From a2521aede92f9f335874de3574cd8827394ba384 Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Sat, 2 Jun 2012 00:04:33 +0100 Subject: [PATCH] ipv6 etc. --- authbind-helper.8 | 21 ++++++++++--------- authbind.1 | 51 ++++++++++++++++++++++++++++------------------- debian/changelog | 6 +++++- helper.c | 47 ++++++++++++++++++++++++++----------------- libauthbind.c | 49 +++++++++++++++++++++++++++++++++++---------- 5 files changed, 113 insertions(+), 61 deletions(-) diff --git a/authbind-helper.8 b/authbind-helper.8 index 44291ba..764cb99 100644 --- a/authbind-helper.8 +++ b/authbind-helper.8 @@ -24,7 +24,9 @@ .SH NAME authbind\-helper \- helper program to bind sockets to privileged ports without root .SH SYNOPSIS -.BI /usr/lib/authbind/helper " addr\-hex port\-hex " < socket +.BI /usr/lib/authbind/helper " addr4\-hex port\-hex " < socket +.br +.BI /usr/lib/authbind/helper " addr6\-hex port\-hex 6 " < socket .SH DESCRIPTION .B helper is the program used by @@ -38,27 +40,24 @@ low-numbered ports in a controlled way. See It may also be used standalone, i.e. without assistance from .BR authbind . Its standard input should be a TCP/IP socket, and it should be passed -two arguments. +two or three arguments. .PP The arguments are the address and port number, respectively, to which -the caller desires that the socket be bound. They should be hex -strings, +the caller desires that the socket be bound, and the address family +(ommitted for IPv4; the fixed string +.B 6 +for IPv6). +The address and port should be hex strings, .I without leading .BR 0x , -of exactly the right length (8 and 4 digits, respectively), being +of exactly the right length (8 or 32, and 4, digits, respectively), being a pairs of hex digits for each byte in the address or port number when expressed in host byte order. For example, the port argument is the result of something like .B sprintf(arg, .B """%04X"", .BR sin.sin_port) . -.PP -.B helper -will not bind to ports 512 and onwards, because programs like -.B rshd -expect these to be used for outgoing connections, so allowing a user -to bind to one of these would open up security hole(s). .SH EXIT STATUS .B helper will exit with code 0 on success. diff --git a/authbind.1 b/authbind.1 index 09f9fc2..092289d 100644 --- a/authbind.1 +++ b/authbind.1 @@ -65,7 +65,7 @@ of files in a configuration area, .BR /etc/authbind . .PP Firstly, -.BR /etc/authbind/byport/ [ ! ]\fIport\fR +.BI /etc/authbind/byport/ port is tested. If this file is accessible for execution to the calling user, according to .BR access (2), @@ -84,11 +84,17 @@ call, usually .RI ( "Permission denied" ). .PP Secondly, if that test fails to resolve the matter, -.BR /etc/authbind/byaddr/ \fIaddr\fR : [ ! ]\fIport\fR -is tested, in the same manner as above. +.BI /etc/authbind/byaddr/ addr , port +(any protocol) or failing that +.BI /etc/authbind/byaddr/ addr : port +(IPv4 only) +is tested, in the same manner as above. (Here +.I addr +is as from +.BR inet_ntop .) .PP Thirdly, if the question is still unresolved, the file -.BR /etc/authbind/byuid/ [ ! ]\fIuid\fR +.BI /etc/authbind/byuid/ uid will be opened and read. If the file does not exist then the binding is not authorised and .B bind @@ -97,17 +103,20 @@ will return .RI ( "Operation not permitted" ", or " "Not owner" ). If the file does exist it will be searched for a line of the form .nf -.IB addr4 / length : min\-port , max\-port -.IR addrmin [\fB-\fR addrmax ]\fB:\fR min\-port \fB,\fR max\-port +.IR addrmin [\fB\-\fR addrmax ]\fB,\fR portmin \fB\-\fR portmax +.IB addr4 / length : portmin , portmax .fi -matching the request. The first form requires that the initial +matching the request. +The first form requires that the address lies in the +relevant range (inclusive at both ends). +The second form requires that the initial .I length bits of .I addr match those in the proposed .B bind -call. The second form requires that the address lies in the -relevant range (inclusive at both ends). Addresses can +call and is only available for IPv4. +Addresses can be in any form acceptable to inet_pton. In both cases the proposed port number must lie is in the inclusive range specified. If such a line is found then the binding is authorised. @@ -122,9 +131,6 @@ In each case above, .I port is the (local) TCP or UDP port number, expressed as an unsigned integer in the minimal non-zero number of digits, and -.TP -.I addr -is the (local) IP address, as a dotted quad. .PP If a read error occurs, or the directory .B /etc/authbind @@ -134,21 +140,24 @@ fail, but an error message will be printed to stderr. Unrecognised lines in .BI /etc/authbind/byuid/ uid files are silently ignored (as are lines whose -.I addr +.I addr4 has non-zero bits more than .I length -from the top). -.TP +from the top) or where +.I min +is larger than +.IR max . +.PP Authorising binding to ports from 512 to 1023 inclusive is not recommended. Some protocols (including some versions of NFS) authorise clients by seeing that they are using a port number in this range. So by authorising a program to be a server for such a port, you are also authorising it to impersonate the whole host for those protocols. To make sure that this isn't done by accident, -if the port number requested is in the range 512-1023, all the files -checked and read will have the additional +if the port number requested is in the range 512-1023, authbind +will expect the permission files to have an additional .B ! -character. +at the start of their leafname. .SH MECHANISM The shared library loaded using .B LD_PRELOAD @@ -241,14 +250,14 @@ wishes it to use authbind they could have it load the library explicitly rather than via .BR LD_PRELOAD . .PP -Some badly-written programs may have trouble because +Some programs may have trouble because .B authbind spawns a child process `under their feet', causing (for example) a .BR fork (2) to happen and .B SIGCHLD -signal to be delivered. Programs should not rely on standard -libraries not doing these things. +signal to be delivered. Unfortunately the Unix API does not make +it possible to deal with this problem in a sane way. .PP The access control configuration scheme is somewhat strange. .SH FILES AND ENVIRONMENT VARIABLES diff --git a/debian/changelog b/debian/changelog index c8b65f7..3b06a18 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,7 +1,11 @@ -authbind (1.2.1) unstable; urgency=low +authbind (2.0.0) unstable; urgency=medium + * Support IPv6. (Closes: #596921.) + * Support ports 512-1023 if the user really wants. + Explain the problem more clearly in the manpage. (Closes: 654706.) * Correct manpage description of helper protocol to have actually-implemented byte order convention. (Closes: #651694.) + * Improve wording in BUGS section of manpage about forking. * Set Priority to optional as in ftpmaster override file. * Upstream repo is now in git. diff --git a/helper.c b/helper.c index 7c50551..0925075 100644 --- a/helper.c +++ b/helper.c @@ -83,8 +83,8 @@ int main(int argc, const char *const *argv) { const char *np; const char *tophalfchar=""; unsigned long port, addr4=0, haddr4=0; - unsigned int hport, a1,a2,a3,a4, alen,pmin,pmax; - int nchar, af; + unsigned int hport; + int af; FILE *file; if (argc == 3) { @@ -139,7 +139,13 @@ int main(int argc, const char *const *argv) { np= inet_ntop(af,addr_any,npbuf,addrlen_any); assert(np); - snprintf(fnbuf,sizeof(fnbuf)-1,"byaddr/%s:%s%u",np,tophalfchar,hport); + if (af == AF_INET) { + snprintf(fnbuf,sizeof(fnbuf)-1,"byaddr/%s%s:%u",np,tophalfchar,hport); + if (!access(fnbuf,X_OK)) authorised(); + if (errno != ENOENT) exiterrno(errno); + } + + snprintf(fnbuf,sizeof(fnbuf)-1,"byaddr/%s%s,%u",np,tophalfchar,hport); if (!access(fnbuf,X_OK)) authorised(); if (errno != ENOENT) exiterrno(errno); @@ -150,15 +156,14 @@ int main(int argc, const char *const *argv) { if (!file) exiterrno(errno==ENOENT ? EPERM : errno); while (fgets(fnbuf,sizeof(fnbuf)-1,file)) { - nchar= -1; + unsigned int a1,a2,a3,a4, alen,pmin,pmax; + int nchar= -1; - char *colon = strchr(fnbuf,'/'); - if (!colon) continue; - *colon++ = '\0'; + if (af == AF_INET && + (sscanf(fnbuf," %u.%u.%u.%u/%u: %u,%u %n", + &a1,&a2,&a3,&a4,&alen,&pmin,&pmax,&nchar), + nchar == strlen(fnbuf))) { - sscanf(fnbuf," %u.%u.%u.%u/%u%n", - &a1,&a2,&a3,&a4,&alen,&nchar); - if (nchar == strlen(fnbuf)) { if (alen>32 || pmin&~0x0ffff || pmax&~0x0ffff || a1&~0x0ff || a2&~0xff || a3&~0x0ff || a4&~0x0ff) continue; @@ -167,7 +172,13 @@ int main(int argc, const char *const *argv) { thaddr= (a1<<24)|(a2<<16)|(a3<<8)|(a4); thmask= 0x0ffffffffUL<<(32-alen); if ((haddr4&thmask) != thaddr) continue; + } else { + + char *comma = strchr(fnbuf,','); + if (comma) continue; + *comma++ = '\0'; + char *hyphen = strchr(fnbuf,'-'); const char *min, *max; if (hyphen) { @@ -182,17 +193,17 @@ int main(int argc, const char *const *argv) { unsigned char maxaddr[addrlen_any]; if (inet_pton(af,min,minaddr) != 1 || inet_pton(af,max,maxaddr) != 1) - continue; + continue; if (memcmp(addr_any,minaddr,addrlen_any) < 0 || memcmp(addr_any,maxaddr,addrlen_any) > 0) - continue; - } + continue; - sscanf(colon," %u,%u %n", - &pmin,&pmax,&nchar); - if (nchar != strlen(colon)) - continue; - + sscanf(comma," %u-%u %n", + &pmin,&pmax,&nchar); + if (nchar != strlen(comma)) + continue; + + } if (hportpmax) continue; authorised(); diff --git a/libauthbind.c b/libauthbind.c index 99a7f3f..183a206 100644 --- a/libauthbind.c +++ b/libauthbind.c @@ -146,15 +146,30 @@ static const int evilsignals[]= { SIGFPE, SIGILL, SIGSEGV, SIGBUS, 0 }; int bind(int fd, const struct sockaddr *addr, socklen_t addrlen) { pid_t child, rchild; - char portarg[5], addrarg[9]; - int r, status; + char portarg[5], addrarg[33]; + const char *afarg; + int i, r, status; const int *evilsignal; sigset_t block, saved; + unsigned int portval; + + switch (addr->sa_family) { + case AF_INET: + portval = ((struct sockaddr_in*)addr)->sin_port; + if (addrlen != sizeof(struct sockaddr_in)) goto bail; + break; + case AF_INET6: + portval = ((struct sockaddr_in6*)addr)->sin6_port; + if (addrlen != sizeof(struct sockaddr_in6)) goto bail; + break; + default: + goto bail; + } - if (addr->sa_family != AF_INET || addrlen != sizeof(struct sockaddr_in) || - !geteuid() || ((struct sockaddr_in*)addr)->sin_port == 0 || - ntohs(((struct sockaddr_in*)addr)->sin_port) >= IPPORT_RESERVED/2) + if (!geteuid() || portval == 0 || portval >= IPPORT_RESERVED) { + bail: return old_bind(fd,addr,addrlen); + } sigfillset(&block); for (evilsignal=evilsignals; @@ -162,18 +177,32 @@ int bind(int fd, const struct sockaddr *addr, socklen_t addrlen) { evilsignal++) sigdelset(&block,*evilsignal); if (sigprocmask(SIG_BLOCK,&block,&saved)) return -1; - - sprintf(addrarg,"%08lx", - ((unsigned long)(((struct sockaddr_in*)addr)->sin_addr.s_addr))&0x0ffffffffUL); + + switch (addr->sa_family) { + case AF_INET: + afarg = 0; + sprintf(addrarg,"%08lx", + ((unsigned long)(((struct sockaddr_in*)addr)->sin_addr.s_addr)) + &0x0ffffffffUL); + break; + case AF_INET6: + afarg = "6"; + for (i=0; i<16; i++) + sprintf(addrarg+i*2,"%02x", + ((struct sockaddr_in6*)addr)->sin6_addr.s6_addr[i]); + break; + default: + abort(); + } sprintf(portarg,"%04x", - ((unsigned int)(((struct sockaddr_in*)addr)->sin_port))&0x0ffff); + portval&0x0ffff); child= fork(); if (child==-1) goto x_err; if (!child) { if (dup2(fd,0)) exiterrno(errno); removepreload(); - execl(HELPER,HELPER,addrarg,portarg,(char*)0); + execl(HELPER,HELPER,addrarg,portarg,afarg,(char*)0); status= errno > 0 && errno < 127 ? errno : 127; STDERRSTR_CONST("libauthbind: possible installation problem - " "could not invoke " HELPER " ("); -- 2.30.2