To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 690
- compare with another revision
- download diff
- download tarball
- view history from revision 690
- Committer: Teddy Hogeborn
- Date: 2014-06-07 20:29:36 UTC
- Revision ID: teddy@recompile.se-20140607202936-crh5fxrdd804oora
Fix typo in code comment.
* debian/mandos.postinst: Fix typo in comment.
* debian/mandos.postinst: Fix typo in comment.
- files modified:
- INSTALL
added
removed
plugins.d/mandos-client.c
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
33
#ifndef _LARGEFILE_SOURCE
34
34
#define _LARGEFILE_SOURCE
35
#endif /* not _LARGEFILE_SOURCE */
35
#endif
36
36
#ifndef _FILE_OFFSET_BITS
37
37
#define _FILE_OFFSET_BITS 64
38
#endif /* not _FILE_OFFSET_BITS */
38
#endif
39
39
40
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
41
42
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror() */
43
stdout, ferror(), remove() */
44
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
58
inet_pton(), connect(),
59
59
getnameinfo() */
60
#include <fcntl.h> /* open(), unlinkat() */
60
#include <fcntl.h> /* open() */
61
61
#include <dirent.h> /* opendir(), struct dirent, readdir()
62
62
*/
63
63
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
73
73
*/
74
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
75
75
getuid(), getgid(), seteuid(),
76
setgid(), pause(), _exit(),
77
unlinkat() */
76
setgid(), pause(), _exit() */
78
77
#include <arpa/inet.h> /* inet_pton(), htons() */
79
78
#include <iso646.h> /* not, or, and */
80
79
#include <argp.h> /* struct argp_option, error_t, struct
142
141
static const char sys_class_net[] = "/sys/class/net";
143
142
char *connect_to = NULL;
144
143
const char *hookdir = HOOKDIR;
145
int hookdir_fd = -1;
146
144
uid_t uid = 65534;
147
145
gid_t gid = 65534;
148
146
234
232
.af = af };
235
233
if(new_server->ip == NULL){
236
234
perror_plus("strdup");
237
free(new_server);
238
235
return false;
239
236
}
240
237
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
241
238
if(ret == -1){
242
239
perror_plus("clock_gettime");
243
#ifdef __GNUC__
244
#pragma GCC diagnostic push
245
#pragma GCC diagnostic ignored "-Wcast-qual"
246
#endif
247
free((char *)(new_server->ip));
248
#ifdef __GNUC__
249
#pragma GCC diagnostic pop
250
#endif
251
free(new_server);
252
240
return false;
253
241
}
254
242
/* Special case of first server */
1076
1064
timed out */
1077
1065
1078
1066
if(quit_now){
1079
avahi_s_service_resolver_free(r);
1080
1067
return;
1081
1068
}
1082
1069
1358
1345
return 0;
1359
1346
}
1360
1347
1361
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1348
char *fullname = NULL;
1349
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1350
if(ret < 0){
1351
perror_plus("asprintf");
1352
return 0;
1353
}
1354
1355
ret = stat(fullname, &st);
1362
1356
if(ret == -1){
1363
1357
if(debug){
1364
1358
perror_plus("Could not stat hook");
1365
1359
}
1366
1360
return 0;
1367
1361
}
1362
free(fullname);
1368
1363
if(not (S_ISREG(st.st_mode))){
1369
1364
/* Not a regular file */
1370
1365
if(debug){
1469
1464
error_t ret_errno = 0;
1470
1465
if(seteuid(0) == -1){
1471
1466
ret_errno = errno;
1467
perror_plus("seteuid");
1472
1468
}
1473
1469
errno = old_errno;
1474
1470
return ret_errno;
1485
1481
}
1486
1482
if(setuid(0) == -1){
1487
1483
ret_errno = errno;
1484
perror_plus("seteuid");
1488
1485
}
1489
1486
errno = old_errno;
1490
1487
return ret_errno;
1497
1494
error_t ret_errno = 0;
1498
1495
if(seteuid(uid) == -1){
1499
1496
ret_errno = errno;
1497
perror_plus("seteuid");
1500
1498
}
1501
1499
errno = old_errno;
1502
1500
return ret_errno;
1509
1507
error_t ret_errno = 0;
1510
1508
if(setuid(uid) == -1){
1511
1509
ret_errno = errno;
1510
perror_plus("setuid");
1512
1511
}
1513
1512
errno = old_errno;
1514
1513
return ret_errno;
1517
1516
__attribute__((nonnull))
1518
1517
void run_network_hooks(const char *mode, const char *interface,
1519
1518
const float delay){
1520
struct dirent **direntries = NULL;
1521
if(hookdir_fd == -1){
1522
hookdir_fd = open(hookdir, O_RDONLY);
1523
if(hookdir_fd == -1){
1524
if(errno == ENOENT){
1525
if(debug){
1526
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1527
" found\n", hookdir);
1528
}
1529
} else {
1530
perror_plus("open");
1531
}
1532
return;
1533
}
1534
}
1535
#ifdef __GLIBC__
1536
#if __GLIBC_PREREQ(2, 15)
1537
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1538
runnable_hook, alphasort);
1539
#else /* not __GLIBC_PREREQ(2, 15) */
1540
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1541
alphasort);
1542
#endif /* not __GLIBC_PREREQ(2, 15) */
1543
#else /* not __GLIBC__ */
1544
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1545
alphasort);
1546
#endif /* not __GLIBC__ */
1519
struct dirent **direntries;
1520
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1521
alphasort);
1547
1522
if(numhooks == -1){
1548
perror_plus("scandir");
1549
return;
1550
}
1551
struct dirent *direntry;
1552
int ret;
1553
int devnull = open("/dev/null", O_RDONLY);
1554
for(int i = 0; i < numhooks; i++){
1555
direntry = direntries[i];
1556
if(debug){
1557
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1558
direntry->d_name);
1523
if(errno == ENOENT){
1524
if(debug){
1525
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1526
" found\n", hookdir);
1527
}
1528
} else {
1529
perror_plus("scandir");
1559
1530
}
1560
pid_t hook_pid = fork();
1561
if(hook_pid == 0){
1562
/* Child */
1563
/* Raise privileges */
1564
errno = raise_privileges_permanently();
1565
if(errno != 0){
1566
perror_plus("Failed to raise privileges");
1567
_exit(EX_NOPERM);
1568
}
1569
/* Set group */
1570
errno = 0;
1571
ret = setgid(0);
1572
if(ret == -1){
1573
perror_plus("setgid");
1574
_exit(EX_NOPERM);
1575
}
1576
/* Reset supplementary groups */
1577
errno = 0;
1578
ret = setgroups(0, NULL);
1579
if(ret == -1){
1580
perror_plus("setgroups");
1581
_exit(EX_NOPERM);
1582
}
1583
ret = dup2(devnull, STDIN_FILENO);
1584
if(ret == -1){
1585
perror_plus("dup2(devnull, STDIN_FILENO)");
1586
_exit(EX_OSERR);
1587
}
1588
ret = close(devnull);
1589
if(ret == -1){
1590
perror_plus("close");
1591
_exit(EX_OSERR);
1592
}
1593
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1594
if(ret == -1){
1595
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1596
_exit(EX_OSERR);
1597
}
1598
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1599
if(ret == -1){
1600
perror_plus("setenv");
1601
_exit(EX_OSERR);
1602
}
1603
ret = setenv("DEVICE", interface, 1);
1604
if(ret == -1){
1605
perror_plus("setenv");
1606
_exit(EX_OSERR);
1607
}
1608
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1609
if(ret == -1){
1610
perror_plus("setenv");
1611
_exit(EX_OSERR);
1612
}
1613
ret = setenv("MODE", mode, 1);
1614
if(ret == -1){
1615
perror_plus("setenv");
1616
_exit(EX_OSERR);
1617
}
1618
char *delaystring;
1619
ret = asprintf(&delaystring, "%f", (double)delay);
1620
if(ret == -1){
1531
} else {
1532
struct dirent *direntry;
1533
int ret;
1534
int devnull = open("/dev/null", O_RDONLY);
1535
for(int i = 0; i < numhooks; i++){
1536
direntry = direntries[i];
1537
char *fullname = NULL;
1538
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1539
if(ret < 0){
1621
1540
perror_plus("asprintf");
1622
_exit(EX_OSERR);
1623
}
1624
ret = setenv("DELAY", delaystring, 1);
1625
if(ret == -1){
1541
continue;
1542
}
1543
if(debug){
1544
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1545
direntry->d_name);
1546
}
1547
pid_t hook_pid = fork();
1548
if(hook_pid == 0){
1549
/* Child */
1550
/* Raise privileges */
1551
if(raise_privileges_permanently() != 0){
1552
perror_plus("Failed to raise privileges");
1553
_exit(EX_NOPERM);
1554
}
1555
/* Set group */
1556
errno = 0;
1557
ret = setgid(0);
1558
if(ret == -1){
1559
perror_plus("setgid");
1560
_exit(EX_NOPERM);
1561
}
1562
/* Reset supplementary groups */
1563
errno = 0;
1564
ret = setgroups(0, NULL);
1565
if(ret == -1){
1566
perror_plus("setgroups");
1567
_exit(EX_NOPERM);
1568
}
1569
ret = dup2(devnull, STDIN_FILENO);
1570
if(ret == -1){
1571
perror_plus("dup2(devnull, STDIN_FILENO)");
1572
_exit(EX_OSERR);
1573
}
1574
ret = close(devnull);
1575
if(ret == -1){
1576
perror_plus("close");
1577
_exit(EX_OSERR);
1578
}
1579
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1580
if(ret == -1){
1581
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1582
_exit(EX_OSERR);
1583
}
1584
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1585
if(ret == -1){
1586
perror_plus("setenv");
1587
_exit(EX_OSERR);
1588
}
1589
ret = setenv("DEVICE", interface, 1);
1590
if(ret == -1){
1591
perror_plus("setenv");
1592
_exit(EX_OSERR);
1593
}
1594
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1595
if(ret == -1){
1596
perror_plus("setenv");
1597
_exit(EX_OSERR);
1598
}
1599
ret = setenv("MODE", mode, 1);
1600
if(ret == -1){
1601
perror_plus("setenv");
1602
_exit(EX_OSERR);
1603
}
1604
char *delaystring;
1605
ret = asprintf(&delaystring, "%f", (double)delay);
1606
if(ret == -1){
1607
perror_plus("asprintf");
1608
_exit(EX_OSERR);
1609
}
1610
ret = setenv("DELAY", delaystring, 1);
1611
if(ret == -1){
1612
free(delaystring);
1613
perror_plus("setenv");
1614
_exit(EX_OSERR);
1615
}
1626
1616
free(delaystring);
1627
perror_plus("setenv");
1628
_exit(EX_OSERR);
1629
}
1630
free(delaystring);
1631
if(connect_to != NULL){
1632
ret = setenv("CONNECT", connect_to, 1);
1633
if(ret == -1){
1634
perror_plus("setenv");
1635
_exit(EX_OSERR);
1636
}
1637
}
1638
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1639
if(hook_fd == -1){
1640
perror_plus("openat");
1641
_exit(EXIT_FAILURE);
1642
}
1643
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1644
perror_plus("close");
1645
_exit(EXIT_FAILURE);
1646
}
1647
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1648
environ) == -1){
1649
perror_plus("fexecve");
1650
_exit(EXIT_FAILURE);
1651
}
1652
} else {
1653
int status;
1654
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1655
perror_plus("waitpid");
1656
free(direntry);
1657
continue;
1658
}
1659
if(WIFEXITED(status)){
1660
if(WEXITSTATUS(status) != 0){
1661
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1662
" with status %d\n", direntry->d_name,
1663
WEXITSTATUS(status));
1664
free(direntry);
1665
continue;
1666
}
1667
} else if(WIFSIGNALED(status)){
1668
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1669
" signal %d\n", direntry->d_name,
1670
WTERMSIG(status));
1671
free(direntry);
1672
continue;
1617
if(connect_to != NULL){
1618
ret = setenv("CONNECT", connect_to, 1);
1619
if(ret == -1){
1620
perror_plus("setenv");
1621
_exit(EX_OSERR);
1622
}
1623
}
1624
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1625
perror_plus("execl");
1626
_exit(EXIT_FAILURE);
1627
}
1673
1628
} else {
1674
fprintf_plus(stderr, "Warning: network hook \"%s\""
1675
" crashed\n", direntry->d_name);
1676
free(direntry);
1677
continue;
1678
}
1679
}
1680
if(debug){
1681
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1682
direntry->d_name);
1683
}
1684
free(direntry);
1685
}
1686
free(direntries);
1687
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1688
perror_plus("close");
1689
} else {
1690
hookdir_fd = -1;
1691
}
1692
close(devnull);
1629
int status;
1630
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1631
perror_plus("waitpid");
1632
free(fullname);
1633
continue;
1634
}
1635
if(WIFEXITED(status)){
1636
if(WEXITSTATUS(status) != 0){
1637
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1638
" with status %d\n", direntry->d_name,
1639
WEXITSTATUS(status));
1640
free(fullname);
1641
continue;
1642
}
1643
} else if(WIFSIGNALED(status)){
1644
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1645
" signal %d\n", direntry->d_name,
1646
WTERMSIG(status));
1647
free(fullname);
1648
continue;
1649
} else {
1650
fprintf_plus(stderr, "Warning: network hook \"%s\""
1651
" crashed\n", direntry->d_name);
1652
free(fullname);
1653
continue;
1654
}
1655
}
1656
free(fullname);
1657
if(debug){
1658
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1659
direntry->d_name);
1660
}
1661
}
1662
close(devnull);
1663
}
1693
1664
}
1694
1665
1695
1666
__attribute__((nonnull, warn_unused_result))
1746
1717
/* Raise privileges */
1747
1718
ret_errno = raise_privileges();
1748
1719
if(ret_errno != 0){
1749
errno = ret_errno;
1750
1720
perror_plus("Failed to raise privileges");
1751
1721
}
1752
1722
1856
1826
/* Raise privileges */
1857
1827
ret_errno = raise_privileges();
1858
1828
if(ret_errno != 0){
1859
errno = ret_errno;
1860
1829
perror_plus("Failed to raise privileges");
1861
1830
}
1862
1831
2269
2238
2270
2239
/* If no interfaces were specified, make a list */
2271
2240
if(mc.interfaces == NULL){
2272
struct dirent **direntries = NULL;
2241
struct dirent **direntries;
2273
2242
/* Look for any good interfaces */
2274
2243
ret = scandir(sys_class_net, &direntries, good_interface,
2275
2244
alphasort);
2281
2250
if(ret_errno != 0){
2282
2251
errno = ret_errno;
2283
2252
perror_plus("argz_add");
2284
free(direntries[i]);
2285
2253
continue;
2286
2254
}
2287
2255
if(debug){
2288
2256
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2289
2257
direntries[i]->d_name);
2290
2258
}
2291
free(direntries[i]);
2292
2259
}
2293
2260
free(direntries);
2294
2261
} else {
2295
if(ret == 0){
2296
free(direntries);
2297
}
2262
free(direntries);
2298
2263
fprintf_plus(stderr, "Could not find a network interface\n");
2299
2264
exitcode = EXIT_FAILURE;
2300
2265
goto end;
2564
2529
mc.current_server->prev->next = NULL;
2565
2530
while(mc.current_server != NULL){
2566
2531
server *next = mc.current_server->next;
2567
#ifdef __GNUC__
2568
#pragma GCC diagnostic push
2569
#pragma GCC diagnostic ignored "-Wcast-qual"
2570
#endif
2571
free((char *)(mc.current_server->ip));
2572
#ifdef __GNUC__
2573
#pragma GCC diagnostic pop
2574
#endif
2575
2532
free(mc.current_server);
2576
2533
mc.current_server = next;
2577
2534
}
2581
2538
{
2582
2539
ret_errno = raise_privileges();
2583
2540
if(ret_errno != 0){
2584
errno = ret_errno;
2585
2541
perror_plus("Failed to raise privileges");
2586
2542
} else {
2587
2543
2610
2566
2611
2567
ret_errno = lower_privileges_permanently();
2612
2568
if(ret_errno != 0){
2613
errno = ret_errno;
2614
2569
perror_plus("Failed to lower privileges permanently");
2615
2570
}
2616
2571
}
2621
2576
/* Removes the GPGME temp directory and all files inside */
2622
2577
if(tempdir != NULL){
2623
2578
struct dirent **direntries = NULL;
2624
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2625
O_NOFOLLOW));
2626
if(tempdir_fd == -1){
2627
perror_plus("open");
2628
} else {
2629
#ifdef __GLIBC__
2630
#if __GLIBC_PREREQ(2, 15)
2631
int numentries = scandirat(tempdir_fd, ".", &direntries,
2632
notdotentries, alphasort);
2633
#else /* not __GLIBC_PREREQ(2, 15) */
2634
int numentries = scandir(tempdir, &direntries, notdotentries,
2635
alphasort);
2636
#endif /* not __GLIBC_PREREQ(2, 15) */
2637
#else /* not __GLIBC__ */
2638
int numentries = scandir(tempdir, &direntries, notdotentries,
2639
alphasort);
2640
#endif /* not __GLIBC__ */
2641
if(numentries >= 0){
2642
for(int i = 0; i < numentries; i++){
2643
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2644
if(ret == -1){
2645
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2646
" \"%s\", 0): %s\n", tempdir,
2647
direntries[i]->d_name, strerror(errno));
2648
}
2649
free(direntries[i]);
2650
}
2651
2652
/* need to clean even if 0 because man page doesn't specify */
2653
free(direntries);
2654
if(numentries == -1){
2655
perror_plus("scandir");
2656
}
2657
ret = rmdir(tempdir);
2658
if(ret == -1 and errno != ENOENT){
2659
perror_plus("rmdir");
2660
}
2579
struct dirent *direntry = NULL;
2580
int numentries = scandir(tempdir, &direntries, notdotentries,
2581
alphasort);
2582
if(numentries > 0){
2583
for(int i = 0; i < numentries; i++){
2584
direntry = direntries[i];
2585
char *fullname = NULL;
2586
ret = asprintf(&fullname, "%s/%s", tempdir,
2587
direntry->d_name);
2588
if(ret < 0){
2589
perror_plus("asprintf");
2590
continue;
2591
}
2592
ret = remove(fullname);
2593
if(ret == -1){
2594
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2595
strerror(errno));
2596
}
2597
free(fullname);
2661
2598
}
2662
TEMP_FAILURE_RETRY(close(tempdir_fd));
2599
}
2600
2601
/* need to clean even if 0 because man page doesn't specify */
2602
free(direntries);
2603
if(numentries == -1){
2604
perror_plus("scandir");
2605
}
2606
ret = rmdir(tempdir);
2607
if(ret == -1 and errno != ENOENT){
2608
perror_plus("rmdir");
2663
2609
}
2664
2610
}
2665
2611
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0