1/*-
2 * Copyright (c) 2005 Andrey Simonenko
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27#include <sys/cdefs.h>
28__FBSDID("$FreeBSD$");
29
30#include <sys/types.h>
31#include <sys/socket.h>
32#include <sys/ucred.h>
33#include <sys/un.h>
34#include <stdarg.h>
35#include <stdbool.h>
36
37#include "uc_common.h"
38#include "t_generic.h"
39#include "t_peercred.h"
40
41static int
42check_xucred(const struct xucred *xucred, socklen_t len)
43{
44	int rc;
45
46	if (len != sizeof(*xucred)) {
47		uc_logmsgx("option value size %zu != %zu",
48		    (size_t)len, sizeof(*xucred));
49		return (-1);
50	}
51
52	uc_dbgmsg("xucred.cr_version %u", xucred->cr_version);
53	uc_dbgmsg("xucred.cr_uid %lu", (u_long)xucred->cr_uid);
54	uc_dbgmsg("xucred.cr_ngroups %d", xucred->cr_ngroups);
55
56	rc = 0;
57
58	if (xucred->cr_version != XUCRED_VERSION) {
59		uc_logmsgx("xucred.cr_version %u != %d",
60		    xucred->cr_version, XUCRED_VERSION);
61		rc = -1;
62	}
63	if (xucred->cr_uid != uc_cfg.proc_cred.euid) {
64		uc_logmsgx("xucred.cr_uid %lu != %lu (EUID)",
65		    (u_long)xucred->cr_uid, (u_long)uc_cfg.proc_cred.euid);
66		rc = -1;
67	}
68	if (xucred->cr_ngroups == 0) {
69		uc_logmsgx("xucred.cr_ngroups == 0");
70		rc = -1;
71	}
72	if (xucred->cr_ngroups < 0) {
73		uc_logmsgx("xucred.cr_ngroups < 0");
74		rc = -1;
75	}
76	if (xucred->cr_ngroups > XU_NGROUPS) {
77		uc_logmsgx("xucred.cr_ngroups %hu > %u (max)",
78		    xucred->cr_ngroups, XU_NGROUPS);
79		rc = -1;
80	}
81	if (xucred->cr_groups[0] != uc_cfg.proc_cred.egid) {
82		uc_logmsgx("xucred.cr_groups[0] %lu != %lu (EGID)",
83		    (u_long)xucred->cr_groups[0], (u_long)uc_cfg.proc_cred.egid);
84		rc = -1;
85	}
86	if (uc_check_groups("xucred.cr_groups", xucred->cr_groups,
87	    "xucred.cr_ngroups", xucred->cr_ngroups, false) < 0)
88		rc = -1;
89	return (rc);
90}
91
92static int
93t_peercred_client(int fd)
94{
95	struct xucred xucred;
96	socklen_t len;
97
98	if (uc_sync_recv() < 0)
99		return (-1);
100
101	if (uc_socket_connect(fd) < 0)
102		return (-1);
103
104	len = sizeof(xucred);
105	if (getsockopt(fd, 0, LOCAL_PEERCRED, &xucred, &len) < 0) {
106		uc_logmsg("getsockopt(LOCAL_PEERCRED)");
107		return (-1);
108	}
109
110	if (check_xucred(&xucred, len) < 0)
111		return (-1);
112
113	return (0);
114}
115
116static int
117t_peercred_server(int fd1)
118{
119	struct xucred xucred;
120	socklen_t len;
121	int fd2, rv;
122
123	if (uc_sync_send() < 0)
124		return (-2);
125
126	fd2 = uc_socket_accept(fd1);
127	if (fd2 < 0)
128		return (-2);
129
130	len = sizeof(xucred);
131	if (getsockopt(fd2, 0, LOCAL_PEERCRED, &xucred, &len) < 0) {
132		uc_logmsg("getsockopt(LOCAL_PEERCRED)");
133		rv = -2;
134		goto done;
135	}
136
137	if (check_xucred(&xucred, len) < 0) {
138		rv = -1;
139		goto done;
140	}
141
142	rv = 0;
143done:
144	if (uc_socket_close(fd2) < 0)
145		rv = -2;
146	return (rv);
147}
148
149int
150t_peercred(void)
151{
152	return (t_generic(t_peercred_client, t_peercred_server));
153}
154