diff options
| author | shin <shin@FreeBSD.org> | 2000-02-24 19:06:05 +0000 |
|---|---|---|
| committer | shin <shin@FreeBSD.org> | 2000-02-24 19:06:05 +0000 |
| commit | 1c7bbb579dd0129ebb51ad5dc7cf1acd37706219 (patch) | |
| tree | d27e65884e231c5ec27b58f8204376314a6aadc1 /sbin/ping6/ping6.c | |
| parent | d693ba6b01e780960fb9d14ccf0ac6b6e383aa8e (diff) | |
| download | FreeBSD-src-1c7bbb579dd0129ebb51ad5dc7cf1acd37706219.zip FreeBSD-src-1c7bbb579dd0129ebb51ad5dc7cf1acd37706219.tar.gz | |
Security fixes. (Just same as sbin/ping and usr.sbin/traceroute)
-Open socket() at first and then setuid() to actual user.
-Allow ping6 preload option only for root.
Approved by: jkh
Submitted by: Neil Blakey-Milner <nbm@mithrandr.moria.org>
Diffstat (limited to 'sbin/ping6/ping6.c')
| -rw-r--r-- | sbin/ping6/ping6.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/sbin/ping6/ping6.c b/sbin/ping6/ping6.c index 34de2bd..00f06e3 100644 --- a/sbin/ping6/ping6.c +++ b/sbin/ping6/ping6.c @@ -269,6 +269,10 @@ main(argc, argv) memset(&smsghdr, 0, sizeof(&smsghdr)); memset(&smsgiov, 0, sizeof(&smsgiov)); + if ((s = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6)) < 0) + err(1, "socket"); + setuid(getuid()); + preload = 0; datap = &outpack[ICMP6ECHOLEN + ICMP6ECHOTMLEN]; #ifndef IPSEC @@ -356,6 +360,10 @@ main(argc, argv) options |= F_INTERVAL; break; case 'l': + if (getuid()) { + errno = EPERM; + errx(1, "Must be superuser to preload"); + } preload = strtol(optarg, &e, 10); if (preload < 0 || *optarg == '\0' || *e != '\0') errx(1, "illegal preload value -- %s", optarg); @@ -462,9 +470,6 @@ main(argc, argv) ident = getpid() & 0xFFFF; - if ((s = socket(res->ai_family, res->ai_socktype, res->ai_protocol)) < 0) - err(1, "socket"); - hold = 1; if (options & F_SO_DEBUG) |
