xref: /netbsd/usr.sbin/tcpdchk/tcpdchk.c (revision c4a72b64) 
1 /*	$NetBSD: tcpdchk.c,v 1.10 2002/06/06 21:28:51 itojun Exp $	*/
2 
3  /*
4   * tcpdchk - examine all tcpd access control rules and inetd.conf entries
5   *
6   * Usage: tcpdchk [-a] [-d] [-i inet_conf] [-v]
7   *
8   * -a: complain about implicit "allow" at end of rule.
9   *
10   * -d: rules in current directory.
11   *
12   * -i: location of inetd.conf file.
13   *
14   * -v: show all rules.
15   *
16   * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
17   */
18 
19 #include <sys/cdefs.h>
20 #ifndef lint
21 #if 0
22 static char sccsid[] = "@(#) tcpdchk.c 1.8 97/02/12 02:13:25";
23 #else
24 __RCSID("$NetBSD: tcpdchk.c,v 1.10 2002/06/06 21:28:51 itojun Exp $");
25 #endif
26 #endif
27 
28 /* System libraries. */
29 
30 #include <sys/types.h>
31 #include <sys/stat.h>
32 #include <netinet/in.h>
33 #include <arpa/inet.h>
34 #include <stdio.h>
35 #include <syslog.h>
36 #include <setjmp.h>
37 #include <errno.h>
38 #include <netdb.h>
39 #include <string.h>
40 #include <stdlib.h>
41 #include <unistd.h>
42 
43 #ifndef INADDR_NONE
44 #define INADDR_NONE     (-1)		/* XXX should be 0xffffffff */
45 #endif
46 
47 #ifndef S_ISDIR
48 #define S_ISDIR(m)	(((m) & S_IFMT) == S_IFDIR)
49 #endif
50 
51 /* Application-specific. */
52 
53 #include "tcpd.h"
54 #include "inetcf.h"
55 #include "scaffold.h"
56 
57 #ifdef NO_NETGRENT
58 	/* SCO has no *netgrent() support */
59 #else
60 # ifdef NETGROUP
61 #  include <netgroup.h>
62 # endif
63 #endif
64 
65  /*
66   * Stolen from hosts_access.c...
67   */
68 static char sep[] = ", \t\n";
69 
70 #define	BUFLEN 2048
71 
72 int     resident = 0;
73 int     hosts_access_verbose = 0;
74 char   *hosts_allow_table = HOSTS_ALLOW;
75 char   *hosts_deny_table = HOSTS_DENY;
76 extern jmp_buf tcpd_buf;
77 
78  /*
79   * Local stuff.
80   */
81 static void usage __P((void));
82 static void parse_table __P((char *, struct request_info *));
83 static void print_list __P((char *, char *));
84 static void check_daemon_list __P((char *));
85 static void check_client_list __P((char *));
86 static void check_daemon __P((char *));
87 static void check_user __P((char *));
88 #ifdef INET6
89 static int check_inet_addr __P((char *));
90 #endif
91 static int check_host __P((char *));
92 static int reserved_name __P((char *));
93 
94 int main __P((int, char **));
95 
96 #define PERMIT	1
97 #define DENY	0
98 
99 #define YES	1
100 #define	NO	0
101 
102 static int defl_verdict;
103 static char *myname;
104 static int allow_check;
105 static char *inetcf;
106 
107 int     main(argc, argv)
108 int     argc;
109 char  **argv;
110 {
111     struct request_info request;
112     struct stat st;
113     int     c;
114 
115     myname = argv[0];
116 
117     /*
118      * Parse the JCL.
119      */
120     while ((c = getopt(argc, argv, "adi:v")) != -1) {
121 	switch (c) {
122 	case 'a':
123 	    allow_check = 1;
124 	    break;
125 	case 'd':
126 	    hosts_allow_table = "hosts.allow";
127 	    hosts_deny_table = "hosts.deny";
128 	    break;
129 	case 'i':
130 	    inetcf = optarg;
131 	    break;
132 	case 'v':
133 	    hosts_access_verbose++;
134 	    break;
135 	default:
136 	    usage();
137 	    /* NOTREACHED */
138 	}
139     }
140     if (argc != optind)
141 	usage();
142 
143     /*
144      * When confusion really strikes...
145      */
146     if (check_path(REAL_DAEMON_DIR, &st) < 0) {
147 	tcpd_warn("REAL_DAEMON_DIR %s: %m", REAL_DAEMON_DIR);
148     } else if (!S_ISDIR(st.st_mode)) {
149 	tcpd_warn("REAL_DAEMON_DIR %s is not a directory", REAL_DAEMON_DIR);
150     }
151 
152     /*
153      * Process the inet configuration file (or its moral equivalent). This
154      * information is used later to find references in hosts.allow/deny to
155      * unwrapped services, and other possible problems.
156      */
157     inetcf = inet_cfg(inetcf);
158     if (hosts_access_verbose)
159 	printf("Using network configuration file: %s\n", inetcf);
160 
161     /*
162      * These are not run from inetd but may have built-in access control.
163      */
164     inet_set("portmap", WR_NOT);
165     inet_set("rpcbind", WR_NOT);
166 
167     /*
168      * Check accessibility of access control files.
169      */
170     (void) check_path(hosts_allow_table, &st);
171     (void) check_path(hosts_deny_table, &st);
172 
173     /*
174      * Fake up an arbitrary service request.
175      */
176     request_init(&request,
177 		 RQ_DAEMON, "daemon_name",
178 		 RQ_SERVER_NAME, "server_hostname",
179 		 RQ_SERVER_ADDR, "server_addr",
180 		 RQ_USER, "user_name",
181 		 RQ_CLIENT_NAME, "client_hostname",
182 		 RQ_CLIENT_ADDR, "client_addr",
183 		 RQ_FILE, 1,
184 		 0);
185 
186     /*
187      * Examine all access-control rules.
188      */
189     defl_verdict = PERMIT;
190     parse_table(hosts_allow_table, &request);
191     defl_verdict = DENY;
192     parse_table(hosts_deny_table, &request);
193     return (0);
194 }
195 
196 /* usage - explain */
197 
198 static void usage()
199 {
200     fprintf(stderr, "usage: %s [-a] [-d] [-i inet_conf] [-v]\n", myname);
201     fprintf(stderr, "	-a: report rules with implicit \"ALLOW\" at end\n");
202     fprintf(stderr, "	-d: use allow/deny files in current directory\n");
203     fprintf(stderr, "	-i: location of inetd.conf file\n");
204     fprintf(stderr, "	-v: list all rules\n");
205     exit(1);
206 }
207 
208 /* parse_table - like table_match(), but examines _all_ entries */
209 
210 static void parse_table(table, request)
211 char   *table;
212 struct request_info *request;
213 {
214     FILE   *fp;
215     int     real_verdict;
216     char    sv_list[BUFLEN];		/* becomes list of daemons */
217     char   *cl_list;			/* becomes list of requests */
218     char   *sh_cmd;			/* becomes optional shell command */
219     int     verdict;
220     struct tcpd_context saved_context;
221 #ifdef __GNUC__
222     /* XXX hack to avoid gcc warnings */
223     (void) &real_verdict;
224     (void) &saved_context;
225 #endif
226 
227     saved_context = tcpd_context;		/* stupid compilers */
228 
229     if ((fp = fopen(table, "r")) != NULL) {
230 	tcpd_context.file = table;
231 	tcpd_context.line = 0;
232 	while (xgets(sv_list, sizeof(sv_list), fp)) {
233 	    if (sv_list[strlen(sv_list) - 1] != '\n') {
234 		tcpd_warn("missing newline or line too long");
235 		continue;
236 	    }
237 	    if (sv_list[0] == '#' || sv_list[strspn(sv_list, " \t\r\n")] == 0)
238 		continue;
239 	    if ((cl_list = split_at(sv_list, ':')) == 0) {
240 		tcpd_warn("missing \":\" separator");
241 		continue;
242 	    }
243 	    sh_cmd = split_at(cl_list, ':');
244 
245 	    if (hosts_access_verbose)
246 		printf("\n>>> Rule %s line %d:\n",
247 		       tcpd_context.file, tcpd_context.line);
248 
249 	    if (hosts_access_verbose)
250 		print_list("daemons:  ", sv_list);
251 	    check_daemon_list(sv_list);
252 
253 	    if (hosts_access_verbose)
254 		print_list("clients:  ", cl_list);
255 	    check_client_list(cl_list);
256 
257 #ifdef PROCESS_OPTIONS
258 	    real_verdict = defl_verdict;
259 	    if (sh_cmd) {
260 		verdict = setjmp(tcpd_buf);
261 		if (verdict != 0) {
262 		    real_verdict = (verdict == AC_PERMIT);
263 		} else {
264 		    dry_run = 1;
265 		    process_options(sh_cmd, request);
266 		    if (dry_run == 1 && real_verdict && allow_check)
267 			tcpd_warn("implicit \"allow\" at end of rule");
268 		}
269 	    } else if (defl_verdict && allow_check) {
270 		tcpd_warn("implicit \"allow\" at end of rule");
271 	    }
272 	    if (hosts_access_verbose)
273 		printf("access:   %s\n", real_verdict ? "granted" : "denied");
274 #else
275 	    if (sh_cmd)
276 		shell_cmd(percent_x(buf, sizeof(buf), sh_cmd, request));
277 	    if (hosts_access_verbose)
278 		printf("access:   %s\n", defl_verdict ? "granted" : "denied");
279 #endif
280 	}
281 	(void) fclose(fp);
282     } else if (errno != ENOENT) {
283 	tcpd_warn("cannot open %s: %m", table);
284     }
285     tcpd_context = saved_context;
286 }
287 
288 /* print_list - pretty-print a list */
289 
290 static void print_list(title, list)
291 char   *title;
292 char   *list;
293 {
294     char    buf[BUFLEN];
295     char   *cp;
296     char   *next;
297 
298     fputs(title, stdout);
299     strcpy(buf, list);
300 
301     for (cp = strtok(buf, sep); cp != 0; cp = next) {
302 	fputs(cp, stdout);
303 	next = strtok((char *) 0, sep);
304 	if (next != 0)
305 	    fputs(" ", stdout);
306     }
307     fputs("\n", stdout);
308 }
309 
310 /* check_daemon_list - criticize daemon list */
311 
312 static void check_daemon_list(list)
313 char   *list;
314 {
315     char    buf[BUFLEN];
316     char   *cp;
317     char   *host;
318     int     daemons = 0;
319 
320     strcpy(buf, list);
321 
322     for (cp = strtok(buf, sep); cp != 0; cp = strtok((char *) 0, sep)) {
323 	if (STR_EQ(cp, "EXCEPT")) {
324 	    daemons = 0;
325 	} else {
326 	    daemons++;
327 	    if ((host = split_at(cp + 1, '@')) != 0 && check_host(host) > 1) {
328 		tcpd_warn("host %s has more than one address", host);
329 		tcpd_warn("(consider using an address instead)");
330 	    }
331 	    check_daemon(cp);
332 	}
333     }
334     if (daemons == 0)
335 	tcpd_warn("daemon list is empty or ends in EXCEPT");
336 }
337 
338 /* check_client_list - criticize client list */
339 
340 static void check_client_list(list)
341 char   *list;
342 {
343     char    buf[BUFLEN];
344     char   *cp;
345     char   *host;
346     int     clients = 0;
347 #ifdef INET6
348     int l;
349 #endif
350 
351     strcpy(buf, list);
352 
353     for (cp = strtok(buf, sep); cp != 0; cp = strtok((char *) 0, sep)) {
354 #ifdef INET6
355 	l = strlen(cp);
356 	if (cp[0] == '[' && cp[l - 1] == ']') {
357 	    cp[l - 1] = '\0';
358 	    cp++;
359 	}
360 #endif
361 	if (STR_EQ(cp, "EXCEPT")) {
362 	    clients = 0;
363 	} else {
364 	    clients++;
365 	    if ((host = split_at(cp + 1, '@')) != NULL) {	/* user@host */
366 		check_user(cp);
367 		check_host(host);
368 	    } else {
369 		check_host(cp);
370 	    }
371 	}
372     }
373     if (clients == 0)
374 	tcpd_warn("client list is empty or ends in EXCEPT");
375 }
376 
377 /* check_daemon - criticize daemon pattern */
378 
379 static void check_daemon(pat)
380 char   *pat;
381 {
382     if (pat[0] == '@') {
383 	tcpd_warn("%s: daemon name begins with \"@\"", pat);
384     } else if (pat[0] == '.') {
385 	tcpd_warn("%s: daemon name begins with dot", pat);
386     } else if (pat[strlen(pat) - 1] == '.') {
387 	tcpd_warn("%s: daemon name ends in dot", pat);
388     } else if (STR_EQ(pat, "ALL") || STR_EQ(pat, unknown)) {
389 	 /* void */ ;
390     } else if (STR_EQ(pat, "FAIL")) {		/* obsolete */
391 	tcpd_warn("FAIL is no longer recognized");
392 	tcpd_warn("(use EXCEPT or DENY instead)");
393     } else if (reserved_name(pat)) {
394 	tcpd_warn("%s: daemon name may be reserved word", pat);
395     } else {
396 	switch (inet_get(pat)) {
397 	case WR_UNKNOWN:
398 	    tcpd_warn("%s: no such process name in %s", pat, inetcf);
399 	    inet_set(pat, WR_YES);		/* shut up next time */
400 	    break;
401 	case WR_NOT:
402 	    tcpd_warn("%s: service possibly not wrapped", pat);
403 	    inet_set(pat, WR_YES);
404 	    break;
405 	}
406     }
407 }
408 
409 /* check_user - criticize user pattern */
410 
411 static void check_user(pat)
412 char   *pat;
413 {
414     if (pat[0] == '@') {			/* @netgroup */
415 	tcpd_warn("%s: user name begins with \"@\"", pat);
416     } else if (pat[0] == '.') {
417 	tcpd_warn("%s: user name begins with dot", pat);
418     } else if (pat[strlen(pat) - 1] == '.') {
419 	tcpd_warn("%s: user name ends in dot", pat);
420     } else if (STR_EQ(pat, "ALL") || STR_EQ(pat, unknown)
421 	       || STR_EQ(pat, "KNOWN")) {
422 	 /* void */ ;
423     } else if (STR_EQ(pat, "FAIL")) {		/* obsolete */
424 	tcpd_warn("FAIL is no longer recognized");
425 	tcpd_warn("(use EXCEPT or DENY instead)");
426     } else if (reserved_name(pat)) {
427 	tcpd_warn("%s: user name may be reserved word", pat);
428     }
429 }
430 
431 #ifdef INET6
432 static int check_inet_addr(pat)
433 char	*pat;
434 {
435 	struct addrinfo *res;
436 
437 	res = find_inet_addr(pat, AI_NUMERICHOST);
438 	if (res) {
439 		freeaddrinfo(res);
440 		return 1;
441 	} else
442 		return 0;
443 }
444 #endif
445 
446 /* check_host - criticize host pattern */
447 static int check_host(pat)
448 char   *pat;
449 {
450     char   *mask;
451     int     addr_count = 1;
452 
453     if (pat[0] == '@') {			/* @netgroup */
454 #ifdef NO_NETGRENT
455 	/* SCO has no *netgrent() support */
456 #else
457 #ifdef NETGROUP
458 	const char   *machinep;
459 	const char   *userp;
460 	const char   *domainp;
461 
462 	setnetgrent(pat + 1);
463 	if (getnetgrent(&machinep, &userp, &domainp) == 0)
464 	    tcpd_warn("%s: unknown or empty netgroup", pat + 1);
465 	endnetgrent();
466 #else
467 	tcpd_warn("netgroup support disabled");
468 #endif
469 #endif
470     } else if ((mask = split_at(pat, '/')) != NULL) {	/* network/netmask */
471 #ifdef INET6
472 	char *ep;
473 #endif
474 	if (dot_quad_addr(pat, NULL) != INADDR_NONE
475 	    || dot_quad_addr(mask, NULL) != INADDR_NONE)
476 	    ; /*okay*/
477 #ifdef INET6
478 	else if (check_inet_addr(pat) && check_inet_addr(mask))
479 	    ; /*okay*/
480 	else if (check_inet_addr(pat) &&
481 	    (ep = NULL, strtoul(mask, &ep, 10), ep && !*ep))
482 	    ; /*okay*/
483 #endif
484 	else
485 	    tcpd_warn("%s/%s: bad net/mask pattern", pat, mask);
486     } else if (STR_EQ(pat, "FAIL")) {		/* obsolete */
487 	tcpd_warn("FAIL is no longer recognized");
488 	tcpd_warn("(use EXCEPT or DENY instead)");
489     } else if (reserved_name(pat)) {		/* other reserved */
490 	 /* void */ ;
491     } else if (NOT_INADDR(pat)) {		/* internet name */
492 	if (pat[strlen(pat) - 1] == '.') {
493 	    tcpd_warn("%s: domain or host name ends in dot", pat);
494 	} else if (pat[0] != '.') {
495 	    addr_count = check_dns(pat);
496 	}
497     } else {					/* numeric form */
498 	if (STR_EQ(pat, "0.0.0.0") || STR_EQ(pat, "255.255.255.255")) {
499 	    /* void */ ;
500 	} else if (pat[0] == '.') {
501 	    tcpd_warn("%s: network number begins with dot", pat);
502 	} else if (pat[strlen(pat) - 1] != '.') {
503 	    check_dns(pat);
504 	}
505     }
506     return (addr_count);
507 }
508 
509 /* reserved_name - determine if name is reserved */
510 
511 static int reserved_name(pat)
512 char   *pat;
513 {
514     return (STR_EQ(pat, unknown)
515 	    || STR_EQ(pat, "KNOWN")
516 	    || STR_EQ(pat, paranoid)
517 	    || STR_EQ(pat, "ALL")
518 	    || STR_EQ(pat, "LOCAL"));
519 }
520