test (1377318d) · Commits · tuxist / authdb

src/authdb.cpp

+42 −53

Changes for src/authdb.cpp: 42 added lines, 53 removed lines.
Original line number	Diff line number	Diff line
		@@ -68,7 +68,6 @@
		#include <grp.h>
		#include <sys/stat.h>
		#include <fcntl.h>
		#include <ftw.h>
		#endif

		namespace authdb {
		@@ -234,7 +233,6 @@ namespace authdb {
		rep.send(curreq,out,FAVICON_LEN);
		return;
		}else if(_AdminBackend.end()<=sizeof(authdb::AuthHeader)){
		{
		AuthBackendLock admlock(_AdminBackend);
		try{
		WizzardEvent(curreq,tid,args);
		@@ -248,15 +246,6 @@ namespace authdb {
		return;
		}
		}
		} // admlock destructor pushes data to cluster store

		// Wizard finished — redirect to login (303 ensures GET)
		libhttppp::HttpResponse rep;
		rep.setState(HTTP303);
		rep.setHeaderData("Location")->push_back("/settings/index");
		rep.setContentType("text/html");
		rep.send(curreq, "", 0);
		return;
		}

		if(curreq.getRequestURL().compare(0,9,"/settings",9)==0){
		@@ -521,10 +510,10 @@ int main(int argc,char *argv[]){
		std::string cert=config.getValue(config.getKey("/AUTHDB/SSL/CERT"),0);
		std::string key=config.getValue(config.getKey("/AUTHDB/SSL/KEY"),0);

		/* Cluster setup — must happen before backend is used */
		/* Cluster config — parsed early, started after priv drop */
		authdb::Cluster cluster;
		if (clusterEnabled) {
		authdb::ClusterConfig ccfg;
		if (clusterEnabled) {
		ccfg.bind_address = config.getValue(config.getKey("/AUTHDB/CLUSTER/BIND"), 0);
		ccfg.port = config.getIntValue(config.getKey("/AUTHDB/CLUSTER/PORT"), 0);
		ccfg.cert_file = cert;
		@@ -559,12 +548,6 @@ int main(int argc,char *argv[]){
		} catch (...) { break; }
		}
		}

		cluster.init(ccfg);
		cluster.start();
		authdb::g_Cluster = &cluster;
		std::cerr << "Cluster started on " << ccfg.bind_address << ":" << ccfg.port
		<< " with " << ccfg.peers.size() << " peer(s)" << std::endl;
		}

		std::string backendPath;
		@@ -572,12 +555,6 @@ int main(int argc,char *argv[]){
		backendPath = config.getValue(config.getKey("/AUTHDB/ADMINDB/PATH"), 0);
		}

		authdb::AuthBackend backend(
		clusterEnabled ? authdb::AuthBackendType::ClusterStore : authdb::AuthBackendType::File,
		backendPath,
		"admin.local"
		);

		libhttppp::HttpD httpd(
		config.getValue(config.getKey("/AUTHDB/BIND"),0),
		config.getIntValue(config.getKey("/AUTHDB/PORT"),0),
		@@ -586,37 +563,10 @@ int main(int argc,char *argv[]){
		key
		);

		authdb::AuthDB authdb(backend,httpd.getServerSockets());

		/* Drop privileges after binding sockets */
		/* Drop privileges after binding HTTP socket */
		#ifndef _WIN32
		if (getuid() == 0) {
		struct passwd *pw = getpwnam("authdb");

		/* Recursively chown paths that were created as root */
		if (pw) {
		auto chown_recursive = [](const char *path, uid_t uid, gid_t gid) {
		static uid_t s_uid;
		static gid_t s_gid;
		s_uid = uid;
		s_gid = gid;
		nftw(path, [](const char fpath, const struct stat , int, struct FTW *) -> int {
		chown(fpath, s_uid, s_gid);
		return 0;
		}, 64, FTW_PHYS);
		};

		if (clusterEnabled) {
		auto *sp = config.getKey("/AUTHDB/CLUSTER/PATH");
		if (sp) chown_recursive(config.getValue(sp, 0).c_str(), pw->pw_uid, pw->pw_gid);
		}
		auto *ap = config.getKey("/AUTHDB/ADMINDB/PATH");
		if (ap) {
		const char *adminPath = config.getValue(ap, 0).c_str();
		chown(adminPath, pw->pw_uid, pw->pw_gid);
		}
		}

		if (pw) {
		if (setgid(pw->pw_gid) != 0) {
		std::cerr << "setgid failed" << std::endl;
		@@ -636,6 +586,23 @@ int main(int argc,char *argv[]){
		}
		#endif

		/* Start cluster after priv drop so all files are owned by authdb */
		if (clusterEnabled) {
		cluster.init(ccfg);
		cluster.start();
		authdb::g_Cluster = &cluster;
		std::cerr << "Cluster started on " << ccfg.bind_address << ":" << ccfg.port
		<< " with " << ccfg.peers.size() << " peer(s)" << std::endl;
		}

		authdb::AuthBackend backend(
		clusterEnabled ? authdb::AuthBackendType::ClusterStore : authdb::AuthBackendType::File,
		backendPath,
		"admin.local"
		);

		authdb::AuthDB authdb(backend,httpd.getServerSockets());

		if(cmd.getCmdbyKey("debug")->getValue()=="true"){
		authdb::DEBUG=true;
		authdb.threads=1;
		@@ -703,6 +670,28 @@ int main(int argc,char *argv[]){
		pluginThreads.back().detach();
		}

		#ifndef _WIN32
		if ( getuid() == 0) {
		struct passwd *pw = getpwnam("authdb");
		if (pw) {
		if (setgid(pw->pw_gid) != 0) {
		std::cerr << "setgid failed" << std::endl;
		return 1;
		}
		if (initgroups("authdb", pw->pw_gid) != 0) {
		std::cerr << "initgroups failed" << std::endl;
		return 1;
		}
		if (setuid(pw->pw_uid) != 0) {
		std::cerr << "setuid failed" << std::endl;
		return 1;
		}
		} else {
		std::cerr << "user authdb not found, running as root" << std::endl;
		}
		}
		#endif

		authdb.runEventloop();

		/* Shutdown cluster */