FD_CLOEXEC everything

_GNU_SOURCE is needed for socket4

diff --git a/Makefile b/Makefile
index bc88915..f5f2e34 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -46,5 +46,5 @@ $(TARGET): $(SOURCES) $(HEADERS)
        $(CC) $(CFLAGS) $(LDFLAGS) $(SOURCES) $(LDLIBS) -o $@
 $(TARGET).exe: $(SOURCES) $(HEADERS)
        $(CC.w32) $(CFLAGS.w32) $(LDFLAGS.w32) $(SOURCES) $(LDLIBS.w32) -o $@
-setpass: src/setpass.c src/passwd.c src/passwd.h
+setpass: src/setpass.c src/passwd.c src/passwd.h src/netsock.h
        $(CC) $(CFLAGS) $(LDFLAGS) src/setpass.c src/passwd.c $(LDLIBS) -o $@

diff --git a/config.example.mk b/config.example.mk
index 5c2efc8..26175db 100644 (file)
--- a/config.example.mk
+++ b/config.example.mk
@@ -1,6 +1,6 @@
 HEADERS+=config.mk
 CC=clang
-CFLAGS=-Wall -Wextra -DHAS_TLS -DNETPOLL_USE_POLL
+CFLAGS=-Wall -Wextra -DHAS_TLS -DNETPOLL_USE_POLL -D_GNU_SOURCE
 LDLIBS=-ltls
 CC.w32=i686-w64-mingw32-gcc
 CFLAGS.w32=-Wall -Wextra -DNETPOLL_USE_SELECT

diff --git a/src/irc.c b/src/irc.c
index 4aef464..55356c4 100644 (file)
--- a/src/irc.c
+++ b/src/irc.c
@@ -455,7 +455,7 @@ saslcleanup:
                if (!hash)
                        return 0; // TODO: error message
                memset(args[1], 0, strlen(args[1]));
-               FILE *f = fopen(getdatafile("newusers.txt"), "ab");
+               FILE *f = fopen(getdatafile("newusers.txt"), "ab" FOPEN_CLOEXEC);
                if (!f)
                        return 0; // TODO: error message
                fprintf(f, "%s:%s\n", args[0], hash);
@@ -732,7 +732,7 @@ saslcleanup:
                if (!is_registered(client))
                        return err_notregistered(client), sendbuf(client), 0;
                char line[512];
-               FILE *f = fopen(getdatafile("help.txt"), "r");
+               FILE *f = fopen(getdatafile("help.txt"), "r" FOPEN_CLOEXEC);
                if (f) {
                        rpl_helpstart(client), sendbuf(client);
                        while (fgets(line, 512, f)) {
@@ -1212,7 +1212,7 @@ void sendLUSERS(struct client_data *client)
 
 void sendMOTD(struct client_data *client) {
        char line[512];
-       FILE *f = fopen(getdatafile("motd.txt"), "r");
+       FILE *f = fopen(getdatafile("motd.txt"), "r" FOPEN_CLOEXEC);
        if (f) {
                rpl_motdstart(client), sendbuf(client);
                while (fgets(line, 512, f)) {

diff --git a/src/main.c b/src/main.c
index 5ae98d9..ab74a76 100644 (file)
--- a/src/main.c
+++ b/src/main.c
@@ -49,7 +49,7 @@ static void set_handler()
 {
        SetConsoleCtrlHandler(on_sigint, TRUE);
 
-       self_sock = socket(AF_INET, SOCK_DGRAM, 0);
+       self_sock = socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC, 0);
        if (self_sock == INVALID_SOCKET) {
                net_perror("ERROR CREATING SELF SOCK");
                return;
@@ -100,7 +100,7 @@ SOCKET create_listen_sock(const char *ip, const char *port)
 
        SOCKET sock;
        // Create socket
-       sock = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
+       sock = socket(res->ai_family, res->ai_socktype|SOCK_CLOEXEC, res->ai_protocol);
        if(sock == (SOCKET)INVALID_SOCKET) {
                net_perror("ERROR SOCKET");
                freeaddrinfo(res);
@@ -140,7 +140,7 @@ void accept_from_sock(struct listener *listener)
        for (;;) {
                struct sockaddr_storage addr;
                socklen_t len = sizeof(addr);
-               SOCKET newSocket = accept(listener->sock, (struct sockaddr *)&addr, &len);
+               SOCKET newSocket = accept4(listener->sock, (struct sockaddr *)&addr, &len, SOCK_CLOEXEC);
                if (newSocket == (SOCKET)INVALID_SOCKET) {
                        if (!net_wouldblock())
                                net_perror("ERROR newSocket");
@@ -305,7 +305,7 @@ int main(int argc, char *argv[])
                net_poll_reg(listeners[i].sock, NETPOLL_IN);
        }
 
-       FILE *f = fopen(getdatafile("init.txt"), "rb");
+       FILE *f = fopen(getdatafile("init.txt"), "rb" FOPEN_CLOEXEC);
        if (f) {
                struct client_data *fake = allocClient();
                fake->FD = INVALID_SOCKET;
@@ -357,7 +357,7 @@ int main(int argc, char *argv[])
                set_time(0);
                fclose(f);
        }
-       fchanlog = fopen(getdatafile("chanlog.txt"), "ab");
+       fchanlog = fopen(getdatafile("chanlog.txt"), "ab" FOPEN_CLOEXEC);
        if (fchanlog) {
                fprintf(fchanlog, "$0 AAA :server starting %lu\r\n", (unsigned long)get_time());
                fflush(fchanlog);

diff --git a/src/netsock.h b/src/netsock.h
index 78c7fb7..3ba7e3b 100644 (file)
--- a/src/netsock.h
+++ b/src/netsock.h
@@ -21,6 +21,9 @@
  * | O_NONBLOCK/FIONBIO | FIONBIO           | net_nonblock()   |
  * | read/recv          | recv              | recv             |
  * | write/send         | send              | send             |
+ * | accept4            | accept            | accept4          |
+ * | SOCK_CLOEXEC       | (none)            | SOCK_CLOEXEC     |
+ * | "e"                | (none)            | FOPEN_CLOEXEC    |
  */
 
 /* All implementations besides glibc and 4.4BSD allow redefining this constant.
@@ -59,6 +62,9 @@ void net_cleanup(void);
 #define SHUT_RD SD_RECEIVE
 #define SHUT_WR SD_SEND
 #define SHUT_RDWR SD_BOTH
+#define SOCK_CLOEXEC 0
+#define FOPEN_CLOEXEC ""
+#define accept4(a,b,c,d) accept((a),(b),(c))
 #else
 /* POSIX */
 #include <unistd.h>
@@ -80,6 +86,10 @@ typedef int SOCKET;
 #define net_cleanup()
 #define closesocket close
 #define ioctlsocket ioctl
+#ifndef SOCK_CLOEXEC
+#error "SOCK_CLOEXEC is required"
+#endif
+#define FOPEN_CLOEXEC "e"
 #endif
 
 void net_perror(const char *p);

diff --git a/src/passwd.c b/src/passwd.c
index fadf685..aa81a0d 100644 (file)
--- a/src/passwd.c
+++ b/src/passwd.c
@@ -24,6 +24,7 @@ int password_check(const char *key, const char *pw, const char *fn)
 #include <string.h>
 #include <unistd.h>
 #include <crypt.h>
+#include "netsock.h"
 const char *password_hash(const char *pw)
 {
        char salt[20];
@@ -49,10 +50,10 @@ int password_set(const char *key, const char *pw, const char *fn, const char *tm
        if (!hash)
                return -1;
 
-       FILE *fi = fopen(fn, "rb");
+       FILE *fi = fopen(fn, "rb" FOPEN_CLOEXEC);
        if (!fi)
                return -1;
-       FILE *fo = fopen(tmpfn, "wb");
+       FILE *fo = fopen(tmpfn, "wb" FOPEN_CLOEXEC);
        if (!fo) {
                fclose(fi);
                return -1;
@@ -87,7 +88,7 @@ int password_set(const char *key, const char *pw, const char *fn, const char *tm
 int password_check(const char *key, const char *pw, const char *fn)
 {
        // NOTE: there are probably a lot of timing leaks in here
-       FILE *fi = fopen(fn, "rb");
+       FILE *fi = fopen(fn, "rb" FOPEN_CLOEXEC);
        if (!fi)
                return -1;
        int keylen = strlen(key);
@@ -108,7 +109,7 @@ int password_check(const char *key, const char *pw, const char *fn)
 }
 #endif
 const char *db_read_rhs(const char *key, const char *fn) {
-       FILE *fi = fopen(fn, "rb");
+       FILE *fi = fopen(fn, "rb" FOPEN_CLOEXEC);
        if (!fi)
                return 0;
        int keylen = strlen(key);