09d6f7dfb8
capabilities from the ndhc master process. Privsep is now complete. The only notable improvement from before is that exploitation of ndhc would only allow an attacker to open raw sockets, bind sockets to ports < port 1024, and create broadcast sockets on the interface that ndhc is performing dhcp on rather than on all interfaces. However, this seems like a worthwhile change; note that it was already impossible for an attacker to sniff packets on any interfaces (as that requires CAP_NET_ADMIN, which was always separated to ifch).
85 lines
3.2 KiB
C
85 lines
3.2 KiB
C
/* ndhc.h - DHCP client
|
|
*
|
|
* Copyright (c) 2014 Nicholas J. Kain <njkain at gmail dot com>
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions are met:
|
|
*
|
|
* - Redistributions of source code must retain the above copyright notice,
|
|
* this list of conditions and the following disclaimer.
|
|
*
|
|
* - Redistributions in binary form must reproduce the above copyright notice,
|
|
* this list of conditions and the following disclaimer in the documentation
|
|
* and/or other materials provided with the distribution.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
|
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
|
|
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
* POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
#ifndef NJK_NDHC_NDHC_H_
|
|
#define NJK_NDHC_NDHC_H_
|
|
|
|
#include <stdint.h>
|
|
#include <limits.h>
|
|
#include <net/if.h>
|
|
#include "nk/random.h"
|
|
|
|
struct client_state_t {
|
|
unsigned long long leaseStartTime;
|
|
int dhcpState;
|
|
int arpPrevState;
|
|
int ifsPrevState;
|
|
int ifchWorking; // ifch is performing interface changes.
|
|
int ifDeconfig; // Set if the interface has already been deconfigured.
|
|
int listenMode;
|
|
int epollFd, signalFd, listenFd, arpFd, nlFd;
|
|
int nlPortId;
|
|
uint32_t clientAddr, serverAddr, routerAddr;
|
|
uint32_t lease, renewTime, rebindTime, xid;
|
|
struct nk_random_state_u32 rnd32_state;
|
|
uint8_t routerArp[6], serverArp[6];
|
|
uint8_t using_dhcp_bpf, init, got_router_arp, got_server_arp;
|
|
};
|
|
|
|
struct client_config_t {
|
|
char foreground; // Do not fork
|
|
char quit_after_lease; // Quit after obtaining lease
|
|
char abort_if_no_lease; // Abort if no lease
|
|
char background_if_no_lease; // Fork to background if no lease
|
|
char interface[IFNAMSIZ]; // The name of the interface to use
|
|
char clientid[64]; // Optional client id to use
|
|
uint8_t clientid_len; // Length of the clientid
|
|
char hostname[64]; // Optional hostname to use
|
|
char vendor[64]; // Vendor identification that will be sent
|
|
int metric; // Metric for the default route
|
|
int ifindex; // Index number of the interface to use
|
|
uint8_t arp[6]; // Our arp address
|
|
};
|
|
|
|
extern struct client_config_t client_config;
|
|
|
|
extern int pToIfchR;
|
|
extern int pToIfchW;
|
|
extern int pToNdhcR;
|
|
extern int pToNdhcW;
|
|
extern int psToNdhcR;
|
|
extern int psToNdhcW;
|
|
extern int pToSockdR;
|
|
extern int pToSockdW;
|
|
extern char state_dir[PATH_MAX];
|
|
extern char chroot_dir[PATH_MAX];
|
|
extern char resolv_conf_d[PATH_MAX];
|
|
|
|
void background(void);
|
|
|
|
#endif /* NJK_NDHC_NDHC_H_ */
|