int IOProxy::connect_callback( Stream * /*stream*/ )
{
ReliSock *client = new ReliSock;
bool accept_client = false;
int success;
success = server->accept(*client);
if(success) {
if(get_local_ipaddr().compare_address(client->peer_addr())) {
dprintf(D_ALWAYS,"IOProxy: accepting connection from %s\n",client->peer_ip_str());
accept_client = true;
} else {
dprintf(D_ALWAYS,"IOProxy: rejecting connection from %s: invalid ip addr\n",client->peer_ip_str());
}
} else {
dprintf(D_ALWAYS,"IOProxy: Couldn't accept connection: %s\n",strerror(errno));
}
if(accept_client) {
IOProxyHandler *handler = new IOProxyHandler();
if(!handler->init(client,cookie)) {
dprintf(D_ALWAYS,"IOProxy: couldn't register request callback!\n");
client->close();
delete client;
}
} else {
client->close();
delete client;
}
return KEEP_STREAM;
}
MyString get_hostname(const condor_sockaddr& addr) {
MyString ret;
if (nodns_enabled())
return convert_ipaddr_to_hostname(addr);
condor_sockaddr targ_addr;
// just like sin_to_string(), if given address is 0.0.0.0 or equivalent,
// it changes to local IP address.
if (addr.is_addr_any())
targ_addr = get_local_ipaddr(addr.get_protocol());
else
targ_addr = addr;
int e;
char hostname[NI_MAXHOST];
// if given address is link-local IPv6 address, it will have %NICname
// at the end of string
// we would like to avoid it
if (targ_addr.is_ipv6())
targ_addr.set_scope_id(0);
e = condor_getnameinfo(targ_addr, hostname, sizeof(hostname), NULL, 0, 0);
if (e)
return ret;
ret = hostname;
return ret;
}
const char* condor_sockaddr::to_ip_string_ex(char* buf, int len) const
{
// no need to check is_valid()
if (is_addr_any())
return get_local_ipaddr().to_ip_string(buf, len);
else
return to_ip_string(buf, len);
}
MyString condor_sockaddr::to_ip_string_ex() const
{
// no need to check is_valid()
if ( is_addr_any() )
return get_local_ipaddr().to_ip_string();
else
return to_ip_string();
}
const char* my_ip_string() {
static MyString __my_ip_string;
// TODO: Picking IPv4 arbitrarily. WARNING: This function
// gets called while the configuration file is being loaded,
// before we know if IPV4 and/or IPv6 is enabled. It needs to
// return a stable answer, because having it change midway
// through parsing the file is a recipe for failure.
__my_ip_string = get_local_ipaddr(CP_IPV4).to_ip_string();
return __my_ip_string.Value();
}
struct sockaddr_in *
getSockAddr(int sockfd)
{
// do getsockname
static struct sockaddr_in sa_in;
SOCKET_LENGTH_TYPE namelen = sizeof(sa_in);
if (getsockname(sockfd, (struct sockaddr *)&sa_in, (socklen_t*)&namelen) < 0) {
dprintf(D_ALWAYS, "failed getsockname(%d): %s\n", sockfd, strerror(errno));
return NULL;
}
// if getsockname returns INADDR_ANY, we rely upon get_local_addr() since returning
// 0.0.0.0 is not a good idea.
if (sa_in.sin_addr.s_addr == ntohl(INADDR_ANY)) {
// This is standad universe -only code at this point, so we know
// we want an IPv4 address.
condor_sockaddr myaddr = get_local_ipaddr( CP_IPV4 );
sa_in.sin_addr = myaddr.to_sin().sin_addr;
// This can happen, I think, if we're running in IPv6-only mode.
// It may make sense to check for ENABLE_IPV4 (if not an actual
// IPv4 interface) when the checkpoint server starts up, instead.
assert( sa_in.sin_addr.s_addr != ntohl(INADDR_ANY) );
}
return &sa_in;
}
const char* my_ip_string() {
static MyString __my_ip_string;
__my_ip_string = get_local_ipaddr().to_ip_string();
return __my_ip_string.Value();
}
static int
sshpam_query(void *ctx, char **name, char **info,
u_int *num, char ***prompts, u_int **echo_on)
{
Buffer buffer;
struct pam_ctxt *ctxt = ctx;
size_t plen;
u_char type;
char *msg;
size_t len, mlen;
debug3("PAM: %s entering", __func__);
buffer_init(&buffer);
*name = xstrdup("");
*info = xstrdup("");
*prompts = xmalloc(sizeof(char *));
**prompts = NULL;
plen = 0;
*echo_on = xmalloc(sizeof(u_int));
while (ssh_msg_recv(ctxt->pam_psock, &buffer) == 0) {
type = buffer_get_char(&buffer);
msg = buffer_get_string(&buffer, NULL);
mlen = strlen(msg);
switch (type) {
case PAM_PROMPT_ECHO_ON:
case PAM_PROMPT_ECHO_OFF:
*num = 1;
len = plen + mlen + 1;
**prompts = xrealloc(**prompts, 1, len);
strlcpy(**prompts + plen, msg, len - plen);
plen += mlen;
**echo_on = (type == PAM_PROMPT_ECHO_ON);
xfree(msg);
return (0);
case PAM_ERROR_MSG:
case PAM_TEXT_INFO:
/* accumulate messages */
len = plen + mlen + 2;
**prompts = xrealloc(**prompts, 1, len);
strlcpy(**prompts + plen, msg, len - plen);
plen += mlen;
strlcat(**prompts + plen, "\n", len - plen);
plen++;
xfree(msg);
break;
case PAM_ACCT_EXPIRED:
sshpam_account_status = 0;
/* FALLTHROUGH */
case PAM_AUTH_ERR:
debug3("PAM: %s", pam_strerror(sshpam_handle, type));
if (**prompts != NULL && strlen(**prompts) != 0) {
*info = **prompts;
**prompts = NULL;
*num = 0;
**echo_on = 0;
ctxt->pam_done = -1;
xfree(msg);
return 0;
}
/* FALLTHROUGH */
case PAM_SUCCESS:
if (**prompts != NULL) {
/* drain any accumulated messages */
debug("PAM: %s", **prompts);
buffer_append(&loginmsg, **prompts,
strlen(**prompts));
xfree(**prompts);
**prompts = NULL;
}
if (type == PAM_SUCCESS) {
if (!sshpam_authctxt->valid ||
(sshpam_authctxt->pw->pw_uid == 0 &&
options.permit_root_login != PERMIT_YES))
fatal("Internal error: PAM auth "
"succeeded when it should have "
"failed");
import_environments(&buffer);
*num = 0;
**echo_on = 0;
ctxt->pam_done = 1;
xfree(msg);
return (0);
}
error("PAM: %s for %s%.100s from %.100s via %s", msg,
sshpam_authctxt->valid ? "" : "illegal user ",
sshpam_authctxt->user,
get_remote_name_or_ip(utmp_len, options.use_dns),
get_local_ipaddr(packet_get_connection_in()));
/* FALLTHROUGH */
default:
*num = 0;
**echo_on = 0;
xfree(msg);
ctxt->pam_done = -1;
return (-1);
}
}
return (-1);
}
void store_pool_cred_handler(void *, int /*i*/, Stream *s)
{
int result;
char *pw = NULL;
char *domain = NULL;
MyString username = POOL_PASSWORD_USERNAME "@";
if (s->type() != Stream::reli_sock) {
dprintf(D_ALWAYS, "ERROR: pool password set attempt via UDP\n");
return;
}
// if we're the CREDD_HOST, make sure any password setting is done locally
// (since knowing what the pool password is on the CREDD_HOST means being
// able to fetch users' passwords)
char *credd_host = param("CREDD_HOST");
if (credd_host) {
MyString my_fqdn_str = get_local_fqdn();
MyString my_hostname_str = get_local_hostname();
MyString my_ip_str = get_local_ipaddr().to_ip_string();
// figure out if we're on the CREDD_HOST
bool on_credd_host = (strcasecmp(my_fqdn_str.Value(), credd_host) == MATCH);
on_credd_host = on_credd_host || (strcasecmp(my_hostname_str.Value(), credd_host) == MATCH);
on_credd_host = on_credd_host || (strcmp(my_ip_str.Value(), credd_host) == MATCH);
if (on_credd_host) {
// we're the CREDD_HOST; make sure the source address matches ours
const char *addr = ((ReliSock*)s)->peer_ip_str();
if (!addr || strcmp(my_ip_str.Value(), addr)) {
dprintf(D_ALWAYS, "ERROR: attempt to set pool password remotely\n");
free(credd_host);
return;
}
}
free(credd_host);
}
s->decode();
if (!s->code(domain) || !s->code(pw) || !s->end_of_message()) {
dprintf(D_ALWAYS, "store_pool_cred: failed to receive all parameters\n");
goto spch_cleanup;
}
if (domain == NULL) {
dprintf(D_ALWAYS, "store_pool_cred_handler: domain is NULL\n");
goto spch_cleanup;
}
// construct the full pool username
username += domain;
// do the real work
if (pw) {
result = store_cred_service(username.Value(), pw, ADD_MODE);
SecureZeroMemory(pw, strlen(pw));
}
else {
result = store_cred_service(username.Value(), NULL, DELETE_MODE);
}
s->encode();
if (!s->code(result)) {
dprintf(D_ALWAYS, "store_pool_cred: Failed to send result.\n");
goto spch_cleanup;
}
if (!s->end_of_message()) {
dprintf(D_ALWAYS, "store_pool_cred: Failed to send end of message.\n");
}
spch_cleanup:
if (pw) free(pw);
if (domain) free(domain);
}