1 /* vi: set sw=4 ts=4: */
2 /*
3 * micro lpd
4 *
5 * Copyright (C) 2008 by Vladimir Dronnikov <dronnikov@gmail.com>
6 *
7 * Licensed under GPLv2, see file LICENSE in this source tree.
8 */
9
10 /*
11 * A typical usage of BB lpd looks as follows:
12 * # tcpsvd -E 0 515 lpd [SPOOLDIR] [HELPER-PROG [ARGS...]]
13 *
14 * This starts TCP listener on port 515 (default for LP protocol).
15 * When a client connection is made (via lpr) lpd first changes its
16 * working directory to SPOOLDIR (current dir is the default).
17 *
18 * SPOOLDIR is the spool directory which contains printing queues
19 * and should have the following structure:
20 *
21 * SPOOLDIR/
22 * <queue1>
23 * ...
24 * <queueN>
25 *
26 * <queueX> can be of two types:
27 * A. a printer character device, an ordinary file or a link to such;
28 * B. a directory.
29 *
30 * In case A lpd just dumps the data it receives from client (lpr) to the
31 * end of queue file/device. This is non-spooling mode.
32 *
33 * In case B lpd enters spooling mode. It reliably saves client data along
34 * with control info in two unique files under the queue directory. These
35 * files are named dfAXXXHHHH and cfAXXXHHHH, where XXX is the job number
36 * and HHHH is the client hostname. Unless a printing helper application
37 * is specified lpd is done at this point.
38 *
39 * NB: file names are produced by peer! They actually may be anything at all.
40 * lpd only sanitizes them (by removing most non-alphanumerics).
41 *
42 * If HELPER-PROG (with optional arguments) is specified then lpd continues
43 * to process client data:
44 * 1. it reads and parses control file (cfA...). The parse process
45 * results in setting environment variables whose values were passed
46 * in control file; when parsing is complete, lpd deletes control file.
47 * 2. it spawns specified helper application. It is then
48 * the helper application who is responsible for both actual printing
49 * and deleting of processed data file.
50 *
51 * A good lpr passes control files which when parsed provides the following
52 * variables:
53 * $H = host which issues the job
54 * $P = user who prints
55 * $C = class of printing (what is printed on banner page)
56 * $J = the name of the job
57 * $L = print banner page
58 * $M = the user to whom a mail should be sent if a problem occurs
59 *
60 * We specifically filter out and NOT provide:
61 * $l = name of datafile ("dfAxxx") - file whose content are to be printed
62 *
63 * lpd provides $DATAFILE instead - the ACTUAL name
64 * of the datafile under which it was saved.
65 * $l would be not reliable (you would be at mercy of remote peer).
66 *
67 * Thus, a typical helper can be something like this:
68 * #!/bin/sh
69 * cat ./"$DATAFILE" >/dev/lp0
70 * mv -f ./"$DATAFILE" save/
71 */
72 //config:config LPD
73 //config: bool "lpd (5.5 kb)"
74 //config: default y
75 //config: help
76 //config: lpd is a print spooling daemon.
77
78 //applet:IF_LPD(APPLET(lpd, BB_DIR_USR_SBIN, BB_SUID_DROP))
79
80 //kbuild:lib-$(CONFIG_LPD) += lpd.o
81
82 //usage:#define lpd_trivial_usage
83 //usage: "SPOOLDIR [HELPER [ARGS]]"
84 //usage:#define lpd_full_usage "\n\n"
85 //usage: "SPOOLDIR must contain (symlinks to) device nodes or directories"
86 //usage: "\nwith names matching print queue names. In the first case, jobs are"
87 //usage: "\nsent directly to the device. Otherwise each job is stored in queue"
88 //usage: "\ndirectory and HELPER program is called. Name of file to print"
89 //usage: "\nis passed in $DATAFILE variable."
90 //usage: "\nExample:"
91 //usage: "\n tcpsvd -E 0 515 softlimit -m 999999 lpd /var/spool ./print"
92
93 #include "libbb.h"
94
95 // strip argument of bad chars
sane(char * str)96 static char *sane(char *str)
97 {
98 char *s = str;
99 char *p = s;
100 while (*s) {
101 if (isalnum(*s) || '-' == *s || '_' == *s) {
102 *p++ = *s;
103 }
104 s++;
105 }
106 *p = '\0';
107 return str;
108 }
109
xmalloc_read_stdin(void)110 static char *xmalloc_read_stdin(void)
111 {
112 // SECURITY:
113 size_t max = 4 * 1024; // more than enough for commands!
114 return xmalloc_reads(STDIN_FILENO, &max);
115 }
116
117 int lpd_main(int argc, char *argv[]) MAIN_EXTERNALLY_VISIBLE;
lpd_main(int argc UNUSED_PARAM,char * argv[])118 int lpd_main(int argc UNUSED_PARAM, char *argv[])
119 {
120 int spooling = spooling; // for compiler
121 char *s, *queue;
122 char *filenames[2];
123
124 // goto spool directory
125 if (*++argv)
126 xchdir(*argv++);
127
128 // error messages of xfuncs will be sent over network
129 xdup2(STDOUT_FILENO, STDERR_FILENO);
130
131 // nullify ctrl/data filenames
132 memset(filenames, 0, sizeof(filenames));
133
134 // read command
135 s = queue = xmalloc_read_stdin();
136 if (!s) // eof?
137 return EXIT_FAILURE;
138 // we understand only "receive job" command
139 if (2 != *queue) {
140 unsupported_cmd:
141 printf("Command %02x %s\n",
142 (unsigned char)s[0], "is not supported");
143 goto err_exit;
144 }
145
146 // parse command: "2 | QUEUE_NAME | '\n'"
147 queue++;
148 // protect against "/../" attacks
149 // *strchrnul(queue, '\n') = '\0'; - redundant, sane() will do
150 if (!*sane(queue))
151 return EXIT_FAILURE;
152
153 // queue is a directory -> chdir to it and enter spooling mode
154 spooling = chdir(queue) + 1; // 0: cannot chdir, 1: done
155 // we don't free(s), we might need "queue" var later
156
157 while (1) {
158 char *fname;
159 int fd;
160 // int is easier than ssize_t: can use xatoi_positive,
161 // and can correctly display error returns (-1)
162 int expected_len, real_len;
163
164 // signal OK
165 safe_write(STDOUT_FILENO, "", 1);
166
167 // get subcommand
168 // valid s must be of form: "SUBCMD | LEN | space | FNAME"
169 // N.B. we bail out on any error
170 s = xmalloc_read_stdin();
171 if (!s) { // (probably) EOF
172 char *p, *q, var[2];
173
174 // non-spooling mode or no spool helper specified
175 if (!spooling || !*argv)
176 return EXIT_SUCCESS; // the only non-error exit
177 // spooling mode but we didn't see both ctrlfile & datafile
178 if (spooling != 7)
179 goto err_exit; // reject job
180
181 // spooling mode and spool helper specified -> exec spool helper
182 // (we exit 127 if helper cannot be executed)
183 var[1] = '\0';
184 // read and delete ctrlfile
185 q = xmalloc_xopen_read_close(filenames[0], NULL);
186 unlink(filenames[0]);
187 // provide datafile name
188 // we can use leaky setenv since we are about to exec or exit
189 xsetenv("DATAFILE", filenames[1]);
190 // parse control file by "\n"
191 while ((p = strchr(q, '\n')) != NULL && isalpha(*q)) {
192 *p++ = '\0';
193 // q is a line of <SYM><VALUE>,
194 // we are setting environment string <SYM>=<VALUE>.
195 // Ignoring "l<datafile>", exporting others:
196 if (*q != 'l') {
197 var[0] = *q++;
198 xsetenv(var, q);
199 }
200 q = p; // next line
201 }
202 // helper should not talk over network.
203 // this call reopens stdio fds to "/dev/null".
204 bb_daemon_helper(DAEMON_DEVNULL_STDIO);
205 BB_EXECVP_or_die(argv);
206 }
207
208 // validate input.
209 // we understand only "control file" or "data file" subcmds
210 if (2 != s[0] && 3 != s[0])
211 goto unsupported_cmd;
212 if (spooling & (1 << (s[0]-1))) {
213 puts("Duplicated subcommand");
214 goto err_exit;
215 }
216 // get filename
217 chomp(s);
218 fname = strchr(s, ' ');
219 if (!fname) {
220 // bad_fname:
221 puts("No or bad filename");
222 goto err_exit;
223 }
224 *fname++ = '\0';
225 // // s[0]==2: ctrlfile, must start with 'c'
226 // // s[0]==3: datafile, must start with 'd'
227 // if (fname[0] != s[0] + ('c'-2))
228 // goto bad_fname;
229 // get length
230 expected_len = bb_strtou(s + 1, NULL, 10);
231 if (errno || expected_len < 0) {
232 puts("Bad length");
233 goto err_exit;
234 }
235 if (2 == s[0] && expected_len > 16 * 1024) {
236 // SECURITY:
237 // ctrlfile can't be big (we want to read it back later!)
238 puts("File is too big");
239 goto err_exit;
240 }
241
242 // open the file
243 if (spooling) {
244 // spooling mode: dump both files
245 // job in flight has mode 0200 "only writable"
246 sane(fname);
247 fd = open3_or_warn(fname, O_CREAT | O_WRONLY | O_TRUNC | O_EXCL, 0200);
248 if (fd < 0)
249 goto err_exit;
250 filenames[s[0] - 2] = xstrdup(fname);
251 } else {
252 // non-spooling mode:
253 // 2: control file (ignoring), 3: data file
254 fd = -1;
255 if (3 == s[0])
256 fd = xopen(queue, O_RDWR | O_APPEND);
257 }
258
259 // signal OK
260 safe_write(STDOUT_FILENO, "", 1);
261
262 // copy the file
263 real_len = bb_copyfd_size(STDIN_FILENO, fd, expected_len);
264 if (real_len != expected_len) {
265 printf("Expected %d but got %d bytes\n",
266 expected_len, real_len);
267 goto err_exit;
268 }
269 // get EOF indicator, see whether it is NUL (ok)
270 // (and don't trash s[0]!)
271 if (safe_read(STDIN_FILENO, &s[1], 1) != 1 || s[1] != 0) {
272 // don't send error msg to peer - it obviously
273 // doesn't follow the protocol, so probably
274 // it can't understand us either
275 goto err_exit;
276 }
277
278 if (spooling) {
279 // chmod completely downloaded file as "readable+writable"
280 fchmod(fd, 0600);
281 // accumulate dump state
282 // N.B. after all files are dumped spooling should be 1+2+4==7
283 spooling |= (1 << (s[0]-1)); // bit 1: ctrlfile; bit 2: datafile
284 }
285
286 free(s);
287 close(fd); // NB: can do close(-1). Who cares?
288
289 // NB: don't do "signal OK" write here, it will be done
290 // at the top of the loop
291 } // while (1)
292
293 err_exit:
294 // don't keep corrupted files
295 if (spooling) {
296 int i;
297 for (i = 2; --i >= 0; )
298 if (filenames[i])
299 unlink(filenames[i]);
300 }
301 return EXIT_FAILURE;
302 }
303