To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 488
- compare with another revision
- download diff
- download tarball
- view history from revision 488
- Committer: Teddy Hogeborn
- Date: 2011-07-25 18:49:17 UTC
- Revision ID: teddy@fukt.bsnet.se-20110725184917-m9eov06ex6vn9877
* mandos-monitor (MandosClientPropertyCache): Save match tag for
PropertyChanged signal.
(MandosClientPropertyCache.delete): New; unregister signal.
(MandosClientWidget.__init__): Save matches for signals.
(MandosClientWidget): Unregister signals.
(UserInterface.find_and_remove_client): Log message when removing
a nonexisting client. Call
client.delete() instead of
self.remove_client().
PropertyChanged signal.
(MandosClientPropertyCache.delete): New; unregister signal.
(MandosClientWidget.__init__): Save matches for signals.
(MandosClientWidget): Unregister signals.
(UserInterface.find_and_remove_client): Log message when removing
a nonexisting client. Call
client.delete() instead of
self.remove_client().
- files removed:
- debian/source/local-options
- files modified:
- DBUS-API
added
removed
plugins.d/mandos-client.c
26
26
* along with this program. If not, see
27
27
* <http://www.gnu.org/licenses/>.
28
28
*
29
* Contact the authors at <mandos@recompile.se>.
29
* Contact the authors at <mandos@fukt.bsnet.se>.
30
30
*/
31
31
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
123
123
#define PATHDIR "/conf/conf.d/mandos"
124
124
#define SECKEY "seckey.txt"
125
125
#define PUBKEY "pubkey.txt"
126
#define HOOKDIR "/lib/mandos/network-hooks.d"
127
126
128
127
bool debug = false;
129
128
static const char mandos_protocol_version[] = "1";
130
129
const char *argp_program_version = "mandos-client " VERSION;
131
const char *argp_program_bug_address = "<mandos@recompile.se>";
130
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
132
131
static const char sys_class_net[] = "/sys/class/net";
133
132
char *connect_to = NULL;
134
133
171
170
perror(print_text);
172
171
}
173
172
174
int fprintf_plus(FILE *stream, const char *format, ...){
175
va_list ap;
176
va_start (ap, format);
177
178
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ", program_invocation_short_name));
179
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
180
}
181
182
173
/*
183
174
* Make additional room in "buffer" for at least BUFFER_SIZE more
184
175
* bytes. "buffer_capacity" is how much is currently allocated,
196
187
return buffer_capacity;
197
188
}
198
189
199
/* Add server to set of servers to retry periodically */
200
190
int add_server(const char *ip, uint16_t port,
201
191
AvahiIfIndex if_index,
202
192
int af){
214
204
perror_plus("strdup");
215
205
return -1;
216
206
}
217
/* Special case of first server */
207
/* unique case of first server */
218
208
if (mc.current_server == NULL){
219
209
new_server->next = new_server;
220
210
new_server->prev = new_server;
221
211
mc.current_server = new_server;
222
/* Place the new server last in the list */
212
/* Placing the new server last in the list */
223
213
} else {
224
214
new_server->next = mc.current_server;
225
215
new_server->prev = mc.current_server->prev;
292
282
return false;
293
283
}
294
284
295
/* Set GPGME home directory for the OpenPGP engine only */
285
/* Set GPGME home directory for the OpenPGP engine only */
296
286
rc = gpgme_get_engine_info(&engine_info);
297
287
if(rc != GPG_ERR_NO_ERROR){
298
288
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
1094
1084
errno = old_errno;
1095
1085
}
1096
1086
1097
bool get_flags(const char *ifname, struct ifreq *ifr){
1098
int ret;
1099
1100
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1101
if(s < 0){
1102
perror_plus("socket");
1103
return false;
1104
}
1105
strcpy(ifr->ifr_name, ifname);
1106
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1107
if(ret == -1){
1108
if(debug){
1109
perror_plus("ioctl SIOCGIFFLAGS");
1110
}
1111
return false;
1112
}
1113
return true;
1114
}
1115
1116
bool good_flags(const char *ifname, const struct ifreq *ifr){
1117
1118
/* Reject the loopback device */
1119
if(ifr->ifr_flags & IFF_LOOPBACK){
1120
if(debug){
1121
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1122
ifname);
1123
}
1124
return false;
1125
}
1126
/* Accept point-to-point devices only if connect_to is specified */
1127
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1128
if(debug){
1129
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1130
ifname);
1131
}
1132
return true;
1133
}
1134
/* Otherwise, reject non-broadcast-capable devices */
1135
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1136
if(debug){
1137
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1138
ifname);
1139
}
1140
return false;
1141
}
1142
/* Reject non-ARP interfaces (including dummy interfaces) */
1143
if(ifr->ifr_flags & IFF_NOARP){
1144
if(debug){
1145
fprintf(stderr, "Rejecting non-ARP interface \"%s\"\n", ifname);
1146
}
1147
return false;
1148
}
1149
1150
/* Accept this device */
1151
if(debug){
1152
fprintf(stderr, "Interface \"%s\" is good\n", ifname);
1153
}
1154
return true;
1155
}
1156
1157
1087
/*
1158
1088
* This function determines if a directory entry in /sys/class/net
1159
1089
* corresponds to an acceptable network device.
1160
1090
* (This function is passed to scandir(3) as a filter function.)
1161
1091
*/
1162
1092
int good_interface(const struct dirent *if_entry){
1163
int ret;
1164
if(if_entry->d_name[0] == '.'){
1165
return 0;
1166
}
1167
struct ifreq ifr;
1168
1169
if(not get_flags(if_entry->d_name, &ifr)){
1170
return 0;
1171
}
1172
1173
if(not good_flags(if_entry->d_name, &ifr)){
1174
return 0;
1175
}
1176
return 1;
1177
}
1178
1179
/*
1180
* This function determines if a directory entry in /sys/class/net
1181
* corresponds to an acceptable network device which is up.
1182
* (This function is passed to scandir(3) as a filter function.)
1183
*/
1184
int up_interface(const struct dirent *if_entry){
1185
1093
ssize_t ssret;
1186
1094
char *flagname = NULL;
1187
1095
if(if_entry->d_name[0] == '.'){
1249
1157
}
1250
1158
return 0;
1251
1159
}
1252
1253
/* Reject down interfaces */
1254
if(not (flags & IFF_UP)){
1255
return 0;
1256
}
1257
1258
1160
/* Accept point-to-point devices only if connect_to is specified */
1259
1161
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1260
1162
if(debug){
1298
1200
return 1;
1299
1201
}
1300
1202
1301
/* Is this directory entry a runnable program? */
1302
int runnable_hook(const struct dirent *direntry){
1303
int ret;
1304
struct stat st;
1305
1306
if((direntry->d_name)[0] == '\0'){
1307
/* Empty name? */
1308
return 0;
1309
}
1310
1311
/* Save pointer to last character */
1312
char *end = strchr(direntry->d_name, '\0')-1;
1313
1314
if(*end == '~'){
1315
/* Backup name~ */
1316
return 0;
1317
}
1318
1319
if(((direntry->d_name)[0] == '#')
1320
and (*end == '#')){
1321
/* Temporary #name# */
1322
return 0;
1323
}
1324
1325
/* XXX more rules here */
1326
1327
ret = stat(direntry->d_name, &st);
1328
if(ret == -1){
1329
if(debug){
1330
perror_plus("Could not stat plugin");
1331
}
1332
return 0;
1333
}
1334
if(not (st.st_mode & S_ISREG)){
1335
/* Not a regular file */
1336
return 0;
1337
}
1338
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1339
/* Not executable */
1340
return 0;
1341
}
1342
return 1;
1343
}
1344
1345
1203
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1346
1204
int ret;
1347
1205
struct timespec now;
1348
1206
struct timespec waited_time;
1349
1207
intmax_t block_time;
1350
1208
1351
1209
while(true){
1352
1210
if(mc.current_server == NULL){
1353
1211
if (debug){
1378
1236
block_time = ((retry_interval
1379
1237
- ((intmax_t)waited_time.tv_sec * 1000))
1380
1238
- ((intmax_t)waited_time.tv_nsec / 1000000));
1381
1239
1382
1240
if (debug){
1383
fprintf(stderr, "Blocking for %" PRIdMAX " ms\n", block_time);
1241
fprintf(stderr, "Blocking for %ld ms\n", block_time);
1384
1242
}
1385
1243
1386
1244
if(block_time <= 0){
1387
1245
ret = start_mandos_communication(mc.current_server->ip,
1388
1246
mc.current_server->port,
1553
1411
errno = 0;
1554
1412
retry_interval = strtod(arg, &tmp);
1555
1413
if(errno != 0 or tmp == arg or *tmp != '\0'
1556
or (retry_interval * 1000) > INT_MAX
1557
or retry_interval < 0){
1414
or (retry_interval * 1000) > INT_MAX){
1558
1415
argp_error(state, "Bad retry interval");
1559
1416
}
1560
1417
break;
1611
1468
perror_plus("seteuid");
1612
1469
}
1613
1470
1614
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1615
int seckey_fd = open(seckey, O_RDONLY);
1616
if(seckey_fd == -1){
1617
perror_plus("open");
1471
int seckey_fd = open(PATHDIR "/" SECKEY, O_RDONLY);
1472
if(seckey_fd == -1){
1473
perror_plus("open");
1474
} else {
1475
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1476
if(ret == -1){
1477
perror_plus("fstat");
1618
1478
} else {
1619
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1620
if(ret == -1){
1621
perror_plus("fstat");
1622
} else {
1623
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1624
ret = fchown(seckey_fd, uid, gid);
1625
if(ret == -1){
1626
perror_plus("fchown");
1627
}
1479
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1480
ret = fchown(seckey_fd, uid, gid);
1481
if(ret == -1){
1482
perror_plus("fchown");
1628
1483
}
1629
1484
}
1630
TEMP_FAILURE_RETRY(close(seckey_fd));
1631
1485
}
1486
TEMP_FAILURE_RETRY(close(seckey_fd));
1632
1487
}
1633
1488
1634
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1635
int pubkey_fd = open(pubkey, O_RDONLY);
1636
if(pubkey_fd == -1){
1637
perror_plus("open");
1489
int pubkey_fd = open(PATHDIR "/" PUBKEY, O_RDONLY);
1490
if(pubkey_fd == -1){
1491
perror_plus("open");
1492
} else {
1493
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1494
if(ret == -1){
1495
perror_plus("fstat");
1638
1496
} else {
1639
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1640
if(ret == -1){
1641
perror_plus("fstat");
1642
} else {
1643
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1644
ret = fchown(pubkey_fd, uid, gid);
1645
if(ret == -1){
1646
perror_plus("fchown");
1647
}
1497
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1498
ret = fchown(pubkey_fd, uid, gid);
1499
if(ret == -1){
1500
perror_plus("fchown");
1648
1501
}
1649
1502
}
1650
TEMP_FAILURE_RETRY(close(pubkey_fd));
1651
1503
}
1504
TEMP_FAILURE_RETRY(close(pubkey_fd));
1652
1505
}
1653
1506
1654
1507
/* Lower privileges */
1659
1512
}
1660
1513
}
1661
1514
1662
/* Find network hooks and run them */
1663
{
1664
struct dirent **direntries;
1665
struct dirent *direntry;
1666
int numhooks = scandir(HOOKDIR, &direntries, runnable_hook,
1667
alphasort);
1668
int devnull = open("/dev/null", O_RDONLY);
1669
for(int i = 0; i < numhooks; i++){
1670
direntry = direntries[0];
1671
char *fullname = NULL;
1672
ret = asprintf(&fullname, "%s/%s", tempdir,
1673
direntry->d_name);
1674
if(ret < 0){
1675
perror_plus("asprintf");
1676
continue;
1677
}
1678
pid_t hook_pid = fork();
1679
if(hook_pid == 0){
1680
/* Child */
1681
dup2(devnull, STDIN_FILENO);
1682
close(devnull);
1683
dup2(STDERR_FILENO, STDOUT_FILENO);
1684
setenv("DEVICE", interface, 1);
1685
setenv("VERBOSE", debug ? "1" : "0", 1);
1686
setenv("MODE", "start", 1);
1687
/* setenv( XXX more here */
1688
ret = execl(fullname, direntry->d_name, "start");
1689
perror_plus("execl");
1690
}
1691
free(fullname);
1692
if(quit_now){
1693
goto end;
1694
}
1695
}
1696
close(devnull);
1697
}
1698
1699
1515
if(not debug){
1700
1516
avahi_set_log_function(empty_log);
1701
1517
}
1702
1518
1703
1519
if(interface[0] == '\0'){
1704
1520
struct dirent **direntries;
1705
1521
ret = scandir(sys_class_net, &direntries, good_interface,
2013
1829
2014
1830
port = (uint16_t)tmpmax;
2015
1831
*address = '\0';
1832
address = connect_to;
2016
1833
/* Colon in address indicates IPv6 */
2017
1834
int af;
2018
if(strchr(connect_to, ':') != NULL){
1835
if(strchr(address, ':') != NULL){
2019
1836
af = AF_INET6;
2020
/* Accept [] around IPv6 address - see RFC 5952 */
2021
if(connect_to[0] == '[' and address[-1] == ']')
2022
{
2023
connect_to++;
2024
address[-1] = '\0';
2025
}
2026
1837
} else {
2027
1838
af = AF_INET;
2028
1839
}
2029
address = connect_to;
2030
1840
2031
1841
if(quit_now){
2032
1842
goto end;
2033
1843
}
2034
1844
2035
1845
while(not quit_now){
2036
1846
ret = start_mandos_communication(address, port, if_index, af);
2037
1847
if(quit_now or ret == 0){
2038
1848
break;
2039
1849
}
2040
if(debug){
2041
fprintf(stderr, "Retrying in %d seconds\n",
2042
(int)retry_interval);
2043
}
2044
sleep((int)retry_interval);
2045
}
2046
1850
sleep((int)retry_interval or 1);
1851
};
1852
2047
1853
if (not quit_now){
2048
1854
exitcode = EXIT_SUCCESS;
2049
1855
}
2050
1856
2051
1857
goto end;
2052
1858
}
2053
1859
2150
1956
}
2151
1957
}
2152
1958
2153
/* XXX run network hooks "stop" here */
2154
2155
1959
/* Take down the network interface */
2156
1960
if(take_down_interface){
2157
1961
/* Re-raise priviliges */
2188
1992
if(tempdir_created){
2189
1993
struct dirent **direntries = NULL;
2190
1994
struct dirent *direntry = NULL;
2191
int numentries = scandir(tempdir, &direntries, notdotentries,
2192
alphasort);
2193
if (numentries > 0){
2194
for(int i = 0; i < numentries; i++){
1995
ret = scandir(tempdir, &direntries, notdotentries, alphasort);
1996
if (ret > 0){
1997
for(int i = 0; i < ret; i++){
2195
1998
direntry = direntries[i];
2196
1999
char *fullname = NULL;
2197
2000
ret = asprintf(&fullname, "%s/%s", tempdir,
2209
2012
}
2210
2013
}
2211
2014
2212
/* need to clean even if 0 because man page doesn't specify */
2015
/* need to be cleaned even if ret == 0 because man page doesn't
2016
specify */
2213
2017
free(direntries);
2214
if (numentries == -1){
2018
if (ret == -1){
2215
2019
perror_plus("scandir");
2216
2020
}
2217
2021
ret = rmdir(tempdir);
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0