iptables 1.8.8 fails with error code 111 but iptables 1.8.7 succeeds with same script

iptables 1.8.8 fails with error code 111 but iptables 1.8.7 succeeds with same script

[Amish]

Hello,

I use Arch Linux. Apache 2.4.54 and iptables 1.8.8 (nft based).

I have a setuid script, given below, which runs via apache httpd and 
simply calls "iptables -w -nvL INPUT" and gives the output.

But with iptables 1.8.8 it fails with error code 111 (undocumented code)

 > curl http://127.0.0.1/ipt.e
EUID = 0, EGID=33
iptables exited with exit code=111
iptables exited with exit code=111


It doesn't even print any error message. (not even to httpd error log - 
via stderr)

But if I downgrade to iptables 1.8.7, it works as expected.

 > curl http://127.0.0.1/ipt.e
EUID = 0, EGID=33
iptables v1.8.7 (nf_tables)
iptables exited with exit code=0
Chain INPUT (policy DROP 290 packets, 27644 bytes)
  pkts bytes target     prot opt in     out source               
destination
<output cut>
iptables exited with exit code=0


So it appears to be some kind of bug introduced in 1.8.8.

Can someone guide / check?

The C script follows: (Can be used for testing)

 > cat ipt.c
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/wait.h>

extern char **environ;

pid_t my_wait(int *status, pid_t pid, int options)
{
     pid_t got_pid;
     while ((got_pid = waitpid(pid, status, options)) == (pid_t)-1) {
         if (errno != EINTR) return -1;
         errno = 0;
     }
     return got_pid;
}

int my_system(const char *program, char *const argv[])
{
     pid_t pid = fork();
     if (pid==(pid_t)-1) return -1;
     if (!pid) { execve(program, argv, environ); exit(127); }

     int status = -1;
     return ((my_wait(&status, pid, 0) == (pid_t)-1) ? -1 : status);
}

int main(int argc, char **main_argv)
{
     printf ("Content-type: text/plain\n\n");
     printf ("EUID = %d, EGID=%d\n", geteuid(), getegid());
     fflush (stdout);

     int i = 0;
     static char *argv[10];
     argv[i++] = (char *) "iptables";
     argv[i++] = (char *) "-w";
     argv[i++] = (char *) "--version";
     argv[i++] = NULL;
     int wstatus = my_system ("/usr/bin/iptables", argv);
     fflush (stdout);
     if (WIFEXITED(wstatus)) printf("iptables exited with exit 
code=%d\n", WEXITSTATUS(wstatus));
     else printf("something went wrong in calling iptables\n");
     fflush (stdout);

     i = 2;
     argv[i++] = (char *) "-nvL";
     argv[i++] = (char *) "INPUT";
     argv[i++] = NULL;
     wstatus = my_system ("/usr/bin/iptables", argv);
     fflush (stdout);
     if (WIFEXITED(wstatus)) printf("iptables exited with exit 
code=%d\n", WEXITSTATUS(wstatus));
     else printf("something went wrong in calling iptables\n");
     fflush (stdout);

     return 0;
}

# compiling and setting setuid bit
 > cc ipt.c
 > mv a.out /srv/http/ipt.e
 > chown root:http /srv/http/ipt.e
 > chmod 750 /srv/http/ipt.e
 > chmod u+s /srv/http/ipt.e

Re: iptables 1.8.8 fails with error code 111 but iptables 1.8.7 succeeds with same script

[Jeremy Sowden]

[-- Attachment #1: Type: text/plain, Size: 835 bytes --]

On 2022-06-17, at 20:02:13 +0530, Amish wrote:
> I use Arch Linux. Apache 2.4.54 and iptables 1.8.8 (nft based).
>
> I have a setuid script, given below, which runs via apache httpd and
> simply calls "iptables -w -nvL INPUT" and gives the output.
>
> But with iptables 1.8.8 it fails with error code 111 (undocumented
> code)
>
> > curl http://127.0.0.1/ipt.e
> EUID = 0, EGID=33
> iptables exited with exit code=111
> iptables exited with exit code=111
>
> It doesn't even print any error message. (not even to httpd error log
> - via stderr)

It is no longer possible to run iptables under seteuid, since it is not
possible to do so safely.  From 1.8.8, iptables checks whether the UID
matches the EUID and exits with 111 if they differ:

  https://git.netfilter.org/iptables/commit/?id=ef7781eb1437a2d6fd37eb3567c599e3ea682b96

J.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: iptables 1.8.8 fails with error code 111 but iptables 1.8.7 succeeds with same script

[Florian Westphal]

Amish <anon.amish@gmail.com> wrote:
> I use Arch Linux. Apache 2.4.54 and iptables 1.8.8 (nft based).
> 
> I have a setuid script, given below, which runs via apache httpd and simply
> calls "iptables -w -nvL INPUT" and gives the output.
> 
> But with iptables 1.8.8 it fails with error code 111 (undocumented code)
> 
> > curl http://127.0.0.1/ipt.e
> EUID = 0, EGID=33
> iptables exited with exit code=111
> iptables exited with exit code=111

I plan to add this to the manual page:

iptables will exit immediately with an error code of 111 if it finds
that it was called as a setuid-to-root program.
iptables cannot be used safely in this manner because it trusts
the shared libraries (matches, targets) loaded at run time, the search
path can be set using environment variables.

> So it appears to be some kind of bug introduced in 1.8.8.

Its intentional.

> The C script follows: (Can be used for testing)
> int my_system(const char *program, char *const argv[])
> {
>     pid_t pid = fork();
>     if (pid==(pid_t)-1) return -1;
>     if (!pid) { execve(program, argv, environ); exit(127); }

iptables evaluates some environment variables and trusts that info.
If you absolutely have to do this, re-set environ so that someone
else calling this wrapper can't use it to load their own
modules/targets.

Then add a 'setuid(0)' before execve.

Re: iptables 1.8.8 fails with error code 111 but iptables 1.8.7 succeeds with same script

[Amish]

On 17/06/22 20:39, Florian Westphal wrote:
> Amish <anon.amish@gmail.com> wrote:
>> I use Arch Linux. Apache 2.4.54 and iptables 1.8.8 (nft based).
>>
>> I have a setuid script, given below, which runs via apache httpd and simply
>> calls "iptables -w -nvL INPUT" and gives the output.
>>
>> But with iptables 1.8.8 it fails with error code 111 (undocumented code)
>>
>>> curl http://127.0.0.1/ipt.e
>> EUID = 0, EGID=33
>> iptables exited with exit code=111
>> iptables exited with exit code=111
>
>> The C script follows: (Can be used for testing)
>> int my_system(const char *program, char *const argv[])
>> {
>>      pid_t pid = fork();
>>      if (pid==(pid_t)-1) return -1;
>>      if (!pid) { execve(program, argv, environ); exit(127); }
> iptables evaluates some environment variables and trusts that info.
> If you absolutely have to do this, re-set environ so that someone
> else calling this wrapper can't use it to load their own
> modules/targets.
>
> Then add a 'setuid(0)' before execve.

Great thank you very much for your clarification.

For those who use setuid scripts, here is what I did:

For safety I added this in main() function:

unsetenv("XTABLES_LIBDIR");
unsetenv("IPTABLES_LIB_DIR");
unsetenv("IP6TABLES_LIB_DIR");

And just before execve() I added:
setuid(geteuid());

Hope it helps.

Thanks and regards,

Amish