Index: head/libexec/casper/dns/dns.c =================================================================== --- head/libexec/casper/dns/dns.c (revision 282252) +++ head/libexec/casper/dns/dns.c (revision 282253) @@ -1,427 +1,436 @@ /*- * Copyright (c) 2012-2013 The FreeBSD Foundation * All rights reserved. * * This software was developed by Pawel Jakub Dawidek under sponsorship from * the FreeBSD Foundation. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #include __FBSDID("$FreeBSD$"); #include +#include #include #include #include #include #include #include #include #include #include static bool dns_allowed_type(const nvlist_t *limits, const char *type) { const char *name; bool notypes; void *cookie; if (limits == NULL) return (true); notypes = true; cookie = NULL; while ((name = nvlist_next(limits, NULL, &cookie)) != NULL) { if (strncmp(name, "type", sizeof("type") - 1) != 0) continue; notypes = false; if (strcmp(nvlist_get_string(limits, name), type) == 0) return (true); } /* If there are no types at all, allow any type. */ if (notypes) return (true); return (false); } static bool dns_allowed_family(const nvlist_t *limits, int family) { const char *name; bool nofamilies; void *cookie; if (limits == NULL) return (true); nofamilies = true; cookie = NULL; while ((name = nvlist_next(limits, NULL, &cookie)) != NULL) { if (strncmp(name, "family", sizeof("family") - 1) != 0) continue; nofamilies = false; if (family == AF_UNSPEC) continue; if (nvlist_get_number(limits, name) == (uint64_t)family) return (true); } /* If there are no families at all, allow any family. */ if (nofamilies) return (true); return (false); } static void hostent_pack(const struct hostent *hp, nvlist_t *nvl) { unsigned int ii; + char nvlname[64]; + int n; nvlist_add_string(nvl, "name", hp->h_name); nvlist_add_number(nvl, "addrtype", (uint64_t)hp->h_addrtype); nvlist_add_number(nvl, "length", (uint64_t)hp->h_length); if (hp->h_aliases == NULL) { nvlist_add_number(nvl, "naliases", 0); } else { for (ii = 0; hp->h_aliases[ii] != NULL; ii++) { - nvlist_addf_string(nvl, hp->h_aliases[ii], "alias%u", - ii); + n = snprintf(nvlname, sizeof(nvlname), "alias%u", ii); + assert(n > 0 && n < (int)sizeof(nvlname)); + nvlist_add_string(nvl, nvlname, hp->h_aliases[ii]); } nvlist_add_number(nvl, "naliases", (uint64_t)ii); } if (hp->h_addr_list == NULL) { nvlist_add_number(nvl, "naddrs", 0); } else { for (ii = 0; hp->h_addr_list[ii] != NULL; ii++) { - nvlist_addf_binary(nvl, hp->h_addr_list[ii], - (size_t)hp->h_length, "addr%u", ii); + n = snprintf(nvlname, sizeof(nvlname), "addr%u", ii); + assert(n > 0 && n < (int)sizeof(nvlname)); + nvlist_add_binary(nvl, nvlname, hp->h_addr_list[ii], + (size_t)hp->h_length); } nvlist_add_number(nvl, "naddrs", (uint64_t)ii); } } static int dns_gethostbyname(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout) { struct hostent *hp; int family; if (!dns_allowed_type(limits, "NAME")) return (NO_RECOVERY); family = (int)nvlist_get_number(nvlin, "family"); if (!dns_allowed_family(limits, family)) return (NO_RECOVERY); hp = gethostbyname2(nvlist_get_string(nvlin, "name"), family); if (hp == NULL) return (h_errno); hostent_pack(hp, nvlout); return (0); } static int dns_gethostbyaddr(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout) { struct hostent *hp; const void *addr; size_t addrsize; int family; if (!dns_allowed_type(limits, "ADDR")) return (NO_RECOVERY); family = (int)nvlist_get_number(nvlin, "family"); if (!dns_allowed_family(limits, family)) return (NO_RECOVERY); addr = nvlist_get_binary(nvlin, "addr", &addrsize); hp = gethostbyaddr(addr, (socklen_t)addrsize, family); if (hp == NULL) return (h_errno); hostent_pack(hp, nvlout); return (0); } static int dns_getnameinfo(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout) { struct sockaddr_storage sast; const void *sabin; char *host, *serv; size_t sabinsize, hostlen, servlen; socklen_t salen; int error, flags; if (!dns_allowed_type(limits, "NAME")) return (NO_RECOVERY); error = 0; host = serv = NULL; memset(&sast, 0, sizeof(sast)); hostlen = (size_t)nvlist_get_number(nvlin, "hostlen"); servlen = (size_t)nvlist_get_number(nvlin, "servlen"); if (hostlen > 0) { host = calloc(1, hostlen + 1); if (host == NULL) { error = EAI_MEMORY; goto out; } } if (servlen > 0) { serv = calloc(1, servlen + 1); if (serv == NULL) { error = EAI_MEMORY; goto out; } } sabin = nvlist_get_binary(nvlin, "sa", &sabinsize); if (sabinsize > sizeof(sast)) { error = EAI_FAIL; goto out; } memcpy(&sast, sabin, sabinsize); salen = (socklen_t)sabinsize; if ((sast.ss_family != AF_INET || salen != sizeof(struct sockaddr_in)) && (sast.ss_family != AF_INET6 || salen != sizeof(struct sockaddr_in6))) { error = EAI_FAIL; goto out; } if (!dns_allowed_family(limits, (int)sast.ss_family)) { error = NO_RECOVERY; goto out; } flags = (int)nvlist_get_number(nvlin, "flags"); error = getnameinfo((struct sockaddr *)&sast, salen, host, hostlen, serv, servlen, flags); if (error != 0) goto out; nvlist_move_string(nvlout, "host", host); nvlist_move_string(nvlout, "serv", serv); out: if (error != 0) { free(host); free(serv); } return (error); } static nvlist_t * addrinfo_pack(const struct addrinfo *ai) { nvlist_t *nvl; nvl = nvlist_create(0); nvlist_add_number(nvl, "ai_flags", (uint64_t)ai->ai_flags); nvlist_add_number(nvl, "ai_family", (uint64_t)ai->ai_family); nvlist_add_number(nvl, "ai_socktype", (uint64_t)ai->ai_socktype); nvlist_add_number(nvl, "ai_protocol", (uint64_t)ai->ai_protocol); nvlist_add_binary(nvl, "ai_addr", ai->ai_addr, (size_t)ai->ai_addrlen); nvlist_add_string(nvl, "ai_canonname", ai->ai_canonname); return (nvl); } static int dns_getaddrinfo(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout) { struct addrinfo hints, *hintsp, *res, *cur; const char *hostname, *servname; + char nvlname[64]; nvlist_t *elem; unsigned int ii; - int error, family; + int error, family, n; if (!dns_allowed_type(limits, "ADDR")) return (NO_RECOVERY); hostname = nvlist_get_string(nvlin, "hostname"); servname = nvlist_get_string(nvlin, "servname"); if (nvlist_exists_number(nvlin, "hints.ai_flags")) { size_t addrlen; hints.ai_flags = (int)nvlist_get_number(nvlin, "hints.ai_flags"); hints.ai_family = (int)nvlist_get_number(nvlin, "hints.ai_family"); hints.ai_socktype = (int)nvlist_get_number(nvlin, "hints.ai_socktype"); hints.ai_protocol = (int)nvlist_get_number(nvlin, "hints.ai_protocol"); hints.ai_addrlen = 0; hints.ai_addr = NULL; hints.ai_canonname = NULL; hintsp = &hints; family = hints.ai_family; } else { hintsp = NULL; family = AF_UNSPEC; } if (!dns_allowed_family(limits, family)) return (NO_RECOVERY); error = getaddrinfo(hostname, servname, hintsp, &res); if (error != 0) goto out; for (cur = res, ii = 0; cur != NULL; cur = cur->ai_next, ii++) { elem = addrinfo_pack(cur); - nvlist_movef_nvlist(nvlout, elem, "res%u", ii); + n = snprintf(nvlname, sizeof(nvlname), "res%u", ii); + assert(n > 0 && n < (int)sizeof(nvlname)); + nvlist_move_nvlist(nvlout, nvlname, elem); } freeaddrinfo(res); error = 0; out: return (error); } static bool limit_has_entry(const nvlist_t *limits, const char *prefix) { const char *name; size_t prefixlen; void *cookie; if (limits == NULL) return (false); prefixlen = strlen(prefix); cookie = NULL; while ((name = nvlist_next(limits, NULL, &cookie)) != NULL) { if (strncmp(name, prefix, prefixlen) == 0) return (true); } return (false); } static int dns_limit(const nvlist_t *oldlimits, const nvlist_t *newlimits) { const char *name; void *cookie; int nvtype; bool hastype, hasfamily; hastype = false; hasfamily = false; cookie = NULL; while ((name = nvlist_next(newlimits, &nvtype, &cookie)) != NULL) { if (nvtype == NV_TYPE_STRING) { const char *type; if (strncmp(name, "type", sizeof("type") - 1) != 0) return (EINVAL); type = nvlist_get_string(newlimits, name); if (strcmp(type, "ADDR") != 0 && strcmp(type, "NAME") != 0) { return (EINVAL); } if (!dns_allowed_type(oldlimits, type)) return (ENOTCAPABLE); hastype = true; } else if (nvtype == NV_TYPE_NUMBER) { int family; if (strncmp(name, "family", sizeof("family") - 1) != 0) return (EINVAL); family = (int)nvlist_get_number(newlimits, name); if (!dns_allowed_family(oldlimits, family)) return (ENOTCAPABLE); hasfamily = true; } else { return (EINVAL); } } /* * If the new limit doesn't mention type or family we have to * check if the current limit does have those. Missing type or * family in the limit means that all types or families are * allowed. */ if (!hastype) { if (limit_has_entry(oldlimits, "type")) return (ENOTCAPABLE); } if (!hasfamily) { if (limit_has_entry(oldlimits, "family")) return (ENOTCAPABLE); } return (0); } static int dns_command(const char *cmd, const nvlist_t *limits, nvlist_t *nvlin, nvlist_t *nvlout) { int error; if (strcmp(cmd, "gethostbyname") == 0) error = dns_gethostbyname(limits, nvlin, nvlout); else if (strcmp(cmd, "gethostbyaddr") == 0) error = dns_gethostbyaddr(limits, nvlin, nvlout); else if (strcmp(cmd, "getnameinfo") == 0) error = dns_getnameinfo(limits, nvlin, nvlout); else if (strcmp(cmd, "getaddrinfo") == 0) error = dns_getaddrinfo(limits, nvlin, nvlout); else error = NO_RECOVERY; return (error); } int main(int argc, char *argv[]) { return (service_start("system.dns", PARENT_FILENO, dns_limit, dns_command, argc, argv)); } Index: head/libexec/casper/grp/grp.c =================================================================== --- head/libexec/casper/grp/grp.c (revision 282252) +++ head/libexec/casper/grp/grp.c (revision 282253) @@ -1,384 +1,389 @@ /*- * Copyright (c) 2013 The FreeBSD Foundation * All rights reserved. * * This software was developed by Pawel Jakub Dawidek under sponsorship from * the FreeBSD Foundation. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #include __FBSDID("$FreeBSD$"); +#include #include #include #include #include #include #include #include #include static bool grp_allowed_cmd(const nvlist_t *limits, const char *cmd) { if (limits == NULL) return (true); /* * If no limit was set on allowed commands, then all commands * are allowed. */ if (!nvlist_exists_nvlist(limits, "cmds")) return (true); limits = nvlist_get_nvlist(limits, "cmds"); return (nvlist_exists_null(limits, cmd)); } static int grp_allowed_cmds(const nvlist_t *oldlimits, const nvlist_t *newlimits) { const char *name; void *cookie; int type; cookie = NULL; while ((name = nvlist_next(newlimits, &type, &cookie)) != NULL) { if (type != NV_TYPE_NULL) return (EINVAL); if (!grp_allowed_cmd(oldlimits, name)) return (ENOTCAPABLE); } return (0); } static bool grp_allowed_group(const nvlist_t *limits, const char *gname, gid_t gid) { const char *name; void *cookie; int type; if (limits == NULL) return (true); /* * If no limit was set on allowed groups, then all groups are allowed. */ if (!nvlist_exists_nvlist(limits, "groups")) return (true); limits = nvlist_get_nvlist(limits, "groups"); cookie = NULL; while ((name = nvlist_next(limits, &type, &cookie)) != NULL) { switch (type) { case NV_TYPE_NUMBER: if (gid != (gid_t)-1 && nvlist_get_number(limits, name) == (uint64_t)gid) { return (true); } break; case NV_TYPE_STRING: if (gname != NULL && strcmp(nvlist_get_string(limits, name), gname) == 0) { return (true); } break; default: PJDLOG_ABORT("Unexpected type %d.", type); } } return (false); } static int grp_allowed_groups(const nvlist_t *oldlimits, const nvlist_t *newlimits) { const char *name, *gname; void *cookie; gid_t gid; int type; cookie = NULL; while ((name = nvlist_next(newlimits, &type, &cookie)) != NULL) { switch (type) { case NV_TYPE_NUMBER: gid = (gid_t)nvlist_get_number(newlimits, name); gname = NULL; break; case NV_TYPE_STRING: gid = (gid_t)-1; gname = nvlist_get_string(newlimits, name); break; default: return (EINVAL); } if (!grp_allowed_group(oldlimits, gname, gid)) return (ENOTCAPABLE); } return (0); } static bool grp_allowed_field(const nvlist_t *limits, const char *field) { if (limits == NULL) return (true); /* * If no limit was set on allowed fields, then all fields are allowed. */ if (!nvlist_exists_nvlist(limits, "fields")) return (true); limits = nvlist_get_nvlist(limits, "fields"); return (nvlist_exists_null(limits, field)); } static int grp_allowed_fields(const nvlist_t *oldlimits, const nvlist_t *newlimits) { const char *name; void *cookie; int type; cookie = NULL; while ((name = nvlist_next(newlimits, &type, &cookie)) != NULL) { if (type != NV_TYPE_NULL) return (EINVAL); if (!grp_allowed_field(oldlimits, name)) return (ENOTCAPABLE); } return (0); } static bool grp_pack(const nvlist_t *limits, const struct group *grp, nvlist_t *nvl) { + char nvlname[64]; + int n; if (grp == NULL) return (true); /* * If either name or GID is allowed, we allow it. */ if (!grp_allowed_group(limits, grp->gr_name, grp->gr_gid)) return (false); if (grp_allowed_field(limits, "gr_name")) nvlist_add_string(nvl, "gr_name", grp->gr_name); else nvlist_add_string(nvl, "gr_name", ""); if (grp_allowed_field(limits, "gr_passwd")) nvlist_add_string(nvl, "gr_passwd", grp->gr_passwd); else nvlist_add_string(nvl, "gr_passwd", ""); if (grp_allowed_field(limits, "gr_gid")) nvlist_add_number(nvl, "gr_gid", (uint64_t)grp->gr_gid); else nvlist_add_number(nvl, "gr_gid", (uint64_t)-1); if (grp_allowed_field(limits, "gr_mem") && grp->gr_mem[0] != NULL) { unsigned int ngroups; for (ngroups = 0; grp->gr_mem[ngroups] != NULL; ngroups++) { - nvlist_addf_string(nvl, grp->gr_mem[ngroups], - "gr_mem[%u]", ngroups); + n = snprintf(nvlname, sizeof(nvlname), "gr_mem[%u]", + ngroups); + assert(n > 0 && n < sizeof(nvlname)); + nvlist_add_string(nvl, nvlname, grp->gr_mem[ngroups]); } nvlist_add_number(nvl, "gr_nmem", (uint64_t)ngroups); } return (true); } static int grp_getgrent(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout) { struct group *grp; for (;;) { errno = 0; grp = getgrent(); if (errno != 0) return (errno); if (grp_pack(limits, grp, nvlout)) return (0); } /* NOTREACHED */ } static int grp_getgrnam(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout) { struct group *grp; const char *name; if (!nvlist_exists_string(nvlin, "name")) return (EINVAL); name = nvlist_get_string(nvlin, "name"); PJDLOG_ASSERT(name != NULL); errno = 0; grp = getgrnam(name); if (errno != 0) return (errno); (void)grp_pack(limits, grp, nvlout); return (0); } static int grp_getgrgid(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout) { struct group *grp; gid_t gid; if (!nvlist_exists_number(nvlin, "gid")) return (EINVAL); gid = (gid_t)nvlist_get_number(nvlin, "gid"); errno = 0; grp = getgrgid(gid); if (errno != 0) return (errno); (void)grp_pack(limits, grp, nvlout); return (0); } static int grp_setgroupent(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout) { int stayopen; if (!nvlist_exists_bool(nvlin, "stayopen")) return (EINVAL); stayopen = nvlist_get_bool(nvlin, "stayopen") ? 1 : 0; return (setgroupent(stayopen) == 0 ? EFAULT : 0); } static int grp_setgrent(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout) { return (setgrent() == 0 ? EFAULT : 0); } static int grp_endgrent(const nvlist_t *limits, const nvlist_t *nvlin, nvlist_t *nvlout) { endgrent(); return (0); } static int grp_limit(const nvlist_t *oldlimits, const nvlist_t *newlimits) { const nvlist_t *limits; const char *name; void *cookie; int error, type; if (oldlimits != NULL && nvlist_exists_nvlist(oldlimits, "cmds") && !nvlist_exists_nvlist(newlimits, "cmds")) { return (ENOTCAPABLE); } if (oldlimits != NULL && nvlist_exists_nvlist(oldlimits, "fields") && !nvlist_exists_nvlist(newlimits, "fields")) { return (ENOTCAPABLE); } if (oldlimits != NULL && nvlist_exists_nvlist(oldlimits, "groups") && !nvlist_exists_nvlist(newlimits, "groups")) { return (ENOTCAPABLE); } cookie = NULL; while ((name = nvlist_next(newlimits, &type, &cookie)) != NULL) { if (type != NV_TYPE_NVLIST) return (EINVAL); limits = nvlist_get_nvlist(newlimits, name); if (strcmp(name, "cmds") == 0) error = grp_allowed_cmds(oldlimits, limits); else if (strcmp(name, "fields") == 0) error = grp_allowed_fields(oldlimits, limits); else if (strcmp(name, "groups") == 0) error = grp_allowed_groups(oldlimits, limits); else error = EINVAL; if (error != 0) return (error); } return (0); } static int grp_command(const char *cmd, const nvlist_t *limits, nvlist_t *nvlin, nvlist_t *nvlout) { int error; if (!grp_allowed_cmd(limits, cmd)) return (ENOTCAPABLE); if (strcmp(cmd, "getgrent") == 0 || strcmp(cmd, "getgrent_r") == 0) error = grp_getgrent(limits, nvlin, nvlout); else if (strcmp(cmd, "getgrnam") == 0 || strcmp(cmd, "getgrnam_r") == 0) error = grp_getgrnam(limits, nvlin, nvlout); else if (strcmp(cmd, "getgrgid") == 0 || strcmp(cmd, "getgrgid_r") == 0) error = grp_getgrgid(limits, nvlin, nvlout); else if (strcmp(cmd, "setgroupent") == 0) error = grp_setgroupent(limits, nvlin, nvlout); else if (strcmp(cmd, "setgrent") == 0) error = grp_setgrent(limits, nvlin, nvlout); else if (strcmp(cmd, "endgrent") == 0) error = grp_endgrent(limits, nvlin, nvlout); else error = EINVAL; return (error); } int main(int argc, char *argv[]) { return (service_start("system.grp", PARENT_FILENO, grp_limit, grp_command, argc, argv)); }