busybox/printutils/lpd.c

/* vi: set sw=4 ts=4: */
/*
 * micro lpd
 *
 * Copyright (C) 2008 by Vladimir Dronnikov <dronnikov@gmail.com>
 *
 * Licensed under GPLv2, see file LICENSE in this tarball for details.
 */

/*
 * A typical usage of BB lpd looks as follows:
 * # tcpsvd -E 0 515 lpd [SPOOLDIR] [HELPER-PROG [ARGS...]]
 *
 * This starts TCP listener on port 515 (default for LP protocol).
 * When a client connection is made (via lpr) lpd first changes its
 * working directory to SPOOLDIR (current dir is the default).
 *
 * SPOOLDIR is the spool directory which contains printing queues
 * and should have the following structure:
 *
 * SPOOLDIR/
 *      <queue1>
 *      ...
 *      <queueN>
 *
 * <queueX> can be of two types:
 *      A. a printer character device, an ordinary file or a link to such;
 *      B. a directory.
 *
 * In case A lpd just dumps the data it receives from client (lpr) to the
 * end of queue file/device. This is non-spooling mode.
 *
 * In case B lpd enters spooling mode. It reliably saves client data along
 * with control info in two unique files under the queue directory. These
 * files are named dfAXXXHHHH and cfAXXXHHHH, where XXX is the job number
 * and HHHH is the client hostname. Unless a printing helper application
 * is specified lpd is done at this point.
 *
 * NB: file names are produced by peer! They actually may be anything at all.
 * lpd only sanitizes them (by removing most non-alphanumerics).
 *
 * If HELPER-PROG (with optional arguments) is specified then lpd continues
 * to process client data:
 *      1. it reads and parses control file (cfA...). The parse process
 *      results in setting environment variables whose values were passed
 *      in control file; when parsing is complete, lpd deletes control file.
 *      2. it spawns specified helper application. It is then
 *      the helper application who is responsible for both actual printing
 *      and deleting of processed data file.
 *
 * A good lpr passes control files which when parsed provides the following
 * variables:
 * $H = host which issues the job
 * $P = user who prints
 * $C = class of printing (what is printed on banner page)
 * $J = the name of the job
 * $L = print banner page
 * $M = the user to whom a mail should be sent if a problem occurs
 *
 * We specifically filter out and NOT provide:
 * $l = name of datafile ("dfAxxx") - file whose content are to be printed
 *
 * lpd provides $DATAFILE instead - the ACTUAL name
 * of the datafile under which it was saved.
 * $l would be not reliable (you would be at mercy of remote peer).
 *
 * Thus, a typical helper can be something like this:
 * #!/bin/sh
 * cat ./"$DATAFILE" >/dev/lp0
 * mv -f ./"$DATAFILE" save/
 */

#include "libbb.h"

// strip argument of bad chars
static char *sane(char *str)
{
	char *s = str;
	char *p = s;
	while (*s) {
		if (isalnum(*s) || '-' == *s || '_' == *s) {
			*p++ = *s;
		}
		s++;
	}
	*p = '\0';
	return str;
}

static char *xmalloc_read_stdin(void)
{
	// SECURITY:
	size_t max = 4 * 1024; // more than enough for commands!
	return xmalloc_reads(STDIN_FILENO, NULL, &max);
}

int lpd_main(int argc, char *argv[]) MAIN_EXTERNALLY_VISIBLE;
int lpd_main(int argc UNUSED_PARAM, char *argv[])
{
	int spooling = spooling; // for compiler
	char *s, *queue;
	char *filenames[2];

	// goto spool directory
	if (*++argv)
		xchdir(*argv++);

	// error messages of xfuncs will be sent over network
	xdup2(STDOUT_FILENO, STDERR_FILENO);

	// nullify ctrl/data filenames
	memset(filenames, 0, sizeof(filenames));

	// read command
	s = queue = xmalloc_read_stdin();
	// we understand only "receive job" command
	if (2 != *queue) {
 unsupported_cmd:
		printf("Command %02x %s\n",
			(unsigned char)s[0], "is not supported");
		goto err_exit;
	}

	// parse command: "2 | QUEUE_NAME | '\n'"
	queue++;
	// protect against "/../" attacks
	// *strchrnul(queue, '\n') = '\0'; - redundant, sane() will do
	if (!*sane(queue))
		return EXIT_FAILURE;

	// queue is a directory -> chdir to it and enter spooling mode
	spooling = chdir(queue) + 1; // 0: cannot chdir, 1: done
	// we don't free(s), we might need "queue" var later

	while (1) {
		char *fname;
		int fd;
		// int is easier than ssize_t: can use xatoi_u,
		// and can correctly display error returns (-1)
		int expected_len, real_len;

		// signal OK
		safe_write(STDOUT_FILENO, "", 1);

		// get subcommand
		// valid s must be of form: "SUBCMD | LEN | space | FNAME"
		// N.B. we bail out on any error
		s = xmalloc_read_stdin();
		if (!s) { // (probably) EOF
			char *p, *q, var[2];

			// non-spooling mode or no spool helper specified
			if (!spooling || !*argv)
				return EXIT_SUCCESS; // the only non-error exit
			// spooling mode but we didn't see both ctrlfile & datafile
			if (spooling != 7)
				goto err_exit; // reject job

			// spooling mode and spool helper specified -> exec spool helper
			// (we exit 127 if helper cannot be executed)
			var[1] = '\0';
			// read and delete ctrlfile
			q = xmalloc_xopen_read_close(filenames[0], NULL);
			unlink(filenames[0]);
			// provide datafile name
			// we can use leaky setenv since we are about to exec or exit
			xsetenv("DATAFILE", filenames[1]);
			// parse control file by "\n"
			while ((p = strchr(q, '\n')) != NULL && isalpha(*q)) {
				*p++ = '\0';
				// q is a line of <SYM><VALUE>,
				// we are setting environment string <SYM>=<VALUE>.
				// Ignoring "l<datafile>", exporting others:
				if (*q != 'l') {
					var[0] = *q++;
					xsetenv(var, q);
				}
				q = p; // next line
			}
			// helper should not talk over network.
			// this call reopens stdio fds to "/dev/null"
			// (no daemonization is done)
			bb_daemonize_or_rexec(DAEMON_DEVNULL_STDIO | DAEMON_ONLY_SANITIZE, NULL);
			BB_EXECVP(*argv, argv);
			exit(127);
		}

		// validate input.
		// we understand only "control file" or "data file" cmds
		if (2 != s[0] && 3 != s[0])
			goto unsupported_cmd;
		if (spooling & (1 << (s[0]-1))) {
			printf("Duplicated subcommand\n");
			goto err_exit;
		}
		// get filename
		*strchrnul(s, '\n') = '\0';
		fname = strchr(s, ' ');
		if (!fname) {
// bad_fname:
			printf("No or bad filename\n");
			goto err_exit;
		}
		*fname++ = '\0';
//		// s[0]==2: ctrlfile, must start with 'c'
//		// s[0]==3: datafile, must start with 'd'
//		if (fname[0] != s[0] + ('c'-2))
//			goto bad_fname;
		// get length
		expected_len = bb_strtou(s + 1, NULL, 10);
		if (errno || expected_len < 0) {
			printf("Bad length\n");
			goto err_exit;
		}
		if (2 == s[0] && expected_len > 16 * 1024) {
			// SECURITY:
			// ctrlfile can't be big (we want to read it back later!)
			printf("File is too big\n");
			goto err_exit;
		}

		// open the file
		if (spooling) {
			// spooling mode: dump both files
			// job in flight has mode 0200 "only writable"
			sane(fname);
			fd = open3_or_warn(fname, O_CREAT | O_WRONLY | O_TRUNC | O_EXCL, 0200);
			if (fd < 0)
				goto err_exit;
			filenames[s[0] - 2] = xstrdup(fname);
		} else {
			// non-spooling mode:
			// 2: control file (ignoring), 3: data file
			fd = -1;
			if (3 == s[0])
				fd = xopen(queue, O_RDWR | O_APPEND);
		}

		// signal OK
		safe_write(STDOUT_FILENO, "", 1);

		// copy the file
		real_len = bb_copyfd_size(STDIN_FILENO, fd, expected_len);
		if (real_len != expected_len) {
			printf("Expected %d but got %d bytes\n",
				expected_len, real_len);
			goto err_exit;
		}
		// get EOF indicator, see whether it is NUL (ok)
		// (and don't trash s[0]!)
		if (safe_read(STDIN_FILENO, &s[1], 1) != 1 || s[1] != 0) {
			// don't send error msg to peer - it obviously
			// doesn't follow the protocol, so probably
			// it can't understand us either
			goto err_exit;
		}

		if (spooling) {
			// chmod completely downloaded file as "readable+writable"
			fchmod(fd, 0600);
			// accumulate dump state
			// N.B. after all files are dumped spooling should be 1+2+4==7
			spooling |= (1 << (s[0]-1)); // bit 1: ctrlfile; bit 2: datafile
		}

		free(s);
		close(fd); // NB: can do close(-1). Who cares?

		// NB: don't do "signal OK" write here, it will be done
		// at the top of the loop
	} // while (1)

 err_exit:
	// don't keep corrupted files
	if (spooling) {
#define i spooling
		for (i = 2; --i >= 0; )
			if (filenames[i])
				unlink(filenames[i]);
	}
	return EXIT_FAILURE;
}
1	/* vi: set sw=4 ts=4: */
2	/*
3	* micro lpd
4	*
5	* Copyright (C) 2008 by Vladimir Dronnikov <dronnikov@gmail.com>
6	*
7	* Licensed under GPLv2, see file LICENSE in this tarball for details.
8	*/
9
10	/*
11	* A typical usage of BB lpd looks as follows:
12	* # tcpsvd -E 0 515 lpd [SPOOLDIR] [HELPER-PROG [ARGS...]]
13	*
14	* This starts TCP listener on port 515 (default for LP protocol).
15	* When a client connection is made (via lpr) lpd first changes its
16	* working directory to SPOOLDIR (current dir is the default).
17	*
18	* SPOOLDIR is the spool directory which contains printing queues
19	* and should have the following structure:
20	*
21	* SPOOLDIR/
22	* <queue1>
23	* ...
24	* <queueN>
25	*
26	* <queueX> can be of two types:
27	* A. a printer character device, an ordinary file or a link to such;
28	* B. a directory.
29	*
30	* In case A lpd just dumps the data it receives from client (lpr) to the
31	* end of queue file/device. This is non-spooling mode.
32	*
33	* In case B lpd enters spooling mode. It reliably saves client data along
34	* with control info in two unique files under the queue directory. These
35	* files are named dfAXXXHHHH and cfAXXXHHHH, where XXX is the job number
36	* and HHHH is the client hostname. Unless a printing helper application
37	* is specified lpd is done at this point.
38	*
39	* NB: file names are produced by peer! They actually may be anything at all.
40	* lpd only sanitizes them (by removing most non-alphanumerics).
41	*
42	* If HELPER-PROG (with optional arguments) is specified then lpd continues
43	* to process client data:
44	* 1. it reads and parses control file (cfA...). The parse process
45	* results in setting environment variables whose values were passed
46	* in control file; when parsing is complete, lpd deletes control file.
47	* 2. it spawns specified helper application. It is then
48	* the helper application who is responsible for both actual printing
49	* and deleting of processed data file.
50	*
51	* A good lpr passes control files which when parsed provides the following
52	* variables:
53	* $H = host which issues the job
54	* $P = user who prints
55	* $C = class of printing (what is printed on banner page)
56	* $J = the name of the job
57	* $L = print banner page
58	* $M = the user to whom a mail should be sent if a problem occurs
59	*
60	* We specifically filter out and NOT provide:
61	* $l = name of datafile ("dfAxxx") - file whose content are to be printed
62	*
63	* lpd provides $DATAFILE instead - the ACTUAL name
64	* of the datafile under which it was saved.
65	* $l would be not reliable (you would be at mercy of remote peer).
66	*
67	* Thus, a typical helper can be something like this:
68	* #!/bin/sh
69	* cat ./"$DATAFILE" >/dev/lp0
70	* mv -f ./"$DATAFILE" save/
71	*/
72
73	#include "libbb.h"
74
75	// strip argument of bad chars
76	static char sane(char str)
77	{
78	char *s = str;
79	char *p = s;
80	while (*s) {
81	if (isalnum(s) \|\| '-' == s \|\| '_' == *s) {
82	p++ = s;
83	}
84	s++;
85	}
86	*p = '\0';
87	return str;
88	}
89
90	static char *xmalloc_read_stdin(void)
91	{
92	// SECURITY:
93	size_t max = 4 * 1024; // more than enough for commands!
94	return xmalloc_reads(STDIN_FILENO, NULL, &max);
95	}
96
97	int lpd_main(int argc, char *argv[]) MAIN_EXTERNALLY_VISIBLE;
98	int lpd_main(int argc UNUSED_PARAM, char *argv[])
99	{
100	int spooling = spooling; // for compiler
101	char s, queue;
102	char *filenames[2];
103
104	// goto spool directory
105	if (*++argv)
106	xchdir(*argv++);
107
108	// error messages of xfuncs will be sent over network
109	xdup2(STDOUT_FILENO, STDERR_FILENO);
110
111	// nullify ctrl/data filenames
112	memset(filenames, 0, sizeof(filenames));
113
114	// read command
115	s = queue = xmalloc_read_stdin();
116	// we understand only "receive job" command
117	if (2 != *queue) {
118	unsupported_cmd:
119	printf("Command %02x %s\n",
120	(unsigned char)s[0], "is not supported");
121	goto err_exit;
122	}
123
124	// parse command: "2 \| QUEUE_NAME \| '\n'"
125	queue++;
126	// protect against "/../" attacks
127	// *strchrnul(queue, '\n') = '\0'; - redundant, sane() will do
128	if (!*sane(queue))
129	return EXIT_FAILURE;
130
131	// queue is a directory -> chdir to it and enter spooling mode
132	spooling = chdir(queue) + 1; // 0: cannot chdir, 1: done
133	// we don't free(s), we might need "queue" var later
134
135	while (1) {
136	char *fname;
137	int fd;
138	// int is easier than ssize_t: can use xatoi_u,
139	// and can correctly display error returns (-1)
140	int expected_len, real_len;
141
142	// signal OK
143	safe_write(STDOUT_FILENO, "", 1);
144
145	// get subcommand
146	// valid s must be of form: "SUBCMD \| LEN \| space \| FNAME"
147	// N.B. we bail out on any error
148	s = xmalloc_read_stdin();
149	if (!s) { // (probably) EOF
150	char p, q, var[2];
151
152	// non-spooling mode or no spool helper specified
153	if (!spooling \|\| !*argv)
154	return EXIT_SUCCESS; // the only non-error exit
155	// spooling mode but we didn't see both ctrlfile & datafile
156	if (spooling != 7)
157	goto err_exit; // reject job
158
159	// spooling mode and spool helper specified -> exec spool helper
160	// (we exit 127 if helper cannot be executed)
161	var[1] = '\0';
162	// read and delete ctrlfile
163	q = xmalloc_xopen_read_close(filenames[0], NULL);
164	unlink(filenames[0]);
165	// provide datafile name
166	// we can use leaky setenv since we are about to exec or exit
167	xsetenv("DATAFILE", filenames[1]);
168	// parse control file by "\n"
169	while ((p = strchr(q, '\n')) != NULL && isalpha(*q)) {
170	*p++ = '\0';
171	// q is a line of <SYM><VALUE>,
172	// we are setting environment string <SYM>=<VALUE>.
173	// Ignoring "l<datafile>", exporting others:
174	if (*q != 'l') {
175	var[0] = *q++;
176	xsetenv(var, q);
177	}
178	q = p; // next line
179	}
180	// helper should not talk over network.
181	// this call reopens stdio fds to "/dev/null"
182	// (no daemonization is done)
183	bb_daemonize_or_rexec(DAEMON_DEVNULL_STDIO \| DAEMON_ONLY_SANITIZE, NULL);
184	BB_EXECVP(*argv, argv);
185	exit(127);
186	}
187
188	// validate input.
189	// we understand only "control file" or "data file" cmds
190	if (2 != s[0] && 3 != s[0])
191	goto unsupported_cmd;
192	if (spooling & (1 << (s[0]-1))) {
193	printf("Duplicated subcommand\n");
194	goto err_exit;
195	}
196	// get filename
197	*strchrnul(s, '\n') = '\0';
198	fname = strchr(s, ' ');
199	if (!fname) {
200	// bad_fname:
201	printf("No or bad filename\n");
202	goto err_exit;
203	}
204	*fname++ = '\0';
205	// // s[0]==2: ctrlfile, must start with 'c'
206	// // s[0]==3: datafile, must start with 'd'
207	// if (fname[0] != s[0] + ('c'-2))
208	// goto bad_fname;
209	// get length
210	expected_len = bb_strtou(s + 1, NULL, 10);
211	if (errno \|\| expected_len < 0) {
212	printf("Bad length\n");
213	goto err_exit;
214	}
215	if (2 == s[0] && expected_len > 16 * 1024) {
216	// SECURITY:
217	// ctrlfile can't be big (we want to read it back later!)
218	printf("File is too big\n");
219	goto err_exit;
220	}
221
222	// open the file
223	if (spooling) {
224	// spooling mode: dump both files
225	// job in flight has mode 0200 "only writable"
226	sane(fname);
227	fd = open3_or_warn(fname, O_CREAT \| O_WRONLY \| O_TRUNC \| O_EXCL, 0200);
228	if (fd < 0)
229	goto err_exit;
230	filenames[s[0] - 2] = xstrdup(fname);
231	} else {
232	// non-spooling mode:
233	// 2: control file (ignoring), 3: data file
234	fd = -1;
235	if (3 == s[0])
236	fd = xopen(queue, O_RDWR \| O_APPEND);
237	}
238
239	// signal OK
240	safe_write(STDOUT_FILENO, "", 1);
241
242	// copy the file
243	real_len = bb_copyfd_size(STDIN_FILENO, fd, expected_len);
244	if (real_len != expected_len) {
245	printf("Expected %d but got %d bytes\n",
246	expected_len, real_len);
247	goto err_exit;
248	}
249	// get EOF indicator, see whether it is NUL (ok)
250	// (and don't trash s[0]!)
251	if (safe_read(STDIN_FILENO, &s[1], 1) != 1 \|\| s[1] != 0) {
252	// don't send error msg to peer - it obviously
253	// doesn't follow the protocol, so probably
254	// it can't understand us either
255	goto err_exit;
256	}
257
258	if (spooling) {
259	// chmod completely downloaded file as "readable+writable"
260	fchmod(fd, 0600);
261	// accumulate dump state
262	// N.B. after all files are dumped spooling should be 1+2+4==7
263	spooling \|= (1 << (s[0]-1)); // bit 1: ctrlfile; bit 2: datafile
264	}
265
266	free(s);
267	close(fd); // NB: can do close(-1). Who cares?
268
269	// NB: don't do "signal OK" write here, it will be done
270	// at the top of the loop
271	} // while (1)
272
273	err_exit:
274	// don't keep corrupted files
275	if (spooling) {
276	#define i spooling
277	for (i = 2; --i >= 0; )
278	if (filenames[i])
279	unlink(filenames[i]);
280	}
281	return EXIT_FAILURE;
282	}