Limit 'extern' to trusted code

[hcoop/domtool2.git] / src / main.sml

diff --git a/src/main.sml b/src/main.sml
index 461207a..2aa3da7 100644 (file)
--- a/src/main.sml
+++ b/src/main.sml
@@ -58,17 +58,13 @@ fun basis () =
        if !ErrorMsg.anyErrors then
            Env.empty
        else
-           foldl (fn (fname, G) => check' G fname) Env.empty files
+           (Tycheck.allowExterns ();
+            foldl (fn (fname, G) => check' G fname) Env.empty files
+            before Tycheck.disallowExterns ())
     end
 
 fun check fname =
     let
-       val uid = Posix.ProcEnv.getuid ()
-       val user = Posix.SysDB.Passwd.name (Posix.SysDB.getpwuid uid)
-
-       val () = Acl.read Config.aclFile
-       val () = Domain.setUser user
-
        val _ = ErrorMsg.reset ()
        val _ = Env.preTycheck ()
 
@@ -78,6 +74,7 @@ fun check fname =
            raise ErrorMsg.Error
        else
            let
+               val _ = Tycheck.disallowExterns ()
                val _ = ErrorMsg.reset ()
                val prog = Parse.parse fname
            in
@@ -128,24 +125,21 @@ fun eval fname =
 val dispatcher =
     Config.dispatcher ^ ":" ^ Int.toString Config.dispatcherPort
 
-fun hostname () =
-    let
-       val inf = TextIO.openIn "/etc/hostname"
-    in
-       case TextIO.inputLine inf of
-           NONE => (TextIO.closeIn inf; raise Fail "No line in /etc/hostname")
-         | SOME line => (TextIO.closeIn inf; String.substring (line, 0, size line - 1))
-    end
-
 fun request fname =
     let
+       val uid = Posix.ProcEnv.getuid ()
+       val user = Posix.SysDB.Passwd.name (Posix.SysDB.getpwuid uid)
+
+       val () = Acl.read Config.aclFile
+       val () = Domain.setUser user
+
        val _ = check fname
 
        val uid = Posix.ProcEnv.getuid ()
        val user = Posix.SysDB.Passwd.name (Posix.SysDB.getpwuid uid)
 
        val context = OpenSSL.context (Config.certDir ^ "/" ^ user ^ ".pem",
-                                      Config.keyDir ^ "/" ^ user ^ ".pem",
+                                      Config.keyDir ^ "/" ^ user ^ "/key.pem",
                                       Config.trustStore)
 
        val bio = OpenSSL.connect (context, dispatcher)
@@ -212,21 +206,21 @@ fun service () =
                                    TextIO.closeOut outf;
                                    (eval outname;
                                     Msg.send (bio, MsgOk))
-                                    handle ErrorMsg.Error =>
-                                           (print "Compilation error\n";
-                                            Msg.send (bio,
-                                                      MsgError "Error during configuration evaluation"))
-                                         | OpenSSL.OpenSSL s =>
-                                           (print "OpenSSL error\n";
-                                            Msg.send (bio,
-                                                      MsgError
-                                                          ("Error during configuration evaluation: "
-                                                           ^ s)));
-                                   OS.FileSys.remove outname;
-                                   (ignore (OpenSSL.readChar bio);
-                                    OpenSSL.close bio)
-                                   handle OpenSSL.OpenSSL _ => ();
-                                   loop ()
+                                   handle ErrorMsg.Error =>
+                                          (print "Compilation error\n";
+                                           Msg.send (bio,
+                                                     MsgError "Error during configuration evaluation"))
+                                        | OpenSSL.OpenSSL s =>
+                                          (print "OpenSSL error\n";
+                                           Msg.send (bio,
+                                                     MsgError
+                                                         ("Error during configuration evaluation: "
+                                                          ^ s)));
+                                          OS.FileSys.remove outname;
+                                          (ignore (OpenSSL.readChar bio);
+                                           OpenSSL.close bio)
+                                          handle OpenSSL.OpenSSL _ => ();
+                                          loop ()
                                end
                              | _ =>
                                (Msg.send (bio, MsgError "Unexpected command")
@@ -237,17 +231,28 @@ fun service () =
                in
                    cmdLoop ()
                end
+                   handle OpenSSL.OpenSSL s =>
+                          (print ("OpenSSL error: " ^ s ^ "\n");
+                           OpenSSL.close bio
+                           handle OpenSSL.OpenSSL _ => ();
+                           loop ())
+                        | OS.SysErr (s, _) =>
+                          (print ("System error: " ^ s ^ "\n");
+                           OpenSSL.close bio
+                           handle OpenSSL.OpenSSL _ => ();
+                           loop ())
     in
+       print "Listening for connections....\n";
        loop ();
        OpenSSL.shutdown sock
     end
 
 fun slave () =
     let
-       val host = hostname ()
+       val host = Slave.hostname ()
 
        val context = OpenSSL.context (Config.certDir ^ "/" ^ host ^ ".pem",
-                                      Config.keyDir ^ "/" ^ host ^ ".pem",
+                                      Config.keyDir ^ "/" ^ host ^ "/key.pem",
                                       Config.trustStore)
 
        val sock = OpenSSL.listen (context, Config.slavePort)
@@ -286,6 +291,11 @@ fun slave () =
                            OpenSSL.close bio
                                          handle OpenSSL.OpenSSL _ => ();
                            loop ())
+                        | OS.SysErr (s, _) =>
+                          (print ("System error: "^ s ^ "\n");
+                           OpenSSL.close bio
+                           handle OpenSSL.OpenSSL _ => ();
+                           loop ())
     in
        loop ();
        OpenSSL.shutdown sock