isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Convert sudoers plugin to use interface list passed in settings.

Browse Source
This commit is contained in:
Todd C. Miller
2010-09-08 15:07:40 -04:00
parent 1009d7a3e6
commit e069b74dc8
8 changed files with 64 additions and 306 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
plugins/sudoers/Makefile.in
View File

@@ -114,7 +114,8 @@ VISUDO_OBJS = visudo.o goodpath.o find_path.o error.o
REPLAY_OBJS = getdate.o sudoreplay.o error.o
TEST_OBJS = interfaces.o testsudoers.o tsgetgrpw.o error.o group_plugin.o
TEST_OBJS = interfaces.o testsudoers.o tsgetgrpw.o error.o group_plugin.o \
net_ifs.o
VERSION = @PACKAGE_VERSION@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
@@ -250,6 +251,8 @@ sudoreplay.o: $(srcdir)/sudoreplay.c $(incdir)/alloc.h $(incdir)/missing.h $(inc
testsudoers.o: $(srcdir)/testsudoers.c $(SUDODEP) $(srcdir)/parse.h $(incdir)/list.h $(srcdir)/interfaces.h $(devdir)/gram.h
tsgetgrpw.o: $(srcdir)/tsgetgrpw.c $(SUDODEP)
visudo.o: $(srcdir)/visudo.c $(SUDODEP) $(devdir)/gram.h
net_ifs.o: $(top_srcdir)/src/net_ifs.c $(SUDODEP)
$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(top_srcdir)/src/net_ifs.c
install: install-dirs install-plugin install-binaries install-sudoers install-doc

330
plugins/sudoers/interfaces.c
View File

@@ -1,6 +1,5 @@
/*
* Copyright (c) 1996, 1998-2005, 2007-2010
* Todd C. Miller <Todd.Miller@courtesan.com>
* Copyright (c) 2010 Todd C. Miller <Todd.Miller@courtesan.com>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
@@ -13,31 +12,13 @@
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*
* Sponsored in part by the Defense Advanced Research Projects
* Agency (DARPA) and Air Force Research Laboratory, Air Force
* Materiel Command, USAF, under agreement number F39502-99-1-0512.
*/
/*
* Suppress a warning w/ gcc on Digital UN*X.
* The system headers should really do this....
*/
#if defined(__osf__) && !defined(__cplusplus)
struct mbuf;
struct rtentry;
#endif
#include <config.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/param.h>
#include <sys/time.h>
#include <sys/ioctl.h>
#if defined(HAVE_SYS_SOCKIO_H) && !defined(SIOCGIFCONF)
# include <sys/sockio.h>
#endif
#include <stdio.h>
#ifdef STDC_HEADERS
# include <stdlib.h>
@@ -59,298 +40,71 @@ struct rtentry;
#ifdef HAVE_UNISTD_H
# include <unistd.h>
#endif /* HAVE_UNISTD_H */
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <errno.h>
#ifdef _ISC
# include <sys/stream.h>
# include <sys/sioctl.h>
# include <sys/stropts.h>
# define STRSET(cmd, param, len) {strioctl.ic_cmd=(cmd);\
strioctl.ic_dp=(param);\
strioctl.ic_timout=0;\
strioctl.ic_len=(len);}
#endif /* _ISC */
#ifdef _MIPS
# include <net/soioctl.h>
#endif /* _MIPS */
#include <netinet/in.h>
#include <arpa/inet.h>
#include <net/if.h>
#ifdef HAVE_GETIFADDRS
# include <ifaddrs.h>
#endif
#include "sudoers.h"
#include "interfaces.h"
/* Minix apparently lacks IFF_LOOPBACK */
#ifndef IFF_LOOPBACK
# define IFF_LOOPBACK 0
#endif
#ifdef HAVE_GETIFADDRS
/*
* Allocate and fill in the interfaces global variable with the
* machine's ip addresses and netmasks.
* Parse a space-delimited list of IP address/netmask pairs and
* store in a list of interface structures.
*/
void
load_interfaces(void)
set_interfaces(const char *ai)
{
struct ifaddrs *ifa, *ifaddrs;
struct sockaddr_in *sin;
#ifdef HAVE_IN6_ADDR
struct sockaddr_in6 *sin6;
#endif
int i;
char *addrinfo, *addr, *mask;
struct interface *ifp;
if (getifaddrs(&ifaddrs))
return;
/* Allocate space for the interfaces list. */
for (ifa = ifaddrs; ifa != NULL; ifa = ifa -> ifa_next) {
/* Skip interfaces marked "down" and "loopback". */
if (ifa->ifa_addr == NULL || !ISSET(ifa->ifa_flags, IFF_UP) ||
ISSET(ifa->ifa_flags, IFF_LOOPBACK))
addrinfo = estrdup(ai);
for (addr = strtok(addrinfo, " \t"); addr != NULL; addr = strtok(NULL, " \t")) {
/* Separate addr and mask. */
if ((mask = strchr(addr, '/')) == NULL)
continue;
*mask++ = '\0';
switch(ifa->ifa_addr->sa_family) {
case AF_INET:
/* Parse addr and store in list. */
ifp = emalloc(sizeof(*ifp));
if (strchr(addr, ':')) {
/* IPv6 */
#ifdef HAVE_IN6_ADDR
case AF_INET6:
ifp->family = AF_INET6;
if (inet_pton(AF_INET6, addr, &ifp->addr.ip6) != 1 ||
inet_pton(AF_INET6, mask, &ifp->netmask.ip6) != 1)
#endif
num_interfaces++;
break;
}
}
if (num_interfaces == 0)
return;
interfaces =
(struct interface *) emalloc2(num_interfaces, sizeof(struct interface));
/* Store the ip addr / netmask pairs. */
for (ifa = ifaddrs, i = 0; ifa != NULL; ifa = ifa -> ifa_next) {
/* Skip interfaces marked "down" and "loopback". */
if (ifa->ifa_addr == NULL || !ISSET(ifa->ifa_flags, IFF_UP) ||
ISSET(ifa->ifa_flags, IFF_LOOPBACK))
{
efree(ifp);
continue;
switch(ifa->ifa_addr->sa_family) {
case AF_INET:
sin = (struct sockaddr_in *)ifa->ifa_addr;
if (sin == NULL)
continue;
memcpy(&interfaces[i].addr, &sin->sin_addr,
sizeof(struct in_addr));
sin = (struct sockaddr_in *)ifa->ifa_netmask;
if (sin == NULL)
continue;
memcpy(&interfaces[i].netmask, &sin->sin_addr,
sizeof(struct in_addr));
interfaces[i].family = AF_INET;
i++;
break;
#ifdef HAVE_IN6_ADDR
case AF_INET6:
sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
if (sin6 == NULL)
continue;
memcpy(&interfaces[i].addr, &sin6->sin6_addr,
sizeof(struct in6_addr));
sin6 = (struct sockaddr_in6 *)ifa->ifa_netmask;
if (sin6 == NULL)
continue;
memcpy(&interfaces[i].netmask, &sin6->sin6_addr,
sizeof(struct in6_addr));
interfaces[i].family = AF_INET6;
i++;
break;
#endif /* HAVE_IN6_ADDR */
}
}
#ifdef HAVE_FREEIFADDRS
freeifaddrs(ifaddrs);
#else
efree(ifaddrs);
#endif
}
#elif defined(SIOCGIFCONF) && !defined(STUB_LOAD_INTERFACES)
/*
* Allocate and fill in the interfaces global variable with the
* machine's ip addresses and netmasks.
*/
void
load_interfaces(void)
{
struct ifconf *ifconf;
struct ifreq *ifr, ifr_tmp;
struct sockaddr_in *sin;
int sock, n, i;
size_t len = sizeof(struct ifconf) + BUFSIZ;
char *previfname = "", *ifconf_buf = NULL;
#ifdef _ISC
struct strioctl strioctl;
#endif /* _ISC */
sock = socket(AF_INET, SOCK_DGRAM, 0);
if (sock < 0)
error(1, "cannot open socket");
/*
* Get interface configuration or return (leaving num_interfaces == 0)
*/
for (;;) {
ifconf_buf = erealloc(ifconf_buf, len);
ifconf = (struct ifconf *) ifconf_buf;
ifconf->ifc_len = len - sizeof(struct ifconf);
ifconf->ifc_buf = (caddr_t) (ifconf_buf + sizeof(struct ifconf));
#ifdef _ISC
STRSET(SIOCGIFCONF, (caddr_t) ifconf, len);
if (ioctl(sock, I_STR, (caddr_t) &strioctl) < 0) {
#else
/* Note that some kernels return EINVAL if the buffer is too small */
if (ioctl(sock, SIOCGIFCONF, (caddr_t) ifconf) < 0 && errno != EINVAL) {
#endif /* _ISC */
efree(ifconf_buf);
(void) close(sock);
return;
}
/* Break out of loop if we have a big enough buffer. */
if (ifconf->ifc_len + sizeof(struct ifreq) < len)
break;
len += BUFSIZ;
}
/* Allocate space for the maximum number of interfaces that could exist. */
if ((n = ifconf->ifc_len / sizeof(struct ifreq)) == 0)
return;
interfaces = (struct interface *) emalloc2(n, sizeof(struct interface));
/* For each interface, store the ip address and netmask. */
for (i = 0; i < ifconf->ifc_len; ) {
/* Get a pointer to the current interface. */
ifr = (struct ifreq *) &ifconf->ifc_buf[i];
/* Set i to the subscript of the next interface. */
i += sizeof(struct ifreq);
#ifdef HAVE_SA_LEN
if (ifr->ifr_addr.sa_len > sizeof(ifr->ifr_addr))
i += ifr->ifr_addr.sa_len - sizeof(struct sockaddr);
#endif /* HAVE_SA_LEN */
/* Skip duplicates and interfaces with NULL addresses. */
sin = (struct sockaddr_in *) &ifr->ifr_addr;
if (sin->sin_addr.s_addr == 0 ||
strncmp(previfname, ifr->ifr_name, sizeof(ifr->ifr_name) - 1) == 0)
continue;
if (ifr->ifr_addr.sa_family != AF_INET)
continue;
#ifdef SIOCGIFFLAGS
zero_bytes(&ifr_tmp, sizeof(ifr_tmp));
strncpy(ifr_tmp.ifr_name, ifr->ifr_name, sizeof(ifr_tmp.ifr_name) - 1);
if (ioctl(sock, SIOCGIFFLAGS, (caddr_t) &ifr_tmp) < 0)
#endif
ifr_tmp = *ifr;
/* Skip interfaces marked "down" and "loopback". */
if (!ISSET(ifr_tmp.ifr_flags, IFF_UP) ||
ISSET(ifr_tmp.ifr_flags, IFF_LOOPBACK))
continue;
sin = (struct sockaddr_in *) &ifr->ifr_addr;
interfaces[num_interfaces].addr.ip4.s_addr = sin->sin_addr.s_addr;
/* Stash the name of the interface we saved. */
previfname = ifr->ifr_name;
/* Get the netmask. */
zero_bytes(&ifr_tmp, sizeof(ifr_tmp));
strncpy(ifr_tmp.ifr_name, ifr->ifr_name, sizeof(ifr_tmp.ifr_name) - 1);
#ifdef SIOCGIFNETMASK
#ifdef _ISC
STRSET(SIOCGIFNETMASK, (caddr_t) &ifr_tmp, sizeof(ifr_tmp));
if (ioctl(sock, I_STR, (caddr_t) &strioctl) == 0) {
#else
if (ioctl(sock, SIOCGIFNETMASK, (caddr_t) &ifr_tmp) == 0) {
#endif /* _ISC */
sin = (struct sockaddr_in *) &ifr_tmp.ifr_addr;
interfaces[num_interfaces].netmask.ip4.s_addr = sin->sin_addr.s_addr;
}
} else {
#else
{
#endif /* SIOCGIFNETMASK */
if (IN_CLASSC(interfaces[num_interfaces].addr.ip4.s_addr))
interfaces[num_interfaces].netmask.ip4.s_addr = htonl(IN_CLASSC_NET);
else if (IN_CLASSB(interfaces[num_interfaces].addr.ip4.s_addr))
interfaces[num_interfaces].netmask.ip4.s_addr = htonl(IN_CLASSB_NET);
else
interfaces[num_interfaces].netmask.ip4.s_addr = htonl(IN_CLASSA_NET);
/* IPv4 */
ifp->family = AF_INET6;
ifp->addr.ip4.s_addr = inet_addr(addr);
ifp->netmask.ip4.s_addr = inet_addr(mask);
if (ifp->addr.ip4.s_addr == (in_addr_t)-1 ||
ifp->netmask.ip4.s_addr == (in_addr_t)-1) {
efree(ifp);
continue;
}
}
/* Only now can we be sure it was a good/interesting interface. */
interfaces[num_interfaces].family = AF_INET;
num_interfaces++;
ifp->next = interfaces;
interfaces = ifp;
}
/* If the expected size < real size, realloc the array. */
if (n != num_interfaces) {
if (num_interfaces != 0)
interfaces = (struct interface *) erealloc3(interfaces,
num_interfaces, sizeof(struct interface));
else
efree(interfaces);
}
efree(ifconf_buf);
(void) close(sock);
efree(addrinfo);
}
#else /* !SIOCGIFCONF || STUB_LOAD_INTERFACES */
/*
* Stub function for those without SIOCGIFCONF
*/
void
load_interfaces(void)
dump_interfaces(const char *ai)
{
return;
}
char *cp, *addrinfo;
#endif /* SIOCGIFCONF && !STUB_LOAD_INTERFACES */
void
dump_interfaces(void)
{
int i;
#ifdef HAVE_IN6_ADDR
char addrbuf[INET6_ADDRSTRLEN], maskbuf[INET6_ADDRSTRLEN];
#endif
addrinfo = estrdup(ai);
sudo_printf(SUDO_CONV_INFO_MSG, "Local IP address and netmask pairs:\n");
for (i = 0; i < num_interfaces; i++) {
switch(interfaces[i].family) {
case AF_INET:
sudo_printf(SUDO_CONV_INFO_MSG,
"\t%s / ", inet_ntoa(interfaces[i].addr.ip4));
sudo_printf(SUDO_CONV_INFO_MSG, "%s\n",
inet_ntoa(interfaces[i].netmask.ip4));
break;
#ifdef HAVE_IN6_ADDR
case AF_INET6:
inet_ntop(AF_INET6, &interfaces[i].addr.ip6,
addrbuf, sizeof(addrbuf));
inet_ntop(AF_INET6, &interfaces[i].netmask.ip6,
maskbuf, sizeof(maskbuf));
sudo_printf(SUDO_CONV_INFO_MSG,
"\t%s / %s\n", addrbuf, maskbuf);
break;
#endif /* HAVE_IN6_ADDR */
}
}
for (cp = strtok(addrinfo, " \t"); cp != NULL; cp = strtok(NULL, " \t"))
sudo_printf(SUDO_CONV_INFO_MSG, "\t%s\n", cp);
efree(addrinfo);
}

7
plugins/sudoers/interfaces.h
View File

@@ -39,20 +39,21 @@ struct interface {
int family; /* AF_INET or AF_INET6 */
union sudo_in_addr_un addr;
union sudo_in_addr_un netmask;
struct interface *next;
};
/*
* Prototypes for external functions.
*/
void load_interfaces(void);
void dump_interfaces(void);
int get_net_ifs(char **addrinfo);
void dump_interfaces(const char *);
void set_interfaces(const char *);
/*
* Definitions for external variables.
*/
#ifndef _SUDO_MAIN
extern struct interface *interfaces;
extern int num_interfaces;
#endif
#endif /* _SUDO_INTERFACES_H */

7
plugins/sudoers/match.c
View File

@@ -578,7 +578,6 @@ command_matches_dir(char *sudoers_dir, size_t dlen)
static int
addr_matches_if(char *n)
{
int i;
union sudo_in_addr_un addr;
struct interface *ifp;
#ifdef HAVE_IN6_ADDR
@@ -596,8 +595,7 @@ addr_matches_if(char *n)
addr.ip4.s_addr = inet_addr(n);
}
for (i = 0; i < num_interfaces; i++) {
ifp = &interfaces[i];
for (ifp = interfaces; ifp != NULL; ifp = ifp->next) {
if (ifp->family != family)
continue;
switch(family) {
@@ -673,8 +671,7 @@ addr_matches_if_netmask(char *n, char *m)
}
#endif /* HAVE_IN6_ADDR */
for (i = 0; i < num_interfaces; i++) {
ifp = &interfaces[i];
for (ifp = interfaces; ifp != NULL; ifp = ifp->next) {
if (ifp->family != family)
continue;
switch(family) {

12
plugins/sudoers/sudoers.c
View File

@@ -123,7 +123,7 @@ char *prev_user;
struct sudo_user sudo_user;
struct passwd *list_pw;
struct interface *interfaces;
int num_interfaces;
static const char *interfaces_string;
int long_list;
int debug_level;
uid_t timestamp_uid;
@@ -203,9 +203,6 @@ sudoers_policy_open(unsigned int version, sudo_conv_t conversation,
/* Setup defaults data structures. */
init_defaults();
/* Load the list of local ip addresses and netmasks. */
load_interfaces();
/* Parse settings and user_info */
sudo_mode = deserialize_info(settings, user_info);
@@ -1154,7 +1151,7 @@ sudoers_policy_version(int verbose)
dump_auth_methods();
dump_defaults();
sudo_printf(SUDO_CONV_INFO_MSG, "\n");
dump_interfaces();
dump_interfaces(interfaces_string);
sudo_printf(SUDO_CONV_INFO_MSG, "\n");
}
return TRUE;
@@ -1257,6 +1254,11 @@ deserialize_info(char * const settings[], char * const user_info[])
continue;
}
#endif
if (MATCHES(*cur, "network_addrs=")) {
interfaces_string = *cur + sizeof("network_addrs=") - 1;
set_interfaces(interfaces_string);
continue;
}
}
for (cur = user_info; *cur != NULL; cur++) {

4
plugins/sudoers/testsudoers.c
View File

@@ -101,7 +101,6 @@ extern struct passwd *getpwuid(uid_t);
*/
int NewArgc;
char **NewArgv;
int num_interfaces;
struct interface *interfaces;
struct sudo_user sudo_user;
struct passwd *list_pw;
@@ -234,7 +233,8 @@ main(int argc, char *argv[])
init_defaults();
/* Load ip addr/mask for each interface. */
load_interfaces();
if (get_net_ifs(&p) > 0)
set_interfaces(p);
/* Allocate space for data structures in the parser. */
init_parser("sudoers", 0);

1
plugins/sudoers/visudo.c
View File

@@ -130,7 +130,6 @@ extern int optind;
/*
* Globals
*/
int num_interfaces;
struct interface *interfaces;
struct sudo_user sudo_user;
struct passwd *list_pw;

4
src/net_ifs.c
View File

@@ -80,7 +80,9 @@ struct rtentry;
# include <ifaddrs.h>
#endif
#include "sudo.h"
#include "missing.h"
#include "alloc.h"
#include "error.h"
/* Minix apparently lacks IFF_LOOPBACK */
#ifndef IFF_LOOPBACK