/
githubmirror
/
sudo
Обзор
Документация
Войти
/
githubmirror
/
sudo
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
main
logsrvd/logsrvd.h
262 строки
9 KB
Todd C. Miller
sudo_logsrvd: Add option to disable client host name check
22 фев 2026, 20:39
22 фев 2026, 20:39
a856428
Код
Авторство
О чём код?
/* * SPDX-License-Identifier: ISC * * Copyright (c) 2019-2022, 2025-2026 Todd C. Miller <Todd.Miller@sudo.ws> * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ #ifndef SUDO_LOGSRVD_H #define SUDO_LOGSRVD_H #include <log_server.pb-c.h> #if PROTOBUF_C_VERSION_NUMBER < 1003000 # error protobuf-c version 1.30 or higher required #endif #include <config.h> #if defined(HAVE_OPENSSL) # if defined(HAVE_WOLFSSL) # include <wolfssl/options.h> # endif # include <openssl/ssl.h> # include <openssl/err.h> #endif #include "logsrv_util.h" #include <tls_common.h> /* Default timeout value for server socket */ #define DEFAULT_SOCKET_TIMEOUT_SEC 30 /* How often to send an ACK to the client (commit point) in seconds */ #define ACK_FREQUENCY 10 /* Shutdown timeout (in seconds) in case client connections time out. */ #define SHUTDOWN_TIMEO 10 #define valid_timespec(ts) ((ts) != NULL && \ (ts)->tv_sec >= 0 && (ts)->tv_nsec >= 0 && (ts)->tv_nsec < 1000000000) /* * Connection status. * In the RUNNING state we expect I/O log buffers. */ enum connection_status { INITIAL, CONNECTING, RUNNING, EXITED, SHUTDOWN, FINISHED }; /* * Per-connection relay state. */ struct relay_closure { struct server_address_list *relays; struct server_address *relay_addr; struct sudo_event *read_ev; struct sudo_event *write_ev; struct sudo_event *connect_ev; struct connection_buffer read_buf; struct connection_buffer_list write_bufs; struct peer_info relay_name; #if defined(HAVE_OPENSSL) struct tls_client_closure tls_client; #endif int sock; bool read_instead_of_write; bool write_instead_of_read; bool temporary_write_event; }; /* * Per-connection state. */ struct connection_closure { TAILQ_ENTRY(connection_closure) entries; struct client_message_switch *cms; struct relay_closure *relay_closure; struct eventlog *evlog; struct timespec elapsed_time; struct connection_buffer read_buf; struct connection_buffer_list write_bufs; struct connection_buffer_list free_bufs; struct sudo_event_base *evbase; struct sudo_event *commit_ev; struct sudo_event *read_ev; struct sudo_event *write_ev; #if defined(HAVE_OPENSSL) struct sudo_event *ssl_accept_ev; char *name; SSL *ssl; #endif const char *errstr; FILE *journal; char *journal_path; struct iolog_file iolog_files[IOFD_MAX]; int iolog_dir_fd; int sock; enum connection_status state; bool error; bool tls; bool log_io; bool store_first; bool read_instead_of_write; bool write_instead_of_read; bool temporary_write_event; unsigned char uuid[16]; #ifdef HAVE_STRUCT_IN6_ADDR char ipaddr[INET6_ADDRSTRLEN]; #else char ipaddr[INET_ADDRSTRLEN]; #endif }; /* Client message switch. */ struct client_message_switch { bool (*accept)(const AcceptMessage *msg, const uint8_t *buf, size_t len, struct connection_closure *closure); bool (*reject)(const RejectMessage *msg, const uint8_t *buf, size_t len, struct connection_closure *closure); bool (*exit)(const ExitMessage *msg, const uint8_t *buf, size_t len, struct connection_closure *closure); bool (*restart)(const RestartMessage *msg, const uint8_t *buf, size_t len, struct connection_closure *closure); bool (*alert)(const AlertMessage *msg, const uint8_t *buf, size_t len, struct connection_closure *closure); bool (*iobuf)(int iofd, const IoBuffer *iobuf, const uint8_t *buf, size_t len, struct connection_closure *closure); bool (*suspend)(const CommandSuspend *msg, const uint8_t *buf, size_t len, struct connection_closure *closure); bool (*winsize)(const ChangeWindowSize *msg, const uint8_t *buf, size_t len, struct connection_closure *closure); }; union sockaddr_union { struct sockaddr sa; struct sockaddr_in sin; #ifdef HAVE_STRUCT_IN6_ADDR struct sockaddr_in6 sin6; #endif }; /* * List of server addresses. */ struct server_address { TAILQ_ENTRY(server_address) entries; char *sa_host; char *sa_str; union sockaddr_union sa_un; socklen_t sa_size; bool tls; }; TAILQ_HEAD(server_address_list, server_address); /* * List of active network listeners. */ struct listener { TAILQ_ENTRY(listener) entries; struct sudo_event *ev; char *sa_str; int sock; bool tls; }; TAILQ_HEAD(listener_list, listener); /* iolog_writer.c */ struct eventlog *evlog_new(const TimeSpec *submit_time, InfoMessage * const *info_msgs, size_t infolen, struct connection_closure *closure); bool iolog_init(const AcceptMessage *msg, struct connection_closure *closure); bool iolog_create(int iofd, struct connection_closure *closure); void iolog_close_all(struct connection_closure *closure); bool iolog_flush_all(struct connection_closure *closure); bool iolog_rewrite(const struct timespec *target, struct connection_closure *closure); void update_elapsed_time(const TimeSpec *delta, struct timespec *elapsed); /* logsrvd.c */ extern struct client_message_switch cms_local; bool start_protocol(struct connection_closure *closure); void connection_close(struct connection_closure *closure); bool schedule_commit_point(const TimeSpec *commit_point, struct connection_closure *closure); bool fmt_server_message(struct connection_closure *closure, ServerMessage *msg); bool fmt_log_id_message(const unsigned char uuid[restrict static 16], const char *path, struct connection_closure *closure); bool schedule_error_message(const char *errstr, struct connection_closure *closure); struct connection_buffer *get_free_buf(size_t, struct connection_closure *closure); struct connection_closure *connection_closure_alloc(int fd, bool tls, bool relay_only, struct sudo_event_base *base); /* logsrvd_conf.c */ bool logsrvd_conf_read(const char *path); const char *logsrvd_conf_iolog_base(void); const char *logsrvd_conf_iolog_dir(void); const char *logsrvd_conf_iolog_file(void); bool logsrvd_conf_iolog_log_passwords(void); void *logsrvd_conf_iolog_passprompt_regex(void); struct server_address_list *logsrvd_conf_server_listen_address(void); struct server_address_list *logsrvd_conf_relay_address(void); const char *logsrvd_conf_relay_dir(void); bool logsrvd_conf_relay_store_first(void); bool logsrvd_conf_relay_tcp_keepalive(void); bool logsrvd_conf_server_tcp_keepalive(void); const char *logsrvd_conf_pid_file(void); struct timespec *logsrvd_conf_server_timeout(void); struct timespec *logsrvd_conf_relay_connect_timeout(void); struct timespec *logsrvd_conf_relay_timeout(void); time_t logsrvd_conf_relay_retry_interval(void); #if defined(HAVE_OPENSSL) bool logsrvd_conf_server_tls_check_host(void); bool logsrvd_conf_server_tls_check_peer(void); SSL_CTX *logsrvd_server_tls_ctx(void); bool logsrvd_conf_relay_tls_check_peer(void); SSL_CTX *logsrvd_relay_tls_ctx(void); #endif bool logsrvd_conf_log_exit(void); uid_t logsrvd_conf_iolog_uid(void); gid_t logsrvd_conf_iolog_gid(void); mode_t logsrvd_conf_iolog_mode(void); void address_list_addref(struct server_address_list *); void address_list_delref(struct server_address_list *); void logsrvd_conf_cleanup(void); void logsrvd_warn_stderr(bool enabled); /* logsrvd_journal.c */ extern struct client_message_switch cms_journal; /* logsrvd_local.c */ extern struct client_message_switch cms_local; bool store_accept_local(const AcceptMessage *msg, const uint8_t *buf, size_t len, struct connection_closure *closure); bool store_reject_local(const RejectMessage *msg, const uint8_t *buf, size_t len, struct connection_closure *closure); bool store_exit_local(const ExitMessage *msg, const uint8_t *buf, size_t len, struct connection_closure *closure); bool store_restart_local(const RestartMessage *msg, const uint8_t *buf, size_t len, struct connection_closure *closure); bool store_alert_local(const AlertMessage *msg, const uint8_t *buf, size_t len, struct connection_closure *closure); bool store_iobuf_local(int iofd, const IoBuffer *iobuf, const uint8_t *buf, size_t len, struct connection_closure *closure); bool store_winsize_local(const ChangeWindowSize *msg, const uint8_t *buf, size_t len, struct connection_closure *closure); bool store_suspend_local(const CommandSuspend *msg, const uint8_t *buf, size_t len, struct connection_closure *closure); /* logsrvd_queue.c */ bool logsrvd_queue_enable(time_t timeout, struct sudo_event_base *evbase); bool logsrvd_queue_insert(struct connection_closure *closure); bool logsrvd_queue_scan(struct sudo_event_base *evbase); void logsrvd_queue_dump(void); /* logsrvd_relay.c */ extern struct client_message_switch cms_relay; void relay_closure_free(struct relay_closure *relay_closure); bool connect_relay(struct connection_closure *closure); bool relay_shutdown(struct connection_closure *closure); #endif /* SUDO_LOGSRVD_H */