source: trunk/src/sh_portcheck.c@ 219

Last change on this file since 219 was 218, checked in by katerina, 16 years ago

Replacement functions for getrpcbynumber, getservbyport (ticket #145).
  • Property svn:executable set to *
File size: 47.1 KB
Line 
1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 2006 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20/***************************************************************************
21 *
22 * This file provides a module for samhain to check for open ports
23 * on the local machine.
24 *
25 */
26
27
28/* #define TEST_ONLY */
29#ifndef TEST_ONLY
30#include "config_xor.h"
31#endif
32
33#include <stdio.h>
34#include <string.h>
35#include <sys/types.h>
36#include <sys/socket.h>
37#include <netinet/in.h>
38#include <arpa/inet.h>
39#include <errno.h>
40#include <unistd.h>
41#include <fcntl.h>
42
43#define PORTCHK_VERSION "1.0"
44
45#if defined(TEST_ONLY) || (defined(SH_USE_PORTCHECK) && (defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)))
46
47
48#define PORTMAP
49#include <rpc/rpc.h>
50#ifdef HAVE_RPC_RPCENT_H
51#include <rpc/rpcent.h>
52#endif
53#include <rpc/pmap_clnt.h>
54#include <rpc/pmap_prot.h>
55#include <netdb.h>
56
57/*
58 * struct pmaplist {
59 * struct pmap pml_map;
60 * struct pmaplist *pml_next;
61 * };
62 */
63
64/* struct pmap {
65 * long unsigned pm_prog;
66 * long unsigned pm_vers;
67 * long unsigned pm_prot;
68 * long unsigned pm_port;
69 * };
70 */
71
72/* TIME_WAIT ? 60-240 seconds */
73
74/* the size of an interface string
75 */
76#define SH_INTERFACE_SIZE 16
77
78#define SH_PORT_NOT 0
79#define SH_PORT_REQ 1
80#define SH_PORT_OPT 2
81#define SH_PORT_IGN 3
82#define SH_PORT_BLACKLIST 4
83
84#define SH_PORT_MISS 0
85#define SH_PORT_ISOK 1
86#define SH_PORT_UNKN 2
87
88#define SH_PORT_NOREPT 0
89#define SH_PORT_REPORT 1
90
91#define SH_PROTO_TCP 0
92#define SH_PROTO_UDP 1
93#define SH_PROTO_STR(a) (((a) == IPPROTO_TCP) ? _("tcp") : _("udp"))
94
95struct sh_portentry {
96 int port;
97 char interface[SH_INTERFACE_SIZE];
98 char * service;
99 char * error;
100 int flag; /* required or not */
101 int status; /* missing or not */
102 struct sh_portentry * next;
103};
104
105static struct sh_portentry * portlist_tcp = NULL;
106static struct sh_portentry * portlist_udp = NULL;
107
108struct sh_port {
109 int port;
110 struct in_addr haddr;
111 struct sh_port * next;
112};
113
114static struct sh_port * blacklist_tcp = NULL;
115static struct sh_port * blacklist_udp = NULL;
116
117#define SH_PORTCHK_INTERVAL 300
118
119static int sh_portchk_check_udp = 1;
120static int sh_portchk_active = 1;
121static int sh_portchk_interval = SH_PORTCHK_INTERVAL;
122#if !defined(TEST_ONLY)
123
124#define FIL__ _("sh_portcheck.c")
125#include "samhain.h"
126#include "sh_error.h"
127#include "sh_mem.h"
128#include "sh_calls.h"
129#include "sh_utils.h"
130#include "sh_modules.h"
131#define SH_NEED_GETHOSTBYXXX
132#include "sh_static.h"
133#include "sh_pthread.h"
134
135SH_MUTEX_STATIC(mutex_port_check, PTHREAD_MUTEX_INITIALIZER);
136
137static int sh_portchk_severity = SH_ERR_SEVERE;
138
139extern char * sh_port2proc_query(int proto, struct in_addr * saddr, int sport,
140 unsigned long * pid, char * user, size_t userlen);
141extern int sh_port2proc_prepare();
142
143#endif
144
145/* Exported interface to add ignoreable ports as 'iface:portlist'
146 */
147static int sh_portchk_add_ignore (const char * str);
148
149/* Exported interface to add required ports as 'iface:portlist'
150 */
151static int sh_portchk_add_required (const char * str);
152
153/* Exported interface to add optional ports as 'iface:portlist'
154 */
155static int sh_portchk_add_optional (const char * str);
156
157/* Exported interface to add blacklisted ports as 'iface:portlist'
158 */
159static int sh_portchk_add_blacklist (const char * str);
160
161/* Exported interface to add an ethernet interface
162 */
163static int sh_portchk_add_interface (const char * str);
164
165/* verify whether port/interface is blacklisted (do not check)
166 */
167static int sh_portchk_is_blacklisted(int port, struct in_addr haddr, int proto);
168
169#ifndef TEST_ONLY
170
171static int sh_portchk_set_interval (const char * c)
172{
173 int retval = 0;
174 long val;
175
176 SL_ENTER(_("sh_portchk_set_interval"));
177 val = strtol (c, (char **)NULL, 10);
178 if (val <= 0)
179 {
180 SH_MUTEX_LOCK(mutex_thread_nolog);
181 sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
182 _("port check interval"), c);
183 SH_MUTEX_UNLOCK(mutex_thread_nolog);
184 retval = -1;
185 }
186
187 sh_portchk_interval = (time_t) val;
188 SL_RETURN(0, _("sh_portchk_set_interval"));
189}
190
191
192static int sh_portchk_set_active (const char * str)
193{
194 return sh_util_flagval(str, &sh_portchk_active);
195}
196
197static int sh_portchk_set_udp (const char * str)
198{
199 return sh_util_flagval(str, &sh_portchk_check_udp);
200}
201
202static int sh_portchk_set_severity (const char * str)
203{
204 char tmp[32];
205 tmp[0] = '='; tmp[1] = '\0';
206 sl_strlcat (tmp, str, 32);
207 return sh_error_set_level (tmp, &sh_portchk_severity);
208}
209
210sh_rconf sh_portchk_table[] = {
211 {
212 N_("severityportcheck"),
213 sh_portchk_set_severity,
214 },
215 {
216 N_("portcheckrequired"),
217 sh_portchk_add_required,
218 },
219 {
220 N_("portcheckoptional"),
221 sh_portchk_add_optional,
222 },
223 {
224 N_("portcheckignore"),
225 sh_portchk_add_ignore,
226 },
227 {
228 N_("portcheckskip"),
229 sh_portchk_add_blacklist,
230 },
231 {
232 N_("portcheckactive"),
233 sh_portchk_set_active,
234 },
235 {
236 N_("portcheckinterface"),
237 sh_portchk_add_interface,
238 },
239 {
240 N_("portcheckinterval"),
241 sh_portchk_set_interval,
242 },
243 {
244 N_("portcheckudp"),
245 sh_portchk_set_udp,
246 },
247 {
248 NULL,
249 NULL
250 }
251};
252
253#endif
254
255/* Interface to initialize port check
256 */
257int sh_portchk_init (struct mod_type * arg);
258
259/* Interface to reset port check
260 */
261int sh_portchk_reset (void);
262
263/* Interface to run port check
264 */
265int sh_portchk_check (void);
266
267
268static char * check_services (int port, int proto);
269
270#ifdef TEST_ONLY
271
272static int portchk_debug = 0;
273#define SH_ALLOC malloc
274#define SH_FREE free
275#define sh_util_strdup strdup
276#define sl_strlcpy strncpy
277#define _(a) a
278
279#else
280
281static int portchk_debug = 0;
282
283#endif
284
285static char * sh_getrpcbynumber (int number, char * buf, size_t len)
286{
287 FILE * fp;
288
289 if (NULL != (fp = fopen(_("/etc/rpc"), "r")))
290 {
291 sh_string * s = sh_string_new(0);
292 while (0 < sh_string_read(s, fp, 1024))
293 {
294 char * p = sh_string_str(s);
295 while (*p && (*p == ' ' || *p == '\t')) ++p; /* skip whitespace */
296 if (*p == '\0' || *p == '#')
297 continue; /* skip comment */
298 else
299 {
300 size_t lengths[3];
301 unsigned int fields = 3;
302 char * q = sh_string_str(s);
303 char ** splits = split_array_ws(q, &fields, lengths);
304
305 if (fields >= 2)
306 {
307 int n = atoi(splits[1]);
308 if (n == number)
309 {
310 sl_strlcpy(buf, splits[0], len);
311 SH_FREE(splits);
312 sh_string_destroy(&s);
313 fclose(fp);
314 return buf;
315 }
316 }
317 SH_FREE(splits);
318 }
319 }
320 sh_string_destroy(&s);
321 fclose(fp);
322 }
323 return NULL;
324}
325
326static char * sh_getservbyport (int port, const char * proto_in, char * buf, size_t len)
327{
328 FILE * fp;
329 char proto[8];
330
331 sl_strlcpy(proto, proto_in, sizeof(proto));
332
333 if (NULL != (fp = fopen(_("/etc/services"), "r")))
334 {
335 sh_string * s = sh_string_new(0);
336 while (0 < sh_string_read(s, fp, 1024))
337 {
338 char * p = sh_string_str(s);
339 while (*p && (*p == ' ' || *p == '\t')) ++p; /* skip whitespace */
340 if (*p == '\0' || *p == '#')
341 continue; /* skip comment */
342 else
343 {
344 size_t lengths[3];
345 unsigned int fields = 3;
346 char * q = sh_string_str(s);
347 char ** splits = split_array_ws(q, &fields, lengths);
348
349 if (fields >= 2)
350 {
351 char * end;
352 long n = strtol(splits[1], &end, 10);
353 if (n == port && end && (*end == '/' || *end == ','))
354 {
355 ++end;
356 if (0 == strcmp(end, proto))
357 {
358 sl_strlcpy(buf, splits[0], len);
359 SH_FREE(splits);
360 sh_string_destroy(&s);
361 fclose(fp);
362 return buf;
363 }
364 }
365 }
366 SH_FREE(splits);
367 }
368 }
369 sh_string_destroy(&s);
370 fclose(fp);
371 }
372 return NULL;
373}
374
375static void sh_portchk_add_to_list (int proto,
376 int port, struct in_addr haddr,
377 char * service,
378 int flag, int status)
379{
380 struct sh_portentry * new = SH_ALLOC (sizeof(struct sh_portentry));
381
382 if (portchk_debug)
383 fprintf(stderr, _("add to list: port %d/%s %d %d (%s)\n"),
384 port, SH_PROTO_STR(proto), flag, status, service ? service : _("undef"));
385
386 new->port = port;
387 sl_strlcpy (new->interface, inet_ntoa(haddr), SH_INTERFACE_SIZE);
388 new->status = status;
389 new->flag = flag;
390
391 new->error = NULL;
392
393 if (service)
394 new->service = sh_util_strdup (service);
395 else
396 new->service = NULL;
397 if (proto == IPPROTO_TCP)
398 {
399 new->next = portlist_tcp;
400 portlist_tcp = new;
401 }
402 else
403 {
404 new->next = portlist_udp;
405 portlist_udp = new;
406 }
407 return;
408}
409
410/* Reset the list by setting all entries to UNKN.
411 * In the next cycle we will check, and set found ports to ISOK.
412 * Thereafter, we check for entries that are still UNKN.
413 */
414static void sh_portchk_reset_lists (void)
415{
416 struct sh_portentry * portlist;
417
418 portlist = portlist_tcp;
419 while (portlist)
420 {
421 if (portlist->status != SH_PORT_MISS)
422 portlist->status = SH_PORT_UNKN;
423 portlist = portlist->next;
424 }
425 portlist = portlist_udp;
426 while (portlist)
427 {
428 if (portlist->status != SH_PORT_MISS)
429 portlist->status = SH_PORT_UNKN;
430 portlist = portlist->next;
431 }
432 return;
433}
434
435static struct sh_portentry * sh_portchk_kill_list (struct sh_portentry * head)
436{
437 if (head)
438 {
439 if (head->next)
440 sh_portchk_kill_list (head->next);
441
442 if (head->service)
443 SH_FREE(head->service);
444 SH_FREE(head);
445 }
446 return NULL;
447}
448
449static struct sh_port * sh_portchk_kill_blacklist (struct sh_port * head)
450{
451 if (head)
452 {
453 if (head->next)
454 sh_portchk_kill_blacklist (head->next);
455
456 SH_FREE(head);
457 }
458 return NULL;
459}
460
461/* These variables are not used anywhere. They only exist
462 * to assign &pre, &ptr to them, which keeps gcc from
463 * putting it into a register, and avoids the 'clobbered
464 * by longjmp' warning. And no, 'volatile' proved insufficient.
465 */
466static void * sh_dummy_pre = NULL;
467static void * sh_dummy_ptr = NULL;
468
469/* check the list of open ports for any that are marked as UNKN
470 */
471static void sh_portchk_check_list (struct sh_portentry ** head, int proto, int report)
472{
473 struct sh_portentry * ptr = *head;
474 struct sh_portentry * pre = *head;
475 char errbuf[256];
476
477 /* Take the address to keep gcc from putting them into registers.
478 * Avoids the 'clobbered by longjmp' warning.
479 */
480 sh_dummy_pre = (void*) &pre;
481 sh_dummy_ptr = (void*) &ptr;
482
483 while (ptr)
484 {
485 if (portchk_debug && report)
486 fprintf(stderr, _("check list: port %d/%s %d %d\n"),
487 ptr->port, SH_PROTO_STR(proto), ptr->flag, ptr->status);
488
489 if (ptr->status == SH_PORT_UNKN)
490 {
491 /* Don't report missing ports that are marked as optional
492 */
493 if (ptr->flag != SH_PORT_OPT && ptr->flag != SH_PORT_IGN)
494 {
495 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
496 ptr->interface, ptr->port, SH_PROTO_STR(proto),
497 ptr->service ? ptr->service : check_services(ptr->port, proto));
498#ifdef TEST_ONLY
499 if (report == SH_PORT_REPORT)
500 fprintf(stderr, _("%s\n"), errbuf);
501#else
502 if (report == SH_PORT_REPORT)
503 {
504 SH_MUTEX_LOCK(mutex_thread_nolog);
505 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
506 MSG_PORT_MISS, errbuf);
507 SH_MUTEX_UNLOCK(mutex_thread_nolog);
508 }
509#endif
510 }
511
512 ptr->status = SH_PORT_MISS;
513
514 if ((ptr->flag != SH_PORT_REQ) && (ptr->flag != SH_PORT_OPT) && (ptr->flag != SH_PORT_IGN))
515 {
516 if (portchk_debug && report)
517 fprintf(stderr, _("removing: port %d/%s %d %d\n"),
518 ptr->port, SH_PROTO_STR(proto), ptr->flag, ptr->status);
519
520 if (ptr == *head)
521 {
522 *head = ptr->next;
523 if (ptr->service)
524 SH_FREE(ptr->service);
525 SH_FREE(ptr);
526 ptr = *head;
527 pre = *head;
528 continue;
529 }
530 else if (ptr->next == NULL)
531 {
532 pre->next = NULL;
533 if (ptr->service)
534 SH_FREE(ptr->service);
535 SH_FREE(ptr);
536 return;
537 }
538 else
539 {
540 pre->next = ptr->next;
541 if (ptr->service)
542 SH_FREE(ptr->service);
543 SH_FREE(ptr);
544 ptr = pre->next;
545 continue;
546 }
547 }
548 }
549 pre = ptr;
550 ptr = ptr->next;
551 }
552 return;
553}
554
555
556static struct sh_portentry * sh_portchk_get_from_list (int proto, int port,
557 struct in_addr haddr, char * service)
558{
559 struct sh_portentry * portlist;
560 char iface_all[8];
561
562 sl_strlcpy (iface_all, _("0.0.0.0"), sizeof(iface_all));
563
564 if (proto == IPPROTO_TCP)
565 portlist = portlist_tcp;
566 else
567 portlist = portlist_udp;
568
569 if (service)
570 {
571 while (portlist)
572 {
573 if (portlist->service &&
574 0 == strcmp(service, portlist->service) &&
575 (0 == strcmp(portlist->interface, inet_ntoa(haddr)) ||
576 0 == strcmp(portlist->interface, iface_all)))
577 return portlist;
578 portlist = portlist->next;
579 }
580 }
581 else
582 {
583 while (portlist)
584 {
585 if (port == portlist->port &&
586 (0 == strcmp(portlist->interface, inet_ntoa(haddr)) ||
587 0 == strcmp(portlist->interface, iface_all)))
588 return portlist;
589 portlist = portlist->next;
590 }
591 }
592 return NULL;
593}
594
595
596static void sh_portchk_cmp_to_list (int proto, int port, struct in_addr haddr, char * service)
597{
598 struct sh_portentry * portent;
599 char errbuf[256];
600
601
602 portent = sh_portchk_get_from_list (proto, port, haddr, service);
603
604 if (service)
605 {
606 if (!portent)
607 {
608 char * path;
609 unsigned long qpid;
610 char user[USER_MAX];
611
612 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
613 inet_ntoa(haddr), port, SH_PROTO_STR(proto), service);
614#ifdef TEST_ONLY
615 fprintf(stderr, _("open port: %s:%d/%s (%s)\n"),
616 inet_ntoa(haddr), port, SH_PROTO_STR(proto), service);
617#else
618 path = sh_port2proc_query(proto, &haddr, port, &qpid, user, sizeof(user));
619 SH_MUTEX_LOCK(mutex_thread_nolog);
620 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
621 MSG_PORT_NEW, errbuf, path, qpid, user);
622 SH_MUTEX_UNLOCK(mutex_thread_nolog);
623 SH_FREE(path);
624#endif
625 /*
626 * was not there, thus it is not in 'required' or 'optional' list
627 */
628 sh_portchk_add_to_list (proto, port, haddr, service, SH_PORT_NOT, SH_PORT_ISOK);
629 }
630 else if (portent->status == SH_PORT_MISS && portent->flag != SH_PORT_IGN)
631 {
632 char * path;
633 unsigned long qpid;
634 char user[USER_MAX];
635
636 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s), was %d/%s"),
637 inet_ntoa(haddr), port, SH_PROTO_STR(proto), service, portent->port, SH_PROTO_STR(proto));
638#ifdef TEST_ONLY
639 fprintf(stderr, _("service: %s\n"), errbuf);
640#else
641 path = sh_port2proc_query(proto, &haddr, port, &qpid, user, sizeof(user));
642 SH_MUTEX_LOCK(mutex_thread_nolog);
643 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
644 MSG_PORT_RESTART, errbuf, path, qpid, user);
645 SH_MUTEX_UNLOCK(mutex_thread_nolog);
646 SH_FREE(path);
647#endif
648
649 portent->status = SH_PORT_ISOK;
650 }
651 else if (port != portent->port && (-1) != portent->port)
652 {
653 char * path;
654 unsigned long qpid;
655 char user[USER_MAX];
656
657 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s), was %d/%s"),
658 inet_ntoa(haddr), port, SH_PROTO_STR(proto), service, portent->port, SH_PROTO_STR(proto));
659#ifdef TEST_ONLY
660 fprintf(stderr, _("service: %s\n"), errbuf);
661#else
662 path = sh_port2proc_query(proto, &haddr, port, &qpid, user, sizeof(user));
663 SH_MUTEX_LOCK(mutex_thread_nolog);
664 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
665 MSG_PORT_NEWPORT, errbuf, path, qpid, user);
666 SH_MUTEX_UNLOCK(mutex_thread_nolog);
667 SH_FREE(path);
668#endif
669 portent->port = port;
670 portent->status = SH_PORT_ISOK;
671 }
672 else
673 {
674 portent->status = SH_PORT_ISOK;
675 }
676 }
677 else
678 {
679 if (!portent)
680 {
681 char * path;
682 unsigned long qpid;
683 char user[USER_MAX];
684
685 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
686 inet_ntoa(haddr), port, SH_PROTO_STR(proto), check_services(port, proto));
687#ifdef TEST_ONLY
688 fprintf(stderr, _("open port: %s:%d/%s (%s)\n"),
689 inet_ntoa(haddr), port, SH_PROTO_STR(proto), check_services(port, proto));
690#else
691 path = sh_port2proc_query(proto, &haddr, port, &qpid, user, sizeof(user));
692 SH_MUTEX_LOCK(mutex_thread_nolog);
693 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
694 MSG_PORT_NEW, errbuf, path, qpid, user);
695 SH_MUTEX_UNLOCK(mutex_thread_nolog);
696 SH_FREE(path);
697#endif
698
699 /* was not there, thus it is not in 'required' or 'optional' list
700 */
701 sh_portchk_add_to_list (proto, port, haddr, service, SH_PORT_NOT, SH_PORT_ISOK);
702 }
703 else if (portent->status == SH_PORT_MISS && portent->flag != SH_PORT_IGN)
704 {
705 char * path;
706 unsigned long qpid;
707 char user[USER_MAX];
708
709 snprintf (errbuf, sizeof(errbuf), _("port: %s:%d/%s (%s)"),
710 inet_ntoa(haddr), port, SH_PROTO_STR(proto), check_services(port, proto));
711#ifdef TEST_ONLY
712 fprintf(stderr, _("port : %s\n"), errbuf);
713#else
714 path = sh_port2proc_query(proto, &haddr, port, &qpid, user, sizeof(user));
715 SH_MUTEX_LOCK(mutex_thread_nolog);
716 sh_error_handle(sh_portchk_severity, FIL__, __LINE__, 0,
717 MSG_PORT_RESTART, errbuf, path, qpid, user);
718 SH_MUTEX_UNLOCK(mutex_thread_nolog);
719 SH_FREE(path);
720#endif
721
722 portent->status = SH_PORT_ISOK;
723 }
724 else
725 {
726 portent->status = SH_PORT_ISOK;
727 }
728 }
729
730 return;
731}
732
733
734/* Returns a static buffer containing the name of the service
735 * running on port <port> (from /etc/services)
736 * Returns NULL on failure
737 */
738static char * check_services (int port, int proto)
739{
740 static char buf[256];
741 char * service = sh_getservbyport(port, SH_PROTO_STR(proto), buf, sizeof(buf));
742
743 if (!service)
744 {
745 snprintf (buf, sizeof(buf), "%s",_("unknown"));
746 }
747 return buf;
748}
749
750/* Returns a static buffer containing the name of the service
751 * running on port <port> at <address> (from portmap daemon)
752 * Returns NULL on failure
753 */
754static char * check_rpc_list (int port, struct sockaddr_in * address,
755 unsigned long prot)
756{
757 struct pmaplist * head;
758 char *r;
759 static char buf[256];
760
761 head = pmap_getmaps(address);
762
763 if (head)
764 {
765 do /* while (head != NULL) */
766 {
767 if ((head->pml_map.pm_prot == prot) &&
768 (port == (int)head->pml_map.pm_port))
769 {
770 r = sh_getrpcbynumber((int)head->pml_map.pm_prog,
771 buf, sizeof(buf));
772 if (r)
773 {
774 return buf;
775 }
776 else
777 {
778 snprintf (buf, sizeof(buf), "RPC_%lu",
779 (unsigned long)head->pml_map.pm_prog);
780 return buf;
781 }
782 }
783 head = head->pml_next;
784 }
785 while (head != NULL);
786 }
787
788 return NULL;
789}
790
791static int check_port_udp_internal (int fd, int port, struct in_addr haddr)
792{
793 struct sockaddr_in sinr;
794 /* struct in_addr haddr; */
795 int retval;
796 char * p;
797 char buf[8];
798#ifndef TEST_ONLY
799 char errmsg[256];
800 int nerr;
801#endif
802 char errbuf[SH_ERRBUF_SIZE];
803
804 /* inet_aton(interface, &haddr); */
805
806 sinr.sin_family = AF_INET;
807 sinr.sin_port = htons (port);
808 sinr.sin_addr = haddr;
809
810 do {
811 retval = connect(fd, (struct sockaddr *) &sinr, sizeof(sinr));
812 } while (retval < 0 && (errno == EINTR || errno == EINPROGRESS));
813
814 if (retval == -1)
815 {
816#ifdef TEST_ONLY
817 if (portchk_debug)
818 perror(_("connect"));
819#else
820 nerr = errno;
821 sl_snprintf(errmsg, sizeof(errmsg), _("check port: %5d/udp on %15s: %s"),
822 port, inet_ntoa(haddr), sh_error_message(errno, errbuf, sizeof(errbuf)));
823 SH_MUTEX_LOCK(mutex_thread_nolog);
824 sh_error_handle((-1), FIL__, __LINE__, nerr, MSG_E_SUBGEN,
825 errmsg, _("connect"));
826 SH_MUTEX_UNLOCK(mutex_thread_nolog);
827#endif
828 }
829 else
830 {
831 do {
832 retval = send (fd, buf, 0, 0);
833 } while (retval < 0 && errno == EINTR);
834
835 if (retval == -1 && errno == ECONNREFUSED)
836 {
837 if (portchk_debug)
838 fprintf(stderr, _("check port: %5d/udp on %15s established/time_wait\n"),
839 port, inet_ntoa(haddr));
840 }
841 else
842 {
843 /* Only the second send() may catch the error
844 */
845 do {
846 retval = send (fd, buf, 0, 0);
847 } while (retval < 0 && errno == EINTR);
848
849 if (retval == -1 && errno == ECONNREFUSED)
850 {
851 if (portchk_debug)
852 fprintf(stderr, _("check port: %5d/udp on %15s established/time_wait\n"),
853 port, inet_ntoa(haddr));
854 }
855 else if (retval != -1)
856 {
857 /* Try to get service name from portmap
858 */
859 p = check_rpc_list (port, &sinr, IPPROTO_UDP);
860
861 sh_portchk_cmp_to_list (IPPROTO_UDP, port, haddr, p ? p : NULL);
862
863 /* If not an RPC service, try to get name from /etc/services
864 */
865 if (!p)
866 p = check_services(port, IPPROTO_UDP);
867
868 if (portchk_debug)
869 fprintf(stderr, _("check port: %5d/udp on %15s open %s\n"),
870 port, inet_ntoa(haddr), p);
871
872 }
873 }
874 }
875 close (fd);
876 return 0;
877}
878
879static int check_port_tcp_internal (int fd, int port, struct in_addr haddr)
880{
881 struct sockaddr_in sinr;
882 /* struct in_addr haddr; */
883 int retval;
884 int flags;
885 char * p;
886#ifndef TEST_ONLY
887 char errmsg[256];
888 int nerr;
889#endif
890 char errbuf[SH_ERRBUF_SIZE];
891
892 /* inet_aton(interface, &haddr); */
893
894 sinr.sin_family = AF_INET;
895 sinr.sin_port = htons (port);
896 sinr.sin_addr = haddr;
897
898 do {
899 retval = connect(fd, (struct sockaddr *) &sinr, sizeof(sinr));
900 } while (retval < 0 && (errno == EINTR || errno == EINPROGRESS));
901
902 if (retval == -1 && errno == ECONNREFUSED)
903 {
904 if (portchk_debug)
905 fprintf(stderr, _("check port: %5d on %15s established/time_wait\n"),
906 port, inet_ntoa(haddr));
907 }
908 else if (retval == -1)
909 {
910#ifdef TEST_ONLY
911 if (portchk_debug)
912 perror(_("connect"));
913#else
914 nerr = errno;
915 sl_snprintf(errmsg, sizeof(errmsg), _("check port: %5d/tcp on %15s: %s"),
916 port, inet_ntoa(haddr), sh_error_message(errno, errbuf, sizeof(errbuf)));
917 SH_MUTEX_LOCK(mutex_thread_nolog);
918 sh_error_handle((-1), FIL__, __LINE__, nerr, MSG_E_SUBGEN,
919 errmsg, _("connect"));
920 SH_MUTEX_UNLOCK(mutex_thread_nolog);
921#endif
922 }
923 else
924 {
925 /* Try to get service name from portmap
926 */
927 p = check_rpc_list (port, &sinr, IPPROTO_TCP);
928
929 sh_portchk_cmp_to_list (IPPROTO_TCP, port, haddr, p ? p : NULL);
930
931 /* If not an RPC service, try to get name from /etc/services
932 */
933 if (!p)
934 p = check_services(port, IPPROTO_TCP);
935
936 if (portchk_debug)
937 fprintf(stderr, _("check port: %5d on %15s open %s\n"),
938 port, inet_ntoa(haddr), p);
939
940#if !defined(O_NONBLOCK)
941#if defined(O_NDELAY)
942#define O_NONBLOCK O_NDELAY
943#else
944#define O_NONBLOCK 0
945#endif
946#endif
947
948 /* prepare to close connection gracefully
949 */
950 if (port == 22) /* ssh */
951 {
952 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
953 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
954 retval = write (fd, _("SSH-2.0-Foobar"), 14);
955 if (retval > 0) retval = write (fd, "\r\n", 2);
956 }
957 else if (port == 25) /* smtp */
958 {
959 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
960 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
961 retval = write (fd, _("QUIT"), 4);
962 if (retval > 0) retval = write (fd, "\r\n", 2);
963 }
964 else if (port == 79) /* finger */
965 {
966 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
967 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
968 retval = write (fd, "\r\n", 2);
969 }
970 else if (port == 110) /* pop3 */
971 {
972 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
973 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
974 retval = write (fd, _("QUIT"), 4);
975 if (retval > 0) retval = write (fd, "\r\n", 2);
976 }
977 else if (port == 143) /* imap */
978 {
979 flags = retry_fcntl(FIL__, __LINE__, fd, F_GETFL, 0);
980 retry_fcntl(FIL__, __LINE__, fd, F_SETFL, flags | O_NONBLOCK);
981 retval = write (fd, _("A01 LOGOUT"), 10);
982 if (retval > 0) retval = write (fd, "\r\n", 2);
983 }
984
985 if (portchk_debug && retval < 0)
986 fprintf(stderr, _("check port: error writing to port %5d\n"),
987 port);
988 }
989 close (fd);
990 return 0;
991}
992
993/* typedef uint32_t in_addr_t;
994 * struct in_addr
995 * {
996 * in_addr_t s_addr;
997 * };
998 */
999
1000#define SH_IFACE_MAX 16
1001
1002struct portchk_interfaces {
1003 struct in_addr iface[SH_IFACE_MAX];
1004 int used;
1005};
1006
1007static struct portchk_interfaces iface_list;
1008static int iface_initialized = 0;
1009
1010#ifdef TEST_ONLY
1011static char * portchk_hostname = NULL;
1012#else
1013static char * portchk_hostname = sh.host.name;
1014#endif
1015
1016static int sh_portchk_init_internal (void)
1017{
1018 struct hostent * hent;
1019 volatile int i; /* might be clobbered by ‘longjmp’ or ‘vfork’*/
1020 char errbuf[256];
1021
1022 if (portchk_debug)
1023 fprintf(stderr, _("checking ports on: %s\n"), portchk_hostname ? portchk_hostname : _("NULL"));
1024
1025 if (!portchk_hostname)
1026 return -1;
1027
1028 if (sh_portchk_active == S_FALSE)
1029 return -1;
1030
1031 SH_MUTEX_LOCK(mutex_port_check);
1032 if (iface_initialized == 0)
1033 {
1034 iface_list.used = 0;
1035 iface_initialized = 1;
1036 }
1037
1038 SH_MUTEX_LOCK(mutex_resolv);
1039 hent = sh_gethostbyname(portchk_hostname);
1040 i = 0;
1041 while (hent && hent->h_addr_list[i] && (iface_list.used < SH_IFACE_MAX))
1042 {
1043 memcpy (&(iface_list.iface[iface_list.used].s_addr), hent->h_addr_list[i], sizeof(in_addr_t));
1044 ++iface_list.used;
1045 ++i;
1046 }
1047 SH_MUTEX_UNLOCK(mutex_resolv);
1048
1049 for (i = 0; i < iface_list.used; ++i)
1050 {
1051 sl_snprintf(errbuf, sizeof(errbuf), _("interface: %s"),
1052 inet_ntoa(iface_list.iface[i]));
1053 SH_MUTEX_LOCK(mutex_thread_nolog);
1054 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1055 errbuf, _("sh_portchk_init"));
1056 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1057 }
1058 SH_MUTEX_UNLOCK(mutex_port_check);
1059
1060 return 0;
1061}
1062
1063int sh_portchk_init (struct mod_type * arg)
1064{
1065#ifndef HAVE_PTHREAD
1066 (void) arg;
1067#endif
1068
1069 if (sh_portchk_active == S_FALSE)
1070 return SH_MOD_FAILED;
1071 if (!portchk_hostname)
1072 return SH_MOD_FAILED;
1073
1074#ifdef HAVE_PTHREAD
1075 if (arg != NULL && arg->initval < 0 &&
1076 (sh.flag.isdaemon == S_TRUE || sh.flag.loop == S_TRUE))
1077 {
1078 if (0 == sh_pthread_create(sh_threaded_module_run, (void *)arg))
1079 return SH_MOD_THREAD;
1080 else
1081 return SH_MOD_FAILED;
1082 }
1083#endif
1084 return sh_portchk_init_internal();
1085}
1086
1087
1088
1089#if !defined(TEST_ONLY)
1090int sh_portchk_reconf (void)
1091{
1092 SH_MUTEX_LOCK(mutex_port_check);
1093 iface_initialized = 0;
1094 sh_portchk_active = 1;
1095 sh_portchk_check_udp = 1;
1096 sh_portchk_interval = SH_PORTCHK_INTERVAL;
1097
1098 portlist_udp = sh_portchk_kill_list (portlist_udp);
1099 portlist_tcp = sh_portchk_kill_list (portlist_tcp);
1100
1101 blacklist_udp = sh_portchk_kill_blacklist (blacklist_udp);
1102 blacklist_tcp = sh_portchk_kill_blacklist (blacklist_tcp);
1103 SH_MUTEX_UNLOCK(mutex_port_check);
1104 return 0;
1105}
1106
1107int sh_portchk_cleanup (void)
1108{
1109 return sh_portchk_reconf ();
1110}
1111
1112int sh_portchk_timer (time_t tcurrent)
1113{
1114 static time_t lastcheck = 0;
1115
1116 SL_ENTER(_("sh_portchk_timer"));
1117 if ((time_t) (tcurrent - lastcheck) >= sh_portchk_interval)
1118 {
1119 lastcheck = tcurrent;
1120 SL_RETURN((-1), _("sh_portchk_timer"));
1121 }
1122 SL_RETURN(0, _("sh_portchk_timer"));
1123}
1124#endif
1125
1126static int check_port_generic (int port, int type, int protocol)
1127{
1128 volatile int i = 0;
1129 int sock = -1;
1130 int flag = 1; /* non-zero to enable an option */
1131 struct in_addr haddr;
1132 char errbuf[SH_ERRBUF_SIZE];
1133
1134 /* Check all interfaces for this host
1135 */
1136 while (i < iface_list.used)
1137 {
1138 haddr.s_addr = iface_list.iface[i].s_addr;
1139
1140 if (0 != sh_portchk_is_blacklisted(port, haddr, protocol))
1141 {
1142 ++i; continue;
1143 }
1144
1145 if ((sock = socket(AF_INET, type, protocol)) < 0 )
1146 {
1147 ++i;
1148#ifdef TEST_ONLY
1149 if (portchk_debug)
1150 perror(_("socket"));
1151#else
1152 SH_MUTEX_LOCK(mutex_thread_nolog);
1153 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
1154 sh_error_message(errno, errbuf, sizeof(errbuf)), _("socket"));
1155 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1156#endif
1157 continue;
1158 }
1159 if ( setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
1160 (void *) &flag, sizeof(flag)) < 0 )
1161 {
1162 ++i;
1163#ifdef TEST_ONLY
1164 if (portchk_debug)
1165 perror(_("setsockopt"));
1166#else
1167 SH_MUTEX_LOCK(mutex_thread_nolog);
1168 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
1169 sh_error_message(errno, errbuf, sizeof(errbuf)),_("setsockopt"));
1170 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1171#endif
1172 continue;
1173 }
1174
1175
1176 if (protocol == IPPROTO_TCP)
1177 check_port_tcp_internal(sock, port, haddr);
1178 else
1179 check_port_udp_internal(sock, port, haddr);
1180
1181 ++i;
1182 }
1183
1184 return 0;
1185}
1186
1187
1188
1189static int check_port_udp (int port)
1190{
1191 return check_port_generic(port, SOCK_DGRAM, IPPROTO_UDP);
1192}
1193
1194static int check_port_tcp (int port)
1195{
1196 return check_port_generic(port, SOCK_STREAM, IPPROTO_TCP);
1197}
1198
1199
1200
1201static int sh_portchk_scan_ports_generic (int min_port, int max_port_arg, int type, int protocol)
1202{
1203 /*
1204 int min_port = 1024;
1205 int max_port = 65535;
1206 */
1207
1208 volatile int port; /* might be clobbered by ‘longjmp’ or ‘vfork’*/
1209 volatile int max_port = max_port_arg;
1210 int retval;
1211 int sock = -1;
1212 int flag = 1; /* non-zero to enable an option */
1213
1214 struct sockaddr_in addr;
1215 int addrlen = sizeof(addr);
1216 char errbuf[SH_ERRBUF_SIZE];
1217
1218 if (min_port == -1)
1219 min_port = 0;
1220 if (max_port == -1)
1221 max_port = 65535;
1222
1223 for (port = min_port; port <= max_port; ++port)
1224 {
1225
1226 if ((sock = socket(AF_INET, type, protocol)) < 0 )
1227 {
1228#ifdef TEST_ONLY
1229 if (portchk_debug)
1230 perror(_("socket"));
1231#else
1232 SH_MUTEX_LOCK(mutex_thread_nolog);
1233 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
1234 sh_error_message(errno, errbuf, sizeof(errbuf)), _("socket"));
1235 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1236#endif
1237 continue;
1238 }
1239 if ( setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
1240 (void *) &flag, sizeof(flag)) < 0 )
1241 {
1242#ifdef TEST_ONLY
1243 if (portchk_debug)
1244 perror(_("setsockopt"));
1245#else
1246 SH_MUTEX_LOCK(mutex_thread_nolog);
1247 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
1248 sh_error_message(errno, errbuf, sizeof(errbuf)),_("setsockopt"));
1249 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1250#endif
1251 continue;
1252 }
1253
1254 addr.sin_family = AF_INET;
1255 addr.sin_port = htons(port);
1256 addr.sin_addr.s_addr = INADDR_ANY;
1257
1258 retval = bind (sock, (struct sockaddr *) &addr, addrlen);
1259
1260 if (retval == 0)
1261 {
1262 /* we can bind the port, thus it is unused
1263 */
1264 close (sock);
1265 }
1266 else
1267 {
1268 if (errno == EINVAL || errno == EADDRINUSE)
1269 {
1270 /* try to connect to the port
1271 */
1272 if (protocol == IPPROTO_TCP)
1273 check_port_tcp(port);
1274 else
1275 check_port_udp(port);
1276 }
1277 else
1278 {
1279#ifdef TEST_ONLY
1280 if (portchk_debug)
1281 perror(_("bind"));
1282#else
1283 SH_MUTEX_LOCK(mutex_thread_nolog);
1284 sh_error_handle((-1), FIL__, __LINE__, errno, MSG_E_SUBGEN,
1285 sh_error_message(errno, errbuf, sizeof(errbuf)), _("bind"));
1286 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1287#endif
1288 }
1289 close (sock);
1290 }
1291 }
1292 return 0;
1293}
1294
1295static int sh_portchk_scan_ports_tcp (int min_port, int max_port)
1296{
1297 return sh_portchk_scan_ports_generic (min_port, max_port, SOCK_STREAM, IPPROTO_TCP);
1298}
1299
1300static int sh_portchk_scan_ports_udp (int min_port, int max_port)
1301{
1302 return sh_portchk_scan_ports_generic (min_port, max_port, SOCK_DGRAM, IPPROTO_UDP);
1303}
1304
1305/* Subroutine to add an interface
1306 */
1307static void * sh_dummy_str = NULL; /* fix clobbered by.. warning */
1308
1309static int sh_portchk_add_interface (const char * str)
1310{
1311 struct in_addr haddr;
1312 char errbuf[256];
1313 char buf[64];
1314
1315 sh_dummy_str = (void*) &str;
1316
1317 if (iface_initialized == 0)
1318 {
1319 iface_list.used = 0;
1320 iface_initialized = 1;
1321 }
1322
1323 do {
1324
1325 while (*str == ',' || *str == ' ' || *str == '\t') ++str;
1326
1327 if (*str)
1328 {
1329 unsigned int i = 0;
1330 while (*str && i < (sizeof(buf)-1) && *str != ',' && *str != ' ' && *str != '\t')
1331 {
1332 buf[i] = *str; ++str; ++i;
1333 }
1334 buf[i] = '\0';
1335
1336 if (0 == inet_aton(buf, &haddr))
1337 return -1;
1338
1339 if (iface_list.used == SH_IFACE_MAX)
1340 return -1;
1341
1342 sl_snprintf(errbuf, sizeof(errbuf), _("interface: %s"), inet_ntoa(haddr));
1343 SH_MUTEX_LOCK(mutex_thread_nolog);
1344 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1345 errbuf, _("sh_portchk_add_interface"));
1346 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1347
1348 memcpy (&(iface_list.iface[iface_list.used].s_addr), &(haddr.s_addr), sizeof(in_addr_t));
1349 ++iface_list.used;
1350 }
1351 } while (*str);
1352
1353 return 0;
1354}
1355
1356/* verify whether port/interface is blacklisted (do not check)
1357 */
1358static int sh_portchk_is_blacklisted(int port, struct in_addr haddr, int proto)
1359{
1360 struct sh_port * head;
1361
1362 if (proto == IPPROTO_TCP)
1363 head = blacklist_tcp;
1364 else
1365 head = blacklist_udp;
1366
1367 while (head)
1368 {
1369 if (head->port == port)
1370 {
1371 if ((head->haddr.s_addr == 0) || (head->haddr.s_addr == haddr.s_addr))
1372 return 1;
1373 else
1374 return 0;
1375 }
1376 head = head->next;
1377 }
1378 return 0;
1379}
1380
1381
1382static int sh_portchk_blacklist(int port, struct in_addr haddr, int proto)
1383{
1384 struct sh_port * black;
1385 struct sh_port * head;
1386
1387 if (proto == IPPROTO_TCP)
1388 head = blacklist_tcp;
1389 else
1390 head = blacklist_udp;
1391
1392 black = head;
1393
1394 while (black)
1395 {
1396 if (black->port == port && head->haddr.s_addr == haddr.s_addr)
1397 return -1;
1398 black = black->next;
1399 }
1400 black = SH_ALLOC (sizeof(struct sh_port));
1401 black->port = port;
1402 black->haddr.s_addr = haddr.s_addr;
1403 black->next = head;
1404
1405 if (proto == IPPROTO_TCP)
1406 blacklist_tcp = black;
1407 else
1408 blacklist_udp = black;
1409 return 0;
1410}
1411
1412
1413/* Subroutine to add a required or optional port/service
1414 */
1415static int sh_portchk_add_required_port_generic (char * service, char * interface, int type)
1416{
1417 char buf[256];
1418 int proto;
1419 char * p;
1420 char * endptr;
1421 unsigned long int port;
1422 struct in_addr haddr;
1423 struct sh_portentry * portent;
1424
1425 if (0 == inet_aton(interface, &haddr))
1426 return -1;
1427
1428 sl_strlcpy (buf, service, sizeof(buf));
1429
1430 p = strchr(buf, '/');
1431 if (!p)
1432 return -1;
1433 if (0 == strcmp(p, _("/tcp")))
1434 proto = IPPROTO_TCP;
1435 else if (0 == strcmp(p, _("/udp")))
1436 proto = IPPROTO_UDP;
1437 else
1438 return -1;
1439
1440 *p = '\0';
1441 port = strtoul(buf, &endptr, 0);
1442
1443 /* Blacklisted ports
1444 */
1445 if (*endptr == '\0' && port <= 65535 && type == SH_PORT_BLACKLIST)
1446 return (sh_portchk_blacklist(port, haddr, proto));
1447
1448 if (*endptr != '\0')
1449 {
1450 portent = sh_portchk_get_from_list (proto, -1, haddr, buf);
1451 if (!portent)
1452 sh_portchk_add_to_list (proto, -1, haddr, buf, type, SH_PORT_UNKN);
1453 else
1454 {
1455#ifdef TEST_ONLY
1456 fprintf(stderr, "** WARNING: duplicate port definition %s/%s\n", buf, SH_PROTO_STR(proto));
1457#else
1458 SH_MUTEX_LOCK(mutex_thread_nolog);
1459 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1460 _("duplicate port definition"), _("sh_portchk_add_required_port_generic"));
1461 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1462#endif
1463 return -1;
1464 }
1465 }
1466 else if (port <= 65535)
1467 {
1468 portent = sh_portchk_get_from_list (proto, port, haddr, NULL);
1469 if (!portent)
1470 sh_portchk_add_to_list (proto, port, haddr, NULL, type, SH_PORT_UNKN);
1471 else
1472 {
1473#ifdef TEST_ONLY
1474 fprintf(stderr, "** WARNING: duplicate port definition %lu/%s\n", port, SH_PROTO_STR(proto));
1475#else
1476 SH_MUTEX_LOCK(mutex_thread_nolog);
1477 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1478 _("duplicate port definition"), _("sh_portchk_add_required_port_generic"));
1479 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1480#endif
1481 return -1;
1482 }
1483 }
1484 else
1485 return -1;
1486
1487 return 0;
1488}
1489
1490/* Internal interface to add required or optional ports as 'iface:portlist'
1491 */
1492static int sh_portchk_add_required_generic (const char * str, int type)
1493{
1494 size_t len;
1495 size_t ll = 0;
1496 int status;
1497
1498 char * interface = NULL;
1499 char * list;
1500 char * p;
1501#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
1502 char * saveptr;
1503#endif
1504
1505 if (!str)
1506 return -1;
1507
1508 if (strchr(str, ':'))
1509 {
1510 len = strlen(str);
1511 for (ll = 0; ll < len; ++ll)
1512 {
1513 if (str[ll] == ':' || str[ll] == ' ' || str[ll] == '\t')
1514 {
1515 interface = SH_ALLOC(ll+1);
1516 sl_strlcpy(interface, str, ll+1);
1517 interface[ll] = '\0';
1518 while (str[ll] == ':' || str[ll] == ' ' || str[ll] == '\t')
1519 ++ll;
1520 break;
1521 }
1522 }
1523 }
1524 else
1525 {
1526 interface = SH_ALLOC(8);
1527 sl_strlcpy(interface, _("0.0.0.0"), 8);
1528 interface[7] = '\0';
1529 while (str[ll] == ' ' || str[ll] == '\t')
1530 ++ll;
1531 }
1532
1533 if (!interface)
1534 return -1;
1535
1536 if (str[ll] == '\0')
1537 {
1538 SH_FREE(interface);
1539 return -1;
1540 }
1541
1542 if (portchk_debug)
1543 fprintf(stderr, "add ports for interface: %s\n", interface);
1544
1545 list = sh_util_strdup(&str[ll]);
1546#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
1547 p = strtok_r (list, " ,\t", &saveptr);
1548#else
1549 p = strtok (list, " ,\t");
1550#endif
1551 if (!p)
1552 {
1553 SH_FREE(interface);
1554 SH_FREE(list);
1555 return -1;
1556 }
1557 while (p)
1558 {
1559 status = sh_portchk_add_required_port_generic (p, interface, type);
1560
1561 if (-1 == status)
1562 {
1563 SH_FREE(interface);
1564 SH_FREE(list);
1565 return -1;
1566 }
1567#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
1568 p = strtok_r (NULL, " ,\t", &saveptr);
1569#else
1570 p = strtok (NULL, " ,\t");
1571#endif
1572 }
1573 SH_FREE(interface);
1574 SH_FREE(list);
1575 return 0;
1576}
1577
1578/* User interface to add required ports as 'iface:portlist'
1579 */
1580static int sh_portchk_add_required (const char * str)
1581{
1582 return sh_portchk_add_required_generic (str, SH_PORT_REQ);
1583}
1584
1585/* User interface to add optional ports as 'iface:portlist'
1586 */
1587static int sh_portchk_add_optional (const char * str)
1588{
1589 return sh_portchk_add_required_generic (str, SH_PORT_OPT);
1590}
1591
1592/* User interface to add ignoreable ports as 'iface:portlist'
1593 */
1594static int sh_portchk_add_ignore (const char * str)
1595{
1596 return sh_portchk_add_required_generic (str, SH_PORT_IGN);
1597}
1598
1599/* User interface to add ports that should not be checked as 'iface:portlist'
1600 */
1601static int sh_portchk_add_blacklist (const char * str)
1602{
1603 return sh_portchk_add_required_generic (str, SH_PORT_BLACKLIST);
1604}
1605
1606/* Interface to run port check
1607 */
1608int sh_portchk_check ()
1609{
1610 volatile int min_port;
1611
1612 SH_MUTEX_LOCK(mutex_port_check);
1613
1614 min_port = 0;
1615
1616 if (sh_portchk_active != S_FALSE)
1617 {
1618 sh_portchk_reset_lists();
1619 if (0 != geteuid())
1620 {
1621 min_port = 1024;
1622#ifdef TEST_ONLY
1623 fprintf(stderr, "** WARNING not scanning ports < 1024\n");
1624#else
1625 SH_MUTEX_LOCK(mutex_thread_nolog);
1626 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1627 _("not scanning ports below 1024"), _("sh_portchk_check"));
1628 SH_MUTEX_UNLOCK(mutex_thread_nolog);
1629#endif
1630 }
1631
1632 sh_port2proc_prepare();
1633
1634 if (sh_portchk_check_udp == 1)
1635 sh_portchk_scan_ports_udp(min_port, -1);
1636 sh_portchk_scan_ports_tcp(min_port, -1);
1637
1638
1639 sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_REPORT);
1640 if (sh_portchk_check_udp == 1)
1641 sh_portchk_check_list (&portlist_udp, IPPROTO_UDP, SH_PORT_REPORT);
1642
1643 }
1644 SH_MUTEX_UNLOCK(mutex_port_check);
1645 return 0;
1646}
1647#endif
1648
1649#ifdef SH_CUTEST
1650#include "CuTest.h"
1651
1652void Test_portcheck_lists (CuTest *tc)
1653{
1654#if defined(SH_USE_PORTCHECK) && (defined(SH_WITH_CLIENT) || defined(SH_STANDALONE))
1655 struct in_addr haddr_local;
1656 struct sh_portentry * portent;
1657 char buf[256];
1658 char * p;
1659
1660 p = sh_getrpcbynumber(0, buf, sizeof(buf));
1661 CuAssertTrue(tc, p == NULL);
1662
1663 p = sh_getrpcbynumber(100000, buf, sizeof(buf));
1664 CuAssertPtrNotNull(tc, p);
1665 CuAssertTrue(tc, (0 == strcmp(p, "portmapper") || 0 == strcmp(p, "rpcbind")));
1666 CuAssertTrue(tc, (0 == strcmp(buf, "portmapper") || 0 == strcmp(p, "rpcbind")));
1667
1668 p = sh_getrpcbynumber(100007, buf, sizeof(buf));
1669 CuAssertPtrNotNull(tc, p);
1670 CuAssertTrue(tc, 0 == strcmp(p, "ypbind"));
1671 CuAssertTrue(tc, 0 == strcmp(buf, "ypbind"));
1672
1673 p = sh_getservbyport(0, SH_PROTO_STR(IPPROTO_TCP), buf, sizeof(buf));
1674 CuAssertTrue(tc, p == NULL);
1675
1676 p = sh_getservbyport(22, SH_PROTO_STR(IPPROTO_TCP), buf, sizeof(buf));
1677 CuAssertPtrNotNull(tc, p);
1678 CuAssertTrue(tc, 0 == strcmp(p, "ssh"));
1679 CuAssertTrue(tc, 0 == strcmp(buf, "ssh"));
1680
1681 p = sh_getservbyport(13, SH_PROTO_STR(IPPROTO_UDP), buf, sizeof(buf));
1682 CuAssertPtrNotNull(tc, p);
1683 CuAssertTrue(tc, 0 == strcmp(p, "daytime"));
1684 CuAssertTrue(tc, 0 == strcmp(buf, "daytime"));
1685
1686 CuAssertTrue(tc, 0 != inet_aton("127.0.0.1", &haddr_local));
1687
1688 sh_portchk_add_to_list (IPPROTO_TCP, 8000, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
1689
1690 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, haddr_local, NULL);
1691 CuAssertPtrNotNull(tc, portent);
1692
1693 CuAssertTrue(tc, portent->port == 8000);
1694 CuAssertTrue(tc, 0 == strcmp("127.0.0.1", portent->interface));
1695 CuAssertTrue(tc, portent->status == SH_PORT_UNKN);
1696 CuAssertTrue(tc, portent->flag == SH_PORT_NOT);
1697
1698 sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_NOREPT);
1699
1700 CuAssertTrue(tc, NULL == portlist_tcp);
1701
1702 sh_portchk_add_to_list (IPPROTO_TCP, 8000, haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
1703 sh_portchk_add_to_list (IPPROTO_TCP, 8001, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
1704 sh_portchk_add_to_list (IPPROTO_TCP, 8002, haddr_local, NULL, SH_PORT_REQ, SH_PORT_UNKN);
1705 sh_portchk_add_to_list (IPPROTO_TCP, 8003, haddr_local, NULL, SH_PORT_NOT, SH_PORT_UNKN);
1706 sh_portchk_add_to_list (IPPROTO_TCP, 8004, haddr_local, NULL, SH_PORT_IGN, SH_PORT_UNKN);
1707 sh_portchk_add_to_list (IPPROTO_TCP, -1, haddr_local, "foo1", SH_PORT_NOT, SH_PORT_UNKN);
1708 sh_portchk_add_to_list (IPPROTO_TCP, -1, haddr_local, "foo2", SH_PORT_REQ, SH_PORT_UNKN);
1709 sh_portchk_add_to_list (IPPROTO_TCP, -1, haddr_local, "foo3", SH_PORT_NOT, SH_PORT_UNKN);
1710 sh_portchk_add_to_list (IPPROTO_TCP, -1, haddr_local, "foo4", SH_PORT_REQ, SH_PORT_UNKN);
1711 sh_portchk_add_to_list (IPPROTO_TCP, -1, haddr_local, "foo5", SH_PORT_IGN, SH_PORT_UNKN);
1712
1713 sh_portchk_check_list (&portlist_tcp, IPPROTO_TCP, SH_PORT_NOREPT);
1714
1715 CuAssertPtrNotNull(tc, portlist_tcp);
1716
1717 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, haddr_local, NULL);
1718 CuAssertPtrNotNull(tc, portent);
1719
1720 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8001, haddr_local, NULL);
1721 CuAssertTrue(tc, NULL == portent);
1722
1723 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8002, haddr_local, NULL);
1724 CuAssertPtrNotNull(tc, portent);
1725
1726 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8003, haddr_local, NULL);
1727 CuAssertTrue(tc, NULL == portent);
1728
1729 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8004, haddr_local, NULL);
1730 CuAssertPtrNotNull(tc, portent);
1731
1732 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, haddr_local, "foo1");
1733 CuAssertTrue(tc, NULL == portent);
1734
1735 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, haddr_local, "foo2");
1736 CuAssertPtrNotNull(tc, portent);
1737 CuAssertTrue(tc, 0 == strcmp(portent->service, "foo2"));
1738
1739 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, haddr_local, "foo3");
1740 CuAssertTrue(tc, NULL == portent);
1741
1742 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, haddr_local, "foo4");
1743 CuAssertPtrNotNull(tc, portent);
1744 CuAssertTrue(tc, 0 == strcmp(portent->service, "foo4"));
1745
1746 portent = sh_portchk_get_from_list(IPPROTO_TCP, 8000, haddr_local, "foo5");
1747 CuAssertPtrNotNull(tc, portent);
1748 CuAssertTrue(tc, 0 == strcmp(portent->service, "foo5"));
1749
1750 CuAssertTrue(tc, 0 == sh_portchk_blacklist(666, haddr_local, IPPROTO_TCP));
1751 CuAssertTrue(tc, 0 != sh_portchk_blacklist(666, haddr_local, IPPROTO_TCP));
1752 CuAssertTrue(tc, 0 == sh_portchk_blacklist(667, haddr_local, IPPROTO_TCP));
1753 CuAssertTrue(tc, 0 == sh_portchk_blacklist(668, haddr_local, IPPROTO_TCP));
1754 CuAssertTrue(tc, 0 == sh_portchk_blacklist(666, haddr_local, IPPROTO_UDP));
1755 CuAssertTrue(tc, 0 != sh_portchk_blacklist(666, haddr_local, IPPROTO_UDP));
1756 CuAssertTrue(tc, 0 == sh_portchk_blacklist(667, haddr_local, IPPROTO_UDP));
1757 CuAssertTrue(tc, 0 == sh_portchk_blacklist(668, haddr_local, IPPROTO_UDP));
1758
1759 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(668, haddr_local, IPPROTO_UDP));
1760 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(667, haddr_local, IPPROTO_UDP));
1761 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(666, haddr_local, IPPROTO_UDP));
1762 CuAssertTrue(tc, 0 == sh_portchk_is_blacklisted(665, haddr_local, IPPROTO_UDP));
1763
1764 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(668, haddr_local, IPPROTO_TCP));
1765 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(667, haddr_local, IPPROTO_TCP));
1766 CuAssertTrue(tc, 0 != sh_portchk_is_blacklisted(666, haddr_local, IPPROTO_TCP));
1767 CuAssertTrue(tc, 0 == sh_portchk_is_blacklisted(665, haddr_local, IPPROTO_TCP));
1768#else
1769 (void) tc; /* fix compiler warning */
1770#endif
1771 return;
1772}
1773#endif
1774
1775#ifdef TEST_ONLY
1776
1777void usage (char * pname)
1778{
1779 printf ("%s [-r|--required interface:portlist][-o|--optional interface:portlist][--no-udp][-d|--debug] hostname\n\n", pname);
1780 printf (" Check local host for open ports; Version %s\n\n", PORTCHK_VERSION);
1781 printf (" Interface: Numeric address for an interface, e.g. 127.0.0.1\n");
1782 printf (" Portlist: List of ports or services, e.g. 22/tcp,nfs/udp,nlockmgr/udp\n");
1783 printf (" required -> must be open\n");
1784 printf (" optional -> may be open or closed\n");
1785 printf (" RPC services must be specified with service **name**, others with **port number**\n\n");
1786 printf (" Example:\n");
1787 printf (" %s --required 192.168.1.2:22/tcp,nfs/udp,nlockmgr/udp\n\n", pname);
1788 return;
1789}
1790
1791int main(int argc, char *argv[])
1792{
1793 char * pname = argv[0];
1794
1795
1796 /*
1797 test_lists();
1798
1799 portlist_tcp = sh_portchk_kill_list (portlist_tcp);
1800 portlist_udp = sh_portchk_kill_list (portlist_udp);
1801 */
1802
1803 // sh_portchk_add_required ("127.0.0.1 : nlockmgr/tcp, 5308/tcp, nfs/tcp");
1804
1805 while (argc > 1 && argv[1][0] == '-')
1806 {
1807 if (0 == strcmp(argv[1], "--help") || 0 == strcmp(argv[1], "-h"))
1808 {
1809 usage(pname);
1810 exit (0);
1811 }
1812 else if (0 == strcmp(argv[1], "--required") || 0 == strcmp(argv[1], "-r"))
1813 {
1814 if (argc < 3)
1815 {
1816 usage(pname);
1817 exit (1);
1818 }
1819 sh_portchk_add_required (argv[2]);
1820 --argc; ++argv;
1821 }
1822 else if (0 == strcmp(argv[1], "--optional") || 0 == strcmp(argv[1], "-o"))
1823 {
1824 if (argc < 3)
1825 {
1826 usage(pname);
1827 exit (1);
1828 }
1829 sh_portchk_add_optional (argv[2]);
1830 --argc; ++argv;
1831 }
1832 else if (0 == strcmp(argv[1], "--no-udp"))
1833 {
1834 sh_portchk_check_udp = 0;
1835 }
1836 else if (0 == strcmp(argv[1], "--debug") || 0 == strcmp(argv[1], "-d"))
1837 {
1838 portchk_debug = 1;
1839 }
1840 else
1841 {
1842 usage(pname);
1843 exit (1);
1844 }
1845 --argc; ++argv;
1846 }
1847
1848 if (argc < 2)
1849 {
1850 usage(pname);
1851 exit (1);
1852 }
1853
1854 portchk_hostname = argv[1];
1855
1856 if (0 != sh_portchk_init ())
1857 {
1858 usage(pname);
1859 exit (1);
1860 }
1861
1862 sh_portchk_check();
1863
1864 return 0;
1865}
1866#endif
Note: See TracBrowser for help on using the repository browser.