1 /* $NetBSD: security.c,v 1.5 2000/06/08 09:01:05 fvdl Exp $ */
2
3 #include <sys/types.h>
4 #include <sys/time.h>
5 #include <sys/socket.h>
6 #include <netinet/in.h>
7 #include <arpa/inet.h>
8 #include <rpc/rpc.h>
9 #include <rpc/rpcb_prot.h>
10 #include <rpc/pmap_prot.h>
11 #include <stdio.h>
12 #include <string.h>
13 #include <unistd.h>
14 #include <syslog.h>
15 #include <netdb.h>
16
17 /*
18 * XXX for special case checks in check_callit.
19 */
20 #include <rpcsvc/mount.h>
21 #include <rpcsvc/rquota.h>
22 #include <rpcsvc/nfs_prot.h>
23 #include <rpcsvc/yp.h>
24 #include <rpcsvc/ypclnt.h>
25 #include <rpcsvc/yppasswd.h>
26
27 #include "rpcbind.h"
28
29 #ifdef LIBWRAP
30 # include <tcpd.h>
31 #ifndef LIBWRAP_ALLOW_FACILITY
32 # define LIBWRAP_ALLOW_FACILITY LOG_AUTH
33 #endif
34 #ifndef LIBWRAP_ALLOW_SEVERITY
35 # define LIBWRAP_ALLOW_SEVERITY LOG_INFO
36 #endif
37 #ifndef LIBWRAP_DENY_FACILITY
38 # define LIBWRAP_DENY_FACILITY LOG_AUTH
39 #endif
40 #ifndef LIBWRAP_DENY_SEVERITY
41 # define LIBWRAP_DENY_SEVERITY LOG_WARNING
42 #endif
43 int allow_severity = LIBWRAP_ALLOW_FACILITY|LIBWRAP_ALLOW_SEVERITY;
44 int deny_severity = LIBWRAP_DENY_FACILITY|LIBWRAP_DENY_SEVERITY;
45 #endif
46
47 #ifndef PORTMAP_LOG_FACILITY
48 # define PORTMAP_LOG_FACILITY LOG_AUTH
49 #endif
50 #ifndef PORTMAP_LOG_SEVERITY
51 # define PORTMAP_LOG_SEVERITY LOG_INFO
52 #endif
53 int log_severity = PORTMAP_LOG_FACILITY|PORTMAP_LOG_SEVERITY;
54
55 extern int verboselog;
56
57 int
check_access(SVCXPRT * xprt,rpcproc_t proc,void * args,unsigned int rpcbvers)58 check_access(SVCXPRT *xprt, rpcproc_t proc, void *args, unsigned int rpcbvers)
59 {
60 struct netbuf *caller = svc_getrpccaller(xprt);
61 struct sockaddr *addr = (struct sockaddr *)caller->buf;
62 #ifdef LIBWRAP
63 struct request_info req;
64 #endif
65 rpcprog_t prog = 0;
66 rpcb *rpcbp;
67 struct pmap *pmap;
68
69 /*
70 * The older PMAP_* equivalents have the same numbers, so
71 * they are accounted for here as well.
72 */
73 switch (proc) {
74 case RPCBPROC_GETADDR:
75 case RPCBPROC_SET:
76 case RPCBPROC_UNSET:
77 if (rpcbvers > PMAPVERS) {
78 rpcbp = (rpcb *)args;
79 prog = rpcbp->r_prog;
80 } else {
81 pmap = (struct pmap *)args;
82 prog = pmap->pm_prog;
83 }
84 if (proc == RPCBPROC_GETADDR)
85 break;
86 if (!insecure && !is_loopback(caller)) {
87 if (verboselog)
88 logit(log_severity, addr, proc, prog,
89 " declined (non-loopback sender)");
90 return 0;
91 }
92 break;
93 case RPCBPROC_CALLIT:
94 case RPCBPROC_INDIRECT:
95 case RPCBPROC_DUMP:
96 case RPCBPROC_GETTIME:
97 case RPCBPROC_UADDR2TADDR:
98 case RPCBPROC_TADDR2UADDR:
99 case RPCBPROC_GETVERSADDR:
100 case RPCBPROC_GETADDRLIST:
101 case RPCBPROC_GETSTAT:
102 default:
103 break;
104 }
105
106 #ifdef LIBWRAP
107 if (libwrap && addr->sa_family != AF_LOCAL) {
108 request_init(&req, RQ_DAEMON, "rpcbind", RQ_CLIENT_SIN, addr,
109 0);
110 sock_methods(&req);
111 if(!hosts_access(&req)) {
112 logit(deny_severity, addr, proc, prog,
113 ": request from unauthorized host");
114 return 0;
115 }
116 }
117 #endif
118 if (verboselog)
119 logit(log_severity, addr, proc, prog, "");
120 return 1;
121 }
122
123 int
is_loopback(struct netbuf * nbuf)124 is_loopback(struct netbuf *nbuf)
125 {
126 struct sockaddr *addr = (struct sockaddr *)nbuf->buf;
127 struct sockaddr_in *sin;
128 #ifdef INET6
129 struct sockaddr_in6 *sin6;
130 #endif
131
132 switch (addr->sa_family) {
133 case AF_INET:
134 if (!oldstyle_local)
135 return 0;
136 sin = (struct sockaddr_in *)addr;
137 return ((sin->sin_addr.s_addr == htonl(INADDR_LOOPBACK)) &&
138 (ntohs(sin->sin_port) < IPPORT_RESERVED));
139 #ifdef INET6
140 case AF_INET6:
141 if (!oldstyle_local)
142 return 0;
143 sin6 = (struct sockaddr_in6 *)addr;
144 return (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr) &&
145 (ntohs(sin6->sin6_port) < IPV6PORT_RESERVED));
146 #endif
147 case AF_LOCAL:
148 case AF_NETLINK:
149 return 1;
150 default:
151 break;
152 }
153
154 return 0;
155 }
156
157
158 /* logit - report events of interest via the syslog daemon */
159 void
logit(int severity,struct sockaddr * addr,rpcproc_t procnum,rpcprog_t prognum,const char * text)160 logit(int severity, struct sockaddr *addr, rpcproc_t procnum, rpcprog_t prognum,
161 const char *text)
162 {
163 const char *procname;
164 char procbuf[32];
165 char *progname;
166 char progbuf[32];
167 char fromname[NI_MAXHOST];
168 struct rpcent *rpc;
169 static const char *procmap[] = {
170 /* RPCBPROC_NULL */ "null",
171 /* RPCBPROC_SET */ "set",
172 /* RPCBPROC_UNSET */ "unset",
173 /* RPCBPROC_GETADDR */ "getport/addr",
174 /* RPCBPROC_DUMP */ "dump",
175 /* RPCBPROC_CALLIT */ "callit",
176 /* RPCBPROC_GETTIME */ "gettime",
177 /* RPCBPROC_UADDR2TADDR */ "uaddr2taddr",
178 /* RPCBPROC_TADDR2UADDR */ "taddr2uaddr",
179 /* RPCBPROC_GETVERSADDR */ "getversaddr",
180 /* RPCBPROC_INDIRECT */ "indirect",
181 /* RPCBPROC_GETADDRLIST */ "getaddrlist",
182 /* RPCBPROC_GETSTAT */ "getstat"
183 };
184
185 /*
186 * Fork off a process or the portmap daemon might hang while
187 * getrpcbynumber() or syslog() does its thing.
188 */
189
190 if (fork() == 0) {
191 setproctitle("logit");
192
193 /* Try to map program number to name. */
194
195 if (prognum == 0) {
196 progname = "";
197 } else if ((rpc = getrpcbynumber((int) prognum))) {
198 progname = rpc->r_name;
199 } else {
200 snprintf(progname = progbuf, sizeof(progbuf), "%u",
201 (unsigned)prognum);
202 }
203
204 /* Try to map procedure number to name. */
205
206 if (procnum >= (sizeof procmap / sizeof (char *))) {
207 snprintf(procbuf, sizeof procbuf, "%u",
208 (unsigned)procnum);
209 procname = procbuf;
210 } else
211 procname = procmap[procnum];
212
213 /* Write syslog record. */
214
215 if (addr->sa_family == AF_LOCAL)
216 strcpy(fromname, "local");
217 else
218 getnameinfo(addr, addr->sa_len, fromname,
219 sizeof fromname, NULL, 0, NI_NUMERICHOST);
220
221 syslog(severity, "connect from %s to %s(%s)%s",
222 fromname, procname, progname, text);
223 _exit(0);
224 }
225 }
226
227 int
check_callit(SVCXPRT * xprt,struct r_rmtcall_args * args,int versnum __unused)228 check_callit(SVCXPRT *xprt, struct r_rmtcall_args *args, int versnum __unused)
229 {
230 struct sockaddr *sa = (struct sockaddr *)svc_getrpccaller(xprt)->buf;
231
232 /*
233 * Always allow calling NULLPROC
234 */
235 if (args->rmt_proc == 0)
236 return 1;
237
238 /*
239 * XXX - this special casing sucks.
240 */
241 switch (args->rmt_prog) {
242 case RPCBPROG:
243 /*
244 * Allow indirect calls to ourselves in insecure mode.
245 * The is_loopback checks aren't useful then anyway.
246 */
247 if (!insecure)
248 goto deny;
249 break;
250 case MOUNTPROG:
251 if (args->rmt_proc != MOUNTPROC_MNT &&
252 args->rmt_proc != MOUNTPROC_UMNT)
253 break;
254 goto deny;
255 case YPBINDPROG:
256 if (args->rmt_proc != YPBINDPROC_SETDOM)
257 break;
258 /* FALLTHROUGH */
259 case YPPASSWDPROG:
260 case NFS_PROGRAM:
261 case RQUOTAPROG:
262 goto deny;
263 case YPPROG:
264 switch (args->rmt_proc) {
265 case YPPROC_ALL:
266 case YPPROC_MATCH:
267 case YPPROC_FIRST:
268 case YPPROC_NEXT:
269 goto deny;
270 default:
271 break;
272 }
273 default:
274 break;
275 }
276
277 return 1;
278 deny:
279 #ifdef LIBWRAP
280 logit(deny_severity, sa, args->rmt_proc, args->rmt_prog,
281 ": indirect call not allowed");
282 #else
283 logit(0, sa, args->rmt_proc, args->rmt_prog,
284 ": indirect call not allowed");
285 #endif
286 return 0;
287 }
288