Return to packet.c CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / mtr / packet

Annotation of embedaddon/mtr/packet/packet.c, revision 1.1.1.1

1.1       misho       1: /*
                      2:     mtr  --  a network diagnostic tool
                      3:     Copyright (C) 2016  Matt Kimball
                      4: 
                      5:     This program is free software; you can redistribute it and/or modify
                      6:     it under the terms of the GNU General Public License version 2 as
                      7:     published by the Free Software Foundation.
                      8: 
                      9:     This program is distributed in the hope that it will be useful,
                     10:     but WITHOUT ANY WARRANTY; without even the implied warranty of
                     11:     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
                     12:     GNU General Public License for more details.
                     13: 
                     14:     You should have received a copy of the GNU General Public License
                     15:     along with this program; if not, write to the Free Software
                     16:     Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
                     17: */
                     18: 
                     19: #include "config.h"
                     20: 
                     21: #include <errno.h>
                     22: #include <stdio.h>
                     23: #include <stdlib.h>
                     24: #include <string.h>
                     25: #include <unistd.h>
                     26: 
                     27: #ifdef HAVE_LIBCAP
                     28: #include <sys/capability.h>
                     29: #endif
                     30: 
                     31: #include "wait.h"
                     32: 
                     33: /*  Drop SUID privileges.  To be used after accquiring raw sockets.  */
                     34: static
                     35: int drop_elevated_permissions(
                     36:     void)
                     37: {
                     38: #ifdef HAVE_LIBCAP
                     39:     cap_t cap;
                     40: #endif
                     41: 
                     42:     /*  Drop any suid permissions granted  */
                     43:     if (setgid(getgid()) || setuid(getuid())) {
                     44:         return -1;
                     45:     }
                     46: 
                     47:     if (geteuid() != getuid() || getegid() != getgid()) {
                     48:         return -1;
                     49:     }
                     50: 
                     51:     /*
                     52:        Drop all process capabilities.
                     53:        This will revoke anything granted by a commandline 'setcap'
                     54:      */
                     55: #ifdef HAVE_LIBCAP
                     56:     cap = cap_get_proc();
                     57:     if (cap == NULL) {
                     58:         return -1;
                     59:     }
                     60:     if (cap_clear(cap)) {
                     61:         return -1;
                     62:     }
                     63:     if (cap_set_proc(cap)) {
                     64:         return -1;
                     65:     }
                     66: #endif
                     67: 
                     68:     return 0;
                     69: }
                     70: 
                     71: int main(
                     72:     int argc,
                     73:     char **argv)
                     74: {
                     75:     bool command_pipe_open;
                     76:     struct command_buffer_t command_buffer;
                     77:     struct net_state_t net_state;
                     78: 
                     79:     /*
                     80:        To minimize security risk, the only thing done prior to 
                     81:        dropping SUID should be opening the network state for
                     82:        raw sockets.
                     83:      */
                     84:     init_net_state_privileged(&net_state);
                     85:     if (drop_elevated_permissions()) {
                     86:         perror("Unable to drop elevated permissions");
                     87:         exit(EXIT_FAILURE);
                     88:     }
                     89:     init_net_state(&net_state);
                     90: 
                     91:     init_command_buffer(&command_buffer, fileno(stdin));
                     92: 
                     93:     command_pipe_open = true;
                     94: 
                     95:     /*
                     96:        Dispatch commands and respond to probe replies until the
                     97:        command stream is closed.
                     98:      */
                     99:     while (true) {
                    100:         /*  Ensure any responses are written before waiting  */
                    101:         fflush(stdout);
                    102:         wait_for_activity(&command_buffer, &net_state);
                    103: 
                    104:         /*
                    105:            Receive replies first so that the timestamps are as
                    106:            close to the response arrival time as possible.
                    107:          */
                    108:         receive_replies(&net_state);
                    109: 
                    110:         if (command_pipe_open) {
                    111:             if (read_commands(&command_buffer)) {
                    112:                 if (errno == EPIPE) {
                    113:                     command_pipe_open = false;
                    114:                 }
                    115:             }
                    116:         }
                    117: 
                    118:         check_probe_timeouts(&net_state);
                    119: 
                    120:         /*
                    121:            Dispatch commands late so that the window between probe
                    122:            departure and arriving replies is as small as possible.
                    123:          */
                    124:         dispatch_buffer_commands(&command_buffer, &net_state);
                    125: 
                    126:         /*
                    127:            If the command pipe has been closed, exit after all
                    128:            in-flight probes have reported their status.
                    129:          */
                    130:         if (!command_pipe_open) {
                    131:             if (net_state.outstanding_probe_count == 0) {
                    132:                 break;
                    133:             }
                    134:         }
                    135:     }
                    136: 
                    137:     return 0;
                    138: }