1 /* $NetBSD: security.c,v 1.5 2000/06/08 09:01:05 fvdl Exp $ */ 2 3 #include <sys/types.h> 4 #include <sys/time.h> 5 #include <sys/socket.h> 6 #include <netinet/in.h> 7 #include <arpa/inet.h> 8 #include <rpc/rpc.h> 9 #include <rpc/rpcb_prot.h> 10 #include <rpc/pmap_prot.h> 11 #include <stdio.h> 12 #include <string.h> 13 #include <unistd.h> 14 #include <syslog.h> 15 #include <netdb.h> 16 17 /* 18 * XXX for special case checks in check_callit. 19 */ 20 #include <rpcsvc/mount.h> 21 #include <rpcsvc/rquota.h> 22 #include <rpcsvc/nfs_prot.h> 23 #include <rpcsvc/yp.h> 24 #include <rpcsvc/ypclnt.h> 25 #include <rpcsvc/yppasswd.h> 26 27 #include "rpcbind.h" 28 29 #ifdef LIBWRAP 30 # include <tcpd.h> 31 #ifndef LIBWRAP_ALLOW_FACILITY 32 # define LIBWRAP_ALLOW_FACILITY LOG_AUTH 33 #endif 34 #ifndef LIBWRAP_ALLOW_SEVERITY 35 # define LIBWRAP_ALLOW_SEVERITY LOG_INFO 36 #endif 37 #ifndef LIBWRAP_DENY_FACILITY 38 # define LIBWRAP_DENY_FACILITY LOG_AUTH 39 #endif 40 #ifndef LIBWRAP_DENY_SEVERITY 41 # define LIBWRAP_DENY_SEVERITY LOG_WARNING 42 #endif 43 int allow_severity = LIBWRAP_ALLOW_FACILITY|LIBWRAP_ALLOW_SEVERITY; 44 int deny_severity = LIBWRAP_DENY_FACILITY|LIBWRAP_DENY_SEVERITY; 45 #endif 46 47 #ifndef PORTMAP_LOG_FACILITY 48 # define PORTMAP_LOG_FACILITY LOG_AUTH 49 #endif 50 #ifndef PORTMAP_LOG_SEVERITY 51 # define PORTMAP_LOG_SEVERITY LOG_INFO 52 #endif 53 int log_severity = PORTMAP_LOG_FACILITY|PORTMAP_LOG_SEVERITY; 54 55 extern int verboselog; 56 57 int 58 check_access(SVCXPRT *xprt, rpcproc_t proc, void *args, unsigned int rpcbvers) 59 { 60 struct netbuf *caller = svc_getrpccaller(xprt); 61 struct sockaddr *addr = (struct sockaddr *)caller->buf; 62 #ifdef LIBWRAP 63 struct request_info req; 64 #endif 65 rpcprog_t prog = 0; 66 rpcb *rpcbp; 67 struct pmap *pmap; 68 69 /* 70 * The older PMAP_* equivalents have the same numbers, so 71 * they are accounted for here as well. 72 */ 73 switch (proc) { 74 case RPCBPROC_GETADDR: 75 case RPCBPROC_SET: 76 case RPCBPROC_UNSET: 77 if (rpcbvers > PMAPVERS) { 78 rpcbp = (rpcb *)args; 79 prog = rpcbp->r_prog; 80 } else { 81 pmap = (struct pmap *)args; 82 prog = pmap->pm_prog; 83 } 84 if (proc == RPCBPROC_GETADDR) 85 break; 86 if (!insecure && !is_loopback(caller)) { 87 if (verboselog) 88 logit(log_severity, addr, proc, prog, 89 " declined (non-loopback sender)"); 90 return 0; 91 } 92 break; 93 case RPCBPROC_CALLIT: 94 case RPCBPROC_INDIRECT: 95 case RPCBPROC_DUMP: 96 case RPCBPROC_GETTIME: 97 case RPCBPROC_UADDR2TADDR: 98 case RPCBPROC_TADDR2UADDR: 99 case RPCBPROC_GETVERSADDR: 100 case RPCBPROC_GETADDRLIST: 101 case RPCBPROC_GETSTAT: 102 default: 103 break; 104 } 105 106 #ifdef LIBWRAP 107 if (libwrap && addr->sa_family != AF_LOCAL) { 108 request_init(&req, RQ_DAEMON, "rpcbind", RQ_CLIENT_SIN, addr, 109 0); 110 sock_methods(&req); 111 if(!hosts_access(&req)) { 112 logit(deny_severity, addr, proc, prog, 113 ": request from unauthorized host"); 114 return 0; 115 } 116 } 117 #endif 118 if (verboselog) 119 logit(log_severity, addr, proc, prog, ""); 120 return 1; 121 } 122 123 int 124 is_loopback(struct netbuf *nbuf) 125 { 126 struct sockaddr *addr = (struct sockaddr *)nbuf->buf; 127 struct sockaddr_in *sin; 128 #ifdef INET6 129 struct sockaddr_in6 *sin6; 130 #endif 131 132 switch (addr->sa_family) { 133 case AF_INET: 134 if (!oldstyle_local) 135 return 0; 136 sin = (struct sockaddr_in *)addr; 137 return ((sin->sin_addr.s_addr == htonl(INADDR_LOOPBACK)) && 138 (ntohs(sin->sin_port) < IPPORT_RESERVED)); 139 #ifdef INET6 140 case AF_INET6: 141 if (!oldstyle_local) 142 return 0; 143 sin6 = (struct sockaddr_in6 *)addr; 144 return (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr) && 145 (ntohs(sin6->sin6_port) < IPV6PORT_RESERVED)); 146 #endif 147 case AF_LOCAL: 148 case AF_NETLINK: 149 return 1; 150 default: 151 break; 152 } 153 154 return 0; 155 } 156 157 158 /* logit - report events of interest via the syslog daemon */ 159 void 160 logit(int severity, struct sockaddr *addr, rpcproc_t procnum, rpcprog_t prognum, 161 const char *text) 162 { 163 const char *procname; 164 char procbuf[32]; 165 char *progname; 166 char progbuf[32]; 167 char fromname[NI_MAXHOST]; 168 struct rpcent *rpc; 169 static const char *procmap[] = { 170 /* RPCBPROC_NULL */ "null", 171 /* RPCBPROC_SET */ "set", 172 /* RPCBPROC_UNSET */ "unset", 173 /* RPCBPROC_GETADDR */ "getport/addr", 174 /* RPCBPROC_DUMP */ "dump", 175 /* RPCBPROC_CALLIT */ "callit", 176 /* RPCBPROC_GETTIME */ "gettime", 177 /* RPCBPROC_UADDR2TADDR */ "uaddr2taddr", 178 /* RPCBPROC_TADDR2UADDR */ "taddr2uaddr", 179 /* RPCBPROC_GETVERSADDR */ "getversaddr", 180 /* RPCBPROC_INDIRECT */ "indirect", 181 /* RPCBPROC_GETADDRLIST */ "getaddrlist", 182 /* RPCBPROC_GETSTAT */ "getstat" 183 }; 184 185 /* 186 * Fork off a process or the portmap daemon might hang while 187 * getrpcbynumber() or syslog() does its thing. 188 */ 189 190 if (fork() == 0) { 191 setproctitle("logit"); 192 193 /* Try to map program number to name. */ 194 195 if (prognum == 0) { 196 progname = ""; 197 } else if ((rpc = getrpcbynumber((int) prognum))) { 198 progname = rpc->r_name; 199 } else { 200 snprintf(progname = progbuf, sizeof(progbuf), "%u", 201 (unsigned)prognum); 202 } 203 204 /* Try to map procedure number to name. */ 205 206 if (procnum >= (sizeof procmap / sizeof (char *))) { 207 snprintf(procbuf, sizeof procbuf, "%u", 208 (unsigned)procnum); 209 procname = procbuf; 210 } else 211 procname = procmap[procnum]; 212 213 /* Write syslog record. */ 214 215 if (addr->sa_family == AF_LOCAL) 216 strcpy(fromname, "local"); 217 else 218 getnameinfo(addr, addr->sa_len, fromname, 219 sizeof fromname, NULL, 0, NI_NUMERICHOST); 220 221 syslog(severity, "connect from %s to %s(%s)%s", 222 fromname, procname, progname, text); 223 _exit(0); 224 } 225 } 226 227 int 228 check_callit(SVCXPRT *xprt, struct r_rmtcall_args *args, int versnum __unused) 229 { 230 struct sockaddr *sa = (struct sockaddr *)svc_getrpccaller(xprt)->buf; 231 232 /* 233 * Always allow calling NULLPROC 234 */ 235 if (args->rmt_proc == 0) 236 return 1; 237 238 /* 239 * XXX - this special casing sucks. 240 */ 241 switch (args->rmt_prog) { 242 case RPCBPROG: 243 /* 244 * Allow indirect calls to ourselves in insecure mode. 245 * The is_loopback checks aren't useful then anyway. 246 */ 247 if (!insecure) 248 goto deny; 249 break; 250 case MOUNTPROG: 251 if (args->rmt_proc != MOUNTPROC_MNT && 252 args->rmt_proc != MOUNTPROC_UMNT) 253 break; 254 goto deny; 255 case YPBINDPROG: 256 if (args->rmt_proc != YPBINDPROC_SETDOM) 257 break; 258 /* FALLTHROUGH */ 259 case YPPASSWDPROG: 260 case NFS_PROGRAM: 261 case RQUOTAPROG: 262 goto deny; 263 case YPPROG: 264 switch (args->rmt_proc) { 265 case YPPROC_ALL: 266 case YPPROC_MATCH: 267 case YPPROC_FIRST: 268 case YPPROC_NEXT: 269 goto deny; 270 default: 271 break; 272 } 273 default: 274 break; 275 } 276 277 return 1; 278 deny: 279 #ifdef LIBWRAP 280 logit(deny_severity, sa, args->rmt_proc, args->rmt_prog, 281 ": indirect call not allowed"); 282 #else 283 logit(0, sa, args->rmt_proc, args->rmt_prog, 284 ": indirect call not allowed"); 285 #endif 286 return 0; 287 } 288