source: trunk/src/sh_portcheck.c@ 216

Last change on this file since 216 was 212, checked in by katerina, 16 years ago

Lock baseline database (ticket #139) and allow list as input for PortCheckInterface (ticket #140).
  • Property svn:executable set to *
File size: 44.2 KB
Line 
1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 2006 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20/***************************************************************************
21 *
22 * This file provides a module for samhain to check for open ports
23 * on the local machine.
24 *
25 */
26
27
28/* #define TEST_ONLY */
29#ifndef TEST_ONLY
30#include "config_xor.h"
31#endif
32
33#include <stdio.h>
34#include <string.h>
35#include <sys/types.h>
36#include <sys/socket.h>
37#include <netinet/in.h>
38#include <arpa/inet.h>
39#include <errno.h>
40#include <unistd.h>
41#include <fcntl.h>
42
43#define PORTCHK_VERSION "1.0"
44
45#if defined(TEST_ONLY) || (defined(SH_USE_PORTCHECK) && (defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)))
46
47
48#define PORTMAP
49#include <rpc/rpc.h>
50#ifdef HAVE_RPC_RPCENT_H
51#include <rpc/rpcent.h>
52#endif
53#include <rpc/pmap_clnt.h>
54#include <rpc/pmap_prot.h>
55#include <netdb.h>
56
57/*
58 * struct pmaplist {
59 * struct pmap pml_map;
60 * struct pmaplist *pml_next;
61 * };
62 */
63
64/* struct pmap {
65 * long unsigned pm_prog;
66 * long unsigned pm_vers;
67 * long unsigned pm_prot;
68 * long unsigned pm_port;
69 * };
70 */
71
72/* TIME_WAIT ? 60-240 seconds */
73
74/* the size of an interface string
75 */
76#define SH_INTERFACE_SIZE 16
77
78#define SH_PORT_NOT 0
79#define SH_PORT_REQ 1
80#define SH_PORT_OPT 2
81#define SH_PORT_IGN 3
82#define SH_PORT_BLACKLIST 4
83
84#define SH_PORT_MISS 0
85#define SH_PORT_ISOK 1
86#define SH_PORT_UNKN 2
87
88#define SH_PORT_NOREPT 0
89#define SH_PORT_REPORT 1
90
91#define SH_PROTO_TCP 0
92#define SH_PROTO_UDP 1
93#define SH_PROTO_STR(a) (((a) == IPPROTO_TCP) ? _("tcp") : _("udp"))
94
95struct sh_portentry {
96 int port;
97 char interface[SH_INTERFACE_SIZE];
98 char * service;
99 char * error;
100 int flag; /* required or not */
101 int status; /* missing or not */
102 struct sh_portentry * next;
103};
104
105static struct sh_portentry * portlist_tcp = NULL;
106static struct sh_portentry * portlist_udp = NULL;
107
108struct sh_port {
109 int port;
110 struct in_addr haddr;
111 struct sh_port * next;
112};
113
114static struct sh_port * blacklist_tcp = NULL;
115static struct sh_port * blacklist_udp = NULL;
116
117#define SH_PORTCHK_INTERVAL 300
118
119static int sh_portchk_check_udp = 1;
120static int sh_portchk_active = 1;
121static int sh_portchk_interval = SH_PORTCHK_INTERVAL;
122#if !defined(TEST_ONLY)
123
124#define FIL__ _("sh_portcheck.c")
125#include "samhain.h"
126#include "sh_error.h"
127#include "sh_mem.h"
128#include "sh_calls.h"
129#include "sh_utils.h"
130#include "sh_modules.h"
131#define SH_NEED_GETHOSTBYXXX
132#include "sh_static.h"
133#include "sh_pthread.h"
134
135SH_MUTEX_STATIC(mutex_port_check, PTHREAD_MUTEX_INITIALIZER);
136
137static int sh_portchk_severity = SH_ERR_SEVERE;
138
139extern char * sh_port2proc_query(int proto, struct in_addr * saddr, int sport,
140 unsigned long * pid, char * user, size_t userlen);
141extern int sh_port2proc_prepare();
142
143#endif
144
145/* Exported interface to add ignoreable ports as 'iface:portlist'
146 */
147static int sh_portchk_add_ignore (const char * str);
148
149/* Exported interface to add required ports as 'iface:portlist'
150 */
151static int sh_portchk_add_required (const char * str);
152
153/* Exported interface to add optional ports as 'iface:portlist'
154 */
155static int sh_portchk_add_optional (const char * str);
156
157/* Exported interface to add blacklisted ports as 'iface:portlist'
158 */
159static int sh_portchk_add_blacklist (const char * str);
160
161/* Exported interface to add an ethernet interface
162 */
163static int sh_portchk_add_interface (const char * str);
164
165/* verify whether port/interface is blacklisted (do not check)
166 */
167static int sh_portchk_is_blacklisted(int port, struct in_addr haddr, int proto);
168
169#ifndef TEST_ONLY
170
171static int sh_portchk_set_interval (const char * c)
172{
173 int retval = 0;
174 long val;
175
176 SL_ENTER(_("sh_portchk_set_interval"));
177 val = strtol (c, (char **)NULL, 10);
178 if (val <= 0)
179 {
180 SH_MUTEX_LOCK(mutex_thread_nolog);
181 sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
182 _("port check interval"), c);
183 SH_MUTEX_UNLOCK(mutex_thread_nolog);
184 retval = -1;
185 }
186
187 sh_portchk_interval = (time_t) val;
188 SL_RETURN(0, _("sh_portchk_set_interval"));
189}
190
191
192static int sh_portchk_set_active (const char * str)
193{
194 return sh_util_flagval(str, &sh_portchk_active);
195}
196
197static int sh_portchk_set_udp (const char * str)
198{
199 return sh_util_flagval(str, &sh_portchk_check_udp);
200}
201
202static int sh_portchk_set_severity (const char * str)
203{
204 char tmp[32];
205 tmp[0] = '='; tmp[1] = '\0';
206 sl_strlcat (tmp, str, 32);
207 return sh_error_set_level (tmp, &sh_portchk_severity);
208}
209
210sh_rconf sh_portchk_table[] = {
211 {
212 N_("severityportcheck"),
213 sh_portchk_set_severity,
214 },
215 {
216 N_("portcheckrequired"),
217 sh_portchk_add_required,
218 },
219 {
220 N_("portcheckoptional"),
221 sh_portchk_add_optional,
222 },
223 {
224 N_("portcheckignore"),
225 sh_portchk_add_ignore,
226 },
227 {
228 N_("portcheckskip"),
229 sh_portchk_add_blacklist,
230 },
231 {
232 N_("portcheckactive"),
233 sh_portchk_set_active,
234 },
235 {
236 N_("portcheckinterface"),
237 sh_portchk_add_interface,
238 },
239 {
240 N_("portcheckinterval"),
241 sh_portchk_set_interval,
242 },
243 {
244 N_("portcheckudp"),
245 sh_portchk_set_udp,
246 },
247 {
248 NULL,
249 NULL
250 }
251};
252
253#endif
254
255/* Interface to initialize port check
256 */
257int sh_portchk_init (struct mod_type * arg);
258
259/* Interface to reset port check
260 */
261int sh_portchk_reset (void);
262
263/* Interface to run port check
264 */
265int sh_portchk_check (void);
266
267
268static char * check_services (int port, int proto);
269
270#ifdef TEST_ONLY
271
272static int portchk_debug = 0;
273#define SH_ALLOC malloc
274#define SH_FREE free
275#define sh_util_strdup strdup
276#define sl_strlcpy strncpy
277#define _(a) a
278
279#else
280
281static int portchk_debug = 0;
282
283#endif
284
285static void sh_portchk_add_to_list (int proto,
286 int port, struct in_addr haddr, char * service,
287 int flag, int status)
288{
289 struct sh_portentry * new = SH_ALLOC (sizeof(struct sh_portentry));
290
291 if (portchk_debug)
292 fprintf(stderr, _("add to list: port %d/%s %d %d (%s)\n"),
293 port, SH_PROTO_STR(proto), flag, status, service ? service : _("undef"));
294
295 new->port = port;
296 sl_strlcpy (new->interface, inet_ntoa(haddr), SH_INTERFACE_SIZE);
297 new->status = status;
298 new->flag = flag;
299
300 new->error = NULL;
301
302 if (service)
303 new->service = sh_util_strdup (service);
304 else
305 new->service = NULL;
306 if (proto == IPPROTO_TCP)
307 {
308 new->next = portlist_tcp;
309 portlist_tcp = new;
310 }
311 else
312 {
313 new->next = portlist_udp;
314 portlist_udp = new;
315 }
316 return;
317}
318
319/* Reset the list by setting all entries to UNKN.
320 * In the next cycle we will check, and set found ports to ISOK.
321 * Thereafter, we check for entries that are still UNKN.
322 */
323static void sh_portchk_reset_lists (void)
324{
325 struct sh_portentry * portlist;
326
327 portlist = portlist_tcp;
328 while (portlist)
329 {
330 if (portlist->status != SH_PORT_MISS)
331 portlist->status = SH_PORT_UNKN;
332 portlist = portlist->next;
333 }
334 portlist = portlist_udp;
335 while (portlist)
336 {
337 if (portlist->status != SH_PORT_MISS)
338 portlist->status = SH_PORT_UNKN;
339 portlist = portlist->next;
340 }
341 return;
342}
343
344static struct sh_portentry * sh_portchk_kill_list (struct sh_portentry * head)
345{
346 if (head)
347 {
348 if (head->next)
349 sh_portchk_kill_list (head->next);
350
351 if (head->service)
352 SH_FREE(head->service);
353 SH_FREE(head);
354 }
355 return NULL;
356}
357
358static struct sh_port * sh_portchk_kill_blacklist (struct sh_port * head)
359{
360 if (head)
361 {
362 if (head->next)
363 sh_portchk_kill_blacklist (head->next);
364
365 SH_FREE(head);
366 }
367 return NULL;
368}
369
370/* These variables are not used anywhere. They only exist
371 * to assign &pre, &ptr to them, which keeps gcc from
372 * putting it into a register, and avoids the 'clobbered
373 * by longjmp' warning. And no, 'volatile' proved insufficient.
374 */
375static void * sh_dummy_pre = NULL;
376static void * sh_dummy_ptr = NULL;
377
378/* check the list of open ports for any that are marked as UNKN
379 */
380static void sh_portchk_check_list (struct sh_portentry ** head, int proto, int report)
381{
382 struct sh_portentry * ptr = *head;
383 struct sh_portentry * pre = *head;
384 char errbuf[256];
385
386 /* Take the address to keep gcc from putting them into registers.
387 * Avoids the 'clobbered by longjmp' warning.
388 */
389 sh_dummy_pre = (void*) &pre;
390 sh_dummy_ptr = (void*) &ptr;
391
392 while (ptr)
393 {
394 if (portchk_debug && report)
395 fprintf(stderr, _("check list: port %d/%s %d %d\n"),
396 ptr->port, SH_PROTO_STR(proto), ptr->flag, ptr->status);
397
398 if (ptr->status == SH_PORT_UNKN)
399 {
400 /* Don't report missing ports that are marked as optional
401 */
402 if (ptr->flag != SH_PORT_OPT && ptr->flag != SH_PORT_IGN)
403 {
404 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
405 ptr->interface, ptr->port, SH_PROTO_STR(proto),
406 ptr->service ? ptr->service : check_services(ptr->port, proto));
407#ifdef TEST_ONLY
408 if (report == SH_PORT_REPORT)
409 fprintf(stderr, _("%s\n"), errbuf);
410#else
411 if (report == SH_PORT_REPORT)
412 {
413 SH_MUTEX_LOCK(mutex_thread_nolog);
414 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
415 MSG_PORT_MISS, errbuf);
416 SH_MUTEX_UNLOCK(mutex_thread_nolog);
417 }
418#endif
419 }
420
421 ptr->status = SH_PORT_MISS;
422
423 if ((ptr->flag != SH_PORT_REQ) && (ptr->flag != SH_PORT_OPT) && (ptr->flag != SH_PORT_IGN))
424 {
425 if (portchk_debug && report)
426 fprintf(stderr, _("removing: port %d/%s %d %d\n"),
427 ptr->port, SH_PROTO_STR(proto), ptr->flag, ptr->status);
428
429 if (ptr == *head)
430 {
431 *head = ptr->next;
432 if (ptr->service)
433 SH_FREE(ptr->service);
434 SH_FREE(ptr);
435 ptr = *head;
436 pre = *head;
437 continue;
438 }
439 else if (ptr->next == NULL)
440 {
441 pre->next = NULL;
442 if (ptr->service)
443 SH_FREE(ptr->service);
444 SH_FREE(ptr);
445 return;
446 }
447 else
448 {
449 pre->next = ptr->next;
450 if (ptr->service)
451 SH_FREE(ptr->service);
452 SH_FREE(ptr);
453 ptr = pre->next;
454 continue;
455 }
456 }
457 }
458 pre = ptr;
459 ptr = ptr->next;
460 }
461 return;
462}
463
464
465static struct sh_portentry * sh_portchk_get_from_list (int proto, int port,
466 struct in_addr haddr, char * service)
467{
468 struct sh_portentry * portlist;
469 char iface_all[8];
470
471 sl_strlcpy (iface_all, _("0.0.0.0"), sizeof(iface_all));
472
473 if (proto == IPPROTO_TCP)
474 portlist = portlist_tcp;
475 else
476 portlist = portlist_udp;
477
478 if (service)
479 {
480 while (portlist)
481 {
482 if (portlist->service &&
483 0 == strcmp(service, portlist->service) &&
484 (0 == strcmp(portlist->interface, inet_ntoa(haddr)) ||
485 0 == strcmp(portlist->interface, iface_all)))
486 return portlist;
487 portlist = portlist->next;
488 }
489 }
490 else
491 {
492 while (portlist)
493 {
494 if (port == portlist->port &&
495 (0 == strcmp(portlist->interface, inet_ntoa(haddr)) ||
496 0 == strcmp(portlist->interface, iface_all)))
497 return portlist;
498 portlist = portlist->next;
499 }
500 }
501 return NULL;
502}
503
504
505static void sh_portchk_cmp_to_list (int proto, int port, struct in_addr haddr, char * service)
506{
507 struct sh_portentry * portent;
508 char errbuf[256];
509
510
511 portent = sh_portchk_get_from_list (proto, port, haddr, service);
512
513 if (service)
514 {
515 if (!portent)
516 {
517 char * path;
518 unsigned long qpid;
519 char user[USER_MAX];
520
521 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
522 inet_ntoa(haddr), port, SH_PROTO_STR(proto), service);
523#ifdef TEST_ONLY
524 fprintf(stderr, _("open port: %s:%d/%s (%s)\n"),
525 inet_ntoa(haddr), port, SH_PROTO_STR(proto), service);
526#else
527 path = sh_port2proc_query(proto, &haddr, port, &qpid, user, sizeof(user));
528 SH_MUTEX_LOCK(mutex_thread_nolog);
529 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
530 MSG_PORT_NEW, errbuf, path, qpid, user);
531 SH_MUTEX_UNLOCK(mutex_thread_nolog);
532 SH_FREE(path);
533#endif
534 /*
535 * was not there, thus it is not in 'required' or 'optional' list
536 */
537 sh_portchk_add_to_list (proto, port, haddr, service, SH_PORT_NOT, SH_PORT_ISOK);
538 }
539 else if (portent->status == SH_PORT_MISS && portent->flag != SH_PORT_IGN)
540 {
541 char * path;
542 unsigned long qpid;
543 char user[USER_MAX];
544
545 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s), was %d/%s"),
546 inet_ntoa(haddr), port, SH_PROTO_STR(proto), service, portent->port, SH_PROTO_STR(proto));
547#ifdef TEST_ONLY
548 fprintf(stderr, _("service: %s\n"), errbuf);
549#else
550 path = sh_port2proc_query(proto, &haddr, port, &qpid, user, sizeof(user));
551 SH_MUTEX_LOCK(mutex_thread_nolog);
552 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
553 MSG_PORT_RESTART, errbuf, path, qpid, user);
554 SH_MUTEX_UNLOCK(mutex_thread_nolog);
555 SH_FREE(path);
556#endif
557
558 portent->status = SH_PORT_ISOK;
559 }
560 else if (port != portent->port && (-1) != portent->port)
561 {
562 char * path;
563 unsigned long qpid;
564 char user[USER_MAX];
565
566 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s), was %d/%s"),
567 inet_ntoa(haddr), port, SH_PROTO_STR(proto), service, portent->port, SH_PROTO_STR(proto));
568#ifdef TEST_ONLY
569 fprintf(stderr, _("service: %s\n"), errbuf);
570#else
571 path = sh_port2proc_query(proto, &haddr, port, &qpid, user, sizeof(user));
572 SH_MUTEX_LOCK(mutex_thread_nolog);
573 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
574 MSG_PORT_NEWPORT, errbuf, path, qpid, user);
575 SH_MUTEX_UNLOCK(mutex_thread_nolog);
576 SH_FREE(path);
577#endif
578 portent->port = port;
579 portent->status = SH_PORT_ISOK;
580 }
581 else
582 {
583 portent->status = SH_PORT_ISOK;
584 }
585 }
586 else
587 {
588 if (!portent)
589 {
590 char * path;
591 unsigned long qpid;
592 char user[USER_MAX];
593
594 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
595 inet_ntoa(haddr), port, SH_PROTO_STR(proto), check_services(port, proto));
596#ifdef TEST_ONLY
597 fprintf(stderr, _("open port: %s:%d/%s (%s)\n"),
598 inet_ntoa(haddr), port, SH_PROTO_STR(proto), check_services(port, proto));
599#else
600 path = sh_port2proc_query(proto, &haddr, port, &qpid, user, sizeof(user));
601 SH_MUTEX_LOCK(mutex_thread_nolog);
602 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
603 MSG_PORT_NEW, errbuf, path, qpid, user);
604 SH_MUTEX_UNLOCK(mutex_thread_nolog);
605 SH_FREE(path);
606#endif
607
608 /* was not there, thus it is not in 'required' or 'optional' list
609 */
610 sh_portchk_add_to_list (proto, port, haddr, service, SH_PORT_NOT, SH_PORT_ISOK);
611 }
612 else if (portent->status == SH_PORT_MISS && portent->flag != SH_PORT_IGN)
613 {
614 char * path;
615 unsigned long qpid;
616 char user[USER_MAX];
617
618 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
619 inet_ntoa(haddr), port, SH_PROTO_STR(proto), check_services(port, proto));
620#ifdef TEST_ONLY
621 fprintf(stderr, _("port : %s\n"), errbuf);
622#else
623 path = sh_port2proc_query(proto, &haddr, port, &qpid, user, sizeof(user));
624 SH_MUTEX_LOCK(mutex_thread_nolog);
625 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
626 MSG_PORT_RESTART, errbuf, path, qpid, user);
627 SH_MUTEX_UNLOCK(mutex_thread_nolog);
628 SH_FREE(path);
629#endif
630
631 portent->status = SH_PORT_ISOK;
632 }
633 else
634 {
635 portent->status = SH_PORT_ISOK;
636 }
637 }
638
639 return;
640}
641
642
643/* Returns a static buffer containing the name of the service
644 * running on port <port> (from /etc/services)
645 * Returns NULL on failure
646 */
647static char * check_services (int port, int proto)
648{
649 static char buf[256];
650 struct servent * service = getservbyport(htons(port), SH_PROTO_STR(proto));
651
652 if (service && service->s_name && service->s_name[0] != '\0')
653 {
654 snprintf (buf, sizeof(buf), _("maybe_%s"), service->s_name);
655 }
656 else
657 {
658 snprintf (buf, sizeof(buf), "%s",_("unknown"));
659 }
660 return buf;
661}
662
663/* Returns a static buffer containing the name of the service
664 * running on port <port> at <address> (from portmap daemon)
665 * Returns NULL on failure
666 */
667static char * check_rpc_list (int port, struct sockaddr_in * address,
668 unsigned long prot)
669{
670 struct pmaplist * head;
671 struct rpcent *r;
672 static char buf[256];
673
674 head = pmap_getmaps(address);
675
676 if (head)
677 {
678 do /* while (head != NULL) */
679 {
680 if ((head->pml_map.pm_prot == prot) &&
681 (port == (int)head->pml_map.pm_port))
682 {
683 r = getrpcbynumber((int)head->pml_map.pm_prog);
684 if (r && r->r_name && r->r_name[0] != '\0')
685 {
686 snprintf (buf, sizeof(buf), "%s", r->r_name);
687 return buf;
688 }
689 else
690 {
691 snprintf (buf, sizeof(buf), "RPC_%lu",
692 (unsigned long)head->pml_map.pm_prog);
693 return buf;
694 }
695 }
696 head = head->pml_next;
697 }
698 while (head != NULL);
699 }
700
701 return NULL;
702}
703
704static int check_port_udp_internal (int fd, int port, struct in_addr haddr)
705{
706 struct sockaddr_in sinr;
707 /* struct in_addr haddr; */
708 int retval;
709 char * p;
710 char buf[8];
711#ifndef TEST_ONLY
712 char errmsg[256];
713 int nerr;
714#endif
715 char errbuf[SH_ERRBUF_SIZE];
716
717 /* inet_aton(interface, &haddr); */
718
719 sinr.sin_family = AF_INET;
720 sinr.sin_port = htons (port);
721 sinr.sin_addr = haddr;
722
723 do {
724 retval = connect(fd, (struct sockaddr *) &sinr, sizeof(sinr));
725 } while (retval < 0 && (errno == EINTR || errno == EINPROGRESS));
726
727 if (retval == -1)
728 {
729#ifdef TEST_ONLY
730 if (portchk_debug)
731 perror(_("connect"));
732#else
733 nerr = errno;
734 sl_snprintf(errmsg, sizeof(errmsg), _("check port: %5d/udp on %15s: %s"),
735 port, inet_ntoa(haddr), sh_error_message(errno, errbuf, sizeof(errbuf)));
736 SH_MUTEX_LOCK(mutex_thread_nolog);
737 sh_error_handle((-1), FIL__, __LINE__, nerr, MSG_E_SUBGEN,
738 errmsg, _("connect"));
739 SH_MUTEX_UNLOCK(mutex_thread_nolog);
740#endif
741 }
742 else
743 {
744 do {
745 retval = send (fd, buf, 0, 0);
746 } while (retval < 0 && errno == EINTR);
747
748 if (retval == -1 && errno == ECONNREFUSED)
749 {
750 if (portchk_debug)
751 fprintf(stderr, _("check port: %5d/udp on %15s established/time_wait\n"),
752 port, inet_ntoa(haddr));
753 }
754 else
755 {
756 /* Only the second send() may catch the error
757 */
758 do {
759 retval = send (fd, buf, 0, 0);
760 } while (retval < 0 && errno == EINTR);
761
762 if (retval == -1 && errno == ECONNREFUSED)
763 {
764 if (portchk_debug)
765 fprintf(stderr, _("check port: %5d/udp on %15s established/time_wait\n"),
766 port, inet_ntoa(haddr));
767 }
768 else if (retval != -1)
769 {
770 /* Try to get service name from portmap
771 */
772 p = check_rpc_list (port, &sinr, IPPROTO_UDP);
773
774 sh_portchk_cmp_to_list (IPPROTO_UDP, port, haddr, p ? p : NULL);
775
776 /* If not an RPC service, try to get name from /etc/services
777 */
778 if (!p)
779 p = check_services(port, IPPROTO_UDP);
780
781 if (portchk_debug)
782 fprintf(stderr, _("check port: %5d/udp on %15s open %s\n"),
783 port, inet_ntoa(haddr), p);
784
785 }
786 }
787 }
788 close (fd);
789 return 0;
790}
791
792static int check_port_tcp_internal (int fd, int port, struct in_addr haddr)
793{
794 struct sockaddr_in sinr;
795 /* struct in_addr haddr; */
796 int retval;
797 int flags;
798 char * p;
799#ifndef TEST_ONLY
800 char errmsg[256];
801 int nerr;
802#endif
803 char errbuf[SH_ERRBUF_SIZE];
804
805 /* inet_aton(interface, &haddr); */
806
807 sinr.sin_family = AF_INET;
808 sinr.sin_port = htons (port);
809 sinr.sin_addr = haddr;
810
811 do {
812 retval = connect(fd, (struct sockaddr *) &sinr, sizeof(sinr));
813 } while (retval < 0 && (errno == EINTR || errno == EINPROGRESS));
814
815 if (retval == -1 && errno == ECONNREFUSED)
816 {
817 if (portchk_debug)
818 fprintf(stderr, _("check port: %5d on %15s established/time_wait\n"),
819 port, inet_ntoa(haddr));
820 }
821 else if (retval == -1)
822 {
823#ifdef TEST_ONLY
824 if (portchk_debug)
825 perror(_("connect"));
826#else
827 nerr = errno;
828 sl_snprintf(errmsg, sizeof(errmsg), _("check port: %5d/tcp on %15s: %s"),
829 port, inet_ntoa(haddr), sh_error_message(errno, errbuf, sizeof(errbuf)));
830 SH_MUTEX_LOCK(mutex_thread_nolog);
831 sh_error_handle((-1), FIL__, __LINE__, nerr, MSG_E_SUBGEN,
832 errmsg, _("connect"));
833 SH_MUTEX_UNLOCK(mutex_thread_nolog);
834#endif
835 }
836 else
837 {
838 /* Try to get service name from portmap
839 */
840 p = check_rpc_list (port, &sinr, IPPROTO_TCP);
841
842 sh_portchk_cmp_to_list (IPPROTO_TCP, port, haddr, p ? p : NULL);
843
844 /* If not an RPC service, try to get name from /etc/services
845 */
846 if (!p)
847 p = check_services(port, IPPROTO_TCP);
848
849 if (portchk_debug)
850 fprintf(stderr, _("check port: %5d on %15s open %s\n"),
851 port, inet_ntoa(haddr), p);
852
853#if !defined(O_NONBLOCK)
854#if defined(O_NDELAY)
855#define O_NONBLOCK O_NDELAY
856#else
857#define O_NONBLOCK 0
858#endif
859#endif
860
861 /* prepare to close connection gracefully
862 */
863 if (port == 22) /* ssh */
864 {
865 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
866 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
867 retval = write (fd, _("SSH-2.0-Foobar"), 14);
868 if (retval > 0) retval = write (fd, "\r\n", 2);
869 }
870 else if (port == 25) /* smtp */
871 {
872 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
873 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
874 retval = write (fd, _("QUIT"), 4);
875 if (retval > 0) retval = write (fd, "\r\n", 2);
876 }
877 else if (port == 79) /* finger */
878 {
879 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
880 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
881 retval = write (fd, "\r\n", 2);
882 }
883 else if (port == 110) /* pop3 */
884 {
885 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
886 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
887 retval = write (fd, _("QUIT"), 4);
888 if (retval > 0) retval = write (fd, "\r\n", 2);
889 }
890 else if (port == 143) /* imap */
891 {
892 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
893 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
894 retval = write (fd, _("A01 LOGOUT"), 10);
895 if (retval > 0) retval = write (fd, "\r\n", 2);
896 }
897
898 if (portchk_debug && retval < 0)
899 fprintf(stderr, _("check port: error writing to port %5d\n"),
900 port);
901 }
902 close (fd);
903 return 0;
904}
905
906/* typedef uint32_t in_addr_t;
907 * struct in_addr
908 * {
909 * in_addr_t s_addr;
910 * };
911 */
912
913#define SH_IFACE_MAX 16
914
915struct portchk_interfaces {
916 struct in_addr iface[SH_IFACE_MAX];
917 int used;
918};
919
920static struct portchk_interfaces iface_list;
921static int iface_initialized = 0;
922
923#ifdef TEST_ONLY
924static char * portchk_hostname = NULL;
925#else
926static char * portchk_hostname = sh.host.name;
927#endif
928
929static int sh_portchk_init_internal (void)
930{
931 struct hostent * hent;
932 volatile int i; /* might be clobbered by ‘longjmp’ or ‘vfork’*/
933 char errbuf[256];
934
935 if (portchk_debug)
936 fprintf(stderr, _("checking ports on: %s\n"), portchk_hostname ? portchk_hostname : _("NULL"));
937
938 if (!portchk_hostname)
939 return -1;
940
941 if (sh_portchk_active == S_FALSE)
942 return -1;
943
944 SH_MUTEX_LOCK(mutex_port_check);
945 if (iface_initialized == 0)
946 {
947 iface_list.used = 0;
948 iface_initialized = 1;
949 }
950
951 SH_MUTEX_LOCK(mutex_resolv);
952 hent = sh_gethostbyname(portchk_hostname);
953 i = 0;
954 while (hent && hent->h_addr_list[i] && (iface_list.used < SH_IFACE_MAX))
955 {
956 memcpy (&(iface_list.iface[iface_list.used].s_addr), hent->h_addr_list[i], sizeof(in_addr_t));
957 ++iface_list.used;
958 ++i;
959 }
960 SH_MUTEX_UNLOCK(mutex_resolv);
961
962 for (i = 0; i < iface_list.used; ++i)
963 {
964 sl_snprintf(errbuf, sizeof(errbuf), _("interface: %s"),
965 inet_ntoa(iface_list.iface[i]));
966 SH_MUTEX_LOCK(mutex_thread_nolog);
967 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
968 errbuf, _("sh_portchk_init"));
969 SH_MUTEX_UNLOCK(mutex_thread_nolog);
970 }
971 SH_MUTEX_UNLOCK(mutex_port_check);
972
973 return 0;
974}
975
976int sh_portchk_init (struct mod_type * arg)
977{
978#ifndef HAVE_PTHREAD
979 (void) arg;
980#endif
981
982 if (sh_portchk_active == S_FALSE)
983 return SH_MOD_FAILED;
984 if (!portchk_hostname)
985 return SH_MOD_FAILED;
986
987#ifdef HAVE_PTHREAD
988 if (arg != NULL && arg->initval < 0 &&
989 (sh.flag.isdaemon == S_TRUE || sh.flag.loop == S_TRUE))
990 {
991 if (0 == sh_pthread_create(sh_threaded_module_run, (void *)arg))
992 return SH_MOD_THREAD;
993 else
994 return SH_MOD_FAILED;
995 }
996#endif
997 return sh_portchk_init_internal();
998}
999
1000
1001
1002#if !defined(TEST_ONLY)
1003int sh_portchk_reconf (void)
1004{
1005 SH_MUTEX_LOCK(mutex_port_check);
1006 iface_initialized = 0;
1007 sh_portchk_active = 1;
1008 sh_portchk_check_udp = 1;
1009 sh_portchk_interval = SH_PORTCHK_INTERVAL;
1010
1011 portlist_udp = sh_portchk_kill_list (portlist_udp);
1012 portlist_tcp = sh_portchk_kill_list (portlist_tcp);
1013
1014 blacklist_udp = sh_portchk_kill_blacklist (blacklist_udp);
1015 blacklist_tcp = sh_portchk_kill_blacklist (blacklist_tcp);
1016 SH_MUTEX_UNLOCK(mutex_port_check);
1017 return 0;
1018}
1019
1020int sh_portchk_cleanup (void)
1021{
1022 return sh_portchk_reconf ();
1023}
1024
1025int sh_portchk_timer (time_t tcurrent)
1026{
1027 static time_t lastcheck = 0;
1028
1029 SL_ENTER(_("sh_portchk_timer"));
1030 if ((time_t) (tcurrent - lastcheck) >= sh_portchk_interval)
1031 {
1032 lastcheck = tcurrent;
1033 SL_RETURN((-1), _("sh_portchk_timer"));
1034 }
1035 SL_RETURN(0, _("sh_portchk_timer"));
1036}
1037#endif
1038
1039static int check_port_generic (int port, int type, int protocol)
1040{
1041 volatile int i = 0;
1042 int sock = -1;
1043 int flag = 1; /* non-zero to enable an option */
1044 struct in_addr haddr;
1045 char errbuf[SH_ERRBUF_SIZE];
1046
1047 /* Check all interfaces for this host
1048 */
1049 while (i < iface_list.used)
1050 {
1051 haddr.s_addr = iface_list.iface[i].s_addr;
1052
1053 if (0 != sh_portchk_is_blacklisted(port, haddr, protocol))
1054 {
1055 ++i; continue;
1056 }
1057
1058 if ((sock = socket(AF_INET, type, protocol)) < 0 )
1059 {
1060 ++i;
1061#ifdef TEST_ONLY
1062 if (portchk_debug)
1063 perror(_("socket"));
1064#else
1065 SH_MUTEX_LOCK(mutex_thread_nolog);
1066 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
1067 sh_error_message(errno, errbuf, sizeof(errbuf)), _("socket"));
1068 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1069#endif
1070 continue;
1071 }
1072 if ( setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
1073 (void *) &flag, sizeof(flag)) < 0 )
1074 {
1075 ++i;
1076#ifdef TEST_ONLY
1077 if (portchk_debug)
1078 perror(_("setsockopt"));
1079#else
1080 SH_MUTEX_LOCK(mutex_thread_nolog);
1081 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
1082 sh_error_message(errno, errbuf, sizeof(errbuf)),_("setsockopt"));
1083 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1084#endif
1085 continue;
1086 }
1087
1088
1089 if (protocol == IPPROTO_TCP)
1090 check_port_tcp_internal(sock, port, haddr);
1091 else
1092 check_port_udp_internal(sock, port, haddr);
1093
1094 ++i;
1095 }
1096
1097 return 0;
1098}
1099
1100
1101
1102static int check_port_udp (int port)
1103{
1104 return check_port_generic(port, SOCK_DGRAM, IPPROTO_UDP);
1105}
1106
1107static int check_port_tcp (int port)
1108{
1109 return check_port_generic(port, SOCK_STREAM, IPPROTO_TCP);
1110}
1111
1112
1113
1114static int sh_portchk_scan_ports_generic (int min_port, int max_port_arg, int type, int protocol)
1115{
1116 /*
1117 int min_port = 1024;
1118 int max_port = 65535;
1119 */
1120
1121 volatile int port; /* might be clobbered by ‘longjmp’ or ‘vfork’*/
1122 volatile int max_port = max_port_arg;
1123 int retval;
1124 int sock = -1;
1125 int flag = 1; /* non-zero to enable an option */
1126
1127 struct sockaddr_in addr;
1128 int addrlen = sizeof(addr);
1129 char errbuf[SH_ERRBUF_SIZE];
1130
1131 if (min_port == -1)
1132 min_port = 0;
1133 if (max_port == -1)
1134 max_port = 65535;
1135
1136 for (port = min_port; port <= max_port; ++port)
1137 {
1138
1139 if ((sock = socket(AF_INET, type, protocol)) < 0 )
1140 {
1141#ifdef TEST_ONLY
1142 if (portchk_debug)
1143 perror(_("socket"));
1144#else
1145 SH_MUTEX_LOCK(mutex_thread_nolog);
1146 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
1147 sh_error_message(errno, errbuf, sizeof(errbuf)), _("socket"));
1148 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1149#endif
1150 continue;
1151 }
1152 if ( setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
1153 (void *) &flag, sizeof(flag)) < 0 )
1154 {
1155#ifdef TEST_ONLY
1156 if (portchk_debug)
1157 perror(_("setsockopt"));
1158#else
1159 SH_MUTEX_LOCK(mutex_thread_nolog);
1160 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
1161 sh_error_message(errno, errbuf, sizeof(errbuf)),_("setsockopt"));
1162 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1163#endif
1164 continue;
1165 }
1166
1167 addr.sin_family = AF_INET;
1168 addr.sin_port = htons(port);
1169 addr.sin_addr.s_addr = INADDR_ANY;
1170
1171 retval = bind (sock, (struct sockaddr *) &addr, addrlen);
1172
1173 if (retval == 0)
1174 {
1175 /* we can bind the port, thus it is unused
1176 */
1177 close (sock);
1178 }
1179 else
1180 {
1181 if (errno == EINVAL || errno == EADDRINUSE)
1182 {
1183 /* try to connect to the port
1184 */
1185 if (protocol == IPPROTO_TCP)
1186 check_port_tcp(port);
1187 else
1188 check_port_udp(port);
1189 }
1190 else
1191 {
1192#ifdef TEST_ONLY
1193 if (portchk_debug)
1194 perror(_("bind"));
1195#else
1196 SH_MUTEX_LOCK(mutex_thread_nolog);
1197 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
1198 sh_error_message(errno, errbuf, sizeof(errbuf)), _("bind"));
1199 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1200#endif
1201 }
1202 close (sock);
1203 }
1204 }
1205 return 0;
1206}
1207
1208static int sh_portchk_scan_ports_tcp (int min_port, int max_port)
1209{
1210 return sh_portchk_scan_ports_generic (min_port, max_port, SOCK_STREAM, IPPROTO_TCP);
1211}
1212
1213static int sh_portchk_scan_ports_udp (int min_port, int max_port)
1214{
1215 return sh_portchk_scan_ports_generic (min_port, max_port, SOCK_DGRAM, IPPROTO_UDP);
1216}
1217
1218/* Subroutine to add an interface
1219 */
1220static void * sh_dummy_str = NULL; /* fix clobbered by.. warning */
1221
1222static int sh_portchk_add_interface (const char * str)
1223{
1224 struct in_addr haddr;
1225 char errbuf[256];
1226 char buf[64];
1227
1228 sh_dummy_str = (void*) &str;
1229
1230 if (iface_initialized == 0)
1231 {
1232 iface_list.used = 0;
1233 iface_initialized = 1;
1234 }
1235
1236 do {
1237
1238 while (*str == ',' || *str == ' ' || *str == '\t') ++str;
1239
1240 if (*str)
1241 {
1242 unsigned int i = 0;
1243 while (*str && i < (sizeof(buf)-1) && *str != ',' && *str != ' ' && *str != '\t')
1244 {
1245 buf[i] = *str; ++str; ++i;
1246 }
1247 buf[i] = '\0';
1248
1249 if (0 == inet_aton(buf, &haddr))
1250 return -1;
1251
1252 if (iface_list.used == SH_IFACE_MAX)
1253 return -1;
1254
1255 sl_snprintf(errbuf, sizeof(errbuf), _("interface: %s"), inet_ntoa(haddr));
1256 SH_MUTEX_LOCK(mutex_thread_nolog);
1257 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1258 errbuf, _("sh_portchk_add_interface"));
1259 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1260
1261 memcpy (&(iface_list.iface[iface_list.used].s_addr), &(haddr.s_addr), sizeof(in_addr_t));
1262 ++iface_list.used;
1263 }
1264 } while (*str);
1265
1266 return 0;
1267}
1268
1269/* verify whether port/interface is blacklisted (do not check)
1270 */
1271static int sh_portchk_is_blacklisted(int port, struct in_addr haddr, int proto)
1272{
1273 struct sh_port * head;
1274
1275 if (proto == IPPROTO_TCP)
1276 head = blacklist_tcp;
1277 else
1278 head = blacklist_udp;
1279
1280 while (head)
1281 {
1282 if (head->port == port)
1283 {
1284 if ((head->haddr.s_addr == 0) || (head->haddr.s_addr == haddr.s_addr))
1285 return 1;
1286 else
1287 return 0;
1288 }
1289 head = head->next;
1290 }
1291 return 0;
1292}
1293
1294
1295static int sh_portchk_blacklist(int port, struct in_addr haddr, int proto)
1296{
1297 struct sh_port * black;
1298 struct sh_port * head;
1299
1300 if (proto == IPPROTO_TCP)
1301 head = blacklist_tcp;
1302 else
1303 head = blacklist_udp;
1304
1305 black = head;
1306
1307 while (black)
1308 {
1309 if (black->port == port && head->haddr.s_addr == haddr.s_addr)
1310 return -1;
1311 black = black->next;
1312 }
1313 black = SH_ALLOC (sizeof(struct sh_port));
1314 black->port = port;
1315 black->haddr.s_addr = haddr.s_addr;
1316 black->next = head;
1317
1318 if (proto == IPPROTO_TCP)
1319 blacklist_tcp = black;
1320 else
1321 blacklist_udp = black;
1322 return 0;
1323}
1324
1325
1326/* Subroutine to add a required or optional port/service
1327 */
1328static int sh_portchk_add_required_port_generic (char * service, char * interface, int type)
1329{
1330 char buf[256];
1331 int proto;
1332 char * p;
1333 char * endptr;
1334 unsigned long int port;
1335 struct in_addr haddr;
1336 struct sh_portentry * portent;
1337
1338 if (0 == inet_aton(interface, &haddr))
1339 return -1;
1340
1341 sl_strlcpy (buf, service, sizeof(buf));
1342
1343 p = strchr(buf, '/');
1344 if (!p)
1345 return -1;
1346 if (0 == strcmp(p, _("/tcp")))
1347 proto = IPPROTO_TCP;
1348 else if (0 == strcmp(p, _("/udp")))
1349 proto = IPPROTO_UDP;
1350 else
1351 return -1;
1352
1353 *p = '\0';
1354 port = strtoul(buf, &endptr, 0);
1355
1356 /* Blacklisted ports
1357 */
1358 if (*endptr == '\0' && port <= 65535 && type == SH_PORT_BLACKLIST)
1359 return (sh_portchk_blacklist(port, haddr, proto));
1360
1361 if (*endptr != '\0')
1362 {
1363 portent = sh_portchk_get_from_list (proto, -1, haddr, buf);
1364 if (!portent)
1365 sh_portchk_add_to_list (proto, -1, haddr, buf, type, SH_PORT_UNKN);
1366 else
1367 {
1368#ifdef TEST_ONLY
1369 fprintf(stderr, "** WARNING: duplicate port definition %s/%s\n", buf, SH_PROTO_STR(proto));
1370#else
1371 SH_MUTEX_LOCK(mutex_thread_nolog);
1372 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1373 _("duplicate port definition"), _("sh_portchk_add_required_port_generic"));
1374 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1375#endif
1376 return -1;
1377 }
1378 }
1379 else if (port <= 65535)
1380 {
1381 portent = sh_portchk_get_from_list (proto, port, haddr, NULL);
1382 if (!portent)
1383 sh_portchk_add_to_list (proto, port, haddr, NULL, type, SH_PORT_UNKN);
1384 else
1385 {
1386#ifdef TEST_ONLY
1387 fprintf(stderr, "** WARNING: duplicate port definition %lu/%s\n", port, SH_PROTO_STR(proto));
1388#else
1389 SH_MUTEX_LOCK(mutex_thread_nolog);
1390 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1391 _("duplicate port definition"), _("sh_portchk_add_required_port_generic"));
1392 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1393#endif
1394 return -1;
1395 }
1396 }
1397 else
1398 return -1;
1399
1400 return 0;
1401}
1402
1403/* Internal interface to add required or optional ports as 'iface:portlist'
1404 */
1405static int sh_portchk_add_required_generic (const char * str, int type)
1406{
1407 size_t len;
1408 size_t ll = 0;
1409 int status;
1410
1411 char * interface = NULL;
1412 char * list;
1413 char * p;
1414#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
1415 char * saveptr;
1416#endif
1417
1418 if (!str)
1419 return -1;
1420
1421 if (strchr(str, ':'))
1422 {
1423 len = strlen(str);
1424 for (ll = 0; ll < len; ++ll)
1425 {
1426 if (str[ll] == ':' || str[ll] == ' ' || str[ll] == '\t')
1427 {
1428 interface = SH_ALLOC(ll+1);
1429 sl_strlcpy(interface, str, ll+1);
1430 interface[ll] = '\0';
1431 while (str[ll] == ':' || str[ll] == ' ' || str[ll] == '\t')
1432 ++ll;
1433 break;
1434 }
1435 }
1436 }
1437 else
1438 {
1439 interface = SH_ALLOC(8);
1440 sl_strlcpy(interface, _("0.0.0.0"), 8);
1441 interface[7] = '\0';
1442 while (str[ll] == ' ' || str[ll] == '\t')
1443 ++ll;
1444 }
1445
1446 if (!interface)
1447 return -1;
1448
1449 if (str[ll] == '\0')
1450 {
1451 SH_FREE(interface);
1452 return -1;
1453 }
1454
1455 if (portchk_debug)
1456 fprintf(stderr, "add ports for interface: %s\n", interface);
1457
1458 list = sh_util_strdup(&str[ll]);
1459#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
1460 p = strtok_r (list, " ,\t", &saveptr);
1461#else
1462 p = strtok (list, " ,\t");
1463#endif
1464 if (!p)
1465 {
1466 SH_FREE(interface);
1467 SH_FREE(list);
1468 return -1;
1469 }
1470 while (p)
1471 {
1472 status = sh_portchk_add_required_port_generic (p, interface, type);
1473
1474 if (-1 == status)
1475 {
1476 SH_FREE(interface);
1477 SH_FREE(list);
1478 return -1;
1479 }
1480#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
1481 p = strtok_r (NULL, " ,\t", &saveptr);
1482#else
1483 p = strtok (NULL, " ,\t");
1484#endif
1485 }
1486 SH_FREE(interface);
1487 SH_FREE(list);
1488 return 0;
1489}
1490
1491/* User interface to add required ports as 'iface:portlist'
1492 */
1493static int sh_portchk_add_required (const char * str)
1494{
1495 return sh_portchk_add_required_generic (str, SH_PORT_REQ);
1496}
1497
1498/* User interface to add optional ports as 'iface:portlist'
1499 */
1500static int sh_portchk_add_optional (const char * str)
1501{
1502 return sh_portchk_add_required_generic (str, SH_PORT_OPT);
1503}
1504
1505/* User interface to add ignoreable ports as 'iface:portlist'
1506 */
1507static int sh_portchk_add_ignore (const char * str)
1508{
1509 return sh_portchk_add_required_generic (str, SH_PORT_IGN);
1510}
1511
1512/* User interface to add ports that should not be checked as 'iface:portlist'
1513 */
1514static int sh_portchk_add_blacklist (const char * str)
1515{
1516 return sh_portchk_add_required_generic (str, SH_PORT_BLACKLIST);
1517}
1518
1519/* Interface to run port check
1520 */
1521int sh_portchk_check ()
1522{
1523 volatile int min_port;
1524
1525 SH_MUTEX_LOCK(mutex_port_check);
1526
1527 min_port = 0;
1528
1529 if (sh_portchk_active != S_FALSE)
1530 {
1531 sh_portchk_reset_lists();
1532 if (0 != geteuid())
1533 {
1534 min_port = 1024;
1535#ifdef TEST_ONLY
1536 fprintf(stderr, "** WARNING not scanning ports < 1024\n");
1537#else
1538 SH_MUTEX_LOCK(mutex_thread_nolog);
1539 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1540 _("not scanning ports below 1024"), _("sh_portchk_check"));
1541 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1542#endif
1543 }
1544
1545 sh_port2proc_prepare();
1546
1547 if (sh_portchk_check_udp == 1)
1548 sh_portchk_scan_ports_udp(min_port, -1);
1549 sh_portchk_scan_ports_tcp(min_port, -1);
1550
1551
1552 sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_REPORT);
1553 if (sh_portchk_check_udp == 1)
1554 sh_portchk_check_list (&portlist_udp, IPPROTO_UDP, SH_PORT_REPORT);
1555
1556 }
1557 SH_MUTEX_UNLOCK(mutex_port_check);
1558 return 0;
1559}
1560#endif
1561
1562#ifdef SH_CUTEST
1563#include "CuTest.h"
1564
1565void Test_portcheck_lists (CuTest *tc)
1566{
1567#if defined(SH_USE_PORTCHECK) && (defined(SH_WITH_CLIENT) || defined(SH_STANDALONE))
1568 struct in_addr haddr_local;
1569 struct sh_portentry * portent;
1570
1571 CuAssertTrue(tc, 0 != inet_aton("127.0.0.1", &haddr_local));
1572
1573 sh_portchk_add_to_list (IPPROTO_TCP, 8000, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
1574
1575 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, haddr_local, NULL);
1576 CuAssertPtrNotNull(tc, portent);
1577
1578 CuAssertTrue(tc, portent->port == 8000);
1579 CuAssertTrue(tc, 0 == strcmp("127.0.0.1", portent->interface));
1580 CuAssertTrue(tc, portent->status == SH_PORT_UNKN);
1581 CuAssertTrue(tc, portent->flag == SH_PORT_NOT);
1582
1583 sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_NOREPT);
1584
1585 CuAssertTrue(tc, NULL == portlist_tcp);
1586
1587 sh_portchk_add_to_list (IPPROTO_TCP, 8000, haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
1588 sh_portchk_add_to_list (IPPROTO_TCP, 8001, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
1589 sh_portchk_add_to_list (IPPROTO_TCP, 8002, haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
1590 sh_portchk_add_to_list (IPPROTO_TCP, 8003, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
1591 sh_portchk_add_to_list (IPPROTO_TCP, 8004, haddr_local, NULL, SH_PORT_IGN, SH_PORT_UNKN);
1592 sh_portchk_add_to_list (IPPROTO_TCP, -1, haddr_local, "foo1", SH_PORT_NOT, SH_PORT_UNKN);
1593 sh_portchk_add_to_list (IPPROTO_TCP, -1, haddr_local, "foo2", SH_PORT_REQ, SH_PORT_UNKN);
1594 sh_portchk_add_to_list (IPPROTO_TCP, -1, haddr_local, "foo3", SH_PORT_NOT, SH_PORT_UNKN);
1595 sh_portchk_add_to_list (IPPROTO_TCP, -1, haddr_local, "foo4", SH_PORT_REQ, SH_PORT_UNKN);
1596 sh_portchk_add_to_list (IPPROTO_TCP, -1, haddr_local, "foo5", SH_PORT_IGN, SH_PORT_UNKN);
1597
1598 sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_NOREPT);
1599
1600 CuAssertPtrNotNull(tc, portlist_tcp);
1601
1602 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, haddr_local, NULL);
1603 CuAssertPtrNotNull(tc, portent);
1604
1605 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8001, haddr_local, NULL);
1606 CuAssertTrue(tc, NULL == portent);
1607
1608 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8002, haddr_local, NULL);
1609 CuAssertPtrNotNull(tc, portent);
1610
1611 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8003, haddr_local, NULL);
1612 CuAssertTrue(tc, NULL == portent);
1613
1614 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8004, haddr_local, NULL);
1615 CuAssertPtrNotNull(tc, portent);
1616
1617 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, haddr_local, "foo1");
1618 CuAssertTrue(tc, NULL == portent);
1619
1620 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, haddr_local, "foo2");
1621 CuAssertPtrNotNull(tc, portent);
1622 CuAssertTrue(tc, 0 == strcmp(portent->service, "foo2"));
1623
1624 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, haddr_local, "foo3");
1625 CuAssertTrue(tc, NULL == portent);
1626
1627 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, haddr_local, "foo4");
1628 CuAssertPtrNotNull(tc, portent);
1629 CuAssertTrue(tc, 0 == strcmp(portent->service, "foo4"));
1630
1631 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, haddr_local, "foo5");
1632 CuAssertPtrNotNull(tc, portent);
1633 CuAssertTrue(tc, 0 == strcmp(portent->service, "foo5"));
1634
1635 CuAssertTrue(tc, 0 == sh_portchk_blacklist(666, haddr_local, IPPROTO_TCP));
1636 CuAssertTrue(tc, 0 != sh_portchk_blacklist(666, haddr_local, IPPROTO_TCP));
1637 CuAssertTrue(tc, 0 == sh_portchk_blacklist(667, haddr_local, IPPROTO_TCP));
1638 CuAssertTrue(tc, 0 == sh_portchk_blacklist(668, haddr_local, IPPROTO_TCP));
1639 CuAssertTrue(tc, 0 == sh_portchk_blacklist(666, haddr_local, IPPROTO_UDP));
1640 CuAssertTrue(tc, 0 != sh_portchk_blacklist(666, haddr_local, IPPROTO_UDP));
1641 CuAssertTrue(tc, 0 == sh_portchk_blacklist(667, haddr_local, IPPROTO_UDP));
1642 CuAssertTrue(tc, 0 == sh_portchk_blacklist(668, haddr_local, IPPROTO_UDP));
1643
1644 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(668, haddr_local, IPPROTO_UDP));
1645 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(667, haddr_local, IPPROTO_UDP));
1646 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(666, haddr_local, IPPROTO_UDP));
1647 CuAssertTrue(tc, 0 == sh_portchk_is_blacklisted(665, haddr_local, IPPROTO_UDP));
1648
1649 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(668, haddr_local, IPPROTO_TCP));
1650 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(667, haddr_local, IPPROTO_TCP));
1651 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(666, haddr_local, IPPROTO_TCP));
1652 CuAssertTrue(tc, 0 == sh_portchk_is_blacklisted(665, haddr_local, IPPROTO_TCP));
1653#else
1654 (void) tc; /* fix compiler warning */
1655#endif
1656 return;
1657}
1658#endif
1659
1660#ifdef TEST_ONLY
1661
1662void usage (char * pname)
1663{
1664 printf ("%s [-r|--required interface:portlist][-o|--optional interface:portlist][--no-udp][-d|--debug] hostname\n\n", pname);
1665 printf (" Check local host for open ports; Version %s\n\n", PORTCHK_VERSION);
1666 printf (" Interface: Numeric address for an interface, e.g. 127.0.0.1\n");
1667 printf (" Portlist: List of ports or services, e.g. 22/tcp,nfs/udp,nlockmgr/udp\n");
1668 printf (" required -> must be open\n");
1669 printf (" optional -> may be open or closed\n");
1670 printf (" RPC services must be specified with service **name**, others with **port number**\n\n");
1671 printf (" Example:\n");
1672 printf (" %s --required 192.168.1.2:22/tcp,nfs/udp,nlockmgr/udp\n\n", pname);
1673 return;
1674}
1675
1676int main(int argc, char *argv[])
1677{
1678 char * pname = argv[0];
1679
1680
1681 /*
1682 test_lists();
1683
1684 portlist_tcp = sh_portchk_kill_list (portlist_tcp);
1685 portlist_udp = sh_portchk_kill_list (portlist_udp);
1686 */
1687
1688 // sh_portchk_add_required ("127.0.0.1 : nlockmgr/tcp, 5308/tcp, nfs/tcp");
1689
1690 while (argc > 1 && argv[1][0] == '-')
1691 {
1692 if (0 == strcmp(argv[1], "--help") || 0 == strcmp(argv[1], "-h"))
1693 {
1694 usage(pname);
1695 exit (0);
1696 }
1697 else if (0 == strcmp(argv[1], "--required") || 0 == strcmp(argv[1], "-r"))
1698 {
1699 if (argc < 3)
1700 {
1701 usage(pname);
1702 exit (1);
1703 }
1704 sh_portchk_add_required (argv[2]);
1705 --argc; ++argv;
1706 }
1707 else if (0 == strcmp(argv[1], "--optional") || 0 == strcmp(argv[1], "-o"))
1708 {
1709 if (argc < 3)
1710 {
1711 usage(pname);
1712 exit (1);
1713 }
1714 sh_portchk_add_optional (argv[2]);
1715 --argc; ++argv;
1716 }
1717 else if (0 == strcmp(argv[1], "--no-udp"))
1718 {
1719 sh_portchk_check_udp = 0;
1720 }
1721 else if (0 == strcmp(argv[1], "--debug") || 0 == strcmp(argv[1], "-d"))
1722 {
1723 portchk_debug = 1;
1724 }
1725 else
1726 {
1727 usage(pname);
1728 exit (1);
1729 }
1730 --argc; ++argv;
1731 }
1732
1733 if (argc < 2)
1734 {
1735 usage(pname);
1736 exit (1);
1737 }
1738
1739 portchk_hostname = argv[1];
1740
1741 if (0 != sh_portchk_init ())
1742 {
1743 usage(pname);
1744 exit (1);
1745 }
1746
1747 sh_portchk_check();
1748
1749 return 0;
1750}
1751#endif
Note: See TracBrowser for help on using the repository browser.