/mandos/release : revision 237.7.325

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to plugin-runner.c

Committer: Teddy Hogeborn
Date: 2015-07-20 03:03:33 UTC
mto: (237.7.594 trunk)
mto: This revision was merged to the branch mainline in revision 325.
Revision ID: teddy@recompile.se-20150720030333-203m2aeblypcsfte

Bug fix for GnuTLS 3: be compatible with old 2048-bit DSA keys.

The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string.  This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:

SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256

* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
  (/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
                                      instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.

Show diffs side-by-side

added added

removed removed

plugin-runner.c

#define BUFFER_SIZE 256

#define PDIR "/lib/mandos/plugins.d"

#define PHDIR "/lib/mandos/plugin-helpers"

#define AFILE "/conf/conf.d/mandos/plugin-runner.conf"

const char *argp_program_version = "plugin-runner " VERSION;

347

348

349

int main(int argc, char *argv[]){

349

350

char *plugindir = NULL;

351

char *pluginhelperdir = NULL;

350

352

char *argfile = NULL;

351

353

FILE *conffp;

352

354

struct dirent **direntries = NULL;

414

416

.doc = "Group ID the plugins will run as", .group = 3 },

415

417

{ .name = "debug", .key = 132,

416

418

.doc = "Debug mode", .group = 4 },

419

{ .name = "plugin-helper-dir", .key = 133,

420

.arg = "DIRECTORY",

421

.doc = "Specify a different plugin helper directory",

422

.group = 2 },

417

423

418

424

* These reproduce what we would get without ARGP_NO_HELP

419

425

545

551

case 132: /* --debug */

546

552

debug = true;

547

553

break;

554

case 133: /* --plugin-helper-dir */

555

free(pluginhelperdir);

556

pluginhelperdir = strdup(arg);

557

if(pluginhelperdir != NULL){

558

errno = 0;

559

}

560

break;

548

561

549

562

* These reproduce what we would get without ARGP_NO_HELP

550

563

601

614

case 130: /* --userid */

602

615

case 131: /* --groupid */

603

616

case 132: /* --debug */

617

case 133: /* --plugin-helper-dir */

604

618

case '?': /* --help */

605

619

case -3: /* --usage */

606

620

case 'V': /* --version */

761

775

goto fallback;

762

776

}

763

777

778

{

779

char *pluginhelperenv;

780

bool bret = true;

781

ret = asprintf(&pluginhelperenv, "MANDOSPLUGINHELPERDIR=%s",

782

pluginhelperdir != NULL ? pluginhelperdir : PHDIR);

783

if(ret != -1){

784

bret = add_environment(getplugin(NULL), pluginhelperenv, true);

785

}

786

if(ret == -1 or not bret){

787

error(0, errno, "Failed to set MANDOSPLUGINHELPERDIR"

788

" environment variable to \"%s\" for all plugins\n",

789

pluginhelperdir != NULL ? pluginhelperdir : PHDIR);

790

}

791

if(ret != -1){

792

free(pluginhelperenv);

793

}

794

}

795

764

796

if(debug){

765

797

for(plugin *p = plugin_list; p != NULL; p=p->next){

766

798

fprintf(stderr, "Plugin: %s has %d arguments\n",

795

827

}

796

828

}

797

829

}

798

TEMP_FAILURE_RETRY(close(plugindir_fd));

830

close(plugindir_fd);

799

831

}

800

832

}

801

833

887

919

int plugin_fd = openat(dir_fd, direntries[i]->d_name, O_RDONLY);

888

920

if(plugin_fd == -1){

889

921

error(0, errno, "Could not open plugin");

922

free(direntries[i]);

890

923

continue;

891

924

}

892

925

ret = (int)TEMP_FAILURE_RETRY(fstat(plugin_fd, &st));

893

926

if(ret == -1){

894

927

error(0, errno, "stat");

895

TEMP_FAILURE_RETRY(close(plugin_fd));

928

close(plugin_fd);

929

free(direntries[i]);

896

930

continue;

897

931

}

898

932

906

940

plugindir != NULL ? plugindir : PDIR,

907

941

direntries[i]->d_name);

908

942

}

909

TEMP_FAILURE_RETRY(close(plugin_fd));

943

close(plugin_fd);

944

free(direntries[i]);

910

945

continue;

911

946

}

912

947

913

948

plugin *p = getplugin(direntries[i]->d_name);

914

949

if(p == NULL){

915

950

error(0, errno, "getplugin");

916

TEMP_FAILURE_RETRY(close(plugin_fd));

951

close(plugin_fd);

952

free(direntries[i]);

917

953

continue;

918

954

}

919

955

if(p->disabled){

921

957

fprintf(stderr, "Ignoring disabled plugin \"%s\"\n",

922

958

direntries[i]->d_name);

923

959

}

924

TEMP_FAILURE_RETRY(close(plugin_fd));

960

close(plugin_fd);

961

free(direntries[i]);

925

962

continue;

926

963

}

927

964

{

960

997

if(ret == -1){

961

998

error(0, errno, "pipe");

962

999

exitstatus = EX_OSERR;

1000

free(direntries[i]);

963

1001

goto fallback;

964

1002

}

965

1003

if(pipefd[0] >= FD_SETSIZE){

966

1004

fprintf(stderr, "pipe()[0] (%d) >= FD_SETSIZE (%d)", pipefd[0],

967

1005

FD_SETSIZE);

968

TEMP_FAILURE_RETRY(close(pipefd[0]));

969

TEMP_FAILURE_RETRY(close(pipefd[1]));

1006

close(pipefd[0]);

1007

close(pipefd[1]);

970

1008

exitstatus = EX_OSERR;

1009

free(direntries[i]);

971

1010

goto fallback;

972

1011

}

973

1012

#ifndef O_CLOEXEC

975

1014

ret = set_cloexec_flag(pipefd[0]);

976

1015

if(ret < 0){

977

1016

error(0, errno, "set_cloexec_flag");

978

TEMP_FAILURE_RETRY(close(pipefd[0]));

979

TEMP_FAILURE_RETRY(close(pipefd[1]));

1017

close(pipefd[0]);

1018

close(pipefd[1]);

980

1019

exitstatus = EX_OSERR;

1020

free(direntries[i]);

981

1021

goto fallback;

982

1022

}

983

1023

ret = set_cloexec_flag(pipefd[1]);

984

1024

if(ret < 0){

985

1025

error(0, errno, "set_cloexec_flag");

986

TEMP_FAILURE_RETRY(close(pipefd[0]));

987

TEMP_FAILURE_RETRY(close(pipefd[1]));

1026

close(pipefd[0]);

1027

close(pipefd[1]);

988

1028

exitstatus = EX_OSERR;

1029

free(direntries[i]);

989

1030

goto fallback;

990

1031

}

991

1032

#endif /* not O_CLOEXEC */

996

1037

if(ret < 0){

997

1038

error(0, errno, "sigprocmask");

998

1039

exitstatus = EX_OSERR;

1040

free(direntries[i]);

999

1041

goto fallback;

1000

1042

}

1001

1043

/* Starting a new process to be watched */

1007

1049

error(0, errno, "fork");

1008

1050

TEMP_FAILURE_RETRY(sigprocmask(SIG_UNBLOCK,

1009

1051

&sigchld_action.sa_mask, NULL));

1010

TEMP_FAILURE_RETRY(close(pipefd[0]));

1011

TEMP_FAILURE_RETRY(close(pipefd[1]));

1052

close(pipefd[0]);

1053

close(pipefd[1]);

1012

1054

exitstatus = EX_OSERR;

1055

free(direntries[i]);

1013

1056

goto fallback;

1014

1057

}

1015

1058

if(pid == 0){

1041

1084

/* no return */

1042

1085

}

1043

1086

/* Parent process */

1044

TEMP_FAILURE_RETRY(close(pipefd[1])); /* Close unused write end of

1045

pipe */

1046

TEMP_FAILURE_RETRY(close(plugin_fd));

1087

close(pipefd[1]); /* Close unused write end of pipe */

1088

close(plugin_fd);

1047

1089

plugin *new_plugin = getplugin(direntries[i]->d_name);

1048

1090

if(new_plugin == NULL){

1049

1091

error(0, errno, "getplugin");

1054

1096

error(0, errno, "sigprocmask");

1055

1097

}

1056

1098

exitstatus = EX_OSERR;

1099

free(direntries[i]);

1057

1100

goto fallback;

1058

1101

}

1102

free(direntries[i]);

1059

1103

1060

1104

new_plugin->pid = pid;

1061

1105

new_plugin->fd = pipefd[0];

1093

1137

1094

1138

free(direntries);

1095

1139

direntries = NULL;

1096

TEMP_FAILURE_RETRY(close(dir_fd));

1140

close(dir_fd);

1097

1141

dir_fd = -1;

1098

1142

free_plugin(getplugin(NULL));

1099

1143

1297

1341

free(direntries);

1298

1342

1299

1343

if(dir_fd != -1){

1300

TEMP_FAILURE_RETRY(close(dir_fd));

1344

close(dir_fd);

1301

1345

}

1302

1346

1303

1347

/* Kill the processes */

1323

1367

free_plugin_list();

1324

1368

1325

1369

free(plugindir);

1370

free(pluginhelperdir);

1326

1371

free(argfile);

1327

1372

1328

1373

return exitstatus;

Older »