doxy

[oweals/gnunet.git] / src / dns / gnunet-helper-dns.c

diff --git a/src/dns/gnunet-helper-dns.c b/src/dns/gnunet-helper-dns.c
index 0f19b4a5637c847ce85624dcc07fe24cca28c9d0..759abc89eb0dadc2b08b06826fa91557d4edf072 100644 (file)
--- a/src/dns/gnunet-helper-dns.c
+++ b/src/dns/gnunet-helper-dns.c
@@ -35,7 +35,9 @@
  * administrators must take care to not cause conflicts with these
  * values (it was deemed safest to hardcode them as passing these
  * values as arguments might permit messing with arbitrary firewall
- * rules, which would be dangerous).
+ * rules, which would be dangerous).  Traffic coming from the same
+ * group ID as the effective group ID that this process is running
+ * as is not intercepted.
  *
  * The code first sets up the virtual interface, then begins to
  * redirect the DNS traffic to it, and then on errors or SIGTERM shuts
@@ -97,6 +99,11 @@ struct in6_ifreq
  */
 static const char *sbin_iptables;
 
+/**
+ * Name and full path of sysctl binary
+ */
+static const char *sbin_sysctl;
+
 /**
  * Name and full path of IPTABLES binary.
  */
@@ -231,6 +238,7 @@ init_tun (char *dev)
   if (fd >= FD_SETSIZE)
   {
     fprintf (stderr, "File descriptor to large: %d", fd);
+    (void) close (fd);
     return -1;
   }
 
@@ -468,7 +476,7 @@ run (int fd_tun)
   unsigned char bufin[MAX_SIZE];
   ssize_t bufin_size = 0;
   size_t bufin_rpos = 0;
-  unsigned char *bufin_read;
+  unsigned char *bufin_read = NULL;
   fd_set fds_w;
   fd_set fds_r;
   int max;
@@ -477,7 +485,6 @@ run (int fd_tun)
   {
     FD_ZERO (&fds_w);
     FD_ZERO (&fds_r);
-    bufin_read = NULL;
 
     /*
      * We are supposed to read and the buffer is empty
@@ -578,6 +585,7 @@ run (int fd_tun)
         bufin_size = read (0, bufin + bufin_rpos, MAX_SIZE - bufin_rpos);
         if (-1 == bufin_size)
         {
+         bufin_read = NULL;
          if ( (errno == EINTR) ||
               (errno == EAGAIN) )
            continue;
@@ -586,6 +594,7 @@ run (int fd_tun)
         }
        if (0 == bufin_size)
         {
+         bufin_read = NULL;
           fprintf (stderr, "EOF on stdin\n");
          return;
         }
@@ -658,7 +667,6 @@ PROCESS_BUFFER:
  *             3: IPv6 netmask length in bits ("64")
  *             4: IPv4 address for the tunnel ("1.2.3.4")
  *             5: IPv4 netmask ("255.255.0.0")
- *             6: PORT to not hijack ("55533")
  * @return 0 on success, otherwise code indicating type of error:
  *         1 wrong number of arguments
  *         2 invalid arguments (i.e. port number / prefix length wrong)
@@ -677,13 +685,12 @@ PROCESS_BUFFER:
 int
 main (int argc, char *const*argv)
 {
-  unsigned int port;
-  char localport[6];
   int r;
   char dev[IFNAMSIZ];
+  char mygid[32];
   int fd_tun;
 
-  if (7 != argc)
+  if (6 != argc)
   {
     fprintf (stderr, "Fatal: must supply 6 arguments!\n");
     return 1;
@@ -712,21 +719,20 @@ main (int argc, char *const*argv)
             strerror (errno));
     return 4;
   }
-
-  /* validate port number */
-  port = atoi (argv[6]);
-  if ( (port == 0) || (port >= 65536) )
+  if (0 == access ("/sbin/sysctl", X_OK))
+    sbin_sysctl = "/sbin/sysctl";
+  else if (0 == access ("/usr/sbin/sysctl", X_OK))
+    sbin_sysctl = "/usr/sbin/sysctl";
+  else
   {
-    fprintf (stderr, 
-            "Port `%u' is invalid\n",
-            port);
-    return 2;
+    fprintf (stderr,
+             "Fatal: executable sysctl not found in approved directories: %s\n",
+             strerror (errno));
+    return 5;
   }
-  /* print port number to string for command-line use*/
-  (void) snprintf (localport,
-                  sizeof (localport), 
-                  "%u", 
-                  port);
+
+  /* setup 'mygid' string */
+  snprintf (mygid, sizeof (mygid), "%d", (int) getegid());
 
   /* do not die on SIGPIPE */
   if (SIG_ERR == signal (SIGPIPE, SIG_IGN))
@@ -788,6 +794,22 @@ main (int argc, char *const*argv)
   strncpy (dev, argv[1], IFNAMSIZ);
   dev[IFNAMSIZ - 1] = '\0';
 
+  /* Disable rp filtering */
+  {
+    char *const sysctl_args[] = {"sysctl", "-w",
+      "net.ipv4.conf.all.rp_filter=0", NULL};
+    char *const sysctl_args2[] = {"sysctl", "-w",
+      "net.ipv4.conf.default.rp_filter=0", NULL};
+    if ((0 != fork_and_exec (sbin_sysctl, sysctl_args)) ||
+        (0 != fork_and_exec (sbin_sysctl, sysctl_args2)))
+    {
+      fprintf (stderr,
+               "Failed to disable rp filtering.\n");
+      return 5;
+    }
+  }
+  
+  
   /* now open virtual interface (first part that requires root) */
   if (-1 == (fd_tun = init_tun (dev)))
   {
@@ -824,16 +846,18 @@ main (int argc, char *const*argv)
 
     set_address4 (dev, address, mask);
   }
+
   
   /* update routing tables -- next part why we need SUID! */
-  /* Forward everything from the given local port (with destination
-     to port 53, and only for UDP) without hijacking */
+  /* Forward everything from our EGID (which should only be held
+     by the 'gnunet-service-dns') and with destination
+     to port 53 on UDP, without hijacking */
   r = 8; /* failed to fully setup routing table */
   {
     char *const mangle_args[] = 
       {
-       "iptables", "-t", "mangle", "-I", "OUTPUT", "1", "-p",
-       "udp", "--sport", localport, "--dport", DNS_PORT, "-j",
+       "iptables", "-m", "owner", "-t", "mangle", "-I", "OUTPUT", "1", "-p",
+       "udp", "--gid-owner", mygid, "--dport", DNS_PORT, "-j",
        "ACCEPT", NULL
       };
     if (0 != fork_and_exec (sbin_iptables, mangle_args))
@@ -947,8 +971,8 @@ main (int argc, char *const*argv)
   {
     char *const mangle_clean_args[] =
       {
-       "iptables", "-t", "mangle", "-D", "OUTPUT", "-p", "udp",
-       "--sport", localport, "--dport", DNS_PORT, "-j", "ACCEPT",
+       "iptables", "-m", "owner", "-t", "mangle", "-D", "OUTPUT", "-p", "udp",
+        "--gid-owner", mygid, "--dport", DNS_PORT, "-j", "ACCEPT",
        NULL
       };
     if (0 != fork_and_exec (sbin_iptables, mangle_clean_args))