/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License, Version 1.0 only

 * (the "License").  You may not use this file except in compliance

 * with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright 2003 Sun Microsystems, Inc.  All rights reserved.

 * Use is subject to license terms.

 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

#include <sys/types.h>

#include <stdio.h>

#include <bsm/audit.h>

#include <bsm/audit_uevents.h>

#include <bsm/libbsm.h>

#include <bsm/audit_private.h>

#include <netinet/in.h>

#include <generic.h>

#include <pwd.h>

#include <strings.h>

#include <stdlib.h>

#include <unistd.h>

#ifdef C2_DEBUG

#define	dprintf(x) {printf x; }

#else

#define	dprintf(x)

#endif

static void audit_inetd_session_setup(struct passwd *);

static au_tid_addr_t audit_inetd_tid;

static int auditingisoff;

static au_class_t eventclass;

static int preselected;

static au_mask_t kmask;

int

audit_inetd_config(void)

{

	struct au_event_ent *ee;

	/*

	 * If auditing is turned off, then don't do anything.

	 * Especially don't return an error

	 */

	if (auditingisoff = cannot_audit(0)) {

		return (0);

	}

	aug_save_event(AUE_inetd_connect);

	if (cacheauevent(&ee, AUE_inetd_connect) != 1)

		return (1);

	eventclass = ee->ae_class;

	return (0);

}

/*

 * save terminal ID for user level audit record generation

 */

int

audit_inetd_termid(int fd)

{

	struct sockaddr_in6 peer;

	struct sockaddr_in6 sock;

	int peerlen = sizeof (peer);

	int socklen = sizeof (sock);

	uint_t port;

	uint32_t *addr;

	auditinfo_addr_t ai;

	if (auditingisoff) {

		return (0);

	}

	(void) aug_save_namask();

	/* quick preslection */

	if (auditon(A_GETKMASK, (caddr_t)&kmask, sizeof (kmask)) < 0) {

		/* should generate syslog message here or in inetd.c */

		preselected = 0;

		return (1);

	}

	/* now see if we're preselected. Ignore success/failure for now */

	if ((kmask.am_success|kmask.am_failure) & eventclass) {

		preselected = 1;

	} else {

		preselected = 0;

		return (0);

	}

	/* get peer name (use local termid if not a socket) */

	if (getpeername(fd, (struct sockaddr *)&peer, (socklen_t *)&peerlen)

		< 0) {

		/* use machine terminal address if unknown ports */

		if (auditon(A_GETKAUDIT, (caddr_t)&ai, sizeof (ai)) < 0) {

			return (1);

		}

		/* termid unset, make it legal (0.0.0.0) */

		if (ai.ai_termid.at_type == 0)

			ai.ai_termid.at_type = AU_IPv4;

		audit_inetd_tid = ai.ai_termid;

		aug_save_tid_ex(ai.ai_termid.at_port,

				(uint32_t *)&ai.ai_termid.at_addr,

				(uint32_t)ai.ai_termid.at_type);

		return (0);

	}

	addr = (uint32_t *)&peer.sin6_addr;

	/* get sock name (use local termid if not a socket) */

	if (getsockname(fd, (struct sockaddr *)&sock, (socklen_t *)&socklen)

		< 0) {

		/* have everything but local port. make it 0 for now */

		bzero(&sock, sizeof (sock));

	}

	bzero(&audit_inetd_tid, sizeof (audit_inetd_tid));

	port = ((peer.sin6_port<<16) | (sock.sin6_port));

	audit_inetd_tid.at_port = port;

	if (peer.sin6_family == AF_INET6) {

		aug_save_tid_ex(port, (uint32_t *)&peer.sin6_addr, AU_IPv6);

		audit_inetd_tid.at_type = AU_IPv6;

		audit_inetd_tid.at_addr[0] = addr[0];

		audit_inetd_tid.at_addr[1] = addr[1];

		audit_inetd_tid.at_addr[2] = addr[2];

		audit_inetd_tid.at_addr[3] = addr[3];

	} else {

		struct sockaddr_in *ppeer = (struct sockaddr_in *)&peer;

		aug_save_tid(port, (int)ppeer->sin_addr.s_addr);

		audit_inetd_tid.at_type = AU_IPv4;

		audit_inetd_tid.at_addr[0] = (uint32_t)ppeer->sin_addr.s_addr;

	}

	return (0);

}

int

audit_inetd_service(

		char *service_name,	/* name of service */

		struct passwd *pwd)		/* password */

{

	int	set_audit = 0;	/* flag - set audit characteristics */

	auditinfo_addr_t ai;

	dprintf(("audit_inetd_service()\n"));

	if (auditingisoff)

		return (0);

	if (preselected == 0)

		return (0);

	/*

	 * set default values. We will overwrite them when appropriate.

	 */

	if (getaudit_addr(&ai, sizeof (ai))) {

		perror("inetd");

		exit(1);

	}

	aug_save_auid(ai.ai_auid);	/* Audit ID */

	aug_save_uid(getuid());		/* User ID */

	aug_save_euid(geteuid());	/* Effective User ID */

	aug_save_gid(getgid());		/* Group ID */

	aug_save_egid(getegid());	/* Effective Group ID */

	aug_save_pid(getpid());		/* process ID */

	aug_save_asid(getpid());	/* session ID */

	/*

	 * do the best we can. We have no way to determine if the

	 * request is from a system service or from the root user.

	 * We will consider all root requests to be system service

	 * operations for now. We'll readdress this when we devise a

	 * better algorithm.

	 */

	if (pwd != NULL && (pwd->pw_uid)) {

		aug_save_auid(pwd->pw_uid);	/* Audit ID */

		aug_save_uid(pwd->pw_uid);	/* User ID */

		aug_save_euid(pwd->pw_uid);	/* Effective User ID */

		aug_save_gid(pwd->pw_gid);	/* Group ID */

		aug_save_egid(pwd->pw_gid);	/* Effective Group ID */

		set_audit = 1;

	}

	aug_save_text(service_name);

	aug_save_sorf(0);

	(void) aug_audit();

	/*

	 * Note that we will only do this if non-attributable auditing set.

	 * we might want to change things so this is always called.

	 */

	if (set_audit)

		audit_inetd_session_setup(pwd);

	return (0);

}

/*

 * set the audit characteristics for the inetd started process.

 * inetd is setting the uid.

 */

void

audit_inetd_session_setup(struct passwd *pwd)

{

	struct auditinfo_addr info;

	au_mask_t mask;

	info.ai_auid = pwd->pw_uid;

	mask.am_success = 0;

	mask.am_failure = 0;

	(void) au_user_mask(pwd->pw_name, &mask);

	info.ai_mask.am_success  = mask.am_success;

	info.ai_mask.am_failure  = mask.am_failure;

	info.ai_asid = getpid();

	info.ai_termid = audit_inetd_tid;

	if (setaudit_addr(&info, sizeof (info)) < 0) {

		perror("inetd: setaudit_addr");

		exit(1);

	}

}