qpsmtpd/qpsmtpd-forkserver

376 lines
10 KiB
Plaintext
Raw Normal View History

#!/usr/bin/perl -Tw
use strict;
2010-04-08 07:30:30 +02:00
# Copyright (c) 2001-2010 Ask Bjoern Hansen. See the LICENSE file for details.
# The "command dispatch" system is taken from colobus - http://trainedmonkey.com/colobus/
#
# For more information see http://smtpd.github.io/qpsmtpd/
#
use lib 'lib';
use Qpsmtpd::Constants;
use Qpsmtpd::TcpServer;
use IO::Socket;
use IO::Select;
use Socket;
use Getopt::Long qw(:config no_ignore_case);
use POSIX qw(:sys_wait_h :errno_h :signal_h);
$| = 1;
my $has_ipv6 = Qpsmtpd::TcpServer::has_ipv6;
# Configuration
2013-04-21 06:34:07 +02:00
my $MAXCONN = 15; # max simultaneous connections
my @PORT; # port number(s)
my @LOCALADDR; # ip address(es) to bind to
my $MAXCONNIP = 5; # max simultaneous connections from one IP
my $PID_FILE = '';
my $DETACH; # daemonize on startup
my $NORDNS;
2013-04-21 06:34:07 +02:00
my $USER = (getpwuid $>)[0]; # user to suid to
$USER = 'smtpd' if $USER eq 'root';
sub usage {
2013-04-21 06:34:07 +02:00
print <<"EOT";
usage: qpsmtpd-forkserver [ options ]
-l, --listen-address addr : listen on specific address(es); can be specified
multiple times for multiple bindings. IPv6
addresses must be inside square brackets [], and
don't need to be zero padded.
Default is [::] (if has_ipv6) or 0.0.0.0 (if not)
-p, --port P : listen on a specific port; default 2525; can be
specified multiple times for multiple bindings.
-c, --limit-connections N : limit concurrent connections to N; default 15
-u, --user U : run as a particular user (default '$USER')
-m, --max-from-ip M : limit connections from a single IP; default 5
--pid-file P : print main servers PID to file P
-d, --detach : detach from controlling terminal (daemonize)
-H, --no-rdns : don't perform reverse DNS lookups
EOT
2013-04-21 06:34:07 +02:00
exit 0;
}
2013-04-21 06:34:07 +02:00
GetOptions(
'h|help' => \&usage,
'l|listen-address=s' => \@LOCALADDR,
'c|limit-connections=i' => \$MAXCONN,
2013-04-21 06:34:07 +02:00
'm|max-from-ip=i' => \$MAXCONNIP,
'p|port=s' => \@PORT,
'u|user=s' => \$USER,
'pid-file=s' => \$PID_FILE,
'd|detach' => \$DETACH,
'H|no-rdns' => \$NORDNS,
)
|| &usage;
# detaint the commandline
if ($has_ipv6) {
2013-04-21 06:34:07 +02:00
@LOCALADDR = ('[::]') if !@LOCALADDR;
}
else {
2013-04-21 06:34:07 +02:00
@LOCALADDR = ('0.0.0.0') if !@LOCALADDR;
}
@PORT = 2525 if !@PORT;
my @LISTENADDR;
2013-04-21 06:34:07 +02:00
for (0 .. $#LOCALADDR) {
if ($LOCALADDR[$_] !~ /^(\[.*\]|[\d\w\-.]+)(?::(\d+))?$/) {
2013-04-21 06:34:07 +02:00
&usage;
}
if (defined $2) {
push @LISTENADDR, {'addr' => $1, 'port' => $2};
next;
}
my $addr = $1;
for (0 .. $#PORT) {
if ($PORT[$_] !~ /^(\d+)$/) {
&usage;
}
push @LISTENADDR, {'addr' => $addr, 'port' => $1};
}
}
if ($USER !~ /^([\w\-]+)$/) { &usage; }
$USER = $1;
if ($MAXCONN !~ /^(\d+)$/) { &usage; }
$MAXCONN = $1;
delete $ENV{ENV};
$ENV{PATH} = '/bin:/usr/bin:/var/qmail/bin';
my %childstatus = ();
sub REAPER {
2013-04-21 06:34:07 +02:00
while (defined(my $chld = waitpid(-1, WNOHANG))) {
last unless $chld > 0;
::log(LOGINFO, "cleaning up after $chld");
delete $childstatus{$chld};
}
}
sub HUNTSMAN {
2013-04-21 06:34:07 +02:00
$SIG{CHLD} = 'DEFAULT';
kill 'INT' => keys %childstatus;
if ($PID_FILE && -e $PID_FILE) {
unlink $PID_FILE or ::log(LOGERROR, "unlink: $PID_FILE: $!");
}
exit(0);
}
2013-04-21 06:34:07 +02:00
$SIG{INT} = \&HUNTSMAN;
$SIG{TERM} = \&HUNTSMAN;
my $select = new IO::Select;
my $server;
# establish SERVER socket(s), bind and listen.
for my $listen_addr (@LISTENADDR) {
2013-04-21 06:34:07 +02:00
my @Socket_opts = (
LocalPort => $listen_addr->{'port'},
LocalAddr => $listen_addr->{'addr'},
Proto => 'tcp',
Reuse => 1,
Blocking => 0,
Listen => SOMAXCONN
);
2013-04-21 06:34:07 +02:00
if ($has_ipv6) {
$server = IO::Socket::INET6->new(@Socket_opts)
or die
"Creating TCP socket $listen_addr->{'addr'}:$listen_addr->{'port'}: $!\n";
}
else {
$server = IO::Socket::INET->new(@Socket_opts)
or die
"Creating TCP socket $listen_addr->{'addr'}:$listen_addr->{'port'}: $!\n";
}
IO::Handle::blocking($server, 0);
$select->add($server);
}
if ($PID_FILE) {
2013-04-21 06:34:07 +02:00
if ($PID_FILE =~ m#^(/[\w\d/\-.]+)$#) { $PID_FILE = $1 }
else { &usage }
if (-e $PID_FILE) {
open PID, "+<$PID_FILE"
or die "open pid_file: $!\n";
my $running_pid = <PID> || '';
chomp $running_pid;
if ($running_pid =~ /(\d+)/) {
$running_pid = $1;
if (kill 0, $running_pid) {
die "Found an already running qpsmtpd with pid $running_pid.\n";
}
}
seek PID, 0, 0
or die "Could not seek back to beginning of $PID_FILE: $!\n";
truncate PID, 0
or die "Could not truncate $PID_FILE at 0: $!";
}
else {
open PID, ">$PID_FILE"
or die "open pid_file: $!\n";
}
}
# Load plugins here
my $qpsmtpd = Qpsmtpd::TcpServer->new();
# Drop privileges
2013-04-21 06:34:07 +02:00
my (undef, undef, $quid, $qgid) = getpwnam $USER
or die "unable to determine uid/gid for $USER\n";
my $groups = "$qgid $qgid";
2013-04-21 06:34:07 +02:00
while (my ($name, $passwd, $gid, $members) = getgrent()) {
my @m = split / /, $members;
2013-04-21 06:34:07 +02:00
if (grep { $_ eq $USER } @m) {
$groups .= " $gid";
}
}
endgrent;
$) = $groups;
POSIX::setgid($qgid) or die "unable to change gid: $!\n";
POSIX::setuid($quid) or die "unable to change uid: $!\n";
$> = $quid;
$qpsmtpd->load_plugins;
foreach my $addr (@LISTENADDR) {
::log(LOGINFO, "Listening on $addr->{addr}:$addr->{port}");
}
2013-04-21 06:34:07 +02:00
::log(LOGINFO,
'Running as user '
. (getpwuid($>) || $>)
. ', group '
. (getgrgid($)) || $))
);
if ($DETACH) {
2013-04-21 06:34:07 +02:00
open STDIN, '/dev/null' or die "/dev/null: $!";
open STDOUT, '>/dev/null' or die "/dev/null: $!";
open STDERR, '>&STDOUT' or die "open(stderr): $!";
defined(my $pid = fork) or die "fork: $!";
exit 0 if $pid;
POSIX::setsid or die "setsid: $!";
}
if ($PID_FILE) {
2013-04-21 06:34:07 +02:00
print PID $$, "\n";
close PID;
}
# Populate class cached variables
$qpsmtpd->spool_dir;
$qpsmtpd->size_threshold;
$SIG{HUP} = sub {
$qpsmtpd = Qpsmtpd::TcpServer->new('restart' => 1);
$qpsmtpd->load_plugins;
$qpsmtpd->spool_dir;
$qpsmtpd->size_threshold;
};
while (1) {
2013-04-21 06:34:07 +02:00
REAPER();
my $running = scalar keys %childstatus;
if ($running >= $MAXCONN) {
::log(LOGINFO,
"Too many connections: $running >= $MAXCONN. Waiting one second."
);
sleep 1;
2013-04-21 06:34:07 +02:00
next;
}
2013-04-21 06:34:07 +02:00
my @ready = $select->can_read(1);
next if !@ready;
while (my $server = shift @ready) {
my ($client, $hisaddr) = $server->accept;
next if !$hisaddr;
2013-04-21 06:34:07 +02:00
IO::Handle::blocking($client, 1);
# get local/remote hostname, port and ip address
my ($port, $iaddr, $lport, $laddr, $nto_iaddr, $nto_laddr) =
$qpsmtpd->lrpip($server, $client, $hisaddr);
2013-04-21 06:34:07 +02:00
my ($rc, @msg) =
$qpsmtpd->run_hooks(
'pre-connection',
2013-04-21 06:34:07 +02:00
remote_ip => $nto_iaddr,
remote_port => $port,
local_ip => $nto_laddr,
local_port => $lport,
max_conn_ip => $MAXCONNIP,
child_addrs => [values %childstatus],
);
if ($rc == DENYSOFT || $rc == DENYSOFT_DISCONNECT) {
unless ($msg[0]) {
@msg = ("Sorry, try again later");
}
&respond_client($client, 451, @msg);
close $client;
next;
}
if ($rc == DENY || $rc == DENY_DISCONNECT) {
2013-04-21 06:34:07 +02:00
unless ($msg[0]) {
@msg = ("Sorry, service not available for you");
}
&respond_client($client, 550, @msg);
close $client;
next;
}
my $pid = safe_fork();
if ($pid) {
# parent
$childstatus{$pid} = $iaddr; # add to table
$running++;
close $client;
2013-04-21 06:34:07 +02:00
next;
}
# child
2013-04-21 06:34:07 +02:00
close $_ for $select->handles;
$SIG{$_} = 'DEFAULT' for keys %SIG;
$SIG{ALRM} = sub {
print $client "421 Connection Timed Out\n";
::log(LOGINFO, "Connection Timed Out");
exit;
};
# set enviroment variables
($ENV{TCPLOCALIP}, $ENV{TCPREMOTEIP}, $ENV{TCPREMOTEHOST}) =
$qpsmtpd->tcpenv($nto_laddr, $nto_iaddr);
2013-04-21 06:34:07 +02:00
# don't do this!
#$0 = "qpsmtpd-forkserver: $ENV{TCPREMOTEIP} / $ENV{TCPREMOTEHOST}";
::log(LOGINFO,
"Accepted connection $running/$MAXCONN from $ENV{TCPREMOTEIP} / $ENV{TCPREMOTEHOST}"
);
# dup to STDIN/STDOUT
POSIX::dup2(fileno($client), 0);
POSIX::dup2(fileno($client), 1);
2013-04-21 06:34:07 +02:00
$qpsmtpd->start_connection(
local_ip => $ENV{TCPLOCALIP},
local_port => $lport,
remote_ip => $ENV{TCPREMOTEIP},
remote_port => $port,
);
$qpsmtpd->run($client);
$qpsmtpd->run_hooks('post-connection');
2013-04-21 06:34:07 +02:00
$qpsmtpd->connection->reset;
close $client;
exit; # child
}
}
sub log {
2013-04-21 06:34:07 +02:00
my ($level, $message) = @_;
$qpsmtpd->log($level, $message);
}
sub respond_client {
2013-04-21 06:34:07 +02:00
my ($client, $code, @message) = @_;
$client->autoflush(1);
while (my $msg = shift @message) {
my $line = $code . (@message ? "-" : " ") . $msg;
::log(LOGDEBUG, $line);
print $client "$line\r\n"
or (::log(LOGERROR, "Could not print [$line]: $!"), return 0);
}
return 1;
}
### routine to protect process during fork
sub safe_fork {
2013-04-21 06:34:07 +02:00
### block signal for fork
my $sigset = POSIX::SigSet->new(SIGINT);
POSIX::sigprocmask(SIG_BLOCK, $sigset)
or die "Can't block SIGINT for fork: [$!]\n";
### fork off a child
my $pid = fork;
unless (defined $pid) {
die "Couldn't fork: [$!]\n";
}
### make SIGINT kill us as it did before
$SIG{INT} = 'DEFAULT';
### put back to normal
POSIX::sigprocmask(SIG_UNBLOCK, $sigset)
or die "Can't unblock SIGINT for fork: [$!]\n";
return $pid;
}
__END__
1;