source: trunk/src/sh_portcheck.c@ 79

Last change on this file since 79 was 78, checked in by rainer, 18 years ago

Fix for ticket #41 (unable to deactivate processcheck), and minor code cleanup.

  • Property svn:executable set to *
File size: 32.3 KB
RevLine 
[67]1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 2006 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20/***************************************************************************
21 *
22 * This file provides a module for samhain to check for open ports
23 * on the local machine.
24 *
25 */
26
27
28/* #define TEST_ONLY */
29#ifndef TEST_ONLY
30#include "config_xor.h"
31#endif
32
33#include <stdio.h>
34#include <string.h>
35#include <sys/types.h>
36#include <sys/socket.h>
37#include <netinet/in.h>
38#include <arpa/inet.h>
39#include <errno.h>
40#include <unistd.h>
41
[76]42#define PORTCHK_VERSION "1.0"
43
44#if defined(TEST_ONLY) || (defined(SH_USE_PORTCHECK) && (defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)))
45
46
[67]47#define PORTMAP
48#include <rpc/rpc.h>
49#ifdef HAVE_RPC_RPCENT_H
50#include <rpc/rpcent.h>
51#endif
52#include <rpc/pmap_clnt.h>
53#include <rpc/pmap_prot.h>
54#include <netdb.h>
55
56/*
57 * struct pmaplist {
58 * struct pmap pml_map;
59 * struct pmaplist *pml_next;
60 * };
61 */
62
63/* struct pmap {
64 * long unsigned pm_prog;
65 * long unsigned pm_vers;
66 * long unsigned pm_prot;
67 * long unsigned pm_port;
68 * };
69 */
70
71/* TIME_WAIT ? 60-240 seconds */
72
73/* the size of an interface string
74 */
75#define SH_INTERFACE_SIZE 16
76
77#define SH_PORT_NOT 0
78#define SH_PORT_REQ 1
79#define SH_PORT_OPT 2
80
81#define SH_PORT_MISS 0
82#define SH_PORT_ISOK 1
83#define SH_PORT_UNKN 2
84
85#define SH_PORT_NOREPT 0
86#define SH_PORT_REPORT 1
87
88struct sh_portentry {
89 int port;
90 char interface[SH_INTERFACE_SIZE];
91 char * service;
92 char * error;
93 int flag; /* required or not */
94 int status; /* missing or not */
95 struct sh_portentry * next;
96};
97
98static struct sh_portentry * portlist_tcp = NULL;
99static struct sh_portentry * portlist_udp = NULL;
100
101#define SH_PORTCHK_INTERVAL 300
102
103static int sh_portchk_check_udp = 1;
104static int sh_portchk_active = 1;
105static int sh_portchk_interval = SH_PORTCHK_INTERVAL;
106#if !defined(TEST_ONLY)
107
108#define FIL__ _("sh_portcheck.c")
109#include "samhain.h"
110#include "sh_error.h"
111#include "sh_mem.h"
112#include "sh_utils.h"
113#include "sh_modules.h"
114
115static int sh_portchk_severity = SH_ERR_SEVERE;
116#endif
117
118/* Exported interface to add required ports as 'iface:portlist'
119 */
120static int sh_portchk_add_required (const char * str);
121
122/* Exported interface to add optional ports as 'iface:portlist'
123 */
124static int sh_portchk_add_optional (const char * str);
125
126/* Exported interface to add an ethernet interface
127 */
128static int sh_portchk_add_interface (const char * str);
129
130
131#ifndef TEST_ONLY
132
133static int sh_portchk_set_interval (const char * c)
134{
135 int retval = 0;
136 long val;
137
138 SL_ENTER(_("sh_portchk_set_interval"));
139 val = strtol (c, (char **)NULL, 10);
140 if (val <= 0)
141 {
142 sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
143 _("port check interval"), c);
144 retval = -1;
145 }
146
147 val = (val <= 0 ? 60 : val);
148
149 sh_portchk_interval = (time_t) val;
150 SL_RETURN(0, _("sh_portchk_set_interval"));
151}
152
153
154static int sh_portchk_set_active (const char * str)
155{
156 return sh_util_flagval(str, &sh_portchk_active);
157}
158
159static int sh_portchk_set_udp (const char * str)
160{
161 return sh_util_flagval(str, &sh_portchk_check_udp);
162}
163
164static int sh_portchk_set_severity (const char * str)
165{
166 char tmp[32];
167 tmp[0] = '='; tmp[1] = '\0';
168 sl_strlcat (tmp, str, 32);
169 return sh_error_set_level (tmp, &sh_portchk_severity);
170}
171
172sh_rconf sh_portchk_table[] = {
173 {
174 N_("severityportcheck"),
175 sh_portchk_set_severity,
176 },
177 {
178 N_("portcheckrequired"),
179 sh_portchk_add_required,
180 },
181 {
182 N_("portcheckoptional"),
183 sh_portchk_add_optional,
184 },
185 {
186 N_("portcheckactive"),
187 sh_portchk_set_active,
188 },
189 {
190 N_("portcheckinterface"),
191 sh_portchk_add_interface,
192 },
193 {
194 N_("portcheckinterval"),
195 sh_portchk_set_interval,
196 },
197 {
198 N_("portcheckudp"),
199 sh_portchk_set_udp,
200 },
201 {
202 NULL,
203 NULL
204 }
205};
206
207#endif
208
209/* Interface to initialize port check
210 */
211int sh_portchk_init ();
212
213/* Interface to reset port check
214 */
215int sh_portchk_reset ();
216
217/* Interface to run port check
218 */
219int sh_portchk_check ();
220
221
222static char * check_services (int port, char * proto);
223
224#ifdef TEST_ONLY
225
226static int portchk_debug = 0;
227#define SH_ALLOC malloc
228#define SH_FREE free
229#define sh_util_strdup strdup
230#define sl_strlcpy strncpy
231#define _(a) a
232
233#else
234
235static int portchk_debug = 0;
236
237#endif
238
239static void sh_portchk_add_to_list (char * proto,
240 int port, struct in_addr haddr, char * service,
241 int flag, int status)
242{
243 struct sh_portentry * new = SH_ALLOC (sizeof(struct sh_portentry));
244
245 if (portchk_debug)
246 fprintf(stderr, _("add to list: port %d/%s %d %d (%s)\n"),
247 port, proto, flag, status, service ? service : _("undef"));
248
249 new->port = port;
250 sl_strlcpy (new->interface, inet_ntoa(haddr), SH_INTERFACE_SIZE);
251 new->status = status;
252 new->flag = flag;
253
254 new->error = NULL;
255
256 if (service)
257 new->service = sh_util_strdup (service);
258 else
259 new->service = NULL;
260 if (0 == strcmp(proto, "tcp"))
261 {
262 new->next = portlist_tcp;
263 portlist_tcp = new;
264 }
265 else
266 {
267 new->next = portlist_udp;
268 portlist_udp = new;
269 }
270 return;
271}
272
273/* Reset the list by setting all entries to UNKN.
274 * In the next cycle we will check, and set found ports to ISOK.
275 * Thereafter, we check for entries that are still UNKN.
276 */
277static void sh_portchk_reset_lists ()
278{
279 struct sh_portentry * portlist;
280
281 portlist = portlist_tcp;
282 while (portlist)
283 {
284 if (portlist->status != SH_PORT_MISS)
285 portlist->status = SH_PORT_UNKN;
286 portlist = portlist->next;
287 }
288 portlist = portlist_udp;
289 while (portlist)
290 {
291 if (portlist->status != SH_PORT_MISS)
292 portlist->status = SH_PORT_UNKN;
293 portlist = portlist->next;
294 }
295 return;
296}
297
298static struct sh_portentry * sh_portchk_kill_list (struct sh_portentry * head)
299{
300 if (head)
301 {
302 if (head->next)
303 sh_portchk_kill_list (head->next);
304
305 if (head->service)
306 SH_FREE(head->service);
307 SH_FREE(head);
308 }
309 return NULL;
310}
311
312/* check the list of open ports for any that are marked as UNKN
313 */
314static void sh_portchk_check_list (struct sh_portentry ** head, char * proto, int report)
315{
316 struct sh_portentry * ptr = *head;
317 struct sh_portentry * pre = *head;
318 char errbuf[256];
319
320 while (ptr)
321 {
322 if (portchk_debug && report)
323 fprintf(stderr, _("check list: port %d/%s %d %d\n"),
324 ptr->port, proto, ptr->flag, ptr->status);
325
326 if (ptr->status == SH_PORT_UNKN)
327 {
328 /* Don't report missing ports that are marked as optional
329 */
330 if (ptr->flag != SH_PORT_OPT)
331 {
332 snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceMissing] port %s:%d/%s (%s)"),
333 ptr->interface, ptr->port, proto,
334 ptr->service ? ptr->service : check_services(ptr->port, proto));
335#ifdef TEST_ONLY
336 if (report == SH_PORT_REPORT)
337 fprintf(stderr, _("%s\n"), errbuf);
338#else
339 if (report == SH_PORT_REPORT)
340 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
341 MSG_PORT_REPORT, errbuf);
342#endif
343 }
344
345 ptr->status = SH_PORT_MISS;
346
347 if ((ptr->flag != SH_PORT_REQ) && (ptr->flag != SH_PORT_OPT))
348 {
349 if (portchk_debug && report)
350 fprintf(stderr, _("removing: port %d/%s %d %d\n"),
351 ptr->port, proto, ptr->flag, ptr->status);
352
353 if (ptr == *head)
354 {
355 *head = ptr->next;
356 if (ptr->service)
357 SH_FREE(ptr->service);
358 SH_FREE(ptr);
359 ptr = *head;
360 pre = *head;
361 continue;
362 }
363 else if (ptr->next == NULL)
364 {
365 pre->next = NULL;
366 if (ptr->service)
367 SH_FREE(ptr->service);
368 SH_FREE(ptr);
369 return;
370 }
371 else
372 {
373 pre->next = ptr->next;
374 if (ptr->service)
375 SH_FREE(ptr->service);
376 SH_FREE(ptr);
377 ptr = pre->next;
378 continue;
379 }
380 }
381 }
382 pre = ptr;
383 ptr = ptr->next;
384 }
385 return;
386}
387
388
389static struct sh_portentry * sh_portchk_get_from_list (char * proto, int port,
390 struct in_addr haddr, char * service)
391{
392 struct sh_portentry * portlist;
[75]393 char iface_all[8];
394
395 sl_strlcpy (iface_all, _("0.0.0.0"), sizeof(iface_all));
[67]396
397 if (0 == strcmp(proto, "tcp"))
398 portlist = portlist_tcp;
399 else
400 portlist = portlist_udp;
401
402 if (service)
403 {
404 while (portlist)
405 {
406 if (portlist->service &&
407 0 == strcmp(service, portlist->service) &&
408 (0 == strcmp(portlist->interface, inet_ntoa(haddr)) ||
409 0 == strcmp(portlist->interface, iface_all)))
410 return portlist;
411 portlist = portlist->next;
412 }
413 }
414 else
415 {
416 while (portlist)
417 {
418 if (port == portlist->port &&
419 (0 == strcmp(portlist->interface, inet_ntoa(haddr)) ||
420 0 == strcmp(portlist->interface, iface_all)))
421 return portlist;
422 portlist = portlist->next;
423 }
424 }
425 return NULL;
426}
427
428
429static void sh_portchk_cmp_to_list (char * proto, int port, struct in_addr haddr, char * service)
430{
431 struct sh_portentry * portent;
432 char errbuf[256];
433
434
435 portent = sh_portchk_get_from_list (proto, port, haddr, service);
436
437 if (service)
438 {
439 if (!portent)
440 {
441 snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceNew] port %s:%d/%s (%s)"),
442 inet_ntoa(haddr), port, proto, service);
443#ifdef TEST_ONLY
444 fprintf(stderr, _("open port: %s:%d/%s (%s)\n"),
445 inet_ntoa(haddr), port, proto, service);
446#else
447 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
448 MSG_PORT_REPORT, errbuf);
449#endif
450 /*
451 * was not there, thus it is not in 'required' or 'optional' list
452 */
453 sh_portchk_add_to_list (proto, port, haddr, service, SH_PORT_NOT, SH_PORT_ISOK);
454 }
455 else if (portent->status == SH_PORT_MISS)
456 {
457 snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceRestarted] port %s:%d/%s to %d/%s (%s)"),
458 inet_ntoa(haddr), portent->port, proto, port, proto, service);
459#ifdef TEST_ONLY
460 fprintf(stderr, _("service: %s\n"), errbuf);
461#else
462 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
463 MSG_PORT_REPORT, errbuf);
464#endif
465
466 portent->status = SH_PORT_ISOK;
467 }
468 else if (port != portent->port && (-1) != portent->port)
469 {
470 snprintf (errbuf, sizeof(errbuf), _("POLICY [ServicePortSwitch] port %s:%d/%s to %d/%s (%s)"),
471 inet_ntoa(haddr), portent->port, proto, port, proto, service);
472#ifdef TEST_ONLY
473 fprintf(stderr, _("service: %s\n"), errbuf);
474#else
475 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
476 MSG_PORT_REPORT, errbuf);
477#endif
478
479 portent->status = SH_PORT_ISOK;
480 }
481 else
482 {
483 portent->status = SH_PORT_ISOK;
484 }
485 }
486 else
487 {
488 if (!portent)
489 {
490 snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceNew] port %s:%d/%s (%s)"),
491 inet_ntoa(haddr), port, proto, check_services(port, proto));
492#ifdef TEST_ONLY
493 fprintf(stderr, _("open port: %s:%d/%s (%s)\n"),
494 inet_ntoa(haddr), port, proto, check_services(port, proto));
495#else
496 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
497 MSG_PORT_REPORT, errbuf);
498#endif
499
500 /* was not there, thus it is not in 'required' or 'optional' list
501 */
502 sh_portchk_add_to_list (proto, port, haddr, service, SH_PORT_NOT, SH_PORT_ISOK);
503 }
504 else if (portent->status == SH_PORT_MISS)
505 {
506 snprintf (errbuf, sizeof(errbuf), _("POLICY [ServiceRestarted] port %s:%d/%s (%s)"),
507 inet_ntoa(haddr), port, proto, check_services(port, proto));
508#ifdef TEST_ONLY
509 fprintf(stderr, _("port : %s\n"), errbuf);
510#else
511 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
512 MSG_PORT_REPORT, errbuf);
513#endif
514
515 portent->status = SH_PORT_ISOK;
516 }
517 else
518 {
519 portent->status = SH_PORT_ISOK;
520 }
521 }
522
523 return;
524}
525
526
527/* Returns a static buffer containing the name of the service
528 * running on port <port> (from /etc/services)
529 * Returns NULL on failure
530 */
531static char * check_services (int port, char * proto)
532{
533 static char buf[256];
534 struct servent * service = getservbyport(htons(port), proto);
535
536 if (service && service->s_name && service->s_name[0] != '\0')
537 {
538 snprintf (buf, sizeof(buf), _("maybe_%s"), service->s_name);
539 }
540 else
541 {
542 snprintf (buf, sizeof(buf), _("unknown"));
543 }
544 return buf;
545}
546
547/* Returns a static buffer containing the name of the service
548 * running on port <port> at <address> (from portmap daemon)
549 * Returns NULL on failure
550 */
551static char * check_rpc_list (int port, struct sockaddr_in * address,
552 unsigned long prot)
553{
554 struct pmaplist * head;
555 struct rpcent *r;
556 static char buf[256];
557
558 head = pmap_getmaps(address);
559
560 if (head)
561 {
562 do /* while (head != NULL) */
563 {
564 if ((head->pml_map.pm_prot == prot) &&
565 (port == (int)head->pml_map.pm_port))
566 {
567 r = getrpcbynumber((int)head->pml_map.pm_prog);
568 if (r && r->r_name && r->r_name[0] != '\0')
569 {
570 snprintf (buf, sizeof(buf), "%s", r->r_name);
571 return buf;
572 }
573 else
574 {
575 snprintf (buf, sizeof(buf), "RPC_%lu",
576 (unsigned long)head->pml_map.pm_prog);
577 return buf;
578 }
579 }
580 head = head->pml_next;
581 }
582 while (head != NULL);
583 }
584
585 return NULL;
586}
587
588static int check_port_udp_internal (int fd, int port, struct in_addr haddr)
589{
590 struct sockaddr_in sinr;
591 /* struct in_addr haddr; */
592 int retval;
593 char * p;
594 char buf[8];
[78]595#ifndef TEST_ONLY
596 char errmsg[256];
597 int nerr;
598#endif
[67]599
600 /* inet_aton(interface, &haddr); */
601
602 sinr.sin_family = AF_INET;
603 sinr.sin_port = htons (port);
604 sinr.sin_addr = haddr;
605
[78]606 do {
607 retval = connect(fd, (struct sockaddr *) &sinr, sizeof(sinr));
608 } while (retval < 0 && errno == EINTR);
609
[67]610 if (retval == -1)
611 {
612#ifdef TEST_ONLY
613 if (portchk_debug)
614 perror(_("connect"));
615#else
[78]616 nerr = errno;
617 sl_snprintf(errmsg, sizeof(errmsg), _("check port: %5d/udp on %15s: %s"),
618 port, inet_ntoa(haddr), sh_error_message(errno));
619 sh_error_handle((-1), FIL__, __LINE__, nerr, MSG_E_SUBGEN,
620 errmsg, _("connect"));
[67]621#endif
622 }
623 else
624 {
[78]625 do {
626 retval = send (fd, buf, 0, 0);
627 } while (retval < 0 && errno == EINTR);
[67]628
629 if (retval == -1 && errno == ECONNREFUSED)
630 {
631 if (portchk_debug)
632 fprintf(stderr, _("check port: %5d/udp on %15s established/time_wait\n"),
633 port, inet_ntoa(haddr));
634 }
635 else
636 {
[78]637 /* Only the second send() may catch the error
638 */
639 do {
640 retval = send (fd, buf, 0, 0);
641 } while (retval < 0 && errno == EINTR);
642
[67]643 if (retval == -1 && errno == ECONNREFUSED)
644 {
645 if (portchk_debug)
646 fprintf(stderr, _("check port: %5d/udp on %15s established/time_wait\n"),
647 port, inet_ntoa(haddr));
648 }
649 else if (retval != -1)
650 {
651 /* Try to get service name from portmap
652 */
653 p = check_rpc_list (port, &sinr, IPPROTO_UDP);
654
655 sh_portchk_cmp_to_list ("udp", port, haddr, p ? p : NULL);
656
657 /* If not an RPC service, try to get name from /etc/services
658 */
659 if (!p)
660 p = check_services(port, "udp");
661
662 if (portchk_debug)
663 fprintf(stderr, _("check port: %5d/udp on %15s open %s\n"),
664 port, inet_ntoa(haddr), p);
665
666 }
667 }
668 }
669 close (fd);
670 return 0;
671}
672
673static int check_port_tcp_internal (int fd, int port, struct in_addr haddr)
674{
675 struct sockaddr_in sinr;
676 /* struct in_addr haddr; */
677 int retval;
678 char * p;
[78]679#ifndef TEST_ONLY
680 char errmsg[256];
681 int nerr;
682#endif
[67]683
684
685 /* inet_aton(interface, &haddr); */
686
687 sinr.sin_family = AF_INET;
688 sinr.sin_port = htons (port);
689 sinr.sin_addr = haddr;
690
[78]691 do {
692 retval = connect(fd, (struct sockaddr *) &sinr, sizeof(sinr));
693 } while (retval < 0 && errno == EINTR);
694
[67]695 if (retval == -1 && errno == ECONNREFUSED)
696 {
697 if (portchk_debug)
698 fprintf(stderr, _("check port: %5d on %15s established/time_wait\n"),
699 port, inet_ntoa(haddr));
700 }
701 else if (retval == -1)
702 {
703#ifdef TEST_ONLY
704 if (portchk_debug)
705 perror(_("connect"));
706#else
[78]707 nerr = errno;
708 sl_snprintf(errmsg, sizeof(errmsg), _("check port: %5d/tcp on %15s: %s"),
709 port, inet_ntoa(haddr), sh_error_message(errno));
710 sh_error_handle((-1), FIL__, __LINE__, nerr, MSG_E_SUBGEN,
711 errmsg, _("connect"));
[67]712#endif
713 }
714 else
715 {
716 /* Try to get service name from portmap
717 */
718 p = check_rpc_list (port, &sinr, IPPROTO_TCP);
719
720 sh_portchk_cmp_to_list ("tcp", port, haddr, p ? p : NULL);
721
722 /* If not an RPC service, try to get name from /etc/services
723 */
724 if (!p)
725 p = check_services(port, "tcp");
726
727 if (portchk_debug)
728 fprintf(stderr, _("check port: %5d on %15s open %s\n"),
729 port, inet_ntoa(haddr), p);
730 }
731 close (fd);
732 return 0;
733}
734
735/* typedef uint32_t in_addr_t;
736 * struct in_addr
737 * {
738 * in_addr_t s_addr;
739 * };
740 */
741
742#define SH_IFACE_MAX 16
743
744struct portchk_interfaces {
745 struct in_addr iface[SH_IFACE_MAX];
746 int used;
747};
748
749static struct portchk_interfaces iface_list;
750static int iface_initialized = 0;
751
752#ifdef TEST_ONLY
753static char * portchk_hostname = NULL;
754#else
755static char * portchk_hostname = sh.host.name;
756#endif
757
758int sh_portchk_init ()
759{
760 struct hostent * hent;
761 int i = 0;
762 char errbuf[256];
763
764 if (portchk_debug)
765 fprintf(stderr, _("checking ports on: %s\n"), portchk_hostname ? portchk_hostname : _("NULL"));
[78]766
[67]767 if (!portchk_hostname)
768 return -1;
769
[78]770 if (sh_portchk_active == S_FALSE)
771 return -1;
772
[67]773 if (iface_initialized == 0)
774 {
775 iface_list.used = 0;
776 iface_initialized = 1;
777 }
778
779 hent = gethostbyname(portchk_hostname);
780
781 while (hent && hent->h_addr_list[i] && (iface_list.used < SH_IFACE_MAX))
782 {
783 memcpy (&(iface_list.iface[iface_list.used].s_addr), hent->h_addr_list[i], sizeof(in_addr_t));
784 sl_snprintf(errbuf, sizeof(errbuf), _("interface: %s"),
785 inet_ntoa(iface_list.iface[iface_list.used]));
786 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
787 errbuf, _("sh_portchk_init"));
788
789 ++iface_list.used;
790 ++i;
791 }
792
793 return 0;
794}
795
796#if !defined(TEST_ONLY)
797int sh_portchk_reconf ()
798{
[78]799 iface_initialized = 0;
[67]800
[78]801 sh_portchk_active = 1;
802 sh_portchk_check_upd = 1;
803
[67]804 portlist_udp = sh_portchk_kill_list (portlist_udp);
805 portlist_tcp = sh_portchk_kill_list (portlist_tcp);
806 return 0;
807}
808
809int sh_portchk_cleanup ()
810{
811 return sh_portchk_reconf ();
812}
813
814int sh_portchk_timer (time_t tcurrent)
815{
816 static time_t lastcheck = 0;
817
818 SL_ENTER(_("sh_portchk_timer"));
819 if ((time_t) (tcurrent - lastcheck) >= sh_portchk_interval)
820 {
821 lastcheck = tcurrent;
822 SL_RETURN((-1), _("sh_portchk_timer"));
823 }
824 SL_RETURN(0, _("sh_portchk_timer"));
825}
826#endif
827
828static int check_port_generic (int port, int type, int protocol)
829{
830 int i = 0;
831 int sock = -1;
832 int flag = 1; /* non-zero to enable an option */
833 struct in_addr haddr;
834
835 /* Check all interfaces for this host
836 */
837 while (i < iface_list.used)
838 {
839 if ((sock = socket(AF_INET, type, protocol)) < 0 )
840 {
841#ifdef TEST_ONLY
842 if (portchk_debug)
843 perror(_("socket"));
844#else
845 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
846 sh_error_message(errno), _("socket"));
847#endif
848 }
849 if ( setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
850 (void *) &flag, sizeof(flag)) < 0 )
851 {
852#ifdef TEST_ONLY
853 if (portchk_debug)
854 perror(_("setsockopt"));
855#else
856 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
857 sh_error_message(errno), _("setsockopt"));
858#endif
859 }
860
861 memcpy (&(haddr.s_addr), &(iface_list.iface[i].s_addr), sizeof(in_addr_t));
862
863 if (protocol == IPPROTO_TCP)
864 check_port_tcp_internal(sock, port, haddr);
865 else
866 check_port_udp_internal(sock, port, haddr);
867
868 ++i;
869 }
870
871 return 0;
872}
873
874
875
876static int check_port_udp (int port)
877{
878 return check_port_generic(port, SOCK_DGRAM, IPPROTO_UDP);
879}
880
881static int check_port_tcp (int port)
882{
883 return check_port_generic(port, SOCK_STREAM, IPPROTO_TCP);
884}
885
886
887
888static int sh_portchk_scan_ports_generic (int min_port, int max_port, int type, int protocol)
889{
890 /*
891 int min_port = 1024;
892 int max_port = 65535;
893 */
894
895 int port;
896 int retval;
897 int sock = -1;
898 int flag = 1; /* non-zero to enable an option */
899
900 struct sockaddr_in addr;
901 int addrlen = sizeof(addr);
902
903 if (min_port == -1)
904 min_port = 0;
905 if (max_port == -1)
906 max_port = 65535;
907
908 for (port = min_port; port <= max_port; ++port)
909 {
910
911 if ((sock = socket(AF_INET, type, protocol)) < 0 )
912 {
913#ifdef TEST_ONLY
914 if (portchk_debug)
915 perror(_("socket"));
916#else
917 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
918 sh_error_message(errno), _("socket"));
919#endif
920 }
921 if ( setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
922 (void *) &flag, sizeof(flag)) < 0 )
923 {
924#ifdef TEST_ONLY
925 if (portchk_debug)
926 perror(_("setsockopt"));
927#else
928 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
929 sh_error_message(errno), _("setsockopt"));
930#endif
931 }
932
933 addr.sin_family = AF_INET;
934 addr.sin_port = htons(port);
935 addr.sin_addr.s_addr = INADDR_ANY;
936
937 retval = bind (sock, (struct sockaddr *) &addr, addrlen);
938
939 if (retval == 0)
940 {
941 /* we can bind the port, thus it is unused
942 */
943 close (sock);
944 }
945 else
946 {
947 if (errno == EINVAL || errno == EADDRINUSE)
948 {
949 /* try to connect to the port
950 */
951 if (protocol == IPPROTO_TCP)
952 check_port_tcp(port);
953 else
954 check_port_udp(port);
955 }
956 else
957 {
958#ifdef TEST_ONLY
959 if (portchk_debug)
960 perror(_("bind"));
961#else
962 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
963 sh_error_message(errno), _("bind"));
964#endif
965 }
966 close (sock);
967 }
968 }
969 return 0;
970}
971
972static int sh_portchk_scan_ports_tcp (int min_port, int max_port)
973{
974 return sh_portchk_scan_ports_generic (min_port, max_port, SOCK_STREAM, IPPROTO_TCP);
975}
976
977static int sh_portchk_scan_ports_udp (int min_port, int max_port)
978{
979 return sh_portchk_scan_ports_generic (min_port, max_port, SOCK_DGRAM, IPPROTO_UDP);
980}
981
982/* Subroutine to add an interface
983 */
984static int sh_portchk_add_interface (const char * str)
985{
986 struct in_addr haddr;
987 char errbuf[256];
988
989 if (iface_initialized == 0)
990 {
991 iface_list.used = 0;
992 iface_initialized = 1;
993 }
994
995 if (0 == inet_aton(str, &haddr))
996 return -1;
997
998 if (iface_list.used == SH_IFACE_MAX)
999 return -1;
1000
1001 sl_snprintf(errbuf, sizeof(errbuf), _("interface: %s"), inet_ntoa(haddr));
1002 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1003 errbuf, _("sh_portchk_add_interface"));
1004
1005 memcpy (&(iface_list.iface[iface_list.used].s_addr), &(haddr.s_addr), sizeof(in_addr_t));
1006 ++iface_list.used;
1007
1008 return 0;
1009}
1010
1011
1012/* Subroutine to add a required or optional port/service
1013 */
1014static int sh_portchk_add_required_port_generic (char * service, char * interface, int type)
1015{
1016 char buf[256];
1017 char proto[4];
1018 char * p;
1019 char * endptr;
1020 unsigned long int port;
1021 struct in_addr haddr;
1022 struct sh_portentry * portent;
1023
1024 if (0 == inet_aton(interface, &haddr))
1025 return -1;
1026
1027 sl_strlcpy (buf, service, sizeof(buf));
1028
1029 p = strchr(buf, '/');
1030 if (!p)
1031 return -1;
1032 if (0 == strcmp(p, _("/tcp")))
1033 sl_strlcpy(proto, _("tcp"), sizeof(proto));
1034 else if (0 == strcmp(p, _("/udp")))
1035 sl_strlcpy(proto, _("udp"), sizeof(proto));
1036 else
1037 return -1;
1038
1039 *p = '\0';
1040 port = strtoul(buf, &endptr, 0);
1041
1042 if (*endptr != '\0')
1043 {
1044 portent = sh_portchk_get_from_list (proto, -1, haddr, buf);
1045 if (!portent)
1046 sh_portchk_add_to_list (proto, -1, haddr, buf, type, SH_PORT_UNKN);
1047 else
1048 {
1049#ifdef TEST_ONLY
1050 fprintf(stderr, "** WARNING: duplicate port definition %s/%s\n", buf, proto);
1051#else
1052 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1053 _("duplicate port definition"), _("sh_portchk_add_required_port_generic"));
1054#endif
1055 return -1;
1056 }
1057 }
1058 else if (port <= 65535)
1059 {
1060 portent = sh_portchk_get_from_list (proto, port, haddr, NULL);
1061 if (!portent)
1062 sh_portchk_add_to_list (proto, port, haddr, NULL, type, SH_PORT_UNKN);
1063 else
1064 {
1065#ifdef TEST_ONLY
1066 fprintf(stderr, "** WARNING: duplicate port definition %lu/%s\n", port, proto);
1067#else
1068 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1069 _("duplicate port definition"), _("sh_portchk_add_required_port_generic"));
1070#endif
1071 return -1;
1072 }
1073 }
1074 else
1075 return -1;
1076
1077 return 0;
1078}
1079
1080/* Internal interface to add required or optional ports as 'iface:portlist'
1081 */
1082static int sh_portchk_add_required_generic (const char * str, int type)
1083{
1084 size_t len;
1085 size_t ll = 0;
1086
1087 char * interface = NULL;
1088 char * list;
1089 char * p;
1090
1091 if (!str)
1092 return -1;
1093
1094 if (strchr(str, ':'))
1095 {
1096 len = strlen(str);
1097 for (ll = 0; ll < len; ++ll)
1098 {
1099 if (str[ll] == ':' || str[ll] == ' ' || str[ll] == '\t')
1100 {
1101 interface = SH_ALLOC(ll+1);
1102 sl_strlcpy(interface, str, ll+1);
1103 interface[ll] = '\0';
1104 while (str[ll] == ':' || str[ll] == ' ' || str[ll] == '\t')
1105 ++ll;
1106 break;
1107 }
1108 }
1109 }
1110 else
1111 {
1112 interface = SH_ALLOC(8);
1113 sl_strlcpy(interface, _("0.0.0.0"), 8);
1114 interface[7] = '\0';
1115 while (str[ll] == ' ' || str[ll] == '\t')
1116 ++ll;
1117 }
1118
1119 if (!interface)
1120 return -1;
1121
1122 if (str[ll] == '\0')
1123 {
1124 SH_FREE(interface);
1125 return -1;
1126 }
1127
1128 if (portchk_debug)
1129 fprintf(stderr, "add ports for interface: %s\n", interface);
1130
1131 list = sh_util_strdup(&str[ll]);
1132 p = strtok (list, " ,\t");
1133 if (!p)
1134 {
1135 SH_FREE(interface);
1136 SH_FREE(list);
1137 return -1;
1138 }
1139 while (p)
1140 {
1141 if (-1 == sh_portchk_add_required_port_generic (p, interface, type))
1142 {
1143 SH_FREE(interface);
1144 SH_FREE(list);
1145 return -1;
1146 }
1147 p = strtok (NULL, " ,\t");
1148 }
1149 SH_FREE(interface);
1150 SH_FREE(list);
1151 return 0;
1152}
1153
1154/* User interface to add required ports as 'iface:portlist'
1155 */
1156static int sh_portchk_add_required (const char * str)
1157{
1158 return sh_portchk_add_required_generic (str, SH_PORT_REQ);
1159}
1160
1161/* User interface to add optional ports as 'iface:portlist'
1162 */
1163static int sh_portchk_add_optional (const char * str)
1164{
1165 return sh_portchk_add_required_generic (str, SH_PORT_OPT);
1166}
1167
1168/* Interface to run port check
1169 */
1170int sh_portchk_check ()
1171{
1172 int min_port = 0;
1173
[78]1174 if (sh_portchk_active != S_FALSE)
[67]1175 {
[78]1176 sh_portchk_reset_lists();
1177 if (0 != geteuid())
1178 {
1179 min_port = 1024;
[67]1180#ifdef TEST_ONLY
[78]1181 fprintf(stderr, "** WARNING not scanning ports < 1024\n");
[67]1182#else
[78]1183 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1184 _("not scanning ports below 1024"), _("sh_portchk_check"));
[67]1185#endif
[78]1186 }
1187 if (sh_portchk_check_udp == 1)
1188 sh_portchk_scan_ports_udp(min_port, -1);
1189 sh_portchk_scan_ports_tcp(min_port, -1);
1190 sh_portchk_check_list (&portlist_tcp, "tcp", SH_PORT_REPORT);
1191 if (sh_portchk_check_udp == 1)
1192 sh_portchk_check_list (&portlist_udp, "udp", SH_PORT_REPORT);
[67]1193 }
1194 return 0;
1195}
1196#endif
1197
1198#ifdef SH_CUTEST
1199#include "CuTest.h"
1200
1201void Test_portcheck_lists (CuTest *tc)
1202{
[73]1203#if defined(SH_USE_PORTCHECK) && (defined(SH_WITH_CLIENT) || defined(SH_STANDALONE))
[67]1204 struct in_addr haddr_local;
1205 struct sh_portentry * portent;
1206
1207 CuAssertTrue(tc, 0 != inet_aton("127.0.0.1", &haddr_local));
1208
1209 sh_portchk_add_to_list ("tcp", 8000, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
1210
1211 portent = sh_portchk_get_from_list("tcp", 8000, haddr_local, NULL);
1212 CuAssertPtrNotNull(tc, portent);
1213
1214 CuAssertTrue(tc, portent->port == 8000);
1215 CuAssertTrue(tc, 0 == strcmp("127.0.0.1", portent->interface));
1216 CuAssertTrue(tc, portent->status == SH_PORT_UNKN);
1217 CuAssertTrue(tc, portent->flag == SH_PORT_NOT);
1218
1219 sh_portchk_check_list (&portlist_tcp, "tcp", SH_PORT_NOREPT);
1220
1221 CuAssertTrue(tc, NULL == portlist_tcp);
1222
1223 sh_portchk_add_to_list ("tcp", 8000, haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
1224 sh_portchk_add_to_list ("tcp", 8001, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
1225 sh_portchk_add_to_list ("tcp", 8002, haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
1226 sh_portchk_add_to_list ("tcp", 8003, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
1227 sh_portchk_add_to_list ("tcp", -1, haddr_local, "foo1", SH_PORT_NOT, SH_PORT_UNKN);
1228 sh_portchk_add_to_list ("tcp", -1, haddr_local, "foo2", SH_PORT_REQ, SH_PORT_UNKN);
1229 sh_portchk_add_to_list ("tcp", -1, haddr_local, "foo3", SH_PORT_NOT, SH_PORT_UNKN);
1230 sh_portchk_add_to_list ("tcp", -1, haddr_local, "foo4", SH_PORT_REQ, SH_PORT_UNKN);
1231
1232 sh_portchk_check_list (&portlist_tcp, "tcp", SH_PORT_NOREPT);
1233
1234 CuAssertPtrNotNull(tc, portlist_tcp);
1235
1236 portent = sh_portchk_get_from_list("tcp", 8000, haddr_local, NULL);
1237 CuAssertPtrNotNull(tc, portent);
1238
1239 portent = sh_portchk_get_from_list("tcp", 8001, haddr_local, NULL);
1240 CuAssertTrue(tc, NULL == portent);
1241
1242 portent = sh_portchk_get_from_list("tcp", 8002, haddr_local, NULL);
1243 CuAssertPtrNotNull(tc, portent);
1244
1245 portent = sh_portchk_get_from_list("tcp", 8003, haddr_local, NULL);
1246 CuAssertTrue(tc, NULL == portent);
1247
1248 portent = sh_portchk_get_from_list("tcp", 8000, haddr_local, "foo1");
1249 CuAssertTrue(tc, NULL == portent);
1250
1251 portent = sh_portchk_get_from_list("tcp", 8000, haddr_local, "foo2");
1252 CuAssertPtrNotNull(tc, portent);
1253 CuAssertTrue(tc, 0 == strcmp(portent->service, "foo2"));
1254
1255 portent = sh_portchk_get_from_list("tcp", 8000, haddr_local, "foo3");
1256 CuAssertTrue(tc, NULL == portent);
1257
1258 portent = sh_portchk_get_from_list("tcp", 8000, haddr_local, "foo4");
1259 CuAssertPtrNotNull(tc, portent);
1260 CuAssertTrue(tc, 0 == strcmp(portent->service, "foo4"));
1261#else
1262 (void) tc; /* fix compiler warning */
1263#endif
1264 return;
1265}
1266#endif
1267
1268#ifdef TEST_ONLY
1269
1270void usage (char * pname)
1271{
1272 printf ("%s [-r|--required interface:portlist][-o|--optional interface:portlist][--no-udp][-d|--debug] hostname\n\n", pname);
1273 printf (" Check local host for open ports; Version %s\n\n", PORTCHK_VERSION);
1274 printf (" Interface: Numeric address for an interface, e.g. 127.0.0.1\n");
1275 printf (" Portlist: List of ports or services, e.g. 22/tcp,nfs/udp,nlockmgr/udp\n");
1276 printf (" required -> must be open\n");
1277 printf (" optional -> may be open or closed\n");
1278 printf (" RPC services must be specified with service **name**, others with **port number**\n\n");
1279 printf (" Example:\n");
1280 printf (" %s --required 192.168.1.2:22/tcp,nfs/udp,nlockmgr/udp\n\n", pname);
1281 return;
1282}
1283
1284int main(int argc, char *argv[])
1285{
1286 char * pname = argv[0];
1287
1288
1289 /*
1290 test_lists();
1291
1292 portlist_tcp = sh_portchk_kill_list (portlist_tcp);
1293 portlist_udp = sh_portchk_kill_list (portlist_udp);
1294 */
1295
1296 // sh_portchk_add_required ("127.0.0.1 : nlockmgr/tcp, 5308/tcp, nfs/tcp");
1297
1298 while (argc > 1 && argv[1][0] == '-')
1299 {
1300 if (0 == strcmp(argv[1], "--help") || 0 == strcmp(argv[1], "-h"))
1301 {
1302 usage(pname);
1303 exit (0);
1304 }
1305 else if (0 == strcmp(argv[1], "--required") || 0 == strcmp(argv[1], "-r"))
1306 {
1307 if (argc < 3)
1308 {
1309 usage(pname);
1310 exit (1);
1311 }
1312 sh_portchk_add_required (argv[2]);
1313 --argc; ++argv;
1314 }
1315 else if (0 == strcmp(argv[1], "--optional") || 0 == strcmp(argv[1], "-o"))
1316 {
1317 if (argc < 3)
1318 {
1319 usage(pname);
1320 exit (1);
1321 }
1322 sh_portchk_add_optional (argv[2]);
1323 --argc; ++argv;
1324 }
1325 else if (0 == strcmp(argv[1], "--no-udp"))
1326 {
1327 sh_portchk_check_udp = 0;
1328 }
1329 else if (0 == strcmp(argv[1], "--debug") || 0 == strcmp(argv[1], "-d"))
1330 {
1331 portchk_debug = 1;
1332 }
1333 else
1334 {
1335 usage(pname);
1336 exit (1);
1337 }
1338 --argc; ++argv;
1339 }
1340
1341 if (argc < 2)
1342 {
1343 usage(pname);
1344 exit (1);
1345 }
1346
1347 portchk_hostname = argv[1];
1348
1349 if (0 != sh_portchk_init ())
1350 {
1351 usage(pname);
1352 exit (1);
1353 }
1354
1355 sh_portchk_check();
1356
1357 /*
1358 sleep(10);
1359
1360 sh_portchk_check();
1361 */
1362
1363 return 0;
1364}
1365#endif
Note: See TracBrowser for help on using the repository browser.