/
libprivbind.c
228 lines (187 loc) · 6.29 KB
/
libprivbind.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
/*
* privbind - allow unpriviledged apps to bind to priviledged ports
* Copyright (C) 2006 Shachar Shemesh
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*
*/
#include "config.h"
#define _GNU_SOURCE
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <errno.h>
#include <unistd.h>
#include <fcntl.h>
#include <pthread.h>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include "stub.h"
#include "ipc.h"
#include "list.h"
static int master_quit=0; /* Whether helper process quit - assume false at first */
static intlist_t reuse_ports={.count = -1}; /* for which ports we should setup SO_REUSEPORT socket option */
FUNCREDIR1( close, int, int );
FUNCREDIR3( bind, int, int, const struct sockaddr *, socklen_t );
static void master_cleanup()
{
/* The helper process has quit */
master_quit=1;
unsetenv("LD_PRELOAD");
close(COMM_SOCKET);
}
/* Acquire or release the lock on the communication socket */
static int acquire_lock( int acquire )
{
static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;
struct flock lock;
lock.l_whence=SEEK_SET;
lock.l_start=0;
lock.l_len=0;
if( acquire ) {
if( pthread_mutex_lock(&mutex)!=0 )
{
/* The mutex is invalid. Assume we terminated */
master_cleanup();
return 0;
}
/* Acquire the fcntl lock on the socket. Need to retry in case of EINTR */
lock.l_type=F_WRLCK;
int res;
while( (res=fcntl(COMM_SOCKET, F_SETLKW, &lock))!=0 && errno==EINTR )
;
if( res!=0 )
pthread_mutex_unlock(&mutex);
return res==0;
} else {
/* Need to unlock, opposite order than locking */
/* Release the fcntl lock */
lock.l_type=F_UNLCK;
int res;
while( (res=fcntl(COMM_SOCKET, F_SETLKW, &lock))!=0 && errno==EINTR )
;
pthread_mutex_unlock(&mutex);
return res==0;
}
}
int bind( int sockfd, const struct sockaddr *my_addr, socklen_t addrlen)
{
#ifdef SO_REUSEPORT
// parse environment property (just once)
if (reuse_ports.count < 0){
char *env_reuse = getenv("PRIVBIND_REUSE_PORTS");
if (env_reuse == NULL){
reuse_ports.count = 0;
}else{
if (parselist(env_reuse, &reuse_ports, 1, 65535) != 0){
reuse_ports.count = -1;
return -1;
}
}
}
// get bind port
int port = -1;
if (my_addr->sa_family==AF_INET)
port = (int) ntohs(((struct sockaddr_in *) my_addr)->sin_port);
else if (my_addr->sa_family==AF_INET6)
port = (int) ntohs(((struct sockaddr_in6 *) my_addr)->sin6_port);
// check if we should setup SO_REUSEPORT for this port
if (port != -1 && is_in_list(&reuse_ports, port)){
int optval = 1;
int retval = setsockopt(sockfd, SOL_SOCKET, SO_REUSEPORT, &optval, sizeof(optval));
if (retval != 0)
return retval;
}
#endif
/* First of all, attempt the bind. We only need the socket if it fails with access denied */
int oret=_bind( sockfd, my_addr, addrlen );
if( oret==0 || errno!=EACCES )
return oret;
/* In most cases, we can let the bind go through as is */
if( master_quit || (my_addr->sa_family!=AF_INET && my_addr->sa_family!=AF_INET6)
|| (my_addr->sa_family==AF_INET && addrlen<sizeof(struct sockaddr_in))
|| (my_addr->sa_family==AF_INET6 && addrlen<sizeof(struct sockaddr_in6))
) {
errno=EACCES;
return oret;
}
/* Prepare the ancillary data for passing the actual FD */
struct msghdr msghdr={.msg_name=NULL};
struct cmsghdr *cmsg;
char buf[CMSG_SPACE(sizeof(int))];
int *fdptr;
msghdr.msg_control=buf;
msghdr.msg_controllen=sizeof(buf);
cmsg=CMSG_FIRSTHDR(&msghdr);
cmsg->cmsg_level=SOL_SOCKET;
cmsg->cmsg_type=SCM_RIGHTS;
cmsg->cmsg_len=CMSG_LEN(sizeof(int));
/* Initialize the payload */
fdptr=(int *)CMSG_DATA(cmsg);
fdptr[0]=sockfd;
msghdr.msg_controllen=cmsg->cmsg_len;
/* Don't forget the data component */
struct ipc_msg_req request;
struct iovec iov;
msghdr.msg_iov=&iov;
msghdr.msg_iovlen=1;
iov.iov_base=&request;
iov.iov_len=sizeof(request);
request.type=MSG_REQ_BIND;
/* Check family of the request, only INET and INET6 should make it here */
if (my_addr->sa_family==AF_INET)
request.data.bind4.addr=*(struct sockaddr_in *) my_addr;
else if (my_addr->sa_family==AF_INET6)
request.data.bind6.addr=*(struct sockaddr_in6 *) my_addr;
int retval=oret;
if( acquire_lock(1) ) {
if( sendmsg( COMM_SOCKET, &msghdr, MSG_NOSIGNAL )>0 ) {
/* Request was sent - wait for reply */
struct ipc_msg_reply reply;
if( recv( COMM_SOCKET, &reply, sizeof(reply), 0 )>0 ) {
retval=reply.data.stat.retval;
if( retval<0 )
errno=reply.data.stat.error;
} else {
/* It would appear that the other process has closed, just return the original retval */
master_cleanup();
}
} else {
/* An error has occured! */
if( errno==EPIPE || errno==ENOTCONN || errno==EBADF ) {
master_cleanup();
} else {
perror("privbind communication socket error");
master_cleanup();
}
}
acquire_lock(0);
}
/* Make sure we return the original errno, regardless of what caused us to fail */
if( retval!=0 )
errno=EACCES;
return retval;
}
int close(int fd)
{
/* Is it our fd? */
if( fd!=COMM_SOCKET )
/* No - pass it on to "close" */
return _close(fd);
/* Yes - override the close and return an error */
errno=EBADF;
return -1;
}