source: trunk/src/sh_portcheck.c@ 68

Last change on this file since 68 was 67, checked in by katerina, 18 years ago

Add/delete files for samhain 2.3
  • Property svn:executable set to *
File size: 31.4 KB
RevLine 
[67]1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 2006 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20/***************************************************************************
21 *
22 * This file provides a module for samhain to check for open ports
23 * on the local machine.
24 *
25 */
26
27
28/* #define TEST_ONLY */
29#ifndef TEST_ONLY
30#include "config_xor.h"
31#endif
32
33#include <stdio.h>
34#include <string.h>
35#include <sys/types.h>
36#include <sys/socket.h>
37#include <netinet/in.h>
38#include <arpa/inet.h>
39#include <errno.h>
40#include <unistd.h>
41
42#define PORTMAP
43#include <rpc/rpc.h>
44#ifdef HAVE_RPC_RPCENT_H
45#include <rpc/rpcent.h>
46#endif
47#include <rpc/pmap_clnt.h>
48#include <rpc/pmap_prot.h>
49#include <netdb.h>
50
51#define PORTCHK_VERSION "1.0"
52
53#if defined(TEST_ONLY) || (defined(SH_USE_PORTCHECK) && (defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)))
54
55
56/*
57 * struct pmaplist {
58 * struct pmap pml_map;
59 * struct pmaplist *pml_next;
60 * };
61 */
62
63/* struct pmap {
64 * long unsigned pm_prog;
65 * long unsigned pm_vers;
66 * long unsigned pm_prot;
67 * long unsigned pm_port;
68 * };
69 */
70
71/* TIME_WAIT ? 60-240 seconds */
72
73/* the size of an interface string
74 */
75#define SH_INTERFACE_SIZE 16
76
77#define SH_PORT_NOT 0
78#define SH_PORT_REQ 1
79#define SH_PORT_OPT 2
80
81#define SH_PORT_MISS 0
82#define SH_PORT_ISOK 1
83#define SH_PORT_UNKN 2
84
85#define SH_PORT_NOREPT 0
86#define SH_PORT_REPORT 1
87
88struct sh_portentry {
89 int port;
90 char interface[SH_INTERFACE_SIZE];
91 char * service;
92 char * error;
93 int flag; /* required or not */
94 int status; /* missing or not */
95 struct sh_portentry * next;
96};
97
98static struct sh_portentry * portlist_tcp = NULL;
99static struct sh_portentry * portlist_udp = NULL;
100
101#define SH_PORTCHK_INTERVAL 300
102
103static int sh_portchk_check_udp = 1;
104static int sh_portchk_active = 1;
105static int sh_portchk_interval = SH_PORTCHK_INTERVAL;
106#if !defined(TEST_ONLY)
107
108#define FIL__ _("sh_portcheck.c")
109#include "samhain.h"
110#include "sh_error.h"
111#include "sh_mem.h"
112#include "sh_utils.h"
113#include "sh_modules.h"
114
115static int sh_portchk_severity = SH_ERR_SEVERE;
116#endif
117
118/* Exported interface to add required ports as 'iface:portlist'
119 */
120static int sh_portchk_add_required (const char * str);
121
122/* Exported interface to add optional ports as 'iface:portlist'
123 */
124static int sh_portchk_add_optional (const char * str);
125
126/* Exported interface to add an ethernet interface
127 */
128static int sh_portchk_add_interface (const char * str);
129
130
131#ifndef TEST_ONLY
132
133static int sh_portchk_set_interval (const char * c)
134{
135 int retval = 0;
136 long val;
137
138 SL_ENTER(_("sh_portchk_set_interval"));
139 val = strtol (c, (char **)NULL, 10);
140 if (val <= 0)
141 {
142 sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
143 _("port check interval"), c);
144 retval = -1;
145 }
146
147 val = (val <= 0 ? 60 : val);
148
149 sh_portchk_interval = (time_t) val;
150 SL_RETURN(0, _("sh_portchk_set_interval"));
151}
152
153
154static int sh_portchk_set_active (const char * str)
155{
156 return sh_util_flagval(str, &sh_portchk_active);
157}
158
159static int sh_portchk_set_udp (const char * str)
160{
161 return sh_util_flagval(str, &sh_portchk_check_udp);
162}
163
164static int sh_portchk_set_severity (const char * str)
165{
166 char tmp[32];
167 tmp[0] = '='; tmp[1] = '\0';
168 sl_strlcat (tmp, str, 32);
169 return sh_error_set_level (tmp, &sh_portchk_severity);
170}
171
172sh_rconf sh_portchk_table[] = {
173 {
174 N_("severityportcheck"),
175 sh_portchk_set_severity,
176 },
177 {
178 N_("portcheckrequired"),
179 sh_portchk_add_required,
180 },
181 {
182 N_("portcheckoptional"),
183 sh_portchk_add_optional,
184 },
185 {
186 N_("portcheckactive"),
187 sh_portchk_set_active,
188 },
189 {
190 N_("portcheckinterface"),
191 sh_portchk_add_interface,
192 },
193 {
194 N_("portcheckinterval"),
195 sh_portchk_set_interval,
196 },
197 {
198 N_("portcheckudp"),
199 sh_portchk_set_udp,
200 },
201 {
202 NULL,
203 NULL
204 }
205};
206
207#endif
208
209/* Interface to initialize port check
210 */
211int sh_portchk_init ();
212
213/* Interface to reset port check
214 */
215int sh_portchk_reset ();
216
217/* Interface to run port check
218 */
219int sh_portchk_check ();
220
221
222static char * check_services (int port, char * proto);
223
224#ifdef TEST_ONLY
225
226static int portchk_debug = 0;
227#define SH_ALLOC malloc
228#define SH_FREE free
229#define sh_util_strdup strdup
230#define sl_strlcpy strncpy
231#define _(a) a
232
233#else
234
235static int portchk_debug = 0;
236
237#endif
238
239static void sh_portchk_add_to_list (char * proto,
240 int port, struct in_addr haddr, char * service,
241 int flag, int status)
242{
243 struct sh_portentry * new = SH_ALLOC (sizeof(struct sh_portentry));
244
245 if (portchk_debug)
246 fprintf(stderr, _("add to list: port %d/%s %d %d (%s)\n"),
247 port, proto, flag, status, service ? service : _("undef"));
248
249 new->port = port;
250 sl_strlcpy (new->interface, inet_ntoa(haddr), SH_INTERFACE_SIZE);
251 new->status = status;
252 new->flag = flag;
253
254 new->error = NULL;
255
256 if (service)
257 new->service = sh_util_strdup (service);
258 else
259 new->service = NULL;
260 if (0 == strcmp(proto, "tcp"))
261 {
262 new->next = portlist_tcp;
263 portlist_tcp = new;
264 }
265 else
266 {
267 new->next = portlist_udp;
268 portlist_udp = new;
269 }
270 return;
271}
272
273/* Reset the list by setting all entries to UNKN.
274 * In the next cycle we will check, and set found ports to ISOK.
275 * Thereafter, we check for entries that are still UNKN.
276 */
277static void sh_portchk_reset_lists ()
278{
279 struct sh_portentry * portlist;
280
281 portlist = portlist_tcp;
282 while (portlist)
283 {
284 if (portlist->status != SH_PORT_MISS)
285 portlist->status = SH_PORT_UNKN;
286 portlist = portlist->next;
287 }
288 portlist = portlist_udp;
289 while (portlist)
290 {
291 if (portlist->status != SH_PORT_MISS)
292 portlist->status = SH_PORT_UNKN;
293 portlist = portlist->next;
294 }
295 return;
296}
297
298static struct sh_portentry * sh_portchk_kill_list (struct sh_portentry * head)
299{
300 if (head)
301 {
302 if (head->next)
303 sh_portchk_kill_list (head->next);
304
305 if (head->service)
306 SH_FREE(head->service);
307 SH_FREE(head);
308 }
309 return NULL;
310}
311
312/* check the list of open ports for any that are marked as UNKN
313 */
314static void sh_portchk_check_list (struct sh_portentry ** head, char * proto, int report)
315{
316 struct sh_portentry * ptr = *head;
317 struct sh_portentry * pre = *head;
318 char errbuf[256];
319
320 while (ptr)
321 {
322 if (portchk_debug && report)
323 fprintf(stderr, _("check list: port %d/%s %d %d\n"),
324 ptr->port, proto, ptr->flag, ptr->status);
325
326 if (ptr->status == SH_PORT_UNKN)
327 {
328 /* Don't report missing ports that are marked as optional
329 */
330 if (ptr->flag != SH_PORT_OPT)
331 {
332 snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceMissing] port %s:%d/%s (%s)"),
333 ptr->interface, ptr->port, proto,
334 ptr->service ? ptr->service : check_services(ptr->port, proto));
335#ifdef TEST_ONLY
336 if (report == SH_PORT_REPORT)
337 fprintf(stderr, _("%s\n"), errbuf);
338#else
339 if (report == SH_PORT_REPORT)
340 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
341 MSG_PORT_REPORT, errbuf);
342#endif
343 }
344
345 ptr->status = SH_PORT_MISS;
346
347 if ((ptr->flag != SH_PORT_REQ) && (ptr->flag != SH_PORT_OPT))
348 {
349 if (portchk_debug && report)
350 fprintf(stderr, _("removing: port %d/%s %d %d\n"),
351 ptr->port, proto, ptr->flag, ptr->status);
352
353 if (ptr == *head)
354 {
355 *head = ptr->next;
356 if (ptr->service)
357 SH_FREE(ptr->service);
358 SH_FREE(ptr);
359 ptr = *head;
360 pre = *head;
361 continue;
362 }
363 else if (ptr->next == NULL)
364 {
365 pre->next = NULL;
366 if (ptr->service)
367 SH_FREE(ptr->service);
368 SH_FREE(ptr);
369 return;
370 }
371 else
372 {
373 pre->next = ptr->next;
374 if (ptr->service)
375 SH_FREE(ptr->service);
376 SH_FREE(ptr);
377 ptr = pre->next;
378 continue;
379 }
380 }
381 }
382 pre = ptr;
383 ptr = ptr->next;
384 }
385 return;
386}
387
388
389static struct sh_portentry * sh_portchk_get_from_list (char * proto, int port,
390 struct in_addr haddr, char * service)
391{
392 struct sh_portentry * portlist;
393 char iface_all[8] = _("0.0.0.0");
394
395 if (0 == strcmp(proto, "tcp"))
396 portlist = portlist_tcp;
397 else
398 portlist = portlist_udp;
399
400 if (service)
401 {
402 while (portlist)
403 {
404 if (portlist->service &&
405 0 == strcmp(service, portlist->service) &&
406 (0 == strcmp(portlist->interface, inet_ntoa(haddr)) ||
407 0 == strcmp(portlist->interface, iface_all)))
408 return portlist;
409 portlist = portlist->next;
410 }
411 }
412 else
413 {
414 while (portlist)
415 {
416 if (port == portlist->port &&
417 (0 == strcmp(portlist->interface, inet_ntoa(haddr)) ||
418 0 == strcmp(portlist->interface, iface_all)))
419 return portlist;
420 portlist = portlist->next;
421 }
422 }
423 return NULL;
424}
425
426
427static void sh_portchk_cmp_to_list (char * proto, int port, struct in_addr haddr, char * service)
428{
429 struct sh_portentry * portent;
430 char errbuf[256];
431
432
433 portent = sh_portchk_get_from_list (proto, port, haddr, service);
434
435 if (service)
436 {
437 if (!portent)
438 {
439 snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceNew] port %s:%d/%s (%s)"),
440 inet_ntoa(haddr), port, proto, service);
441#ifdef TEST_ONLY
442 fprintf(stderr, _("open port: %s:%d/%s (%s)\n"),
443 inet_ntoa(haddr), port, proto, service);
444#else
445 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
446 MSG_PORT_REPORT, errbuf);
447#endif
448 /*
449 * was not there, thus it is not in 'required' or 'optional' list
450 */
451 sh_portchk_add_to_list (proto, port, haddr, service, SH_PORT_NOT, SH_PORT_ISOK);
452 }
453 else if (portent->status == SH_PORT_MISS)
454 {
455 snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceRestarted] port %s:%d/%s to %d/%s (%s)"),
456 inet_ntoa(haddr), portent->port, proto, port, proto, service);
457#ifdef TEST_ONLY
458 fprintf(stderr, _("service: %s\n"), errbuf);
459#else
460 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
461 MSG_PORT_REPORT, errbuf);
462#endif
463
464 portent->status = SH_PORT_ISOK;
465 }
466 else if (port != portent->port && (-1) != portent->port)
467 {
468 snprintf (errbuf, sizeof(errbuf), _("POLICY [ServicePortSwitch] port %s:%d/%s to %d/%s (%s)"),
469 inet_ntoa(haddr), portent->port, proto, port, proto, service);
470#ifdef TEST_ONLY
471 fprintf(stderr, _("service: %s\n"), errbuf);
472#else
473 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
474 MSG_PORT_REPORT, errbuf);
475#endif
476
477 portent->status = SH_PORT_ISOK;
478 }
479 else
480 {
481 portent->status = SH_PORT_ISOK;
482 }
483 }
484 else
485 {
486 if (!portent)
487 {
488 snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceNew] port %s:%d/%s (%s)"),
489 inet_ntoa(haddr), port, proto, check_services(port, proto));
490#ifdef TEST_ONLY
491 fprintf(stderr, _("open port: %s:%d/%s (%s)\n"),
492 inet_ntoa(haddr), port, proto, check_services(port, proto));
493#else
494 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
495 MSG_PORT_REPORT, errbuf);
496#endif
497
498 /* was not there, thus it is not in 'required' or 'optional' list
499 */
500 sh_portchk_add_to_list (proto, port, haddr, service, SH_PORT_NOT, SH_PORT_ISOK);
501 }
502 else if (portent->status == SH_PORT_MISS)
503 {
504 snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceRestarted] port %s:%d/%s (%s)"),
505 inet_ntoa(haddr), port, proto, check_services(port, proto));
506#ifdef TEST_ONLY
507 fprintf(stderr, _("port : %s\n"), errbuf);
508#else
509 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
510 MSG_PORT_REPORT, errbuf);
511#endif
512
513 portent->status = SH_PORT_ISOK;
514 }
515 else
516 {
517 portent->status = SH_PORT_ISOK;
518 }
519 }
520
521 return;
522}
523
524
525/* Returns a static buffer containing the name of the service
526 * running on port <port> (from /etc/services)
527 * Returns NULL on failure
528 */
529static char * check_services (int port, char * proto)
530{
531 static char buf[256];
532 struct servent * service = getservbyport(htons(port), proto);
533
534 if (service && service->s_name && service->s_name[0] != '\0')
535 {
536 snprintf (buf, sizeof(buf), _("maybe_%s"), service->s_name);
537 }
538 else
539 {
540 snprintf (buf, sizeof(buf), _("unknown"));
541 }
542 return buf;
543}
544
545/* Returns a static buffer containing the name of the service
546 * running on port <port> at <address> (from portmap daemon)
547 * Returns NULL on failure
548 */
549static char * check_rpc_list (int port, struct sockaddr_in * address,
550 unsigned long prot)
551{
552 struct pmaplist * head;
553 struct rpcent *r;
554 static char buf[256];
555
556 head = pmap_getmaps(address);
557
558 if (head)
559 {
560 do /* while (head != NULL) */
561 {
562 if ((head->pml_map.pm_prot == prot) &&
563 (port == (int)head->pml_map.pm_port))
564 {
565 r = getrpcbynumber((int)head->pml_map.pm_prog);
566 if (r && r->r_name && r->r_name[0] != '\0')
567 {
568 snprintf (buf, sizeof(buf), "%s", r->r_name);
569 return buf;
570 }
571 else
572 {
573 snprintf (buf, sizeof(buf), "RPC_%lu",
574 (unsigned long)head->pml_map.pm_prog);
575 return buf;
576 }
577 }
578 head = head->pml_next;
579 }
580 while (head != NULL);
581 }
582
583 return NULL;
584}
585
586static int check_port_udp_internal (int fd, int port, struct in_addr haddr)
587{
588 struct sockaddr_in sinr;
589 /* struct in_addr haddr; */
590 int retval;
591 char * p;
592 char buf[8];
593
594
595 /* inet_aton(interface, &haddr); */
596
597 sinr.sin_family = AF_INET;
598 sinr.sin_port = htons (port);
599 sinr.sin_addr = haddr;
600
601 retval = connect(fd, (struct sockaddr *) &sinr, sizeof(sinr));
602 if (retval == -1)
603 {
604#ifdef TEST_ONLY
605 if (portchk_debug)
606 perror(_("connect"));
607#else
608 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
609 sh_error_message(errno), _("connect"));
610#endif
611 }
612 else
613 {
614 retval = send (fd, buf, 0, 0);
615
616 if (retval == -1 && errno == ECONNREFUSED)
617 {
618 if (portchk_debug)
619 fprintf(stderr, _("check port: %5d/udp on %15s established/time_wait\n"),
620 port, inet_ntoa(haddr));
621 }
622 else
623 {
624 retval = send (fd, buf, 0, 0);
625 if (retval == -1 && errno == ECONNREFUSED)
626 {
627 if (portchk_debug)
628 fprintf(stderr, _("check port: %5d/udp on %15s established/time_wait\n"),
629 port, inet_ntoa(haddr));
630 }
631 else if (retval != -1)
632 {
633 /* Try to get service name from portmap
634 */
635 p = check_rpc_list (port, &sinr, IPPROTO_UDP);
636
637 sh_portchk_cmp_to_list ("udp", port, haddr, p ? p : NULL);
638
639 /* If not an RPC service, try to get name from /etc/services
640 */
641 if (!p)
642 p = check_services(port, "udp");
643
644 if (portchk_debug)
645 fprintf(stderr, _("check port: %5d/udp on %15s open %s\n"),
646 port, inet_ntoa(haddr), p);
647
648 }
649 }
650 }
651 close (fd);
652 return 0;
653}
654
655static int check_port_tcp_internal (int fd, int port, struct in_addr haddr)
656{
657 struct sockaddr_in sinr;
658 /* struct in_addr haddr; */
659 int retval;
660 char * p;
661
662
663 /* inet_aton(interface, &haddr); */
664
665 sinr.sin_family = AF_INET;
666 sinr.sin_port = htons (port);
667 sinr.sin_addr = haddr;
668
669 retval = connect(fd, (struct sockaddr *) &sinr, sizeof(sinr));
670 if (retval == -1 && errno == ECONNREFUSED)
671 {
672 if (portchk_debug)
673 fprintf(stderr, _("check port: %5d on %15s established/time_wait\n"),
674 port, inet_ntoa(haddr));
675 }
676 else if (retval == -1)
677 {
678#ifdef TEST_ONLY
679 if (portchk_debug)
680 perror(_("connect"));
681#else
682 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
683 sh_error_message(errno), _("connect"));
684#endif
685 }
686 else
687 {
688 /* Try to get service name from portmap
689 */
690 p = check_rpc_list (port, &sinr, IPPROTO_TCP);
691
692 sh_portchk_cmp_to_list ("tcp", port, haddr, p ? p : NULL);
693
694 /* If not an RPC service, try to get name from /etc/services
695 */
696 if (!p)
697 p = check_services(port, "tcp");
698
699 if (portchk_debug)
700 fprintf(stderr, _("check port: %5d on %15s open %s\n"),
701 port, inet_ntoa(haddr), p);
702 }
703 close (fd);
704 return 0;
705}
706
707/* typedef uint32_t in_addr_t;
708 * struct in_addr
709 * {
710 * in_addr_t s_addr;
711 * };
712 */
713
714#define SH_IFACE_MAX 16
715
716struct portchk_interfaces {
717 struct in_addr iface[SH_IFACE_MAX];
718 int used;
719};
720
721static struct portchk_interfaces iface_list;
722static int iface_initialized = 0;
723
724#ifdef TEST_ONLY
725static char * portchk_hostname = NULL;
726#else
727static char * portchk_hostname = sh.host.name;
728#endif
729
730int sh_portchk_init ()
731{
732 struct hostent * hent;
733 int i = 0;
734 char errbuf[256];
735
736 if (portchk_debug)
737 fprintf(stderr, _("checking ports on: %s\n"), portchk_hostname ? portchk_hostname : _("NULL"));
738 if (!portchk_hostname)
739 return -1;
740
741 if (iface_initialized == 0)
742 {
743 iface_list.used = 0;
744 iface_initialized = 1;
745 }
746
747 hent = gethostbyname(portchk_hostname);
748
749 while (hent && hent->h_addr_list[i] && (iface_list.used < SH_IFACE_MAX))
750 {
751 memcpy (&(iface_list.iface[iface_list.used].s_addr), hent->h_addr_list[i], sizeof(in_addr_t));
752 sl_snprintf(errbuf, sizeof(errbuf), _("interface: %s"),
753 inet_ntoa(iface_list.iface[iface_list.used]));
754 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
755 errbuf, _("sh_portchk_init"));
756
757 ++iface_list.used;
758 ++i;
759 }
760
761 return 0;
762}
763
764#if !defined(TEST_ONLY)
765int sh_portchk_reconf ()
766{
767 iface_initialized = 0;
768
769 portlist_udp = sh_portchk_kill_list (portlist_udp);
770 portlist_tcp = sh_portchk_kill_list (portlist_tcp);
771 return 0;
772}
773
774int sh_portchk_cleanup ()
775{
776 return sh_portchk_reconf ();
777}
778
779int sh_portchk_timer (time_t tcurrent)
780{
781 static time_t lastcheck = 0;
782
783 SL_ENTER(_("sh_portchk_timer"));
784 if ((time_t) (tcurrent - lastcheck) >= sh_portchk_interval)
785 {
786 lastcheck = tcurrent;
787 SL_RETURN((-1), _("sh_portchk_timer"));
788 }
789 SL_RETURN(0, _("sh_portchk_timer"));
790}
791#endif
792
793static int check_port_generic (int port, int type, int protocol)
794{
795 int i = 0;
796 int sock = -1;
797 int flag = 1; /* non-zero to enable an option */
798 struct in_addr haddr;
799
800 /* Check all interfaces for this host
801 */
802 while (i < iface_list.used)
803 {
804 if ((sock = socket(AF_INET, type, protocol)) < 0 )
805 {
806#ifdef TEST_ONLY
807 if (portchk_debug)
808 perror(_("socket"));
809#else
810 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
811 sh_error_message(errno), _("socket"));
812#endif
813 }
814 if ( setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
815 (void *) &flag, sizeof(flag)) < 0 )
816 {
817#ifdef TEST_ONLY
818 if (portchk_debug)
819 perror(_("setsockopt"));
820#else
821 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
822 sh_error_message(errno), _("setsockopt"));
823#endif
824 }
825
826 memcpy (&(haddr.s_addr), &(iface_list.iface[i].s_addr), sizeof(in_addr_t));
827
828 if (protocol == IPPROTO_TCP)
829 check_port_tcp_internal(sock, port, haddr);
830 else
831 check_port_udp_internal(sock, port, haddr);
832
833 ++i;
834 }
835
836 return 0;
837}
838
839
840
841static int check_port_udp (int port)
842{
843 return check_port_generic(port, SOCK_DGRAM, IPPROTO_UDP);
844}
845
846static int check_port_tcp (int port)
847{
848 return check_port_generic(port, SOCK_STREAM, IPPROTO_TCP);
849}
850
851
852
853static int sh_portchk_scan_ports_generic (int min_port, int max_port, int type, int protocol)
854{
855 /*
856 int min_port = 1024;
857 int max_port = 65535;
858 */
859
860 int port;
861 int retval;
862 int sock = -1;
863 int flag = 1; /* non-zero to enable an option */
864
865 struct sockaddr_in addr;
866 int addrlen = sizeof(addr);
867
868 if (min_port == -1)
869 min_port = 0;
870 if (max_port == -1)
871 max_port = 65535;
872
873 for (port = min_port; port <= max_port; ++port)
874 {
875
876 if ((sock = socket(AF_INET, type, protocol)) < 0 )
877 {
878#ifdef TEST_ONLY
879 if (portchk_debug)
880 perror(_("socket"));
881#else
882 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
883 sh_error_message(errno), _("socket"));
884#endif
885 }
886 if ( setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
887 (void *) &flag, sizeof(flag)) < 0 )
888 {
889#ifdef TEST_ONLY
890 if (portchk_debug)
891 perror(_("setsockopt"));
892#else
893 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
894 sh_error_message(errno), _("setsockopt"));
895#endif
896 }
897
898 addr.sin_family = AF_INET;
899 addr.sin_port = htons(port);
900 addr.sin_addr.s_addr = INADDR_ANY;
901
902 retval = bind (sock, (struct sockaddr *) &addr, addrlen);
903
904 if (retval == 0)
905 {
906 /* we can bind the port, thus it is unused
907 */
908 close (sock);
909 }
910 else
911 {
912 if (errno == EINVAL || errno == EADDRINUSE)
913 {
914 /* try to connect to the port
915 */
916 if (protocol == IPPROTO_TCP)
917 check_port_tcp(port);
918 else
919 check_port_udp(port);
920 }
921 else
922 {
923#ifdef TEST_ONLY
924 if (portchk_debug)
925 perror(_("bind"));
926#else
927 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
928 sh_error_message(errno), _("bind"));
929#endif
930 }
931 close (sock);
932 }
933 }
934 return 0;
935}
936
937static int sh_portchk_scan_ports_tcp (int min_port, int max_port)
938{
939 return sh_portchk_scan_ports_generic (min_port, max_port, SOCK_STREAM, IPPROTO_TCP);
940}
941
942static int sh_portchk_scan_ports_udp (int min_port, int max_port)
943{
944 return sh_portchk_scan_ports_generic (min_port, max_port, SOCK_DGRAM, IPPROTO_UDP);
945}
946
947/* Subroutine to add an interface
948 */
949static int sh_portchk_add_interface (const char * str)
950{
951 struct in_addr haddr;
952 char errbuf[256];
953
954 if (iface_initialized == 0)
955 {
956 iface_list.used = 0;
957 iface_initialized = 1;
958 }
959
960 if (0 == inet_aton(str, &haddr))
961 return -1;
962
963 if (iface_list.used == SH_IFACE_MAX)
964 return -1;
965
966 sl_snprintf(errbuf, sizeof(errbuf), _("interface: %s"), inet_ntoa(haddr));
967 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
968 errbuf, _("sh_portchk_add_interface"));
969
970 memcpy (&(iface_list.iface[iface_list.used].s_addr), &(haddr.s_addr), sizeof(in_addr_t));
971 ++iface_list.used;
972
973 return 0;
974}
975
976
977/* Subroutine to add a required or optional port/service
978 */
979static int sh_portchk_add_required_port_generic (char * service, char * interface, int type)
980{
981 char buf[256];
982 char proto[4];
983 char * p;
984 char * endptr;
985 unsigned long int port;
986 struct in_addr haddr;
987 struct sh_portentry * portent;
988
989 if (0 == inet_aton(interface, &haddr))
990 return -1;
991
992 sl_strlcpy (buf, service, sizeof(buf));
993
994 p = strchr(buf, '/');
995 if (!p)
996 return -1;
997 if (0 == strcmp(p, _("/tcp")))
998 sl_strlcpy(proto, _("tcp"), sizeof(proto));
999 else if (0 == strcmp(p, _("/udp")))
1000 sl_strlcpy(proto, _("udp"), sizeof(proto));
1001 else
1002 return -1;
1003
1004 *p = '\0';
1005 port = strtoul(buf, &endptr, 0);
1006
1007 if (*endptr != '\0')
1008 {
1009 portent = sh_portchk_get_from_list (proto, -1, haddr, buf);
1010 if (!portent)
1011 sh_portchk_add_to_list (proto, -1, haddr, buf, type, SH_PORT_UNKN);
1012 else
1013 {
1014#ifdef TEST_ONLY
1015 fprintf(stderr, "** WARNING: duplicate port definition %s/%s\n", buf, proto);
1016#else
1017 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1018 _("duplicate port definition"), _("sh_portchk_add_required_port_generic"));
1019#endif
1020 return -1;
1021 }
1022 }
1023 else if (port <= 65535)
1024 {
1025 portent = sh_portchk_get_from_list (proto, port, haddr, NULL);
1026 if (!portent)
1027 sh_portchk_add_to_list (proto, port, haddr, NULL, type, SH_PORT_UNKN);
1028 else
1029 {
1030#ifdef TEST_ONLY
1031 fprintf(stderr, "** WARNING: duplicate port definition %lu/%s\n", port, proto);
1032#else
1033 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1034 _("duplicate port definition"), _("sh_portchk_add_required_port_generic"));
1035#endif
1036 return -1;
1037 }
1038 }
1039 else
1040 return -1;
1041
1042 return 0;
1043}
1044
1045/* Internal interface to add required or optional ports as 'iface:portlist'
1046 */
1047static int sh_portchk_add_required_generic (const char * str, int type)
1048{
1049 size_t len;
1050 size_t ll = 0;
1051
1052 char * interface = NULL;
1053 char * list;
1054 char * p;
1055
1056 if (!str)
1057 return -1;
1058
1059 if (strchr(str, ':'))
1060 {
1061 len = strlen(str);
1062 for (ll = 0; ll < len; ++ll)
1063 {
1064 if (str[ll] == ':' || str[ll] == ' ' || str[ll] == '\t')
1065 {
1066 interface = SH_ALLOC(ll+1);
1067 sl_strlcpy(interface, str, ll+1);
1068 interface[ll] = '\0';
1069 while (str[ll] == ':' || str[ll] == ' ' || str[ll] == '\t')
1070 ++ll;
1071 break;
1072 }
1073 }
1074 }
1075 else
1076 {
1077 interface = SH_ALLOC(8);
1078 sl_strlcpy(interface, _("0.0.0.0"), 8);
1079 interface[7] = '\0';
1080 while (str[ll] == ' ' || str[ll] == '\t')
1081 ++ll;
1082 }
1083
1084 if (!interface)
1085 return -1;
1086
1087 if (str[ll] == '\0')
1088 {
1089 SH_FREE(interface);
1090 return -1;
1091 }
1092
1093 if (portchk_debug)
1094 fprintf(stderr, "add ports for interface: %s\n", interface);
1095
1096 list = sh_util_strdup(&str[ll]);
1097 p = strtok (list, " ,\t");
1098 if (!p)
1099 {
1100 SH_FREE(interface);
1101 SH_FREE(list);
1102 return -1;
1103 }
1104 while (p)
1105 {
1106 if (-1 == sh_portchk_add_required_port_generic (p, interface, type))
1107 {
1108 SH_FREE(interface);
1109 SH_FREE(list);
1110 return -1;
1111 }
1112 p = strtok (NULL, " ,\t");
1113 }
1114 SH_FREE(interface);
1115 SH_FREE(list);
1116 return 0;
1117}
1118
1119/* User interface to add required ports as 'iface:portlist'
1120 */
1121static int sh_portchk_add_required (const char * str)
1122{
1123 return sh_portchk_add_required_generic (str, SH_PORT_REQ);
1124}
1125
1126/* User interface to add optional ports as 'iface:portlist'
1127 */
1128static int sh_portchk_add_optional (const char * str)
1129{
1130 return sh_portchk_add_required_generic (str, SH_PORT_OPT);
1131}
1132
1133/* Interface to run port check
1134 */
1135int sh_portchk_check ()
1136{
1137 int min_port = 0;
1138
1139 sh_portchk_reset_lists();
1140 if (0 != geteuid())
1141 {
1142 min_port = 1024;
1143#ifdef TEST_ONLY
1144 fprintf(stderr, "** WARNING not scanning ports < 1024\n");
1145#else
1146 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1147 _("not scanning ports below 1024"), _("sh_portchk_check"));
1148#endif
1149 }
1150 if (sh_portchk_check_udp == 1)
1151 sh_portchk_scan_ports_udp(min_port, -1);
1152 sh_portchk_scan_ports_tcp(min_port, -1);
1153 sh_portchk_check_list (&portlist_tcp, "tcp", SH_PORT_REPORT);
1154 if (sh_portchk_check_udp == 1)
1155 sh_portchk_check_list (&portlist_udp, "udp", SH_PORT_REPORT);
1156 return 0;
1157}
1158#endif
1159
1160#ifdef SH_CUTEST
1161#include "CuTest.h"
1162
1163void Test_portcheck_lists (CuTest *tc)
1164{
1165#if defined(SH_USE_PROCESSCHECK) && (defined(SH_WITH_CLIENT) || defined(SH_STANDALONE))
1166 struct in_addr haddr_local;
1167 struct sh_portentry * portent;
1168
1169 CuAssertTrue(tc, 0 != inet_aton("127.0.0.1", &haddr_local));
1170
1171 sh_portchk_add_to_list ("tcp", 8000, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
1172
1173 portent = sh_portchk_get_from_list("tcp", 8000, haddr_local, NULL);
1174 CuAssertPtrNotNull(tc, portent);
1175
1176 CuAssertTrue(tc, portent->port == 8000);
1177 CuAssertTrue(tc, 0 == strcmp("127.0.0.1", portent->interface));
1178 CuAssertTrue(tc, portent->status == SH_PORT_UNKN);
1179 CuAssertTrue(tc, portent->flag == SH_PORT_NOT);
1180
1181 sh_portchk_check_list (&portlist_tcp, "tcp", SH_PORT_NOREPT);
1182
1183 CuAssertTrue(tc, NULL == portlist_tcp);
1184
1185 sh_portchk_add_to_list ("tcp", 8000, haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
1186 sh_portchk_add_to_list ("tcp", 8001, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
1187 sh_portchk_add_to_list ("tcp", 8002, haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
1188 sh_portchk_add_to_list ("tcp", 8003, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
1189 sh_portchk_add_to_list ("tcp", -1, haddr_local, "foo1", SH_PORT_NOT, SH_PORT_UNKN);
1190 sh_portchk_add_to_list ("tcp", -1, haddr_local, "foo2", SH_PORT_REQ, SH_PORT_UNKN);
1191 sh_portchk_add_to_list ("tcp", -1, haddr_local, "foo3", SH_PORT_NOT, SH_PORT_UNKN);
1192 sh_portchk_add_to_list ("tcp", -1, haddr_local, "foo4", SH_PORT_REQ, SH_PORT_UNKN);
1193
1194 sh_portchk_check_list (&portlist_tcp, "tcp", SH_PORT_NOREPT);
1195
1196 CuAssertPtrNotNull(tc, portlist_tcp);
1197
1198 portent = sh_portchk_get_from_list("tcp", 8000, haddr_local, NULL);
1199 CuAssertPtrNotNull(tc, portent);
1200
1201 portent = sh_portchk_get_from_list("tcp", 8001, haddr_local, NULL);
1202 CuAssertTrue(tc, NULL == portent);
1203
1204 portent = sh_portchk_get_from_list("tcp", 8002, haddr_local, NULL);
1205 CuAssertPtrNotNull(tc, portent);
1206
1207 portent = sh_portchk_get_from_list("tcp", 8003, haddr_local, NULL);
1208 CuAssertTrue(tc, NULL == portent);
1209
1210 portent = sh_portchk_get_from_list("tcp", 8000, haddr_local, "foo1");
1211 CuAssertTrue(tc, NULL == portent);
1212
1213 portent = sh_portchk_get_from_list("tcp", 8000, haddr_local, "foo2");
1214 CuAssertPtrNotNull(tc, portent);
1215 CuAssertTrue(tc, 0 == strcmp(portent->service, "foo2"));
1216
1217 portent = sh_portchk_get_from_list("tcp", 8000, haddr_local, "foo3");
1218 CuAssertTrue(tc, NULL == portent);
1219
1220 portent = sh_portchk_get_from_list("tcp", 8000, haddr_local, "foo4");
1221 CuAssertPtrNotNull(tc, portent);
1222 CuAssertTrue(tc, 0 == strcmp(portent->service, "foo4"));
1223#else
1224 (void) tc; /* fix compiler warning */
1225#endif
1226 return;
1227}
1228#endif
1229
1230#ifdef TEST_ONLY
1231
1232void usage (char * pname)
1233{
1234 printf ("%s [-r|--required interface:portlist][-o|--optional interface:portlist][--no-udp][-d|--debug] hostname\n\n", pname);
1235 printf (" Check local host for open ports; Version %s\n\n", PORTCHK_VERSION);
1236 printf (" Interface: Numeric address for an interface, e.g. 127.0.0.1\n");
1237 printf (" Portlist: List of ports or services, e.g. 22/tcp,nfs/udp,nlockmgr/udp\n");
1238 printf (" required -> must be open\n");
1239 printf (" optional -> may be open or closed\n");
1240 printf (" RPC services must be specified with service **name**, others with **port number**\n\n");
1241 printf (" Example:\n");
1242 printf (" %s --required 192.168.1.2:22/tcp,nfs/udp,nlockmgr/udp\n\n", pname);
1243 return;
1244}
1245
1246int main(int argc, char *argv[])
1247{
1248 char * pname = argv[0];
1249
1250
1251 /*
1252 test_lists();
1253
1254 portlist_tcp = sh_portchk_kill_list (portlist_tcp);
1255 portlist_udp = sh_portchk_kill_list (portlist_udp);
1256 */
1257
1258 // sh_portchk_add_required ("127.0.0.1 : nlockmgr/tcp, 5308/tcp, nfs/tcp");
1259
1260 while (argc > 1 && argv[1][0] == '-')
1261 {
1262 if (0 == strcmp(argv[1], "--help") || 0 == strcmp(argv[1], "-h"))
1263 {
1264 usage(pname);
1265 exit (0);
1266 }
1267 else if (0 == strcmp(argv[1], "--required") || 0 == strcmp(argv[1], "-r"))
1268 {
1269 if (argc < 3)
1270 {
1271 usage(pname);
1272 exit (1);
1273 }
1274 sh_portchk_add_required (argv[2]);
1275 --argc; ++argv;
1276 }
1277 else if (0 == strcmp(argv[1], "--optional") || 0 == strcmp(argv[1], "-o"))
1278 {
1279 if (argc < 3)
1280 {
1281 usage(pname);
1282 exit (1);
1283 }
1284 sh_portchk_add_optional (argv[2]);
1285 --argc; ++argv;
1286 }
1287 else if (0 == strcmp(argv[1], "--no-udp"))
1288 {
1289 sh_portchk_check_udp = 0;
1290 }
1291 else if (0 == strcmp(argv[1], "--debug") || 0 == strcmp(argv[1], "-d"))
1292 {
1293 portchk_debug = 1;
1294 }
1295 else
1296 {
1297 usage(pname);
1298 exit (1);
1299 }
1300 --argc; ++argv;
1301 }
1302
1303 if (argc < 2)
1304 {
1305 usage(pname);
1306 exit (1);
1307 }
1308
1309 portchk_hostname = argv[1];
1310
1311 if (0 != sh_portchk_init ())
1312 {
1313 usage(pname);
1314 exit (1);
1315 }
1316
1317 sh_portchk_check();
1318
1319 /*
1320 sleep(10);
1321
1322 sh_portchk_check();
1323 */
1324
1325 return 0;
1326}
1327#endif
Note: See TracBrowser for help on using the repository browser.