(root)/mandos/release
» Revision
237.11.7
(compared to revision 237.16.2)
: plugins.d/mandos-client.c
To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 237.11.7
- compare with another revision
- download diff
- download tarball
- view history from revision 237.11.7
- Committer: Teddy Hogeborn
- Date: 2011-10-08 21:13:46 UTC
- mfrom: (237.7.58 trunk)
- mto: (237.15.5 mandos-client-network-hooks)
- mto: This revision was merged to the branch mainline in revision 286.
- Revision ID: teddy@recompile.se-20111008211346-z1r0xsk8ak8b04wf
* debian/source/local-options: New; contains "--single-debian-patch".
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
53
53
sockaddr_in6, PF_INET6,
54
54
SOCK_STREAM, uid_t, gid_t, open(),
55
55
opendir(), DIR */
56
#include <sys/stat.h> /* open(), S_ISREG */
56
#include <sys/stat.h> /* open() */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
58
inet_pton(), connect() */
59
59
#include <fcntl.h> /* open() */
123
123
#define PATHDIR "/conf/conf.d/mandos"
124
124
#define SECKEY "seckey.txt"
125
125
#define PUBKEY "pubkey.txt"
126
#define HOOKDIR "/lib/mandos/network-hooks.d"
127
126
128
127
bool debug = false;
129
128
static const char mandos_protocol_version[] = "1";
1086
1085
errno = old_errno;
1087
1086
}
1088
1087
1089
bool get_flags(const char *ifname, struct ifreq *ifr){
1090
int ret;
1091
1092
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1093
if(s < 0){
1094
perror_plus("socket");
1095
return false;
1096
}
1097
strcpy(ifr->ifr_name, ifname);
1098
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1099
if(ret == -1){
1088
/*
1089
* This function determines if a directory entry in /sys/class/net
1090
* corresponds to an acceptable network device.
1091
* (This function is passed to scandir(3) as a filter function.)
1092
*/
1093
int good_interface(const struct dirent *if_entry){
1094
ssize_t ssret;
1095
char *flagname = NULL;
1096
if(if_entry->d_name[0] == '.'){
1097
return 0;
1098
}
1099
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
1100
if_entry->d_name);
1101
if(ret < 0){
1102
perror_plus("asprintf");
1103
return 0;
1104
}
1105
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1106
if(flags_fd == -1){
1107
perror_plus("open");
1108
free(flagname);
1109
return 0;
1110
}
1111
free(flagname);
1112
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1113
/* read line from flags_fd */
1114
ssize_t to_read = 2+(sizeof(ifreq_flags)*2)+1; /* "0x1003\n" */
1115
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1116
flagstring[(size_t)to_read] = '\0';
1117
if(flagstring == NULL){
1118
perror_plus("malloc");
1119
close(flags_fd);
1120
return 0;
1121
}
1122
while(to_read > 0){
1123
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1124
(size_t)to_read));
1125
if(ssret == -1){
1126
perror_plus("read");
1127
free(flagstring);
1128
close(flags_fd);
1129
return 0;
1130
}
1131
to_read -= ssret;
1132
if(ssret == 0){
1133
break;
1134
}
1135
}
1136
close(flags_fd);
1137
intmax_t tmpmax;
1138
char *tmp;
1139
errno = 0;
1140
tmpmax = strtoimax(flagstring, &tmp, 0);
1141
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1142
and not (isspace(*tmp)))
1143
or tmpmax != (ifreq_flags)tmpmax){
1100
1144
if(debug){
1101
perror_plus("ioctl SIOCGIFFLAGS");
1145
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1146
flagstring, if_entry->d_name);
1102
1147
}
1103
return false;
1148
free(flagstring);
1149
return 0;
1104
1150
}
1105
return true;
1106
}
1107
1108
bool good_flags(const char *ifname, const struct ifreq *ifr){
1109
1151
free(flagstring);
1152
ifreq_flags flags = (ifreq_flags)tmpmax;
1110
1153
/* Reject the loopback device */
1111
if(ifr->ifr_flags & IFF_LOOPBACK){
1154
if(flags & IFF_LOOPBACK){
1112
1155
if(debug){
1113
1156
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1114
ifname);
1157
if_entry->d_name);
1115
1158
}
1116
return false;
1159
return 0;
1117
1160
}
1118
1161
/* Accept point-to-point devices only if connect_to is specified */
1119
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1162
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1120
1163
if(debug){
1121
1164
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1122
ifname);
1165
if_entry->d_name);
1123
1166
}
1124
return true;
1167
return 1;
1125
1168
}
1126
1169
/* Otherwise, reject non-broadcast-capable devices */
1127
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1170
if(not (flags & IFF_BROADCAST)){
1128
1171
if(debug){
1129
1172
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1130
ifname);
1173
if_entry->d_name);
1131
1174
}
1132
return false;
1175
return 0;
1133
1176
}
1134
1177
/* Reject non-ARP interfaces (including dummy interfaces) */
1135
if(ifr->ifr_flags & IFF_NOARP){
1178
if(flags & IFF_NOARP){
1136
1179
if(debug){
1137
fprintf(stderr, "Rejecting non-ARP interface \"%s\"\n", ifname);
1180
fprintf(stderr, "Rejecting non-ARP interface \"%s\"\n",
1181
if_entry->d_name);
1138
1182
}
1139
return false;
1183
return 0;
1140
1184
}
1141
1142
1185
/* Accept this device */
1143
1186
if(debug){
1144
fprintf(stderr, "Interface \"%s\" is good\n", ifname);
1145
}
1146
return true;
1147
}
1148
1149
/*
1150
* This function determines if a directory entry in /sys/class/net
1151
* corresponds to an acceptable network device.
1152
* (This function is passed to scandir(3) as a filter function.)
1153
*/
1154
int good_interface(const struct dirent *if_entry){
1155
if(if_entry->d_name[0] == '.'){
1156
return 0;
1157
}
1158
1159
struct ifreq ifr;
1160
if(not get_flags(if_entry->d_name, &ifr)){
1161
if(debug){
1162
fprintf(stderr, "Failed to get flags for interface \"%s\"\n",
1163
if_entry->d_name);
1164
}
1165
return 0;
1166
}
1167
1168
if(not good_flags(if_entry->d_name, &ifr)){
1169
return 0;
1170
}
1171
return 1;
1172
}
1173
1174
/*
1175
* This function determines if a directory entry in /sys/class/net
1176
* corresponds to an acceptable network device which is up.
1177
* (This function is passed to scandir(3) as a filter function.)
1178
*/
1179
int up_interface(const struct dirent *if_entry){
1180
if(if_entry->d_name[0] == '.'){
1181
return 0;
1182
}
1183
1184
struct ifreq ifr;
1185
if(not get_flags(if_entry->d_name, &ifr)){
1186
if(debug){
1187
fprintf(stderr, "Failed to get flags for interface \"%s\"\n",
1188
if_entry->d_name);
1189
}
1190
return 0;
1191
}
1192
1193
/* Reject down interfaces */
1194
if(not (ifr.ifr_flags & IFF_UP)){
1195
if(debug){
1196
fprintf(stderr, "Rejecting down interface \"%s\"\n",
1197
if_entry->d_name);
1198
}
1199
return 0;
1200
}
1201
1202
/* Reject non-running interfaces */
1203
if(not (ifr.ifr_flags & IFF_RUNNING)){
1204
if(debug){
1205
fprintf(stderr, "Rejecting non-running interface \"%s\"\n",
1206
if_entry->d_name);
1207
}
1208
return 0;
1209
}
1210
1211
if(not good_flags(if_entry->d_name, &ifr)){
1212
return 0;
1187
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1188
if_entry->d_name);
1213
1189
}
1214
1190
return 1;
1215
1191
}
1225
1201
return 1;
1226
1202
}
1227
1203
1228
/* Is this directory entry a runnable program? */
1229
int runnable_hook(const struct dirent *direntry){
1230
int ret;
1231
struct stat st;
1232
1233
if((direntry->d_name)[0] == '\0'){
1234
/* Empty name? */
1235
return 0;
1236
}
1237
1238
/* Save pointer to last character */
1239
char *end = strchr(direntry->d_name, '\0')-1;
1240
1241
if(*end == '~'){
1242
/* Backup name~ */
1243
return 0;
1244
}
1245
1246
if(((direntry->d_name)[0] == '#')
1247
and (*end == '#')){
1248
/* Temporary #name# */
1249
return 0;
1250
}
1251
1252
/* XXX more rules here */
1253
1254
ret = stat(direntry->d_name, &st);
1255
if(ret == -1){
1256
if(debug){
1257
perror_plus("Could not stat plugin");
1258
}
1259
return 0;
1260
}
1261
if(not (S_ISREG(st.st_mode))){
1262
/* Not a regular file */
1263
return 0;
1264
}
1265
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1266
/* Not executable */
1267
return 0;
1268
}
1269
return 1;
1270
}
1271
1272
1204
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1273
1205
int ret;
1274
1206
struct timespec now;
1586
1518
}
1587
1519
}
1588
1520
1589
/* Find network hooks and run them */
1590
{
1591
struct dirent **direntries;
1592
struct dirent *direntry;
1593
int numhooks = scandir(HOOKDIR, &direntries, runnable_hook,
1594
alphasort);
1595
int devnull = open("/dev/null", O_RDONLY);
1596
for(int i = 0; i < numhooks; i++){
1597
direntry = direntries[0];
1598
char *fullname = NULL;
1599
ret = asprintf(&fullname, "%s/%s", tempdir,
1600
direntry->d_name);
1601
if(ret < 0){
1602
perror_plus("asprintf");
1603
continue;
1604
}
1605
pid_t hook_pid = fork();
1606
if(hook_pid == 0){
1607
/* Child */
1608
dup2(devnull, STDIN_FILENO);
1609
close(devnull);
1610
dup2(STDERR_FILENO, STDOUT_FILENO);
1611
ret = setenv("DEVICE", interface, 1);
1612
if(ret == -1){
1613
perror_plus("setenv");
1614
exit(1);
1615
}
1616
ret = setenv("VERBOSE", debug ? "1" : "0", 1);
1617
if(ret == -1){
1618
perror_plus("setenv");
1619
exit(1);
1620
}
1621
ret = setenv("MODE", "start", 1);
1622
if(ret == -1){
1623
perror_plus("setenv");
1624
exit(1);
1625
}
1626
char *delaystring;
1627
ret = asprintf(&delaystring, "%f", delay);
1628
if(ret == -1){
1629
perror_plus("asprintf");
1630
exit(1);
1631
}
1632
ret = setenv("DELAY", delaystring, 1);
1633
if(ret == -1){
1634
free(delaystring);
1635
perror_plus("setenv");
1636
exit(1);
1637
}
1638
free(delaystring);
1639
ret = execl(fullname, direntry->d_name, "start", NULL);
1640
perror_plus("execl");
1641
}
1642
free(fullname);
1643
if(quit_now){
1644
goto end;
1645
}
1646
}
1647
close(devnull);
1648
}
1649
1650
1521
if(not debug){
1651
1522
avahi_set_log_function(empty_log);
1652
1523
}
1653
1524
1654
1525
if(interface[0] == '\0'){
1655
1526
struct dirent **direntries;
1656
/* First look for interfaces that are up */
1657
ret = scandir(sys_class_net, &direntries, up_interface,
1527
ret = scandir(sys_class_net, &direntries, good_interface,
1658
1528
alphasort);
1659
if(ret == 0){
1660
/* No up interfaces, look for any good interfaces */
1661
free(direntries);
1662
ret = scandir(sys_class_net, &direntries, good_interface,
1663
alphasort);
1664
}
1665
1529
if(ret >= 1){
1666
/* Pick the first interface returned */
1530
/* Pick the first good interface */
1667
1531
interface = strdup(direntries[0]->d_name);
1668
1532
if(debug){
1669
1533
fprintf(stderr, "Using interface \"%s\"\n", interface);
2005
1869
if (not quit_now){
2006
1870
exitcode = EXIT_SUCCESS;
2007
1871
}
2008
1872
2009
1873
goto end;
2010
1874
}
2011
1875
2108
1972
}
2109
1973
}
2110
1974
2111
/* XXX run network hooks "stop" here */
2112
2113
1975
/* Take down the network interface */
2114
1976
if(take_down_interface){
2115
1977
/* Re-raise priviliges */
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0