_escape)
  77 {
  78         VALUE_PAIR *vp;
  79         char mycmd[1024];
  80         const char *from;
  81         char *p, *to;
  82         int to_child[2] = {-1, -1};
  83         int from_child[2] = {-1, -1};
  84         pid_t pid;
  85         int argc = -1;
  86         int i;
  87         int n, left;
  88         char *argv[MAX_ARGV];
  89         char argv_buf[4096];
  90 #define MAX_ENVP 1024
  91         char *envp[MAX_ENVP];
  92
  93         if (strlen(cmd) > (sizeof(mycmd) - 1)) {
  94                 radlog(L_ERR|L_CONS, "Command line is too long");
  95                 return -1;
  96         }
  97
  98         /*
  99          *      Check for bad escapes.
 100          */
 101         if (cmd[strlen(cmd) - 1] == '\\') {
 102                 radlog(L_ERR|L_CONS, "Command line has final backslash, without a following character");
 103                 return -1;
 104         }
 105
 106         strlcpy(mycmd, cmd, sizeof(mycmd));
 107
 108         /*
 109          *      Split the string into argv's BEFORE doing radius_xlat...
 110          */
 111         from = cmd;
 112         to = mycmd;
 113         argc = 0;
 114         while (*from) {
 115                 int length;
 116
 117                 /*
 118                  *      Skip spaces.
 119                  */
 120                 if ((*from == ' ') || (*from == '\t')) {
 121                         from++;
 122                         continue;
 123                 }
 124
 125                 argv[argc] = to;
 126                 argc++;
 127
 128                 if (argc >= (MAX_ARGV - 1)) break;
 129
 130                 /*
 131                  *      Copy the argv over to our buffer.
 132                  */
 133                 while (*from && (*from != ' ') && (*from != '\t')) {
 134                         if (to >= mycmd + sizeof(mycmd) - 1) {
 135                                 return -1; /* ran out of space */
 136                         }
 137
 138                         switch (*from) {
 139                         case '"':
 140                         case '\'':
 141                                 length = rad_copy_string(to, from);
 142                                 if (length < 0) {
 143                                         radlog(L_ERR|L_CONS, "Invalid string passed as argument for external program");
 144                                         return -1;
 145                                 }
 146                                 from += length;
 147                                 to += length;
 148                                 break;
 149
 150                         case '%':
 151                                 if (from[1] == '{') {
 152                                         *(to++) = *(from++);
 153
 154                                         length = rad_copy_variable(to, from);
 155                                         if (length < 0) {
 156                                                 radlog(L_ERR|L_CONS, "Invalid variable expansion passed as argument for external program");
 157                                                 return -1;
 158                                         }
 159                                         from += length;
 160                                         to += length;
 161                                 } else { /* FIXME: catch %%{ ? */
 162                                         *(to++) = *(from++);
 163                                 }
 164                                 break;
 165
 166                         case '\\':
 167                                 if (from[1] == ' ') from++;
 168                                 /* FALL-THROUGH */
 169
 170                         default:
 171                                 *(to++) = *(from++);
 172                         }
 173                 } /* end of string, or found a space */
 174
 175                 *(to++) = '\0'; /* terminate the string */
 176         }
 177
 178         /*
 179          *      We have to have SOMETHING, at least.
 180          */
 181         if (argc <= 0) {
 182                 radlog(L_ERR, "Exec-Program: empty command line.");
 183                 return -1;
 184         }
 185
 186         /*
 187          *      Expand each string, as appropriate.
 188          */
 189         to = argv_buf;
 190         left = sizeof(argv_buf);
 191         for (i = 0; i < argc; i++) {
 192                 int sublen;
 193
 194                 /*
 195                  *      Don't touch argv's which won't be translated.
 196                  */
 197                 if (strchr(argv[i], '%') == NULL) continue;
 198
 199                 if (!request) continue;
 200
 201                 sublen = radius_xlat(to, left - 1, argv[i], request, NULL);
 202                 if (sublen <= 0) {
 203                         /*
 204                          *      Fail to be backwards compatible.
 205                          *
 206                          *      It's yucky, but it won't break anything,
 207                          *      and it won't cause security problems.
 208                          */
 209                         sublen = 0;
 210                 }
 211
 212                 argv[i] = to;
 213                 to += sublen;
 214                 *(to++) = '\0';
 215                 left -= sublen;
 216                 left--;
 217
 218                 if (left <= 0) {
 219                         radlog(L_ERR, "Exec-Program: Ran out of space while expanding arguments.");
 220                         return -1;
 221                 }
 222         }
 223         argv[argc] = NULL;
 224
 225 #ifndef __MINGW32__
 226         /*
 227          *      Open a pipe for child/parent communication, if necessary.
 228          */
 229         if (exec_wait) {
 230                 if (input_fd) {
 231                         if (pipe(to_child) != 0) {
 232                                 radlog(L_ERR|L_CONS, "Couldn't open pipe to child: %s",
 233                                        strerror(errno));
 234                                 return -1;
 235                         }
 236                 }
 237                 if (output_fd) {
 238                         if (pipe(from_child) != 0) {
 239                                 radlog(L_ERR|L_CONS, "Couldn't open pipe from child: %s",
 240                                        strerror(errno));
 241                                 /* safe because these either need closing or are == -1 */
 242                                 close(to_child[0]);
 243                                 close(to_child[1]);
 244                                 return -1;
 245                         }
 246                 }
 247         }
 248
 249         envp[0] = NULL;
 250
 251         if (input_pairs) {
 252                 int envlen;
 253                 char buffer[1024];
 254
 255                 /*
 256                  *      Set up the environment variables in the
 257                  *      parent, so we don't call libc functions that
 258                  *      hold mutexes.  They might be locked when we fork,
 259                  *      and will remain locked in the child.
 260                  */
 261                 envlen = 0;
 262
 263                 for (vp = input_pairs; vp != NULL; vp = vp->next) {
 264                         /*
 265                          *      Hmm... maybe we shouldn't pass the
 266                          *      user's password in an environment
 267                          *      variable...
 268                          */
 269                         snprintf(buffer, sizeof(buffer), "%s=", vp->name);
 270                         if (shell_escape) {
 271                                 for (p = buffer; *p != '='; p++) {
 272                                         if (*p == '-') {
 273                                                 *p = '_';
 274                                         } else if (isalpha((int) *p)) {
 275                                                 *p = toupper(*p);
 276                                         }
 277                                 }
 278                         }
 279
 280                         n = strlen(buffer);
 281                         vp_prints_value(buffer+n, sizeof(buffer) - n, vp, shell_escape);
 282
 283                         envp[envlen++] = strdup(buffer);
 284
 285                         /*
 286                          *      Don't add too many attributes.
 287                          */
 288                         if (envlen == (MAX_ENVP - 1)) break;
 289                 }
 290                 envp[envlen] = NULL;
 291         }
 292
 293         if (exec_wait) {
 294                 pid = rad_fork();       /* remember PID */
 295         } else {
 296                 pid = fork();           /* don't wait */
 297         }
 298
 299         if (pid == 0) {
 300                 int devnull;
 301
 302                 /*
 303                  *      Child process.
 304                  *
 305                  *      We try to be fail-safe here. So if ANYTHING
 306                  *      goes wrong, we exit with status 1.
 307                  */
 308
 309                 /*
 310                  *      Open STDIN to /dev/null
 311                  */
 312                 devnull = open("/dev/null", O_RDWR);
 313                 if (devnull < 0) {
 314                         radlog(L_ERR|L_CONS, "Failed opening /dev/null: %s\n",
 315                                strerror(errno));
 316                         exit(1);
 317                 }
 318
 319                 /*
 320                  *      Only massage the pipe handles if the parent
 321                  *      has created them.
 322                  */
 323                 if (exec_wait) {
 324
 325                         if (input_fd) {
 326                                 close(to_child[1]);
 327                                 dup2(to_child[0], STDIN_FILENO);
 328                         } else {
 329                                 dup2(devnull, STDIN_FILENO);
 330                         }
 331
 332                         if (output_fd) {
 333                                 close(from_child[0]);
 334                                 dup2(from_child[1], STDOUT_FILENO);
 335                         } else {
 336                                 dup2(devnull, STDOUT_FILENO);
 337                         }
 338
 339                 } else {        /* no pipe, STDOUT should be /dev/null */
 340                         dup2(devnull, STDIN_FILENO);
 341                         dup2(devnull, STDOUT_FILENO);
 342                 }
 343
 344                 /*
 345                  *      If we're not debugging, then we can't do
 346                  *      anything with the error messages, so we throw
 347                  *      them away.
 348                  *
 349                  *      If we are debugging, then we want the error
 350                  *      messages to go to the STDERR of the server.
 351                  */
 352                 if (debug_flag == 0) {
 353                         dup2(devnull, STDERR_FILENO);
 354                 }
 355                 close(devnull);
 356
 357                 /*
 358                  *      The server may have MANY FD's open.  We don't
 359                  *      want to leave dangling FD's for the child process
 360                  *      to play funky games with, so we close them.
 361                  */
 362                 closefrom(3);
 363
 364                 execve(argv[0], argv, envp);
 365                 radlog(L_ERR, "Exec-Program: FAILED to execute %s: %s",
 366                        argv[0], strerror(errno));
 367                 exit(1);
 368         }
 369
 370         /*
 371          *      Free child environment variables
 372          */
 373         for (i = 0; envp[i] != NULL; i++) {
 374                 free(envp[i]);
 375         }
 376
 377         /*
 378          *      Parent process.
 379          */
 380         if (pid < 0) {
 381                 radlog(L_ERR|L_CONS, "Couldn't fork %s: %s",
 382                        argv[0], strerror(errno));
 383                 if (exec_wait) {
 384                         /* safe because these either need closing or are == -1 */
 385                         close(to_child[0]);
 386                         close(to_child[1]);
 387                         close(from_child[0]);
 388                         close(from_child[0]);
 389                 }
 390                 return -1;
 391         }
 392
 393         /*
 394          *      We're not waiting, exit, and ignore any child's status.
 395          */
 396         if (exec_wait) {
 397                 /*
 398                  *      Close the ends of the pipe(s) the child is using
 399                  *      return the ends of the pipe(s) our caller wants
 400                  *
 401                  */
 402                 if (input_fd) {
 403                         *input_fd = to_child[1];
 404                         close(to_child[0]);
 405                 }
 406                 if (output_fd) {
 407                         *output_fd = from_child[0];
 408                         close(from_child[1]);
 409                 }
 410         }
 411
 412         return pid;
 413 }
 414
 415 /*
 416  * read from the child process into buffer "answer" of length "left"
 417  */
 418 int radius_readfrom_program(int fd, pid_t pid, int timeout, char *answer, int left) {
 419
 420         int done;
 421         int status;
 422         struct timeval start;
 423 #ifdef O_NONBLOCK
 424         int nonblock = TRUE;
 425 #endif
 426
 427 #ifdef O_NONBLOCK
 428         /*
 429          *      Try to set it non-blocking.
 430          */
 431         do {
 432                 int flags;
 433
 434                 if ((flags = fcntl(fd, F_GETFL, NULL)) < 0)  {
 435                         nonblock = FALSE;
 436                         break;
 437                 }
 438
 439                 flags |= O_NONBLOCK;
 440                 if( fcntl(fd, F_SETFL, flags) < 0) {
 441                         nonblock = FALSE;
 442                         break;
 443                 }
 444         } while (0);
 445 #endif
 446
 447
 448         /*
 449          *      Read from the pipe until we doesn't get any more or
 450          *      until the message is full.
 451          */
 452         done = 0;
 453         gettimeofday(&start, NULL);
 454         while (1) {
 455                 int rcode;
 456                 fd_set fds;
 457                 struct timeval when, elapsed, wake;
 458
 459                 FD_ZERO(&fds);
 460                 FD_SET(fd, &fds);
 461
 462                 gettimeofday(&when, NULL);
 463                 tv_sub(&when, &start, &elapsed);
 464                 if (elapsed.tv_sec >= timeout) goto too_long;
 465
 466                 when.tv_sec = timeout;
 467                 when.tv_usec = 0;
 468                 tv_sub(&when, &elapsed, &wake);
 469
 470                 rcode = select(fd + 1, &fds, NULL, NULL, &wake);
 471                 if (rcode == 0) {
 472                 too_long:
 473                         radlog(L_ERR, "Child PID %u (%s) is taking too much time: forcing failure and killing child.", pid, argv[0]);
 474                         kill(pid, SIGTERM);
 475                         close(fd); /* should give SIGPIPE to child, too */
 476
 477                         /*
 478                          *      Clean up the child entry.
 479                          */
 480                         rad_waitpid(pid, &status);
 481                         return -1;
 482                 }
 483                 if (rcode < 0) {
 484                         if (errno == EINTR) continue;
 485                         break;
 486                 }
 487
 488 #ifdef O_NONBLOCK
 489                 /*
 490                  *      Read as many bytes as possible.  The kernel
 491                  *      will return the number of bytes available.
 492                  */
 493                 if (nonblock) {
 494                         status = read(fd, answer + done, left);
 495                 } else
 496 #endif
 497                         /*
 498                          *      There's at least 1 byte ready: read it.
 499                          */
 500                         status = read(fd, answer + done, 1);
 501
 502                 /*
 503                  *      Nothing more to read: stop.
 504                  */
 505                 if (status == 0) {
 506                         break;
 507                 }
 508
 509                 /*
 510                  *      Error: See if we have to continue.
 511                  */
 512                 if (status < 0) {
 513                         /*
 514                          *      We were interrupted: continue reading.
 515                          */
 516                         if (errno == EINTR) {
 517                                 continue;
 518                         }
 519
 520                         /*
 521                          *      There was another error.  Most likely
 522                          *      The child process has finished, and
 523                          *      exited.
 524                          */
 525                         break;
 526                 }
 527
 528                 done += status;
 529                 left -= status;
 530                 if (left <= 0) break;
 531         }
 532
 533         return done;
 534 }
 535
 536 /*
 537  *      Execute a program on successful authentication.
 538  *      Return 0 if exec_wait == 0.
 539  *      Return the exit code of the called program if exec_wait != 0.
 540  *      Return -1 on fork/other errors in the parent process.
 541  */
 542 int radius_exec_program(const char *cmd, REQUEST *request,
 543                         int exec_wait,
 544                         char *user_msg, int msg_len,
 545                         VALUE_PAIR *input_pairs,
 546                         VALUE_PAIR **output_pairs,
 547                         int shell_escape)
 548 {
 549         VALUE_PAIR *vp;
 550         char *p;
 551         int from_child;
 552         pid_t pid, child_pid;
 553         int comma = 0;
 554         int status;
 555         int n, done;
 556         char answer[4096];
 557
 558         pid = radius_start_program(cmd, request, exec_wait, NULL, &from_child, input_pairs, shell_escape);
 559         if (pid < 0) {
 560                 return -1;
 561         }
 562
 563         if (!exec_wait)
 564                 return 0;
 565
 566         done = radius_readfrom_program(from_child, pid, 10, answer, sizeof(answer));
 567         if (done < 0) {
 568                 /*
 569                  * failure - radius_readfrom_program will
 570                  * have called close(from_child) for us
 571                  */
 572                 DEBUG("failed to read from child output");
 573                 return 1;
 574
 575         }
 576         answer[done] = 0;
 577
 578
 579         /*
 580          *      Make sure that the writer can't block while writing to
 581          *      a pipe that no one is reading from anymore.
 582          */
 583         close(from_child);
 584
 585         DEBUG2("Exec-Program output: %s", answer);
 586
 587         /*
 588          *      Parse the output, if any.
 589          */
 590         if (done) {
 591                 n = T_OP_INVALID;
 592                 if (output_pairs) {
 593                         /*
 594                          *      For backwards compatibility, first check
 595                          *      for plain text (user_msg).
 596                          */
 597                         vp = NULL;
 598                         n = userparse(answer, &vp);
 599                         if (vp) {
 600                                 pairfree(&vp);
 601                         }
 602                 }
 603
 604                 if (n == T_OP_INVALID) {
 605                         DEBUG("Exec-Program-Wait: plaintext: %s", answer);
 606                         if (user_msg) {
 607                                 strlcpy(user_msg, answer, msg_len);
 608                         }
 609                 } else {
 610                         /*
 611                          *      HACK: Replace '\n' with ',' so that
 612                          *      userparse() can parse the buffer in
 613                          *      one go (the proper way would be to
 614                          *      fix userparse(), but oh well).
 615                          */
 616                         for (p = answer; *p; p++) {
 617                                 if (*p == '\n') {
 618                                         *p = comma ? ' ' : ',';
 619                                         p++;
 620                                         comma = 0;
 621                                 }
 622                                 if (*p == ',') comma++;
 623                         }
 624
 625                         /*
 626                          *      Replace any trailing comma by a NUL.
 627                          */
 628                         if (answer[strlen(answer) - 1] == ',') {
 629                                 answer[strlen(answer) - 1] = '\0';
 630                         }
 631
 632                         radlog(L_DBG,"Exec-Program-Wait: value-pairs: %s", answer);
 633                         if (userparse(answer, &vp) == T_OP_INVALID) {
 634                                 radlog(L_ERR, "Exec-Program-Wait: %s: unparsable reply", cmd);
 635
 636                         } else {
 637                                 /*
 638                                  *      Tell the caller about the value
 639                                  *      pairs.
 640                                  */
 641                                 *output_pairs = vp;
 642                         }
 643                 } /* else the answer was a set of VP's, not a text message */
 644         } /* else we didn't read anything from the child */
 645
 646         /*
 647          *      Call rad_waitpid (should map to waitpid on non-threaded
 648          *      or single-server systems).
 649          */
 650         child_pid = rad_waitpid(pid, &status);
 651         if (child_pid == 0) {
 652                 radlog(L_DBG, "Exec-Program: Timeout waiting for child");
 653                 return 2;
 654         }
 655
 656         if (child_pid == pid) {
 657                 if (WIFEXITED(status)) {
 658                         status = WEXITSTATUS(status);
 659                         radlog(L_DBG, "Exec-Program: returned: %d", status);
 660                         return status;
 661                 }
 662         }
 663
 664         radlog(L_ERR|L_CONS, "Exec-Program: Abnormal child exit: %s",
 665                strerror(errno));
 666         return 1;
 667 #else
 668         msg_len = msg_len;      /* -Wunused */
 669
 670         if (exec_wait) {
 671                 radlog(L_ERR, "Exec-Program-Wait is not supported");
 672                 return -1;
 673         }
 674
 675         /*
 676          *      We're not waiting, so we don't look for a
 677          *      message, or VP's.
 678          */
 679         user_msg = NULL;
 680         output_pairs = NULL;
 681
 682         {
 683                 /*
 684                  *      The _spawn and _exec families of functions are
 685                  *      found in Windows compiler libraries for
 686                  *      portability from UNIX. There is a variety of
 687                  *      functions, including the ability to pass
 688                  *      either a list or array of parameters, to
 689                  *      search in the PATH or otherwise, and whether
 690                  *      or not to pass an environment (a set of
 691                  *      environment variables). Using _spawn, you can
 692                  *      also specify whether you want the new process
 693                  *      to close your program (_P_OVERLAY), to wait
 694                  *      until the new process is finished (_P_WAIT) or
 695                  *      for the two to run concurrently (_P_NOWAIT).
 696
 697                  *      _spawn and _exec are useful for instances in
 698                  *      which you have simple requirements for running
 699                  *      the program, don't want the overhead of the
 700                  *      Windows header file, or are interested
 701                  *      primarily in portability.
 702                  */
 703
 704                 /*
 705                  *      FIXME: check return code... what is it?
 706                  */
 707                 _spawnve(_P_NOWAIT, argv[0], argv, envp);
 708         }
 709
 710         return 0;
 711 #endif
 712 }
 713
 714 void exec_trigger(REQUEST *request, CONF_SECTION *cs, const char *name)
 715 {
 716         CONF_SECTION *subcs;
 717         CONF_ITEM *ci;
 718         CONF_PAIR *cp;
 719         const char *attr;
 720         const char *value;
 721         VALUE_PAIR *vp;
 722
 723         /*
 724          *      Use global "trigger" section if no local config is given.
 725          */
 726         if (!cs) {
 727                 cs = mainconfig.config;
 728                 attr = name;
 729         } else {
 730                 /*
 731                  *      Try to use pair name, rather than reference.
 732                  */
 733                 attr = strrchr(name, '.');
 734                 if (attr) {
 735                         attr++;
 736                 } else {
 737                         attr = name;
 738                 }
 739         }
 740
 741         /*
 742          *      Find local "trigger" subsection.  If it isn't found,
 743          *      try using the global "trigger" section, and reset the
 744          *      reference to the full path, rather than the sub-path.
 745          */
 746         subcs = cf_section_sub_find(cs, "trigger");
 747         if (!subcs && (cs != mainconfig.config)) {
 748                 subcs = cf_section_sub_find(mainconfig.config, "trigger");
 749                 attr = name;
 750         }
 751
 752         if (!subcs) {
 753                 DEBUG3("No trigger subsection: ignoring trigger %s", name);
 754                 return;
 755         }
 756
 757         ci = cf_reference_item(subcs, mainconfig.config, attr);
 758         if (!ci) {
 759                 DEBUG3("No such item in trigger section: %s", attr);
 760                 return;
 761         }
 762
 763         if (!cf_item_is_pair(ci)) {
 764                 DEBUG2("Trigger is not a configuration variable: %s", attr);
 765                 return;
 766         }
 767
 768         cp = cf_itemtopair(ci);
 769         if (!cp) return;
 770
 771         value = cf_pair_value(cp);
 772         if (!value) {
 773                 DEBUG2("Trigger has no value: %s", name);
 774                 return;
 775         }
 776
 777         /*
 778          *      May be called for Status-Server packets.
 779          */
 780         vp = NULL;
 781         if (request && request->packet) vp = request->packet->vps;
 782
 783         DEBUG("Trigger %s -> %s", name, value);
 784         radius_exec_program(value, request, 0, NULL, 0, vp, NULL, 1);
 785 }