/mandos/trunk : revision 237.4.139

1

/* -*- mode: c; coding: utf-8; after-save-hook: (lambda () (let* ((find-build-directory (lambda (try-directory &optional base-directory) (let ((base-directory (or base-directory try-directory))) (cond ((equal try-directory "/") base-directory) ((file-readable-p (concat (file-name-as-directory try-directory) "Makefile")) try-directory) ((funcall find-build-directory (directory-file-name (file-name-directory try-directory)) base-directory)))))) (build-directory (funcall find-build-directory (buffer-file-name))) (local-build-directory (if (fboundp 'file-local-name) (file-local-name build-directory) (or (file-remote-p build-directory 'localname) build-directory))) (command (file-relative-name (file-name-sans-extension (buffer-file-name)) build-directory))) (pcase (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (let ((qbdir (shell-quote-argument local-build-directory)) (qcmd (shell-quote-argument command))) (format "cd %s && CFLAGS=-Werror make --silent %s && %s --test --verbose" qbdir qcmd qcmd)) nil "*Test*")) (0 (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)))) (_ (with-current-buffer "*Test*" (compilation-mode) (cd-absolute build-directory)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); -*- */

1

/* -*- coding: utf-8; lexical-binding: t -*- */

2

/*

3

* Mandos password agent - Simple password agent to run Mandos client

4

*

5

6

5

6

7

*

8

* This file is part of Mandos.

9

*

23

* Contact the authors at <mandos@recompile.se>.

24

*/

25

26

#define _GNU_SOURCE

27

#include <inttypes.h> /* uintmax_t, PRIuMAX, PRIdMAX,

28

intmax_t, uint32_t, SCNx32,

29

SCNuMAX, SCNxMAX */

30

#include <stddef.h> /* size_t */

26

#define _GNU_SOURCE /* pipe2(), O_CLOEXEC, setresgid(),

27

setresuid(), asprintf(), getline(),

28

basename() */

29

#include <inttypes.h> /* uintmax_t, strtoumax(), PRIuMAX,

30

PRIdMAX, intmax_t, uint32_t,

31

SCNx32, SCNuMAX, SCNxMAX */

32

#include <stddef.h> /* size_t, NULL */

31

33

#include <sys/types.h> /* pid_t, uid_t, gid_t, getuid(),

32

34

getpid() */

33

35

#include <stdbool.h> /* bool, true, false */

40

42

NSIG, sigismember(), SA_ONSTACK,

41

43

SIG_DFL, SIG_IGN, SIGINT, SIGQUIT,

42

44

SIGHUP, SIGSTOP, SIG_UNBLOCK */

45

#include <unistd.h> /* uid_t, gid_t, close(), pipe2(),

46

fork(), _exit(), dup2(),

47

STDOUT_FILENO, setresgid(),

48

setresuid(), execv(), ssize_t,

49

read(), dup3(), getuid(), dup(),

50

STDERR_FILENO, pause(), write(),

51

rmdir(), unlink(), getpid() */

43

52

#include <stdlib.h> /* EXIT_SUCCESS, EXIT_FAILURE,

44

malloc(), free(), strtoumax(),

45

realloc(), setenv(), calloc(),

46

mkdtemp(), mkostemp() */

53

malloc(), free(), realloc(),

54

setenv(), calloc(), mkdtemp(),

55

mkostemp() */

47

56

#include <iso646.h> /* not, or, and, xor */

48

57

#include <error.h> /* error() */

49

58

#include <sysexits.h> /* EX_USAGE, EX_OSERR, EX_OSFILE */

57

66

#include <string.h> /* strdup(), memcpy(),

58

67

explicit_bzero(), memset(),

59

68

strcmp(), strlen(), strncpy(),

60

memcmp(), basename() */

69

memcmp(), basename(), strerror() */

61

70

#include <argz.h> /* argz_create(), argz_count(),

62

71

argz_extract(), argz_next(),

63

72

argz_add() */

73

82

ARGP_ERR_UNKNOWN, ARGP_KEY_ARGS,

74

83

struct argp, argp_parse(),

75

84

ARGP_NO_EXIT */

76

#include <stdint.h> /* SIZE_MAX */

77

#include <unistd.h> /* uid_t, gid_t, close(), pipe2(),

78

fork(), _exit(), dup2(),

79

STDOUT_FILENO, setresgid(),

80

setresuid(), execv(), ssize_t,

81

read(), dup3(), getuid(), dup(),

82

STDERR_FILENO, pause(), write(),

83

rmdir(), unlink(), getpid() */

85

#include <stdint.h> /* SIZE_MAX, uint32_t */

84

86

#include <sys/mman.h> /* munlock(), mlock() */

85

87

#include <fcntl.h> /* O_CLOEXEC, O_NONBLOCK, fcntl(),

86

88

F_GETFD, F_GETFL, FD_CLOEXEC,

110

112

g_assert_null(), g_assert_false(),

111

113

g_assert_cmpint(), g_assert_cmpuint(),

112

114

g_test_skip(), g_assert_cmpstr(),

113

g_test_init(), g_test_add(), g_test_run(),

114

GOptionContext, g_option_context_new(),

115

g_test_message(), g_test_init(), g_test_add(),

116

g_test_run(), GOptionContext,

117

g_option_context_new(),

115

118

g_option_context_set_help_enabled(), FALSE,

116

119

g_option_context_set_ignore_unknown_options(),

117

120

gboolean, GOptionEntry, G_OPTION_ARG_NONE,

1095

1098

} ievent_buffer;

1096

1099

struct inotify_event *const ievent = &ievent_buffer.event;

1097

1100

1101

#if defined(__GNUC__) and __GNUC__ >= 7

1102

#pragma GCC diagnostic push

1103

/* ievent is pointing into a struct which is of sufficient size */

1104

#pragma GCC diagnostic ignored "-Wstringop-overflow"

1105

#endif

1098

1106

const ssize_t read_length = read(fd, ievent, ievent_size);

1107

#if defined(__GNUC__) and __GNUC__ >= 7

1108

#pragma GCC diagnostic pop

1109

#endif

1099

1110

if(read_length == 0){ /* EOF */

1100

1111

error(0, 0, "Got EOF from inotify fd for directory %s", filename);

1101

1112

*quit_now = true;

1193

1204

bool *const password_is_read = task.password_is_read;

1194

1205

1195

1206

/* We use the GLib "Key-value file parser" functions to parse the

1196

question file. See <https://www.freedesktop.org/wiki/Software

1197

/systemd/PasswordAgents/> for specification of contents */

1207

question file. See <https://systemd.io/PASSWORD_AGENTS/> for

1208

specification of contents */

1198

1209

__attribute__((nonnull))

1199

1210

void cleanup_g_key_file(GKeyFile **key_file){

1200

1211

if(*key_file != NULL){

1490

1501

not. You may but don't have to include a final NUL byte in

1491

1502

your message.

1492

1503

1493

— <https://www.freedesktop.org/wiki/Software/systemd/

1494

PasswordAgents/> (Wed 08 Oct 2014 02:14:28 AM UTC)

1504

— <https://systemd.io/PASSWORD_AGENTS/> (Tue, 15 Sep 2020

1505

14:24:20 GMT)

1495

1506

*/

1496

1507

send_buffer[0] = '+'; /* Prefix with "+" */

1497

1508

/* Always add an extra NUL */

1502

1513

errno = 0;

1503

1514

ssize_t ssret = send(fd, send_buffer, send_buffer_length,

1504

1515

MSG_NOSIGNAL);

1505

const error_t saved_errno = errno;

1516

const error_t saved_errno = (ssret < 0) ? errno : 0;

1506

1517

#if defined(__GLIBC_PREREQ) and __GLIBC_PREREQ(2, 25)

1507

1518

explicit_bzero(send_buffer, send_buffer_length);

1508

1519

#else

1526

1537

/* Retry, below */

1527

1538

break;

1528

1539

case EMSGSIZE:

1529

error(0, 0, "Password of size %" PRIuMAX " is too big",

1530

(uintmax_t)password->length);

1540

error(0, saved_errno, "Password of size %" PRIuMAX

1541

" is too big", (uintmax_t)password->length);

1531

1542

#if __GNUC__ < 7

1532

1543

/* FALLTHROUGH */

1533

1544

#else

1535

1546

#endif

1536

1547

case 0:

1537

1548

if(ssret >= 0 and ssret < (ssize_t)send_buffer_length){

1538

error(0, 0, "Password only partially sent to socket");

1549

error(0, 0, "Password only partially sent to socket %s: %"

1550

PRIuMAX " out of %" PRIuMAX " bytes sent", filename,

1551

(uintmax_t)ssret, (uintmax_t)send_buffer_length);

1539

1552

}

1540

1553

#if __GNUC__ < 7

1541

1554

/* FALLTHROUGH */

2648

2661

bool password_is_read = false;

2649

2662

const char helper_directory[] = "/nonexistent";

2650

2663

const char *const argv[] = { "/bin/sh", "-c",

2651

"echo -n ${MANDOSPLUGINHELPERDIR}", NULL };

2664

"printf %s \"${MANDOSPLUGINHELPERDIR}\"", NULL };

2652

2665

2653

2666

const bool success = start_mandos_client(queue, epoll_fd,

2654

2667

&mandos_client_exited,

4177

4190

memcpy(ievent->name, dummy_file_name, sizeof(dummy_file_name));

4178

4191

const size_t ievent_size = (sizeof(struct inotify_event)

4179

4192

+ sizeof(dummy_file_name));

4193

#if defined(__GNUC__) and __GNUC__ >= 11

4194

#pragma GCC diagnostic push

4195

/* ievent is pointing into a struct which is of sufficient size */

4196

#pragma GCC diagnostic ignored "-Wstringop-overread"

4197

#endif

4180

4198

g_assert_cmpint(write(pipefds[1], (char *)ievent, ievent_size),

4181

4199

==, ievent_size);

4200

#if defined(__GNUC__) and __GNUC__ >= 11

4201

#pragma GCC diagnostic pop

4202

#endif

4182

4203

g_assert_cmpint(close(pipefds[1]), ==, 0);

4183

4204

4184

4205

bool quit_now = false;

4272

4293

memcpy(ievent->name, dummy_file_name, sizeof(dummy_file_name));

4273

4294

const size_t ievent_size = (sizeof(struct inotify_event)

4274

4295

+ sizeof(dummy_file_name));

4296

#if defined(__GNUC__) and __GNUC__ >= 11

4297

#pragma GCC diagnostic push

4298

/* ievent is pointing into a struct which is of sufficient size */

4299

#pragma GCC diagnostic ignored "-Wstringop-overread"

4300

#endif

4275

4301

g_assert_cmpint(write(pipefds[1], (char *)ievent, ievent_size),

4276

4302

==, ievent_size);

4303

#if defined(__GNUC__) and __GNUC__ >= 11

4304

#pragma GCC diagnostic pop

4305

#endif

4277

4306

g_assert_cmpint(close(pipefds[1]), ==, 0);

4278

4307

4279

4308

bool quit_now = false;

4369

4398

memcpy(ievent->name, dummy_file_name, sizeof(dummy_file_name));

4370

4399

const size_t ievent_size = (sizeof(struct inotify_event)

4371

4400

+ sizeof(dummy_file_name));

4401

#if defined(__GNUC__) and __GNUC__ >= 11

4402

#pragma GCC diagnostic push

4403

/* ievent is pointing into a struct which is of sufficient size */

4404

#pragma GCC diagnostic ignored "-Wstringop-overread"

4405

#endif

4372

4406

g_assert_cmpint(write(pipefds[1], (char *)ievent, ievent_size),

4373

4407

==, ievent_size);

4408

#if defined(__GNUC__) and __GNUC__ >= 11

4409

#pragma GCC diagnostic pop

4410

#endif

4374

4411

g_assert_cmpint(close(pipefds[1]), ==, 0);

4375

4412

4376

4413

bool quit_now = false;

4454

4491

memcpy(ievent->name, dummy_file_name, sizeof(dummy_file_name));

4455

4492

const size_t ievent_size = (sizeof(struct inotify_event)

4456

4493

+ sizeof(dummy_file_name));

4494

#if defined(__GNUC__) and __GNUC__ >= 11

4495

#pragma GCC diagnostic push

4496

/* ievent is pointing into a struct which is of sufficient size */

4497

#pragma GCC diagnostic ignored "-Wstringop-overread"

4498

#endif

4457

4499

g_assert_cmpint(write(pipefds[1], (char *)ievent, ievent_size),

4458

4500

==, ievent_size);

4501

#if defined(__GNUC__) and __GNUC__ >= 11

4502

#pragma GCC diagnostic pop

4503

#endif

4459

4504

g_assert_cmpint(close(pipefds[1]), ==, 0);

4460

4505

4461

4506

bool quit_now = false;

4538

4583

memcpy(ievent->name, dummy_file_name, sizeof(dummy_file_name));

4539

4584

const size_t ievent_size = (sizeof(struct inotify_event)

4540

4585

+ sizeof(dummy_file_name));

4586

#if defined(__GNUC__) and __GNUC__ >= 11

4587

#pragma GCC diagnostic push

4588

/* ievent is pointing into a struct which is of sufficient size */

4589

#pragma GCC diagnostic ignored "-Wstringop-overread"

4590

#endif

4541

4591

g_assert_cmpint(write(pipefds[1], (char *)ievent, ievent_size),

4542

4592

==, ievent_size);

4593

#if defined(__GNUC__) and __GNUC__ >= 11

4594

#pragma GCC diagnostic pop

4595

#endif

4543

4596

g_assert_cmpint(close(pipefds[1]), ==, 0);

4544

4597

4545

4598

bool quit_now = false;

4614

4667

memcpy(ievent->name, dummy_file_name, sizeof(dummy_file_name));

4615

4668

const size_t ievent_size = (sizeof(struct inotify_event)

4616

4669

+ sizeof(dummy_file_name));

4670

#if defined(__GNUC__) and __GNUC__ >= 11

4671

#pragma GCC diagnostic push

4672

/* ievent is pointing into a struct which is of sufficient size */

4673

#pragma GCC diagnostic ignored "-Wstringop-overread"

4674

#endif

4617

4675

g_assert_cmpint(write(pipefds[1], (char *)ievent, ievent_size),

4618

4676

==, ievent_size);

4677

#if defined(__GNUC__) and __GNUC__ >= 11

4678

#pragma GCC diagnostic pop

4679

#endif

4619

4680

g_assert_cmpint(close(pipefds[1]), ==, 0);

4620

4681

4621

4682

bool quit_now = false;

4693

4754

memcpy(ievent->name, dummy_file_name, sizeof(dummy_file_name));

4694

4755

const size_t ievent_size = (sizeof(struct inotify_event)

4695

4756

+ sizeof(dummy_file_name));

4757

#if defined(__GNUC__) and __GNUC__ >= 11

4758

#pragma GCC diagnostic push

4759

/* ievent is pointing into a struct which is of sufficient size */

4760

#pragma GCC diagnostic ignored "-Wstringop-overread"

4761

#endif

4696

4762

g_assert_cmpint(write(pipefds[1], (char *)ievent, ievent_size),

4697

4763

==, ievent_size);

4764

#if defined(__GNUC__) and __GNUC__ >= 11

4765

#pragma GCC diagnostic pop

4766

#endif

4698

4767

g_assert_cmpint(close(pipefds[1]), ==, 0);

4699

4768

4700

4769

bool quit_now = false;

5807

5876

char write_data[PIPE_BUF];

5808

5877

{

5809

5878

/* Construct test password buffer */

5810

/* Start with + since that is what the real procotol uses */

5879

/* Start with + since that is what the real protocol uses */

5811

5880

write_data[0] = '+';

5812

5881

/* Set a special character at string end just to mark the end */

5813

5882

write_data[sizeof(write_data)-2] = 'y';

5958

6027

test_fixture *fixture,

5959

6028

__attribute__((unused))

5960

6029

gconstpointer user_data){

5961

#ifndef __amd64__

5962

g_test_skip("Skipping EMSGSIZE test on non-AMD64 platform");

5963

#else

5964

6030

__attribute__((cleanup(cleanup_close)))

5965

6031

const int epoll_fd = epoll_create1(EPOLL_CLOEXEC);

5966

6032

g_assert_cmpint(epoll_fd, >=, 0);

5968

6034

char *const filename = strdup("/nonexistent/socket");

5969

6035

__attribute__((cleanup(string_set_clear)))

5970

6036

string_set cancelled_filenames = {};

5971

const size_t oversized = 1024*1024; /* Limit seems to be 212960 */

5972

__attribute__((cleanup(cleanup_buffer)))

5973

buffer password = {

5974

.data=malloc(oversized),

5975

.length=oversized,

5976

.allocated=oversized,

6037

int socketfds[2];

6038

6039

/* Find a message size which triggers EMSGSIZE */

6040

__attribute__((cleanup(cleanup_string)))

6041

char *message_buffer = NULL;

6042

size_t message_size = PIPE_BUF + 1;

6043

for(ssize_t ssret = 0; ssret >= 0; message_size += 1024){

6044

if(message_size >= 1024*1024*1024){ /* 1 GiB */

6045

g_test_skip("Skipping EMSGSIZE test: Will not try 1GiB");

6046

return;

6047

}

6048

message_buffer = realloc(message_buffer, message_size);

6049

if(message_buffer == NULL){

6050

g_test_skip("Skipping EMSGSIZE test");

6051

g_test_message("Failed to malloc() %" PRIuMAX " bytes",

6052

(uintmax_t)message_size);

6053

return;

6054

}

6055

/* Fill buffer with 'x' */

6056

memset(message_buffer, 'x', message_size);

6057

/* Create a new socketpair for each message size to avoid having

6058

to empty the pipe by reading the message to a separate buffer

6059

*/

6060

g_assert_cmpint(socketpair(PF_LOCAL, SOCK_DGRAM

6061

| SOCK_NONBLOCK | SOCK_CLOEXEC, 0,

6062

socketfds), ==, 0);

6063

ssret = send(socketfds[1], message_buffer, message_size,

6064

MSG_NOSIGNAL);

6065

error_t saved_errno = errno;

6066

g_assert_cmpint(close(socketfds[0]), ==, 0);

6067

g_assert_cmpint(close(socketfds[1]), ==, 0);

6068

6069

if(ssret < 0){

6070

if(saved_errno != EMSGSIZE) {

6071

g_test_skip("Skipping EMSGSIZE test");

6072

g_test_message("Error on send(%" PRIuMAX " bytes): %s",

6073

(uintmax_t)message_size,

6074

strerror(saved_errno));

6075

return;

6076

}

6077

break;

6078

} else if(ssret != (ssize_t)message_size){

6079

g_test_skip("Skipping EMSGSIZE test");

6080

g_test_message("Partial send(): %" PRIuMAX " of %" PRIdMAX

6081

" bytes", (uintmax_t)ssret,

6082

(intmax_t)message_size);

6083

return;

6084

}

6085

}

6086

g_test_message("EMSGSIZE triggered by %" PRIdMAX " bytes",

6087

(intmax_t)message_size);

6088

6089

buffer password = {

6090

.data=message_buffer,

6091

.length=message_size - 2, /* Compensate for added '+' and NUL */

6092

.allocated=message_size,

5977

6093

};

5978

g_assert_nonnull(password.data);

5979

6094

if(mlock(password.data, password.allocated) != 0){

5980

6095

g_assert_true(errno == EPERM or errno == ENOMEM);

5981

6096

}

5982

/* Construct test password buffer */

5983

/* Start with + since that is what the real procotol uses */

5984

password.data[0] = '+';

5985

/* Set a special character at string end just to mark the end */

5986

password.data[oversized-3] = 'y';

5987

/* Set NUL at buffer end, as suggested by the protocol */

5988

password.data[oversized-2] = '\0';

5989

/* Fill rest of password with 'x' */

5990

memset(password.data+1, 'x', oversized-3);

5991

6097

5992

6098

__attribute__((cleanup(cleanup_queue)))

5993

6099

task_queue *queue = create_queue();

5994

6100

g_assert_nonnull(queue);

5995

int socketfds[2];

5996

6101

g_assert_cmpint(socketpair(PF_LOCAL, SOCK_DGRAM

5997

6102

| SOCK_NONBLOCK | SOCK_CLOEXEC, 0,

5998

6103

socketfds), ==, 0);

6019

6124

g_assert_cmpuint((unsigned int)queue->length, ==, 0);

6020

6125

g_assert_true(string_set_contains(cancelled_filenames,

6021

6126

question_filename));

6022

#endif

6023

6127

}

6024

6128

6025

6129

static void test_send_password_to_socket_retry(__attribute__((unused))

8155

8259

g_option_context_free(context);

8156

8260

return should_run_tests != FALSE;

8157

8261

}

8262

8263

/*

8264

Local Variables:

8265

run-tests:

8266

(lambda ()

8267

(if (not (funcall run-tests-in-test-buffer default-directory))

8268

(funcall show-test-buffer-in-test-window)

8269

(funcall remove-test-window)))

8270

run-tests-in-test-buffer:

8271

(lambda (dir)

8272

(with-current-buffer (get-buffer-create "*Test*")

8273

(setq buffer-read-only nil

8274

default-directory dir)

8275

(erase-buffer)

8276

(compilation-mode))

8277

(let ((process-result

8278

(let ((inhibit-read-only t))

8279

(process-file-shell-command

8280

(funcall get-command-line) nil "*Test*"))))

8281

(and (numberp process-result)

8282

(= process-result 0))))

8283

get-command-line:

8284

(lambda ()

8285

(let*

8286

((build-directory

8287

(funcall find-build-directory (buffer-file-name)))

8288

(local-build-directory

8289

(if (fboundp 'file-local-name)

8290

(file-local-name build-directory)

8291

(or (file-remote-p build-directory 'localname)

8292

build-directory)))

8293

(command

8294

(file-relative-name (file-name-sans-extension

8295

(buffer-file-name)) build-directory))

8296

(qbdir (shell-quote-argument local-build-directory))

8297

(qcmd (shell-quote-argument command)))

8298

(format (concat "cd %s && CFLAGS=-Werror make --silent %s"

8299

" && %s --test --verbose") qbdir qcmd qcmd)))

8300

find-build-directory:

8301

(lambda (try-directory &optional base-directory)

8302

(let ((base-directory (or base-directory try-directory)))

8303

(cond ((equal try-directory "/") base-directory)

8304

((file-readable-p

8305

(concat (file-name-as-directory try-directory)

8306

"Makefile")) try-directory)

8307

((funcall find-build-directory

8308

(directory-file-name (file-name-directory

8309

try-directory))

8310

base-directory)))))

8311

show-test-buffer-in-test-window:

8312

(lambda ()

8313

(when (not (get-buffer-window-list "*Test*"))

8314

(setq next-error-last-buffer (get-buffer "*Test*"))

8315

(let* ((side (if (>= (window-width) 146) 'right 'bottom))

8316

(display-buffer-overriding-action

8317

`((display-buffer-in-side-window) (side . ,side)

8318

(window-height . fit-window-to-buffer)

8319

(window-width . fit-window-to-buffer))))

8320

(display-buffer "*Test*"))))

8321

remove-test-window:

8322

(lambda ()

8323

(let ((test-window (get-buffer-window "*Test*")))

8324

(if test-window (delete-window test-window))))

8325

eval: (add-hook 'after-save-hook run-tests 90 t)

8326

End:

8327

*/