/mandos/trunk : revision 626

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/mandos-client.c

Committer: Teddy Hogeborn
Date: 2013-10-20 15:25:09 UTC
Revision ID: teddy@recompile.se-20131020152509-zkhuy2yse76w10hg

* Makefile (CFLAGS, LDFLAGS): Keep default flags from environment.
  (purge-server): PID file changed to "/run/mandos.pid".
* debian/compat: Changed to "9".
* debian/control (Standards-Version): Updated to "3.9.4".
  (DM-Upload-Allowed): Removed.
  (mandos/Depends): Add "initscripts (>= 2.88dsf-13.3)" to be able to
                    use the "/run" directory (for mandos.pid).
* debian/copyright (Copyright): Update year.
* init.d-mandos (PIDFILE): Changed to "/run/mandos.pid".
* mandos: Update copyright year.
  (pidfilename): Changed to "/run/mandos.pid".
* mandos-clients.conf.xml (OPTIONS/approval_delay): Bug fix: default
                                                    is "PT0S" - using
                                                    the new RFC 3339
                                                    duration syntax.
* mandos-keygen: Update copyright year.
* mandos-monitor: - '' -
* mandos.conf.xml: - '' -
* mandos.xml: - '' -
  (FILES): PID file changed to "/run/mandos.pid".
* plugin-runner.c: Update copyright year.
* plugins.d/mandos-client.c: - '' -
* plugins.d/mandos-client.xml: - '' -
* plugins.d/password-prompt.c: - '' -
* plugins.d/plymouth.c: - '' -

Show diffs side-by-side

added added

removed removed

plugins.d/mandos-client.c

opendir(), DIR */

#include <sys/stat.h> /* open(), S_ISREG */

#include <sys/socket.h> /* socket(), struct sockaddr_in6,

inet_pton(), connect(),

getnameinfo() */

inet_pton(), connect() */

#include <fcntl.h> /* open() */

#include <dirent.h> /* opendir(), struct dirent, readdir()

#include <unistd.h> /* close(), SEEK_SET, off_t, write(),

getuid(), getgid(), seteuid(),

setgid(), pause(), _exit() */

#include <arpa/inet.h> /* inet_pton(), htons() */

#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */

#include <iso646.h> /* not, or, and */

#include <argp.h> /* struct argp_option, error_t, struct

argp_state, struct argp,

argz_delete(), argz_append(),

argz_stringify(), argz_add(),

argz_count() */

#include <netdb.h> /* getnameinfo(), NI_NUMERICHOST,

EAI_SYSTEM, gai_strerror() */

#ifdef __linux__

#include <sys/klog.h> /* klogctl() */

201

198

size_t incbuffer(char **buffer, size_t buffer_length,

202

199

size_t buffer_capacity){

203

200

if(buffer_length + BUFFER_SIZE > buffer_capacity){

204

char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);

205

if(new_buf == NULL){

206

int old_errno = errno;

207

free(*buffer);

208

errno = old_errno;

209

*buffer = NULL;

201

*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);

202

if(buffer == NULL){

210

203

return 0;

211

204

}

212

*buffer = new_buf;

213

205

buffer_capacity += BUFFER_SIZE;

214

206

}

215

207

return buffer_capacity;

232

224

perror_plus("strdup");

233

225

return false;

234

226

}

235

ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));

236

if(ret == -1){

237

perror_plus("clock_gettime");

238

return false;

239

}

240

227

/* Special case of first server */

241

228

if(*current_server == NULL){

242

229

new_server->next = new_server;

249

236

new_server->prev->next = new_server;

250

237

(*current_server)->prev = new_server;

251

238

}

239

ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);

240

if(ret == -1){

241

perror_plus("clock_gettime");

242

return false;

243

}

252

244

return true;

253

245

}

254

246

744

736

}

745

737

if(af == AF_INET6){

746

738

to.in6.sin6_port = htons(port);

747

#ifdef __GNUC__

748

#pragma GCC diagnostic push

749

#pragma GCC diagnostic ignored "-Wstrict-aliasing"

750

#endif

751

739

if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */

752

(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower */

753

#ifdef __GNUC__

754

#pragma GCC diagnostic pop

755

#endif

740

(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and

741

-Wunreachable-code*/

756

742

if(if_index == AVAHI_IF_UNSPEC){

757

743

fprintf_plus(stderr, "An IPv6 link-local address is"

758

744

" incomplete without a network interface\n");

763

749

to.in6.sin6_scope_id = (uint32_t)if_index;

764

750

}

765

751

} else {

766

to.in.sin_port = htons(port);

752

to.in.sin_port = htons(port); /* Spurious warnings from

753

-Wconversion and

754

-Wunreachable-code */

767

755

}

768

756

769

757

if(quit_now){

786

774

}

787

775

char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?

788

776

INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";

777

const char *pcret;

789

778

if(af == AF_INET6){

790

ret = getnameinfo((struct sockaddr *)&(to.in6), sizeof(to.in6),

791

addrstr, sizeof(addrstr), NULL, 0,

792

NI_NUMERICHOST);

779

pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,

780

sizeof(addrstr));

793

781

} else {

794

ret = getnameinfo((struct sockaddr *)&(to.in), sizeof(to.in),

795

addrstr, sizeof(addrstr), NULL, 0,

796

NI_NUMERICHOST);

782

pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,

783

sizeof(addrstr));

797

784

}

798

if(ret == EAI_SYSTEM){

799

perror_plus("getnameinfo");

800

} else if(ret != 0) {

801

fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));

802

} else if(strcmp(addrstr, ip) != 0){

803

fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);

785

if(pcret == NULL){

786

perror_plus("inet_ntop");

787

} else {

788

if(strcmp(addrstr, ip) != 0){

789

fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);

790

}

804

791

}

805

792

}

806

793

1497

1484

bool run_network_hooks(const char *mode, const char *interface,

1498

1485

const float delay){

1499

1486

struct dirent **direntries;

1487

struct dirent *direntry;

1488

int ret;

1500

1489

int numhooks = scandir(hookdir, &direntries, runnable_hook,

1501

1490

alphasort);

1502

1491

if(numhooks == -1){

1509

1498

perror_plus("scandir");

1510

1499

}

1511

1500

} else {

1512

struct dirent *direntry;

1513

int ret;

1514

1501

int devnull = open("/dev/null", O_RDONLY);

1515

1502

for(int i = 0; i < numhooks; i++){

1516

1503

direntry = direntries[i];

1736

1723

}

1737

1724

1738

1725

error_t take_down_interface(const char *const interface){

1726

int sd = -1;

1739

1727

error_t old_errno = errno;

1728

error_t ret_errno = 0;

1729

int ret, ret_setflags;

1740

1730

struct ifreq network;

1741

1731

unsigned int if_index = if_nametoindex(interface);

1742

1732

if(if_index == 0){

1745

1735

return ENXIO;

1746

1736

}

1747

1737

if(interface_is_up(interface)){

1748

error_t ret_errno = 0;

1749

1738

if(not get_flags(interface, &network) and debug){

1750

1739

ret_errno = errno;

1751

1740

fprintf_plus(stderr, "Failed to get flags for interface "

1754

1743

}

1755

1744

network.ifr_flags &= ~(short)IFF_UP; /* clear flag */

1756

1745

1757

int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

1746

sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

1758

1747

if(sd < 0){

1759

1748

ret_errno = errno;

1760

1749

perror_plus("socket");

1770

1759

/* Raise priviliges */

1771

1760

raise_privileges();

1772

1761

1773

int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);

1762

ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);

1774

1763

ret_errno = errno;

1775

1764

1776

1765

/* Lower privileges */

1777

1766

lower_privileges();

1778

1767

1779

1768

/* Close the socket */

1780

int ret = (int)TEMP_FAILURE_RETRY(close(sd));

1769

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1781

1770

if(ret == -1){

1782

1771

perror_plus("close");

1783

1772

}

1816

1805

const char *seckey = PATHDIR "/" SECKEY;

1817

1806

const char *pubkey = PATHDIR "/" PUBKEY;

1818

1807

char *interfaces_hooks = NULL;

1808

size_t interfaces_hooks_size = 0;

1819

1809

1820

1810

bool gnutls_initialized = false;

1821

1811

bool gpgme_initialized = false;

2076

2066

goto end;

2077

2067

}

2078

2068

memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);

2079

argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');

2069

interfaces_hooks_size = mc.interfaces_size;

2070

argz_stringify(interfaces_hooks, interfaces_hooks_size,

2071

(int)',');

2080

2072

}

2081

2073

if(not run_network_hooks("start", interfaces_hooks != NULL ?

2082

2074

interfaces_hooks : "", delay)){

2175

2167

ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,

2176

2168

direntries[i]->d_name);

2177

2169

if(ret_errno != 0){

2178

errno = ret_errno;

2179

2170

perror_plus("argz_add");

2180

2171

continue;

2181

2172

}

2224

2215

ret_errno = argz_add(&interfaces_to_take_down,

2225

2216

&interfaces_to_take_down_size,

2226

2217

interface);

2227

if(ret_errno != 0){

2228

errno = ret_errno;

2229

perror_plus("argz_add");

2230

}

2231

2218

}

2232

2219

}

2233

2220

}

Older »