/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
21 by Teddy Hogeborn
* Makefile (CFLAGS): Changed to use $(WARN), $(DEBUG), $(COVERAGE) and
1
/*  -*- coding: utf-8 -*- */
2
/*
3
 * Mandos plugin runner - Run Mandos plugins
4
 *
5
 * Copyright © 2007-2008 Teddy Hogeborn and Björn Påhlsson.
6
 * 
7
 * This program is free software: you can redistribute it and/or
8
 * modify it under the terms of the GNU General Public License as
9
 * published by the Free Software Foundation, either version 3 of the
10
 * License, or (at your option) any later version.
11
 * 
12
 * This program is distributed in the hope that it will be useful, but
13
 * WITHOUT ANY WARRANTY; without even the implied warranty of
14
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15
 * General Public License for more details.
16
 * 
17
 * You should have received a copy of the GNU General Public License
18
 * along with this program.  If not, see
19
 * <http://www.gnu.org/licenses/>.
20
 * 
21
 * Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
22
 * <https://www.fukt.bsnet.se/~teddy/>.
23
 */
24
25
#define _FORTIFY_SOURCE 2
26
13 by Björn Påhlsson
Added following support:
27
#include <stdio.h>	/* popen, fileno */
28
#include <iso646.h>	/* and, or, not */
29
#include <sys/types.h>	/* DIR, opendir, stat, struct stat, waitpid,
30
			   WIFEXITED, WEXITSTATUS, wait */
31
#include <sys/wait.h>	/* wait */
32
#include <dirent.h>	/* DIR, opendir */
33
#include <sys/stat.h>	/* stat, struct stat */
34
#include <unistd.h>	/* stat, struct stat, chdir */
35
#include <stdlib.h>	/* EXIT_FAILURE */
21 by Teddy Hogeborn
* Makefile (CFLAGS): Changed to use $(WARN), $(DEBUG), $(COVERAGE) and
36
#include <sys/select.h>	/* fd_set, select, FD_ZERO, FD_SET,
37
			   FD_ISSET */
13 by Björn Påhlsson
Added following support:
38
#include <string.h>	/* strlen, strcpy, strcat */
39
#include <stdbool.h>	/* true */
40
#include <sys/wait.h>	/* waitpid, WIFEXITED, WEXITSTATUS */
41
#include <errno.h>	/* errno */
24.1.1 by Björn Påhlsson
Added syntax and support for plugbasedclient arguments and how they
42
#include <argp.h>	/* argp */
13 by Björn Påhlsson
Added following support:
43
44
struct process;
45
46
typedef struct process{
47
  pid_t pid;
48
  int fd;
49
  char *buffer;
21 by Teddy Hogeborn
* Makefile (CFLAGS): Changed to use $(WARN), $(DEBUG), $(COVERAGE) and
50
  size_t buffer_size;
51
  size_t buffer_length;
13 by Björn Påhlsson
Added following support:
52
  struct process *next;
53
} process;
54
24.1.1 by Björn Påhlsson
Added syntax and support for plugbasedclient arguments and how they
55
typedef struct plugin{
56
  char *name; 		/* can be "global" and any plugin name */
57
  char **argv;
58
  int argc;
24.1.5 by Björn Påhlsson
plugbasedclient:
59
  bool disable;
24.1.1 by Björn Påhlsson
Added syntax and support for plugbasedclient arguments and how they
60
  struct plugin *next;
61
} plugin;
62
63
plugin *getplugin(char *name, plugin **plugin_list){
64
  for (plugin *p = *plugin_list; p != NULL; p = p->next){
65
    if ((p->name == name)
66
	or (p->name and name and (strcmp(p->name, name) == 0))){
67
      return p;
68
    }
69
  }
70
  /* Create a new plugin */
71
  plugin *new_plugin = malloc(sizeof(plugin));
72
  if (new_plugin == NULL){
73
    perror("malloc");
74
    exit(EXIT_FAILURE);
75
  }
76
  new_plugin->name = name;
77
  new_plugin->argv = malloc(sizeof(char *) * 2);
78
  if (new_plugin->argv == NULL){
79
    perror("malloc");
80
    exit(EXIT_FAILURE);
81
  }
82
  new_plugin->argv[0] = name;
83
  new_plugin->argv[1] = NULL;
84
  new_plugin->argc = 1;
24.1.5 by Björn Påhlsson
plugbasedclient:
85
  new_plugin->disable = false;
86
  new_plugin->next = *plugin_list;
24.1.1 by Björn Påhlsson
Added syntax and support for plugbasedclient arguments and how they
87
  /* Append the new plugin to the list */
88
  *plugin_list = new_plugin;
89
  return new_plugin;
90
}
91
92
void addarguments(plugin *p, char *arg){
93
  p->argv[p->argc] = arg;
94
  p->argv = realloc(p->argv, sizeof(char *) * (size_t)(p->argc + 2));
95
  if (p->argv == NULL){
96
    perror("malloc");
97
    exit(EXIT_FAILURE);
98
  }
99
  p->argc++;
100
  p->argv[p->argc] = NULL;
101
}
102
	
13 by Björn Påhlsson
Added following support:
103
#define BUFFER_SIZE 256
104
24.1.1 by Björn Påhlsson
Added syntax and support for plugbasedclient arguments and how they
105
const char *argp_program_version =
106
  "plugbasedclient 0.9";
107
const char *argp_program_bug_address =
108
  "<mandos@fukt.bsnet.se>";
109
static char doc[] =
110
  "Mandos plugin runner -- Run Mandos plugins";
111
/* A description of the arguments we accept. */
112
static char args_doc[] = "";
113
13 by Björn Påhlsson
Added following support:
114
int main(int argc, char *argv[]){
24.1.5 by Björn Påhlsson
plugbasedclient:
115
  const char *plugindir = "plugins.d";
116
  size_t d_name_len;
13 by Björn Påhlsson
Added following support:
117
  DIR *dir;
118
  struct dirent *dirst;
119
  struct stat st;
120
  fd_set rfds_orig;
121
  int ret, maxfd = 0;
122
  process *process_list = NULL;
24.1.6 by Björn Påhlsson
plugbasedclient
123
  uid_t uid = 65534;
124
  gid_t gid = 65534;
24.1.1 by Björn Påhlsson
Added syntax and support for plugbasedclient arguments and how they
125
  /* The options we understand. */
126
  struct argp_option options[] = {
127
    { .name = "global-options", .key = 'g',
128
      .arg = "option[,option[,...]]", .flags = 0,
129
      .doc = "Options effecting all plugins" },
130
    { .name = "options-for", .key = 'o',
131
      .arg = "plugin:option[,option[,...]]", .flags = 0,
132
      .doc = "Options effecting only specified plugins" },
24.1.5 by Björn Påhlsson
plugbasedclient:
133
    { .name = "disable-plugin", .key = 'd',
134
      .arg = "Plugin[,Plugin[,...]]", .flags = 0,
135
      .doc = "Option to disable specififed plugins" },
136
    { .name = "plugin-dir", .key = 128,
137
      .arg = "Directory", .flags = 0,
138
      .doc = "Option to change directory to search for plugins" },
24.1.6 by Björn Påhlsson
plugbasedclient
139
    { .name = "userid", .key = 129,
140
      .arg = "Id", .flags = 0,
141
      .doc = "Option to change which user id the plugins will run as" },
142
    { .name = "groupid", .key = 130,
143
      .arg = "Id", .flags = 0,
144
      .doc = "Option to change which group id the plugins will run as" },
24.1.1 by Björn Påhlsson
Added syntax and support for plugbasedclient arguments and how they
145
    { .name = NULL }
146
  };
147
  
148
  error_t parse_opt (int key, char *arg, struct argp_state *state) {
149
       /* Get the INPUT argument from `argp_parse', which we
150
          know is a pointer to our arguments structure. */
151
    plugin **plugins = state->input;
152
    switch (key) {
153
    case 'g':
154
      if (arg != NULL){
155
	char *p = strtok(arg, ",");
156
	do{
157
	  addarguments(getplugin(NULL, plugins), p);
158
	  p = strtok(NULL, ",");
159
	} while (p);
160
      }
161
      break;
162
    case 'o':
163
      if (arg != NULL){
164
	char *name = strtok(arg, ":");
165
	char *p = strtok(NULL, ":");
166
	p = strtok(p, ",");
167
	do{
168
	  addarguments(getplugin(name, plugins), p);
169
	  p = strtok(NULL, ",");
170
	} while (p);
171
      }
172
      break;
24.1.5 by Björn Påhlsson
plugbasedclient:
173
    case 'd':
174
      if (arg != NULL){
175
	char *p = strtok(arg, ",");
176
	do{
177
	  getplugin(p, plugins)->disable = true;
178
	  p = strtok(NULL, ",");
179
	} while (p);
180
      }
181
      break;
182
    case 128:
183
      plugindir = arg;
184
      break;
24.1.6 by Björn Påhlsson
plugbasedclient
185
    case 129:
186
      uid = (uid_t)strtol(arg, NULL, 10);
187
      break;
188
    case 130:
189
      gid = (gid_t)strtol(arg, NULL, 10);
190
      break;
24.1.1 by Björn Påhlsson
Added syntax and support for plugbasedclient arguments and how they
191
    case ARGP_KEY_ARG:
192
      argp_usage (state);
193
      break;
194
    case ARGP_KEY_END:
195
      break;
196
    default:
197
      return ARGP_ERR_UNKNOWN;
198
    }
199
    return 0;
200
  }
201
202
  plugin *plugin_list = NULL;
203
  
204
  struct argp argp = { .options = options, .parser = parse_opt,
205
		       .args_doc = args_doc, .doc = doc };
206
207
  argp_parse (&argp, argc, argv, 0, 0, &plugin_list);
208
209
/*   for(plugin *p = plugin_list; p != NULL; p=p->next){ */
210
/*     fprintf(stderr, "Plugin: %s has %d arguments\n", p->name ? p->name : "Global", p->argc); */
211
/*     for(char **a = p->argv + 1; *a != NULL; a++){ */
212
/*       fprintf(stderr, "\tArg: %s\n", *a); */
213
/*     } */
214
/*   } */
215
  
216
/*   return 0; */
24.1.5 by Björn Påhlsson
plugbasedclient:
217
24.1.6 by Björn Påhlsson
plugbasedclient
218
  ret = setuid(uid);
219
  if (ret == -1){
220
    perror("setuid");
221
  }
222
223
  setgid(gid);
224
  if (ret == -1){
225
    perror("setuid");
226
  }
227
  
13 by Björn Påhlsson
Added following support:
228
  dir = opendir(plugindir);
24.1.1 by Björn Påhlsson
Added syntax and support for plugbasedclient arguments and how they
229
  
13 by Björn Påhlsson
Added following support:
230
  if(dir == NULL){
231
    fprintf(stderr, "Can not open directory\n");
232
    return EXIT_FAILURE;
233
  }
234
  
235
  FD_ZERO(&rfds_orig);
236
  
237
  while(true){
238
    dirst = readdir(dir);
239
    
240
    // All directory entries have been processed
241
    if(dirst == NULL){
242
      break;
243
    }
244
    
245
    d_name_len = strlen(dirst->d_name);
246
    
247
    // Ignore dotfiles and backup files
248
    if (dirst->d_name[0] == '.'
249
	or dirst->d_name[d_name_len - 1] == '~'){
250
      continue;
251
    }
14 by Björn Påhlsson
Fixed a overbufferflow bug, thanks to a forgotten \0
252
24.1.5 by Björn Påhlsson
plugbasedclient:
253
    char *filename = malloc(d_name_len + strlen(plugindir) + 2);
13 by Björn Påhlsson
Added following support:
254
    strcpy(filename, plugindir);
255
    strcat(filename, "/");
256
    strcat(filename, dirst->d_name);    
14 by Björn Påhlsson
Fixed a overbufferflow bug, thanks to a forgotten \0
257
13 by Björn Påhlsson
Added following support:
258
    stat(filename, &st);
259
24.1.5 by Björn Påhlsson
plugbasedclient:
260
    if (S_ISREG(st.st_mode)
261
	and (access(filename, X_OK) == 0)
262
	and not (getplugin(dirst->d_name, &plugin_list)->disable)){
13 by Björn Påhlsson
Added following support:
263
      // Starting a new process to be watched
264
      process *new_process = malloc(sizeof(process));
24.1.5 by Björn Påhlsson
plugbasedclient:
265
      int pipefd[2]; 
24.1.1 by Björn Påhlsson
Added syntax and support for plugbasedclient arguments and how they
266
      ret = pipe(pipefd);
267
      if (ret == -1){
268
	perror(argv[0]);
269
	goto end;
270
      }
13 by Björn Påhlsson
Added following support:
271
      new_process->pid = fork();
272
      if(new_process->pid == 0){
273
	/* this is the child process */
274
	closedir(dir);
275
	close(pipefd[0]);	/* close unused read end of pipe */
276
	dup2(pipefd[1], STDOUT_FILENO); /* replace our stdout */
24.1.1 by Björn Påhlsson
Added syntax and support for plugbasedclient arguments and how they
277
24.1.5 by Björn Påhlsson
plugbasedclient:
278
	plugin *p = getplugin(dirst->d_name, &plugin_list);
24.1.1 by Björn Påhlsson
Added syntax and support for plugbasedclient arguments and how they
279
	plugin *g = getplugin(NULL, &plugin_list);
280
	for(char **a = g->argv + 1; *a != NULL; a++){
281
	  addarguments(p, *a);
282
	}
283
	if(execv(filename, p->argv) < 0){
13 by Björn Påhlsson
Added following support:
284
	  perror(argv[0]);
285
	  close(pipefd[1]);
286
	  exit(EXIT_FAILURE);
287
	}
288
	/* no return */
289
      }
290
      close(pipefd[1]);		/* close unused write end of pipe */
291
      new_process->fd = pipefd[0];
292
      new_process->buffer = malloc(BUFFER_SIZE);
293
      if (new_process->buffer == NULL){
294
	perror(argv[0]);
295
	goto end;
296
      }
297
      new_process->buffer_size = BUFFER_SIZE;
298
      new_process->buffer_length = 0;
299
      FD_SET(new_process->fd, &rfds_orig);
300
      
301
      if (maxfd < new_process->fd){
302
	maxfd = new_process->fd;
303
      }
304
      
305
      //List handling
306
      new_process->next = process_list;
307
      process_list = new_process;
308
    }
309
  }
310
  
311
  closedir(dir);
312
  
313
  if (process_list != NULL){
314
    while(true){
315
      fd_set rfds = rfds_orig;
316
      int select_ret = select(maxfd+1, &rfds, NULL, NULL, NULL);
317
      if (select_ret == -1){
318
	perror(argv[0]);
319
	goto end;
320
      }else{	
321
	for(process *process_itr = process_list; process_itr != NULL;
322
	    process_itr = process_itr->next){
323
	  if(FD_ISSET(process_itr->fd, &rfds)){
324
	    if(process_itr->buffer_length + BUFFER_SIZE
325
	       > process_itr->buffer_size){
326
		process_itr->buffer = realloc(process_itr->buffer,
327
					      process_itr->buffer_size
21 by Teddy Hogeborn
* Makefile (CFLAGS): Changed to use $(WARN), $(DEBUG), $(COVERAGE) and
328
					      + (size_t) BUFFER_SIZE);
13 by Björn Påhlsson
Added following support:
329
		if (process_itr->buffer == NULL){
330
		  perror(argv[0]);
331
		  goto end;
332
		}
333
		process_itr->buffer_size += BUFFER_SIZE;
334
	    }
335
	    ret = read(process_itr->fd, process_itr->buffer
336
		       + process_itr->buffer_length, BUFFER_SIZE);
21 by Teddy Hogeborn
* Makefile (CFLAGS): Changed to use $(WARN), $(DEBUG), $(COVERAGE) and
337
	    if(ret < 0){
338
	      /* Read error from this process; ignore it */
339
	      continue;
340
	    }
341
	    process_itr->buffer_length += (size_t) ret;
13 by Björn Påhlsson
Added following support:
342
	    if(ret == 0){
343
	      /* got EOF */
344
	      /* wait for process exit */
345
	      int status;
346
	      waitpid(process_itr->pid, &status, 0);
347
	      if(WIFEXITED(status) and WEXITSTATUS(status) == 0){
24.1.1 by Björn Påhlsson
Added syntax and support for plugbasedclient arguments and how they
348
		for(size_t written = 0;
349
		    written < process_itr->buffer_length;){
350
		  ret = write(STDOUT_FILENO,
351
			      process_itr->buffer + written,
352
			      process_itr->buffer_length - written);
353
		  if(ret < 0){
354
		    perror(argv[0]);
355
		    goto end;
356
		  }
357
		  written += (size_t)ret;
358
		}
13 by Björn Påhlsson
Added following support:
359
		goto end;
360
	      } else {
361
		FD_CLR(process_itr->fd, &rfds_orig);
362
	      }
363
	    }
364
	  }
365
	}
366
      }
367
    }
368
  }
369
  
370
 end:
371
  for(process *process_itr = process_list; process_itr != NULL;
372
      process_itr = process_itr->next){
373
    close(process_itr->fd);
374
    kill(process_itr->pid, SIGTERM);
375
    free(process_itr->buffer);
376
  }
377
  
378
  while(true){
379
    int status;
380
    ret = wait(&status);
381
    if (ret == -1){
382
      if(errno != ECHILD){
383
	perror("wait");
384
      }
385
      break;
386
    }
387
  }  
388
  return EXIT_SUCCESS;
389
}