1 /*- 2 * Copyright (c) 2005 Andrey Simonenko 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27 #include <sys/cdefs.h> 28 __FBSDID("$FreeBSD$"); 29 30 #include <sys/types.h> 31 #include <sys/socket.h> 32 #include <sys/ucred.h> 33 #include <sys/un.h> 34 #include <stdarg.h> 35 #include <stdbool.h> 36 37 #include "uc_common.h" 38 #include "t_generic.h" 39 #include "t_peercred.h" 40 41 static int 42 check_xucred(const struct xucred *xucred, socklen_t len) 43 { 44 int rc; 45 46 if (len != sizeof(*xucred)) { 47 uc_logmsgx("option value size %zu != %zu", 48 (size_t)len, sizeof(*xucred)); 49 return (-1); 50 } 51 52 uc_dbgmsg("xucred.cr_version %u", xucred->cr_version); 53 uc_dbgmsg("xucred.cr_uid %lu", (u_long)xucred->cr_uid); 54 uc_dbgmsg("xucred.cr_ngroups %d", xucred->cr_ngroups); 55 56 rc = 0; 57 58 if (xucred->cr_version != XUCRED_VERSION) { 59 uc_logmsgx("xucred.cr_version %u != %d", 60 xucred->cr_version, XUCRED_VERSION); 61 rc = -1; 62 } 63 if (xucred->cr_uid != uc_cfg.proc_cred.euid) { 64 uc_logmsgx("xucred.cr_uid %lu != %lu (EUID)", 65 (u_long)xucred->cr_uid, (u_long)uc_cfg.proc_cred.euid); 66 rc = -1; 67 } 68 if (xucred->cr_ngroups == 0) { 69 uc_logmsgx("xucred.cr_ngroups == 0"); 70 rc = -1; 71 } 72 if (xucred->cr_ngroups < 0) { 73 uc_logmsgx("xucred.cr_ngroups < 0"); 74 rc = -1; 75 } 76 if (xucred->cr_ngroups > XU_NGROUPS) { 77 uc_logmsgx("xucred.cr_ngroups %hu > %u (max)", 78 xucred->cr_ngroups, XU_NGROUPS); 79 rc = -1; 80 } 81 if (xucred->cr_groups[0] != uc_cfg.proc_cred.egid) { 82 uc_logmsgx("xucred.cr_groups[0] %lu != %lu (EGID)", 83 (u_long)xucred->cr_groups[0], (u_long)uc_cfg.proc_cred.egid); 84 rc = -1; 85 } 86 if (uc_check_groups("xucred.cr_groups", xucred->cr_groups, 87 "xucred.cr_ngroups", xucred->cr_ngroups, false) < 0) 88 rc = -1; 89 return (rc); 90 } 91 92 static int 93 t_peercred_client(int fd) 94 { 95 struct xucred xucred; 96 socklen_t len; 97 98 if (uc_sync_recv() < 0) 99 return (-1); 100 101 if (uc_socket_connect(fd) < 0) 102 return (-1); 103 104 len = sizeof(xucred); 105 if (getsockopt(fd, 0, LOCAL_PEERCRED, &xucred, &len) < 0) { 106 uc_logmsg("getsockopt(LOCAL_PEERCRED)"); 107 return (-1); 108 } 109 110 if (check_xucred(&xucred, len) < 0) 111 return (-1); 112 113 return (0); 114 } 115 116 static int 117 t_peercred_server(int fd1) 118 { 119 struct xucred xucred; 120 socklen_t len; 121 int fd2, rv; 122 123 if (uc_sync_send() < 0) 124 return (-2); 125 126 fd2 = uc_socket_accept(fd1); 127 if (fd2 < 0) 128 return (-2); 129 130 len = sizeof(xucred); 131 if (getsockopt(fd2, 0, LOCAL_PEERCRED, &xucred, &len) < 0) { 132 uc_logmsg("getsockopt(LOCAL_PEERCRED)"); 133 rv = -2; 134 goto done; 135 } 136 137 if (check_xucred(&xucred, len) < 0) { 138 rv = -1; 139 goto done; 140 } 141 142 rv = 0; 143 done: 144 if (uc_socket_close(fd2) < 0) 145 rv = -2; 146 return (rv); 147 } 148 149 int 150 t_peercred(void) 151 { 152 return (t_generic(t_peercred_client, t_peercred_server)); 153 } 154