/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugin-runner.c

  • Committer: Teddy Hogeborn
  • Date: 2015-03-10 18:03:38 UTC
  • Revision ID: teddy@recompile.se-20150310180338-pcxw6r2qmw9k6br9
Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx.

If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key
exchange algorithm in the TLS handshake, any saved network traffic
could then be decrypted later if the Mandos client key was obtained.
By default, Mandos uses ephemeral DH key exchanges which does not have
this problem, but a non-ephemeral key exchange algorithm was still
enabled by default.  The simplest solution is to simply turn that off,
which ensures that Mandos will always use ephemeral DH key exchanges.

There is a "PFS" priority string specifier, but we can't use it because:

1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it
   enables a lot more algorithms than "SECURE256".

2. It is only available since GnuTLS 3.2.4.

Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugin-runner.c
887
887
    int plugin_fd = openat(dir_fd, direntries[i]->d_name, O_RDONLY);
888
888
    if(plugin_fd == -1){
889
889
      error(0, errno, "Could not open plugin");
 
890
      free(direntries[i]);
890
891
      continue;
891
892
    }
892
893
    ret = (int)TEMP_FAILURE_RETRY(fstat(plugin_fd, &st));
893
894
    if(ret == -1){
894
895
      error(0, errno, "stat");
895
896
      TEMP_FAILURE_RETRY(close(plugin_fd));
 
897
      free(direntries[i]);
896
898
      continue;
897
899
    }
898
900
    
907
909
                direntries[i]->d_name);
908
910
      }
909
911
      TEMP_FAILURE_RETRY(close(plugin_fd));
 
912
      free(direntries[i]);
910
913
      continue;
911
914
    }
912
915
    
914
917
    if(p == NULL){
915
918
      error(0, errno, "getplugin");
916
919
      TEMP_FAILURE_RETRY(close(plugin_fd));
 
920
      free(direntries[i]);
917
921
      continue;
918
922
    }
919
923
    if(p->disabled){
922
926
                direntries[i]->d_name);
923
927
      }
924
928
      TEMP_FAILURE_RETRY(close(plugin_fd));
 
929
      free(direntries[i]);
925
930
      continue;
926
931
    }
927
932
    {
960
965
    if(ret == -1){
961
966
      error(0, errno, "pipe");
962
967
      exitstatus = EX_OSERR;
 
968
      free(direntries[i]);
963
969
      goto fallback;
964
970
    }
965
971
    if(pipefd[0] >= FD_SETSIZE){
968
974
      TEMP_FAILURE_RETRY(close(pipefd[0]));
969
975
      TEMP_FAILURE_RETRY(close(pipefd[1]));
970
976
      exitstatus = EX_OSERR;
 
977
      free(direntries[i]);
971
978
      goto fallback;
972
979
    }
973
980
#ifndef O_CLOEXEC
978
985
      TEMP_FAILURE_RETRY(close(pipefd[0]));
979
986
      TEMP_FAILURE_RETRY(close(pipefd[1]));
980
987
      exitstatus = EX_OSERR;
 
988
      free(direntries[i]);
981
989
      goto fallback;
982
990
    }
983
991
    ret = set_cloexec_flag(pipefd[1]);
986
994
      TEMP_FAILURE_RETRY(close(pipefd[0]));
987
995
      TEMP_FAILURE_RETRY(close(pipefd[1]));
988
996
      exitstatus = EX_OSERR;
 
997
      free(direntries[i]);
989
998
      goto fallback;
990
999
    }
991
1000
#endif  /* not O_CLOEXEC */
996
1005
    if(ret < 0){
997
1006
      error(0, errno, "sigprocmask");
998
1007
      exitstatus = EX_OSERR;
 
1008
      free(direntries[i]);
999
1009
      goto fallback;
1000
1010
    }
1001
1011
    /* Starting a new process to be watched */
1010
1020
      TEMP_FAILURE_RETRY(close(pipefd[0]));
1011
1021
      TEMP_FAILURE_RETRY(close(pipefd[1]));
1012
1022
      exitstatus = EX_OSERR;
 
1023
      free(direntries[i]);
1013
1024
      goto fallback;
1014
1025
    }
1015
1026
    if(pid == 0){
1054
1065
        error(0, errno, "sigprocmask");
1055
1066
      }
1056
1067
      exitstatus = EX_OSERR;
 
1068
      free(direntries[i]);
1057
1069
      goto fallback;
1058
1070
    }
 
1071
    free(direntries[i]);
1059
1072
    
1060
1073
    new_plugin->pid = pid;
1061
1074
    new_plugin->fd = pipefd[0];