source: trunk/src/sh_portcheck.c@ 394

Last change on this file since 394 was 383, checked in by katerina, 13 years ago

Fix for ticket #281 (warnings from clang static analyzer).

  • Property svn:executable set to *
File size: 52.4 KB
RevLine 
[67]1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 2006 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20/***************************************************************************
21 *
22 * This file provides a module for samhain to check for open ports
23 * on the local machine.
24 *
25 */
26
27
28/* #define TEST_ONLY */
29#ifndef TEST_ONLY
30#include "config_xor.h"
31#endif
32
33#include <stdio.h>
34#include <string.h>
35#include <sys/types.h>
36#include <sys/socket.h>
37#include <netinet/in.h>
38#include <arpa/inet.h>
39#include <errno.h>
40#include <unistd.h>
[109]41#include <fcntl.h>
[67]42
[76]43#define PORTCHK_VERSION "1.0"
44
45#if defined(TEST_ONLY) || (defined(SH_USE_PORTCHECK) && (defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)))
46
47
[67]48#define PORTMAP
[290]49#ifdef HAVE_RPC_RPC_H
[67]50#include <rpc/rpc.h>
51#ifdef HAVE_RPC_RPCENT_H
52#include <rpc/rpcent.h>
53#endif
54#include <rpc/pmap_clnt.h>
55#include <rpc/pmap_prot.h>
[290]56#endif
[67]57#include <netdb.h>
58
59/*
60 * struct pmaplist {
61 * struct pmap pml_map;
62 * struct pmaplist *pml_next;
63 * };
64 */
65
66/* struct pmap {
67 * long unsigned pm_prog;
68 * long unsigned pm_vers;
69 * long unsigned pm_prot;
70 * long unsigned pm_port;
71 * };
72 */
73
74/* TIME_WAIT ? 60-240 seconds */
75
[295]76#if !defined(TEST_ONLY)
77
78#define FIL__ _("sh_portcheck.c")
79#include "samhain.h"
80#include "sh_error.h"
81#include "sh_mem.h"
82#include "sh_calls.h"
83#include "sh_utils.h"
84#include "sh_modules.h"
85#define SH_NEED_GETHOSTBYXXX
86#include "sh_static.h"
87#include "sh_pthread.h"
88#include "sh_ipvx.h"
89
[67]90/* the size of an interface string
91 */
[295]92#define SH_INTERFACE_SIZE SH_IP_BUF
[67]93
94#define SH_PORT_NOT 0
95#define SH_PORT_REQ 1
96#define SH_PORT_OPT 2
[127]97#define SH_PORT_IGN 3
[149]98#define SH_PORT_BLACKLIST 4
[67]99
100#define SH_PORT_MISS 0
101#define SH_PORT_ISOK 1
102#define SH_PORT_UNKN 2
103
104#define SH_PORT_NOREPT 0
105#define SH_PORT_REPORT 1
106
[149]107#define SH_PROTO_TCP 0
108#define SH_PROTO_UDP 1
109#define SH_PROTO_STR(a) (((a) == IPPROTO_TCP) ? _("tcp") : _("udp"))
110
[67]111struct sh_portentry {
112 int port;
113 char interface[SH_INTERFACE_SIZE];
114 char * service;
115 char * error;
116 int flag; /* required or not */
117 int status; /* missing or not */
118 struct sh_portentry * next;
119};
120
121static struct sh_portentry * portlist_tcp = NULL;
122static struct sh_portentry * portlist_udp = NULL;
123
[149]124
[67]125#define SH_PORTCHK_INTERVAL 300
126
127static int sh_portchk_check_udp = 1;
128static int sh_portchk_active = 1;
129static int sh_portchk_interval = SH_PORTCHK_INTERVAL;
130
[328]131static int sh_portchk_minport = -1;
132static int sh_portchk_maxport = -1;
133
[295]134struct sh_port {
135 int port;
136 struct sh_sockaddr * paddr;
137 struct sh_port * next;
138};
[67]139
[295]140static struct sh_port * blacklist_tcp = NULL;
141static struct sh_port * blacklist_udp = NULL;
142
[149]143SH_MUTEX_STATIC(mutex_port_check, PTHREAD_MUTEX_INITIALIZER);
144
[67]145static int sh_portchk_severity = SH_ERR_SEVERE;
[180]146
[295]147extern char * sh_port2proc_query(int proto, struct sh_sockaddr * saddr, int sport,
[206]148 unsigned long * pid, char * user, size_t userlen);
[180]149extern int sh_port2proc_prepare();
[235]150extern void sh_port2proc_finish();
[180]151
[67]152#endif
153
[127]154/* Exported interface to add ignoreable ports as 'iface:portlist'
155 */
156static int sh_portchk_add_ignore (const char * str);
157
[67]158/* Exported interface to add required ports as 'iface:portlist'
159 */
160static int sh_portchk_add_required (const char * str);
161
162/* Exported interface to add optional ports as 'iface:portlist'
163 */
164static int sh_portchk_add_optional (const char * str);
165
[149]166/* Exported interface to add blacklisted ports as 'iface:portlist'
167 */
168static int sh_portchk_add_blacklist (const char * str);
169
[67]170/* Exported interface to add an ethernet interface
171 */
172static int sh_portchk_add_interface (const char * str);
173
[149]174/* verify whether port/interface is blacklisted (do not check)
175 */
[295]176static int sh_portchk_is_blacklisted(int port, struct sh_sockaddr * haddr, int proto);
[67]177
178#ifndef TEST_ONLY
179
180static int sh_portchk_set_interval (const char * c)
181{
182 int retval = 0;
183 long val;
184
185 SL_ENTER(_("sh_portchk_set_interval"));
186 val = strtol (c, (char **)NULL, 10);
187 if (val <= 0)
188 {
[149]189 SH_MUTEX_LOCK(mutex_thread_nolog);
[67]190 sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
191 _("port check interval"), c);
[149]192 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]193 retval = -1;
194 }
[362]195 else
196 {
197 sh_portchk_interval = (time_t) val;
198 }
199 SL_RETURN(retval, _("sh_portchk_set_interval"));
[67]200}
201
[328]202static int sh_portchk_set_port_minmax (const char * c, int * setthis)
203{
204 int retval = 0;
205 long val;
[67]206
[328]207 SL_ENTER(_("sh_portchk_set_port_minmax"));
208 val = strtol (c, (char **)NULL, 10);
209 if (val < 0 || val > 65535)
210 {
211 SH_MUTEX_LOCK(mutex_thread_nolog);
212 sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
213 _("port check port minmax"), c);
214 SH_MUTEX_UNLOCK(mutex_thread_nolog);
215 retval = -1;
216 }
[362]217 else
218 {
219 *setthis = (int) val;
220 }
221 SL_RETURN(retval, _("sh_portchk_set_port_minmax"));
[328]222}
223
224
225static int sh_portchk_set_minport (const char * str)
226{
227 return sh_portchk_set_port_minmax (str, &sh_portchk_minport);
228}
229
230static int sh_portchk_set_maxport (const char * str)
231{
232 return sh_portchk_set_port_minmax (str, &sh_portchk_maxport);
233}
234
[67]235static int sh_portchk_set_active (const char * str)
236{
237 return sh_util_flagval(str, &sh_portchk_active);
238}
239
240static int sh_portchk_set_udp (const char * str)
241{
242 return sh_util_flagval(str, &sh_portchk_check_udp);
243}
244
245static int sh_portchk_set_severity (const char * str)
246{
247 char tmp[32];
248 tmp[0] = '='; tmp[1] = '\0';
249 sl_strlcat (tmp, str, 32);
250 return sh_error_set_level (tmp, &sh_portchk_severity);
251}
252
253sh_rconf sh_portchk_table[] = {
254 {
255 N_("severityportcheck"),
256 sh_portchk_set_severity,
257 },
258 {
259 N_("portcheckrequired"),
260 sh_portchk_add_required,
261 },
262 {
263 N_("portcheckoptional"),
264 sh_portchk_add_optional,
265 },
266 {
[127]267 N_("portcheckignore"),
268 sh_portchk_add_ignore,
269 },
270 {
[149]271 N_("portcheckskip"),
272 sh_portchk_add_blacklist,
273 },
274 {
[67]275 N_("portcheckactive"),
276 sh_portchk_set_active,
277 },
278 {
279 N_("portcheckinterface"),
280 sh_portchk_add_interface,
281 },
282 {
283 N_("portcheckinterval"),
284 sh_portchk_set_interval,
285 },
286 {
[328]287 N_("portcheckminport"),
288 sh_portchk_set_minport,
289 },
290 {
291 N_("portcheckmaxport"),
292 sh_portchk_set_maxport,
293 },
294 {
[67]295 N_("portcheckudp"),
296 sh_portchk_set_udp,
297 },
298 {
299 NULL,
300 NULL
301 }
302};
303
304#endif
305
306/* Interface to initialize port check
307 */
[170]308int sh_portchk_init (struct mod_type * arg);
[67]309
310/* Interface to reset port check
311 */
[170]312int sh_portchk_reset (void);
[67]313
314/* Interface to run port check
315 */
[170]316int sh_portchk_check (void);
[67]317
318
[149]319static char * check_services (int port, int proto);
[67]320
321#ifdef TEST_ONLY
322
[380]323static int portchk_debug = 0;
[67]324#define SH_ALLOC malloc
325#define SH_FREE free
326#define sh_util_strdup strdup
327#define sl_strlcpy strncpy
328#define _(a) a
329
330#else
331
332static int portchk_debug = 0;
333
334#endif
335
[290]336#ifdef HAVE_RPC_RPC_H
[218]337static char * sh_getrpcbynumber (int number, char * buf, size_t len)
338{
339 FILE * fp;
340
341 if (NULL != (fp = fopen(_("/etc/rpc"), "r")))
342 {
343 sh_string * s = sh_string_new(0);
344 while (0 < sh_string_read(s, fp, 1024))
345 {
346 char * p = sh_string_str(s);
347 while (*p && (*p == ' ' || *p == '\t')) ++p; /* skip whitespace */
348 if (*p == '\0' || *p == '#')
349 continue; /* skip comment */
350 else
351 {
352 size_t lengths[3];
353 unsigned int fields = 3;
354 char * q = sh_string_str(s);
355 char ** splits = split_array_ws(q, &fields, lengths);
356
357 if (fields >= 2)
358 {
359 int n = atoi(splits[1]);
360 if (n == number)
361 {
362 sl_strlcpy(buf, splits[0], len);
363 SH_FREE(splits);
364 sh_string_destroy(&s);
[252]365 sl_fclose(FIL__, __LINE__, fp);
[218]366 return buf;
367 }
368 }
369 SH_FREE(splits);
370 }
371 }
372 sh_string_destroy(&s);
[252]373 sl_fclose(FIL__, __LINE__, fp);
[218]374 }
375 return NULL;
376}
[290]377#endif
[218]378
379static char * sh_getservbyport (int port, const char * proto_in, char * buf, size_t len)
380{
381 FILE * fp;
382 char proto[8];
383
384 sl_strlcpy(proto, proto_in, sizeof(proto));
385
386 if (NULL != (fp = fopen(_("/etc/services"), "r")))
387 {
388 sh_string * s = sh_string_new(0);
389 while (0 < sh_string_read(s, fp, 1024))
390 {
391 char * p = sh_string_str(s);
392 while (*p && (*p == ' ' || *p == '\t')) ++p; /* skip whitespace */
393 if (*p == '\0' || *p == '#')
394 continue; /* skip comment */
395 else
396 {
397 size_t lengths[3];
398 unsigned int fields = 3;
399 char * q = sh_string_str(s);
400 char ** splits = split_array_ws(q, &fields, lengths);
401
402 if (fields >= 2)
403 {
404 char * end;
405 long n = strtol(splits[1], &end, 10);
406 if (n == port && end && (*end == '/' || *end == ','))
407 {
408 ++end;
409 if (0 == strcmp(end, proto))
410 {
411 sl_strlcpy(buf, splits[0], len);
412 SH_FREE(splits);
413 sh_string_destroy(&s);
[252]414 sl_fclose(FIL__, __LINE__, fp);
[218]415 return buf;
416 }
417 }
418 }
419 SH_FREE(splits);
420 }
421 }
422 sh_string_destroy(&s);
[252]423 sl_fclose(FIL__, __LINE__, fp);
[218]424 }
425 return NULL;
426}
427
[149]428static void sh_portchk_add_to_list (int proto,
[295]429 int port, struct sh_sockaddr * paddr,
[218]430 char * service,
[67]431 int flag, int status)
432{
433 struct sh_portentry * new = SH_ALLOC (sizeof(struct sh_portentry));
434
435 new->port = port;
[295]436 sh_ipvx_ntoa(new->interface, SH_INTERFACE_SIZE, paddr);
[67]437 new->status = status;
438 new->flag = flag;
439
440 new->error = NULL;
441
[380]442 if (portchk_debug)
443 fprintf(stderr, _("add to list: port %d/%s %d %d (%s) %s\n"),
444 port, SH_PROTO_STR(proto), flag, status, service ? service : _("undef"),
445 new->interface);
446
[67]447 if (service)
448 new->service = sh_util_strdup (service);
449 else
450 new->service = NULL;
[149]451 if (proto == IPPROTO_TCP)
[67]452 {
453 new->next = portlist_tcp;
454 portlist_tcp = new;
455 }
456 else
457 {
458 new->next = portlist_udp;
459 portlist_udp = new;
460 }
461 return;
462}
463
464/* Reset the list by setting all entries to UNKN.
465 * In the next cycle we will check, and set found ports to ISOK.
466 * Thereafter, we check for entries that are still UNKN.
467 */
[170]468static void sh_portchk_reset_lists (void)
[67]469{
470 struct sh_portentry * portlist;
471
472 portlist = portlist_tcp;
473 while (portlist)
474 {
475 if (portlist->status != SH_PORT_MISS)
476 portlist->status = SH_PORT_UNKN;
477 portlist = portlist->next;
478 }
479 portlist = portlist_udp;
480 while (portlist)
481 {
482 if (portlist->status != SH_PORT_MISS)
483 portlist->status = SH_PORT_UNKN;
484 portlist = portlist->next;
485 }
486 return;
487}
488
489static struct sh_portentry * sh_portchk_kill_list (struct sh_portentry * head)
490{
491 if (head)
492 {
493 if (head->next)
494 sh_portchk_kill_list (head->next);
495
496 if (head->service)
497 SH_FREE(head->service);
498 SH_FREE(head);
499 }
500 return NULL;
501}
502
[149]503static struct sh_port * sh_portchk_kill_blacklist (struct sh_port * head)
504{
505 if (head)
506 {
507 if (head->next)
508 sh_portchk_kill_blacklist (head->next);
509
[295]510 SH_FREE(head->paddr);
[149]511 SH_FREE(head);
512 }
513 return NULL;
514}
515
[170]516/* These variables are not used anywhere. They only exist
517 * to assign &pre, &ptr to them, which keeps gcc from
518 * putting it into a register, and avoids the 'clobbered
519 * by longjmp' warning. And no, 'volatile' proved insufficient.
520 */
521static void * sh_dummy_pre = NULL;
522static void * sh_dummy_ptr = NULL;
523
[67]524/* check the list of open ports for any that are marked as UNKN
525 */
[149]526static void sh_portchk_check_list (struct sh_portentry ** head, int proto, int report)
[67]527{
528 struct sh_portentry * ptr = *head;
529 struct sh_portentry * pre = *head;
530 char errbuf[256];
531
[170]532 /* Take the address to keep gcc from putting them into registers.
533 * Avoids the 'clobbered by longjmp' warning.
534 */
535 sh_dummy_pre = (void*) &pre;
536 sh_dummy_ptr = (void*) &ptr;
537
[67]538 while (ptr)
539 {
540 if (portchk_debug && report)
541 fprintf(stderr, _("check list: port %d/%s %d %d\n"),
[149]542 ptr->port, SH_PROTO_STR(proto), ptr->flag, ptr->status);
[67]543
544 if (ptr->status == SH_PORT_UNKN)
545 {
546 /* Don't report missing ports that are marked as optional
547 */
[127]548 if (ptr->flag != SH_PORT_OPT && ptr->flag != SH_PORT_IGN)
[67]549 {
[169]550 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
[149]551 ptr->interface, ptr->port, SH_PROTO_STR(proto),
[67]552 ptr->service ? ptr->service : check_services(ptr->port, proto));
553#ifdef TEST_ONLY
554 if (report == SH_PORT_REPORT)
555 fprintf(stderr, _("%s\n"), errbuf);
556#else
557 if (report == SH_PORT_REPORT)
[149]558 {
559 SH_MUTEX_LOCK(mutex_thread_nolog);
560 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
[169]561 MSG_PORT_MISS, errbuf);
[149]562 SH_MUTEX_UNLOCK(mutex_thread_nolog);
563 }
[67]564#endif
565 }
566
567 ptr->status = SH_PORT_MISS;
568
[128]569 if ((ptr->flag != SH_PORT_REQ) && (ptr->flag != SH_PORT_OPT) && (ptr->flag != SH_PORT_IGN))
[67]570 {
571 if (portchk_debug && report)
572 fprintf(stderr, _("removing: port %d/%s %d %d\n"),
[149]573 ptr->port, SH_PROTO_STR(proto), ptr->flag, ptr->status);
[67]574
575 if (ptr == *head)
576 {
577 *head = ptr->next;
578 if (ptr->service)
579 SH_FREE(ptr->service);
580 SH_FREE(ptr);
581 ptr = *head;
582 pre = *head;
583 continue;
584 }
585 else if (ptr->next == NULL)
586 {
587 pre->next = NULL;
588 if (ptr->service)
589 SH_FREE(ptr->service);
590 SH_FREE(ptr);
591 return;
592 }
593 else
594 {
595 pre->next = ptr->next;
596 if (ptr->service)
597 SH_FREE(ptr->service);
598 SH_FREE(ptr);
599 ptr = pre->next;
600 continue;
601 }
602 }
603 }
604 pre = ptr;
605 ptr = ptr->next;
606 }
[383]607
608 sh_dummy_ptr = NULL;
609 sh_dummy_pre = NULL;
610
[67]611 return;
612}
613
614
[149]615static struct sh_portentry * sh_portchk_get_from_list (int proto, int port,
[295]616 struct sh_sockaddr * paddr, char * service)
[67]617{
618 struct sh_portentry * portlist;
[295]619 char str_addr[SH_IP_BUF];
[75]620
[149]621 if (proto == IPPROTO_TCP)
[67]622 portlist = portlist_tcp;
623 else
624 portlist = portlist_udp;
625
[295]626 sh_ipvx_ntoa(str_addr, sizeof(str_addr), paddr);
627
[67]628 if (service)
629 {
630 while (portlist)
631 {
632 if (portlist->service &&
633 0 == strcmp(service, portlist->service) &&
[295]634 ( 0 == strcmp(portlist->interface, str_addr) ||
635 sh_ipvx_isany(paddr) ))
[67]636 return portlist;
637 portlist = portlist->next;
638 }
639 }
640 else
641 {
642 while (portlist)
643 {
644 if (port == portlist->port &&
[295]645 (0 == strcmp(portlist->interface, str_addr) ||
646 sh_ipvx_isany(paddr) ))
[67]647 return portlist;
648 portlist = portlist->next;
649 }
650 }
651 return NULL;
652}
653
654
[380]655static void sh_portchk_cmp_to_list (int proto, int port,
656 struct sh_sockaddr * paddr, char * service)
[67]657{
658 struct sh_portentry * portent;
659 char errbuf[256];
660
661
[295]662 portent = sh_portchk_get_from_list (proto, port, paddr, service);
[67]663
664 if (service)
665 {
666 if (!portent)
667 {
[180]668 char * path;
[206]669 unsigned long qpid;
[180]670 char user[USER_MAX];
[295]671 char saddr[SH_IP_BUF];
[180]672
[295]673 sh_ipvx_ntoa(saddr, sizeof(saddr), paddr);
674
[169]675 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
[295]676 saddr, port, SH_PROTO_STR(proto), service);
[380]677
678 if (portchk_debug)
679 fprintf(stderr, _("cmp_to_list: open port: %s:%d/%s (%s)\n"),
680 saddr, port, SH_PROTO_STR(proto), service);
681
682#ifndef TEST_ONLY
[295]683 path = sh_port2proc_query(proto, paddr, port, &qpid, user, sizeof(user));
[149]684 SH_MUTEX_LOCK(mutex_thread_nolog);
[67]685 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
[206]686 MSG_PORT_NEW, errbuf, path, qpid, user);
[149]687 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[180]688 SH_FREE(path);
[67]689#endif
690 /*
691 * was not there, thus it is not in 'required' or 'optional' list
692 */
[295]693 sh_portchk_add_to_list (proto, port, paddr, service, SH_PORT_NOT, SH_PORT_ISOK);
[67]694 }
[127]695 else if (portent->status == SH_PORT_MISS && portent->flag != SH_PORT_IGN)
[67]696 {
[180]697 char * path;
[206]698 unsigned long qpid;
[180]699 char user[USER_MAX];
[295]700 char saddr[SH_IP_BUF];
[180]701
[295]702 sh_ipvx_ntoa(saddr, sizeof(saddr), paddr);
703
[169]704 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s), was %d/%s"),
[295]705 saddr, port, SH_PROTO_STR(proto), service, portent->port, SH_PROTO_STR(proto));
[67]706#ifdef TEST_ONLY
707 fprintf(stderr, _("service: %s\n"), errbuf);
708#else
[295]709 path = sh_port2proc_query(proto, paddr, port, &qpid, user, sizeof(user));
[149]710 SH_MUTEX_LOCK(mutex_thread_nolog);
[67]711 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
[206]712 MSG_PORT_RESTART, errbuf, path, qpid, user);
[149]713 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[180]714 SH_FREE(path);
[67]715#endif
716
717 portent->status = SH_PORT_ISOK;
718 }
719 else if (port != portent->port && (-1) != portent->port)
720 {
[180]721 char * path;
[206]722 unsigned long qpid;
[180]723 char user[USER_MAX];
[295]724 char saddr[SH_IP_BUF];
[180]725
[295]726 sh_ipvx_ntoa(saddr, sizeof(saddr), paddr);
727
[169]728 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s), was %d/%s"),
[295]729 saddr, port, SH_PROTO_STR(proto), service, portent->port, SH_PROTO_STR(proto));
[67]730#ifdef TEST_ONLY
731 fprintf(stderr, _("service: %s\n"), errbuf);
732#else
[295]733 path = sh_port2proc_query(proto, paddr, port, &qpid, user, sizeof(user));
[149]734 SH_MUTEX_LOCK(mutex_thread_nolog);
[67]735 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
[206]736 MSG_PORT_NEWPORT, errbuf, path, qpid, user);
[149]737 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[180]738 SH_FREE(path);
[67]739#endif
[127]740 portent->port = port;
[67]741 portent->status = SH_PORT_ISOK;
742 }
743 else
744 {
745 portent->status = SH_PORT_ISOK;
746 }
747 }
748 else
749 {
750 if (!portent)
751 {
[180]752 char * path;
[206]753 unsigned long qpid;
[180]754 char user[USER_MAX];
[295]755 char saddr[SH_IP_BUF];
[180]756
[295]757 sh_ipvx_ntoa(saddr, sizeof(saddr), paddr);
758
[169]759 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
[295]760 saddr, port, SH_PROTO_STR(proto), check_services(port, proto));
[380]761
762 if (portchk_debug)
763 fprintf(stderr, _("cmp_to_list: open port: %s:%d/%s (%s) check_services\n"),
764 saddr, port, SH_PROTO_STR(proto), check_services(port, proto));
765
766#ifndef TEST_ONLY
[295]767 path = sh_port2proc_query(proto, paddr, port, &qpid, user, sizeof(user));
[149]768 SH_MUTEX_LOCK(mutex_thread_nolog);
[67]769 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
[206]770 MSG_PORT_NEW, errbuf, path, qpid, user);
[149]771 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[180]772 SH_FREE(path);
[67]773#endif
774
775 /* was not there, thus it is not in 'required' or 'optional' list
776 */
[295]777 sh_portchk_add_to_list (proto, port, paddr, service, SH_PORT_NOT, SH_PORT_ISOK);
[67]778 }
[127]779 else if (portent->status == SH_PORT_MISS && portent->flag != SH_PORT_IGN)
[67]780 {
[180]781 char * path;
[206]782 unsigned long qpid;
[180]783 char user[USER_MAX];
[295]784 char saddr[SH_IP_BUF];
[180]785
[295]786 sh_ipvx_ntoa(saddr, sizeof(saddr), paddr);
787
[169]788 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
[295]789 saddr, port, SH_PROTO_STR(proto), check_services(port, proto));
[67]790#ifdef TEST_ONLY
791 fprintf(stderr, _("port : %s\n"), errbuf);
792#else
[295]793 path = sh_port2proc_query(proto, paddr, port, &qpid, user, sizeof(user));
[149]794 SH_MUTEX_LOCK(mutex_thread_nolog);
[67]795 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
[206]796 MSG_PORT_RESTART, errbuf, path, qpid, user);
[149]797 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[180]798 SH_FREE(path);
[67]799#endif
800
801 portent->status = SH_PORT_ISOK;
802 }
803 else
804 {
805 portent->status = SH_PORT_ISOK;
806 }
807 }
808
809 return;
810}
811
812
813/* Returns a static buffer containing the name of the service
814 * running on port <port> (from /etc/services)
815 * Returns NULL on failure
816 */
[149]817static char * check_services (int port, int proto)
[67]818{
819 static char buf[256];
[218]820 char * service = sh_getservbyport(port, SH_PROTO_STR(proto), buf, sizeof(buf));
[67]821
[218]822 if (!service)
[67]823 {
[210]824 snprintf (buf, sizeof(buf), "%s",_("unknown"));
[67]825 }
826 return buf;
827}
828
829/* Returns a static buffer containing the name of the service
830 * running on port <port> at <address> (from portmap daemon)
831 * Returns NULL on failure
832 */
833static char * check_rpc_list (int port, struct sockaddr_in * address,
834 unsigned long prot)
835{
[290]836#ifdef HAVE_RPC_RPC_H
[67]837 struct pmaplist * head;
[218]838 char *r;
[67]839 static char buf[256];
840
841 head = pmap_getmaps(address);
842
843 if (head)
844 {
845 do /* while (head != NULL) */
846 {
847 if ((head->pml_map.pm_prot == prot) &&
848 (port == (int)head->pml_map.pm_port))
849 {
[218]850 r = sh_getrpcbynumber((int)head->pml_map.pm_prog,
851 buf, sizeof(buf));
852 if (r)
[67]853 {
854 return buf;
855 }
856 else
857 {
858 snprintf (buf, sizeof(buf), "RPC_%lu",
859 (unsigned long)head->pml_map.pm_prog);
860 return buf;
861 }
862 }
863 head = head->pml_next;
864 }
865 while (head != NULL);
866 }
[290]867#else
868 (void) port;
869 (void) address;
870 (void) prot;
871#endif
[67]872 return NULL;
873}
874
[295]875static int check_port_udp_internal (int fd, int port, struct sh_sockaddr * paddr)
[67]876{
877 int retval;
[295]878 char * p = NULL;
[67]879 char buf[8];
[78]880#ifndef TEST_ONLY
881 char errmsg[256];
882 int nerr;
883#endif
[132]884 char errbuf[SH_ERRBUF_SIZE];
[295]885 char ipbuf[SH_IP_BUF];
[67]886
[295]887 sh_ipvx_set_port(paddr, port);
[67]888
[78]889 do {
[295]890 retval = connect(fd, sh_ipvx_sockaddr_cast(paddr), SH_SSP_LEN(paddr));
[171]891 } while (retval < 0 && (errno == EINTR || errno == EINPROGRESS));
[78]892
[67]893 if (retval == -1)
894 {
895#ifdef TEST_ONLY
896 if (portchk_debug)
897 perror(_("connect"));
898#else
[295]899 sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), paddr);
900
[78]901 nerr = errno;
902 sl_snprintf(errmsg, sizeof(errmsg), _("check port: %5d/udp on %15s: %s"),
[295]903 port, ipbuf, sh_error_message(errno, errbuf, sizeof(errbuf)));
[149]904 SH_MUTEX_LOCK(mutex_thread_nolog);
[78]905 sh_error_handle((-1), FIL__, __LINE__, nerr, MSG_E_SUBGEN,
906 errmsg, _("connect"));
[149]907 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]908#endif
909 }
910 else
911 {
[78]912 do {
913 retval = send (fd, buf, 0, 0);
914 } while (retval < 0 && errno == EINTR);
[67]915
916 if (retval == -1 && errno == ECONNREFUSED)
917 {
[295]918 sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), paddr);
[67]919 if (portchk_debug)
[380]920 fprintf(stderr, _("check port_udp: %5d/udp on %15s established/time_wait\n"),
[295]921 port, ipbuf);
[67]922 }
923 else
924 {
[78]925 /* Only the second send() may catch the error
926 */
927 do {
928 retval = send (fd, buf, 0, 0);
929 } while (retval < 0 && errno == EINTR);
930
[67]931 if (retval == -1 && errno == ECONNREFUSED)
932 {
[295]933 sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), paddr);
[67]934 if (portchk_debug)
935 fprintf(stderr, _("check port: %5d/udp on %15s established/time_wait\n"),
[295]936 port, ipbuf);
[67]937 }
938 else if (retval != -1)
939 {
940 /* Try to get service name from portmap
941 */
[295]942 if (paddr->ss_family == AF_INET)
943 {
[380]944 p = check_rpc_list (port,
945 (struct sockaddr_in *) sh_ipvx_sockaddr_cast(paddr),
946 IPPROTO_UDP);
[295]947 }
[380]948
[295]949 sh_portchk_cmp_to_list (IPPROTO_UDP, port, paddr, p ? p : NULL);
[67]950
951 /* If not an RPC service, try to get name from /etc/services
952 */
953 if (!p)
[149]954 p = check_services(port, IPPROTO_UDP);
[67]955
956 if (portchk_debug)
[295]957 {
958 sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), paddr);
[380]959 fprintf(stderr, _("check port_udp: %5d/udp on %15s open %s\n"),
[295]960 port, ipbuf, p);
961 }
[67]962
963 }
964 }
965 }
[252]966 sl_close_fd (FIL__, __LINE__, fd);
[67]967 return 0;
968}
969
[295]970static int check_port_tcp_internal (int fd, int port, struct sh_sockaddr * paddr)
[67]971{
972 int retval;
[109]973 int flags;
[295]974 char * p = NULL;
[78]975#ifndef TEST_ONLY
976 char errmsg[256];
977 int nerr;
978#endif
[132]979 char errbuf[SH_ERRBUF_SIZE];
[295]980 char ipbuf[SH_IP_BUF];
[67]981
[295]982 sh_ipvx_set_port(paddr, port);
[67]983
[78]984 do {
[295]985 retval = connect(fd, sh_ipvx_sockaddr_cast(paddr), SH_SSP_LEN(paddr));
[171]986 } while (retval < 0 && (errno == EINTR || errno == EINPROGRESS));
[78]987
[67]988 if (retval == -1 && errno == ECONNREFUSED)
989 {
990 if (portchk_debug)
[295]991 {
992 sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), paddr);
[380]993 fprintf(stderr, _("check port_tcp: %5d on %15s established/time_wait\n"),
[295]994 port, ipbuf);
995 }
[67]996 }
997 else if (retval == -1)
998 {
999#ifdef TEST_ONLY
1000 if (portchk_debug)
1001 perror(_("connect"));
1002#else
[295]1003 sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), paddr);
[78]1004 nerr = errno;
1005 sl_snprintf(errmsg, sizeof(errmsg), _("check port: %5d/tcp on %15s: %s"),
[295]1006 port, ipbuf, sh_error_message(errno, errbuf, sizeof(errbuf)));
[149]1007 SH_MUTEX_LOCK(mutex_thread_nolog);
[78]1008 sh_error_handle((-1), FIL__, __LINE__, nerr, MSG_E_SUBGEN,
1009 errmsg, _("connect"));
[149]1010 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]1011#endif
1012 }
1013 else
1014 {
1015 /* Try to get service name from portmap
1016 */
[295]1017 if (paddr->ss_family == AF_INET)
1018 {
[380]1019 p = check_rpc_list (port,
1020 (struct sockaddr_in *) sh_ipvx_sockaddr_cast(paddr),
1021 IPPROTO_TCP);
[295]1022 }
[67]1023
[295]1024 sh_portchk_cmp_to_list (IPPROTO_TCP, port, paddr, p ? p : NULL);
[67]1025
1026 /* If not an RPC service, try to get name from /etc/services
1027 */
1028 if (!p)
[149]1029 p = check_services(port, IPPROTO_TCP);
[67]1030
1031 if (portchk_debug)
[295]1032 {
1033 sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), paddr);
[380]1034 fprintf(stderr, _("check port_tcp: %5d on %15s open %s\n"),
[295]1035 port, ipbuf, p);
1036 }
[109]1037
1038#if !defined(O_NONBLOCK)
1039#if defined(O_NDELAY)
1040#define O_NONBLOCK O_NDELAY
1041#else
1042#define O_NONBLOCK 0
1043#endif
1044#endif
1045
1046 /* prepare to close connection gracefully
1047 */
1048 if (port == 22) /* ssh */
1049 {
1050 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
1051 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
[170]1052 retval = write (fd, _("SSH-2.0-Foobar"), 14);
1053 if (retval > 0) retval = write (fd, "\r\n", 2);
[109]1054 }
1055 else if (port == 25) /* smtp */
1056 {
1057 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
1058 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
[170]1059 retval = write (fd, _("QUIT"), 4);
1060 if (retval > 0) retval = write (fd, "\r\n", 2);
[109]1061 }
1062 else if (port == 79) /* finger */
1063 {
1064 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
1065 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
[170]1066 retval = write (fd, "\r\n", 2);
[109]1067 }
1068 else if (port == 110) /* pop3 */
1069 {
1070 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
1071 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
[170]1072 retval = write (fd, _("QUIT"), 4);
1073 if (retval > 0) retval = write (fd, "\r\n", 2);
[109]1074 }
1075 else if (port == 143) /* imap */
1076 {
1077 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
1078 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
[170]1079 retval = write (fd, _("A01 LOGOUT"), 10);
1080 if (retval > 0) retval = write (fd, "\r\n", 2);
[109]1081 }
[170]1082
1083 if (portchk_debug && retval < 0)
1084 fprintf(stderr, _("check port: error writing to port %5d\n"),
1085 port);
[67]1086 }
[252]1087 sl_close_fd (FIL__, __LINE__, fd);
[67]1088 return 0;
1089}
1090
1091/* typedef uint32_t in_addr_t;
1092 * struct in_addr
1093 * {
1094 * in_addr_t s_addr;
1095 * };
1096 */
1097
1098#define SH_IFACE_MAX 16
1099
1100struct portchk_interfaces {
[295]1101 struct sh_sockaddr iface[SH_IFACE_MAX];
[67]1102 int used;
1103};
1104
1105static struct portchk_interfaces iface_list;
1106static int iface_initialized = 0;
1107
1108#ifdef TEST_ONLY
1109static char * portchk_hostname = NULL;
1110#else
1111static char * portchk_hostname = sh.host.name;
1112#endif
1113
[149]1114static int sh_portchk_init_internal (void)
[67]1115{
[170]1116 volatile int i; /* might be clobbered by ‘longjmp’ or ‘vfork’*/
[67]1117 char errbuf[256];
[295]1118#if defined(USE_IPVX)
1119 struct addrinfo hints;
1120 struct addrinfo *res;
1121#else
1122 struct hostent * hent;
1123#endif
1124 char ipbuf[SH_IP_BUF];
[67]1125
1126 if (portchk_debug)
1127 fprintf(stderr, _("checking ports on: %s\n"), portchk_hostname ? portchk_hostname : _("NULL"));
[78]1128
[67]1129 if (!portchk_hostname)
1130 return -1;
1131
[78]1132 if (sh_portchk_active == S_FALSE)
1133 return -1;
1134
[149]1135 SH_MUTEX_LOCK(mutex_port_check);
[67]1136 if (iface_initialized == 0)
1137 {
1138 iface_list.used = 0;
1139 iface_initialized = 1;
1140 }
[295]1141
1142#if !defined(USE_IPVX)
[134]1143 SH_MUTEX_LOCK(mutex_resolv);
[162]1144 hent = sh_gethostbyname(portchk_hostname);
[170]1145 i = 0;
[67]1146 while (hent && hent->h_addr_list[i] && (iface_list.used < SH_IFACE_MAX))
1147 {
[295]1148 struct sockaddr_in sin;
1149
1150 memcpy(&(sin.sin_addr.s_addr), hent->h_addr_list[i], sizeof(in_addr_t));
1151 sh_ipvx_save(&(iface_list.iface[iface_list.used]),
1152 AF_INET, (struct sockaddr *)&sin);
[380]1153
1154 if (portchk_debug)
1155 {
1156 char buf[256];
1157 sh_ipvx_ntoa(buf, sizeof(buf), &(iface_list.iface[iface_list.used]));
1158 fprintf(stderr, _("interface[%d]: %s\n"), i, buf);
1159 }
[134]1160 ++iface_list.used;
1161 ++i;
1162 }
1163 SH_MUTEX_UNLOCK(mutex_resolv);
[295]1164#else
1165 memset(&hints, '\0', sizeof(hints));
1166 hints.ai_family = PF_UNSPEC;
1167 hints.ai_flags = AI_ADDRCONFIG;
[134]1168
[295]1169 if (0 == getaddrinfo(portchk_hostname, NULL, &hints, &res))
1170 {
1171 struct addrinfo *p = res;
1172
1173 while ((p != NULL) && (iface_list.used < SH_IFACE_MAX))
1174 {
1175 sh_ipvx_save(&(iface_list.iface[iface_list.used]),
1176 p->ai_family, p->ai_addr);
1177 ++iface_list.used;
1178 p = p->ai_next;
1179 }
1180 freeaddrinfo(res);
1181 }
1182#endif
1183
[134]1184 for (i = 0; i < iface_list.used; ++i)
1185 {
[295]1186 sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), &(iface_list.iface[i]));
1187 sl_snprintf(errbuf, sizeof(errbuf), _("interface: %s"), ipbuf);
1188
[149]1189 SH_MUTEX_LOCK(mutex_thread_nolog);
[67]1190 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1191 errbuf, _("sh_portchk_init"));
[149]1192 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]1193 }
[149]1194 SH_MUTEX_UNLOCK(mutex_port_check);
[67]1195
1196 return 0;
1197}
1198
[149]1199int sh_portchk_init (struct mod_type * arg)
1200{
[210]1201#ifndef HAVE_PTHREAD
1202 (void) arg;
1203#endif
1204
[149]1205 if (sh_portchk_active == S_FALSE)
1206 return SH_MOD_FAILED;
1207 if (!portchk_hostname)
1208 return SH_MOD_FAILED;
1209
1210#ifdef HAVE_PTHREAD
1211 if (arg != NULL && arg->initval < 0 &&
1212 (sh.flag.isdaemon == S_TRUE || sh.flag.loop == S_TRUE))
1213 {
1214 if (0 == sh_pthread_create(sh_threaded_module_run, (void *)arg))
1215 return SH_MOD_THREAD;
1216 else
1217 return SH_MOD_FAILED;
1218 }
[335]1219 else if (arg != NULL && arg->initval == SH_MOD_THREAD &&
1220 (sh.flag.isdaemon == S_TRUE || sh.flag.loop == S_TRUE))
1221 {
1222 return SH_MOD_THREAD;
1223 }
[149]1224#endif
1225 return sh_portchk_init_internal();
1226}
1227
1228
1229
[67]1230#if !defined(TEST_ONLY)
[170]1231int sh_portchk_reconf (void)
[67]1232{
[149]1233 SH_MUTEX_LOCK(mutex_port_check);
[78]1234 iface_initialized = 0;
1235 sh_portchk_active = 1;
[80]1236 sh_portchk_check_udp = 1;
[149]1237 sh_portchk_interval = SH_PORTCHK_INTERVAL;
[78]1238
[328]1239 sh_portchk_minport = -1;
1240 sh_portchk_maxport = -1;
1241
[67]1242 portlist_udp = sh_portchk_kill_list (portlist_udp);
1243 portlist_tcp = sh_portchk_kill_list (portlist_tcp);
[149]1244
1245 blacklist_udp = sh_portchk_kill_blacklist (blacklist_udp);
1246 blacklist_tcp = sh_portchk_kill_blacklist (blacklist_tcp);
[235]1247 sh_port2proc_finish();
1248
[149]1249 SH_MUTEX_UNLOCK(mutex_port_check);
[67]1250 return 0;
1251}
1252
[170]1253int sh_portchk_cleanup (void)
[67]1254{
1255 return sh_portchk_reconf ();
1256}
1257
1258int sh_portchk_timer (time_t tcurrent)
1259{
1260 static time_t lastcheck = 0;
1261
1262 SL_ENTER(_("sh_portchk_timer"));
1263 if ((time_t) (tcurrent - lastcheck) >= sh_portchk_interval)
1264 {
1265 lastcheck = tcurrent;
1266 SL_RETURN((-1), _("sh_portchk_timer"));
1267 }
1268 SL_RETURN(0, _("sh_portchk_timer"));
1269}
1270#endif
1271
[295]1272static int check_port_generic (int port, int domain, int type, int protocol)
[67]1273{
[170]1274 volatile int i = 0;
[67]1275 int sock = -1;
1276 int flag = 1; /* non-zero to enable an option */
[295]1277 struct sh_sockaddr paddr;
[132]1278 char errbuf[SH_ERRBUF_SIZE];
1279
[67]1280 /* Check all interfaces for this host
1281 */
1282 while (i < iface_list.used)
1283 {
[295]1284 memcpy(&paddr, &(iface_list.iface[i]), sizeof(paddr));
[149]1285
[295]1286 if (paddr.ss_family != domain)
[149]1287 {
[295]1288 ++i;
1289 continue;
[149]1290 }
1291
[295]1292 if (0 != sh_portchk_is_blacklisted(port, &paddr, protocol))
[67]1293 {
[295]1294 ++i;
1295 continue;
1296 }
1297
1298 if ((sock = socket(paddr.ss_family, type, protocol)) < 0 )
1299 {
[170]1300 ++i;
[67]1301#ifdef TEST_ONLY
1302 if (portchk_debug)
1303 perror(_("socket"));
1304#else
[334]1305
1306#ifndef EPROTONOSUPPORT
1307#define EPROTONOSUPPORT 0
[170]1308#endif
[334]1309#ifndef EAFNOSUPPORT
1310#define EAFNOSUPPORT 0
1311#endif
1312 if (errno != EPROTONOSUPPORT && errno != EAFNOSUPPORT)
1313 {
1314 SH_MUTEX_LOCK(mutex_thread_nolog);
1315 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
1316 sh_error_message(errno, errbuf, sizeof(errbuf)), _("socket"));
1317 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1318 }
1319#endif
[149]1320 continue;
[67]1321 }
1322 if ( setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
1323 (void *) &flag, sizeof(flag)) < 0 )
1324 {
[170]1325 ++i;
[67]1326#ifdef TEST_ONLY
1327 if (portchk_debug)
1328 perror(_("setsockopt"));
1329#else
[149]1330 SH_MUTEX_LOCK(mutex_thread_nolog);
[67]1331 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
[132]1332 sh_error_message(errno, errbuf, sizeof(errbuf)),_("setsockopt"));
[149]1333 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]1334#endif
[149]1335 continue;
[67]1336 }
1337
1338
1339 if (protocol == IPPROTO_TCP)
[295]1340 check_port_tcp_internal(sock, port, &paddr);
[67]1341 else
[295]1342 check_port_udp_internal(sock, port, &paddr);
[67]1343
1344 ++i;
1345 }
1346
1347 return 0;
1348}
1349
1350
1351
[295]1352static int check_port_udp (int port, int domain)
[67]1353{
[295]1354 return check_port_generic(port, domain, SOCK_DGRAM, IPPROTO_UDP);
[67]1355}
1356
[295]1357static int check_port_tcp (int port, int domain)
[67]1358{
[295]1359 return check_port_generic(port, domain, SOCK_STREAM, IPPROTO_TCP);
[67]1360}
1361
1362
[295]1363static int sh_portchk_scan_ports_generic (int min_port, int max_port_arg,
1364 int domain, int type, int protocol)
[67]1365{
1366 /*
1367 int min_port = 1024;
1368 int max_port = 65535;
1369 */
1370
[170]1371 volatile int port; /* might be clobbered by ‘longjmp’ or ‘vfork’*/
1372 volatile int max_port = max_port_arg;
[67]1373 int retval;
1374 int sock = -1;
1375 int flag = 1; /* non-zero to enable an option */
1376
[295]1377 struct sockaddr_in addr4;
1378 struct sockaddr_in6 addr6;
1379
1380 int addrlen4 = sizeof(addr4);
1381 int addrlen6 = sizeof(addr6);
1382
1383 struct in6_addr anyaddr = IN6ADDR_ANY_INIT;
1384
[132]1385 char errbuf[SH_ERRBUF_SIZE];
[67]1386
1387 if (min_port == -1)
1388 min_port = 0;
1389 if (max_port == -1)
1390 max_port = 65535;
1391
1392 for (port = min_port; port <= max_port; ++port)
1393 {
[295]1394 if ((sock = socket(domain, type, protocol)) < 0 )
[67]1395 {
1396#ifdef TEST_ONLY
1397 if (portchk_debug)
1398 perror(_("socket"));
1399#else
[334]1400#ifndef EPROTONOSUPPORT
1401#define EPROTONOSUPPORT 0
[67]1402#endif
[334]1403#ifndef EAFNOSUPPORT
1404#define EAFNOSUPPORT 0
1405#endif
1406 if (errno != EPROTONOSUPPORT && errno != EAFNOSUPPORT)
1407 {
1408 SH_MUTEX_LOCK(mutex_thread_nolog);
1409 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
1410 sh_error_message(errno, errbuf, sizeof(errbuf)), _("socket"));
1411 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1412 }
1413#endif
[149]1414 continue;
[67]1415 }
1416 if ( setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
1417 (void *) &flag, sizeof(flag)) < 0 )
1418 {
1419#ifdef TEST_ONLY
1420 if (portchk_debug)
1421 perror(_("setsockopt"));
1422#else
[149]1423 SH_MUTEX_LOCK(mutex_thread_nolog);
[67]1424 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
[132]1425 sh_error_message(errno, errbuf, sizeof(errbuf)),_("setsockopt"));
[149]1426 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]1427#endif
[149]1428 continue;
[67]1429 }
1430
[295]1431 if (domain == AF_INET)
1432 {
1433 addr4.sin_family = AF_INET;
1434 addr4.sin_port = htons(port);
1435 addr4.sin_addr.s_addr = INADDR_ANY;
1436 retval = bind (sock, (struct sockaddr *) &addr4, addrlen4);
1437 }
1438 else
1439 {
1440 addr6.sin6_family = AF_INET6;
1441 addr6.sin6_port = htons(port);
1442 memcpy(&(addr6.sin6_addr.s6_addr), &anyaddr, sizeof(anyaddr));
1443 retval = bind (sock, (struct sockaddr *) &addr6, addrlen6);
1444 }
[67]1445
1446 if (retval == 0)
1447 {
1448 /* we can bind the port, thus it is unused
1449 */
[252]1450 sl_close_fd (FIL__, __LINE__, sock);
[67]1451 }
1452 else
1453 {
1454 if (errno == EINVAL || errno == EADDRINUSE)
1455 {
1456 /* try to connect to the port
1457 */
1458 if (protocol == IPPROTO_TCP)
[295]1459 check_port_tcp(port, domain);
[67]1460 else
[295]1461 check_port_udp(port, domain);
[67]1462 }
1463 else
1464 {
1465#ifdef TEST_ONLY
1466 if (portchk_debug)
1467 perror(_("bind"));
1468#else
[149]1469 SH_MUTEX_LOCK(mutex_thread_nolog);
[67]1470 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
[132]1471 sh_error_message(errno, errbuf, sizeof(errbuf)), _("bind"));
[149]1472 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]1473#endif
1474 }
[252]1475 sl_close_fd (FIL__, __LINE__, sock);
[67]1476 }
1477 }
1478 return 0;
1479}
1480
1481static int sh_portchk_scan_ports_tcp (int min_port, int max_port)
1482{
[295]1483#if defined(USE_IPVX)
1484 sh_portchk_scan_ports_generic (min_port, max_port, AF_INET6,
1485 SOCK_STREAM, IPPROTO_TCP);
1486#endif
1487 return sh_portchk_scan_ports_generic (min_port, max_port, AF_INET,
1488 SOCK_STREAM, IPPROTO_TCP);
[67]1489}
1490
1491static int sh_portchk_scan_ports_udp (int min_port, int max_port)
1492{
[295]1493#if defined(USE_IPVX)
1494 sh_portchk_scan_ports_generic (min_port, max_port, AF_INET6,
1495 SOCK_DGRAM, IPPROTO_UDP);
1496#endif
1497 return sh_portchk_scan_ports_generic (min_port, max_port, AF_INET,
1498 SOCK_DGRAM, IPPROTO_UDP);
[67]1499}
1500
1501/* Subroutine to add an interface
1502 */
[212]1503static void * sh_dummy_str = NULL; /* fix clobbered by.. warning */
1504
[67]1505static int sh_portchk_add_interface (const char * str)
1506{
[295]1507 struct sh_sockaddr saddr;
[67]1508 char errbuf[256];
[212]1509 char buf[64];
[67]1510
[212]1511 sh_dummy_str = (void*) &str;
1512
[67]1513 if (iface_initialized == 0)
1514 {
1515 iface_list.used = 0;
1516 iface_initialized = 1;
1517 }
1518
[212]1519 do {
[67]1520
[212]1521 while (*str == ',' || *str == ' ' || *str == '\t') ++str;
[67]1522
[212]1523 if (*str)
1524 {
[295]1525 char ipbuf[SH_IP_BUF];
[212]1526 unsigned int i = 0;
[295]1527 while (*str && i < (sizeof(buf)-1) &&
1528 *str != ',' && *str != ' ' && *str != '\t')
[212]1529 {
1530 buf[i] = *str; ++str; ++i;
1531 }
1532 buf[i] = '\0';
[67]1533
[295]1534 if (0 == sh_ipvx_aton(buf, &saddr))
[212]1535 return -1;
[67]1536
[212]1537 if (iface_list.used == SH_IFACE_MAX)
1538 return -1;
1539
[295]1540 sh_ipvx_ntoa(ipbuf, sizeof(ipbuf), &saddr);
1541 sl_snprintf(errbuf, sizeof(errbuf), _("interface: %s"), ipbuf);
[212]1542 SH_MUTEX_LOCK(mutex_thread_nolog);
1543 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1544 errbuf, _("sh_portchk_add_interface"));
1545 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1546
[295]1547 memcpy (&(iface_list.iface[iface_list.used]), &(saddr), sizeof(saddr));
[212]1548 ++iface_list.used;
1549 }
1550 } while (*str);
1551
[383]1552 sh_dummy_str = NULL;
[67]1553 return 0;
1554}
1555
[149]1556/* verify whether port/interface is blacklisted (do not check)
1557 */
[295]1558static int sh_portchk_is_blacklisted(int port, struct sh_sockaddr * saddr,
1559 int proto)
[149]1560{
1561 struct sh_port * head;
1562
1563 if (proto == IPPROTO_TCP)
1564 head = blacklist_tcp;
1565 else
1566 head = blacklist_udp;
1567
1568 while (head)
1569 {
1570 if (head->port == port)
1571 {
[295]1572 if (sh_ipvx_isany(head->paddr) ||
1573 0 == sh_ipvx_cmp(head->paddr, saddr))
[149]1574 return 1;
1575 else
1576 return 0;
1577 }
1578 head = head->next;
1579 }
1580 return 0;
1581}
1582
1583
[295]1584static int sh_portchk_blacklist(int port, struct sh_sockaddr * saddr, int proto)
[149]1585{
1586 struct sh_port * black;
1587 struct sh_port * head;
1588
1589 if (proto == IPPROTO_TCP)
1590 head = blacklist_tcp;
1591 else
1592 head = blacklist_udp;
1593
1594 black = head;
1595
1596 while (black)
1597 {
[295]1598 if (black->port == port &&
1599 0 == sh_ipvx_cmp(head->paddr, saddr))
[149]1600 return -1;
1601 black = black->next;
1602 }
[295]1603
[149]1604 black = SH_ALLOC (sizeof(struct sh_port));
[295]1605 black->paddr = SH_ALLOC (sizeof(struct sh_sockaddr));
[149]1606 black->port = port;
[295]1607 memcpy(black->paddr, saddr, sizeof(struct sh_sockaddr));
[149]1608 black->next = head;
1609
1610 if (proto == IPPROTO_TCP)
1611 blacklist_tcp = black;
1612 else
1613 blacklist_udp = black;
1614 return 0;
1615}
1616
[67]1617
1618/* Subroutine to add a required or optional port/service
1619 */
[295]1620static int sh_portchk_add_required_port_generic (char * service,
1621 char * interface, int type)
[67]1622{
1623 char buf[256];
[149]1624 int proto;
[67]1625 char * p;
1626 char * endptr;
1627 unsigned long int port;
[295]1628 struct sh_sockaddr saddr;
[67]1629 struct sh_portentry * portent;
1630
[295]1631 if (0 == sh_ipvx_aton(interface, &saddr))
[67]1632 return -1;
1633
1634 sl_strlcpy (buf, service, sizeof(buf));
1635
1636 p = strchr(buf, '/');
1637 if (!p)
1638 return -1;
1639 if (0 == strcmp(p, _("/tcp")))
[149]1640 proto = IPPROTO_TCP;
1641 else if (0 == strcmp(p, _("/udp")))
1642 proto = IPPROTO_UDP;
[67]1643 else
1644 return -1;
1645
1646 *p = '\0';
1647 port = strtoul(buf, &endptr, 0);
1648
[149]1649 /* Blacklisted ports
1650 */
1651 if (*endptr == '\0' && port <= 65535 && type == SH_PORT_BLACKLIST)
[295]1652 return (sh_portchk_blacklist(port, &saddr, proto));
[149]1653
[67]1654 if (*endptr != '\0')
1655 {
[295]1656 portent = sh_portchk_get_from_list (proto, -1, &saddr, buf);
[67]1657 if (!portent)
[380]1658 {
1659 if (portchk_debug)
[383]1660 fprintf(stderr, _("add_required_port %d\n"), (int) port);
[380]1661 sh_portchk_add_to_list (proto, -1, &saddr, buf, type, SH_PORT_UNKN);
1662 }
[67]1663 else
1664 {
1665#ifdef TEST_ONLY
[149]1666 fprintf(stderr, "** WARNING: duplicate port definition %s/%s\n", buf, SH_PROTO_STR(proto));
[67]1667#else
[149]1668 SH_MUTEX_LOCK(mutex_thread_nolog);
[67]1669 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1670 _("duplicate port definition"), _("sh_portchk_add_required_port_generic"));
[149]1671 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]1672#endif
1673 return -1;
1674 }
1675 }
1676 else if (port <= 65535)
1677 {
[295]1678 portent = sh_portchk_get_from_list (proto, port, &saddr, NULL);
[67]1679 if (!portent)
[380]1680 {
1681 if (portchk_debug)
1682 fprintf(stderr, _("add_required_port: open port: %d/%s\n"),
1683 (int) port, SH_PROTO_STR(proto));
1684 sh_portchk_add_to_list (proto, port, &saddr, NULL, type, SH_PORT_UNKN);
1685 }
[67]1686 else
1687 {
1688#ifdef TEST_ONLY
[149]1689 fprintf(stderr, "** WARNING: duplicate port definition %lu/%s\n", port, SH_PROTO_STR(proto));
[67]1690#else
[149]1691 SH_MUTEX_LOCK(mutex_thread_nolog);
[67]1692 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1693 _("duplicate port definition"), _("sh_portchk_add_required_port_generic"));
[149]1694 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]1695#endif
1696 return -1;
1697 }
1698 }
1699 else
1700 return -1;
1701
1702 return 0;
1703}
1704
1705/* Internal interface to add required or optional ports as 'iface:portlist'
1706 */
1707static int sh_portchk_add_required_generic (const char * str, int type)
1708{
1709 size_t len;
1710 size_t ll = 0;
[149]1711 int status;
[67]1712
1713 char * interface = NULL;
1714 char * list;
1715 char * p;
[131]1716#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
1717 char * saveptr;
1718#endif
[67]1719
1720 if (!str)
1721 return -1;
1722
1723 if (strchr(str, ':'))
1724 {
1725 len = strlen(str);
1726 for (ll = 0; ll < len; ++ll)
1727 {
1728 if (str[ll] == ':' || str[ll] == ' ' || str[ll] == '\t')
1729 {
1730 interface = SH_ALLOC(ll+1);
1731 sl_strlcpy(interface, str, ll+1);
1732 interface[ll] = '\0';
1733 while (str[ll] == ':' || str[ll] == ' ' || str[ll] == '\t')
1734 ++ll;
1735 break;
1736 }
1737 }
1738 }
1739 else
1740 {
1741 interface = SH_ALLOC(8);
1742 sl_strlcpy(interface, _("0.0.0.0"), 8);
1743 interface[7] = '\0';
1744 while (str[ll] == ' ' || str[ll] == '\t')
1745 ++ll;
1746 }
1747
1748 if (!interface)
1749 return -1;
1750
1751 if (str[ll] == '\0')
1752 {
1753 SH_FREE(interface);
1754 return -1;
1755 }
1756
1757 if (portchk_debug)
1758 fprintf(stderr, "add ports for interface: %s\n", interface);
1759
1760 list = sh_util_strdup(&str[ll]);
[131]1761#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
1762 p = strtok_r (list, " ,\t", &saveptr);
1763#else
[67]1764 p = strtok (list, " ,\t");
[131]1765#endif
[67]1766 if (!p)
1767 {
1768 SH_FREE(interface);
1769 SH_FREE(list);
1770 return -1;
1771 }
1772 while (p)
1773 {
[149]1774 status = sh_portchk_add_required_port_generic (p, interface, type);
1775
1776 if (-1 == status)
[67]1777 {
1778 SH_FREE(interface);
1779 SH_FREE(list);
1780 return -1;
1781 }
[131]1782#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
1783 p = strtok_r (NULL, " ,\t", &saveptr);
1784#else
[67]1785 p = strtok (NULL, " ,\t");
[131]1786#endif
[67]1787 }
1788 SH_FREE(interface);
1789 SH_FREE(list);
1790 return 0;
1791}
1792
1793/* User interface to add required ports as 'iface:portlist'
1794 */
1795static int sh_portchk_add_required (const char * str)
1796{
1797 return sh_portchk_add_required_generic (str, SH_PORT_REQ);
1798}
1799
1800/* User interface to add optional ports as 'iface:portlist'
1801 */
1802static int sh_portchk_add_optional (const char * str)
1803{
1804 return sh_portchk_add_required_generic (str, SH_PORT_OPT);
1805}
1806
[127]1807/* User interface to add ignoreable ports as 'iface:portlist'
1808 */
1809static int sh_portchk_add_ignore (const char * str)
1810{
1811 return sh_portchk_add_required_generic (str, SH_PORT_IGN);
1812}
1813
[149]1814/* User interface to add ports that should not be checked as 'iface:portlist'
1815 */
1816static int sh_portchk_add_blacklist (const char * str)
1817{
1818 return sh_portchk_add_required_generic (str, SH_PORT_BLACKLIST);
1819}
1820
[67]1821/* Interface to run port check
1822 */
1823int sh_portchk_check ()
1824{
[170]1825 volatile int min_port;
[376]1826 static int noprivports = 0;
[67]1827
[149]1828 SH_MUTEX_LOCK(mutex_port_check);
[170]1829
[328]1830 min_port = (sh_portchk_minport == -1) ? 0 : sh_portchk_minport;
[170]1831
[78]1832 if (sh_portchk_active != S_FALSE)
[67]1833 {
[253]1834 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1835 _("Checking for open ports"),
1836 _("sh_portchk_check"));
1837
[78]1838 sh_portchk_reset_lists();
[328]1839 if ((0 != geteuid()) && (min_port < 1024))
[78]1840 {
1841 min_port = 1024;
[376]1842 if (noprivports == 0)
1843 {
[67]1844#ifdef TEST_ONLY
[376]1845 fprintf(stderr, "** WARNING not scanning ports < 1024\n");
[67]1846#else
[376]1847 SH_MUTEX_LOCK(mutex_thread_nolog);
1848 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1849 _("not scanning ports below 1024"),
1850 _("sh_portchk_check"));
1851 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[67]1852#endif
[376]1853 noprivports = 1;
1854 }
[78]1855 }
[180]1856
1857 sh_port2proc_prepare();
1858
[78]1859 if (sh_portchk_check_udp == 1)
[328]1860 sh_portchk_scan_ports_udp(min_port, sh_portchk_maxport);
1861 sh_portchk_scan_ports_tcp(min_port, sh_portchk_maxport);
[180]1862
1863
[149]1864 sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_REPORT);
[78]1865 if (sh_portchk_check_udp == 1)
[149]1866 sh_portchk_check_list (&portlist_udp, IPPROTO_UDP, SH_PORT_REPORT);
[180]1867
[67]1868 }
[149]1869 SH_MUTEX_UNLOCK(mutex_port_check);
[67]1870 return 0;
1871}
1872#endif
1873
1874#ifdef SH_CUTEST
1875#include "CuTest.h"
1876
1877void Test_portcheck_lists (CuTest *tc)
1878{
[73]1879#if defined(SH_USE_PORTCHECK) && (defined(SH_WITH_CLIENT) || defined(SH_STANDALONE))
[295]1880 struct sh_sockaddr haddr_local;
[67]1881 struct sh_portentry * portent;
[218]1882 char buf[256];
1883 char * p;
[67]1884
[290]1885#ifdef HAVE_RPC_RPC_H
[218]1886 p = sh_getrpcbynumber(0, buf, sizeof(buf));
1887 CuAssertTrue(tc, p == NULL);
1888
1889 p = sh_getrpcbynumber(100000, buf, sizeof(buf));
1890 CuAssertPtrNotNull(tc, p);
1891 CuAssertTrue(tc, (0 == strcmp(p, "portmapper") || 0 == strcmp(p, "rpcbind")));
1892 CuAssertTrue(tc, (0 == strcmp(buf, "portmapper") || 0 == strcmp(p, "rpcbind")));
1893
1894 p = sh_getrpcbynumber(100007, buf, sizeof(buf));
1895 CuAssertPtrNotNull(tc, p);
1896 CuAssertTrue(tc, 0 == strcmp(p, "ypbind"));
1897 CuAssertTrue(tc, 0 == strcmp(buf, "ypbind"));
[290]1898#endif
[218]1899
[300]1900 p = sh_getservbyport(0, SH_PROTO_STR(IPPROTO_UDP), buf, sizeof(buf));
[218]1901 CuAssertTrue(tc, p == NULL);
1902
[290]1903#if !defined(HOST_IS_CYGWIN)
[218]1904 p = sh_getservbyport(22, SH_PROTO_STR(IPPROTO_TCP), buf, sizeof(buf));
1905 CuAssertPtrNotNull(tc, p);
1906 CuAssertTrue(tc, 0 == strcmp(p, "ssh"));
1907 CuAssertTrue(tc, 0 == strcmp(buf, "ssh"));
[290]1908#endif
[218]1909
1910 p = sh_getservbyport(13, SH_PROTO_STR(IPPROTO_UDP), buf, sizeof(buf));
1911 CuAssertPtrNotNull(tc, p);
1912 CuAssertTrue(tc, 0 == strcmp(p, "daytime"));
1913 CuAssertTrue(tc, 0 == strcmp(buf, "daytime"));
1914
[295]1915 CuAssertTrue(tc, 0 != sh_ipvx_aton("127.0.0.1", &haddr_local));
[67]1916
[295]1917 sh_portchk_add_to_list (IPPROTO_TCP, 8000, &haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
[67]1918
[295]1919 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, &haddr_local, NULL);
[67]1920 CuAssertPtrNotNull(tc, portent);
1921
1922 CuAssertTrue(tc, portent->port == 8000);
1923 CuAssertTrue(tc, 0 == strcmp("127.0.0.1", portent->interface));
1924 CuAssertTrue(tc, portent->status == SH_PORT_UNKN);
1925 CuAssertTrue(tc, portent->flag == SH_PORT_NOT);
1926
[149]1927 sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_NOREPT);
[67]1928
1929 CuAssertTrue(tc, NULL == portlist_tcp);
1930
[295]1931 sh_portchk_add_to_list (IPPROTO_TCP, 8000, &haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
1932 sh_portchk_add_to_list (IPPROTO_TCP, 8001, &haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
1933 sh_portchk_add_to_list (IPPROTO_TCP, 8002, &haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
1934 sh_portchk_add_to_list (IPPROTO_TCP, 8003, &haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
1935 sh_portchk_add_to_list (IPPROTO_TCP, 8004, &haddr_local, NULL, SH_PORT_IGN, SH_PORT_UNKN);
1936 sh_portchk_add_to_list (IPPROTO_TCP, -1, &haddr_local, "foo1", SH_PORT_NOT, SH_PORT_UNKN);
1937 sh_portchk_add_to_list (IPPROTO_TCP, -1, &haddr_local, "foo2", SH_PORT_REQ, SH_PORT_UNKN);
1938 sh_portchk_add_to_list (IPPROTO_TCP, -1, &haddr_local, "foo3", SH_PORT_NOT, SH_PORT_UNKN);
1939 sh_portchk_add_to_list (IPPROTO_TCP, -1, &haddr_local, "foo4", SH_PORT_REQ, SH_PORT_UNKN);
1940 sh_portchk_add_to_list (IPPROTO_TCP, -1, &haddr_local, "foo5", SH_PORT_IGN, SH_PORT_UNKN);
[67]1941
[149]1942 sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_NOREPT);
[67]1943
1944 CuAssertPtrNotNull(tc, portlist_tcp);
1945
[295]1946 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, &haddr_local, NULL);
[67]1947 CuAssertPtrNotNull(tc, portent);
1948
[295]1949 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8001, &haddr_local, NULL);
[67]1950 CuAssertTrue(tc, NULL == portent);
1951
[295]1952 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8002, &haddr_local, NULL);
[67]1953 CuAssertPtrNotNull(tc, portent);
1954
[295]1955 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8003, &haddr_local, NULL);
[67]1956 CuAssertTrue(tc, NULL == portent);
1957
[295]1958 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8004, &haddr_local, NULL);
[127]1959 CuAssertPtrNotNull(tc, portent);
1960
[295]1961 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, &haddr_local, "foo1");
[67]1962 CuAssertTrue(tc, NULL == portent);
1963
[295]1964 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, &haddr_local, "foo2");
[67]1965 CuAssertPtrNotNull(tc, portent);
1966 CuAssertTrue(tc, 0 == strcmp(portent->service, "foo2"));
1967
[295]1968 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, &haddr_local, "foo3");
[67]1969 CuAssertTrue(tc, NULL == portent);
1970
[295]1971 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, &haddr_local, "foo4");
[67]1972 CuAssertPtrNotNull(tc, portent);
1973 CuAssertTrue(tc, 0 == strcmp(portent->service, "foo4"));
[127]1974
[295]1975 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, &haddr_local, "foo5");
[127]1976 CuAssertPtrNotNull(tc, portent);
1977 CuAssertTrue(tc, 0 == strcmp(portent->service, "foo5"));
[149]1978
[295]1979 CuAssertTrue(tc, 0 == sh_portchk_blacklist(666, &haddr_local, IPPROTO_TCP));
1980 CuAssertTrue(tc, 0 != sh_portchk_blacklist(666, &haddr_local, IPPROTO_TCP));
1981 CuAssertTrue(tc, 0 == sh_portchk_blacklist(667, &haddr_local, IPPROTO_TCP));
1982 CuAssertTrue(tc, 0 == sh_portchk_blacklist(668, &haddr_local, IPPROTO_TCP));
1983 CuAssertTrue(tc, 0 == sh_portchk_blacklist(666, &haddr_local, IPPROTO_UDP));
1984 CuAssertTrue(tc, 0 != sh_portchk_blacklist(666, &haddr_local, IPPROTO_UDP));
1985 CuAssertTrue(tc, 0 == sh_portchk_blacklist(667, &haddr_local, IPPROTO_UDP));
1986 CuAssertTrue(tc, 0 == sh_portchk_blacklist(668, &haddr_local, IPPROTO_UDP));
[149]1987
[295]1988 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(668, &haddr_local, IPPROTO_UDP));
1989 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(667, &haddr_local, IPPROTO_UDP));
1990 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(666, &haddr_local, IPPROTO_UDP));
1991 CuAssertTrue(tc, 0 == sh_portchk_is_blacklisted(665, &haddr_local, IPPROTO_UDP));
[149]1992
[295]1993 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(668, &haddr_local, IPPROTO_TCP));
1994 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(667, &haddr_local, IPPROTO_TCP));
1995 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(666, &haddr_local, IPPROTO_TCP));
1996 CuAssertTrue(tc, 0 == sh_portchk_is_blacklisted(665, &haddr_local, IPPROTO_TCP));
[67]1997#else
1998 (void) tc; /* fix compiler warning */
1999#endif
2000 return;
2001}
2002#endif
2003
2004#ifdef TEST_ONLY
2005
2006void usage (char * pname)
2007{
2008 printf ("%s [-r|--required interface:portlist][-o|--optional interface:portlist][--no-udp][-d|--debug] hostname\n\n", pname);
2009 printf (" Check local host for open ports; Version %s\n\n", PORTCHK_VERSION);
2010 printf (" Interface: Numeric address for an interface, e.g. 127.0.0.1\n");
2011 printf (" Portlist: List of ports or services, e.g. 22/tcp,nfs/udp,nlockmgr/udp\n");
2012 printf (" required -> must be open\n");
2013 printf (" optional -> may be open or closed\n");
2014 printf (" RPC services must be specified with service **name**, others with **port number**\n\n");
2015 printf (" Example:\n");
2016 printf (" %s --required 192.168.1.2:22/tcp,nfs/udp,nlockmgr/udp\n\n", pname);
2017 return;
2018}
2019
2020int main(int argc, char *argv[])
2021{
2022 char * pname = argv[0];
2023
2024
2025 /*
2026 test_lists();
2027
2028 portlist_tcp = sh_portchk_kill_list (portlist_tcp);
2029 portlist_udp = sh_portchk_kill_list (portlist_udp);
2030 */
2031
[237]2032 /* sh_portchk_add_required ("127.0.0.1 : nlockmgr/tcp, 5308/tcp, nfs/tcp"); */
[67]2033
2034 while (argc > 1 && argv[1][0] == '-')
2035 {
2036 if (0 == strcmp(argv[1], "--help") || 0 == strcmp(argv[1], "-h"))
2037 {
2038 usage(pname);
2039 exit (0);
2040 }
2041 else if (0 == strcmp(argv[1], "--required") || 0 == strcmp(argv[1], "-r"))
2042 {
2043 if (argc < 3)
2044 {
2045 usage(pname);
2046 exit (1);
2047 }
2048 sh_portchk_add_required (argv[2]);
2049 --argc; ++argv;
2050 }
2051 else if (0 == strcmp(argv[1], "--optional") || 0 == strcmp(argv[1], "-o"))
2052 {
2053 if (argc < 3)
2054 {
2055 usage(pname);
2056 exit (1);
2057 }
2058 sh_portchk_add_optional (argv[2]);
2059 --argc; ++argv;
2060 }
2061 else if (0 == strcmp(argv[1], "--no-udp"))
2062 {
2063 sh_portchk_check_udp = 0;
2064 }
2065 else if (0 == strcmp(argv[1], "--debug") || 0 == strcmp(argv[1], "-d"))
2066 {
2067 portchk_debug = 1;
2068 }
2069 else
2070 {
2071 usage(pname);
2072 exit (1);
2073 }
2074 --argc; ++argv;
2075 }
2076
2077 if (argc < 2)
2078 {
2079 usage(pname);
2080 exit (1);
2081 }
2082
2083 portchk_hostname = argv[1];
2084
2085 if (0 != sh_portchk_init ())
2086 {
2087 usage(pname);
2088 exit (1);
2089 }
2090
2091 sh_portchk_check();
2092
2093 return 0;
2094}
2095#endif
Note: See TracBrowser for help on using the repository browser.