[#3848] Warn on socket permissions

Warn if control socket path is valid but
socket permissions are wrong and security is
disabled.

modified:   src/lib/config/config_messages.cc
modified:   src/lib/config/config_messages.h
modified:   src/lib/config/config_messages.mes
modified:   src/lib/config/tests/unix_command_config_unittests.cc
modified:   src/lib/config/unix_command_config.cc

diff --git a/src/lib/config/config_messages.cc b/src/lib/config/config_messages.cc
index bfc4fe9899299a3bc713a2c69f7d2e51a9b15028..b6f76cfcd0d2021c4167fca706eea6657eeb06bc 100644 (file)
--- a/src/lib/config/config_messages.cc
+++ b/src/lib/config/config_messages.cc
@@ -32,6 +32,7 @@ extern const isc::log::MessageID COMMAND_SOCKET_READ_FAIL = "COMMAND_SOCKET_READ
 extern const isc::log::MessageID COMMAND_SOCKET_WRITE = "COMMAND_SOCKET_WRITE";
 extern const isc::log::MessageID COMMAND_SOCKET_WRITE_FAIL = "COMMAND_SOCKET_WRITE_FAIL";
 extern const isc::log::MessageID COMMAND_UNIX_SOCKET_PATH_SECURITY_WARNING = "COMMAND_UNIX_SOCKET_PATH_SECURITY_WARNING";
+extern const isc::log::MessageID COMMAND_UNIX_SOCKET_PERMISSIONS_SECURITY_WARNING = "COMMAND_UNIX_SOCKET_PERMISSIONS_SECURITY_WARNING";
 extern const isc::log::MessageID COMMAND_WATCH_SOCKET_CLEAR_ERROR = "COMMAND_WATCH_SOCKET_CLEAR_ERROR";
 extern const isc::log::MessageID COMMAND_WATCH_SOCKET_CLOSE_ERROR = "COMMAND_WATCH_SOCKET_CLOSE_ERROR";
 extern const isc::log::MessageID COMMAND_WATCH_SOCKET_MARK_READY_ERROR = "COMMAND_WATCH_SOCKET_MARK_READY_ERROR";
@@ -73,6 +74,7 @@ const char* values[] = {
     "COMMAND_SOCKET_WRITE", "Sent response of %1 bytes (%2 bytes left to send) over command socket %3",
     "COMMAND_SOCKET_WRITE_FAIL", "Error while writing to command socket %1 : %2",
     "COMMAND_UNIX_SOCKET_PATH_SECURITY_WARNING", "unix socket path is NOT SECURE: %1",
+    "COMMAND_UNIX_SOCKET_PERMISSIONS_SECURITY_WARNING", "unix socket permissions are NOT SECURE: %1",
     "COMMAND_WATCH_SOCKET_CLEAR_ERROR", "watch socket failed to clear: %1",
     "COMMAND_WATCH_SOCKET_CLOSE_ERROR", "watch socket failed to close: %1",
     "COMMAND_WATCH_SOCKET_MARK_READY_ERROR", "watch socket failed to mark ready: %1",

diff --git a/src/lib/config/config_messages.h b/src/lib/config/config_messages.h
index 890ea28053bc708851b085f8afa40e41953ffe28..089aa1e57fc1770de7b9569840910a2d1e68817d 100644 (file)
--- a/src/lib/config/config_messages.h
+++ b/src/lib/config/config_messages.h
@@ -33,6 +33,7 @@ extern const isc::log::MessageID COMMAND_SOCKET_READ_FAIL;
 extern const isc::log::MessageID COMMAND_SOCKET_WRITE;
 extern const isc::log::MessageID COMMAND_SOCKET_WRITE_FAIL;
 extern const isc::log::MessageID COMMAND_UNIX_SOCKET_PATH_SECURITY_WARNING;
+extern const isc::log::MessageID COMMAND_UNIX_SOCKET_PERMISSIONS_SECURITY_WARNING;
 extern const isc::log::MessageID COMMAND_WATCH_SOCKET_CLEAR_ERROR;
 extern const isc::log::MessageID COMMAND_WATCH_SOCKET_CLOSE_ERROR;
 extern const isc::log::MessageID COMMAND_WATCH_SOCKET_MARK_READY_ERROR;

diff --git a/src/lib/config/config_messages.mes b/src/lib/config/config_messages.mes
index 752083c167e4cfe07577e7a7d233bfc0c3bbd119..dd7e733fe57639c1c2a8c87ef05267fcb67ee791 100644 (file)
--- a/src/lib/config/config_messages.mes
+++ b/src/lib/config/config_messages.mes
@@ -186,3 +186,9 @@ This warning message is issued when security enforcement is disabled
 and the path specified for a control channel unix socket-name does
 not comply with the supported path. The server will still use the
 specified path but is warning that doing so may pose a security risk.
+
+% COMMAND_UNIX_SOCKET_PERMISSIONS_SECURITY_WARNING unix socket permissions are NOT SECURE: %1
+This warning message is issued when security enforcement is disabled
+and the path specified for a control channel unix socket-name does
+not have the required socket permissions. The server will still use the
+specified path but is warning that doing so may pose a security risk.

diff --git a/src/lib/config/tests/unix_command_config_unittests.cc b/src/lib/config/tests/unix_command_config_unittests.cc
index a7e501ccb364e0a1419733f98184da2efbcb8ef3..59d2b9da52fe2874fab0b831bd8acff9adff67cd 100644 (file)
--- a/src/lib/config/tests/unix_command_config_unittests.cc
+++ b/src/lib/config/tests/unix_command_config_unittests.cc
@@ -163,4 +163,25 @@ TEST_F(UnixCommandConfigTest, securityEnforcmentFalse) {
     EXPECT_EQ(1, countFile(oss.str()));
 }
 
+// This test verifies security warning of invalid
+// socket path permissions.
+TEST_F(UnixCommandConfigTest, securityEnforcmentFalsePermissions) {
+    setSocketTestPath("/tmp");
+    UnixCommandConfig::setSocketPathPerms(0);
+    file::PathChecker::enableEnforcement(false);
+    std::string config = R"( { "socket-name": "/tmp/mysocket" } )";
+
+    ElementPtr json;
+    ASSERT_NO_THROW(json = Element::fromJSON(config));
+    ASSERT_NO_THROW_LOG(unix_config_.reset(new UnixCommandConfig(json)));
+
+    std::ostringstream oss;
+    oss << "COMMAND_UNIX_SOCKET_PERMISSIONS_SECURITY_WARNING"
+        << " unix socket permissions are NOT SECURE: socket path:/tmp"
+        << " does not exist or does not have permssions = 0";
+
+    EXPECT_EQ(1, countFile(oss.str()));
+}
+
+
 } // end of anonymous namespace

diff --git a/src/lib/config/unix_command_config.cc b/src/lib/config/unix_command_config.cc
index 4b1e2153ad46ecc6484c53d2f97c5c3698e0def2..bbb10d5946aa7ef3cc3a59e2d451b1b0e63fcc0c 100644 (file)
--- a/src/lib/config/unix_command_config.cc
+++ b/src/lib/config/unix_command_config.cc
@@ -127,11 +127,19 @@ UnixCommandConfig::validatePath(const std::string socket_path) {
         return(socket_path);
     }
 
-    if (!socket_path_checker_->pathHasPermissions(socket_path_perms_)) {
-        isc_throw (DhcpConfigError,
-                   "socket path:" << socket_path_checker_->getPath()
-                   << " does not exist or does not have permssions = "
-                   << std::oct << socket_path_perms_);
+    auto parent_path = socket_path_checker_->getPath();
+    if (!hasPermissions(parent_path, socket_path_perms_)) {
+        std::ostringstream oss;
+        oss << "socket path:" << parent_path
+            << " does not exist or does not have permssions = "
+            << std::oct << socket_path_perms_;
+
+        if (PathChecker::shouldEnforceSecurity()) {
+            isc_throw (DhcpConfigError, oss.str());
+        }
+
+        LOG_WARN(command_logger, COMMAND_UNIX_SOCKET_PERMISSIONS_SECURITY_WARNING)
+                .arg(oss.str());
     }
 
     return (valid_path);