To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 485
- compare with another revision
- download diff
- download tarball
- view history from revision 485
- Committer: Teddy Hogeborn
- Date: 2011-07-13 02:24:39 UTC
- mfrom: (24.1.174 mandos)
- Revision ID: teddy@fukt.bsnet.se-20110713022439-wbv6kghshdsc2x24
Merge from Björn.
- files removed:
- debian/source/local-options
- files modified:
- DBUS-API
added
removed
plugins.d/mandos-client.c
26
26
* along with this program. If not, see
27
27
* <http://www.gnu.org/licenses/>.
28
28
*
29
* Contact the authors at <mandos@recompile.se>.
29
* Contact the authors at <mandos@fukt.bsnet.se>.
30
30
*/
31
31
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
123
123
#define PATHDIR "/conf/conf.d/mandos"
124
124
#define SECKEY "seckey.txt"
125
125
#define PUBKEY "pubkey.txt"
126
#define HOOKDIR "/lib/mandos/network-hooks.d"
127
126
128
127
bool debug = false;
129
128
static const char mandos_protocol_version[] = "1";
130
129
const char *argp_program_version = "mandos-client " VERSION;
131
const char *argp_program_bug_address = "<mandos@recompile.se>";
130
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
132
131
static const char sys_class_net[] = "/sys/class/net";
133
132
char *connect_to = NULL;
134
133
188
187
return buffer_capacity;
189
188
}
190
189
191
/* Add server to set of servers to retry periodically */
192
190
int add_server(const char *ip, uint16_t port,
193
191
AvahiIfIndex if_index,
194
192
int af){
206
204
perror_plus("strdup");
207
205
return -1;
208
206
}
209
/* Special case of first server */
207
/* unique case of first server */
210
208
if (mc.current_server == NULL){
211
209
new_server->next = new_server;
212
210
new_server->prev = new_server;
213
211
mc.current_server = new_server;
214
/* Place the new server last in the list */
212
/* Placing the new server last in the list */
215
213
} else {
216
214
new_server->next = mc.current_server;
217
215
new_server->prev = mc.current_server->prev;
284
282
return false;
285
283
}
286
284
287
/* Set GPGME home directory for the OpenPGP engine only */
285
/* Set GPGME home directory for the OpenPGP engine only */
288
286
rc = gpgme_get_engine_info(&engine_info);
289
287
if(rc != GPG_ERR_NO_ERROR){
290
288
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
1086
1084
errno = old_errno;
1087
1085
}
1088
1086
1089
bool get_flags(const char *ifname, struct ifreq *ifr){
1090
int ret;
1091
1092
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1093
if(s < 0){
1094
perror_plus("socket");
1095
return false;
1096
}
1097
strcpy(ifr->ifr_name, ifname);
1098
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1099
if(ret == -1){
1100
if(debug){
1101
perror_plus("ioctl SIOCGIFFLAGS");
1102
}
1103
return false;
1104
}
1105
return true;
1106
}
1107
1108
bool good_flags(const char *ifname, const struct ifreq *ifr){
1109
1110
/* Reject the loopback device */
1111
if(ifr->ifr_flags & IFF_LOOPBACK){
1112
if(debug){
1113
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1114
ifname);
1115
}
1116
return false;
1117
}
1118
/* Accept point-to-point devices only if connect_to is specified */
1119
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1120
if(debug){
1121
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1122
ifname);
1123
}
1124
return true;
1125
}
1126
/* Otherwise, reject non-broadcast-capable devices */
1127
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1128
if(debug){
1129
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1130
ifname);
1131
}
1132
return false;
1133
}
1134
/* Reject non-ARP interfaces (including dummy interfaces) */
1135
if(ifr->ifr_flags & IFF_NOARP){
1136
if(debug){
1137
fprintf(stderr, "Rejecting non-ARP interface \"%s\"\n", ifname);
1138
}
1139
return false;
1140
}
1141
1142
/* Accept this device */
1143
if(debug){
1144
fprintf(stderr, "Interface \"%s\" is good\n", ifname);
1145
}
1146
return true;
1147
}
1148
1149
1087
/*
1150
1088
* This function determines if a directory entry in /sys/class/net
1151
1089
* corresponds to an acceptable network device.
1152
1090
* (This function is passed to scandir(3) as a filter function.)
1153
1091
*/
1154
1092
int good_interface(const struct dirent *if_entry){
1155
int ret;
1156
if(if_entry->d_name[0] == '.'){
1157
return 0;
1158
}
1159
struct ifreq ifr;
1160
1161
if(not get_flags(if_entry->d_name, &ifr)){
1162
return 0;
1163
}
1164
1165
if(not good_flags(if_entry->d_name, &ifr)){
1166
return 0;
1167
}
1168
return 1;
1169
}
1170
1171
/*
1172
* This function determines if a directory entry in /sys/class/net
1173
* corresponds to an acceptable network device which is up.
1174
* (This function is passed to scandir(3) as a filter function.)
1175
*/
1176
int up_interface(const struct dirent *if_entry){
1177
1093
ssize_t ssret;
1178
1094
char *flagname = NULL;
1179
1095
if(if_entry->d_name[0] == '.'){
1241
1157
}
1242
1158
return 0;
1243
1159
}
1244
1245
/* Reject down interfaces */
1246
if(not (flags & IFF_UP)){
1247
return 0;
1248
}
1249
1250
1160
/* Accept point-to-point devices only if connect_to is specified */
1251
1161
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1252
1162
if(debug){
1290
1200
return 1;
1291
1201
}
1292
1202
1293
/* Is this directory entry a runnable program? */
1294
int runnable_hook(const struct dirent *direntry){
1295
int ret;
1296
struct stat st;
1297
1298
if((direntry->d_name)[0] == '\0'){
1299
/* Empty name? */
1300
return 0;
1301
}
1302
1303
/* Save pointer to last character */
1304
char *end = strchr(direntry->d_name, '\0')-1;
1305
1306
if(*end == '~'){
1307
/* Backup name~ */
1308
return 0;
1309
}
1310
1311
if(((direntry->d_name)[0] == '#')
1312
and (*end == '#')){
1313
/* Temporary #name# */
1314
return 0;
1315
}
1316
1317
/* XXX more rules here */
1318
1319
ret = stat(direntry->d_name, &st);
1320
if(ret == -1){
1321
if(debug){
1322
perror_plus("Could not stat plugin");
1323
}
1324
return 0;
1325
}
1326
if(not (st.st_mode & S_ISREG)){
1327
/* Not a regular file */
1328
return 0;
1329
}
1330
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1331
/* Not executable */
1332
return 0;
1333
}
1334
return 1;
1335
}
1336
1337
1203
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1338
1204
int ret;
1339
1205
struct timespec now;
1340
1206
struct timespec waited_time;
1341
1207
intmax_t block_time;
1342
1208
1343
1209
while(true){
1344
1210
if(mc.current_server == NULL){
1345
1211
if (debug){
1370
1236
block_time = ((retry_interval
1371
1237
- ((intmax_t)waited_time.tv_sec * 1000))
1372
1238
- ((intmax_t)waited_time.tv_nsec / 1000000));
1373
1239
1374
1240
if (debug){
1375
fprintf(stderr, "Blocking for %" PRIdMAX " ms\n", block_time);
1241
fprintf(stderr, "Blocking for %ld ms\n", block_time);
1376
1242
}
1377
1243
1378
1244
if(block_time <= 0){
1379
1245
ret = start_mandos_communication(mc.current_server->ip,
1380
1246
mc.current_server->port,
1545
1411
errno = 0;
1546
1412
retry_interval = strtod(arg, &tmp);
1547
1413
if(errno != 0 or tmp == arg or *tmp != '\0'
1548
or (retry_interval * 1000) > INT_MAX
1549
or retry_interval < 0){
1414
or (retry_interval * 1000) > INT_MAX){
1550
1415
argp_error(state, "Bad retry interval");
1551
1416
}
1552
1417
break;
1590
1455
goto end;
1591
1456
}
1592
1457
}
1593
1594
{
1595
/* Work around Debian bug #633582:
1596
<http://bugs.debian.org/633582> */
1597
struct stat st;
1598
1599
/* Re-raise priviliges */
1600
errno = 0;
1601
ret = seteuid(0);
1602
if(ret == -1){
1603
perror_plus("seteuid");
1604
}
1605
1606
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1607
int seckey_fd = open(seckey, O_RDONLY);
1608
if(seckey_fd == -1){
1609
perror_plus("open");
1610
} else {
1611
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1612
if(ret == -1){
1613
perror_plus("fstat");
1614
} else {
1615
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1616
ret = fchown(seckey_fd, uid, gid);
1617
if(ret == -1){
1618
perror_plus("fchown");
1619
}
1620
}
1621
}
1622
TEMP_FAILURE_RETRY(close(seckey_fd));
1623
}
1624
}
1625
1626
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1627
int pubkey_fd = open(pubkey, O_RDONLY);
1628
if(pubkey_fd == -1){
1629
perror_plus("open");
1630
} else {
1631
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1632
if(ret == -1){
1633
perror_plus("fstat");
1634
} else {
1635
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1636
ret = fchown(pubkey_fd, uid, gid);
1637
if(ret == -1){
1638
perror_plus("fchown");
1639
}
1640
}
1641
}
1642
TEMP_FAILURE_RETRY(close(pubkey_fd));
1643
}
1644
}
1645
1646
/* Lower privileges */
1647
errno = 0;
1648
ret = seteuid(uid);
1649
if(ret == -1){
1650
perror_plus("seteuid");
1651
}
1652
}
1653
1654
/* Find network hooks and run them */
1655
{
1656
struct dirent **direntries;
1657
struct dirent *direntry;
1658
int numhooks = scandir(HOOKDIR, &direntries, runnable_hook,
1659
alphasort);
1660
int devnull = open("/dev/null", O_RDONLY);
1661
for(int i = 0; i < numhooks; i++){
1662
direntry = direntries[0];
1663
char *fullname = NULL;
1664
ret = asprintf(&fullname, "%s/%s", tempdir,
1665
direntry->d_name);
1666
if(ret < 0){
1667
perror_plus("asprintf");
1668
continue;
1669
}
1670
pid_t hook_pid = fork();
1671
if(hook_pid == 0){
1672
/* Child */
1673
dup2(devnull, STDIN_FILENO);
1674
close(devnull);
1675
dup2(STDERR_FILENO, STDOUT_FILENO);
1676
setenv("DEVICE", interface, 1);
1677
setenv("VERBOSE", debug ? "1" : "0", 1);
1678
setenv("MODE", "start", 1);
1679
/* setenv( XXX more here */
1680
ret = execl(fullname, direntry->d_name, "start");
1681
perror_plus("execl");
1682
}
1683
free(fullname);
1684
if(quit_now){
1685
goto end;
1686
}
1687
}
1688
close(devnull);
1689
}
1690
1458
1691
1459
if(not debug){
1692
1460
avahi_set_log_function(empty_log);
1693
1461
}
1694
1462
1695
1463
if(interface[0] == '\0'){
1696
1464
struct dirent **direntries;
1697
1465
ret = scandir(sys_class_net, &direntries, good_interface,
2005
1773
2006
1774
port = (uint16_t)tmpmax;
2007
1775
*address = '\0';
1776
address = connect_to;
2008
1777
/* Colon in address indicates IPv6 */
2009
1778
int af;
2010
if(strchr(connect_to, ':') != NULL){
1779
if(strchr(address, ':') != NULL){
2011
1780
af = AF_INET6;
2012
/* Accept [] around IPv6 address - see RFC 5952 */
2013
if(connect_to[0] == '[' and address[-1] == ']')
2014
{
2015
connect_to++;
2016
address[-1] = '\0';
2017
}
2018
1781
} else {
2019
1782
af = AF_INET;
2020
1783
}
2021
address = connect_to;
2022
1784
2023
1785
if(quit_now){
2024
1786
goto end;
2025
1787
}
2026
1788
2027
1789
while(not quit_now){
2028
1790
ret = start_mandos_communication(address, port, if_index, af);
2029
1791
if(quit_now or ret == 0){
2030
1792
break;
2031
1793
}
2032
if(debug){
2033
fprintf(stderr, "Retrying in %d seconds\n",
2034
(int)retry_interval);
2035
}
2036
sleep((int)retry_interval);
2037
}
2038
1794
sleep((int)retry_interval or 1);
1795
};
1796
2039
1797
if (not quit_now){
2040
1798
exitcode = EXIT_SUCCESS;
2041
1799
}
2042
1800
2043
1801
goto end;
2044
1802
}
2045
1803
2142
1900
}
2143
1901
}
2144
1902
2145
/* XXX run network hooks "stop" here */
2146
2147
1903
/* Take down the network interface */
2148
1904
if(take_down_interface){
2149
1905
/* Re-raise priviliges */
2180
1936
if(tempdir_created){
2181
1937
struct dirent **direntries = NULL;
2182
1938
struct dirent *direntry = NULL;
2183
int numentries = scandir(tempdir, &direntries, notdotentries,
2184
alphasort);
2185
if (numentries > 0){
2186
for(int i = 0; i < numentries; i++){
1939
ret = scandir(tempdir, &direntries, notdotentries, alphasort);
1940
if (ret > 0){
1941
for(int i = 0; i < ret; i++){
2187
1942
direntry = direntries[i];
2188
1943
char *fullname = NULL;
2189
1944
ret = asprintf(&fullname, "%s/%s", tempdir,
2201
1956
}
2202
1957
}
2203
1958
2204
/* need to clean even if 0 because man page doesn't specify */
1959
/* need to be cleaned even if ret == 0 because man page doesn't
1960
specify */
2205
1961
free(direntries);
2206
if (numentries == -1){
1962
if (ret == -1){
2207
1963
perror_plus("scandir");
2208
1964
}
2209
1965
ret = rmdir(tempdir);
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0