/mandos/trunk : revision 1213

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to dracut-module/password-agent.c

Committer: teddy at recompile
Date: 2020-04-05 21:30:59 UTC
Revision ID: teddy@recompile.se-20200405213059-fb2a61ckqynrmatk

Fix file descriptor leak in mandos-client

When the local network has Mandos servers announcing themselves using
real, globally reachable, IPv6 addresses (i.e. not link-local
addresses), but there is no router on the local network providing IPv6
RA (Router Advertisement) packets, the client cannot reach the server
by normal means, since the client only has a link-local IPv6 address,
and has no usable route to reach the server's global IPv6 address.
(This is not a common situation, and usually only happens when the
router itself reboots and runs a Mandos client, since it cannot then
give RA packets to itself.)  The client code has a solution for
this, which consists of adding a temporary local route to reach the
address of the server during communication, and removing this
temporary route afterwards.

This solution with a temporary route works, but has a file descriptor
leak; it leaks one file descriptor for each addition and for each
removal of a route.  If one server requiring an added route is present
on the network, but no servers gives a password, making the client
retry after the default ten seconds, and we furthermore assume a
default 1024 open files limit, the client runs out of file descriptors
after about 90 minutes, after which time the client process will be
useless and fail to retrieve any passwords, necessitating manual
password entry via the keyboard.

Fix this by eliminating the file descriptor leak in the client.

* plugins.d/mandos-client.c (add_delete_local_route): Do
  close(devnull) also in parent process, also if fork() fails, and on
  any failure in child process.

Show diffs side-by-side

added added

removed removed

dracut-module/password-agent.c

* Mandos password agent - Simple password agent to run Mandos client

* This file is part of Mandos.

1193

bool *const password_is_read = task.password_is_read;

1194

1195

/* We use the GLib "Key-value file parser" functions to parse the

1196

question file. See <https://systemd.io/PASSWORD_AGENTS/> for

1197

specification of contents */

1196

question file. See <https://www.freedesktop.org/wiki/Software

1197

/systemd/PasswordAgents/> for specification of contents */

1198

__attribute__((nonnull))

1199

void cleanup_g_key_file(GKeyFile **key_file){

1200

if(*key_file != NULL){

1490

not. You may but don't have to include a final NUL byte in

1491

your message.

1492

1493

— <https://systemd.io/PASSWORD_AGENTS/> (Tue, 15 Sep 2020

1494

14:24:20 GMT)

1493

— <https://www.freedesktop.org/wiki/Software/systemd/

1494

PasswordAgents/> (Wed 08 Oct 2014 02:14:28 AM UTC)

1495

1496

send_buffer[0] = '+'; /* Prefix with "+" */

1497

/* Always add an extra NUL */

1502

errno = 0;

1503

ssize_t ssret = send(fd, send_buffer, send_buffer_length,

1504

MSG_NOSIGNAL);

1505

const error_t saved_errno = (ssret < 0) ? errno : 0;

1505

const error_t saved_errno = errno;

1506

#if defined(__GLIBC_PREREQ) and __GLIBC_PREREQ(2, 25)

1507

explicit_bzero(send_buffer, send_buffer_length);

1508

#else

1526

/* Retry, below */

1527

break;

1528

case EMSGSIZE:

1529

error(0, saved_errno, "Password of size %" PRIuMAX

1530

" is too big", (uintmax_t)password->length);

1529

error(0, 0, "Password of size %" PRIuMAX " is too big",

1530

(uintmax_t)password->length);

1531

#if __GNUC__ < 7

1532

/* FALLTHROUGH */

1533

#else

1535

#endif

1536

case 0:

1537

if(ssret >= 0 and ssret < (ssize_t)send_buffer_length){

1538

error(0, 0, "Password only partially sent to socket %s: %"

1539

PRIuMAX " out of %" PRIuMAX " bytes sent", filename,

1540

(uintmax_t)ssret, (uintmax_t)send_buffer_length);

1538

error(0, 0, "Password only partially sent to socket");

1541

1539

}

1542

1540

#if __GNUC__ < 7

1543

1541

/* FALLTHROUGH */

5809

5807

char write_data[PIPE_BUF];

5810

5808

{

5811

5809

/* Construct test password buffer */

5812

/* Start with + since that is what the real protocol uses */

5810

/* Start with + since that is what the real procotol uses */

5813

5811

write_data[0] = '+';

5814

5812

/* Set a special character at string end just to mark the end */

5815

5813

write_data[sizeof(write_data)-2] = 'y';

5960

5958

test_fixture *fixture,

5961

5959

__attribute__((unused))

5962

5960

gconstpointer user_data){

5961

#ifndef __amd64__

5962

g_test_skip("Skipping EMSGSIZE test on non-AMD64 platform");

5963

#else

5963

5964

__attribute__((cleanup(cleanup_close)))

5964

5965

const int epoll_fd = epoll_create1(EPOLL_CLOEXEC);

5965

5966

g_assert_cmpint(epoll_fd, >=, 0);

5967

5968

char *const filename = strdup("/nonexistent/socket");

5968

5969

__attribute__((cleanup(string_set_clear)))

5969

5970

string_set cancelled_filenames = {};

5970

int socketfds[2];

5971

5972

/* Find a message size which triggers EMSGSIZE */

5973

__attribute__((cleanup(cleanup_string)))

5974

char *message_buffer = NULL;

5975

size_t message_size = PIPE_BUF + 1;

5976

for(ssize_t ssret = 0; ssret >= 0; message_size += 1024){

5977

if(message_size >= 1024*1024*1024){ /* 1 GiB */

5978

g_test_skip("Skipping EMSGSIZE test: Will not try 1GiB");

5979

return;

5980

}

5981

free(message_buffer);

5982

message_buffer = malloc(message_size);

5983

if(message_buffer == NULL){

5984

g_test_skip("Skipping EMSGSIZE test");

5985

g_test_message("Failed to malloc() %" PRIuMAX " bytes",

5986

(uintmax_t)message_size);

5987

return;

5988

}

5989

/* Fill buffer with 'x' */

5990

memset(message_buffer, 'x', message_size);

5991

/* Create a new socketpair for each message size to avoid having

5992

to empty the pipe by reading the message to a separate buffer

5993

5994

g_assert_cmpint(socketpair(PF_LOCAL, SOCK_DGRAM

5995

| SOCK_NONBLOCK | SOCK_CLOEXEC, 0,

5996

socketfds), ==, 0);

5997

ssret = send(socketfds[1], message_buffer, message_size,

5998

MSG_NOSIGNAL);

5999

error_t saved_errno = errno;

6000

g_assert_cmpint(close(socketfds[0]), ==, 0);

6001

g_assert_cmpint(close(socketfds[1]), ==, 0);

6002

6003

if(ssret < 0){

6004

if(saved_errno != EMSGSIZE) {

6005

g_test_skip("Skipping EMSGSIZE test");

6006

g_test_message("Error on send(): %s", strerror(saved_errno));

6007

return;

6008

}

6009

} else if(ssret != (ssize_t)message_size){

6010

g_test_skip("Skipping EMSGSIZE test");

6011

g_test_message("Partial send(): %" PRIuMAX " of %" PRIdMAX

6012

" bytes", (uintmax_t)ssret,

6013

(intmax_t)message_size);

6014

return;

6015

}

6016

}

6017

g_test_message("EMSGSIZE triggered by %" PRIdMAX " bytes",

6018

(intmax_t)message_size);

6019

6020

buffer password = {

6021

.data=message_buffer,

6022

.length=message_size - 2, /* Compensate for added '+' and NUL */

6023

.allocated=message_size,

5971

const size_t oversized = 1024*1024; /* Limit seems to be 212960 */

5972

__attribute__((cleanup(cleanup_buffer)))

5973

buffer password = {

5974

.data=malloc(oversized),

5975

.length=oversized,

5976

.allocated=oversized,

6024

5977

};

5978

g_assert_nonnull(password.data);

6025

5979

if(mlock(password.data, password.allocated) != 0){

6026

5980

g_assert_true(errno == EPERM or errno == ENOMEM);

6027

5981

}

5982

/* Construct test password buffer */

5983

/* Start with + since that is what the real procotol uses */

5984

password.data[0] = '+';

5985

/* Set a special character at string end just to mark the end */

5986

password.data[oversized-3] = 'y';

5987

/* Set NUL at buffer end, as suggested by the protocol */

5988

password.data[oversized-2] = '\0';

5989

/* Fill rest of password with 'x' */

5990

memset(password.data+1, 'x', oversized-3);

6028

5991

6029

5992

__attribute__((cleanup(cleanup_queue)))

6030

5993

task_queue *queue = create_queue();

6031

5994

g_assert_nonnull(queue);

5995

int socketfds[2];

6032

5996

g_assert_cmpint(socketpair(PF_LOCAL, SOCK_DGRAM

6033

5997

| SOCK_NONBLOCK | SOCK_CLOEXEC, 0,

6034

5998

socketfds), ==, 0);

6055

6019

g_assert_cmpuint((unsigned int)queue->length, ==, 0);

6056

6020

g_assert_true(string_set_contains(cancelled_filenames,

6057

6021

question_filename));

6022

#endif

6058

6023

}

6059

6024

6060

6025

static void test_send_password_to_socket_retry(__attribute__((unused))

Older »