Home | History | Annotate | Line # | Download | only in tcpdchk
tcpdchk.c revision 1.4 
      1 /*	$NetBSD: tcpdchk.c,v 1.4 1997/10/17 13:49:49 lukem Exp $	*/
      2 
      3  /*
      4   * tcpdchk - examine all tcpd access control rules and inetd.conf entries
      5   *
      6   * Usage: tcpdchk [-a] [-d] [-i inet_conf] [-v]
      7   *
      8   * -a: complain about implicit "allow" at end of rule.
      9   *
     10   * -d: rules in current directory.
     11   *
     12   * -i: location of inetd.conf file.
     13   *
     14   * -v: show all rules.
     15   *
     16   * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
     17   */
     18 
     19 #include <sys/cdefs.h>
     20 #ifndef lint
     21 #if 0
     22 static char sccsid[] = "@(#) tcpdchk.c 1.7 96/02/11 17:01:34";
     23 #else
     24 __RCSID("$NetBSD: tcpdchk.c,v 1.4 1997/10/17 13:49:49 lukem Exp $");
     25 #endif
     26 #endif
     27 
     28 /* System libraries. */
     29 
     30 #include <sys/types.h>
     31 #include <sys/stat.h>
     32 #include <netinet/in.h>
     33 #include <arpa/inet.h>
     34 #include <stdio.h>
     35 #include <syslog.h>
     36 #include <setjmp.h>
     37 #include <errno.h>
     38 #include <netdb.h>
     39 #include <string.h>
     40 #include <stdlib.h>
     41 #include <unistd.h>
     42 
     43 #ifndef INADDR_NONE
     44 #define INADDR_NONE     (-1)		/* XXX should be 0xffffffff */
     45 #endif
     46 
     47 #ifndef S_ISDIR
     48 #define S_ISDIR(m)	(((m) & S_IFMT) == S_IFDIR)
     49 #endif
     50 
     51 /* Application-specific. */
     52 
     53 #include "tcpd.h"
     54 #include "inetcf.h"
     55 #include "scaffold.h"
     56 
     57  /*
     58   * Stolen from hosts_access.c...
     59   */
     60 static char sep[] = ", \t\n";
     61 
     62 #define	BUFLEN 2048
     63 
     64 int     resident = 0;
     65 int     hosts_access_verbose = 0;
     66 char   *hosts_allow_table = HOSTS_ALLOW;
     67 char   *hosts_deny_table = HOSTS_DENY;
     68 extern jmp_buf tcpd_buf;
     69 
     70  /*
     71   * Local stuff.
     72   */
     73 static void usage __P((void));
     74 static void parse_table __P((char *, struct request_info *));
     75 static void print_list __P((char *, char *));
     76 static void check_daemon_list __P((char *));
     77 static void check_client_list __P((char *));
     78 static void check_daemon __P((char *));
     79 static void check_user __P((char *));
     80 static int check_host __P((char *));
     81 static int reserved_name __P((char *));
     82 
     83 int main __P((int, char **));
     84 
     85 #define PERMIT	1
     86 #define DENY	0
     87 
     88 #define YES	1
     89 #define	NO	0
     90 
     91 static int defl_verdict;
     92 static char *myname;
     93 static int allow_check;
     94 static char *inetcf;
     95 
     96 int     main(argc, argv)
     97 int     argc;
     98 char  **argv;
     99 {
    100     struct request_info request;
    101     struct stat st;
    102     int     c;
    103 
    104     myname = argv[0];
    105 
    106     /*
    107      * Parse the JCL.
    108      */
    109     while ((c = getopt(argc, argv, "adi:v")) != -1) {
    110 	switch (c) {
    111 	case 'a':
    112 	    allow_check = 1;
    113 	    break;
    114 	case 'd':
    115 	    hosts_allow_table = "hosts.allow";
    116 	    hosts_deny_table = "hosts.deny";
    117 	    break;
    118 	case 'i':
    119 	    inetcf = optarg;
    120 	    break;
    121 	case 'v':
    122 	    hosts_access_verbose++;
    123 	    break;
    124 	default:
    125 	    usage();
    126 	    /* NOTREACHED */
    127 	}
    128     }
    129     if (argc != optind)
    130 	usage();
    131 
    132     /*
    133      * When confusion really strikes...
    134      */
    135     if (check_path(REAL_DAEMON_DIR, &st) < 0) {
    136 	tcpd_warn("REAL_DAEMON_DIR %s: %m", REAL_DAEMON_DIR);
    137     } else if (!S_ISDIR(st.st_mode)) {
    138 	tcpd_warn("REAL_DAEMON_DIR %s is not a directory", REAL_DAEMON_DIR);
    139     }
    140 
    141     /*
    142      * Process the inet configuration file (or its moral equivalent). This
    143      * information is used later to find references in hosts.allow/deny to
    144      * unwrapped services, and other possible problems.
    145      */
    146     inetcf = inet_cfg(inetcf);
    147     if (hosts_access_verbose)
    148 	printf("Using network configuration file: %s\n", inetcf);
    149 
    150     /*
    151      * These are not run from inetd but may have built-in access control.
    152      */
    153     inet_set("portmap", WR_NOT);
    154     inet_set("rpcbind", WR_NOT);
    155 
    156     /*
    157      * Check accessibility of access control files.
    158      */
    159     (void) check_path(hosts_allow_table, &st);
    160     (void) check_path(hosts_deny_table, &st);
    161 
    162     /*
    163      * Fake up an arbitrary service request.
    164      */
    165     request_init(&request,
    166 		 RQ_DAEMON, "daemon_name",
    167 		 RQ_SERVER_NAME, "server_hostname",
    168 		 RQ_SERVER_ADDR, "server_addr",
    169 		 RQ_USER, "user_name",
    170 		 RQ_CLIENT_NAME, "client_hostname",
    171 		 RQ_CLIENT_ADDR, "client_addr",
    172 		 RQ_FILE, 1,
    173 		 0);
    174 
    175     /*
    176      * Examine all access-control rules.
    177      */
    178     defl_verdict = PERMIT;
    179     parse_table(hosts_allow_table, &request);
    180     defl_verdict = DENY;
    181     parse_table(hosts_deny_table, &request);
    182     return (0);
    183 }
    184 
    185 /* usage - explain */
    186 
    187 static void usage()
    188 {
    189     fprintf(stderr, "usage: %s [-a] [-d] [-i inet_conf] [-v]\n", myname);
    190     fprintf(stderr, "	-a: report rules with implicit \"ALLOW\" at end\n");
    191     fprintf(stderr, "	-d: use allow/deny files in current directory\n");
    192     fprintf(stderr, "	-i: location of inetd.conf file\n");
    193     fprintf(stderr, "	-v: list all rules\n");
    194     exit(1);
    195 }
    196 
    197 /* parse_table - like table_match(), but examines _all_ entries */
    198 
    199 static void parse_table(table, request)
    200 char   *table;
    201 struct request_info *request;
    202 {
    203     FILE   *fp;
    204     int     real_verdict;
    205     char    sv_list[BUFLEN];		/* becomes list of daemons */
    206     char   *cl_list;			/* becomes list of requests */
    207     char   *sh_cmd;			/* becomes optional shell command */
    208     int     verdict;
    209     struct tcpd_context saved_context;
    210 #ifdef __GNUC__
    211     /* XXX hack to avoid gcc warnings */
    212     (void) &real_verdict;
    213     (void) &saved_context;
    214 #endif
    215 
    216     saved_context = tcpd_context;		/* stupid compilers */
    217 
    218     if ((fp = fopen(table, "r")) != NULL) {
    219 	tcpd_context.file = table;
    220 	tcpd_context.line = 0;
    221 	while (xgets(sv_list, sizeof(sv_list), fp)) {
    222 	    if (sv_list[strlen(sv_list) - 1] != '\n') {
    223 		tcpd_warn("missing newline or line too long");
    224 		continue;
    225 	    }
    226 	    if (sv_list[0] == '#' || sv_list[strspn(sv_list, " \t\r\n")] == 0)
    227 		continue;
    228 	    if ((cl_list = split_at(sv_list, ':')) == 0) {
    229 		tcpd_warn("missing \":\" separator");
    230 		continue;
    231 	    }
    232 	    sh_cmd = split_at(cl_list, ':');
    233 
    234 	    if (hosts_access_verbose)
    235 		printf("\n>>> Rule %s line %d:\n",
    236 		       tcpd_context.file, tcpd_context.line);
    237 
    238 	    if (hosts_access_verbose)
    239 		print_list("daemons:  ", sv_list);
    240 	    check_daemon_list(sv_list);
    241 
    242 	    if (hosts_access_verbose)
    243 		print_list("clients:  ", cl_list);
    244 	    check_client_list(cl_list);
    245 
    246 #ifdef PROCESS_OPTIONS
    247 	    real_verdict = defl_verdict;
    248 	    if (sh_cmd) {
    249 		if ((verdict = setjmp(tcpd_buf)) != 0) {
    250 		    real_verdict = (verdict == AC_PERMIT);
    251 		} else {
    252 		    dry_run = 1;
    253 		    process_options(sh_cmd, request);
    254 		    if (dry_run == 1 && real_verdict && allow_check)
    255 			tcpd_warn("implicit \"allow\" at end of rule");
    256 		}
    257 	    } else if (defl_verdict && allow_check) {
    258 		tcpd_warn("implicit \"allow\" at end of rule");
    259 	    }
    260 	    if (hosts_access_verbose)
    261 		printf("access:   %s\n", real_verdict ? "granted" : "denied");
    262 #else
    263 	    if (sh_cmd)
    264 		shell_cmd(percent_x(buf, sizeof(buf), sh_cmd, request));
    265 	    if (hosts_access_verbose)
    266 		printf("access:   %s\n", defl_verdict ? "granted" : "denied");
    267 #endif
    268 	}
    269 	(void) fclose(fp);
    270     } else if (errno != ENOENT) {
    271 	tcpd_warn("cannot open %s: %m", table);
    272     }
    273     tcpd_context = saved_context;
    274 }
    275 
    276 /* print_list - pretty-print a list */
    277 
    278 static void print_list(title, list)
    279 char   *title;
    280 char   *list;
    281 {
    282     char    buf[BUFLEN];
    283     char   *cp;
    284     char   *next;
    285 
    286     fputs(title, stdout);
    287     strcpy(buf, list);
    288 
    289     for (cp = strtok(buf, sep); cp != 0; cp = next) {
    290 	fputs(cp, stdout);
    291 	next = strtok((char *) 0, sep);
    292 	if (next != 0)
    293 	    fputs(" ", stdout);
    294     }
    295     fputs("\n", stdout);
    296 }
    297 
    298 /* check_daemon_list - criticize daemon list */
    299 
    300 static void check_daemon_list(list)
    301 char   *list;
    302 {
    303     char    buf[BUFLEN];
    304     char   *cp;
    305     char   *host;
    306     int     daemons = 0;
    307 
    308     strcpy(buf, list);
    309 
    310     for (cp = strtok(buf, sep); cp != 0; cp = strtok((char *) 0, sep)) {
    311 	if (STR_EQ(cp, "EXCEPT")) {
    312 	    daemons = 0;
    313 	} else {
    314 	    daemons++;
    315 	    if ((host = split_at(cp + 1, '@')) != 0 && check_host(host) > 1) {
    316 		tcpd_warn("host %s has more than one address", host);
    317 		tcpd_warn("(consider using an address instead)");
    318 	    }
    319 	    check_daemon(cp);
    320 	}
    321     }
    322     if (daemons == 0)
    323 	tcpd_warn("daemon list is empty or ends in EXCEPT");
    324 }
    325 
    326 /* check_client_list - criticize client list */
    327 
    328 static void check_client_list(list)
    329 char   *list;
    330 {
    331     char    buf[BUFLEN];
    332     char   *cp;
    333     char   *host;
    334     int     clients = 0;
    335 
    336     strcpy(buf, list);
    337 
    338     for (cp = strtok(buf, sep); cp != 0; cp = strtok((char *) 0, sep)) {
    339 	if (STR_EQ(cp, "EXCEPT")) {
    340 	    clients = 0;
    341 	} else {
    342 	    clients++;
    343 	    if ((host = split_at(cp + 1, '@')) != NULL) {	/* user@host */
    344 		check_user(cp);
    345 		check_host(host);
    346 	    } else {
    347 		check_host(cp);
    348 	    }
    349 	}
    350     }
    351     if (clients == 0)
    352 	tcpd_warn("client list is empty or ends in EXCEPT");
    353 }
    354 
    355 /* check_daemon - criticize daemon pattern */
    356 
    357 static void check_daemon(pat)
    358 char   *pat;
    359 {
    360     if (pat[0] == '@') {
    361 	tcpd_warn("%s: daemon name begins with \"@\"", pat);
    362     } else if (pat[0] == '.') {
    363 	tcpd_warn("%s: daemon name begins with dot", pat);
    364     } else if (pat[strlen(pat) - 1] == '.') {
    365 	tcpd_warn("%s: daemon name ends in dot", pat);
    366     } else if (STR_EQ(pat, "ALL") || STR_EQ(pat, unknown)) {
    367 	 /* void */ ;
    368     } else if (STR_EQ(pat, "FAIL")) {		/* obsolete */
    369 	tcpd_warn("FAIL is no longer recognized");
    370 	tcpd_warn("(use EXCEPT or DENY instead)");
    371     } else if (reserved_name(pat)) {
    372 	tcpd_warn("%s: daemon name may be reserved word", pat);
    373     } else {
    374 	switch (inet_get(pat)) {
    375 	case WR_UNKNOWN:
    376 	    tcpd_warn("%s: no such process name in %s", pat, inetcf);
    377 	    inet_set(pat, WR_YES);		/* shut up next time */
    378 	    break;
    379 	case WR_NOT:
    380 	    tcpd_warn("%s: service possibly not wrapped", pat);
    381 	    inet_set(pat, WR_YES);
    382 	    break;
    383 	}
    384     }
    385 }
    386 
    387 /* check_user - criticize user pattern */
    388 
    389 static void check_user(pat)
    390 char   *pat;
    391 {
    392     if (pat[0] == '@') {			/* @netgroup */
    393 	tcpd_warn("%s: user name begins with \"@\"", pat);
    394     } else if (pat[0] == '.') {
    395 	tcpd_warn("%s: user name begins with dot", pat);
    396     } else if (pat[strlen(pat) - 1] == '.') {
    397 	tcpd_warn("%s: user name ends in dot", pat);
    398     } else if (STR_EQ(pat, "ALL") || STR_EQ(pat, unknown)
    399 	       || STR_EQ(pat, "KNOWN")) {
    400 	 /* void */ ;
    401     } else if (STR_EQ(pat, "FAIL")) {		/* obsolete */
    402 	tcpd_warn("FAIL is no longer recognized");
    403 	tcpd_warn("(use EXCEPT or DENY instead)");
    404     } else if (reserved_name(pat)) {
    405 	tcpd_warn("%s: user name may be reserved word", pat);
    406     }
    407 }
    408 
    409 /* check_host - criticize host pattern */
    410 
    411 static int check_host(pat)
    412 char   *pat;
    413 {
    414     char   *mask;
    415     int     addr_count = 1;
    416 
    417     if (pat[0] == '@') {			/* @netgroup */
    418 #ifdef NO_NETGRENT
    419 	/* SCO has no *netgrent() support */
    420 #else
    421 #ifdef NETGROUP
    422 	char   *machinep;
    423 	char   *userp;
    424 	char   *domainp;
    425 
    426 	setnetgrent(pat + 1);
    427 	if (getnetgrent(&machinep, &userp, &domainp) == 0)
    428 	    tcpd_warn("%s: unknown or empty netgroup", pat + 1);
    429 	endnetgrent();
    430 #else
    431 	tcpd_warn("netgroup support disabled");
    432 #endif
    433 #endif
    434     } else if ((mask = split_at(pat, '/')) != NULL) {	/* network/netmask */
    435 	if (dot_quad_addr(pat) == INADDR_NONE
    436 	    || dot_quad_addr(mask) == INADDR_NONE)
    437 	    tcpd_warn("%s/%s: bad net/mask pattern", pat, mask);
    438     } else if (STR_EQ(pat, "FAIL")) {		/* obsolete */
    439 	tcpd_warn("FAIL is no longer recognized");
    440 	tcpd_warn("(use EXCEPT or DENY instead)");
    441     } else if (reserved_name(pat)) {		/* other reserved */
    442 	 /* void */ ;
    443     } else if (NOT_INADDR(pat)) {		/* internet name */
    444 	if (pat[strlen(pat) - 1] == '.') {
    445 	    tcpd_warn("%s: domain or host name ends in dot", pat);
    446 	} else if (pat[0] != '.') {
    447 	    addr_count = check_dns(pat);
    448 	}
    449     } else {					/* numeric form */
    450 	if (STR_EQ(pat, "0.0.0.0") || STR_EQ(pat, "255.255.255.255")) {
    451 	    /* void */ ;
    452 	} else if (pat[0] == '.') {
    453 	    tcpd_warn("%s: network number begins with dot", pat);
    454 	} else if (pat[strlen(pat) - 1] != '.') {
    455 	    check_dns(pat);
    456 	}
    457     }
    458     return (addr_count);
    459 }
    460 
    461 /* reserved_name - determine if name is reserved */
    462 
    463 static int reserved_name(pat)
    464 char   *pat;
    465 {
    466     return (STR_EQ(pat, unknown)
    467 	    || STR_EQ(pat, "KNOWN")
    468 	    || STR_EQ(pat, paranoid)
    469 	    || STR_EQ(pat, "ALL")
    470 	    || STR_EQ(pat, "LOCAL"));
    471 }
    472