X-Git-Url: https://git.librecmc.org/?a=blobdiff_plain;f=src%2Fexit%2Fgnunet-helper-exit.c;h=573bb7a502ebb5a8c49b41fbf87ebc887defd2d4;hb=82c4c89493dcbfc6ee7fd1232a9088d02e2cd0a2;hp=d1db2a6e649ebb78c3a83ce704e4cb9cc4ada7f4;hpb=4f285bb38af149f35a1bd3e730ac6bac7b14fd53;p=oweals%2Fgnunet.git diff --git a/src/exit/gnunet-helper-exit.c b/src/exit/gnunet-helper-exit.c index d1db2a6e6..573bb7a50 100644 --- a/src/exit/gnunet-helper-exit.c +++ b/src/exit/gnunet-helper-exit.c @@ -54,6 +54,12 @@ */ #include "gnunet_protocols.h" +/** + * Should we print (interesting|debug) messages that can happen during + * normal operation? + */ +#define DEBUG GNUNET_NO + /** * Maximum size of a GNUnet message (GNUNET_SERVER_MAX_MESSAGE_SIZE) */ @@ -62,12 +68,12 @@ /** * Path to 'sysctl' binary. */ -#define SBIN_SYSCTL "/sbin/sysctl" +static const char *sbin_sysctl; /** * Path to 'iptables' binary. */ -#define SBIN_IPTABLES "/sbin/iptables" +static const char *sbin_iptables; #ifndef _LINUX_IN6_H @@ -77,8 +83,8 @@ struct in6_ifreq { struct in6_addr ifr6_addr; - uint32_t ifr6_prefixlen; - unsigned int ifr6_ifindex; + __u32 ifr6_prefixlen; + int ifr6_ifindex; }; #endif @@ -110,6 +116,10 @@ fork_and_exec (const char *file, if (0 == pid) { /* we are the child process */ + /* close stdin/stdout to not cause interference + with the helper's main protocol! */ + (void) close (0); + (void) close (1); (void) execv (file, cmd); /* can only get here on error */ fprintf (stderr, @@ -164,6 +174,7 @@ init_tun (char *dev) if (fd >= FD_SETSIZE) { fprintf (stderr, "File descriptor to large: %d", fd); + (void) close (fd); return -1; } @@ -175,7 +186,8 @@ init_tun (char *dev) if (-1 == ioctl (fd, TUNSETIFF, (void *) &ifr)) { - fprintf (stderr, "Error with ioctl on `%s': %s\n", "/dev/net/tun", + fprintf (stderr, + "Error with ioctl on `%s': %s\n", "/dev/net/tun", strerror (errno)); (void) close (fd); return -1; @@ -196,16 +208,16 @@ static void set_address6 (const char *dev, const char *address, unsigned long prefix_len) { struct ifreq ifr; - struct in6_ifreq ifr6; struct sockaddr_in6 sa6; int fd; + struct in6_ifreq ifr6; /* * parse the new address */ memset (&sa6, 0, sizeof (struct sockaddr_in6)); sa6.sin6_family = AF_INET6; - if (1 != inet_pton (AF_INET6, address, sa6.sin6_addr.s6_addr)) + if (1 != inet_pton (AF_INET6, address, &sa6.sin6_addr)) { fprintf (stderr, "Failed to parse address `%s': %s\n", address, strerror (errno)); @@ -214,7 +226,7 @@ set_address6 (const char *dev, const char *address, unsigned long prefix_len) if (-1 == (fd = socket (PF_INET6, SOCK_DGRAM, 0))) { - fprintf (stderr, "Error creating socket: %s\n", strerror (errno)); + fprintf (stderr, "Error creating socket: %s\n", strerror (errno)); exit (1); } @@ -470,7 +482,9 @@ run (int fd_tun) } else if (0 == buftun_size) { +#if DEBUG fprintf (stderr, "EOF on tun\n"); +#endif shutdown (fd_tun, SHUT_RD); shutdown (1, SHUT_WR); read_open = 0; @@ -492,7 +506,10 @@ run (int fd_tun) if (-1 == written) { - fprintf (stderr, "write-error to stdout: %s\n", strerror (errno)); +#if !DEBUG + if (errno != EPIPE) +#endif + fprintf (stderr, "write-error to stdout: %s\n", strerror (errno)); shutdown (fd_tun, SHUT_RD); shutdown (1, SHUT_WR); read_open = 0; @@ -523,7 +540,9 @@ run (int fd_tun) } else if (0 == bufin_size) { +#if DEBUG fprintf (stderr, "EOF on stdin\n"); +#endif shutdown (0, SHUT_RD); shutdown (fd_tun, SHUT_WR); write_open = 0; @@ -589,8 +608,8 @@ PROCESS_BUFFER: * Open VPN tunnel interface. * * @param argc must be 6 - * @param argv 0: binary name ("gnunet-helper-vpn") - * 1: tunnel interface name ("gnunet-vpn") + * @param argv 0: binary name ("gnunet-helper-exit") + * 1: tunnel interface name ("gnunet-exit") * 2: IPv4 "physical" interface name ("eth0"), or "%" to not do IPv4 NAT * 3: IPv6 address ("::1"), or "-" to skip IPv6 * 4: IPv6 netmask length in bits ("64") [ignored if #4 is "-"] @@ -606,7 +625,7 @@ main (int argc, char **argv) if (7 != argc) { - fprintf (stderr, "Fatal: must supply 5 arguments!\n"); + fprintf (stderr, "Fatal: must supply 6 arguments!\n"); return 1; } if ( (0 == strcmp (argv[3], "-")) && @@ -615,13 +634,41 @@ main (int argc, char **argv) fprintf (stderr, "Fatal: disabling both IPv4 and IPv6 makes no sense.\n"); return 1; } + if (0 == access ("/sbin/iptables", X_OK)) + sbin_iptables = "/sbin/iptables"; + else if (0 == access ("/usr/sbin/iptables", X_OK)) + sbin_iptables = "/usr/sbin/iptables"; + else + { + fprintf (stderr, + "Fatal: executable iptables not found in approved directories: %s\n", + strerror (errno)); + return 1; + } + if (0 == access ("/sbin/sysctl", X_OK)) + sbin_sysctl = "/sbin/sysctl"; + else if (0 == access ("/usr/sbin/sysctl", X_OK)) + sbin_sysctl = "/usr/sbin/sysctl"; + else + { + fprintf (stderr, + "Fatal: executable sysctl not found in approved directories: %s\n", + strerror (errno)); + return 1; + } strncpy (dev, argv[1], IFNAMSIZ); dev[IFNAMSIZ - 1] = '\0'; if (-1 == (fd_tun = init_tun (dev))) { - fprintf (stderr, "Fatal: could not initialize tun-interface\n"); + fprintf (stderr, + "Fatal: could not initialize tun-interface `%s' with IPv6 %s/%s and IPv4 %s/%s\n", + dev, + argv[3], + argv[4], + argv[5], + argv[6]); return 1; } @@ -643,7 +690,7 @@ main (int argc, char **argv) { "sysctl", "-w", "net.ipv6.conf.all.forwarding=1", NULL }; - if (0 != fork_and_exec (SBIN_SYSCTL, + if (0 != fork_and_exec (sbin_sysctl, sysctl_args)) { fprintf (stderr, @@ -665,7 +712,7 @@ main (int argc, char **argv) { "sysctl", "-w", "net.ipv4.ip_forward=1", NULL }; - if (0 != fork_and_exec (SBIN_SYSCTL, + if (0 != fork_and_exec (sbin_sysctl, sysctl_args)) { fprintf (stderr, @@ -678,7 +725,7 @@ main (int argc, char **argv) { "iptables", "-t", "nat", "-A", "POSTROUTING", "-o", argv[2], "-j", "MASQUERADE", NULL }; - if (0 != fork_and_exec (SBIN_IPTABLES, + if (0 != fork_and_exec (sbin_iptables, iptables_args)) { fprintf (stderr,