1 /*-
2 * Copyright (c) 2005 Andrey Simonenko
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27 #include <sys/types.h>
28 #include <sys/socket.h>
29 #include <sys/ucred.h>
30 #include <sys/un.h>
31 #include <stdarg.h>
32 #include <stdbool.h>
33
34 #include "uc_common.h"
35 #include "t_generic.h"
36 #include "t_peercred.h"
37
38 static int
check_xucred(const struct xucred * xucred,socklen_t len)39 check_xucred(const struct xucred *xucred, socklen_t len)
40 {
41 int rc;
42
43 if (len != sizeof(*xucred)) {
44 uc_logmsgx("option value size %zu != %zu",
45 (size_t)len, sizeof(*xucred));
46 return (-1);
47 }
48
49 uc_dbgmsg("xucred.cr_version %u", xucred->cr_version);
50 uc_dbgmsg("xucred.cr_uid %lu", (u_long)xucred->cr_uid);
51 uc_dbgmsg("xucred.cr_ngroups %d", xucred->cr_ngroups);
52
53 rc = 0;
54
55 if (xucred->cr_version != XUCRED_VERSION) {
56 uc_logmsgx("xucred.cr_version %u != %d",
57 xucred->cr_version, XUCRED_VERSION);
58 rc = -1;
59 }
60 if (xucred->cr_uid != uc_cfg.proc_cred.euid) {
61 uc_logmsgx("xucred.cr_uid %lu != %lu (EUID)",
62 (u_long)xucred->cr_uid, (u_long)uc_cfg.proc_cred.euid);
63 rc = -1;
64 }
65 if (xucred->cr_ngroups == 0) {
66 uc_logmsgx("xucred.cr_ngroups == 0");
67 rc = -1;
68 }
69 if (xucred->cr_ngroups < 0) {
70 uc_logmsgx("xucred.cr_ngroups < 0");
71 rc = -1;
72 }
73 if (xucred->cr_ngroups > XU_NGROUPS) {
74 uc_logmsgx("xucred.cr_ngroups %hu > %u (max)",
75 xucred->cr_ngroups, XU_NGROUPS);
76 rc = -1;
77 }
78 if (xucred->cr_groups[0] != uc_cfg.proc_cred.egid) {
79 uc_logmsgx("xucred.cr_groups[0] %lu != %lu (EGID)",
80 (u_long)xucred->cr_groups[0], (u_long)uc_cfg.proc_cred.egid);
81 rc = -1;
82 }
83 if (uc_check_groups("xucred.cr_groups", xucred->cr_groups,
84 "xucred.cr_ngroups", xucred->cr_ngroups, false) < 0)
85 rc = -1;
86 return (rc);
87 }
88
89 static int
t_peercred_client(int fd)90 t_peercred_client(int fd)
91 {
92 struct xucred xucred;
93 socklen_t len;
94
95 if (uc_sync_recv() < 0)
96 return (-1);
97
98 if (uc_socket_connect(fd) < 0)
99 return (-1);
100
101 len = sizeof(xucred);
102 if (getsockopt(fd, 0, LOCAL_PEERCRED, &xucred, &len) < 0) {
103 uc_logmsg("getsockopt(LOCAL_PEERCRED)");
104 return (-1);
105 }
106
107 if (check_xucred(&xucred, len) < 0)
108 return (-1);
109
110 return (0);
111 }
112
113 static int
t_peercred_server(int fd1)114 t_peercred_server(int fd1)
115 {
116 struct xucred xucred;
117 socklen_t len;
118 int fd2, rv;
119
120 if (uc_sync_send() < 0)
121 return (-2);
122
123 fd2 = uc_socket_accept(fd1);
124 if (fd2 < 0)
125 return (-2);
126
127 len = sizeof(xucred);
128 if (getsockopt(fd2, 0, LOCAL_PEERCRED, &xucred, &len) < 0) {
129 uc_logmsg("getsockopt(LOCAL_PEERCRED)");
130 rv = -2;
131 goto done;
132 }
133
134 if (check_xucred(&xucred, len) < 0) {
135 rv = -1;
136 goto done;
137 }
138
139 rv = 0;
140 done:
141 if (uc_socket_close(fd2) < 0)
142 rv = -2;
143 return (rv);
144 }
145
146 int
t_peercred(void)147 t_peercred(void)
148 {
149 return (t_generic(t_peercred_client, t_peercred_server));
150 }
151