diff options
| -rw-r--r-- | src/conn-tools/s6-tlsserver.c | 66 | ||||
| -rw-r--r-- | src/stls/stls_s6tlsd.c | 2 |
2 files changed, 39 insertions, 29 deletions
diff --git a/src/conn-tools/s6-tlsserver.c b/src/conn-tools/s6-tlsserver.c index 5ba5b0c..ef5abe4 100644 --- a/src/conn-tools/s6-tlsserver.c +++ b/src/conn-tools/s6-tlsserver.c @@ -8,6 +8,7 @@ #include <skalibs/sgetopt.h> #include <skalibs/strerr2.h> #include <skalibs/djbunix.h> +#include <s6/config.h> #include <s6-networking/config.h> #define USAGE "s6-tlsserver [ options ] ip port prog...\n" \ @@ -45,6 +46,7 @@ struct options_s unsigned int flagS : 1 ; unsigned int flagy : 1 ; unsigned int doaccess : 1 ; + unsigned int doapply : 1 ; } ; #define OPTIONS_ZERO \ @@ -72,7 +74,8 @@ struct options_s .ruleswhat = 0, \ .flagS = 0, \ .flagy = 0, \ - .doaccess = 0 \ + .doaccess = 0, \ + .doapply = 0 \ } int main (int argc, char const *const *argv, char const *const *envp) @@ -96,10 +99,10 @@ int main (int argc, char const *const *argv, char const *const *envp) case 'c' : if (!uint0_scan(l.arg, &o.maxconn)) dieusage() ; if (!o.maxconn) o.maxconn = 1 ; break ; case 'C' : if (!uint0_scan(l.arg, &o.localmaxconn)) dieusage() ; if (!o.localmaxconn) o.localmaxconn = 1 ; break ; case 'b' : if (!uint0_scan(l.arg, &o.backlog)) dieusage() ; break ; - case 'G' : if (!gid_scanlist(o.gids, NGROUPS_MAX, l.arg, &o.gidn) && *l.arg) dieusage() ; break ; - case 'g' : if (!uint0_scan(l.arg, &o.gid)) dieusage() ; break ; - case 'u' : if (!uint0_scan(l.arg, &o.uid)) dieusage() ; break ; - case 'U' : o.flagU = 1 ; o.uid = 0 ; o.gid = 0 ; o.gidn = (unsigned int)-1 ; break ; + case 'G' : if (!gid_scanlist(o.gids, NGROUPS_MAX, l.arg, &o.gidn) && *l.arg) dieusage() ; o.doapply = 1 ; break ; + case 'g' : if (!uint0_scan(l.arg, &o.gid)) dieusage() ; o.doapply = 1 ; break ; + case 'u' : if (!uint0_scan(l.arg, &o.uid)) dieusage() ; o.doapply = 1 ; break ; + case 'U' : o.flagU = 1 ; o.uid = 0 ; o.gid = 0 ; o.gidn = (unsigned int)-1 ; o.doapply = 1 ; break ; case 'W' : o.flagw = 0 ; break ; case 'w' : o.flagw = 1 ; break ; case 'D' : o.flagD = 1 ; o.doaccess = 1 ; break ; @@ -131,7 +134,7 @@ int main (int argc, char const *const *argv, char const *const *envp) unsigned int m = 0 ; unsigned int pos = 0 ; char fmt[UINT_FMT * 5 + GID_FMT * (NGROUPS_MAX + 1) + UINT64_FMT] ; - char const *newargv[44 + argc] ; + char const *newargv[46 + argc] ; newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpserver" ; if (o.verbosity != 1) newargv[m++] = o.verbosity ? "-v" : "-q" ; if (o.flag46) newargv[m++] = o.flag46 == 1 ? "-4" : "-6" ; @@ -157,29 +160,9 @@ int main (int argc, char const *const *argv, char const *const *envp) pos += uint_fmt(fmt + pos, o.backlog) ; fmt[pos++] = 0 ; } - if (o.gidn != (unsigned int)-1) - { - newargv[m++] = "-G" ; - newargv[m++] = fmt + pos ; - pos += gid_fmtlist(fmt + pos, o.gids, o.gidn) ; - fmt[pos++] = 0 ; - } - if (o.gid) - { - newargv[m++] = "-g" ; - newargv[m++] = fmt + pos ; - pos += gid_fmt(fmt + pos, o.gid) ; - fmt[pos++] = 0 ; - } - if (o.uid) - { - newargv[m++] = "-u" ; - newargv[m++] = fmt + pos ; - pos += uint64_fmt(fmt + pos, o.uid) ; - fmt[pos++] = 0 ; - } - if (o.flagU) newargv[m++] = "-U" ; newargv[m++] = "--" ; + newargv[m++] = *argv++ ; + newargv[m++] = *argv++ ; if (o.doaccess) { newargv[m++] = S6_NETWORKING_BINPREFIX "s6-tcpserver-access" ; @@ -233,6 +216,33 @@ int main (int argc, char const *const *argv, char const *const *envp) fmt[pos++] = 0 ; } newargv[m++] = "--" ; + if (o.doapply) + { + newargv[m++] = S6_BINPREFIX "s6-applyuidgid" ; + if (o.gidn != (unsigned int)-1) + { + newargv[m++] = "-G" ; + newargv[m++] = fmt + pos ; + pos += gid_fmtlist(fmt + pos, o.gids, o.gidn) ; + fmt[pos++] = 0 ; + } + if (o.gid) + { + newargv[m++] = "-g" ; + newargv[m++] = fmt + pos ; + pos += gid_fmt(fmt + pos, o.gid) ; + fmt[pos++] = 0 ; + } + if (o.uid) + { + newargv[m++] = "-u" ; + newargv[m++] = fmt + pos ; + pos += uint64_fmt(fmt + pos, o.uid) ; + fmt[pos++] = 0 ; + } + if (o.flagU) newargv[m++] = "-Uz" ; + newargv[m++] = "--" ; + } while (*argv) newargv[m++] = *argv++ ; newargv[m++] = 0 ; pathexec_run(newargv[0], newargv, envp) ; diff --git a/src/stls/stls_s6tlsd.c b/src/stls/stls_s6tlsd.c index dcee5f4..61b1343 100644 --- a/src/stls/stls_s6tlsd.c +++ b/src/stls/stls_s6tlsd.c @@ -60,7 +60,7 @@ int stls_s6tlsd (char const *const *argv, char const *const *envp, tain_t const diecfg(cfg, "tls_config_set_ecdhecurve") ; if (preoptions & 1) tls_config_verify_client(cfg) ; - else tls_config_verify_client_optional(cfg) ; + else tls_config_insecure_noverifycert(cfg) ; tls_config_set_protocols(cfg, TLS_PROTOCOLS_DEFAULT) ; tls_config_prefer_ciphers_server(cfg) ; |