/mandos/release : revision 24.1.51

21

* Contact the authors at <mandos@fukt.bsnet.se>.

22

*/

23

24

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), getline(),

25

asprintf() */

24

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */

25

26

#include <stddef.h> /* size_t, NULL */

27

#include <stdlib.h> /* malloc(), exit(), EXIT_FAILURE,

28

EXIT_SUCCESS, realloc() */

51

close() */

52

#include <fcntl.h> /* fcntl(), F_GETFD, F_SETFD,

53

FD_CLOEXEC */

54

#include <string.h> /* strsep, strlen(), asprintf() */

54

#include <string.h> /* strsep, strlen(), strcpy(),

55

strcat() */

55

56

#include <errno.h> /* errno */

56

57

#include <argp.h> /* struct argp_option, struct

57

58

argp_state, struct argp,

58

59

argp_parse(), ARGP_ERR_UNKNOWN,

59

ARGP_KEY_END, ARGP_KEY_ARG,

60

error_t */

60

ARGP_KEY_END, ARGP_KEY_ARG, error_t */

61

#include <signal.h> /* struct sigaction, sigemptyset(),

62

sigaddset(), sigaction(),

63

sigprocmask(), SIG_BLOCK, SIGCHLD,

65

#include <errno.h> /* errno, EBADF */

66

67

#define BUFFER_SIZE 256

68

#define ARGFILE "/conf/conf.d/mandos/plugin-runner.conf"

68

#define CONFFILE "/conf/conf.d/mandos/client.conf"

69

70

const char *argp_program_version = "plugin-runner 1.0";

70

const char *argp_program_version = "mandos-client 1.0";

71

const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";

72

73

struct process;

79

size_t buffer_size;

80

size_t buffer_length;

81

bool eof;

82

volatile bool completed;

83

volatile int status;

82

bool completed;

83

int status;

84

struct process *next;

85

} process;

86

88

char *name; /* can be NULL or any plugin name */

89

char **argv;

90

int argc;

91

char **environ;

92

int envc;

93

91

bool disabled;

94

92

struct plugin *next;

95

93

} plugin;

104

102

/* Create a new plugin */

105

103

plugin *new_plugin = malloc(sizeof(plugin));

106

104

if (new_plugin == NULL){

107

return NULL;

108

}

109

char *copy_name = NULL;

110

if(name != NULL){

111

copy_name = strdup(name);

112

if(copy_name == NULL){

113

return NULL;

114

}

115

}

116

117

*new_plugin = (plugin) { .name = copy_name,

118

.argc = 1,

119

.envc = 0,

120

.disabled = false,

121

.next = *plugin_list };

122

105

perror("malloc");

106

exit(EXIT_FAILURE);

107

}

108

new_plugin->name = name;

123

109

new_plugin->argv = malloc(sizeof(char *) * 2);

124

110

if (new_plugin->argv == NULL){

125

free(copy_name);

126

free(new_plugin);

127

return NULL;

111

perror("malloc");

112

exit(EXIT_FAILURE);

128

113

}

129

new_plugin->argv[0] = copy_name;

114

new_plugin->argv[0] = name;

130

115

new_plugin->argv[1] = NULL;

131

132

new_plugin->environ = malloc(sizeof(char *));

133

if(new_plugin->environ == NULL){

134

free(copy_name);

135

free(new_plugin->argv);

136

free(new_plugin);

137

return NULL;

138

}

139

new_plugin->environ[0] = NULL;

116

new_plugin->argc = 1;

117

new_plugin->disabled = false;

118

new_plugin->next = *plugin_list;

140

119

/* Append the new plugin to the list */

141

120

*plugin_list = new_plugin;

142

121

return new_plugin;

143

122

}

144

123

145

/* Helper function for add_argument and add_environment */

146

static bool add_to_char_array(const char *new, char ***array,

147

int *len){

148

/* Resize the pointed-to array to hold one more pointer */

149

*array = realloc(*array, sizeof(char *)

150

* (size_t) ((*len) + 2));

151

/* Malloc check */

152

if(*array == NULL){

153

return false;

154

}

155

/* Make a copy of the new string */

156

char *copy = strdup(new);

157

if(copy == NULL){

158

return false;

159

}

160

/* Insert the copy */

161

(*array)[*len] = copy;

162

(*len)++;

163

/* Add a new terminating NULL pointer to the last element */

164

(*array)[*len] = NULL;

165

return true;

166

}

167

168

/* Add to a plugin's argument vector */

169

static bool add_argument(plugin *p, const char *arg){

170

if(p == NULL){

171

return false;

172

}

173

return add_to_char_array(arg, &(p->argv), &(p->argc));

174

}

175

176

/* Add to a plugin's environment */

177

static bool add_environment(plugin *p, const char *def){

178

if(p == NULL){

179

return false;

180

}

181

return add_to_char_array(def, &(p->environ), &(p->envc));

182

}

183

124

static void addargument(plugin *p, char *arg){

125

p->argv[p->argc] = arg;

126

p->argv = realloc(p->argv, sizeof(char *) * (size_t)(p->argc + 2));

127

if (p->argv == NULL){

128

perror("malloc");

129

exit(EXIT_FAILURE);

130

}

131

p->argc++;

132

p->argv[p->argc] = NULL;

133

}

184

134

185

135

/*

186

136

* Based on the example in the GNU LibC manual chapter 13.13 "File

200

150

201

151

process *process_list = NULL;

202

152

203

/* Mark processes as completed when they exit, and save their exit

153

/* Mark a process as completed when it exits, and save its exit

204

154

status. */

205

155

void handle_sigchld(__attribute__((unused)) int sig){

206

while(true){

207

process *proc = process_list;

208

int status;

209

pid_t pid = waitpid(-1, &status, WNOHANG);

210

if(pid == 0){

211

/* Only still running child processes */

212

break;

213

}

214

if(pid == -1){

215

if (errno != ECHILD){

216

perror("waitpid");

217

}

218

/* No child processes */

219

break;

220

}

221

222

/* A child exited, find it in process_list */

223

while(proc != NULL and proc->pid != pid){

224

proc = proc->next;

225

}

226

if(proc == NULL){

227

/* Process not found in process list */

228

continue;

229

}

230

proc->status = status;

231

proc->completed = true;

232

}

156

process *proc = process_list;

157

int status;

158

pid_t pid = wait(&status);

159

if(pid == -1){

160

perror("wait");

161

return;

162

}

163

while(proc != NULL and proc->pid != pid){

164

proc = proc->next;

165

}

166

if(proc == NULL){

167

/* Process not found in process list */

168

return;

169

}

170

proc->status = status;

171

proc->completed = true;

233

172

}

234

173

235

174

bool print_out_password(const char *buffer, size_t length){

247

186

return true;

248

187

}

249

188

250

char **add_to_argv(char **argv, int *argc, char *arg){

189

char ** addcustomargument(char **argv, int *argc, char *arg){

190

251

191

if (argv == NULL){

252

192

*argc = 1;

253

193

argv = malloc(sizeof(char*) * 2);

254

194

if(argv == NULL){

255

195

return NULL;

256

196

}

257

argv[0] = NULL; /* Will be set to argv[0] in main before

258

parsing */

197

argv[0] = NULL; /* Will be set to argv[0] in main before parsing */

259

198

argv[1] = NULL;

260

199

}

261

200

*argc += 1;

265

204

return NULL;

266

205

}

267

206

argv[*argc-1] = arg;

268

argv[*argc] = NULL;

207

argv[*argc] = NULL;

269

208

return argv;

270

209

}

271

210

272

static void free_plugin_list(plugin *plugin_list){

273

for(plugin *next; plugin_list != NULL; plugin_list = next){

274

next = plugin_list->next;

275

for(char **arg = plugin_list->argv; *arg != NULL; arg++){

276

free(*arg);

277

}

278

free(plugin_list->argv);

279

for(char **env = plugin_list->environ; *env != NULL; env++){

280

free(*env);

281

}

282

free(plugin_list->environ);

283

free(plugin_list);

284

}

285

}

286

287

211

int main(int argc, char *argv[]){

288

const char *plugindir = "/lib/mandos/plugins.d";

289

const char *argfile = ARGFILE;

212

const char *plugindir = "/conf/conf.d/mandos/plugins.d";

213

const char *conffile = CONFFILE;

290

214

FILE *conffp;

291

215

size_t d_name_len;

292

216

DIR *dir = NULL;

307

231

/* Establish a signal handler */

308

232

sigemptyset(&sigchld_action.sa_mask);

309

233

ret = sigaddset(&sigchld_action.sa_mask, SIGCHLD);

310

if(ret == -1){

234

if(ret < 0){

311

235

perror("sigaddset");

312

exitstatus = EXIT_FAILURE;

313

goto fallback;

236

exit(EXIT_FAILURE);

314

237

}

315

238

ret = sigaction(SIGCHLD, &sigchld_action, &old_sigchld_action);

316

if(ret == -1){

239

if(ret < 0){

317

240

perror("sigaction");

318

exitstatus = EXIT_FAILURE;

319

goto fallback;

241

exit(EXIT_FAILURE);

320

242

}

321

243

322

244

/* The options we understand. */

324

246

{ .name = "global-options", .key = 'g',

325

247

.arg = "OPTION[,OPTION[,...]]",

326

248

.doc = "Options passed to all plugins" },

327

{ .name = "global-envs", .key = 'e',

328

.arg = "VAR=value",

329

.doc = "Environment variable passed to all plugins" },

330

249

{ .name = "options-for", .key = 'o',

331

250

.arg = "PLUGIN:OPTION[,OPTION[,...]]",

332

251

.doc = "Options passed only to specified plugin" },

333

{ .name = "envs-for", .key = 'f',

334

.arg = "PLUGIN:ENV=value",

335

.doc = "Environment variable passed to specified plugin" },

336

252

{ .name = "disable", .key = 'd',

337

253

.arg = "PLUGIN",

338

254

.doc = "Disable a specific plugin", .group = 1 },

362

278

if(p[0] == '\0'){

363

279

continue;

364

280

}

365

if(not add_argument(getplugin(NULL, plugins), p)){

366

perror("add_argument");

367

return ARGP_ERR_UNKNOWN;

368

}

369

}

370

}

371

break;

372

case 'e':

373

if(arg == NULL){

374

break;

375

}

376

{

377

char *envdef = strdup(arg);

378

if(envdef == NULL){

379

break;

380

}

381

if(not add_environment(getplugin(NULL, plugins), envdef)){

382

perror("add_environment");

281

addargument(getplugin(NULL, plugins), p);

383

282

}

384

283

}

385

284

break;

386

285

case 'o':

387

286

if (arg != NULL){

388

char *p_name = strsep(&arg, ":");

389

if(p_name[0] == '\0'){

287

char *name = strsep(&arg, ":");

288

if(name[0] == '\0'){

390

289

break;

391

290

}

392

291

char *opt = strsep(&arg, ":");

399

298

if(p[0] == '\0'){

400

299

continue;

401

300

}

402

if(not add_argument(getplugin(p_name, plugins), p)){

403

perror("add_argument");

404

return ARGP_ERR_UNKNOWN;

405

}

301

addargument(getplugin(name, plugins), p);

406

302

}

407

303

}

408

304

}

409

305

break;

410

case 'f':

411

if(arg == NULL){

412

break;

413

}

414

{

415

char *envdef = strchr(arg, ':');

416

if(envdef == NULL){

417

break;

418

}

419

char *p_name = strndup(arg, (size_t) (envdef-arg));

420

if(p_name == NULL){

421

break;

422

}

423

envdef++;

424

if(not add_environment(getplugin(p_name, plugins), envdef)){

425

perror("add_environment");

426

}

427

}

428

break;

429

306

case 'd':

430

307

if (arg != NULL){

431

plugin *p = getplugin(arg, plugins);

432

if(p == NULL){

433

return ARGP_ERR_UNKNOWN;

434

}

435

p->disabled = true;

308

getplugin(arg, plugins)->disabled = true;

436

309

}

437

310

break;

438

311

case 128:

448

321

debug = true;

449

322

break;

450

323

case ARGP_KEY_ARG:

451

fprintf(stderr, "Ignoring unknown argument \"%s\"\n", arg);

324

fprintf(stderr, "Ignoring unknown argument \"%s\"\n", arg);

452

325

break;

453

326

case ARGP_KEY_END:

454

327

break;

468

341

if (ret == ARGP_ERR_UNKNOWN){

469

342

fprintf(stderr, "Unknown error while parsing arguments\n");

470

343

exitstatus = EXIT_FAILURE;

471

goto fallback;

344

goto end;

472

345

}

473

346

474

conffp = fopen(argfile, "r");

347

conffp = fopen(conffile, "r");

475

348

if(conffp != NULL){

476

349

char *org_line = NULL;

477

char *p, *arg, *new_arg, *line;

478

350

size_t size = 0;

479

351

ssize_t sret;

352

char *p, *arg, *new_arg, *line;

480

353

const char whitespace_delims[] = " \r\t\f\v\n";

481

354

const char comment_delim[] = "#";

482

355

493

366

continue;

494

367

}

495

368

new_arg = strdup(p);

496

custom_argv = add_to_argv(custom_argv, &custom_argc, new_arg);

369

custom_argv = addcustomargument(custom_argv, &custom_argc, new_arg);

497

370

if (custom_argv == NULL){

498

perror("add_to_argv");

371

perror("addcustomargument");

499

372

exitstatus = EXIT_FAILURE;

500

goto fallback;

373

goto end;

501

374

}

502

375

}

503

376

}

504

377

free(org_line);

505

378

} else{

506

/* Check for harmful errors and go to fallback. Other errors might

507

not affect opening plugins */

379

/* check for harmfull errors */

508

380

if (errno == EMFILE or errno == ENFILE or errno == ENOMEM){

509

381

perror("fopen");

510

382

exitstatus = EXIT_FAILURE;

511

goto fallback;

383

goto end;

512

384

}

513

385

}

514

386

515

387

if(custom_argv != NULL){

516

388

custom_argv[0] = argv[0];

517

ret = argp_parse (&argp, custom_argc, custom_argv, 0, 0,

518

&plugin_list);

389

ret = argp_parse (&argp, custom_argc, custom_argv, 0, 0, &plugin_list);

519

390

if (ret == ARGP_ERR_UNKNOWN){

520

391

fprintf(stderr, "Unknown error while parsing arguments\n");

521

392

exitstatus = EXIT_FAILURE;

522

goto fallback;

393

goto end;

523

394

}

524

395

}

525

396

530

401

for(char **a = p->argv; *a != NULL; a++){

531

402

fprintf(stderr, "\tArg: %s\n", *a);

532

403

}

533

fprintf(stderr, "...and %u environment variables\n", p->envc);

534

for(char **a = p->environ; *a != NULL; a++){

535

fprintf(stderr, "\t%s\n", *a);

536

}

537

404

}

538

405

}

539

406

551

418

if(dir == NULL){

552

419

perror("Could not open plugin dir");

553

420

exitstatus = EXIT_FAILURE;

554

goto fallback;

421

goto end;

555

422

}

556

423

557

424

/* Set the FD_CLOEXEC flag on the directory, if possible */

562

429

if(ret < 0){

563

430

perror("set_cloexec_flag");

564

431

exitstatus = EXIT_FAILURE;

565

goto fallback;

432

goto end;

566

433

}

567

434

}

568

435

}

577

444

if (errno == EBADF){

578

445

perror("readdir");

579

446

exitstatus = EXIT_FAILURE;

580

goto fallback;

447

goto end;

581

448

}

582

449

break;

583

450

}

628

495

continue;

629

496

}

630

497

}

631

632

char *filename;

633

ret = asprintf(&filename, "%s/%s", plugindir, dirst->d_name);

634

if(ret < 0){

635

perror("asprintf");

498

499

char *filename = malloc(d_name_len + strlen(plugindir) + 2);

500

if (filename == NULL){

501

perror("malloc");

636

502

continue;

637

503

}

504

strcpy(filename, plugindir); /* Spurious warning */

505

strcat(filename, "/"); /* Spurious warning */

506

strcat(filename, dirst->d_name); /* Spurious warning */

638

507

639

508

ret = stat(filename, &st);

640

509

if (ret == -1){

651

520

free(filename);

652

521

continue;

653

522

}

654

plugin *p = getplugin(dirst->d_name, &plugin_list);

655

if(p == NULL){

656

perror("getplugin");

657

free(filename);

658

continue;

659

}

660

if(p->disabled){

523

if(getplugin(dirst->d_name, &plugin_list)->disabled){

661

524

if(debug){

662

525

fprintf(stderr, "Ignoring disabled plugin \"%s\"\n",

663

526

dirst->d_name);

665

528

free(filename);

666

529

continue;

667

530

}

531

plugin *p = getplugin(dirst->d_name, &plugin_list);

668

532

{

669

533

/* Add global arguments to argument list for this plugin */

670

534

plugin *g = getplugin(NULL, &plugin_list);

671

if(g != NULL){

672

for(char **a = g->argv + 1; *a != NULL; a++){

673

if(not add_argument(p, *a)){

674

perror("add_argument");

675

}

676

}

677

/* Add global environment variables */

678

for(char **e = g->environ; *e != NULL; e++){

679

if(not add_environment(p, *e)){

680

perror("add_environment");

681

}

682

}

683

}

684

}

685

/* If this plugin has any environment variables, we will call

686

using execve and need to duplicate the environment from this

687

process, too. */

688

if(p->environ[0] != NULL){

689

for(char **e = environ; *e != NULL; e++){

690

char *copy = strdup(*e);

691

if(copy == NULL){

692

perror("strdup");

693

continue;

694

}

695

if(not add_environment(p, copy)){

696

perror("add_environment");

697

}

698

}

699

}

700

701

int pipefd[2];

535

for(char **a = g->argv + 1; *a != NULL; a++){

536

addargument(p, *a);

537

}

538

}

539

int pipefd[2];

702

540

ret = pipe(pipefd);

703

541

if (ret == -1){

704

542

perror("pipe");

705

543

exitstatus = EXIT_FAILURE;

706

goto fallback;

544

goto end;

707

545

}

708

546

ret = set_cloexec_flag(pipefd[0]);

709

547

if(ret < 0){

710

548

perror("set_cloexec_flag");

711

549

exitstatus = EXIT_FAILURE;

712

goto fallback;

550

goto end;

713

551

}

714

552

ret = set_cloexec_flag(pipefd[1]);

715

553

if(ret < 0){

716

554

perror("set_cloexec_flag");

717

555

exitstatus = EXIT_FAILURE;

718

goto fallback;

556

goto end;

719

557

}

720

558

/* Block SIGCHLD until process is safely in process list */

721

559

ret = sigprocmask (SIG_BLOCK, &sigchld_action.sa_mask, NULL);

722

560

if(ret < 0){

723

561

perror("sigprocmask");

724

562

exitstatus = EXIT_FAILURE;

725

goto fallback;

563

goto end;

726

564

}

727

565

// Starting a new process to be watched

728

566

pid_t pid = fork();

729

567

if(pid == -1){

730

568

perror("fork");

731

569

exitstatus = EXIT_FAILURE;

732

goto fallback;

570

goto end;

733

571

}

734

572

if(pid == 0){

735

573

/* this is the child process */

755

593

above and must now close it manually here. */

756

594

closedir(dir);

757

595

}

758

if(p->environ[0] == NULL){

759

if(execv(filename, p->argv) < 0){

760

perror("execv");

761

_exit(EXIT_FAILURE);

762

}

763

} else {

764

if(execve(filename, p->argv, p->environ) < 0){

765

perror("execve");

766

_exit(EXIT_FAILURE);

767

}

596

if(execv(filename, p->argv) < 0){

597

perror("execv");

598

_exit(EXIT_FAILURE);

768

599

}

769

600

/* no return */

770

601

}

779

610

perror("sigprocmask");

780

611

}

781

612

exitstatus = EXIT_FAILURE;

782

goto fallback;

613

goto end;

783

614

}

784

615

785

616

*new_process = (struct process){ .pid = pid,

793

624

if(ret < 0){

794

625

perror("sigprocmask");

795

626

exitstatus = EXIT_FAILURE;

796

goto fallback;

627

goto end;

797

628

}

798

629

799

630

FD_SET(new_process->fd, &rfds_all);

804

635

805

636

}

806

637

807

free_plugin_list(plugin_list);

808

plugin_list = NULL;

638

/* Free the plugin list */

639

for(plugin *next; plugin_list != NULL; plugin_list = next){

640

next = plugin_list->next;

641

free(plugin_list->argv);

642

free(plugin_list);

643

}

809

644

810

645

closedir(dir);

811

646

dir = NULL;

821

656

if (select_ret == -1){

822

657

perror("select");

823

658

exitstatus = EXIT_FAILURE;

824

goto fallback;

659

goto end;

825

660

}

826

661

/* OK, now either a process completed, or something can be read

827

662

from one of them */

849

684

/* Remove the plugin */

850

685

FD_CLR(proc->fd, &rfds_all);

851

686

/* Block signal while modifying process_list */

852

ret = sigprocmask(SIG_BLOCK, &sigchld_action.sa_mask, NULL);

687

ret = sigprocmask (SIG_BLOCK, &sigchld_action.sa_mask, NULL);

853

688

if(ret < 0){

854

689

perror("sigprocmask");

855

690

exitstatus = EXIT_FAILURE;

856

goto fallback;

691

goto end;

857

692

}

858

693

/* Delete this process entry from the list */

859

694

if(process_list == proc){

883

718

}

884

719

/* This process exited nicely, so print its buffer */

885

720

886

bool bret = print_out_password(proc->buffer,

887

proc->buffer_length);

721

bool bret = print_out_password(proc->buffer, proc->buffer_length);

888

722

if(not bret){

889

723

perror("print_out_password");

890

724

exitstatus = EXIT_FAILURE;

891

725

}

892

goto fallback;

726

goto end;

893

727

}

894

728

/* This process has not completed. Does it have any output? */

895

729

if(proc->eof or not FD_ISSET(proc->fd, &rfds)){

903

737

if (proc->buffer == NULL){

904

738

perror("malloc");

905

739

exitstatus = EXIT_FAILURE;

906

goto fallback;

740

goto end;

907

741

}

908

742

proc->buffer_size += BUFFER_SIZE;

909

743

}

924

758

}

925

759

926

760

927

fallback:

761

end:

928

762

929

763

if(process_list == NULL or exitstatus != EXIT_SUCCESS){

930

/* Fallback if all plugins failed, none are found or an error

931

occured */

764

/* Fallback if all plugins failed, none are found or an error occured */

932

765

bool bret;

933

766

fprintf(stderr, "Going to fallback mode using getpass(3)\n");

934

767

char *passwordbuffer = getpass("Password: ");

936

769

if(not bret){

937

770

perror("print_out_password");

938

771

exitstatus = EXIT_FAILURE;

772

goto end;

939

773

}

940

774

}

941

775

942

776

/* Restore old signal handler */

943

ret = sigaction(SIGCHLD, &old_sigchld_action, NULL);

944

if(ret == -1){

945

perror("sigaction");

946

exitstatus = EXIT_FAILURE;

947

}

948

949

if(custom_argv != NULL){

950

for(char **arg = custom_argv; *arg != NULL; arg++){

951

free(*arg);

952

}

953

free(custom_argv);

954

}

955

free_plugin_list(plugin_list);

777

sigaction(SIGCHLD, &old_sigchld_action, NULL);

778

779

free(custom_argv);

780

781

/* Free the plugin list */

782

for(plugin *next; plugin_list != NULL; plugin_list = next){

783

next = plugin_list->next;

784

free(plugin_list->argv);

785

free(plugin_list);

786

}

956

787

957

788

if(dir != NULL){

958

789

closedir(dir);