1*cf1d77f7Schristos /* $NetBSD: getpeereid.c,v 1.3 2021/08/14 16:14:58 christos Exp $ */
24e6df137Slukem
32de962bdSlukem /* getpeereid.c */
433197c6aStron /* $OpenLDAP$ */
52de962bdSlukem /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
62de962bdSlukem *
7*cf1d77f7Schristos * Copyright 2000-2021 The OpenLDAP Foundation.
82de962bdSlukem * All rights reserved.
92de962bdSlukem *
102de962bdSlukem * Redistribution and use in source and binary forms, with or without
112de962bdSlukem * modification, are permitted only as authorized by the OpenLDAP
122de962bdSlukem * Public License.
132de962bdSlukem *
142de962bdSlukem * A copy of this license is available in the file LICENSE in the
152de962bdSlukem * top-level directory of the distribution or, alternatively, at
162de962bdSlukem * <http://www.OpenLDAP.org/license.html>.
172de962bdSlukem */
182de962bdSlukem
194e6df137Slukem #ifndef _GNU_SOURCE
204e6df137Slukem #define _GNU_SOURCE 1 /* Needed for glibc struct ucred */
214e6df137Slukem #endif
224e6df137Slukem
238bd9f7cdSchristos #include <sys/cdefs.h>
24*cf1d77f7Schristos __RCSID("$NetBSD: getpeereid.c,v 1.3 2021/08/14 16:14:58 christos Exp $");
258bd9f7cdSchristos
262de962bdSlukem #include "portable.h"
272de962bdSlukem
282de962bdSlukem #ifndef HAVE_GETPEEREID
292de962bdSlukem
302de962bdSlukem #include <sys/types.h>
312de962bdSlukem #include <ac/unistd.h>
322de962bdSlukem
332de962bdSlukem #include <ac/socket.h>
342de962bdSlukem #include <ac/errno.h>
352de962bdSlukem
362de962bdSlukem #ifdef HAVE_GETPEERUCRED
372de962bdSlukem #include <ucred.h>
382de962bdSlukem #endif
392de962bdSlukem
402de962bdSlukem #ifdef LDAP_PF_LOCAL_SENDMSG
412de962bdSlukem #include <lber.h>
422de962bdSlukem #ifdef HAVE_SYS_UIO_H
432de962bdSlukem #include <sys/uio.h>
442de962bdSlukem #endif
452de962bdSlukem #include <sys/stat.h>
462de962bdSlukem #endif
472de962bdSlukem
482de962bdSlukem #ifdef HAVE_SYS_UCRED_H
492de962bdSlukem #ifdef HAVE_GRP_H
502de962bdSlukem #include <grp.h> /* for NGROUPS on Tru64 5.1 */
512de962bdSlukem #endif
522de962bdSlukem #include <sys/ucred.h>
532de962bdSlukem #endif
542de962bdSlukem
552de962bdSlukem #include <stdlib.h>
562de962bdSlukem
lutil_getpeereid(int s,uid_t * euid,gid_t * egid,struct berval * peerbv)572de962bdSlukem int lutil_getpeereid( int s, uid_t *euid, gid_t *egid
582de962bdSlukem #ifdef LDAP_PF_LOCAL_SENDMSG
592de962bdSlukem , struct berval *peerbv
602de962bdSlukem #endif
612de962bdSlukem )
622de962bdSlukem {
632de962bdSlukem #ifdef LDAP_PF_LOCAL
642de962bdSlukem #if defined( HAVE_GETPEERUCRED )
652de962bdSlukem ucred_t *uc = NULL;
662de962bdSlukem if( getpeerucred( s, &uc ) == 0 ) {
672de962bdSlukem *euid = ucred_geteuid( uc );
682de962bdSlukem *egid = ucred_getegid( uc );
692de962bdSlukem ucred_free( uc );
70bb30016cSlukem return 0;
712de962bdSlukem }
722de962bdSlukem
732de962bdSlukem #elif defined( SO_PEERCRED )
742de962bdSlukem struct ucred peercred;
752de962bdSlukem ber_socklen_t peercredlen = sizeof peercred;
762de962bdSlukem
772de962bdSlukem if(( getsockopt( s, SOL_SOCKET, SO_PEERCRED,
782de962bdSlukem (void *)&peercred, &peercredlen ) == 0 )
792de962bdSlukem && ( peercredlen == sizeof peercred ))
802de962bdSlukem {
812de962bdSlukem *euid = peercred.uid;
822de962bdSlukem *egid = peercred.gid;
832de962bdSlukem return 0;
842de962bdSlukem }
852de962bdSlukem
862de962bdSlukem #elif defined( LOCAL_PEERCRED )
872de962bdSlukem struct xucred peercred;
882de962bdSlukem ber_socklen_t peercredlen = sizeof peercred;
892de962bdSlukem
902de962bdSlukem if(( getsockopt( s, LOCAL_PEERCRED, 1,
912de962bdSlukem (void *)&peercred, &peercredlen ) == 0 )
922de962bdSlukem && ( peercred.cr_version == XUCRED_VERSION ))
932de962bdSlukem {
942de962bdSlukem *euid = peercred.cr_uid;
952de962bdSlukem *egid = peercred.cr_gid;
962de962bdSlukem return 0;
972de962bdSlukem }
982de962bdSlukem #elif defined( LDAP_PF_LOCAL_SENDMSG ) && defined( MSG_WAITALL )
992de962bdSlukem int err, fd;
1002de962bdSlukem struct iovec iov;
1012de962bdSlukem struct msghdr msg = {0};
1022de962bdSlukem # ifdef HAVE_STRUCT_MSGHDR_MSG_CONTROL
1032de962bdSlukem # ifndef CMSG_SPACE
1042de962bdSlukem # define CMSG_SPACE(len) (_CMSG_ALIGN(sizeof(struct cmsghdr)) + _CMSG_ALIGN(len))
1052de962bdSlukem # endif
1062de962bdSlukem # ifndef CMSG_LEN
1072de962bdSlukem # define CMSG_LEN(len) (_CMSG_ALIGN(sizeof(struct cmsghdr)) + (len))
1082de962bdSlukem # endif
1092de962bdSlukem struct {
1102de962bdSlukem struct cmsghdr cm;
1112de962bdSlukem int fd;
1122de962bdSlukem } control_st;
1132de962bdSlukem struct cmsghdr *cmsg;
1142de962bdSlukem # endif /* HAVE_STRUCT_MSGHDR_MSG_CONTROL */
1152de962bdSlukem struct stat st;
1162de962bdSlukem struct sockaddr_un lname, rname;
1172de962bdSlukem ber_socklen_t llen, rlen;
1182de962bdSlukem
1192de962bdSlukem rlen = sizeof(rname);
1202de962bdSlukem llen = sizeof(lname);
1212de962bdSlukem memset( &lname, 0, sizeof( lname ));
1222de962bdSlukem getsockname(s, (struct sockaddr *)&lname, &llen);
1232de962bdSlukem
1242de962bdSlukem iov.iov_base = peerbv->bv_val;
1252de962bdSlukem iov.iov_len = peerbv->bv_len;
1262de962bdSlukem msg.msg_iov = &iov;
1272de962bdSlukem msg.msg_iovlen = 1;
1282de962bdSlukem peerbv->bv_len = 0;
1292de962bdSlukem
1302de962bdSlukem # ifdef HAVE_STRUCT_MSGHDR_MSG_CONTROL
1312de962bdSlukem msg.msg_control = &control_st;
1322de962bdSlukem msg.msg_controllen = sizeof( struct cmsghdr ) + sizeof( int ); /* no padding! */
1332de962bdSlukem
1342de962bdSlukem cmsg = CMSG_FIRSTHDR( &msg );
1352de962bdSlukem # else
1362de962bdSlukem msg.msg_accrights = (char *)&fd;
1372de962bdSlukem msg.msg_accrightslen = sizeof(fd);
1382de962bdSlukem # endif
1392de962bdSlukem
1402de962bdSlukem /*
1412de962bdSlukem * AIX returns a bogus file descriptor if recvmsg() is
1422de962bdSlukem * called with MSG_PEEK (is this a bug?). Hence we need
1432de962bdSlukem * to receive the Abandon PDU.
1442de962bdSlukem */
1452de962bdSlukem err = recvmsg( s, &msg, MSG_WAITALL );
1462de962bdSlukem if( err >= 0 &&
1472de962bdSlukem # ifdef HAVE_STRUCT_MSGHDR_MSG_CONTROL
1482de962bdSlukem cmsg->cmsg_len == CMSG_LEN( sizeof(int) ) &&
1492de962bdSlukem cmsg->cmsg_level == SOL_SOCKET &&
1502de962bdSlukem cmsg->cmsg_type == SCM_RIGHTS
1512de962bdSlukem # else
1522de962bdSlukem msg.msg_accrightslen == sizeof(int)
1532de962bdSlukem # endif /* HAVE_STRUCT_MSGHDR_MSG_CONTROL*/
1542de962bdSlukem ) {
1552de962bdSlukem int mode = S_IFIFO|S_ISUID|S_IRWXU;
1562de962bdSlukem
1572de962bdSlukem /* We must receive a valid descriptor, it must be a pipe,
1582de962bdSlukem * it must only be accessible by its owner, and it must
1592de962bdSlukem * have the name of our socket written on it.
1602de962bdSlukem */
1612de962bdSlukem peerbv->bv_len = err;
1622de962bdSlukem # ifdef HAVE_STRUCT_MSGHDR_MSG_CONTROL
1632de962bdSlukem fd = (*(int *)CMSG_DATA( cmsg ));
1642de962bdSlukem # endif
1652de962bdSlukem err = fstat( fd, &st );
1662de962bdSlukem if ( err == 0 )
1672de962bdSlukem rlen = read(fd, &rname, rlen);
1682de962bdSlukem close(fd);
1692de962bdSlukem if( err == 0 && st.st_mode == mode &&
1702de962bdSlukem llen == rlen && !memcmp(&lname, &rname, llen))
1712de962bdSlukem {
1722de962bdSlukem *euid = st.st_uid;
1732de962bdSlukem *egid = st.st_gid;
1742de962bdSlukem return 0;
1752de962bdSlukem }
1762de962bdSlukem }
1772de962bdSlukem #elif defined(SOCKCREDSIZE)
1782de962bdSlukem struct msghdr msg;
1792de962bdSlukem ber_socklen_t crmsgsize;
1802de962bdSlukem void *crmsg;
1812de962bdSlukem struct cmsghdr *cmp;
1822de962bdSlukem struct sockcred *sc;
1832de962bdSlukem
1842de962bdSlukem memset(&msg, 0, sizeof msg);
1852de962bdSlukem crmsgsize = CMSG_SPACE(SOCKCREDSIZE(NGROUPS));
1862de962bdSlukem if (crmsgsize == 0) goto sc_err;
1872de962bdSlukem crmsg = malloc(crmsgsize);
1882de962bdSlukem if (crmsg == NULL) goto sc_err;
1892de962bdSlukem memset(crmsg, 0, crmsgsize);
1902de962bdSlukem
1912de962bdSlukem msg.msg_control = crmsg;
1922de962bdSlukem msg.msg_controllen = crmsgsize;
1932de962bdSlukem
1942de962bdSlukem if (recvmsg(s, &msg, 0) < 0) {
1952de962bdSlukem free(crmsg);
1962de962bdSlukem goto sc_err;
1972de962bdSlukem }
1982de962bdSlukem
1992de962bdSlukem if (msg.msg_controllen == 0 || (msg.msg_flags & MSG_CTRUNC) != 0) {
2002de962bdSlukem free(crmsg);
2012de962bdSlukem goto sc_err;
2022de962bdSlukem }
2032de962bdSlukem
2042de962bdSlukem cmp = CMSG_FIRSTHDR(&msg);
2052de962bdSlukem if (cmp->cmsg_level != SOL_SOCKET || cmp->cmsg_type != SCM_CREDS) {
2062de962bdSlukem printf("nocreds\n");
2072de962bdSlukem goto sc_err;
2082de962bdSlukem }
2092de962bdSlukem
2102de962bdSlukem sc = (struct sockcred *)(void *)CMSG_DATA(cmp);
2112de962bdSlukem
2122de962bdSlukem *euid = sc->sc_euid;
2132de962bdSlukem *egid = sc->sc_egid;
2142de962bdSlukem
2152de962bdSlukem free(crmsg);
2162de962bdSlukem return 0;
2172de962bdSlukem
2182de962bdSlukem sc_err:
2192de962bdSlukem #endif
2202de962bdSlukem #endif /* LDAP_PF_LOCAL */
2212de962bdSlukem
2222de962bdSlukem return -1;
2232de962bdSlukem }
2242de962bdSlukem
2252de962bdSlukem #endif /* HAVE_GETPEEREID */
226