*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
*
- * Copyright 2000 The FreeRADIUS server project
- * Copyright 2000 Michael J. Hartwick <hartwick@hartwick.com>
+ * Copyright 2000-2004,2006 The FreeRADIUS server project
*/
-static const char rcsid[] = "$Id$";
-#include "autoconf.h"
+#include <freeradius-devel/ident.h>
+RCSID("$Id$")
+
+#include <freeradius-devel/radiusd.h>
+#include <freeradius-devel/rad_assert.h>
#include <sys/file.h>
-#include <stdlib.h>
-#include <string.h>
#include <fcntl.h>
#include <ctype.h>
#include <signal.h>
-#if HAVE_SYS_WAIT_H
+#ifdef HAVE_SYS_WAIT_H
# include <sys/wait.h>
#endif
#ifndef WEXITSTATUS
# define WIFEXITED(stat_val) (((stat_val) & 255) == 0)
#endif
-#include "radiusd.h"
-#include "rad_assert.h"
-
-#ifndef HAVE_PTHREAD_H
-#define rad_fork(n) fork()
-#define rad_waitpid waitpid
-#endif
-
+#define MAX_ARGV (256)
/*
* Execute a program on successful authentication.
* Return 0 if exec_wait == 0.
* Return -1 on fork/other errors in the parent process.
*/
int radius_exec_program(const char *cmd, REQUEST *request,
- int exec_wait, const char **user_msg)
+ int exec_wait,
+ char *user_msg, int msg_len,
+ VALUE_PAIR *input_pairs,
+ VALUE_PAIR **output_pairs,
+ int shell_escape)
{
VALUE_PAIR *vp;
- static char message[256];
+ char mycmd[1024];
char answer[4096];
- char *argv[256];
- char *buf, *p;
+ char argv_buf[4096];
+ char *argv[MAX_ARGV];
+ const char *from;
+ char *p, *to;
int pd[2];
pid_t pid, child_pid;
int argc = -1;
int comma = 0;
int status;
+ int i;
int n, left, done;
+ if (user_msg) *user_msg = '\0';
+ if (output_pairs) *output_pairs = NULL;
+
+ if (strlen(cmd) > (sizeof(mycmd) - 1)) {
+ radlog(L_ERR|L_CONS, "Command line is too long");
+ return -1;
+ }
+
/*
- * Open a pipe for child/parent communication, if
- * necessary.
+ * Check for bad escapes.
*/
- if (exec_wait) {
- if (pipe(pd) != 0) {
- radlog(L_ERR|L_CONS, "Couldn't open pipe: %s",
- strerror(errno));
- return -1;
+ if (cmd[strlen(cmd) - 1] == '\\') {
+ radlog(L_ERR|L_CONS, "Command line has final backslash, without a following character");
+ return -1;
+ }
+
+ strlcpy(mycmd, cmd, sizeof(mycmd));
+
+ /*
+ * Split the string into argv's BEFORE doing radius_xlat...
+ */
+ from = cmd;
+ to = mycmd;
+ argc = 0;
+ while (*from) {
+ int length;
+
+ /*
+ * Skip spaces.
+ */
+ if ((*from == ' ') || (*from == '\t')) {
+ from++;
+ continue;
}
+
+ argv[argc] = to;
+ argc++;
+
+ if (argc >= (MAX_ARGV - 1)) break;
+
+ /*
+ * Copy the argv over to our buffer.
+ */
+ while (*from && (*from != ' ') && (*from != '\t')) {
+ if (to >= mycmd + sizeof(mycmd) - 1) {
+ return -1; /* ran out of space */
+ }
+
+ switch (*from) {
+ case '"':
+ case '\'':
+ length = rad_copy_string(to, from);
+ if (length < 0) {
+ radlog(L_ERR|L_CONS, "Invalid string passed as argument for external program");
+ return -1;
+ }
+ from += length;
+ to += length;
+ break;
+
+ case '%':
+ if (from[1] == '{') {
+ *(to++) = *(from++);
+
+ length = rad_copy_variable(to, from);
+ if (length < 0) {
+ radlog(L_ERR|L_CONS, "Invalid variable expansion passed as argument for external program");
+ return -1;
+ }
+ from += length;
+ to += length;
+ } else { /* FIXME: catch %%{ ? */
+ *(to++) = *(from++);
+ }
+ break;
+
+ default:
+ *(to++) = *(from++);
+ }
+ } /* end of string, or found a space */
+
+ *(to++) = '\0'; /* terminate the string */
}
/*
- * Do the translation (as the parent) of the command to
- * execute. This MAY involve calling other modules, so
- * we want to do it in the parent.
+ * We have to have SOMETHING, at least.
*/
- radius_xlat(answer, sizeof(answer), cmd, request, NULL);
- buf = answer;
-
+ if (argc <= 0) {
+ radlog(L_ERR, "Exec-Program: empty command line.");
+ return -1;
+ }
+
/*
- * Log the command if we are debugging something
+ * Expand each string, as appropriate.
*/
- DEBUG("Exec-Program: %s", buf);
-
+ to = argv_buf;
+ left = sizeof(argv_buf);
+ for (i = 0; i < argc; i++) {
+ int sublen;
+
+ /*
+ * Don't touch argv's which won't be translated.
+ */
+ if (strchr(argv[i], '%') == NULL) continue;
+
+ sublen = radius_xlat(to, left - 1, argv[i], request, NULL);
+ if (sublen <= 0) {
+ /*
+ * Fail to be backwards compatible.
+ *
+ * It's yucky, but it won't break anything,
+ * and it won't cause security problems.
+ */
+ sublen = 0;
+ }
+
+ argv[i] = to;
+ to += sublen;
+ *(to++) = '\0';
+ left -= sublen;
+ left--;
+
+ if (left <= 0) {
+ radlog(L_ERR, "Exec-Program: Ran out of space while expanding arguments.");
+ return -1;
+ }
+ }
+ argv[argc] = NULL;
+
/*
- * Build vector list of arguments and execute.
+ * Open a pipe for child/parent communication, if necessary.
*/
- p = strtok(buf, " \t");
- if (p) do {
- argv[++argc] = p;
- p = strtok(NULL, " \t");
- } while(p != NULL);
-
- argv[++argc] = p;
- if (argc == 0) {
- radlog(L_ERR, "Exec-Program: empty command line.");
- return -1;
+ if (exec_wait) {
+ if (pipe(pd) != 0) {
+ radlog(L_ERR|L_CONS, "Couldn't open pipe: %s",
+ strerror(errno));
+ return -1;
+ }
+ } else {
+ /*
+ * We're not waiting, so we don't look for a
+ * message, or VP's.
+ */
+ user_msg = NULL;
+ output_pairs = NULL;
}
- if ((pid = rad_fork(exec_wait)) == 0) {
+ if (exec_wait) {
+ pid = rad_fork(); /* remember PID */
+ } else {
+ pid = fork(); /* don't wait */
+ }
+
+ if (pid == 0) {
#define MAX_ENVP 1024
- int i, devnull;
+ int devnull;
char *envp[MAX_ENVP];
int envlen;
char buffer[1024];
- /*
+ /*
* Child process.
*
- * We try to be fail-safe here. So if ANYTHING
+ * We try to be fail-safe here. So if ANYTHING
* goes wrong, we exit with status 1.
*/
strerror(errno));
exit(1);
}
-
+
/*
* pd[1] is the FD that the child will write to,
* so we make it STDOUT.
* want to leave dangling FD's for the child process
* to play funky games with, so we close them.
*/
- for (i = 3; i < 256; i++) {
- close(i);
- }
+ closefrom(3);
/*
* Set up the environment variables.
*/
envlen = 0;
- for (vp = request->packet->vps; vp->next; vp = vp->next) {
+ for (vp = input_pairs; vp != NULL; vp = vp->next) {
/*
* Hmm... maybe we shouldn't pass the
* user's password in an environment
* variable...
*/
snprintf(buffer, sizeof(buffer), "%s=", vp->name);
- for (p = buffer; *p != '='; p++) {
- if (*p == '-') {
- *p = '_';
- } else if (isalpha(*p)) {
- *p = toupper(*p);
+ if (shell_escape) {
+ for (p = buffer; *p != '='; p++) {
+ if (*p == '-') {
+ *p = '_';
+ } else if (isalpha((int) *p)) {
+ *p = toupper(*p);
+ }
}
}
n = strlen(buffer);
- vp_prints_value(buffer+n, sizeof(buffer) - n, vp, 1);
+ vp_prints_value(buffer+n, sizeof(buffer) - n, vp, shell_escape);
envp[envlen++] = strdup(buffer);
+
+ /*
+ * Don't add too many attributes.
+ */
+ if (envlen == (MAX_ENVP - 1)) break;
}
envp[envlen] = NULL;
execve(argv[0], argv, envp);
-
radlog(L_ERR, "Exec-Program: FAILED to execute %s: %s",
argv[0], strerror(errno));
exit(1);
}
/*
- * We're not waiting, exit, and ignore any child's
- * status.
+ * We're not waiting, exit, and ignore any child's status.
*/
if (!exec_wait) {
return 0;
*/
close(pd[0]);
+ DEBUG2("Exec-Program output: %s", answer);
+
/*
* Parse the output, if any.
*/
if (done) {
- /*
- * For backwards compatibility, first check
- * for plain text (user_msg).
- */
- vp = NULL;
- n = userparse(answer, &vp);
- if (vp) {
- pairfree(&vp);
+ n = T_OP_INVALID;
+ if (output_pairs) {
+ /*
+ * For backwards compatibility, first check
+ * for plain text (user_msg).
+ */
+ vp = NULL;
+ n = userparse(answer, &vp);
+ if (vp) {
+ pairfree(&vp);
+ }
}
- if (n < 0) {
- radlog(L_DBG, "Exec-Program-Wait: plaintext: %s", answer);
+ if (n == T_OP_INVALID) {
+ DEBUG("Exec-Program-Wait: plaintext: %s", answer);
if (user_msg) {
- strncpy(message, answer, sizeof(message));
- message[sizeof(message) - 1] = 0;
- *user_msg = message;
+ strlcpy(user_msg, answer, msg_len);
}
} else {
/*
}
/*
- * Replace any trailing comma by a NUL.
+ * Replace any trailing comma by a NUL.
*/
if (answer[strlen(answer) - 1] == ',') {
answer[strlen(answer) - 1] = '\0';
}
radlog(L_DBG,"Exec-Program-Wait: value-pairs: %s", answer);
- if (userparse(answer, &vp) < 0) {
+ if (userparse(answer, &vp) == T_OP_INVALID) {
radlog(L_ERR, "Exec-Program-Wait: %s: unparsable reply", cmd);
} else {
/*
- * Add the attributes to the reply.
+ * Tell the caller about the value
+ * pairs.
*/
- pairmove(&request->reply->vps, &vp);
- pairfree(&vp);
+ *output_pairs = vp;
}
} /* else the answer was a set of VP's, not a text message */
- } /* else we didn't read anything from the child. */
+ } /* else we didn't read anything from the child */
/*
* Call rad_waitpid (should map to waitpid on non-threaded
* or single-server systems).
*/
- child_pid = rad_waitpid(pid, &status, 0);
- rad_assert(child_pid == pid);
-
- if (WIFEXITED(status)) {
- status = WEXITSTATUS(status);
- radlog(L_DBG, "Exec-Program: returned: %d", status);
- return status;
+ child_pid = rad_waitpid(pid, &status);
+ if (child_pid == 0) {
+ radlog(L_DBG, "Exec-Program: Timeout waiting for child");
+ return 2;
+ }
+
+ if (child_pid == pid) {
+ if (WIFEXITED(status)) {
+ status = WEXITSTATUS(status);
+ radlog(L_DBG, "Exec-Program: returned: %d", status);
+ return status;
+ }
}
- radlog(L_ERR|L_CONS, "Exec-Program: Abnormal child exit (killed or coredump)");
+ radlog(L_ERR|L_CONS, "Exec-Program: Abnormal child exit: %s",
+ strerror(errno));
return 1;
}
projects / freeradius.git / blobdiff