*
* Licensed under GPLv2, see file LICENSE in this tarball for details.
*/
+
+/*
+ * A typical usage of BB lpd looks as follows:
+ * # tcpsvd -E 0 515 lpd [SPOOLDIR] [HELPER-PROG [ARGS...]]
+ *
+ * This starts TCP listener on port 515 (default for LP protocol).
+ * When a client connection is made (via lpr) lpd first changes its
+ * working directory to SPOOLDIR (current dir is the default).
+ *
+ * SPOOLDIR is the spool directory which contains printing queues
+ * and should have the following structure:
+ *
+ * SPOOLDIR/
+ * <queue1>
+ * ...
+ * <queueN>
+ *
+ * <queueX> can be of two types:
+ * A. a printer character device, an ordinary file or a link to such;
+ * B. a directory.
+ *
+ * In case A lpd just dumps the data it receives from client (lpr) to the
+ * end of queue file/device. This is non-spooling mode.
+ *
+ * In case B lpd enters spooling mode. It reliably saves client data along
+ * with control info in two unique files under the queue directory. These
+ * files are named dfAXXXHHHH and cfAXXXHHHH, where XXX is the job number
+ * and HHHH is the client hostname. Unless a printing helper application
+ * is specified lpd is done at this point.
+ *
+ * NB: file names are produced by peer! They actually may be anything at all.
+ * lpd only sanitizes them (by removing most non-alphanumerics).
+ *
+ * If HELPER-PROG (with optional arguments) is specified then lpd continues
+ * to process client data:
+ * 1. it reads and parses control file (cfA...). The parse process
+ * results in setting environment variables whose values were passed
+ * in control file; when parsing is complete, lpd deletes control file.
+ * 2. it spawns specified helper application. It is then
+ * the helper application who is responsible for both actual printing
+ * and deleting of processed data file.
+ *
+ * A good lpr passes control files which when parsed provides the following
+ * variables:
+ * $H = host which issues the job
+ * $P = user who prints
+ * $C = class of printing (what is printed on banner page)
+ * $J = the name of the job
+ * $L = print banner page
+ * $M = the user to whom a mail should be sent if a problem occurs
+ *
+ * We specifically filter out and NOT provide:
+ * $l = name of datafile ("dfAxxx") - file whose content are to be printed
+ *
+ * lpd provides $DATAFILE instead - the ACTUAL name
+ * of the datafile under which it was saved.
+ * $l would be not reliable (you would be at mercy of remote peer).
+ *
+ * Thus, a typical helper can be something like this:
+ * #!/bin/sh
+ * cat ./"$DATAFILE" >/dev/lp0
+ * mv -f ./"$DATAFILE" save/
+ */
+
#include "libbb.h"
-// TODO: xmalloc_reads is vulnerable to remote OOM attack!
+// strip argument of bad chars
+static char *sane(char *str)
+{
+ char *s = str;
+ char *p = s;
+ while (*s) {
+ if (isalnum(*s) || '-' == *s || '_' == *s) {
+ *p++ = *s;
+ }
+ s++;
+ }
+ *p = '\0';
+ return str;
+}
+
+static char *xmalloc_read_stdin(void)
+{
+ // SECURITY:
+ size_t max = 4 * 1024; // more than enough for commands!
+ return xmalloc_reads(STDIN_FILENO, NULL, &max);
+}
int lpd_main(int argc, char *argv[]) MAIN_EXTERNALLY_VISIBLE;
-int lpd_main(int argc ATTRIBUTE_UNUSED, char *argv[])
+int lpd_main(int argc UNUSED_PARAM, char *argv[])
{
- int spooling;
+ int spooling = spooling; // for compiler
char *s, *queue;
+ char *filenames[2];
- // read command
- s = xmalloc_reads(STDIN_FILENO, NULL);
+ // goto spool directory
+ if (*++argv)
+ xchdir(*argv++);
+
+ // error messages of xfuncs will be sent over network
+ xdup2(STDOUT_FILENO, STDERR_FILENO);
+ // nullify ctrl/data filenames
+ memset(filenames, 0, sizeof(filenames));
+
+ // read command
+ s = queue = xmalloc_read_stdin();
// we understand only "receive job" command
- if (2 != *s) {
+ if (2 != *queue) {
unsupported_cmd:
printf("Command %02x %s\n",
(unsigned char)s[0], "is not supported");
- return EXIT_FAILURE;
+ goto err_exit;
}
- // spool directory contains either links to real printer devices or just simple files
- // these links or files are called "queues"
- // OR
- // if a directory named as given queue exists within spool directory
- // then LPD enters spooling mode and just dumps both control and data files to it
-
- // goto spool directory
- if (argv[1])
- xchdir(argv[1]);
-
- // parse command: "\x2QUEUE_NAME\n"
- queue = s + 1;
- *strchrnul(s, '\n') = '\0';
-
+ // parse command: "2 | QUEUE_NAME | '\n'"
+ queue++;
// protect against "/../" attacks
- if (queue[0] == '.' || strstr(queue, "/."))
+ // *strchrnul(queue, '\n') = '\0'; - redundant, sane() will do
+ if (!*sane(queue))
return EXIT_FAILURE;
// queue is a directory -> chdir to it and enter spooling mode
- spooling = chdir(queue) + 1; /* 0: cannot chdir, 1: done */
-
- xdup2(STDOUT_FILENO, STDERR_FILENO);
+ spooling = chdir(queue) + 1; // 0: cannot chdir, 1: done
+ // we don't free(s), we might need "queue" var later
while (1) {
char *fname;
int expected_len, real_len;
// signal OK
- write(STDOUT_FILENO, "", 1);
+ safe_write(STDOUT_FILENO, "", 1);
// get subcommand
- s = xmalloc_reads(STDIN_FILENO, NULL);
- if (!s)
- return EXIT_SUCCESS; // probably EOF
+ // valid s must be of form: "SUBCMD | LEN | space | FNAME"
+ // N.B. we bail out on any error
+ s = xmalloc_read_stdin();
+ if (!s) { // (probably) EOF
+ char *p, *q, var[2];
+
+ // non-spooling mode or no spool helper specified
+ if (!spooling || !*argv)
+ return EXIT_SUCCESS; // the only non-error exit
+ // spooling mode but we didn't see both ctrlfile & datafile
+ if (spooling != 7)
+ goto err_exit; // reject job
+
+ // spooling mode and spool helper specified -> exec spool helper
+ // (we exit 127 if helper cannot be executed)
+ var[1] = '\0';
+ // read and delete ctrlfile
+ q = xmalloc_xopen_read_close(filenames[0], NULL);
+ unlink(filenames[0]);
+ // provide datafile name
+ // we can use leaky setenv since we are about to exec or exit
+ xsetenv("DATAFILE", filenames[1]);
+ // parse control file by "\n"
+ while ((p = strchr(q, '\n')) != NULL && isalpha(*q)) {
+ *p++ = '\0';
+ // q is a line of <SYM><VALUE>,
+ // we are setting environment string <SYM>=<VALUE>.
+ // Ignoring "l<datafile>", exporting others:
+ if (*q != 'l') {
+ var[0] = *q++;
+ xsetenv(var, q);
+ }
+ q = p; // next line
+ }
+ // helper should not talk over network.
+ // this call reopens stdio fds to "/dev/null"
+ // (no daemonization is done)
+ bb_daemonize_or_rexec(DAEMON_DEVNULL_STDIO | DAEMON_ONLY_SANITIZE, NULL);
+ BB_EXECVP(argv[0], argv);
+ bb_perror_msg_and_die("can't execute '%s'", argv[0]);
+ }
+
+ // validate input.
// we understand only "control file" or "data file" cmds
if (2 != s[0] && 3 != s[0])
goto unsupported_cmd;
-
+ if (spooling & (1 << (s[0]-1))) {
+ printf("Duplicated subcommand\n");
+ goto err_exit;
+ }
+ // get filename
*strchrnul(s, '\n') = '\0';
- // valid s must be of form: SUBCMD | LEN | SP | FNAME
- // N.B. we bail out on any error
fname = strchr(s, ' ');
if (!fname) {
- printf("Command %02x %s\n",
- (unsigned char)s[0], "lacks filename");
- return EXIT_FAILURE;
+// bad_fname:
+ printf("No or bad filename\n");
+ goto err_exit;
}
*fname++ = '\0';
+// // s[0]==2: ctrlfile, must start with 'c'
+// // s[0]==3: datafile, must start with 'd'
+// if (fname[0] != s[0] + ('c'-2))
+// goto bad_fname;
+ // get length
+ expected_len = bb_strtou(s + 1, NULL, 10);
+ if (errno || expected_len < 0) {
+ printf("Bad length\n");
+ goto err_exit;
+ }
+ if (2 == s[0] && expected_len > 16 * 1024) {
+ // SECURITY:
+ // ctrlfile can't be big (we want to read it back later!)
+ printf("File is too big\n");
+ goto err_exit;
+ }
+
+ // open the file
if (spooling) {
// spooling mode: dump both files
- // make "/../" attacks in file names ineffective
- xchroot(".");
// job in flight has mode 0200 "only writable"
- fd = xopen3(fname, O_CREAT | O_WRONLY | O_TRUNC | O_EXCL, 0200);
+ sane(fname);
+ fd = open3_or_warn(fname, O_CREAT | O_WRONLY | O_TRUNC | O_EXCL, 0200);
+ if (fd < 0)
+ goto err_exit;
+ filenames[s[0] - 2] = xstrdup(fname);
} else {
// non-spooling mode:
// 2: control file (ignoring), 3: data file
if (3 == s[0])
fd = xopen(queue, O_RDWR | O_APPEND);
}
- expected_len = xatoi_u(s + 1);
+
+ // signal OK
+ safe_write(STDOUT_FILENO, "", 1);
+
+ // copy the file
real_len = bb_copyfd_size(STDIN_FILENO, fd, expected_len);
- if (spooling && real_len != expected_len) {
- unlink(fname); // don't keep corrupted files
+ if (real_len != expected_len) {
printf("Expected %d but got %d bytes\n",
expected_len, real_len);
- return EXIT_FAILURE;
+ goto err_exit;
}
- // get ACK and see whether it is NUL (ok)
- if (read(STDIN_FILENO, s, 1) != 1 || s[0] != 0) {
+ // get EOF indicator, see whether it is NUL (ok)
+ // (and don't trash s[0]!)
+ if (safe_read(STDIN_FILENO, &s[1], 1) != 1 || s[1] != 0) {
// don't send error msg to peer - it obviously
- // don't follow the protocol, so probably
+ // doesn't follow the protocol, so probably
// it can't understand us either
- return EXIT_FAILURE;
+ goto err_exit;
}
- // chmod completely downloaded job as "readable+writable"
- if (spooling)
+
+ if (spooling) {
+ // chmod completely downloaded file as "readable+writable"
fchmod(fd, 0600);
- close(fd); // NB: can do close(-1). Who cares?
+ // accumulate dump state
+ // N.B. after all files are dumped spooling should be 1+2+4==7
+ spooling |= (1 << (s[0]-1)); // bit 1: ctrlfile; bit 2: datafile
+ }
+
free(s);
- } /* while (1) */
+ close(fd); // NB: can do close(-1). Who cares?
+
+ // NB: don't do "signal OK" write here, it will be done
+ // at the top of the loop
+ } // while (1)
+
+ err_exit:
+ // don't keep corrupted files
+ if (spooling) {
+#define i spooling
+ for (i = 2; --i >= 0; )
+ if (filenames[i])
+ unlink(filenames[i]);
+ }
+ return EXIT_FAILURE;
}
projects / platform / upstream / busybox.git / blobdiff