modified ssp.c, works with glibc

ssp.c (text/plain), 5.46 KB, created by Kevin F. Quinn (RETIRED) on 2005-01-27 16:24:24 UTC

/*
 * Distributed under the terms of the GNU General Public License v2
 * $Header: /var/cvsroot/gentoo-x86/sys-libs/glibc/files/2.3.3/ssp.c,v 1.3 2004/08/07 17:53:20 solar Exp $
 *
 * This is a modified version of Hiroaki Etoh's stack smashing routines
 * implemented for glibc.
 *
 * The following people have contributed input to this code.
 * Ned Ludd - <solar[@]gentoo.org>
 * Alexander Gabert - <pappy[@]gentoo.org>
 * The PaX Team - <pageexec[@]freemail.hu>
 * Peter S. Mazinger - <ps.m[@]gmx.net>
 * Yoann Vandoorselaere - <yoann[@]prelude-ids.org>
 * Robert Connolly - <robert[@]linuxfromscratch.org>
 * Cory Visi <[e-mail]>
 *
 */

#ifdef HAVE_CONFIG_H
# include <config.h>
#endif

#include <stdio.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <sys/syslog.h>
#include <sys/time.h>
#include <sys/sysctl.h>

#ifndef _PATH_LOG
#define _PATH_LOG "/dev/log"
#endif

#ifdef __PROPOLICE_BLOCK_SEGV__
#define SSP_SIGTYPE SIGSEGV
#elif __PROPOLICE_BLOCK_KILL__
#define SSP_SIGTYPE SIGKILL
#else
#define SSP_SIGTYPE SIGABRT
#endif

/* [e-mail] - fix for http://bugs.gentoo.org/show_bug.cgi?id=65892 */
/* as proposed by  Peter S. Mazinger */

#ifdef __UCLIBC__
#define open __libc_open
#define close __libc_close
#define read __libc_read
#define socket __socketcall
#define sendto __libc_sendto
#define getpid __libc_getpid
/* #define kill __syscall_kill */
#define sigdelset __sigdelset
/* #define sigprocmask __syscall_sigprocmask */
#define sigfillset __sigfillset
/*
#define sigaction __syscall_sigaction
#define strcpy __strcpy
#define strncat __strncat
#define strlen __strlen
#define strncpy __strncpy
#define gettimeofday __gettimeofday
 */
#else
#define open __open /* __libc_open is also available */
#define close __close /* __libc_close is also available */
#define read __read /* __libc_read is also available */
#define write __write /* __libc_write is also available */
#define socket __socket /* not hidden */
#define sendto __sendto /* not hidden */
#define getpid __getpid
#define kill __kill /* not hidden */
#define sigdelset __sigdelset /* sigdelset hidden */
#define sigprocmask __sigprocmask
#define sigfillset __sigfillset /* sigfillset hidden */
#define sigaction(a,b,c) __sigaction(a,b,c)
/* for these, __X does not exist; the macro expansion
 * is rather more complex.
#ifndef strcpy
#define strcpy __strcpy
#endif
#ifndef strncat
#define strncat __strncat * not hidden; macro *
#endif
#ifndef strlen
#define strlen __strlen
#endif
#ifndef strncpy
#define strncpy __strncpy
#endif
*/
#define gettimeofday __gettimeofday /* not hidden */
#endif

unsigned long __guard = 0UL;

void
__guard_setup (void)
{
  size_t size;
#ifdef HAVE_DEV_ERANDOM
  int mib[3];
#endif

  if (__guard != 0UL)
    return;

#ifndef __SSP_QUICK_CANARY__
#ifdef HAVE_DEV_ERANDOM
  /* Random is another depth in Linux, hence an array of 3. */
  mib[0] = CTL_KERN;
  mib[1] = KERN_RANDOM;
  mib[2] = RANDOM_ERANDOM;

  size = sizeof (unsigned long);
  if (__sysctl (mib, 3, &__guard, &size, NULL, 0) != (-1))
    if (__guard != 0UL)
      return;
#endif
  /* 
   * Attempt to open kernel pseudo random device if one exists before 
   * opening urandom to avoid system entropy depletion.
   */
  {
    int fd;
#ifdef HAVE_DEV_ERANDOM
    if ((fd = open ("/dev/erandom", O_RDONLY)) == (-1))
#endif
      fd = open ("/dev/urandom", O_RDONLY);
    if (fd != (-1))
      {
	size = read (fd, (char *) &__guard, sizeof (__guard));
	close (fd);
	if (size == sizeof (__guard))
	  return;
      }
  }
#endif

  /* If sysctl was unsuccessful, use the "terminator canary". */
  __guard = 0xFF0A0D00UL;

  {
    /* Everything failed? Or we are using a weakened model of the 
     * terminator canary */
    struct timeval tv;

    gettimeofday (&tv, NULL);
    __guard ^= tv.tv_usec ^ tv.tv_sec;
  }
}

void
__stack_smash_handler (char func[], int damaged)
{
  struct sigaction sa;
  const char message[] = ": stack smashing attack in function ";
  int bufsz, len;
  char buf[512];
#ifndef __dietlibc__
  struct sockaddr_un sock;	/* AF_UNIX address of local logger */
  int log;
  extern char *__progname;
#else
  static char *__progname = "dietapp";
#endif

  sigset_t mask;
  sigfillset (&mask);

  sigdelset (&mask, SSP_SIGTYPE);	/* Block all signal handlers */
  sigprocmask (SIG_BLOCK, &mask, NULL);	/* except SIGABRT */

  bufsz = sizeof (buf);
  strcpy (buf, "<2>");
  len = 3;

  strncat (buf, __progname, sizeof (buf) - 4);
  len = strlen (buf);

  if (bufsz > len)
    {
      strncat (buf, message, bufsz - len - 1);
      len = strlen (buf);
    }
  if (bufsz > len)
    {
      strncat (buf, func, bufsz - len - 1);
      len = strlen (buf);
    }

  /* print error message */
  write (STDERR_FILENO, buf + 3, len - 3);
  write (STDERR_FILENO, "()\n", 3);
#ifndef __dietlibc__
  if ((log = socket (AF_UNIX, SOCK_DGRAM, 0)) != -1)
    {
      /* Send "found" message to the "/dev/log" path */
      sock.sun_family = AF_UNIX;
      (void) strncpy (sock.sun_path, _PATH_LOG, sizeof (sock.sun_path) - 1);
      sock.sun_path[sizeof (sock.sun_path) - 1] = '\0';
      sendto (log, buf, len, 0, (struct sockaddr *) &sock, sizeof (sock));
    }
#endif
  /* Make sure the default handler is associated with the our signal handler */

  memset (&sa, 0, sizeof (struct sigaction));
  sigfillset (&sa.sa_mask);	/* Block all signals */
  sa.sa_flags = 0;
  sa.sa_handler = SIG_DFL;
  sigaction (SSP_SIGTYPE, &sa, NULL);
  (void) kill (getpid (), SSP_SIGTYPE);
  _exit (127);
}