1 files changed, 142 insertions, 0 deletions

diff --git a/src/firejail/dhcp.c b/src/firejail/dhcp.c
new file mode 100644
index 000000000..c9bbb4d8f
--- /dev/null
+++ b/src/firejail/dhcp.c
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2014-2019 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+#include "firejail.h"
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <errno.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <string.h>
+
+pid_t dhclient4_pid = 0;
+pid_t dhclient6_pid = 0;
+
+typedef struct {
+  char *version_arg;
+  char *pid_file;
+  char *leases_file;
+  uint8_t generate_duid;
+  char *duid_leases_file;
+  pid_t *pid;
+  ptrdiff_t arg_offset;
+} Dhclient;
+
+static const Dhclient dhclient4 = { .version_arg = "-4",
+                                    .pid_file = RUN_DHCLIENT_4_PID_FILE,
+                                    .leases_file = RUN_DHCLIENT_4_LEASES_FILE,
+                                    .generate_duid = 1,
+                                    .pid = &dhclient4_pid,
+                                    .arg_offset = offsetof(Bridge, arg_ip_dhcp)
+};
+
+static const Dhclient dhclient6 = { .version_arg = "-6",
+                                    .pid_file = RUN_DHCLIENT_6_PID_FILE,
+                                    .leases_file = RUN_DHCLIENT_6_LEASES_FILE,
+                                    .duid_leases_file = RUN_DHCLIENT_4_LEASES_FILE,
+                                    .pid = &dhclient6_pid,
+                                    .arg_offset = offsetof(Bridge, arg_ip6_dhcp)
+};
+
+static void dhcp_run_dhclient(const Dhclient *client) {
+  char *argv[256] = { "dhclient",
+                      client->version_arg,
+                      "-pf", client->pid_file,
+                      "-lf", client->leases_file,
+  };
+  int i = 6;
+  if (client->generate_duid)
+    argv[i++] = "-i";
+  if (client->duid_leases_file) {
+    argv[i++] = "-df";
+    argv[i++] = client->duid_leases_file;
+  }
+  if (arg_debug)
+    argv[i++] = "-v";
+  if (*(uint8_t *) ((char *) &cfg.bridge0 + client->arg_offset))
+    argv[i++] = cfg.bridge0.devsandbox;
+  if (*(uint8_t *) ((char *) &cfg.bridge1 + client->arg_offset))
+    argv[i++] = cfg.bridge1.devsandbox;
+  if (*(uint8_t *) ((char *) &cfg.bridge2 + client->arg_offset))
+    argv[i++] = cfg.bridge2.devsandbox;
+  if (*(uint8_t *) ((char *) &cfg.bridge3 + client->arg_offset))
+    argv[i++] = cfg.bridge3.devsandbox;
+
+  sbox_run_v(SBOX_ROOT | SBOX_CAPS_NETWORK | SBOX_CAPS_NET_SERVICE | SBOX_SECCOMP, argv);
+}
+
+static pid_t dhcp_read_pidfile(const Dhclient *client) {
+  // We have to run dhclient as a forking daemon (not pass the -d option),
+  // because we want to be notified of a successful DHCP lease by the parent process exit.
+  // However, try to be extra paranoid with race conditions,
+  // because dhclient only writes the daemon pid into the pidfile
+  // after its parent process has exited.
+  int tries = 0;
+  pid_t found = 0;
+  while (found == 0 && tries < 10) {
+    if (tries >= 1)
+      usleep(100000);
+    FILE *pidfile = fopen(client->pid_file, "r");
+    if (pidfile) {
+      long pid;
+      if (fscanf(pidfile, "%ld", &pid) == 1) {
+        char *pidname = pid_proc_comm((pid_t) pid);
+        if (pidname && strcmp(pidname, "dhclient") == 0)
+          found = (pid_t) pid;
+      }
+      fclose(pidfile);
+    }
+    ++tries;
+  }
+  if (found == 0) {
+    fprintf(stderr, "Error: Cannot get dhclient %s PID from %s\n",
+            client->version_arg, client->pid_file);
+    exit(1);
+  }
+  return found;
+}
+
+static void dhcp_start_dhclient(const Dhclient *client) {
+  dhcp_run_dhclient(client);
+  *(client->pid) = dhcp_read_pidfile(client);
+}
+
+void dhcp_start(void) {
+  if (!any_dhcp())
+    return;
+
+  EUID_ROOT();
+  if (mkdir(RUN_DHCLIENT_DIR, 0700))
+    errExit("mkdir");
+
+  if (any_ip_dhcp()) {
+    dhcp_start_dhclient(&dhclient4);
+    if (arg_debug)
+      printf("Running dhclient -4 in the background as pid %ld\n", (long) dhclient4_pid);
+  }
+  if (any_ip6_dhcp()) {
+    dhcp_start_dhclient(&dhclient6);
+    if (arg_debug)
+      printf("Running dhclient -6 in the background as pid %ld\n", (long) dhclient6_pid);
+    if (dhclient4_pid == dhclient6_pid) {
+      fprintf(stderr, "Error: dhclient -4 and -6 have the same PID: %ld\n", (long) dhclient4_pid);
+      exit(1);
+    }
+  }
+}