/****************************************************************\
*                                                                *
*  bitlbeed.c                                                    *
*                                                                *
*  A tiny daemon to allow you to run The Bee as a non-root user  *
*  (without access to /etc/inetd.conf or whatever)               *
*                                                                *
*  Copyright 2002-2004 Wilmer van der Gaast <wilmer@gaast.net>   *
*                                                                *
*  Licensed under the GNU General Public License                 *
*                                                                *
*  Modified by M. Dennis, 20040627                               *
\****************************************************************/

/*
   ChangeLog:

   2004-06-27: Added support for AF_LOCAL (UNIX domain) sockets
               Renamed log to do_log to fix conflict warning
               Changed protocol to 0 (6 is not supported?)
               Added error check for socket()
               Added a no-fork (debug) mode
   2004-05-15: Added rate limiting
   2003-12-26: Added the SO_REUSEADDR sockopt, logging and CPU-time limiting
               for clients using setrlimit(), fixed the execv() call
   2002-11-29: Added the timeout so old child processes clean up faster
   2002-11-28: First version
*/

#define SELECT_TIMEOUT 2
#define MAX_LOG_LEN 128

#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>
#include <fcntl.h>
#include <stdarg.h>
#include <time.h>

#include <sys/wait.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/resource.h>
#include <sys/stat.h>

#include <sys/un.h>
#include <netinet/in.h>
#include <arpa/inet.h>

typedef struct settings {
	char local;
	char debug;
	char *interface;
	signed int port;

	unsigned char max_conn;
	int seconds;

	int rate_seconds;
	int rate_times;
	int rate_ignore;

	char **call;
} settings_t;

typedef struct ipstats {
	unsigned int ip;

	time_t rate_start;
	int rate_times;
	time_t rate_ignore;

	struct ipstats *next;
} ipstats_t;

FILE *logfile;
ipstats_t *ipstats;

settings_t *set_load(int argc, char *argv[]);
void do_log(char *fmt, ...);
ipstats_t *ip_get(char *ip_txt);

int main(int argc, char *argv[])
{
	const int rebind_on = 1;
	settings_t *set;

	int serv_fd, serv_len;
	struct sockaddr_in serv_addr;
	struct sockaddr_un local_addr;

	pid_t st;

	if (!(set = set_load(argc, argv))) {
		return(1);
	}

	if (!logfile) {
		if (!(logfile = fopen("/dev/null", "w"))) {
			perror("fopen");
			return(1);
		}
	}

	fcntl(fileno(logfile), F_SETFD, FD_CLOEXEC);

	if (set->local) {
		serv_fd = socket(PF_LOCAL, SOCK_STREAM, 0);
	} else {
		serv_fd = socket(PF_INET, SOCK_STREAM, 0);
	}
	if (serv_fd < 0) {
		perror("socket");
		return(1);
	}
	setsockopt(serv_fd, SOL_SOCKET, SO_REUSEADDR, &rebind_on, sizeof(rebind_on));
	fcntl(serv_fd, F_SETFD, FD_CLOEXEC);
	if (set->local) {
		local_addr.sun_family = AF_LOCAL;
		strncpy(local_addr.sun_path, set->interface, sizeof(local_addr.sun_path) - 1);
		local_addr.sun_path[sizeof(local_addr.sun_path) - 1] = '\0';

		/* warning - don't let untrusted users run this program if it
		   is setuid/setgid! Arbitrary file deletion risk! */
		unlink(set->interface);
		if (bind(serv_fd, (struct sockaddr *) &local_addr, SUN_LEN(&local_addr)) != 0) {
			perror("bind");
			return(1);
		}
		chmod(set->interface, S_IRWXO | S_IRWXG | S_IRWXU);

	} else {
		serv_addr.sin_family = AF_INET;
		serv_addr.sin_addr.s_addr = inet_addr(set->interface);
		serv_addr.sin_port = htons(set->port);
		serv_len = sizeof(serv_addr);

		if (bind(serv_fd, (struct sockaddr *) &serv_addr, serv_len) != 0) {
			perror("bind");
			return(1);
		}
	}

	if (listen(serv_fd, set->max_conn) != 0) {
		perror("listen");
		return(1);
	}

	if (!set->debug) {
		st = fork();
		if (st < 0) {
			perror("fork");
			return(1);
		} else if (st > 0) {
			return(0);
		}

		setsid();
		close(0);
		close(1);
		close(2);
	}

	do_log("bitlbeed running");

	/* The Daemon */
	while (1) {
		int cli_fd, cli_len, i, st;
		struct sockaddr_in cli_addr;
		struct sockaddr_un cli_local;
		ipstats_t *ip;
		char *cli_txt;
		pid_t child;

		static int running = 0;

		fd_set rd;
		struct timeval tm;

		/* accept() only returns after someone connects. To clean up old
		   processes (by running waitpid()) it's better to use select()
		   with a timeout. */
		FD_ZERO(&rd);
		FD_SET(serv_fd, &rd);
		tm.tv_sec = SELECT_TIMEOUT;
		tm.tv_usec = 0;
		if (select(serv_fd + 1, &rd, NULL, NULL, &tm) > 0) {
			if (set->local) {
				cli_len = SUN_LEN(&cli_local);
				cli_fd = accept(serv_fd, (struct sockaddr *) &cli_local, &cli_len);
				cli_txt = "127.0.0.1";
			} else {
				cli_len = sizeof(cli_addr);
				cli_fd = accept(serv_fd, (struct sockaddr *) &cli_addr, &cli_len);
				cli_txt = inet_ntoa(cli_addr.sin_addr);
			}

			ip = ip_get(cli_txt);

			if (set->rate_times == 0 || time(NULL) > ip->rate_ignore) {
				/* We want this socket on stdout and stderr too! */
				dup(cli_fd); dup(cli_fd);

				if ((child = fork()) == 0) {
					if (set->seconds) {
						struct rlimit li;

						li.rlim_cur = (rlim_t) set->seconds;
						li.rlim_max = (rlim_t) set->seconds + 1;
						setrlimit(RLIMIT_CPU, &li);
					}
					execv(set->call[0], set->call);
					do_log("Error while executing %s!", set->call[0]);
					return(1);
				}

				running++;
				close(0);
				close(1);
				close(2);

				do_log("Started child process for client %s (PID=%d), got %d clients now", cli_txt,
				       child, running);

				if (time(NULL) < (ip->rate_start + set->rate_seconds)) {
					ip->rate_times++;
					if (ip->rate_times >= set->rate_times) {
						do_log("Client %s crossed the limit; ignoring for the next %d seconds",
						       cli_txt, set->rate_ignore);
						ip->rate_ignore = time(NULL) + set->rate_ignore;
						ip->rate_start = 0;
					}
				} else {
					ip->rate_start = time(NULL);
					ip->rate_times = 1;
				}
			} else {
				do_log("Ignoring connection from %s", cli_txt);
				close(cli_fd);
			}
		}

		/* If the max. number of connection is reached, don't accept
		   new connections until one expires -> Not always WNOHANG

		   Cleaning up child processes is a good idea anyway... :-) */
		while ((i = waitpid(0, &st, ((running < set->max_conn) || (set->max_conn == 0)) ? WNOHANG : 0)) > 0) {
			running--;
			if (WIFEXITED(st)) {
				do_log("Child process (PID=%d) exited normally with status %d. %d Clients left now",
				       i, WEXITSTATUS(st), running);
			} else if (WIFSIGNALED(st)) {
				do_log("Child process (PID=%d) killed by signal %d. %d Clients left now",
				       i, WTERMSIG(st), running);
			} else {
				/* Should not happen AFAIK... */
				do_log("Child process (PID=%d) stopped for unknown reason, %d clients left now",
				       i, running);
			}
		}
	}

	return(0);
}

settings_t *set_load(int argc, char *argv[])
{
	settings_t *set;
	int opt, i;

	set = malloc(sizeof(settings_t));
	memset(set, 0, sizeof(settings_t));
	set->interface = NULL;          /* will be filled in later */
	set->port = 6667;
	set->local = 0;
	set->debug = 0;

	set->rate_seconds = 600;
	set->rate_times = 5;
	set->rate_ignore = 900;

	while ((opt = getopt(argc, argv, "i:p:n:t:l:r:hud")) >= 0) {
		if (opt == 'i') {
			set->interface = strdup(optarg);
		} else if (opt == 'p') {
			if ((sscanf(optarg, "%d", &i) != 1) || (i <= 0) || (i > 65535)) {
				fprintf(stderr, "Invalid port number: %s\n", optarg);
				return(NULL);
			}
			set->port = i;
		} else if (opt == 'n') {
			if ((sscanf(optarg, "%d", &i) != 1) || (i < 0)) {
				fprintf(stderr, "Invalid number of connections: %s\n", optarg);
				return(NULL);
			}
			set->max_conn = i;
		} else if (opt == 't') {
			if ((sscanf(optarg, "%d", &i) != 1) || (i < 0) || (i > 600)) {
				fprintf(stderr, "Invalid number of seconds: %s\n", optarg);
				return(NULL);
			}
			set->seconds = i;
		} else if (opt == 'l') {
			if (!(logfile = fopen(optarg, "a"))) {
				perror("fopen");
				fprintf(stderr, "Error opening logfile, giving up.\n");
				return(NULL);
			}
			setbuf(logfile, NULL);
		} else if (opt == 'r') {
			if (sscanf(optarg, "%d,%d,%d", &set->rate_seconds, &set->rate_times, &set->rate_ignore) != 3) {
				fprintf(stderr, "Invalid argument to -r.\n");
				return(NULL);
			}
		} else if (opt == 'u') {
			set->local = 1;
		} else if (opt == 'd') {
			set->debug = 1;
		} else if (opt == 'h') {
			printf("Usage: %s [-i <interface>] [-p <port>] [-n <num>] [-r x,y,z] ...\n"
			       "          ... <command> <args...>\n"
			       "A simple inetd-like daemon to have a program listening on a TCP socket without\n"
			       "needing root access to the machine\n"
			       "\n"
			       "  -i  Specify the interface (by IP address) to listen on.\n"
			       "      (Default: 0.0.0.0 (any interface))\n"
			       "  -p  Port number to listen on. (Default: 6667)\n"
			       "  -n  Maximum number of connections. (Default: 0 (unlimited))\n"
			       "  -t  Specify the maximum number of CPU seconds per process.\n"
			       "      (Default: 0 (unlimited))\n"
			       "  -l  Specify a logfile. (Default: none)\n"
			       "  -r  Rate limiting: Ignore a host for z seconds when it connects for more\n"
			       "      than y times in x seconds. (Default: 600,5,900. Disable: 0,0,0)\n"
			       "  -u  Use a local socket, by default /tmp/bitlbee (override with -i <filename>)\n"
			       "  -d  Don't fork for listening (for debugging purposes)\n"
			       "  -h  This information\n", argv[0]);
			return(NULL);
		}
	}

	if (set->interface == NULL) {
		set->interface = (set->local) ? "/tmp/bitlbee" : "0.0.0.0";
	}

	if (optind == argc) {
		fprintf(stderr, "Missing program parameter!\n");
		return(NULL);
	}

	/* The remaining arguments are the executable and its arguments */
	set->call = malloc((argc - optind + 1) * sizeof(char*));
	memcpy(set->call, argv + optind, sizeof(char*) * (argc - optind));
	set->call[argc - optind] = NULL;

	return(set);
}

void do_log(char *fmt, ...)
{
	va_list params;
	char line[MAX_LOG_LEN];
	time_t tm;
	int l;

	memset(line, 0, MAX_LOG_LEN);

	tm = time(NULL);
	strcpy(line, ctime(&tm));
	l = strlen(line);
	line[l - 1] = ' ';

	va_start(params, fmt);
	vsnprintf(line + l, MAX_LOG_LEN - l - 2, fmt, params);
	va_end(params);
	strcat(line, "\n");

	fprintf(logfile, "%s", line);
}

ipstats_t *ip_get(char *ip_txt)
{
	unsigned int ip;
	ipstats_t *l;
	int p[4];

	sscanf(ip_txt, "%d.%d.%d.%d", p + 0, p + 1, p + 2, p + 3);
	ip = (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | (p[3]);

	for (l = ipstats; l; l = l->next) {
		if (l->ip == ip) {
			return(l);
		}
	}

	if (ipstats) {
		for (l = ipstats; l->next; l = l->next) {
			;
		}

		l->next = malloc(sizeof(ipstats_t));
		l = l->next;
	} else {
		l = malloc(sizeof(ipstats_t));
		ipstats = l;
	}
	memset(l, 0, sizeof(ipstats_t));

	l->ip = ip;

	return(l);
}