Context Navigation

source: trunk/src/sh_portcheck.c@ 328

Last change on this file since 328 was 328, checked in by katerina, 14 years ago
Fix for ticket #247: The port range for the open port check should be configurable
Property svn:executable set to ``*
File size: 51.2 KB

Rev	Line
[67]	1	/* SAMHAIN file system integrity testing */
	2	/* Copyright (C) 2006 Rainer Wichmann */
	3	/* */
	4	/* This program is free software; you can redistribute it */
	5	/* and/or modify */
	6	/* it under the terms of the GNU General Public License as */
	7	/* published by */
	8	/* the Free Software Foundation; either version 2 of the License, or */
	9	/* (at your option) any later version. */
	10	/* */
	11	/* This program is distributed in the hope that it will be useful, */
	12	/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
	13	/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
	14	/* GNU General Public License for more details. */
	15	/* */
	16	/* You should have received a copy of the GNU General Public License */
	17	/* along with this program; if not, write to the Free Software */
	18	/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
	19
	20	/***************************************************************************
	21	*
	22	* This file provides a module for samhain to check for open ports
	23	* on the local machine.
	24	*
	25	*/
	26
	27
	28	/* #define TEST_ONLY */
	29	#ifndef TEST_ONLY
	30	#include "config_xor.h"
	31	#endif
	32
	33	#include <stdio.h>
	34	#include <string.h>
	35	#include <sys/types.h>
	36	#include <sys/socket.h>
	37	#include <netinet/in.h>
	38	#include <arpa/inet.h>
	39	#include <errno.h>
	40	#include <unistd.h>
[109]	41	#include <fcntl.h>
[67]	42
[76]	43	#define PORTCHK_VERSION "1.0"
	44
	45	#if defined(TEST_ONLY) \|\| (defined(SH_USE_PORTCHECK) && (defined (SH_WITH_CLIENT) \|\| defined (SH_STANDALONE)))
	46
	47
[67]	48	#define PORTMAP
[290]	49	#ifdef HAVE_RPC_RPC_H
[67]	50	#include <rpc/rpc.h>
	51	#ifdef HAVE_RPC_RPCENT_H
	52	#include <rpc/rpcent.h>
	53	#endif
	54	#include <rpc/pmap_clnt.h>
	55	#include <rpc/pmap_prot.h>
[290]	56	#endif
[67]	57	#include <netdb.h>
	58
	59	/*
	60	* struct pmaplist {
	61	* struct pmap pml_map;
	62	* struct pmaplist *pml_next;
	63	* };
	64	*/
	65
	66	/* struct pmap {
	67	* long unsigned pm_prog;
	68	* long unsigned pm_vers;
	69	* long unsigned pm_prot;
	70	* long unsigned pm_port;
	71	* };
	72	*/
	73
	74	/* TIME_WAIT ? 60-240 seconds */
	75
[295]	76	#if !defined(TEST_ONLY)
	77
	78	#define FIL__ _("sh_portcheck.c")
	79	#include "samhain.h"
	80	#include "sh_error.h"
	81	#include "sh_mem.h"
	82	#include "sh_calls.h"
	83	#include "sh_utils.h"
	84	#include "sh_modules.h"
	85	#define SH_NEED_GETHOSTBYXXX
	86	#include "sh_static.h"
	87	#include "sh_pthread.h"
	88	#include "sh_ipvx.h"
	89
[67]	90	/* the size of an interface string
	91	*/
[295]	92	#define SH_INTERFACE_SIZE SH_IP_BUF
[67]	93
	94	#define SH_PORT_NOT 0
	95	#define SH_PORT_REQ 1
	96	#define SH_PORT_OPT 2
[127]	97	#define SH_PORT_IGN 3
[149]	98	#define SH_PORT_BLACKLIST 4
[67]	99
	100	#define SH_PORT_MISS 0
	101	#define SH_PORT_ISOK 1
	102	#define SH_PORT_UNKN 2
	103
	104	#define SH_PORT_NOREPT 0
	105	#define SH_PORT_REPORT 1
	106
[149]	107	#define SH_PROTO_TCP 0
	108	#define SH_PROTO_UDP 1
	109	#define SH_PROTO_STR(a) (((a) == IPPROTO_TCP) ? _("tcp") : _("udp"))
	110
[67]	111	struct sh_portentry {
	112	int port;
	113	char interface[SH_INTERFACE_SIZE];
	114	char * service;
	115	char * error;
	116	int flag; /* required or not */
	117	int status; /* missing or not */
	118	struct sh_portentry * next;
	119	};
	120
	121	static struct sh_portentry * portlist_tcp = NULL;
	122	static struct sh_portentry * portlist_udp = NULL;
	123
[149]	124
[67]	125	#define SH_PORTCHK_INTERVAL 300
	126
	127	static int sh_portchk_check_udp = 1;
	128	static int sh_portchk_active = 1;
	129	static int sh_portchk_interval = SH_PORTCHK_INTERVAL;
	130
[328]	131	static int sh_portchk_minport = -1;
	132	static int sh_portchk_maxport = -1;
	133
[295]	134	struct sh_port {
	135	int port;
	136	struct sh_sockaddr * paddr;
	137	struct sh_port * next;
	138	};
[67]	139
[295]	140	static struct sh_port * blacklist_tcp = NULL;
	141	static struct sh_port * blacklist_udp = NULL;
	142
[149]	143	SH_MUTEX_STATIC(mutex_port_check, PTHREAD_MUTEX_INITIALIZER);
	144
[67]	145	static int sh_portchk_severity = SH_ERR_SEVERE;
[180]	146
[295]	147	extern char * sh_port2proc_query(int proto, struct sh_sockaddr * saddr, int sport,
[206]	148	unsigned long * pid, char * user, size_t userlen);
[180]	149	extern int sh_port2proc_prepare();
[235]	150	extern void sh_port2proc_finish();
[180]	151
[67]	152	#endif
	153
[127]	154	/* Exported interface to add ignoreable ports as 'iface:portlist'
	155	*/
	156	static int sh_portchk_add_ignore (const char * str);
	157
[67]	158	/* Exported interface to add required ports as 'iface:portlist'
	159	*/
	160	static int sh_portchk_add_required (const char * str);
	161
	162	/* Exported interface to add optional ports as 'iface:portlist'
	163	*/
	164	static int sh_portchk_add_optional (const char * str);
	165
[149]	166	/* Exported interface to add blacklisted ports as 'iface:portlist'
	167	*/
	168	static int sh_portchk_add_blacklist (const char * str);
	169
[67]	170	/* Exported interface to add an ethernet interface
	171	*/
	172	static int sh_portchk_add_interface (const char * str);
	173
[149]	174	/* verify whether port/interface is blacklisted (do not check)
	175	*/
[295]	176	static int sh_portchk_is_blacklisted(int port, struct sh_sockaddr * haddr, int proto);
[67]	177
	178	#ifndef TEST_ONLY
	179
	180	static int sh_portchk_set_interval (const char * c)
	181	{
	182	int retval = 0;
	183	long val;
	184
	185	SL_ENTER(_("sh_portchk_set_interval"));
	186	val = strtol (c, (char **)NULL, 10);
	187	if (val <= 0)
	188	{
[149]	189	SH_MUTEX_LOCK(mutex_thread_nolog);
[67]	190	sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
	191	_("port check interval"), c);
[149]	192	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]	193	retval = -1;
	194	}
	195
	196	sh_portchk_interval = (time_t) val;
	197	SL_RETURN(0, _("sh_portchk_set_interval"));
	198	}
	199
[328]	200	static int sh_portchk_set_port_minmax (const char * c, int * setthis)
	201	{
	202	int retval = 0;
	203	long val;
[67]	204
[328]	205	SL_ENTER(_("sh_portchk_set_port_minmax"));
	206	val = strtol (c, (char **)NULL, 10);
	207	if (val < 0 \|\| val > 65535)
	208	{
	209	SH_MUTEX_LOCK(mutex_thread_nolog);
	210	sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
	211	_("port check port minmax"), c);
	212	SH_MUTEX_UNLOCK(mutex_thread_nolog);
	213	retval = -1;
	214	}
	215
	216	*setthis = (int) val;
	217	SL_RETURN(0, _("sh_portchk_set_port_minmax"));
	218	}
	219
	220
	221	static int sh_portchk_set_minport (const char * str)
	222	{
	223	return sh_portchk_set_port_minmax (str, &sh_portchk_minport);
	224	}
	225
	226	static int sh_portchk_set_maxport (const char * str)
	227	{
	228	return sh_portchk_set_port_minmax (str, &sh_portchk_maxport);
	229	}
	230
[67]	231	static int sh_portchk_set_active (const char * str)
	232	{
	233	return sh_util_flagval(str, &sh_portchk_active);
	234	}
	235
	236	static int sh_portchk_set_udp (const char * str)
	237	{
	238	return sh_util_flagval(str, &sh_portchk_check_udp);
	239	}
	240
	241	static int sh_portchk_set_severity (const char * str)
	242	{
	243	char tmp[32];
	244	tmp[0] = '='; tmp[1] = '\0';
	245	sl_strlcat (tmp, str, 32);
	246	return sh_error_set_level (tmp, &sh_portchk_severity);
	247	}
	248
	249	sh_rconf sh_portchk_table[] = {
	250	{
	251	N_("severityportcheck"),
	252	sh_portchk_set_severity,
	253	},
	254	{
	255	N_("portcheckrequired"),
	256	sh_portchk_add_required,
	257	},
	258	{
	259	N_("portcheckoptional"),
	260	sh_portchk_add_optional,
	261	},
	262	{
[127]	263	N_("portcheckignore"),
	264	sh_portchk_add_ignore,
	265	},
	266	{
[149]	267	N_("portcheckskip"),
	268	sh_portchk_add_blacklist,
	269	},
	270	{
[67]	271	N_("portcheckactive"),
	272	sh_portchk_set_active,
	273	},
	274	{
	275	N_("portcheckinterface"),
	276	sh_portchk_add_interface,
	277	},
	278	{
	279	N_("portcheckinterval"),
	280	sh_portchk_set_interval,
	281	},
	282	{
[328]	283	N_("portcheckminport"),
	284	sh_portchk_set_minport,
	285	},
	286	{
	287	N_("portcheckmaxport"),
	288	sh_portchk_set_maxport,
	289	},
	290	{
[67]	291	N_("portcheckudp"),
	292	sh_portchk_set_udp,
	293	},
	294	{
	295	NULL,
	296	NULL
	297	}
	298	};
	299
	300	#endif
	301
	302	/* Interface to initialize port check
	303	*/
[170]	304	int sh_portchk_init (struct mod_type * arg);
[67]	305
	306	/* Interface to reset port check
	307	*/
[170]	308	int sh_portchk_reset (void);
[67]	309
	310	/* Interface to run port check
	311	*/
[170]	312	int sh_portchk_check (void);
[67]	313
	314
[149]	315	static char * check_services (int port, int proto);
[67]	316
	317	#ifdef TEST_ONLY
	318
	319	static int portchk_debug = 0;
	320	#define SH_ALLOC malloc
	321	#define SH_FREE free
	322	#define sh_util_strdup strdup
	323	#define sl_strlcpy strncpy
	324	#define _(a) a
	325
	326	#else
	327
	328	static int portchk_debug = 0;
	329
	330	#endif
	331
[290]	332	#ifdef HAVE_RPC_RPC_H
[218]	333	static char * sh_getrpcbynumber (int number, char * buf, size_t len)
	334	{
	335	FILE * fp;
	336
	337	if (NULL != (fp = fopen(_("/etc/rpc"), "r")))
	338	{
	339	sh_string * s = sh_string_new(0);
	340	while (0 < sh_string_read(s, fp, 1024))
	341	{
	342	char * p = sh_string_str(s);
	343	while (p && (p == ' ' \|\| p == '\t')) ++p; / skip whitespace */
	344	if (p == '\0' \|\| p == '#')
	345	continue; /* skip comment */
	346	else
	347	{
	348	size_t lengths[3];
	349	unsigned int fields = 3;
	350	char * q = sh_string_str(s);
	351	char ** splits = split_array_ws(q, &fields, lengths);
	352
	353	if (fields >= 2)
	354	{
	355	int n = atoi(splits[1]);
	356	if (n == number)
	357	{
	358	sl_strlcpy(buf, splits[0], len);
	359	SH_FREE(splits);
	360	sh_string_destroy(&s);
[252]	361	sl_fclose(FIL__, __LINE__, fp);
[218]	362	return buf;
	363	}
	364	}
	365	SH_FREE(splits);
	366	}
	367	}
	368	sh_string_destroy(&s);
[252]	369	sl_fclose(FIL__, __LINE__, fp);
[218]	370	}
	371	return NULL;
	372	}
[290]	373	#endif
[218]	374
	375	static char * sh_getservbyport (int port, const char * proto_in, char * buf, size_t len)
	376	{
	377	FILE * fp;
	378	char proto[8];
	379
	380	sl_strlcpy(proto, proto_in, sizeof(proto));
	381
	382	if (NULL != (fp = fopen(_("/etc/services"), "r")))
	383	{
	384	sh_string * s = sh_string_new(0);
	385	while (0 < sh_string_read(s, fp, 1024))
	386	{
	387	char * p = sh_string_str(s);
	388	while (p && (p == ' ' \|\| p == '\t')) ++p; / skip whitespace */
	389	if (p == '\0' \|\| p == '#')
	390	continue; /* skip comment */
	391	else
	392	{
	393	size_t lengths[3];
	394	unsigned int fields = 3;
	395	char * q = sh_string_str(s);
	396	char ** splits = split_array_ws(q, &fields, lengths);
	397
	398	if (fields >= 2)
	399	{
	400	char * end;
	401	long n = strtol(splits[1], &end, 10);
	402	if (n == port && end && (end == '/' \|\| end == ','))
	403	{
	404	++end;
	405	if (0 == strcmp(end, proto))
	406	{
	407	sl_strlcpy(buf, splits[0], len);
	408	SH_FREE(splits);
	409	sh_string_destroy(&s);
[252]	410	sl_fclose(FIL__, __LINE__, fp);
[218]	411	return buf;
	412	}
	413	}
	414	}
	415	SH_FREE(splits);
	416	}
	417	}
	418	sh_string_destroy(&s);
[252]	419	sl_fclose(FIL__, __LINE__, fp);
[218]	420	}
	421	return NULL;
	422	}
	423
[149]	424	static void sh_portchk_add_to_list (int proto,
[295]	425	int port, struct sh_sockaddr * paddr,
[218]	426	char * service,
[67]	427	int flag, int status)
	428	{
	429	struct sh_portentry * new = SH_ALLOC (sizeof(struct sh_portentry));
	430
	431	if (portchk_debug)
	432	fprintf(stderr, _("add to list: port %d/%s %d %d (%s)\n"),
[149]	433	port, SH_PROTO_STR(proto), flag, status, service ? service : _("undef"));
[67]	434
	435	new->port = port;
[295]	436	sh_ipvx_ntoa(new->interface, SH_INTERFACE_SIZE, paddr);
[67]	437	new->status = status;
	438	new->flag = flag;
	439
	440	new->error = NULL;
	441
	442	if (service)
	443	new->service = sh_util_strdup (service);
	444	else
	445	new->service = NULL;
[149]	446	if (proto == IPPROTO_TCP)
[67]	447	{
	448	new->next = portlist_tcp;
	449	portlist_tcp = new;
	450	}
	451	else
	452	{
	453	new->next = portlist_udp;
	454	portlist_udp = new;
	455	}
	456	return;
	457	}
	458
	459	/* Reset the list by setting all entries to UNKN.
	460	* In the next cycle we will check, and set found ports to ISOK.
	461	* Thereafter, we check for entries that are still UNKN.
	462	*/
[170]	463	static void sh_portchk_reset_lists (void)
[67]	464	{
	465	struct sh_portentry * portlist;
	466
	467	portlist = portlist_tcp;
	468	while (portlist)
	469	{
	470	if (portlist->status != SH_PORT_MISS)
	471	portlist->status = SH_PORT_UNKN;
	472	portlist = portlist->next;
	473	}
	474	portlist = portlist_udp;
	475	while (portlist)
	476	{
	477	if (portlist->status != SH_PORT_MISS)
	478	portlist->status = SH_PORT_UNKN;
	479	portlist = portlist->next;
	480	}
	481	return;
	482	}
	483
	484	static struct sh_portentry * sh_portchk_kill_list (struct sh_portentry * head)
	485	{
	486	if (head)
	487	{
	488	if (head->next)
	489	sh_portchk_kill_list (head->next);
	490
	491	if (head->service)
	492	SH_FREE(head->service);
	493	SH_FREE(head);
	494	}
	495	return NULL;
	496	}
	497
[149]	498	static struct sh_port * sh_portchk_kill_blacklist (struct sh_port * head)
	499	{
	500	if (head)
	501	{
	502	if (head->next)
	503	sh_portchk_kill_blacklist (head->next);
	504
[295]	505	SH_FREE(head->paddr);
[149]	506	SH_FREE(head);
	507	}
	508	return NULL;
	509	}
	510
[170]	511	/* These variables are not used anywhere. They only exist
	512	* to assign &pre, &ptr to them, which keeps gcc from
	513	* putting it into a register, and avoids the 'clobbered
	514	* by longjmp' warning. And no, 'volatile' proved insufficient.
	515	*/
	516	static void * sh_dummy_pre = NULL;
	517	static void * sh_dummy_ptr = NULL;
	518
[67]	519	/* check the list of open ports for any that are marked as UNKN
	520	*/
[149]	521	static void sh_portchk_check_list (struct sh_portentry ** head, int proto, int report)
[67]	522	{
	523	struct sh_portentry * ptr = *head;
	524	struct sh_portentry * pre = *head;
	525	char errbuf[256];
	526
[170]	527	/* Take the address to keep gcc from putting them into registers.
	528	* Avoids the 'clobbered by longjmp' warning.
	529	*/
	530	sh_dummy_pre = (void*) &pre;
	531	sh_dummy_ptr = (void*) &ptr;
	532
[67]	533	while (ptr)
	534	{
	535	if (portchk_debug && report)
	536	fprintf(stderr, _("check list: port %d/%s %d %d\n"),
[149]	537	ptr->port, SH_PROTO_STR(proto), ptr->flag, ptr->status);
[67]	538
	539	if (ptr->status == SH_PORT_UNKN)
	540	{
	541	/* Don't report missing ports that are marked as optional
	542	*/
[127]	543	if (ptr->flag != SH_PORT_OPT && ptr->flag != SH_PORT_IGN)
[67]	544	{
[169]	545	snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
[149]	546	ptr->interface, ptr->port, SH_PROTO_STR(proto),
[67]	547	ptr->service ? ptr->service : check_services(ptr->port, proto));
	548	#ifdef TEST_ONLY
	549	if (report == SH_PORT_REPORT)
	550	fprintf(stderr, _("%s\n"), errbuf);
	551	#else
	552	if (report == SH_PORT_REPORT)
[149]	553	{
	554	SH_MUTEX_LOCK(mutex_thread_nolog);
	555	sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
[169]	556	MSG_PORT_MISS, errbuf);
[149]	557	SH_MUTEX_UNLOCK(mutex_thread_nolog);
	558	}
[67]	559	#endif
	560	}
	561
	562	ptr->status = SH_PORT_MISS;
	563
[128]	564	if ((ptr->flag != SH_PORT_REQ) && (ptr->flag != SH_PORT_OPT) && (ptr->flag != SH_PORT_IGN))
[67]	565	{
	566	if (portchk_debug && report)
	567	fprintf(stderr, _("removing: port %d/%s %d %d\n"),
[149]	568	ptr->port, SH_PROTO_STR(proto), ptr->flag, ptr->status);
[67]	569
	570	if (ptr == *head)
	571	{
	572	*head = ptr->next;
	573	if (ptr->service)
	574	SH_FREE(ptr->service);
	575	SH_FREE(ptr);
	576	ptr = *head;
	577	pre = *head;
	578	continue;
	579	}
	580	else if (ptr->next == NULL)
	581	{
	582	pre->next = NULL;
	583	if (ptr->service)
	584	SH_FREE(ptr->service);
	585	SH_FREE(ptr);
	586	return;
	587	}
	588	else
	589	{
	590	pre->next = ptr->next;
	591	if (ptr->service)
	592	SH_FREE(ptr->service);
	593	SH_FREE(ptr);
	594	ptr = pre->next;
	595	continue;
	596	}
	597	}
	598	}
	599	pre = ptr;
	600	ptr = ptr->next;
	601	}
	602	return;
	603	}
	604
	605
[149]	606	static struct sh_portentry * sh_portchk_get_from_list (int proto, int port,
[295]	607	struct sh_sockaddr * paddr, char * service)
[67]	608	{
	609	struct sh_portentry * portlist;
[295]	610	char str_addr[SH_IP_BUF];
[75]	611
[149]	612	if (proto == IPPROTO_TCP)
[67]	613	portlist = portlist_tcp;
	614	else
	615	portlist = portlist_udp;
	616
[295]	617	sh_ipvx_ntoa(str_addr, sizeof(str_addr), paddr);
	618
[67]	619	if (service)
	620	{
	621	while (portlist)
	622	{
	623	if (portlist->service &&
	624	0 == strcmp(service, portlist->service) &&
[295]	625	( 0 == strcmp(portlist->interface, str_addr) \|\|
	626	sh_ipvx_isany(paddr) ))
[67]	627	return portlist;
	628	portlist = portlist->next;
	629	}
	630	}
	631	else
	632	{
	633	while (portlist)
	634	{
	635	if (port == portlist->port &&
[295]	636	(0 == strcmp(portlist->interface, str_addr) \|\|
	637	sh_ipvx_isany(paddr) ))
[67]	638	return portlist;
	639	portlist = portlist->next;
	640	}
	641	}
	642	return NULL;
	643	}
	644
	645
[295]	646	static void sh_portchk_cmp_to_list (int proto, int port, struct sh_sockaddr * paddr, char * service)
[67]	647	{
	648	struct sh_portentry * portent;
	649	char errbuf[256];
	650
	651
[295]	652	portent = sh_portchk_get_from_list (proto, port, paddr, service);
[67]	653
	654	if (service)
	655	{
	656	if (!portent)
	657	{
[180]	658	char * path;
[206]	659	unsigned long qpid;
[180]	660	char user[USER_MAX];
[295]	661	char saddr[SH_IP_BUF];
[180]	662
[295]	663	sh_ipvx_ntoa(saddr, sizeof(saddr), paddr);
	664
[169]	665	snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
[295]	666	saddr, port, SH_PROTO_STR(proto), service);
[67]	667	#ifdef TEST_ONLY
	668	fprintf(stderr, _("open port: %s:%d/%s (%s)\n"),
[295]	669	saddr, port, SH_PROTO_STR(proto), service);
[67]	670	#else
[295]	671	path = sh_port2proc_query(proto, paddr, port, &qpid, user, sizeof(user));
[149]	672	SH_MUTEX_LOCK(mutex_thread_nolog);
[67]	673	sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
[206]	674	MSG_PORT_NEW, errbuf, path, qpid, user);
[149]	675	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[180]	676	SH_FREE(path);
[67]	677	#endif
	678	/*
	679	* was not there, thus it is not in 'required' or 'optional' list
	680	*/
[295]	681	sh_portchk_add_to_list (proto, port, paddr, service, SH_PORT_NOT, SH_PORT_ISOK);
[67]	682	}
[127]	683	else if (portent->status == SH_PORT_MISS && portent->flag != SH_PORT_IGN)
[67]	684	{
[180]	685	char * path;
[206]	686	unsigned long qpid;
[180]	687	char user[USER_MAX];
[295]	688	char saddr[SH_IP_BUF];
[180]	689
[295]	690	sh_ipvx_ntoa(saddr, sizeof(saddr), paddr);
	691
[169]	692	snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s), was %d/%s"),
[295]	693	saddr, port, SH_PROTO_STR(proto), service, portent->port, SH_PROTO_STR(proto));
[67]	694	#ifdef TEST_ONLY
	695	fprintf(stderr, _("service: %s\n"), errbuf);
	696	#else
[295]	697	path = sh_port2proc_query(proto, paddr, port, &qpid, user, sizeof(user));
[149]	698	SH_MUTEX_LOCK(mutex_thread_nolog);
[67]	699	sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
[206]	700	MSG_PORT_RESTART, errbuf, path, qpid, user);
[149]	701	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[180]	702	SH_FREE(path);
[67]	703	#endif
	704
	705	portent->status = SH_PORT_ISOK;
	706	}
	707	else if (port != portent->port && (-1) != portent->port)
	708	{
[180]	709	char * path;
[206]	710	unsigned long qpid;
[180]	711	char user[USER_MAX];
[295]	712	char saddr[SH_IP_BUF];
[180]	713
[295]	714	sh_ipvx_ntoa(saddr, sizeof(saddr), paddr);
	715
[169]	716	snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s), was %d/%s"),
[295]	717	saddr, port, SH_PROTO_STR(proto), service, portent->port, SH_PROTO_STR(proto));
[67]	718	#ifdef TEST_ONLY
	719	fprintf(stderr, _("service: %s\n"), errbuf);
	720	#else
[295]	721	path = sh_port2proc_query(proto, paddr, port, &qpid, user, sizeof(user));
[149]	722	SH_MUTEX_LOCK(mutex_thread_nolog);
[67]	723	sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
[206]	724	MSG_PORT_NEWPORT, errbuf, path, qpid, user);
[149]	725	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[180]	726	SH_FREE(path);
[67]	727	#endif
[127]	728	portent->port = port;
[67]	729	portent->status = SH_PORT_ISOK;
	730	}
	731	else
	732	{
	733	portent->status = SH_PORT_ISOK;
	734	}
	735	}
	736	else
	737	{
	738	if (!portent)
	739	{
[180]	740	char * path;
[206]	741	unsigned long qpid;
[180]	742	char user[USER_MAX];
[295]	743	char saddr[SH_IP_BUF];
[180]	744
[295]	745	sh_ipvx_ntoa(saddr, sizeof(saddr), paddr);
	746
[169]	747	snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
[295]	748	saddr, port, SH_PROTO_STR(proto), check_services(port, proto));
[67]	749	#ifdef TEST_ONLY
	750	fprintf(stderr, _("open port: %s:%d/%s (%s)\n"),
[295]	751	saddr, port, SH_PROTO_STR(proto), check_services(port, proto));
[67]	752	#else
[295]	753	path = sh_port2proc_query(proto, paddr, port, &qpid, user, sizeof(user));
[149]	754	SH_MUTEX_LOCK(mutex_thread_nolog);
[67]	755	sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
[206]	756	MSG_PORT_NEW, errbuf, path, qpid, user);
[149]	757	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[180]	758	SH_FREE(path);
[67]	759	#endif
	760
	761	/* was not there, thus it is not in 'required' or 'optional' list
	762	*/
[295]	763	sh_portchk_add_to_list (proto, port, paddr, service, SH_PORT_NOT, SH_PORT_ISOK);
[67]	764	}
[127]	765	else if (portent->status == SH_PORT_MISS && portent->flag != SH_PORT_IGN)
[67]	766	{
[180]	767	char * path;
[206]	768	unsigned long qpid;
[180]	769	char user[USER_MAX];
[295]	770	char saddr[SH_IP_BUF];
[180]	771
[295]	772	sh_ipvx_ntoa(saddr, sizeof(saddr), paddr);
	773
[169]	774	snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
[295]	775	saddr, port, SH_PROTO_STR(proto), check_services(port, proto));
[67]	776	#ifdef TEST_ONLY
	777	fprintf(stderr, _("port : %s\n"), errbuf);
	778	#else
[295]	779	path = sh_port2proc_query(proto, paddr, port, &qpid, user, sizeof(user));
[149]	780	SH_MUTEX_LOCK(mutex_thread_nolog);
[67]	781	sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
[206]	782	MSG_PORT_RESTART, errbuf, path, qpid, user);
[149]	783	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[180]	784	SH_FREE(path);
[67]	785	#endif
	786
	787	portent->status = SH_PORT_ISOK;
	788	}
	789	else
	790	{
	791	portent->status = SH_PORT_ISOK;
	792	}
	793	}
	794
	795	return;
	796	}
	797
	798
	799	/* Returns a static buffer containing the name of the service
	800	* running on port <port> (from /etc/services)
	801	* Returns NULL on failure
	802	*/
[149]	803	static char * check_services (int port, int proto)
[67]	804	{
	805	static char buf[256];
[218]	806	char * service = sh_getservbyport(port, SH_PROTO_STR(proto), buf, sizeof(buf));
[67]	807
[218]	808	if (!service)
[67]	809	{
[210]	810	snprintf (buf, sizeof(buf), "%s",_("unknown"));
[67]	811	}
	812	return buf;
	813	}
	814
	815	/* Returns a static buffer containing the name of the service
	816	* running on port <port> at <address> (from portmap daemon)
	817	* Returns NULL on failure
	818	*/
	819	static char * check_rpc_list (int port, struct sockaddr_in * address,
	820	unsigned long prot)
	821	{
[290]	822	#ifdef HAVE_RPC_RPC_H
[67]	823	struct pmaplist * head;
[218]	824	char *r;
[67]	825	static char buf[256];
	826
	827	head = pmap_getmaps(address);
	828
	829	if (head)
	830	{
	831	do /* while (head != NULL) */
	832	{
	833	if ((head->pml_map.pm_prot == prot) &&
	834	(port == (int)head->pml_map.pm_port))
	835	{
[218]	836	r = sh_getrpcbynumber((int)head->pml_map.pm_prog,
	837	buf, sizeof(buf));
	838	if (r)
[67]	839	{
	840	return buf;
	841	}
	842	else
	843	{
	844	snprintf (buf, sizeof(buf), "RPC_%lu",
	845	(unsigned long)head->pml_map.pm_prog);
	846	return buf;
	847	}
	848	}
	849	head = head->pml_next;
	850	}
	851	while (head != NULL);
	852	}
[290]	853	#else
	854	(void) port;
	855	(void) address;
	856	(void) prot;
	857	#endif
[67]	858	return NULL;
	859	}
	860
[295]	861	static int check_port_udp_internal (int fd, int port, struct sh_sockaddr * paddr)
[67]	862	{
	863	int retval;
[295]	864	char * p = NULL;
[67]	865	char buf[8];
[78]	866	#ifndef TEST_ONLY
	867	char errmsg[256];
	868	int nerr;
	869	#endif
[132]	870	char errbuf[SH_ERRBUF_SIZE];
[295]	871	char ipbuf[SH_IP_BUF];
[67]	872
[295]	873	sh_ipvx_set_port(paddr, port);
[67]	874
[78]	875	do {
[295]	876	retval = connect(fd, sh_ipvx_sockaddr_cast(paddr), SH_SSP_LEN(paddr));
[171]	877	} while (retval < 0 && (errno == EINTR \|\| errno == EINPROGRESS));
[78]	878
[67]	879	if (retval == -1)
	880	{
	881	#ifdef TEST_ONLY
	882	if (portchk_debug)
	883	perror(_("connect"));
	884	#else
[295]	885	sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), paddr);
	886
[78]	887	nerr = errno;
	888	sl_snprintf(errmsg, sizeof(errmsg), _("check port: %5d/udp on %15s: %s"),
[295]	889	port, ipbuf, sh_error_message(errno, errbuf, sizeof(errbuf)));
[149]	890	SH_MUTEX_LOCK(mutex_thread_nolog);
[78]	891	sh_error_handle((-1), FIL__, __LINE__, nerr, MSG_E_SUBGEN,
	892	errmsg, _("connect"));
[149]	893	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]	894	#endif
	895	}
	896	else
	897	{
[78]	898	do {
	899	retval = send (fd, buf, 0, 0);
	900	} while (retval < 0 && errno == EINTR);
[67]	901
	902	if (retval == -1 && errno == ECONNREFUSED)
	903	{
[295]	904	sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), paddr);
[67]	905	if (portchk_debug)
	906	fprintf(stderr, _("check port: %5d/udp on %15s established/time_wait\n"),
[295]	907	port, ipbuf);
[67]	908	}
	909	else
	910	{
[78]	911	/* Only the second send() may catch the error
	912	*/
	913	do {
	914	retval = send (fd, buf, 0, 0);
	915	} while (retval < 0 && errno == EINTR);
	916
[67]	917	if (retval == -1 && errno == ECONNREFUSED)
	918	{
[295]	919	sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), paddr);
[67]	920	if (portchk_debug)
	921	fprintf(stderr, _("check port: %5d/udp on %15s established/time_wait\n"),
[295]	922	port, ipbuf);
[67]	923	}
	924	else if (retval != -1)
	925	{
	926	/* Try to get service name from portmap
	927	*/
[295]	928	if (paddr->ss_family == AF_INET)
	929	{
	930	p = check_rpc_list (port, (struct sockaddr_in *) sh_ipvx_sockaddr_cast(paddr), IPPROTO_UDP);
	931	}
[67]	932
[295]	933	sh_portchk_cmp_to_list (IPPROTO_UDP, port, paddr, p ? p : NULL);
[67]	934
	935	/* If not an RPC service, try to get name from /etc/services
	936	*/
	937	if (!p)
[149]	938	p = check_services(port, IPPROTO_UDP);
[67]	939
	940	if (portchk_debug)
[295]	941	{
	942	sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), paddr);
	943	fprintf(stderr, _("check port: %5d/udp on %15s open %s\n"),
	944	port, ipbuf, p);
	945	}
[67]	946
	947	}
	948	}
	949	}
[252]	950	sl_close_fd (FIL__, __LINE__, fd);
[67]	951	return 0;
	952	}
	953
[295]	954	static int check_port_tcp_internal (int fd, int port, struct sh_sockaddr * paddr)
[67]	955	{
	956	int retval;
[109]	957	int flags;
[295]	958	char * p = NULL;
[78]	959	#ifndef TEST_ONLY
	960	char errmsg[256];
	961	int nerr;
	962	#endif
[132]	963	char errbuf[SH_ERRBUF_SIZE];
[295]	964	char ipbuf[SH_IP_BUF];
[67]	965
[295]	966	sh_ipvx_set_port(paddr, port);
[67]	967
[78]	968	do {
[295]	969	retval = connect(fd, sh_ipvx_sockaddr_cast(paddr), SH_SSP_LEN(paddr));
[171]	970	} while (retval < 0 && (errno == EINTR \|\| errno == EINPROGRESS));
[78]	971
[67]	972	if (retval == -1 && errno == ECONNREFUSED)
	973	{
	974	if (portchk_debug)
[295]	975	{
	976	sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), paddr);
	977	fprintf(stderr, _("check port: %5d on %15s established/time_wait\n"),
	978	port, ipbuf);
	979	}
[67]	980	}
	981	else if (retval == -1)
	982	{
	983	#ifdef TEST_ONLY
	984	if (portchk_debug)
	985	perror(_("connect"));
	986	#else
[295]	987	sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), paddr);
[78]	988	nerr = errno;
	989	sl_snprintf(errmsg, sizeof(errmsg), _("check port: %5d/tcp on %15s: %s"),
[295]	990	port, ipbuf, sh_error_message(errno, errbuf, sizeof(errbuf)));
[149]	991	SH_MUTEX_LOCK(mutex_thread_nolog);
[78]	992	sh_error_handle((-1), FIL__, __LINE__, nerr, MSG_E_SUBGEN,
	993	errmsg, _("connect"));
[149]	994	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]	995	#endif
	996	}
	997	else
	998	{
	999	/* Try to get service name from portmap
	1000	*/
[295]	1001	if (paddr->ss_family == AF_INET)
	1002	{
	1003	p = check_rpc_list (port, (struct sockaddr_in *) sh_ipvx_sockaddr_cast(paddr), IPPROTO_TCP);
	1004	}
[67]	1005
[295]	1006	sh_portchk_cmp_to_list (IPPROTO_TCP, port, paddr, p ? p : NULL);
[67]	1007
	1008	/* If not an RPC service, try to get name from /etc/services
	1009	*/
	1010	if (!p)
[149]	1011	p = check_services(port, IPPROTO_TCP);
[67]	1012
	1013	if (portchk_debug)
[295]	1014	{
	1015	sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), paddr);
	1016	fprintf(stderr, _("check port: %5d on %15s open %s\n"),
	1017	port, ipbuf, p);
	1018	}
[109]	1019
	1020	#if !defined(O_NONBLOCK)
	1021	#if defined(O_NDELAY)
	1022	#define O_NONBLOCK O_NDELAY
	1023	#else
	1024	#define O_NONBLOCK 0
	1025	#endif
	1026	#endif
	1027
	1028	/* prepare to close connection gracefully
	1029	*/
	1030	if (port == 22) /* ssh */
	1031	{
	1032	flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
	1033	retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags \| O_NONBLOCK);
[170]	1034	retval = write (fd, _("SSH-2.0-Foobar"), 14);
	1035	if (retval > 0) retval = write (fd, "\r\n", 2);
[109]	1036	}
	1037	else if (port == 25) /* smtp */
	1038	{
	1039	flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
	1040	retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags \| O_NONBLOCK);
[170]	1041	retval = write (fd, _("QUIT"), 4);
	1042	if (retval > 0) retval = write (fd, "\r\n", 2);
[109]	1043	}
	1044	else if (port == 79) /* finger */
	1045	{
	1046	flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
	1047	retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags \| O_NONBLOCK);
[170]	1048	retval = write (fd, "\r\n", 2);
[109]	1049	}
	1050	else if (port == 110) /* pop3 */
	1051	{
	1052	flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
	1053	retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags \| O_NONBLOCK);
[170]	1054	retval = write (fd, _("QUIT"), 4);
	1055	if (retval > 0) retval = write (fd, "\r\n", 2);
[109]	1056	}
	1057	else if (port == 143) /* imap */
	1058	{
	1059	flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
	1060	retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags \| O_NONBLOCK);
[170]	1061	retval = write (fd, _("A01 LOGOUT"), 10);
	1062	if (retval > 0) retval = write (fd, "\r\n", 2);
[109]	1063	}
[170]	1064
	1065	if (portchk_debug && retval < 0)
	1066	fprintf(stderr, _("check port: error writing to port %5d\n"),
	1067	port);
[67]	1068	}
[252]	1069	sl_close_fd (FIL__, __LINE__, fd);
[67]	1070	return 0;
	1071	}
	1072
	1073	/* typedef uint32_t in_addr_t;
	1074	* struct in_addr
	1075	* {
	1076	* in_addr_t s_addr;
	1077	* };
	1078	*/
	1079
	1080	#define SH_IFACE_MAX 16
	1081
	1082	struct portchk_interfaces {
[295]	1083	struct sh_sockaddr iface[SH_IFACE_MAX];
[67]	1084	int used;
	1085	};
	1086
	1087	static struct portchk_interfaces iface_list;
	1088	static int iface_initialized = 0;
	1089
	1090	#ifdef TEST_ONLY
	1091	static char * portchk_hostname = NULL;
	1092	#else
	1093	static char * portchk_hostname = sh.host.name;
	1094	#endif
	1095
[149]	1096	static int sh_portchk_init_internal (void)
[67]	1097	{
[170]	1098	volatile int i; /* might be clobbered by âlongjmpâ or âvforkâ*/
[67]	1099	char errbuf[256];
[295]	1100	#if defined(USE_IPVX)
	1101	struct addrinfo hints;
	1102	struct addrinfo *res;
	1103	#else
	1104	struct hostent * hent;
	1105	#endif
	1106	char ipbuf[SH_IP_BUF];
[67]	1107
	1108	if (portchk_debug)
	1109	fprintf(stderr, _("checking ports on: %s\n"), portchk_hostname ? portchk_hostname : _("NULL"));
[78]	1110
[67]	1111	if (!portchk_hostname)
	1112	return -1;
	1113
[78]	1114	if (sh_portchk_active == S_FALSE)
	1115	return -1;
	1116
[149]	1117	SH_MUTEX_LOCK(mutex_port_check);
[67]	1118	if (iface_initialized == 0)
	1119	{
	1120	iface_list.used = 0;
	1121	iface_initialized = 1;
	1122	}
[295]	1123
	1124	#if !defined(USE_IPVX)
[134]	1125	SH_MUTEX_LOCK(mutex_resolv);
[162]	1126	hent = sh_gethostbyname(portchk_hostname);
[170]	1127	i = 0;
[67]	1128	while (hent && hent->h_addr_list[i] && (iface_list.used < SH_IFACE_MAX))
	1129	{
[295]	1130	struct sockaddr_in sin;
	1131
	1132	memcpy(&(sin.sin_addr.s_addr), hent->h_addr_list[i], sizeof(in_addr_t));
	1133	sh_ipvx_save(&(iface_list.iface[iface_list.used]),
	1134	AF_INET, (struct sockaddr *)&sin);
[134]	1135	++iface_list.used;
	1136	++i;
	1137	}
	1138	SH_MUTEX_UNLOCK(mutex_resolv);
[295]	1139	#else
	1140	memset(&hints, '\0', sizeof(hints));
	1141	hints.ai_family = PF_UNSPEC;
	1142	hints.ai_flags = AI_ADDRCONFIG;
[134]	1143
[295]	1144	if (0 == getaddrinfo(portchk_hostname, NULL, &hints, &res))
	1145	{
	1146	struct addrinfo *p = res;
	1147
	1148	while ((p != NULL) && (iface_list.used < SH_IFACE_MAX))
	1149	{
	1150	sh_ipvx_save(&(iface_list.iface[iface_list.used]),
	1151	p->ai_family, p->ai_addr);
	1152	++iface_list.used;
	1153	p = p->ai_next;
	1154	}
	1155	freeaddrinfo(res);
	1156	}
	1157	#endif
	1158
[134]	1159	for (i = 0; i < iface_list.used; ++i)
	1160	{
[295]	1161	sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), &(iface_list.iface[i]));
	1162	sl_snprintf(errbuf, sizeof(errbuf), _("interface: %s"), ipbuf);
	1163
[149]	1164	SH_MUTEX_LOCK(mutex_thread_nolog);
[67]	1165	sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
	1166	errbuf, _("sh_portchk_init"));
[149]	1167	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]	1168	}
[149]	1169	SH_MUTEX_UNLOCK(mutex_port_check);
[67]	1170
	1171	return 0;
	1172	}
	1173
[149]	1174	int sh_portchk_init (struct mod_type * arg)
	1175	{
[210]	1176	#ifndef HAVE_PTHREAD
	1177	(void) arg;
	1178	#endif
	1179
[149]	1180	if (sh_portchk_active == S_FALSE)
	1181	return SH_MOD_FAILED;
	1182	if (!portchk_hostname)
	1183	return SH_MOD_FAILED;
	1184
	1185	#ifdef HAVE_PTHREAD
	1186	if (arg != NULL && arg->initval < 0 &&
	1187	(sh.flag.isdaemon == S_TRUE \|\| sh.flag.loop == S_TRUE))
	1188	{
	1189	if (0 == sh_pthread_create(sh_threaded_module_run, (void *)arg))
	1190	return SH_MOD_THREAD;
	1191	else
	1192	return SH_MOD_FAILED;
	1193	}
	1194	#endif
	1195	return sh_portchk_init_internal();
	1196	}
	1197
	1198
	1199
[67]	1200	#if !defined(TEST_ONLY)
[170]	1201	int sh_portchk_reconf (void)
[67]	1202	{
[149]	1203	SH_MUTEX_LOCK(mutex_port_check);
[78]	1204	iface_initialized = 0;
	1205	sh_portchk_active = 1;
[80]	1206	sh_portchk_check_udp = 1;
[149]	1207	sh_portchk_interval = SH_PORTCHK_INTERVAL;
[78]	1208
[328]	1209	sh_portchk_minport = -1;
	1210	sh_portchk_maxport = -1;
	1211
[67]	1212	portlist_udp = sh_portchk_kill_list (portlist_udp);
	1213	portlist_tcp = sh_portchk_kill_list (portlist_tcp);
[149]	1214
	1215	blacklist_udp = sh_portchk_kill_blacklist (blacklist_udp);
	1216	blacklist_tcp = sh_portchk_kill_blacklist (blacklist_tcp);
[235]	1217	sh_port2proc_finish();
	1218
[149]	1219	SH_MUTEX_UNLOCK(mutex_port_check);
[67]	1220	return 0;
	1221	}
	1222
[170]	1223	int sh_portchk_cleanup (void)
[67]	1224	{
	1225	return sh_portchk_reconf ();
	1226	}
	1227
	1228	int sh_portchk_timer (time_t tcurrent)
	1229	{
	1230	static time_t lastcheck = 0;
	1231
	1232	SL_ENTER(_("sh_portchk_timer"));
	1233	if ((time_t) (tcurrent - lastcheck) >= sh_portchk_interval)
	1234	{
	1235	lastcheck = tcurrent;
	1236	SL_RETURN((-1), _("sh_portchk_timer"));
	1237	}
	1238	SL_RETURN(0, _("sh_portchk_timer"));
	1239	}
	1240	#endif
	1241
[295]	1242	static int check_port_generic (int port, int domain, int type, int protocol)
[67]	1243	{
[170]	1244	volatile int i = 0;
[67]	1245	int sock = -1;
	1246	int flag = 1; /* non-zero to enable an option */
[295]	1247	struct sh_sockaddr paddr;
[132]	1248	char errbuf[SH_ERRBUF_SIZE];
	1249
[67]	1250	/* Check all interfaces for this host
	1251	*/
	1252	while (i < iface_list.used)
	1253	{
[295]	1254	memcpy(&paddr, &(iface_list.iface[i]), sizeof(paddr));
[149]	1255
[295]	1256	if (paddr.ss_family != domain)
[149]	1257	{
[295]	1258	++i;
	1259	continue;
[149]	1260	}
	1261
[295]	1262	if (0 != sh_portchk_is_blacklisted(port, &paddr, protocol))
[67]	1263	{
[295]	1264	++i;
	1265	continue;
	1266	}
	1267
	1268	if ((sock = socket(paddr.ss_family, type, protocol)) < 0 )
	1269	{
[170]	1270	++i;
[67]	1271	#ifdef TEST_ONLY
	1272	if (portchk_debug)
	1273	perror(_("socket"));
	1274	#else
[149]	1275	SH_MUTEX_LOCK(mutex_thread_nolog);
[67]	1276	sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
[132]	1277	sh_error_message(errno, errbuf, sizeof(errbuf)), _("socket"));
[149]	1278	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[170]	1279	#endif
[149]	1280	continue;
[67]	1281	}
	1282	if ( setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
	1283	(void *) &flag, sizeof(flag)) < 0 )
	1284	{
[170]	1285	++i;
[67]	1286	#ifdef TEST_ONLY
	1287	if (portchk_debug)
	1288	perror(_("setsockopt"));
	1289	#else
[149]	1290	SH_MUTEX_LOCK(mutex_thread_nolog);
[67]	1291	sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
[132]	1292	sh_error_message(errno, errbuf, sizeof(errbuf)),_("setsockopt"));
[149]	1293	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]	1294	#endif
[149]	1295	continue;
[67]	1296	}
	1297
	1298
	1299	if (protocol == IPPROTO_TCP)
[295]	1300	check_port_tcp_internal(sock, port, &paddr);
[67]	1301	else
[295]	1302	check_port_udp_internal(sock, port, &paddr);
[67]	1303
	1304	++i;
	1305	}
	1306
	1307	return 0;
	1308	}
	1309
	1310
	1311
[295]	1312	static int check_port_udp (int port, int domain)
[67]	1313	{
[295]	1314	return check_port_generic(port, domain, SOCK_DGRAM, IPPROTO_UDP);
[67]	1315	}
	1316
[295]	1317	static int check_port_tcp (int port, int domain)
[67]	1318	{
[295]	1319	return check_port_generic(port, domain, SOCK_STREAM, IPPROTO_TCP);
[67]	1320	}
	1321
	1322
[295]	1323	static int sh_portchk_scan_ports_generic (int min_port, int max_port_arg,
	1324	int domain, int type, int protocol)
[67]	1325	{
	1326	/*
	1327	int min_port = 1024;
	1328	int max_port = 65535;
	1329	*/
	1330
[170]	1331	volatile int port; /* might be clobbered by âlongjmpâ or âvforkâ*/
	1332	volatile int max_port = max_port_arg;
[67]	1333	int retval;
	1334	int sock = -1;
	1335	int flag = 1; /* non-zero to enable an option */
	1336
[295]	1337	struct sockaddr_in addr4;
	1338	struct sockaddr_in6 addr6;
	1339
	1340	int addrlen4 = sizeof(addr4);
	1341	int addrlen6 = sizeof(addr6);
	1342
	1343	struct in6_addr anyaddr = IN6ADDR_ANY_INIT;
	1344
[132]	1345	char errbuf[SH_ERRBUF_SIZE];
[67]	1346
	1347	if (min_port == -1)
	1348	min_port = 0;
	1349	if (max_port == -1)
	1350	max_port = 65535;
	1351
	1352	for (port = min_port; port <= max_port; ++port)
	1353	{
[295]	1354	if ((sock = socket(domain, type, protocol)) < 0 )
[67]	1355	{
	1356	#ifdef TEST_ONLY
	1357	if (portchk_debug)
	1358	perror(_("socket"));
	1359	#else
[149]	1360	SH_MUTEX_LOCK(mutex_thread_nolog);
[67]	1361	sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
[132]	1362	sh_error_message(errno, errbuf, sizeof(errbuf)), _("socket"));
[149]	1363	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]	1364	#endif
[149]	1365	continue;
[67]	1366	}
	1367	if ( setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
	1368	(void *) &flag, sizeof(flag)) < 0 )
	1369	{
	1370	#ifdef TEST_ONLY
	1371	if (portchk_debug)
	1372	perror(_("setsockopt"));
	1373	#else
[149]	1374	SH_MUTEX_LOCK(mutex_thread_nolog);
[67]	1375	sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
[132]	1376	sh_error_message(errno, errbuf, sizeof(errbuf)),_("setsockopt"));
[149]	1377	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]	1378	#endif
[149]	1379	continue;
[67]	1380	}
	1381
[295]	1382	if (domain == AF_INET)
	1383	{
	1384	addr4.sin_family = AF_INET;
	1385	addr4.sin_port = htons(port);
	1386	addr4.sin_addr.s_addr = INADDR_ANY;
	1387	retval = bind (sock, (struct sockaddr *) &addr4, addrlen4);
	1388	}
	1389	else
	1390	{
	1391	addr6.sin6_family = AF_INET6;
	1392	addr6.sin6_port = htons(port);
	1393	memcpy(&(addr6.sin6_addr.s6_addr), &anyaddr, sizeof(anyaddr));
	1394	retval = bind (sock, (struct sockaddr *) &addr6, addrlen6);
	1395	}
[67]	1396
	1397	if (retval == 0)
	1398	{
	1399	/* we can bind the port, thus it is unused
	1400	*/
[252]	1401	sl_close_fd (FIL__, __LINE__, sock);
[67]	1402	}
	1403	else
	1404	{
	1405	if (errno == EINVAL \|\| errno == EADDRINUSE)
	1406	{
	1407	/* try to connect to the port
	1408	*/
	1409	if (protocol == IPPROTO_TCP)
[295]	1410	check_port_tcp(port, domain);
[67]	1411	else
[295]	1412	check_port_udp(port, domain);
[67]	1413	}
	1414	else
	1415	{
	1416	#ifdef TEST_ONLY
	1417	if (portchk_debug)
	1418	perror(_("bind"));
	1419	#else
[149]	1420	SH_MUTEX_LOCK(mutex_thread_nolog);
[67]	1421	sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
[132]	1422	sh_error_message(errno, errbuf, sizeof(errbuf)), _("bind"));
[149]	1423	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]	1424	#endif
	1425	}
[252]	1426	sl_close_fd (FIL__, __LINE__, sock);
[67]	1427	}
	1428	}
	1429	return 0;
	1430	}
	1431
	1432	static int sh_portchk_scan_ports_tcp (int min_port, int max_port)
	1433	{
[295]	1434	#if defined(USE_IPVX)
	1435	sh_portchk_scan_ports_generic (min_port, max_port, AF_INET6,
	1436	SOCK_STREAM, IPPROTO_TCP);
	1437	#endif
	1438	return sh_portchk_scan_ports_generic (min_port, max_port, AF_INET,
	1439	SOCK_STREAM, IPPROTO_TCP);
[67]	1440	}
	1441
	1442	static int sh_portchk_scan_ports_udp (int min_port, int max_port)
	1443	{
[295]	1444	#if defined(USE_IPVX)
	1445	sh_portchk_scan_ports_generic (min_port, max_port, AF_INET6,
	1446	SOCK_DGRAM, IPPROTO_UDP);
	1447	#endif
	1448	return sh_portchk_scan_ports_generic (min_port, max_port, AF_INET,
	1449	SOCK_DGRAM, IPPROTO_UDP);
[67]	1450	}
	1451
	1452	/* Subroutine to add an interface
	1453	*/
[212]	1454	static void * sh_dummy_str = NULL; /* fix clobbered by.. warning */
	1455
[67]	1456	static int sh_portchk_add_interface (const char * str)
	1457	{
[295]	1458	struct sh_sockaddr saddr;
[67]	1459	char errbuf[256];
[212]	1460	char buf[64];
[67]	1461
[212]	1462	sh_dummy_str = (void*) &str;
	1463
[67]	1464	if (iface_initialized == 0)
	1465	{
	1466	iface_list.used = 0;
	1467	iface_initialized = 1;
	1468	}
	1469
[212]	1470	do {
[67]	1471
[212]	1472	while (str == ',' \|\| str == ' ' \|\| *str == '\t') ++str;
[67]	1473
[212]	1474	if (*str)
	1475	{
[295]	1476	char ipbuf[SH_IP_BUF];
[212]	1477	unsigned int i = 0;
[295]	1478	while (*str && i < (sizeof(buf)-1) &&
	1479	str != ',' && str != ' ' && *str != '\t')
[212]	1480	{
	1481	buf[i] = *str; ++str; ++i;
	1482	}
	1483	buf[i] = '\0';
[67]	1484
[295]	1485	if (0 == sh_ipvx_aton(buf, &saddr))
[212]	1486	return -1;
[67]	1487
[212]	1488	if (iface_list.used == SH_IFACE_MAX)
	1489	return -1;
	1490
[295]	1491	sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), &saddr);
	1492	sl_snprintf(errbuf, sizeof(errbuf), _("interface: %s"), ipbuf);
[212]	1493	SH_MUTEX_LOCK(mutex_thread_nolog);
	1494	sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
	1495	errbuf, _("sh_portchk_add_interface"));
	1496	SH_MUTEX_UNLOCK(mutex_thread_nolog);
	1497
[295]	1498	memcpy (&(iface_list.iface[iface_list.used]), &(saddr), sizeof(saddr));
[212]	1499	++iface_list.used;
	1500	}
	1501	} while (*str);
	1502
[67]	1503	return 0;
	1504	}
	1505
[149]	1506	/* verify whether port/interface is blacklisted (do not check)
	1507	*/
[295]	1508	static int sh_portchk_is_blacklisted(int port, struct sh_sockaddr * saddr,
	1509	int proto)
[149]	1510	{
	1511	struct sh_port * head;
	1512
	1513	if (proto == IPPROTO_TCP)
	1514	head = blacklist_tcp;
	1515	else
	1516	head = blacklist_udp;
	1517
	1518	while (head)
	1519	{
	1520	if (head->port == port)
	1521	{
[295]	1522	if (sh_ipvx_isany(head->paddr) \|\|
	1523	0 == sh_ipvx_cmp(head->paddr, saddr))
[149]	1524	return 1;
	1525	else
	1526	return 0;
	1527	}
	1528	head = head->next;
	1529	}
	1530	return 0;
	1531	}
	1532
	1533
[295]	1534	static int sh_portchk_blacklist(int port, struct sh_sockaddr * saddr, int proto)
[149]	1535	{
	1536	struct sh_port * black;
	1537	struct sh_port * head;
	1538
	1539	if (proto == IPPROTO_TCP)
	1540	head = blacklist_tcp;
	1541	else
	1542	head = blacklist_udp;
	1543
	1544	black = head;
	1545
	1546	while (black)
	1547	{
[295]	1548	if (black->port == port &&
	1549	0 == sh_ipvx_cmp(head->paddr, saddr))
[149]	1550	return -1;
	1551	black = black->next;
	1552	}
[295]	1553
[149]	1554	black = SH_ALLOC (sizeof(struct sh_port));
[295]	1555	black->paddr = SH_ALLOC (sizeof(struct sh_sockaddr));
[149]	1556	black->port = port;
[295]	1557	memcpy(black->paddr, saddr, sizeof(struct sh_sockaddr));
[149]	1558	black->next = head;
	1559
	1560	if (proto == IPPROTO_TCP)
	1561	blacklist_tcp = black;
	1562	else
	1563	blacklist_udp = black;
	1564	return 0;
	1565	}
	1566
[67]	1567
	1568	/* Subroutine to add a required or optional port/service
	1569	*/
[295]	1570	static int sh_portchk_add_required_port_generic (char * service,
	1571	char * interface, int type)
[67]	1572	{
	1573	char buf[256];
[149]	1574	int proto;
[67]	1575	char * p;
	1576	char * endptr;
	1577	unsigned long int port;
[295]	1578	struct sh_sockaddr saddr;
[67]	1579	struct sh_portentry * portent;
	1580
[295]	1581	if (0 == sh_ipvx_aton(interface, &saddr))
[67]	1582	return -1;
	1583
	1584	sl_strlcpy (buf, service, sizeof(buf));
	1585
	1586	p = strchr(buf, '/');
	1587	if (!p)
	1588	return -1;
	1589	if (0 == strcmp(p, _("/tcp")))
[149]	1590	proto = IPPROTO_TCP;
	1591	else if (0 == strcmp(p, _("/udp")))
	1592	proto = IPPROTO_UDP;
[67]	1593	else
	1594	return -1;
	1595
	1596	*p = '\0';
	1597	port = strtoul(buf, &endptr, 0);
	1598
[149]	1599	/* Blacklisted ports
	1600	*/
	1601	if (*endptr == '\0' && port <= 65535 && type == SH_PORT_BLACKLIST)
[295]	1602	return (sh_portchk_blacklist(port, &saddr, proto));
[149]	1603
[67]	1604	if (*endptr != '\0')
	1605	{
[295]	1606	portent = sh_portchk_get_from_list (proto, -1, &saddr, buf);
[67]	1607	if (!portent)
[295]	1608	sh_portchk_add_to_list (proto, -1, &saddr, buf, type, SH_PORT_UNKN);
[67]	1609	else
	1610	{
	1611	#ifdef TEST_ONLY
[149]	1612	fprintf(stderr, "** WARNING: duplicate port definition %s/%s\n", buf, SH_PROTO_STR(proto));
[67]	1613	#else
[149]	1614	SH_MUTEX_LOCK(mutex_thread_nolog);
[67]	1615	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
	1616	_("duplicate port definition"), _("sh_portchk_add_required_port_generic"));
[149]	1617	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]	1618	#endif
	1619	return -1;
	1620	}
	1621	}
	1622	else if (port <= 65535)
	1623	{
[295]	1624	portent = sh_portchk_get_from_list (proto, port, &saddr, NULL);
[67]	1625	if (!portent)
[295]	1626	sh_portchk_add_to_list (proto, port, &saddr, NULL, type, SH_PORT_UNKN);
[67]	1627	else
	1628	{
	1629	#ifdef TEST_ONLY
[149]	1630	fprintf(stderr, "** WARNING: duplicate port definition %lu/%s\n", port, SH_PROTO_STR(proto));
[67]	1631	#else
[149]	1632	SH_MUTEX_LOCK(mutex_thread_nolog);
[67]	1633	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
	1634	_("duplicate port definition"), _("sh_portchk_add_required_port_generic"));
[149]	1635	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]	1636	#endif
	1637	return -1;
	1638	}
	1639	}
	1640	else
	1641	return -1;
	1642
	1643	return 0;
	1644	}
	1645
	1646	/* Internal interface to add required or optional ports as 'iface:portlist'
	1647	*/
	1648	static int sh_portchk_add_required_generic (const char * str, int type)
	1649	{
	1650	size_t len;
	1651	size_t ll = 0;
[149]	1652	int status;
[67]	1653
	1654	char * interface = NULL;
	1655	char * list;
	1656	char * p;
[131]	1657	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
	1658	char * saveptr;
	1659	#endif
[67]	1660
	1661	if (!str)
	1662	return -1;
	1663
	1664	if (strchr(str, ':'))
	1665	{
	1666	len = strlen(str);
	1667	for (ll = 0; ll < len; ++ll)
	1668	{
	1669	if (str[ll] == ':' \|\| str[ll] == ' ' \|\| str[ll] == '\t')
	1670	{
	1671	interface = SH_ALLOC(ll+1);
	1672	sl_strlcpy(interface, str, ll+1);
	1673	interface[ll] = '\0';
	1674	while (str[ll] == ':' \|\| str[ll] == ' ' \|\| str[ll] == '\t')
	1675	++ll;
	1676	break;
	1677	}
	1678	}
	1679	}
	1680	else
	1681	{
	1682	interface = SH_ALLOC(8);
	1683	sl_strlcpy(interface, _("0.0.0.0"), 8);
	1684	interface[7] = '\0';
	1685	while (str[ll] == ' ' \|\| str[ll] == '\t')
	1686	++ll;
	1687	}
	1688
	1689	if (!interface)
	1690	return -1;
	1691
	1692	if (str[ll] == '\0')
	1693	{
	1694	SH_FREE(interface);
	1695	return -1;
	1696	}
	1697
	1698	if (portchk_debug)
	1699	fprintf(stderr, "add ports for interface: %s\n", interface);
	1700
	1701	list = sh_util_strdup(&str[ll]);
[131]	1702	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
	1703	p = strtok_r (list, " ,\t", &saveptr);
	1704	#else
[67]	1705	p = strtok (list, " ,\t");
[131]	1706	#endif
[67]	1707	if (!p)
	1708	{
	1709	SH_FREE(interface);
	1710	SH_FREE(list);
	1711	return -1;
	1712	}
	1713	while (p)
	1714	{
[149]	1715	status = sh_portchk_add_required_port_generic (p, interface, type);
	1716
	1717	if (-1 == status)
[67]	1718	{
	1719	SH_FREE(interface);
	1720	SH_FREE(list);
	1721	return -1;
	1722	}
[131]	1723	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
	1724	p = strtok_r (NULL, " ,\t", &saveptr);
	1725	#else
[67]	1726	p = strtok (NULL, " ,\t");
[131]	1727	#endif
[67]	1728	}
	1729	SH_FREE(interface);
	1730	SH_FREE(list);
	1731	return 0;
	1732	}
	1733
	1734	/* User interface to add required ports as 'iface:portlist'
	1735	*/
	1736	static int sh_portchk_add_required (const char * str)
	1737	{
	1738	return sh_portchk_add_required_generic (str, SH_PORT_REQ);
	1739	}
	1740
	1741	/* User interface to add optional ports as 'iface:portlist'
	1742	*/
	1743	static int sh_portchk_add_optional (const char * str)
	1744	{
	1745	return sh_portchk_add_required_generic (str, SH_PORT_OPT);
	1746	}
	1747
[127]	1748	/* User interface to add ignoreable ports as 'iface:portlist'
	1749	*/
	1750	static int sh_portchk_add_ignore (const char * str)
	1751	{
	1752	return sh_portchk_add_required_generic (str, SH_PORT_IGN);
	1753	}
	1754
[149]	1755	/* User interface to add ports that should not be checked as 'iface:portlist'
	1756	*/
	1757	static int sh_portchk_add_blacklist (const char * str)
	1758	{
	1759	return sh_portchk_add_required_generic (str, SH_PORT_BLACKLIST);
	1760	}
	1761
[67]	1762	/* Interface to run port check
	1763	*/
	1764	int sh_portchk_check ()
	1765	{
[170]	1766	volatile int min_port;
[67]	1767
[149]	1768	SH_MUTEX_LOCK(mutex_port_check);
[170]	1769
[328]	1770	min_port = (sh_portchk_minport == -1) ? 0 : sh_portchk_minport;
[170]	1771
[78]	1772	if (sh_portchk_active != S_FALSE)
[67]	1773	{
[253]	1774	sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
	1775	_("Checking for open ports"),
	1776	_("sh_portchk_check"));
	1777
[78]	1778	sh_portchk_reset_lists();
[328]	1779	if ((0 != geteuid()) && (min_port < 1024))
[78]	1780	{
	1781	min_port = 1024;
[67]	1782	#ifdef TEST_ONLY
[78]	1783	fprintf(stderr, "** WARNING not scanning ports < 1024\n");
[67]	1784	#else
[149]	1785	SH_MUTEX_LOCK(mutex_thread_nolog);
[78]	1786	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
[253]	1787	_("not scanning ports below 1024"),
	1788	_("sh_portchk_check"));
[149]	1789	SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]	1790	#endif
[78]	1791	}
[180]	1792
	1793	sh_port2proc_prepare();
	1794
[328]	1795	min_port = (sh_portchk_minport == -1) ? min_port : sh_portchk_minport;
	1796
[78]	1797	if (sh_portchk_check_udp == 1)
[328]	1798	sh_portchk_scan_ports_udp(min_port, sh_portchk_maxport);
	1799	sh_portchk_scan_ports_tcp(min_port, sh_portchk_maxport);
[180]	1800
	1801
[149]	1802	sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_REPORT);
[78]	1803	if (sh_portchk_check_udp == 1)
[149]	1804	sh_portchk_check_list (&portlist_udp, IPPROTO_UDP, SH_PORT_REPORT);
[180]	1805
[67]	1806	}
[149]	1807	SH_MUTEX_UNLOCK(mutex_port_check);
[67]	1808	return 0;
	1809	}
	1810	#endif
	1811
	1812	#ifdef SH_CUTEST
	1813	#include "CuTest.h"
	1814
	1815	void Test_portcheck_lists (CuTest *tc)
	1816	{
[73]	1817	#if defined(SH_USE_PORTCHECK) && (defined(SH_WITH_CLIENT) \|\| defined(SH_STANDALONE))
[295]	1818	struct sh_sockaddr haddr_local;
[67]	1819	struct sh_portentry * portent;
[218]	1820	char buf[256];
	1821	char * p;
[67]	1822
[290]	1823	#ifdef HAVE_RPC_RPC_H
[218]	1824	p = sh_getrpcbynumber(0, buf, sizeof(buf));
	1825	CuAssertTrue(tc, p == NULL);
	1826
	1827	p = sh_getrpcbynumber(100000, buf, sizeof(buf));
	1828	CuAssertPtrNotNull(tc, p);
	1829	CuAssertTrue(tc, (0 == strcmp(p, "portmapper") \|\| 0 == strcmp(p, "rpcbind")));
	1830	CuAssertTrue(tc, (0 == strcmp(buf, "portmapper") \|\| 0 == strcmp(p, "rpcbind")));
	1831
	1832	p = sh_getrpcbynumber(100007, buf, sizeof(buf));
	1833	CuAssertPtrNotNull(tc, p);
	1834	CuAssertTrue(tc, 0 == strcmp(p, "ypbind"));
	1835	CuAssertTrue(tc, 0 == strcmp(buf, "ypbind"));
[290]	1836	#endif
[218]	1837
[300]	1838	p = sh_getservbyport(0, SH_PROTO_STR(IPPROTO_UDP), buf, sizeof(buf));
[218]	1839	CuAssertTrue(tc, p == NULL);
	1840
[290]	1841	#if !defined(HOST_IS_CYGWIN)
[218]	1842	p = sh_getservbyport(22, SH_PROTO_STR(IPPROTO_TCP), buf, sizeof(buf));
	1843	CuAssertPtrNotNull(tc, p);
	1844	CuAssertTrue(tc, 0 == strcmp(p, "ssh"));
	1845	CuAssertTrue(tc, 0 == strcmp(buf, "ssh"));
[290]	1846	#endif
[218]	1847
	1848	p = sh_getservbyport(13, SH_PROTO_STR(IPPROTO_UDP), buf, sizeof(buf));
	1849	CuAssertPtrNotNull(tc, p);
	1850	CuAssertTrue(tc, 0 == strcmp(p, "daytime"));
	1851	CuAssertTrue(tc, 0 == strcmp(buf, "daytime"));
	1852
[295]	1853	CuAssertTrue(tc, 0 != sh_ipvx_aton("127.0.0.1", &haddr_local));
[67]	1854
[295]	1855	sh_portchk_add_to_list (IPPROTO_TCP, 8000, &haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
[67]	1856
[295]	1857	portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, &haddr_local, NULL);
[67]	1858	CuAssertPtrNotNull(tc, portent);
	1859
	1860	CuAssertTrue(tc, portent->port == 8000);
	1861	CuAssertTrue(tc, 0 == strcmp("127.0.0.1", portent->interface));
	1862	CuAssertTrue(tc, portent->status == SH_PORT_UNKN);
	1863	CuAssertTrue(tc, portent->flag == SH_PORT_NOT);
	1864
[149]	1865	sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_NOREPT);
[67]	1866
	1867	CuAssertTrue(tc, NULL == portlist_tcp);
	1868
[295]	1869	sh_portchk_add_to_list (IPPROTO_TCP, 8000, &haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
	1870	sh_portchk_add_to_list (IPPROTO_TCP, 8001, &haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
	1871	sh_portchk_add_to_list (IPPROTO_TCP, 8002, &haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
	1872	sh_portchk_add_to_list (IPPROTO_TCP, 8003, &haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
	1873	sh_portchk_add_to_list (IPPROTO_TCP, 8004, &haddr_local, NULL, SH_PORT_IGN, SH_PORT_UNKN);
	1874	sh_portchk_add_to_list (IPPROTO_TCP, -1, &haddr_local, "foo1", SH_PORT_NOT, SH_PORT_UNKN);
	1875	sh_portchk_add_to_list (IPPROTO_TCP, -1, &haddr_local, "foo2", SH_PORT_REQ, SH_PORT_UNKN);
	1876	sh_portchk_add_to_list (IPPROTO_TCP, -1, &haddr_local, "foo3", SH_PORT_NOT, SH_PORT_UNKN);
	1877	sh_portchk_add_to_list (IPPROTO_TCP, -1, &haddr_local, "foo4", SH_PORT_REQ, SH_PORT_UNKN);
	1878	sh_portchk_add_to_list (IPPROTO_TCP, -1, &haddr_local, "foo5", SH_PORT_IGN, SH_PORT_UNKN);
[67]	1879
[149]	1880	sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_NOREPT);
[67]	1881
	1882	CuAssertPtrNotNull(tc, portlist_tcp);
	1883
[295]	1884	portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, &haddr_local, NULL);
[67]	1885	CuAssertPtrNotNull(tc, portent);
	1886
[295]	1887	portent = sh_portchk_get_from_list(IPPROTO_TCP, 8001, &haddr_local, NULL);
[67]	1888	CuAssertTrue(tc, NULL == portent);
	1889
[295]	1890	portent = sh_portchk_get_from_list(IPPROTO_TCP, 8002, &haddr_local, NULL);
[67]	1891	CuAssertPtrNotNull(tc, portent);
	1892
[295]	1893	portent = sh_portchk_get_from_list(IPPROTO_TCP, 8003, &haddr_local, NULL);
[67]	1894	CuAssertTrue(tc, NULL == portent);
	1895
[295]	1896	portent = sh_portchk_get_from_list(IPPROTO_TCP, 8004, &haddr_local, NULL);
[127]	1897	CuAssertPtrNotNull(tc, portent);
	1898
[295]	1899	portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, &haddr_local, "foo1");
[67]	1900	CuAssertTrue(tc, NULL == portent);
	1901
[295]	1902	portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, &haddr_local, "foo2");
[67]	1903	CuAssertPtrNotNull(tc, portent);
	1904	CuAssertTrue(tc, 0 == strcmp(portent->service, "foo2"));
	1905
[295]	1906	portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, &haddr_local, "foo3");
[67]	1907	CuAssertTrue(tc, NULL == portent);
	1908
[295]	1909	portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, &haddr_local, "foo4");
[67]	1910	CuAssertPtrNotNull(tc, portent);
	1911	CuAssertTrue(tc, 0 == strcmp(portent->service, "foo4"));
[127]	1912
[295]	1913	portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, &haddr_local, "foo5");
[127]	1914	CuAssertPtrNotNull(tc, portent);
	1915	CuAssertTrue(tc, 0 == strcmp(portent->service, "foo5"));
[149]	1916
[295]	1917	CuAssertTrue(tc, 0 == sh_portchk_blacklist(666, &haddr_local, IPPROTO_TCP));
	1918	CuAssertTrue(tc, 0 != sh_portchk_blacklist(666, &haddr_local, IPPROTO_TCP));
	1919	CuAssertTrue(tc, 0 == sh_portchk_blacklist(667, &haddr_local, IPPROTO_TCP));
	1920	CuAssertTrue(tc, 0 == sh_portchk_blacklist(668, &haddr_local, IPPROTO_TCP));
	1921	CuAssertTrue(tc, 0 == sh_portchk_blacklist(666, &haddr_local, IPPROTO_UDP));
	1922	CuAssertTrue(tc, 0 != sh_portchk_blacklist(666, &haddr_local, IPPROTO_UDP));
	1923	CuAssertTrue(tc, 0 == sh_portchk_blacklist(667, &haddr_local, IPPROTO_UDP));
	1924	CuAssertTrue(tc, 0 == sh_portchk_blacklist(668, &haddr_local, IPPROTO_UDP));
[149]	1925
[295]	1926	CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(668, &haddr_local, IPPROTO_UDP));
	1927	CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(667, &haddr_local, IPPROTO_UDP));
	1928	CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(666, &haddr_local, IPPROTO_UDP));
	1929	CuAssertTrue(tc, 0 == sh_portchk_is_blacklisted(665, &haddr_local, IPPROTO_UDP));
[149]	1930
[295]	1931	CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(668, &haddr_local, IPPROTO_TCP));
	1932	CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(667, &haddr_local, IPPROTO_TCP));
	1933	CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(666, &haddr_local, IPPROTO_TCP));
	1934	CuAssertTrue(tc, 0 == sh_portchk_is_blacklisted(665, &haddr_local, IPPROTO_TCP));
[67]	1935	#else
	1936	(void) tc; /* fix compiler warning */
	1937	#endif
	1938	return;
	1939	}
	1940	#endif
	1941
	1942	#ifdef TEST_ONLY
	1943
	1944	void usage (char * pname)
	1945	{
	1946	printf ("%s [-r\|--required interface:portlist][-o\|--optional interface:portlist][--no-udp][-d\|--debug] hostname\n\n", pname);
	1947	printf (" Check local host for open ports; Version %s\n\n", PORTCHK_VERSION);
	1948	printf (" Interface: Numeric address for an interface, e.g. 127.0.0.1\n");
	1949	printf (" Portlist: List of ports or services, e.g. 22/tcp,nfs/udp,nlockmgr/udp\n");
	1950	printf (" required -> must be open\n");
	1951	printf (" optional -> may be open or closed\n");
	1952	printf (" RPC services must be specified with service name, others with port number\n\n");
	1953	printf (" Example:\n");
	1954	printf (" %s --required 192.168.1.2:22/tcp,nfs/udp,nlockmgr/udp\n\n", pname);
	1955	return;
	1956	}
	1957
	1958	int main(int argc, char *argv[])
	1959	{
	1960	char * pname = argv[0];
	1961
	1962
	1963	/*
	1964	test_lists();
	1965
	1966	portlist_tcp = sh_portchk_kill_list (portlist_tcp);
	1967	portlist_udp = sh_portchk_kill_list (portlist_udp);
	1968	*/
	1969
[237]	1970	/* sh_portchk_add_required ("127.0.0.1 : nlockmgr/tcp, 5308/tcp, nfs/tcp"); */
[67]	1971
	1972	while (argc > 1 && argv[1][0] == '-')
	1973	{
	1974	if (0 == strcmp(argv[1], "--help") \|\| 0 == strcmp(argv[1], "-h"))
	1975	{
	1976	usage(pname);
	1977	exit (0);
	1978	}
	1979	else if (0 == strcmp(argv[1], "--required") \|\| 0 == strcmp(argv[1], "-r"))
	1980	{
	1981	if (argc < 3)
	1982	{
	1983	usage(pname);
	1984	exit (1);
	1985	}
	1986	sh_portchk_add_required (argv[2]);
	1987	--argc; ++argv;
	1988	}
	1989	else if (0 == strcmp(argv[1], "--optional") \|\| 0 == strcmp(argv[1], "-o"))
	1990	{
	1991	if (argc < 3)
	1992	{
	1993	usage(pname);
	1994	exit (1);
	1995	}
	1996	sh_portchk_add_optional (argv[2]);
	1997	--argc; ++argv;
	1998	}
	1999	else if (0 == strcmp(argv[1], "--no-udp"))
	2000	{
	2001	sh_portchk_check_udp = 0;
	2002	}
	2003	else if (0 == strcmp(argv[1], "--debug") \|\| 0 == strcmp(argv[1], "-d"))
	2004	{
	2005	portchk_debug = 1;
	2006	}
	2007	else
	2008	{
	2009	usage(pname);
	2010	exit (1);
	2011	}
	2012	--argc; ++argv;
	2013	}
	2014
	2015	if (argc < 2)
	2016	{
	2017	usage(pname);
	2018	exit (1);
	2019	}
	2020
	2021	portchk_hostname = argv[1];
	2022
	2023	if (0 != sh_portchk_init ())
	2024	{
	2025	usage(pname);
	2026	exit (1);
	2027	}
	2028
	2029	sh_portchk_check();
	2030
	2031	return 0;
	2032	}
	2033	#endif

Note: See TracBrowser for help on using the repository browser.

Download in other formats: