emo/ndhc
1
0 Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
534 Commits 1 Branch 0 Tags
d0d8bcf3ffe5fbc375485b4f82e43b09a668385d
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Nicholas J. Kain d0d8bcf3ff options.[ch] must still be valid C++11 because it is used in ndhs. 
That means the [static 1] arg specifier cannot be used.
 2015-02-14 02:14:30 -05:00
Nicholas J. Kain 00c9479c4c Mark more pointer arguments as never being null. 2015-02-14 01:46:02 -05:00
Nicholas J. Kain 0535b36534 dhcp.c: Make init_packet() not return a struct. 
Just work via a pointer to not rely on the compiler being intelligent
and inlining.
 2015-02-14 01:41:52 -05:00
Nicholas J. Kain 70c750f50c get_raw_packet: The read length check is stricter than necessary. 
Allow reads with excess data beyond the packet to succeed if the
packet is still well-formed.
 2015-02-14 01:40:06 -05:00
Nicholas J. Kain a7cb063f0c state.c: cosmetic cleanups and a constification 2015-02-14 00:44:21 -05:00
Nicholas J. Kain 04840c261d Fix some c99 struct initializer uninitialized member warnings 
that clang detects and GCC misses.
 2015-02-13 23:25:42 -05:00
Nicholas J. Kain 702d8b0c5b Mark pointer arguments that cannot ever be null as [static 1]. 
Also constify some cases, too.
 2015-02-13 23:14:08 -05:00
Nicholas J. Kain cc806acc0b Indicate that client_state_t and client_config_t pointer args 
cannot ever be null.

Could possibly improve code generation, and makes the intention clear.
 2015-02-13 22:29:03 -05:00
Nicholas J. Kain b6554c2931 Quiet the 'UDP length [] does not match header length' message. 
It is triggered frequently when discarding invalid packets that were
received on the DHCP port and it seems to have little significance.
 2015-02-13 21:56:34 -05:00
Nicholas J. Kain b4b6ed8fd5 Check for carrier before sendto() or write() on interface fd. 
Linux will quietly proceed as if the data were sent even if the carrier
is down and nothing actually happened.  There is still a tiny race
condition where the carrier could drop between the check and the actual
write, but we really can't do anything about that and it is a very
small race.
 2015-02-13 21:53:15 -05:00
Nicholas J. Kain 911d4cc58e Fix the dhcp state bootstrapping when rfkill is set #3. 2015-02-13 19:08:50 -05:00
Nicholas J. Kain 2e679ed491 Fix the dhcp state bootstrapping when rfkill is set #2. 2015-02-13 18:35:44 -05:00
Nicholas J. Kain a8af406307 Fix the dhcp state bootstrapping when rfkill is set. 2015-02-13 18:07:14 -05:00
Nicholas J. Kain 79a97131bc Handle the case where the rfkill is set when ndhc is initializing. 2015-02-13 17:50:24 -05:00
Nicholas J. Kain 5b050ba498 If the rfkill switch is enabled, do not react to netlink notifications 
until the rfkill is disabled.  They will mostly fail outright.
 2015-02-13 17:20:36 -05:00
Nicholas J. Kain cf81573082 Fix a dumb typo in the previous commit. 2015-02-13 16:56:56 -05:00
Nicholas J. Kain e3d4d4c1aa rfkill: Add support for reacting to radio kill switch events. 
In order for this to work, the correct rfkill index must be specified
with the rfkill-idx option.

It might be possible to auto-detect the corresponding rfkill-idx option,
but I'm not sure if there's a guaranteed mapping between rfkill name and
interface name, as it seems that rfkills should represent phy devices
and not wlan devices.

The rfkill indexes can be found by checking
/sys/class/rfkill/rfkill<IDX>.
 2015-02-13 16:25:36 -05:00
Nicholas J. Kain 3421f0c585 CMAKE_CROSSCOMPILE should be CMAKE_CROSSCOMPILING. 2015-02-13 05:12:55 -05:00
Nicholas J. Kain c58a071f52 Update copyright dates. 2015-02-13 01:54:57 -05:00
Nicholas J. Kain 7cb5506487 Spelling correction in README. 2015-02-13 01:48:00 -05:00
Nicholas J. Kain 27c9e2c553 Improve fingerprinting to support DHCP relay agents. 
Mostly reverts the previous commit and instead teaches ndhc to properly
handle the case when it is communicating with a DHCP relay agent on
its local segment rather than directly with a DHCP server.
 2015-02-12 23:28:54 -05:00
Nicholas J. Kain a395234a67 Support networks with relay agents that have the DHCP server on a 
different segment.

The network fingerprinting would never complete if the DHCP server was
on a different segment before this change, since it would be impossible
for the ARP messages sent by ndhc to ever reach the DHCP server
(and vice-versa).

Now just give up trying to find the hardware address after two tries
and assume that the DHCP server cannot be reached by ARP.

An alternative would be to fingerprint the relay agent instead, but
to do so would require a lot more work as the giaddr field is only
meaningful in the client->server message path, not in the
server->client path.  Thus it would require gathering the source IP
for DHCP replies sent by unicast or broadcast and ferrying along
this information to the ARP checking code where it would be used
in place of the DHCP server address.

This is entirely possible to do, but is quite a bit more work.
 2015-02-12 20:49:40 -05:00
Nicholas J. Kain 03fc696267 Update the man page and correct some formatting errors. 2015-02-12 19:03:09 -05:00
Nicholas J. Kain 9d8d653877 CMake: Do not try to test for the glibc version when cross-compiling. 2015-02-12 18:46:44 -05:00
Nicholas J. Kain b792162113 Add CROSSCOMPILE_MACHINENAME environment variable for CMake that 
will allow the host machine type detection to be skipped and
the target MACHINENAME to be manually defined.
 2015-02-12 13:35:50 -05:00
Nicholas J. Kain 8e4ea0be72 CMake: Only add -lrt link dependency if glibc is detected. 2015-02-12 13:05:30 -05:00
Nicholas J. Kain 6f6aad211e Documentation update. 2015-01-10 18:34:51 -05:00
Nicholas J. Kain 9f87bd8b30 udp_checksum(): Clamp the value of the UDP packet header length. 
Without this change, it is possible for malicious UDP packets to
make the function read past the end of a buffer.

If this was ever a possibility in ndhc, the previous commit fixed
that issue, but there is no reason for udp_checksum() to have
such a subtle precondition to proper use.  This change also makes
it easier to audit correctness.
 2015-01-06 07:07:08 -05:00
Nicholas J. Kain 6548b5ce54 get_raw_packet(): Perform the UDP checksum after the packet length 
checks.

This change makes it easier to verify that there can be no reads
beyond a buffer end by udp_checksum().
 2015-01-06 04:32:58 -05:00
Nicholas J. Kain c8dcf5a06b Make sure that received DHCP packets have a valid options end marker. 2015-01-06 04:02:52 -05:00
Nicholas J. Kain 94c107d465 Make sure all sockets are set NONBLOCK so that writes do not block. 2014-08-19 11:09:59 -04:00
Nicholas J. Kain 12114c9bae Add more explicit length checks for get_raw_packet. 2014-07-25 20:34:01 -04:00
Nicholas J. Kain 2518e0a2bc Use SO_LOCK_FILTER to ensure that BPF filters cannot be removed once attached. 
This facility was added to Linux in early 2013.  If it is not available,
the BPF will still be installed, but redundant checks will be performed
to guard against the BPF possibly being removed by an attacker.
 2014-06-13 22:37:37 -04:00
Nicholas J. Kain 56e30a0923 Fix the return value for nlmsg_get_error(). 2014-06-13 22:35:57 -04:00
Nicholas J. Kain ae03b6dd8f Move the ip checksum code out to ncmlib. 2014-06-08 20:34:34 -04:00
Nicholas J. Kain 4a083d3367 get_dhcp_opt() didx argument should be passed as a reference rather 
than relying on the caller re-assigning to didx.  The previous
didx += get_dhcp_opt(...) was wrong and should have used =.
 2014-05-10 21:38:45 -04:00
Nicholas J. Kain 99e21004ea arp_min_close_fd() will always force the arp fd to be equal to -1, so 
there is no need to check force_reopen twice.
 2014-05-10 21:13:24 -04:00
Nicholas J. Kain 3721cc926b Documentation updates. 2014-04-24 18:29:52 -04:00
Nicholas J. Kain 6af0d26351 Remove the obsolete init script for Gentoo's network configuration system. 
My own machines use a process supervision system, so this script is
unmaintained and doesn't work anymore.
 2014-04-24 18:24:00 -04:00
Nicholas J. Kain 2420bed259 Accept no command line arguments without error. 2014-04-21 12:04:13 -04:00
Nicholas J. Kain dbc91b0811 Background option in config files should be a boolval rathe than a value. 2014-04-21 09:02:58 -04:00
Nicholas J. Kain 034e2bb1db When sockd transfers a file descriptor to ndhc, close the fd in sockd. 
Since the transfer is conceptually a move, this is the correct thing to
do and prevents sockets from spuriously hanging around forever and
eventually exhausting the per process limit on fds.
 2014-04-17 11:04:00 -04:00
Nicholas J. Kain 07cbd88049 Just use raw sockets for listening to DHCP requests. A UDP SO_BROADCAST 
socket was previously used only for receiving RENEWING packets, and it
added needless complexity and was somewhat fragile.
 2014-04-16 01:00:36 -04:00
Nicholas J. Kain ca85a6ba9f Style cleanups in dhcp.c. 2014-04-16 00:24:40 -04:00
Nicholas J. Kain d8260b4e63 Print an error message when bind() fails when creating a UDP socket in sockd. 2014-04-16 00:24:13 -04:00
Nicholas J. Kain 0884d96d1e PR_SET_PDEATHSIG is not fully reliable, so instead maintain a pair of 
AF_UNIX SOCK_STREAM sockets between the master processes and each subprocess,
and poll for the HUP event.

At the same time, be specific about the events that are checked in epoll
when dispatching on an event.
 2014-04-15 23:19:24 -04:00
Nicholas J. Kain e526adce19 Make the signal handling code use safe_read() and unify ifchd and sockd 
signals code.
 2014-04-15 20:55:13 -04:00
Nicholas J. Kain baa394af9a UDP listen sockets should be requested with 'U' instead of 'u'. 2014-04-15 20:54:35 -04:00
Nicholas J. Kain b3578737df Update the Makefile to build cfg.c from cfg.rl. 2014-04-15 20:50:54 -04:00
Nicholas J. Kain b00444ab8b Bound the subprocess lifetime using prctl(PR_SET_PDEATHSIG, ...). 
The pipes wouldn't do this job anymore because they were unused and thus
never performed writes that would generate SIGPIPEs, so the pipes are
removed, too.
 2014-04-15 18:01:01 -04:00
Nicholas J. Kain b3ce601f20 state.c: Print error messages if we fail to send DHCP packets. 2014-04-15 17:59:15 -04:00
Nicholas J. Kain 18604c5245 get_udp_unicast_socket() needs to have the client address as an argument 
when sending the request to sockd.

Also, print error messages if sockd returns an invalid fd (< 0).
 2014-04-15 17:55:28 -04:00
Nicholas J. Kain a9055b5ca5 Update more message prints to prefix with the interface name. 2014-04-15 15:24:22 -04:00
Nicholas J. Kain 58b4ba768c If the IP header length does not match the size of the UDP packet received 
via the raw socket, print both lengths in the warning message.
 2014-04-15 15:23:52 -04:00
Nicholas J. Kain 730e5ef310 setpgid() can return EPERM if we are already a process group leader. 2014-04-15 15:02:20 -04:00
Nicholas J. Kain e5834da6d3 Permit sendmsg in the seccomp syscall whitelist for all daemons. 2014-04-15 14:57:07 -04:00
Nicholas J. Kain b5f0ccd88d In cfg.rl, when performing clear action, don't clear the cs member in ccfg. 2014-04-15 14:56:35 -04:00
Nicholas J. Kain a777766cc6 Fix stupid typo in ndhc.c that would cause the clientid option to 
corrupt the start of the hostname option if both were specified.
 2014-04-15 14:55:50 -04:00
Nicholas J. Kain 8a9fbb6f09 Documentation updates. 2014-04-14 18:32:08 -04:00
Nicholas J. Kain 74ad01a086 Update the manual page. 2014-04-14 15:52:39 -04:00
Nicholas J. Kain a501789e04 Parse config options with ragel and support a configuration file. 2014-04-14 15:06:31 -04:00
Nicholas J. Kain 51033d3664 Detect the glibc version in CMake and link librt if it is required. 
For the Makefile, unconditionally link librt with no detection.
 2014-04-07 19:14:31 -04:00
Nicholas J. Kain d267c2c44b Use the raw capability interface via updated ncmlib rather than linking 
to libcap.
 2014-04-07 15:05:34 -04:00
Nicholas J. Kain bb1ff7a506 arp.c: Make logging messages print the associated interface name. 2014-04-07 04:43:21 -04:00
Nicholas J. Kain 74678ef510 Use safe_recvmsg(). 2014-04-07 04:22:32 -04:00
Nicholas J. Kain 6804be2277 Use safe_sendto where necessary, and check for short writes. 
Also, change many log_lines to log_errors, mostly in ifset.c.
 2014-04-07 04:15:02 -04:00
Nicholas J. Kain 650da6a7fd Add recvfrom to the seccomp syscall whitelist. 2014-04-07 03:54:30 -04:00
Nicholas J. Kain cab9162d8d Remove socketpair from the seccomp syscall filter whitelist. 
socketpair() is called only before privileges are dropped, so it does
not need to be in the whitelist.
 2014-04-07 03:44:53 -04:00
Nicholas J. Kain 5fa2030bab Use a socketpair rather than a pair of pipes for communication between 
ndhc and ifch, similar to sockd.  A single pipe is also maintained so
that SIGPIPE can bound the lifetime of an orphaned ifch process.
 2014-04-07 03:44:02 -04:00
Nicholas J. Kain e2ee728982 Consolidate all of the global static variables in arp.c into a single 
struct, and use booleans where appropriate.
 2014-04-06 22:12:31 -04:00
Nicholas J. Kain a86363f248 Create a new process ID group for ndhc. 2014-04-06 22:07:12 -04:00
Nicholas J. Kain b761889025 Move source from ndhc/ to src/ since ifchd is no longer a separate program. 2014-04-06 16:57:06 -04:00
Nicholas J. Kain b511d45c2f Change most error comparisons from == -1 to < 0. Some were not changed, 
as the different negative values equate to different errors.

Tests against syscall returns and fds are very common and mostly fit
the pattern of this change.

The gain is increased range-exclusion.
 2014-04-06 06:33:14 -04:00
Nicholas J. Kain c03be059f5 writeordie() was buggy; delete the == 1 which makes no sense. 2014-04-06 06:31:40 -04:00
Nicholas J. Kain 3d76fbeedc Make sure that all safe_* return values use ssize_t. 2014-04-06 06:24:13 -04:00
Nicholas J. Kain 745e9e8923 If we encounter read errors reading the duid or iaid after successfully 
opening the file, print an error and exit.
 2014-04-06 06:06:53 -04:00
Nicholas J. Kain 7b0db5b8d3 arp.c: If the safe_read that fetches arp responses encounters a 
return of -1 with errno == EAGAIN or EWOULDBLOCK, then report the
error, as it should never happen given that the function is called
only once after polling for ready-reads.

Further, the old code was buggy; it would subtract from the arpreply_offset
the return value of -1 in that case, which is just wrong.
 2014-04-06 06:02:03 -04:00
Nicholas J. Kain 8b4c7f05b2 arp.c: Check for < 0 for invalid fds and function errors instead of == -1. 2014-04-06 05:54:21 -04:00
Nicholas J. Kain 8af6bee46d arp_switch_state() was far too confusing and buggy. Pass the target state as 
an argument, and only switch the global state after a change is successfully
made.
 2014-04-06 05:51:52 -04:00
Nicholas J. Kain 1e52914f2e Remove a lot of permitted syscalls from the seccomp filter list. 
Probably the most notable is that setsockopt is only allowed from sockd.
This change prevents ndhc and ifch from removing BPF filters that have been
installed onto a socket.
 2014-04-06 05:21:56 -04:00
Nicholas J. Kain 812912126e ifch doesn't need to save a pidfile because its lifetime is strictly bounded 
by that of ndhc by the shared pipe, so remove that option.
 2014-04-06 02:27:52 -04:00
Nicholas J. Kain 6b1d422d6f arp_min_close_fd() and arp_close_fd() can return void. 2014-04-05 23:40:18 -04:00
Nicholas J. Kain 1c30247c36 arp_reopen_fd() can be return void. 2014-04-05 23:37:44 -04:00
Nicholas J. Kain 6750209e12 Have sockd apply BPF filters to ARP sockets. 2014-04-05 21:39:27 -04:00
Nicholas J. Kain 5212e0dfc5 Switch to using a socket for ndhc/sockd IPC so that fd passing works. 2014-04-05 05:25:56 -04:00
Nicholas J. Kain 9622640698 Add command line help for the sockd-user option. 2014-04-05 05:23:37 -04:00
Nicholas J. Kain ef51971a6d Update to latest ncmlib privilege.[ch]. 2014-04-05 05:23:18 -04:00
Nicholas J. Kain 09d6f7dfb8 Introduce a ndhc-sockd daemon that separates out the remaining elevated 
capabilities from the ndhc master process.

Privsep is now complete.  The only notable improvement from before is that
exploitation of ndhc would only allow an attacker to open raw sockets,
bind sockets to ports < port 1024, and create broadcast sockets on the
interface that ndhc is performing dhcp on rather than on all interfaces.

However, this seems like a worthwhile change; note that it was already
impossible for an attacker to sniff packets on any interfaces (as that
requires CAP_NET_ADMIN, which was always separated to ifch).
 2014-04-04 04:12:25 -04:00
Nicholas J. Kain 65c3cd4fd9 Make many more logging prints specify the interface and function, and make 
the return checks for safe_(read|write) stricter.
 2014-04-04 04:01:49 -04:00
Nicholas J. Kain 2200b68aff Print a warning if the BPF is not installed for an ARP socket. 2014-04-04 03:55:32 -04:00
Nicholas J. Kain dc2ac46fd4 Update to latest ncmlib and remove some dead preprocessor defines. 2014-03-31 16:06:41 -04:00
Nicholas J. Kain 2f54ff75f3 Use nk_uidgidbyname(). 2014-03-30 22:18:04 -04:00
Nicholas J. Kain 2d8654ae59 Update copyright dates. 2014-03-30 17:23:35 -04:00
Nicholas J. Kain 1abf8462d3 Convert logging messages to suicide() where appropriate and clean up the 
logging messages a bit.
 2014-03-30 17:21:27 -04:00
Nicholas J. Kain 82d9682ed8 Update to latest ncmlib changes. 2014-03-30 17:02:48 -04:00
Nicholas J. Kain abda60e0e9 Remove unused defines. 2014-03-28 11:17:52 -04:00
Nicholas J. Kain 1b6b52d2eb Don't background the daemon by default. Process supervision is finally 
catching on and becoming the norm.
 2014-03-28 00:12:33 -04:00
Nicholas J. Kain 704e414171 Add nl_sendgetaddr and nl_sendgetaddrs variants for v4/v6. 2014-03-28 00:09:53 -04:00
Nicholas J. Kain 77ce7b9a6c printf 'hh' length modifier is a gnu extension. Don't use it. 2014-03-25 05:27:47 -04:00
Nicholas J. Kain 00e7e2a61b Remove an implicit narrowing cast from void* in nl.h. 
This cast is fine in C, but if the header is included from C++, even from
an extern "C" block, it will cause an error.
 2014-03-24 09:55:55 -04:00