82
92
volatile bool completed;
83
93
volatile int status;
87
typedef struct plugin{
88
char *name; /* can be NULL or any plugin name */
94
94
struct plugin *next;
97
static plugin *getplugin(char *name, plugin **plugin_list){
98
for (plugin *p = *plugin_list; p != NULL; p = p->next){
97
static plugin *plugin_list = NULL;
99
/* Gets an existing plugin based on name,
100
or if none is found, creates a new one */
101
static plugin *getplugin(char *name){
102
/* Check for exiting plugin with that name */
103
for (plugin *p = plugin_list; p != NULL; p = p->next){
99
104
if ((p->name == name)
100
105
or (p->name and name and (strcmp(p->name, name) == 0))){
176
181
/* Add to a plugin's environment */
177
static bool add_environment(plugin *p, const char *def){
182
static bool add_environment(plugin *p, const char *def, bool replace){
186
/* namelen = length of name of environment variable */
187
size_t namelen = (size_t)(strchrnul(def, '=') - def);
188
/* Search for this environment variable */
189
for(char **e = p->environ; *e != NULL; e++){
190
if(strncmp(*e, def, namelen + 1) == 0){
191
/* It already exists */
193
char *new = realloc(*e, strlen(def) + 1);
181
203
return add_to_char_array(def, &(p->environ), &(p->envc));
186
207
* Based on the example in the GNU LibC manual chapter 13.13 "File
187
208
* Descriptor Flags".
250
char **add_to_argv(char **argv, int *argc, char *arg){
253
argv = malloc(sizeof(char*) * 2);
271
/* Removes and free a plugin from the plugin list */
272
static void free_plugin(plugin *plugin_node){
274
for(char **arg = plugin_node->argv; *arg != NULL; arg++){
277
free(plugin_node->argv);
278
for(char **env = plugin_node->environ; *env != NULL; env++){
281
free(plugin_node->environ);
282
free(plugin_node->buffer);
284
/* Removes the plugin from the singly-linked list */
285
if(plugin_node == plugin_list){
286
/* First one - simple */
287
plugin_list = plugin_list->next;
289
/* Second one or later */
290
for(plugin *p = plugin_list; p != NULL; p = p->next){
291
if(p->next == plugin_node){
292
p->next = plugin_node->next;
257
argv[0] = NULL; /* Will be set to argv[0] in main before parsing */
261
argv = realloc(argv, sizeof(char *)
262
* ((unsigned int) *argc + 1));
271
static void free_plugin_list(plugin *plugin_list){
272
for(plugin *next; plugin_list != NULL; plugin_list = next){
273
next = plugin_list->next;
274
for(char **arg = plugin_list->argv; *arg != NULL; arg++){
277
free(plugin_list->argv);
278
for(char **env = plugin_list->environ; *env != NULL; env++){
281
free(plugin_list->environ);
301
static void free_plugin_list(void){
302
while(plugin_list != NULL){
303
free_plugin(plugin_list);
286
307
int main(int argc, char *argv[]){
287
const char *plugindir = "/lib/mandos/plugins.d";
288
const char *argfile = ARGFILE;
308
char *plugindir = NULL;
309
char *argfile = NULL;
290
311
size_t d_name_len;
323
344
{ .name = "global-options", .key = 'g',
324
345
.arg = "OPTION[,OPTION[,...]]",
325
346
.doc = "Options passed to all plugins" },
326
{ .name = "global-envs", .key = 'e',
347
{ .name = "global-env", .key = 'G',
327
348
.arg = "VAR=value",
328
349
.doc = "Environment variable passed to all plugins" },
329
350
{ .name = "options-for", .key = 'o',
330
351
.arg = "PLUGIN:OPTION[,OPTION[,...]]",
331
352
.doc = "Options passed only to specified plugin" },
332
{ .name = "envs-for", .key = 'f',
353
{ .name = "env-for", .key = 'E',
333
354
.arg = "PLUGIN:ENV=value",
334
355
.doc = "Environment variable passed to specified plugin" },
335
356
{ .name = "disable", .key = 'd',
337
358
.doc = "Disable a specific plugin", .group = 1 },
359
{ .name = "enable", .key = 'e',
361
.doc = "Enable a specific plugin", .group = 1 },
338
362
{ .name = "plugin-dir", .key = 128,
339
363
.arg = "DIRECTORY",
340
364
.doc = "Specify a different plugin directory", .group = 2 },
341
{ .name = "userid", .key = 129,
342
.arg = "ID", .flags = 0,
343
.doc = "User ID the plugins will run as", .group = 2 },
344
{ .name = "groupid", .key = 130,
345
.arg = "ID", .flags = 0,
346
.doc = "Group ID the plugins will run as", .group = 2 },
347
{ .name = "debug", .key = 131,
348
.doc = "Debug mode", .group = 3 },
365
{ .name = "config-file", .key = 129,
367
.doc = "Specify a different configuration file", .group = 2 },
368
{ .name = "userid", .key = 130,
369
.arg = "ID", .flags = 0,
370
.doc = "User ID the plugins will run as", .group = 3 },
371
{ .name = "groupid", .key = 131,
372
.arg = "ID", .flags = 0,
373
.doc = "Group ID the plugins will run as", .group = 3 },
374
{ .name = "debug", .key = 132,
375
.doc = "Debug mode", .group = 4 },
352
error_t parse_opt (int key, char *arg, struct argp_state *state) {
353
/* Get the INPUT argument from `argp_parse', which we know is a
354
pointer to our plugin list pointer. */
355
plugin **plugins = state->input;
379
error_t parse_opt (int key, char *arg, __attribute__((unused))
380
struct argp_state *state) {
382
case 'g': /* --global-options */
358
383
if (arg != NULL){
360
385
while((p = strsep(&arg, ",")) != NULL){
361
386
if(p[0] == '\0'){
364
if(not add_argument(getplugin(NULL, plugins), p)){
389
if(not add_argument(getplugin(NULL), p)){
365
390
perror("add_argument");
366
391
return ARGP_ERR_UNKNOWN;
396
case 'G': /* --global-env */
377
402
if(envdef == NULL){
380
if(not add_environment(getplugin(NULL, plugins), envdef)){
405
if(not add_environment(getplugin(NULL), envdef, true)){
381
406
perror("add_environment");
410
case 'o': /* --options-for */
386
411
if (arg != NULL){
387
412
char *p_name = strsep(&arg, ":");
388
if(p_name[0] == '\0'){
413
if(p_name[0] == '\0' or arg == NULL){
391
416
char *opt = strsep(&arg, ":");
417
if(opt[0] == '\0' or opt == NULL){
397
while((p = strsep(&opt, ",")) != NULL){
401
if(not add_argument(getplugin(p_name, plugins), p)){
402
perror("add_argument");
403
return ARGP_ERR_UNKNOWN;
421
while((p = strsep(&opt, ",")) != NULL){
425
if(not add_argument(getplugin(p_name), p)){
426
perror("add_argument");
427
return ARGP_ERR_UNKNOWN;
432
case 'E': /* --env-for */
423
if(not add_environment(getplugin(p_name, plugins), envdef)){
446
if(not add_environment(getplugin(p_name), envdef, true)){
424
447
perror("add_environment");
451
case 'd': /* --disable */
429
452
if (arg != NULL){
430
plugin *p = getplugin(arg, plugins);
453
plugin *p = getplugin(arg);
432
455
return ARGP_ERR_UNKNOWN;
434
457
p->disabled = true;
460
case 'e': /* --enable */
462
plugin *p = getplugin(arg);
464
return ARGP_ERR_UNKNOWN;
469
case 128: /* --plugin-dir */
470
plugindir = strdup(arg);
471
if(plugindir == NULL){
475
case 129: /* --config-file */
476
/* This is already done by parse_opt_config_file() */
478
case 130: /* --userid */
441
479
uid = (uid_t)strtol(arg, NULL, 10);
481
case 131: /* --groupid */
444
482
gid = (gid_t)strtol(arg, NULL, 10);
484
case 132: /* --debug */
449
487
case ARGP_KEY_ARG:
460
plugin *plugin_list = NULL;
498
/* This option parser is the same as parse_opt() above, except it
499
ignores everything but the --config-file option. */
500
error_t parse_opt_config_file (int key, char *arg,
501
__attribute__((unused))
502
struct argp_state *state) {
504
case 'g': /* --global-options */
505
case 'G': /* --global-env */
506
case 'o': /* --options-for */
507
case 'E': /* --env-for */
508
case 'd': /* --disable */
509
case 'e': /* --enable */
510
case 128: /* --plugin-dir */
512
case 129: /* --config-file */
513
argfile = strdup(arg);
518
case 130: /* --userid */
519
case 131: /* --groupid */
520
case 132: /* --debug */
525
return ARGP_ERR_UNKNOWN;
462
struct argp argp = { .options = options, .parser = parse_opt,
463
.args_doc = "[+PLUS_SEPARATED_OPTIONS]",
530
struct argp argp = { .options = options,
531
.parser = parse_opt_config_file,
464
533
.doc = "Mandos plugin runner -- Run plugins" };
466
ret = argp_parse (&argp, argc, argv, 0, 0, &plugin_list);
535
/* Parse using the parse_opt_config_file in order to get the custom
536
config file location, if any. */
537
ret = argp_parse (&argp, argc, argv, ARGP_IN_ORDER, 0, NULL);
467
538
if (ret == ARGP_ERR_UNKNOWN){
468
539
fprintf(stderr, "Unknown error while parsing arguments\n");
469
540
exitstatus = EXIT_FAILURE;
473
conffp = fopen(argfile, "r");
544
/* Reset to the normal argument parser */
545
argp.parser = parse_opt;
547
/* Open the configfile if available */
548
if (argfile == NULL){
549
conffp = fopen(AFILE, "r");
551
conffp = fopen(argfile, "r");
474
553
if(conffp != NULL){
475
554
char *org_line = NULL;
476
555
char *p, *arg, *new_arg, *line;
494
585
new_arg = strdup(p);
495
custom_argv = add_to_argv(custom_argv, &custom_argc, new_arg);
496
if (custom_argv == NULL){
497
perror("add_to_argv");
498
exitstatus = EXIT_FAILURE;
588
exitstatus = EXIT_FAILURE;
594
custom_argv = realloc(custom_argv, sizeof(char *)
595
* ((unsigned int) custom_argc + 1));
596
if(custom_argv == NULL){
598
exitstatus = EXIT_FAILURE;
602
custom_argv[custom_argc-1] = new_arg;
603
custom_argv[custom_argc] = NULL;
505
608
/* Check for harmful errors and go to fallback. Other errors might
506
609
not affect opening plugins */
507
610
if (errno == EMFILE or errno == ENFILE or errno == ENOMEM){
616
/* If there was any arguments from configuration file,
617
pass them to parser as command arguments */
514
618
if(custom_argv != NULL){
515
custom_argv[0] = argv[0];
516
ret = argp_parse (&argp, custom_argc, custom_argv, 0, 0, &plugin_list);
619
ret = argp_parse (&argp, custom_argc, custom_argv, ARGP_IN_ORDER,
517
621
if (ret == ARGP_ERR_UNKNOWN){
518
622
fprintf(stderr, "Unknown error while parsing arguments\n");
519
623
exitstatus = EXIT_FAILURE;
885
close(pipefd[1]); /* Close unused write end of pipe */
771
close(pipefd[1]); /* close unused write end of pipe */
772
process *new_process = malloc(sizeof(process));
773
if (new_process == NULL){
887
plugin *new_plugin = getplugin(dirst->d_name);
888
if (new_plugin == NULL){
775
890
ret = sigprocmask (SIG_UNBLOCK, &sigchld_action.sa_mask, NULL);
777
perror("sigprocmask");
892
perror("sigprocmask");
779
894
exitstatus = EXIT_FAILURE;
783
*new_process = (struct process){ .pid = pid,
785
.next = process_list };
787
process_list = new_process;
898
new_plugin->pid = pid;
899
new_plugin->fd = pipefd[0];
788
901
/* Unblock SIGCHLD so signal handler can be run if this process
789
902
has already completed */
790
903
ret = sigprocmask (SIG_UNBLOCK, &sigchld_action.sa_mask, NULL);
797
FD_SET(new_process->fd, &rfds_all);
910
FD_SET(new_plugin->fd, &rfds_all);
799
if (maxfd < new_process->fd){
800
maxfd = new_process->fd;
912
if (maxfd < new_plugin->fd){
913
maxfd = new_plugin->fd;
805
free_plugin_list(plugin_list);
811
if (process_list == NULL){
812
fprintf(stderr, "No plugin processes started. Incorrect plugin"
921
for(plugin *p = plugin_list; p != NULL; p = p->next){
926
fprintf(stderr, "No plugin processes started. Incorrect plugin"
932
/* Main loop while running plugins exist */
817
934
fd_set rfds = rfds_all;
818
935
int select_ret = select(maxfd+1, &rfds, NULL, NULL, NULL);
819
936
if (select_ret == -1){
824
941
/* OK, now either a process completed, or something can be read
825
942
from one of them */
826
for(process *proc = process_list; proc ; proc = proc->next){
943
for(plugin *proc = plugin_list; proc != NULL; proc = proc->next){
827
944
/* Is this process completely done? */
828
945
if(proc->eof and proc->completed){
829
946
/* Only accept the plugin output if it exited cleanly */
830
947
if(not WIFEXITED(proc->status)
831
948
or WEXITSTATUS(proc->status) != 0){
832
949
/* Bad exit by plugin */
834
952
if(WIFEXITED(proc->status)){
835
953
fprintf(stderr, "Plugin %u exited with status %d\n",
853
973
exitstatus = EXIT_FAILURE;
856
/* Delete this process entry from the list */
857
if(process_list == proc){
858
/* First one - simple */
859
process_list = proc->next;
861
/* Second one or later */
862
for(process *p = process_list; p != NULL; p = p->next){
864
p->next = proc->next;
869
977
/* We are done modifying process list, so unblock signal */
870
978
ret = sigprocmask (SIG_UNBLOCK, &sigchld_action.sa_mask,
873
981
perror("sigprocmask");
877
/* We deleted this process from the list, so we can't go
878
proc->next. Therefore, start over from the beginning of
982
exitstatus = EXIT_FAILURE;
986
if(plugin_list == NULL){
882
992
/* This process exited nicely, so print its buffer */
884
994
bool bret = print_out_password(proc->buffer,
947
1058
if(custom_argv != NULL){
948
for(char **arg = custom_argv; *arg != NULL; arg++){
1059
for(char **arg = custom_argv+1; *arg != NULL; arg++){
951
1062
free(custom_argv);
953
free_plugin_list(plugin_list);
955
1065
if(dir != NULL){
959
1069
/* Free the process list and kill the processes */
960
for(process *next; process_list != NULL; process_list = next){
961
next = process_list->next;
962
close(process_list->fd);
963
ret = kill(process_list->pid, SIGTERM);
964
if(ret == -1 and errno != ESRCH){
965
/* set-uid proccesses migth not get closed */
1070
for(plugin *p = plugin_list; p != NULL; p = p->next){
1073
ret = kill(p->pid, SIGTERM);
1074
if(ret == -1 and errno != ESRCH){
1075
/* Set-uid proccesses might not get closed */
968
free(process_list->buffer);
972
1081
/* Wait for any remaining child processes to terminate */