Merge pull request #86 from painless-security/jennifer/aaa_server_port

[trust_router.git] / tid / tids.c

diff --git a/tid/tids.c b/tid/tids.c
index 0569333..f600d66 100644 (file)
--- a/tid/tids.c
+++ b/tid/tids.c
@@ -49,6 +49,7 @@
 #include <tr_socket.h>
 #include <tr_gss.h>
 #include <tr_event.h>
+#include <sys/resource.h>
 
 /**
  * Create a response with minimal fields filled in
@@ -355,7 +356,7 @@ nfds_t tids_get_listener(TIDS_INSTANCE *tids,
                          TIDS_REQ_FUNC *req_handler,
                          tids_auth_func *auth_handler,
                          const char *hostname,
-                         unsigned int port,
+                         int port,
                          void *cookie,
                          int *fd_out,
                          size_t max_fd)
@@ -367,7 +368,7 @@ nfds_t tids_get_listener(TIDS_INSTANCE *tids,
   n_fd = tr_sock_listen_all(port, fd_out, max_fd);
 
   if (n_fd == 0)
-    tr_err("tids_get_listener: Error opening port %d");
+    tr_err("tids_get_listener: Error opening port %d", port);
   else {
     /* opening port succeeded */
     tr_info("tids_get_listener: Opened port %d.", port);
@@ -408,7 +409,7 @@ nfds_t tids_get_listener(TIDS_INSTANCE *tids,
  * Process to handle an incoming TIDS request
  *
  * This should be run in the child process after a fork(). Handles
- * the request, writes the result to result_fd, and terminates via exit().
+ * the request, writes the result to result_fd, and terminates.
  * Never returns to the caller.
  *
  * @param tids TID server instance
@@ -418,6 +419,7 @@ nfds_t tids_get_listener(TIDS_INSTANCE *tids,
 static void tids_handle_proc(TIDS_INSTANCE *tids, int conn_fd, int result_fd)
 {
   const char *response_message = NULL;
+  struct rlimit rlim; /* for disabling core dump */
 
   switch(tr_gss_handle_connection(conn_fd,
                                   "trustidentity", tids->hostname, /* acceptor name */
@@ -442,7 +444,15 @@ static void tids_handle_proc(TIDS_INSTANCE *tids, int conn_fd, int result_fd)
 
   close(result_fd);
   close(conn_fd);
-  exit(0); /* exit to kill forked child process */
+
+  /* This ought to be an exit(0), but log4shib does not play well with fork() due to
+   * threading issues. To ensure we do not get stuck in the exit handler, we will
+   * abort. First disable core dump for this subprocess (the main process will still
+   * dump core if the environment allows). */
+  rlim.rlim_cur = 0; /* max core size of 0 */
+  rlim.rlim_max = 0; /* prevent the core size limit from being raised later */
+  setrlimit(RLIMIT_CORE, &rlim);
+  abort(); /* exit hard */
 }
 
 /* Accept and process a connection on a port opened with tids_get_listener() */
@@ -564,12 +574,12 @@ void tids_sweep_procs(TIDS_INSTANCE *tids)
 }
 
 /* Process tids requests forever. Should not return except on error. */
-int tids_start (TIDS_INSTANCE *tids,
-                TIDS_REQ_FUNC *req_handler,
-                tids_auth_func *auth_handler,
-                const char *hostname,
-                unsigned int port,
-                void *cookie)
+int tids_start(TIDS_INSTANCE *tids,
+               TIDS_REQ_FUNC *req_handler,
+               tids_auth_func *auth_handler,
+               const char *hostname,
+               int port,
+               void *cookie)
 {
   int fd[TR_MAX_SOCKETS]={0};
   nfds_t n_fd=0;