summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--doc/shibari-server-tcp.html2
-rw-r--r--doc/shibari-server-udp.html8
-rw-r--r--src/server/shibari-server-udp.c25
3 files changed, 28 insertions, 7 deletions
diff --git a/doc/shibari-server-tcp.html b/doc/shibari-server-tcp.html
index 5f36087..42808fa 100644
--- a/doc/shibari-server-tcp.html
+++ b/doc/shibari-server-tcp.html
@@ -28,7 +28,7 @@ on its standard output.
</div>
<pre>
- shibari-server-tcp [ -v <em>verbosity</em> [ -f <em>tdbfile</em> ] [ -r <em>rtimeout</em> ] [ -w <em>wtimeout</em> ]
+ shibari-server-tcp [ -v <em>verbosity</em> ] [ -f <em>tdbfile</em> ] [ -r <em>rtimeout</em> ] [ -w <em>wtimeout</em> ]
</pre>
<ul>
diff --git a/doc/shibari-server-udp.html b/doc/shibari-server-udp.html
index 7ac2897..a3395ba 100644
--- a/doc/shibari-server-udp.html
+++ b/doc/shibari-server-udp.html
@@ -28,7 +28,7 @@ answers DNS queries it receives, until it is killed.
</div>
<pre>
- shibari-server-udp [ -v <em>verbosity</em> ] [ -d <em>notif</em> ] [ -f <em>tdbfile</em> ] [ -w <em>wtimeout</em> ] [ -i <em>rulesdir</em> ] [ -x <em>rulesfile</em> ] [ -p <em>port</em> ] <em>ip</em>
+ shibari-server-udp [ -U ] [ -v <em>verbosity</em> ] [ -d <em>notif</em> ] [ -f <em>tdbfile</em> ] [ -w <em>wtimeout</em> ] [ -i <em>rulesdir</em> ] [ -x <em>rulesfile</em> ] [ -p <em>port</em> ] <em>ip</em>
</pre>
<ul>
@@ -65,6 +65,12 @@ underlying operating system. </dd>
</div>
<dl>
+
+ <dt> -U </dt>
+ <dd> Drop privileges. shibari-server-udp will expect the UID and GID
+environment variables to contain a suitable uid and gid, and will change
+to this uid and gid after binding its socket. </dd>
+
<dt> -v <em>verbosity</em> </dt>
<dd> Be more or less verbose.
A <em>verbosity</em> of 0 means no warnings, no logs, only error messages. 1
diff --git a/src/server/shibari-server-udp.c b/src/server/shibari-server-udp.c
index 87f0118..0a723ea 100644
--- a/src/server/shibari-server-udp.c
+++ b/src/server/shibari-server-udp.c
@@ -29,7 +29,7 @@
#include <shibari/common.h>
#include <shibari/server.h>
-#define USAGE "shibari-server-udp [ -v verbosity ] [ -d notif ] [ -f cdbfile ] [ -w wtimeout ] [ -i rulesdir | -x rulesfile ] [ -p port ] ip"
+#define USAGE "shibari-server-udp [ -U ] [ -v verbosity ] [ -d notif ] [ -f cdbfile ] [ -w wtimeout ] [ -i rulesdir | -x rulesfile ] [ -p port ] ip"
#define dieusage() strerr_dieusage(100, USAGE)
#define VAR "LOC"
@@ -116,6 +116,8 @@ int main (int argc, char const *const *argv)
tain wtto = TAIN_INFINITE_RELATIVE ;
s6_accessrules_params_t params = S6_ACCESSRULES_PARAMS_ZERO ;
unsigned int notif = 0 ;
+ uid_t uid = 0 ;
+ gid_t gid = 0 ;
char buf[512] ;
shibari_packet pkt = SHIBARI_PACKET_INIT(buf, 512, 0) ;
uint16_t localport = 53 ;
@@ -125,13 +127,15 @@ int main (int argc, char const *const *argv)
{
unsigned int wtimeout = 0 ;
+ int flagdrop = 0 ;
subgetopt l = SUBGETOPT_ZERO ;
for (;;)
{
- int opt = subgetopt_r(argc, argv, "v:d:f:w:i:x:p:", &l) ;
+ int opt = subgetopt_r(argc, argv, "Uv:d:f:w:i:x:p:", &l) ;
if (opt == -1) break ;
switch (opt)
{
+ case 'U' : flagdrop = 1 ; break ;
case 'v' : if (!uint320_scan(l.arg, &verbosity)) dieusage() ; break ;
case 'd' : if (!uint0_scan(l.arg, &notif)) dieusage() ; break ;
case 'f' : tdbfile = l.arg ; break ;
@@ -143,12 +147,20 @@ int main (int argc, char const *const *argv)
}
}
argc -= l.ind ; argv += l.ind ;
+ if (!argc) dieusage() ;
+ if (!ip46_scan(argv[0], &localip)) dieusage() ;
+ if (flagdrop)
+ {
+ char const *x = getenv("UID") ;
+ if (!x) strerr_dienotset(100, "UID") ;
+ if (!uid0_scan(x, &uid)) strerr_dieinvalid(100, "UID") ;
+ x = getenv("GID") ;
+ if (!x) strerr_dienotset(100, "GID") ;
+ if (!uid0_scan(x, &gid)) strerr_dieinvalid(100, "GID") ;
+ }
if (wtimeout) tain_from_millisecs(&wtto, wtimeout) ;
}
- if (!argc) dieusage() ;
- if (!ip46_scan(argv[0], &localip)) dieusage() ;
-
if (notif)
{
if (notif < 3) strerr_dief1x(100, "notification fd cannot be 0, 1 or 2") ;
@@ -174,6 +186,9 @@ int main (int argc, char const *const *argv)
x[1].fd = socket_udp46_nb(ip46_is6(&localip)) ;
if (x[1].fd == -1) strerr_diefu1sys(111, "create socket") ;
if (socket_bind46_reuse(x[1].fd, &localip, localport) == -1) strerr_diefu1sys(111, "bind socket") ;
+
+ if (gid && setgid(gid) == -1) strerr_diefu1sys(111, "setgid") ;
+ if (uid && setuid(uid) == -1) strerr_diefu1sys(111, "setuid") ;
if (!tain_now_set_stopwatch_g()) strerr_diefu1sys(111, "initialize clock") ;
shibari_log_start(verbosity, &localip, localport) ;