/mandos/trunk : revision 708

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugin-runner.c

Committer: Teddy Hogeborn
Date: 2014-06-22 02:19:30 UTC
Revision ID: teddy@recompile.se-20140622021930-icl7h4cm97blhjml

mandos-keygen: Generate "checker" option to use SSH fingerprints.

To turn this off, use a new "--no-ssh" option to mandos-keygen.

* INSTALL (Mandos Server, Mandos Client): Document new suggested
                                          installation of SSH.
* Makefile (confdir/clients.conf): Use new "--no-ssh" option to
                                   "mandos-keygen".
* debian/control (mandos/Depends): Changed to "fping | ssh-client".
  (mandos-client/Recommends): New; set to "ssh".
* intro.xml (FREQUENTLY ASKED QUESTIONS): Rename and rewrite section
                                          called "Faking ping
                                          replies?" to address new
                                          default behavior.
* mandos-clients.conf.xml (OPTIONS/checker): Briefly discuss new
                                             behavior of
                                             mandos-keygen.
* mandos-keygen: Bug fix: Suppress failure output of "shred" to remove
                 "sec*", since no such files may exist.
(password mode): Scan for SSH key fingerprints and output as new
                  "checker" and "ssh_fingerprint" options, unless new
                  "--no-ssh" option is given.
* mandos-keygen.xml (SYNOPSIS/--force): Bug fix: Document short form.
  (OPTIONS/--no-ssh): New.
  (SEE ALSO): Add reference "ssh-keyscan(1)".
* plugins.d/mandos-client.xml (SECURITY): Briefly mention the
                                          possibility of using SSH key
                                          fingerprints for checking.

Show diffs side-by-side

added added

removed removed

plugin-runner.c

#define BUFFER_SIZE 256

#define PDIR "/lib/mandos/plugins.d"

#define PHDIR "/lib/mandos/plugin-helpers"

#define AFILE "/conf/conf.d/mandos/plugin-runner.conf"

const char *argp_program_version = "plugin-runner " VERSION;

348

347

349

348

int main(int argc, char *argv[]){

350

349

char *plugindir = NULL;

351

char *pluginhelperdir = NULL;

352

350

char *argfile = NULL;

353

351

FILE *conffp;

354

352

struct dirent **direntries = NULL;

416

414

.doc = "Group ID the plugins will run as", .group = 3 },

417

415

{ .name = "debug", .key = 132,

418

416

.doc = "Debug mode", .group = 4 },

419

{ .name = "plugin-helper-dir", .key = 133,

420

.arg = "DIRECTORY",

421

.doc = "Specify a different plugin helper directory",

422

.group = 2 },

423

417

424

418

* These reproduce what we would get without ARGP_NO_HELP

425

419

551

545

case 132: /* --debug */

552

546

debug = true;

553

547

break;

554

case 133: /* --plugin-helper-dir */

555

free(pluginhelperdir);

556

pluginhelperdir = strdup(arg);

557

if(pluginhelperdir != NULL){

558

errno = 0;

559

}

560

break;

561

548

562

549

* These reproduce what we would get without ARGP_NO_HELP

563

550

614

601

case 130: /* --userid */

615

602

case 131: /* --groupid */

616

603

case 132: /* --debug */

617

case 133: /* --plugin-helper-dir */

618

604

case '?': /* --help */

619

605

case -3: /* --usage */

620

606

case 'V': /* --version */

775

761

goto fallback;

776

762

}

777

763

778

{

779

char *pluginhelperenv;

780

bool bret = true;

781

ret = asprintf(&pluginhelperenv, "MANDOSPLUGINHELPERDIR=%s",

782

pluginhelperdir != NULL ? pluginhelperdir : PHDIR);

783

if(ret != -1){

784

bret = add_environment(getplugin(NULL), pluginhelperenv, true);

785

}

786

if(ret == -1 or not bret){

787

error(0, errno, "Failed to set MANDOSPLUGINHELPERDIR"

788

" environment variable to \"%s\" for all plugins\n",

789

pluginhelperdir != NULL ? pluginhelperdir : PHDIR);

790

}

791

if(ret != -1){

792

free(pluginhelperenv);

793

}

794

}

795

796

764

if(debug){

797

765

for(plugin *p = plugin_list; p != NULL; p=p->next){

798

766

fprintf(stderr, "Plugin: %s has %d arguments\n",

827

795

}

828

796

}

829

797

}

830

close(plugindir_fd);

798

TEMP_FAILURE_RETRY(close(plugindir_fd));

831

799

}

832

800

}

833

801

919

887

int plugin_fd = openat(dir_fd, direntries[i]->d_name, O_RDONLY);

920

888

if(plugin_fd == -1){

921

889

error(0, errno, "Could not open plugin");

922

free(direntries[i]);

923

890

continue;

924

891

}

925

892

ret = (int)TEMP_FAILURE_RETRY(fstat(plugin_fd, &st));

926

893

if(ret == -1){

927

894

error(0, errno, "stat");

928

close(plugin_fd);

929

free(direntries[i]);

895

TEMP_FAILURE_RETRY(close(plugin_fd));

930

896

continue;

931

897

}

932

898

940

906

plugindir != NULL ? plugindir : PDIR,

941

907

direntries[i]->d_name);

942

908

}

943

close(plugin_fd);

944

free(direntries[i]);

909

TEMP_FAILURE_RETRY(close(plugin_fd));

945

910

continue;

946

911

}

947

912

948

913

plugin *p = getplugin(direntries[i]->d_name);

949

914

if(p == NULL){

950

915

error(0, errno, "getplugin");

951

close(plugin_fd);

952

free(direntries[i]);

916

TEMP_FAILURE_RETRY(close(plugin_fd));

953

917

continue;

954

918

}

955

919

if(p->disabled){

957

921

fprintf(stderr, "Ignoring disabled plugin \"%s\"\n",

958

922

direntries[i]->d_name);

959

923

}

960

close(plugin_fd);

961

free(direntries[i]);

924

TEMP_FAILURE_RETRY(close(plugin_fd));

962

925

continue;

963

926

}

964

927

{

997

960

if(ret == -1){

998

961

error(0, errno, "pipe");

999

962

exitstatus = EX_OSERR;

1000

free(direntries[i]);

1001

963

goto fallback;

1002

964

}

1003

965

if(pipefd[0] >= FD_SETSIZE){

1004

966

fprintf(stderr, "pipe()[0] (%d) >= FD_SETSIZE (%d)", pipefd[0],

1005

967

FD_SETSIZE);

1006

close(pipefd[0]);

1007

close(pipefd[1]);

968

TEMP_FAILURE_RETRY(close(pipefd[0]));

969

TEMP_FAILURE_RETRY(close(pipefd[1]));

1008

970

exitstatus = EX_OSERR;

1009

free(direntries[i]);

1010

971

goto fallback;

1011

972

}

1012

973

#ifndef O_CLOEXEC

1014

975

ret = set_cloexec_flag(pipefd[0]);

1015

976

if(ret < 0){

1016

977

error(0, errno, "set_cloexec_flag");

1017

close(pipefd[0]);

1018

close(pipefd[1]);

978

TEMP_FAILURE_RETRY(close(pipefd[0]));

979

TEMP_FAILURE_RETRY(close(pipefd[1]));

1019

980

exitstatus = EX_OSERR;

1020

free(direntries[i]);

1021

981

goto fallback;

1022

982

}

1023

983

ret = set_cloexec_flag(pipefd[1]);

1024

984

if(ret < 0){

1025

985

error(0, errno, "set_cloexec_flag");

1026

close(pipefd[0]);

1027

close(pipefd[1]);

986

TEMP_FAILURE_RETRY(close(pipefd[0]));

987

TEMP_FAILURE_RETRY(close(pipefd[1]));

1028

988

exitstatus = EX_OSERR;

1029

free(direntries[i]);

1030

989

goto fallback;

1031

990

}

1032

991

#endif /* not O_CLOEXEC */

1037

996

if(ret < 0){

1038

997

error(0, errno, "sigprocmask");

1039

998

exitstatus = EX_OSERR;

1040

free(direntries[i]);

1041

999

goto fallback;

1042

1000

}

1043

1001

/* Starting a new process to be watched */

1049

1007

error(0, errno, "fork");

1050

1008

TEMP_FAILURE_RETRY(sigprocmask(SIG_UNBLOCK,

1051

1009

&sigchld_action.sa_mask, NULL));

1052

close(pipefd[0]);

1053

close(pipefd[1]);

1010

TEMP_FAILURE_RETRY(close(pipefd[0]));

1011

TEMP_FAILURE_RETRY(close(pipefd[1]));

1054

1012

exitstatus = EX_OSERR;

1055

free(direntries[i]);

1056

1013

goto fallback;

1057

1014

}

1058

1015

if(pid == 0){

1084

1041

/* no return */

1085

1042

}

1086

1043

/* Parent process */

1087

close(pipefd[1]); /* Close unused write end of pipe */

1088

close(plugin_fd);

1044

TEMP_FAILURE_RETRY(close(pipefd[1])); /* Close unused write end of

1045

pipe */

1046

TEMP_FAILURE_RETRY(close(plugin_fd));

1089

1047

plugin *new_plugin = getplugin(direntries[i]->d_name);

1090

1048

if(new_plugin == NULL){

1091

1049

error(0, errno, "getplugin");

1096

1054

error(0, errno, "sigprocmask");

1097

1055

}

1098

1056

exitstatus = EX_OSERR;

1099

free(direntries[i]);

1100

1057

goto fallback;

1101

1058

}

1102

free(direntries[i]);

1103

1059

1104

1060

new_plugin->pid = pid;

1105

1061

new_plugin->fd = pipefd[0];

1137

1093

1138

1094

free(direntries);

1139

1095

direntries = NULL;

1140

close(dir_fd);

1096

TEMP_FAILURE_RETRY(close(dir_fd));

1141

1097

dir_fd = -1;

1142

1098

free_plugin(getplugin(NULL));

1143

1099

1341

1297

free(direntries);

1342

1298

1343

1299

if(dir_fd != -1){

1344

close(dir_fd);

1300

TEMP_FAILURE_RETRY(close(dir_fd));

1345

1301

}

1346

1302

1347

1303

/* Kill the processes */

1367

1323

free_plugin_list();

1368

1324

1369

1325

free(plugindir);

1370

free(pluginhelperdir);

1371

1326

free(argfile);

1372

1327

1373

1328

return exitstatus;

Older »