Skip to content

Commit 3d6efb1

Browse files
authored
tang: allow running standalone (latchset#86)
This enables running tangd in environments without systemd (e.g., embedded), without requiring xinetd or other superservers.
1 parent dac0dd6 commit 3d6efb1

File tree

15 files changed

+636
-150
lines changed

15 files changed

+636
-150
lines changed

.github/workflows/install-dependencies

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,15 @@ debian:*|ubuntu:*)
66
apt clean
77
apt update
88
apt -y install gcc meson pkg-config libjose-dev jose libhttp-parser-dev \
9-
systemd gcovr curl socat
9+
systemd gcovr curl socat iproute2
1010
;;
1111

1212
fedora:*)
1313
echo 'max_parallel_downloads=10' >> /etc/dnf/dnf.conf
1414
dnf -y clean all
1515
dnf -y --setopt=deltarpm=0 update
1616
dnf -y install gcc meson pkgconfig libjose-devel jose http-parser-devel \
17-
systemd gcovr curl socat
17+
systemd gcovr curl socat iproute
1818
;;
1919

2020
centos:*)
@@ -23,7 +23,7 @@ centos:*)
2323
yum install -y yum-utils epel-release
2424
yum config-manager -y --set-enabled PowerTools \
2525
|| yum config-manager -y --set-enabled powertools || :
26-
yum -y install meson socat
26+
yum -y install meson socat iproute
2727
yum-builddep -y tang
2828
;;
2929

@@ -33,7 +33,7 @@ centos:*)
3333
dnf install -y dnf-plugins-core epel-release
3434
dnf config-manager -y --set-enabled powertools \
3535
|| dnf config-manager -y --set-enabled crb || :
36-
dnf -y install meson socat
36+
dnf -y install meson socat iproute
3737
dnf builddep -y tang
3838
;;
3939
esac

doc/tang.8.adoc

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,14 @@ ifndef::freebsd[]
6363
link:systemd.unit.5.adoc[*systemd.unit*(5)] and link:systemd.socket.5.adoc[*systemd.socket*(5)] for more information.
6464
endif::[]
6565

66+
== STANDALONE OR VIA SYSTEMD
67+
68+
The Tang server can be run via systemd socket activation or standalone
69+
when the parameter *-l* is passed. The default port used is 9090 and can
70+
be changed with the *-p* option.
71+
72+
tang -l -p 9090
73+
6674
== KEY ROTATION
6775

6876
In order to preserve the security of the system over the long run, you need to

meson.build

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ add_project_arguments(
5050
language: 'c'
5151
)
5252

53+
add_project_arguments('-DVERSION="'+meson.project_version() + '"', language : 'c')
54+
5355
jose = dependency('jose', version: '>=8')
5456
a2x = find_program('a2x', required: false)
5557
compiler = meson.get_compiler('c')

src/meson.build

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ tangd = executable('tangd',
22
'http.c',
33
'keys.c',
44
'tangd.c',
5+
'socket.c',
56
dependencies: [jose, http_parser],
67
install: true,
78
install_dir: libexecdir

src/socket.c

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,240 @@
1+
/* vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: */
2+
/*
3+
* Copyright (c) 2022 Nikos Mavrogiannopoulos
4+
*
5+
* This program is free software: you can redistribute it and/or modify
6+
* it under the terms of the GNU General Public License as published by
7+
* the Free Software Foundation, either version 3 of the License, or
8+
* (at your option) any later version.
9+
*
10+
* This program is distributed in the hope that it will be useful,
11+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
12+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13+
* GNU General Public License for more details.
14+
*
15+
* You should have received a copy of the GNU General Public License
16+
* along with this program. If not, see <http://www.gnu.org/licenses/>.
17+
*/
18+
19+
#include <stdio.h>
20+
#include <stdlib.h>
21+
#include <string.h>
22+
#include <unistd.h>
23+
#include <sys/types.h>
24+
#include <sys/socket.h>
25+
#include <netdb.h>
26+
#include <arpa/inet.h>
27+
#include <netinet/in.h>
28+
#include <sys/select.h>
29+
#include <errno.h>
30+
#include <sys/wait.h>
31+
#include <signal.h>
32+
33+
#include "socket.h"
34+
35+
#define MAX(x,y) ((x)>(y)?(x):(y))
36+
37+
typedef struct socket_list {
38+
int s;
39+
int family;
40+
struct sockaddr addr;
41+
socklen_t addrlen;
42+
struct socket_list *next;
43+
} socket_list;
44+
45+
static void free_socket_list(socket_list *slist)
46+
{
47+
socket_list *ptr, *oldptr;
48+
49+
for (ptr = slist; ptr != NULL;) {
50+
if (ptr->s >= 0)
51+
close(ptr->s);
52+
oldptr = ptr;
53+
ptr = ptr->next;
54+
free(oldptr);
55+
}
56+
}
57+
58+
static int listen_port(socket_list **slist, int port)
59+
{
60+
struct addrinfo hints, *res, *ptr;
61+
int y, r, s;
62+
char portname[6], strip[64];
63+
socket_list *lm;
64+
65+
snprintf(portname, sizeof(portname), "%d", port);
66+
memset(&hints, 0, sizeof(hints));
67+
hints.ai_socktype = SOCK_STREAM;
68+
hints.ai_flags = AI_PASSIVE;
69+
70+
*slist = NULL;
71+
72+
/* listen to all available (IPv4 and IPv6) address */
73+
if ((r = getaddrinfo(NULL, portname, &hints, &res)) != 0) {
74+
fprintf(stderr, "getaddrinfo() failed: %s\n", gai_strerror(r));
75+
return -1;
76+
}
77+
78+
for (ptr = res; ptr != NULL; ptr = ptr->ai_next) {
79+
s = socket(ptr->ai_family, SOCK_STREAM, 0);
80+
if (s < 0) {
81+
perror("socket() failed");
82+
continue;
83+
}
84+
85+
if (ptr->ai_family == AF_INET)
86+
fprintf(stderr, "Listening on %s:%d\n", inet_ntop(ptr->ai_family,
87+
&((struct sockaddr_in*)ptr->ai_addr)->sin_addr, strip,
88+
sizeof(strip)), port);
89+
else if (ptr->ai_family == AF_INET6)
90+
fprintf(stderr, "Listening on [%s]:%d\n", inet_ntop(ptr->ai_family,
91+
&((struct sockaddr_in6*)ptr->ai_addr)->sin6_addr, strip,
92+
sizeof(strip)), port);
93+
94+
#if defined(IPV6_V6ONLY)
95+
if (ptr->ai_family == AF_INET6) {
96+
y = 1;
97+
/* avoid listen on ipv6 addresses failing
98+
* because already listening on ipv4 addresses: */
99+
if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY,
100+
(const void *) &y, sizeof(y)) < 0) {
101+
perror("setsockopt(IPV6_V6ONLY) failed");
102+
}
103+
}
104+
#endif
105+
106+
y = 1;
107+
if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR,
108+
(const void *) &y, sizeof(y)) < 0) {
109+
perror("setsockopt(SO_REUSEADDR) failed");
110+
}
111+
112+
if (bind(s, ptr->ai_addr, ptr->ai_addrlen) < 0) {
113+
perror("bind() failed");
114+
close(s);
115+
continue;
116+
}
117+
118+
if (listen(s, 1024) < 0) {
119+
perror("listen() failed");
120+
close(s);
121+
r = -1;
122+
goto cleanup;
123+
}
124+
125+
lm = calloc(1, sizeof(socket_list));
126+
if (lm == NULL) {
127+
close(s);
128+
r = -1;
129+
goto cleanup;
130+
}
131+
lm->s = s;
132+
lm->family = ptr->ai_family;
133+
lm->addrlen = ptr->ai_addrlen;
134+
memcpy(&lm->addr, ptr->ai_addr, ptr->ai_addrlen);
135+
lm->next = *slist;
136+
*slist = lm;
137+
}
138+
139+
if (*slist == NULL)
140+
r = -1;
141+
else
142+
r = 0;
143+
144+
cleanup:
145+
freeaddrinfo(res);
146+
fflush(stderr);
147+
148+
return r;
149+
}
150+
151+
static void spawn_process(int fd, const char *jwkdir,
152+
process_request_func pfunc,
153+
socket_list *slist)
154+
{
155+
pid_t pid;
156+
socket_list *ptr;
157+
158+
pid = fork();
159+
if (pid == 0) { /* child */
160+
for (ptr = slist; ptr != NULL; ptr = ptr->next) {
161+
close(ptr->s);
162+
}
163+
/* Ensure that both stdout and stdin are set */
164+
if (dup2(fd, STDOUT_FILENO) < 0) {
165+
perror("dup2");
166+
close(fd);
167+
return;
168+
}
169+
170+
close(fd);
171+
172+
pfunc(jwkdir, STDOUT_FILENO);
173+
exit(0);
174+
} else if (pid == -1) {
175+
perror("fork failed");
176+
}
177+
close(fd);
178+
}
179+
180+
static void handle_child(int sig)
181+
{
182+
pid_t pid;
183+
int status;
184+
185+
while ((pid = waitpid(-1, &status, WNOHANG)) > 0);
186+
}
187+
188+
int run_service(const char *jwkdir, int port, process_request_func pfunc)
189+
{
190+
socket_list *slist, *ptr;
191+
int r, n = 0, accept_fd;
192+
fd_set read_fds;
193+
struct timeval tv;
194+
195+
signal(SIGCHLD, handle_child);
196+
197+
r = listen_port(&slist, port);
198+
if (r < 0) {
199+
fprintf(stderr, "Could not listen port (%d)\n", port);
200+
return -1;
201+
}
202+
203+
while (1) {
204+
FD_ZERO(&read_fds);
205+
for (ptr = slist; ptr != NULL; ptr = ptr->next) {
206+
if (ptr->s > FD_SETSIZE) {
207+
fprintf(stderr, "exceeded FD_SETSIZE\n");
208+
free_socket_list(slist);
209+
return -1;
210+
}
211+
FD_SET(ptr->s, &read_fds);
212+
n = MAX(n, ptr->s);
213+
}
214+
tv.tv_sec = 1200;
215+
tv.tv_usec = 0;
216+
n = select(n+1, &read_fds, NULL, NULL, &tv);
217+
if (n == -1 && errno == EINTR)
218+
continue;
219+
if (n < 0) {
220+
perror("select");
221+
free_socket_list(slist);
222+
return -1;
223+
}
224+
225+
for (ptr = slist; ptr != NULL; ptr = ptr->next) {
226+
if (FD_ISSET(ptr->s, &read_fds)) {
227+
accept_fd = accept(ptr->s, NULL, 0);
228+
if (accept_fd < 0) {
229+
perror("accept");
230+
continue;
231+
}
232+
233+
spawn_process(accept_fd, jwkdir, pfunc, slist);
234+
}
235+
}
236+
237+
}
238+
239+
return 0;
240+
}

src/socket.h

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/* vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: */
2+
/*
3+
* Copyright (c) 2022 Nikos Mavrogiannopoulos
4+
*
5+
* This program is free software: you can redistribute it and/or modify
6+
* it under the terms of the GNU General Public License as published by
7+
* the Free Software Foundation, either version 3 of the License, or
8+
* (at your option) any later version.
9+
*
10+
* This program is distributed in the hope that it will be useful,
11+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
12+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13+
* GNU General Public License for more details.
14+
*
15+
* You should have received a copy of the GNU General Public License
16+
* along with this program. If not, see <http://www.gnu.org/licenses/>.
17+
*/
18+
19+
typedef int (*process_request_func)(const char *jwkdir, int in_fileno);
20+
21+
int run_service(const char *jwkdir, int port, process_request_func);

0 commit comments

Comments
 (0)