Changeset View
Changeset View
Standalone View
Standalone View
sbin/ipfw/main.c
| Show All 12 Lines | ||||||||||
| * Obviously, it would be nice if you gave credit where credit is due | * Obviously, it would be nice if you gave credit where credit is due | |||||||||
| * but requiring it would be too onerous. | * but requiring it would be too onerous. | |||||||||
| * | * | |||||||||
| * This software is provided ``AS IS'' without any warranties of any kind. | * This software is provided ``AS IS'' without any warranties of any kind. | |||||||||
| * | * | |||||||||
| * Command line interface for IP firewall facility | * Command line interface for IP firewall facility | |||||||||
| */ | */ | |||||||||
| #include <sys/stat.h> | ||||||||||
glebius: No longer needed. | ||||||||||
| #include <sys/wait.h> | #include <sys/wait.h> | |||||||||
| #include <ctype.h> | #include <ctype.h> | |||||||||
| #include <err.h> | #include <err.h> | |||||||||
| #include <errno.h> | #include <errno.h> | |||||||||
| #include <signal.h> | #include <signal.h> | |||||||||
| #include <stdio.h> | #include <stdio.h> | |||||||||
| #include <stdlib.h> | #include <stdlib.h> | |||||||||
| #include <string.h> | #include <string.h> | |||||||||
| #include <sysexits.h> | #include <sysexits.h> | |||||||||
| #include <unistd.h> | #include <unistd.h> | |||||||||
| #include <libgen.h> | #include <libgen.h> | |||||||||
| #include <osreldate.h> | ||||||||||
| #include "ipfw2.h" | #include "ipfw2.h" | |||||||||
| static void | static void | |||||||||
| help(void) | help(void) | |||||||||
| { | { | |||||||||
| if (is_ipfw()) { | if (is_ipfw()) { | |||||||||
| fprintf(stderr, | fprintf(stderr, | |||||||||
| "ipfw syntax summary (but please do read the ipfw(8) manpage):\n\n" | "ipfw syntax summary (but please do read the ipfw(8) manpage):\n\n" | |||||||||
| ▲ Show 20 Lines • Show All 643 Lines • ▼ Show 20 Lines | #if defined(_WIN32) && defined(TCC) | |||||||||
| } | } | |||||||||
| } | } | |||||||||
| #endif | #endif | |||||||||
| if (strcmp("dnctl", basename(av[0])) == 0) | if (strcmp("dnctl", basename(av[0])) == 0) | |||||||||
| g_co.prog = cmdline_prog_dnctl; | g_co.prog = cmdline_prog_dnctl; | |||||||||
| else | else | |||||||||
| g_co.prog = cmdline_prog_ipfw; | g_co.prog = cmdline_prog_ipfw; | |||||||||
Done Inline Actions
What's the point of using __FreeBSD_version here? It will be substituted by pre-processor at compilation time. We do not expect this code to be ever compiled outside of stable/14 and its descendants. glebius: What's the point of using __FreeBSD_version here? It will be substituted by pre-processor at… | ||||||||||
| /* | ||||||||||
| * ABI-incopatibility detected, check for availability of ipfw/dnctl15 | ||||||||||
| * binaries and run them instead | ||||||||||
| */ | ||||||||||
| if (getosreldate() >= 1500000) { | ||||||||||
| const char *releng15_progname; | ||||||||||
| struct stat sb; | ||||||||||
Done Inline Actions
glebius: | ||||||||||
| if (g_co.prog == cmdline_prog_ipfw) | ||||||||||
| releng15_progname = "/sbin/ipfw15"; | ||||||||||
Done Inline ActionsI can't imagine any exploitable use here, except a stupid admin who has "." in their PATH. However, just for the safety I would suggest two things:
glebius: I can't imagine any exploitable use here, except a stupid admin who has "." in their PATH. | ||||||||||
| else | ||||||||||
| releng15_progname = "/sbin/dnctl15"; | ||||||||||
| printf("WARNING! KBI incompatibility for ipfw is detected," | ||||||||||
| " trying to run %s.\n", releng15_progname); | ||||||||||
| if (stat(releng15_progname, &sb) < 0) { | ||||||||||
| printf("%s: %s\n", releng15_progname, | ||||||||||
| strerror(errno)); | ||||||||||
| return (1); | ||||||||||
| } else if (S_ISREG(sb.st_mode) == 0 || | ||||||||||
| (sb.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0) { | ||||||||||
| printf("%s is not an executable file\n", | ||||||||||
| releng15_progname); | ||||||||||
| return (1); | ||||||||||
| } | ||||||||||
Done Inline ActionsI don't think these extra checks with stat(2) add any value. The execution attempt will do the same checks internally. You may add an extra printf() with strerror() in the case of execv() failed. glebius: I don't think these extra checks with stat(2) add any value. The execution attempt will do the… | ||||||||||
| return execv(releng15_progname, av); | ||||||||||
| } | ||||||||||
| /* | /* | |||||||||
| * If the last argument is an absolute pathname, interpret it | * If the last argument is an absolute pathname, interpret it | |||||||||
| * as a file to be preprocessed. | * as a file to be preprocessed. | |||||||||
| */ | */ | |||||||||
| if (ac > 1 && av[ac - 1][0] == '/') { | if (ac > 1 && av[ac - 1][0] == '/') { | |||||||||
| if (access(av[ac - 1], R_OK) == 0) | if (access(av[ac - 1], R_OK) == 0) | |||||||||
| Show All 13 Lines | ||||||||||
No longer needed.