emo/ndhc
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Support running an executable file when a new lease is acquired.

Browse Source 
If no 'script-file = SCRIPTFILE' is specified in the configuration
file and if no '-X SCRIPTFILE' or '--script-file SCRIPTFILE'
command argument is provided, then this functionality is entirely
inactive and no associated subprocess is spawned.

Otherwise, ndhc will spawn a subprocess that runs as root that has the
sole job of forking off a subprocess that exec's the specified script in
a sanitized and fixed-state environment whenever a new DHCPv4 lease is
acquired.

Note that this script is provided no information about ndhc or the
DHCP state in the environment or in any argument fields; it is the
responsibility of this script to gather whatever information it needs
from either the filesystem or syscalls.  This design is intended to
avoid the historical problems that are associated with dhcp clients
invoking scripts.

The path of the scriptfile cannot be changed after ndhc is initially
run; ndhc forks off the privsep script subprocess that executes scripts
after it has read the configuration file and command arguments, but
before it begins processing network data; thus, it is impossible for the
network-handling process to modify or influence the script assuming
proper OS memory protection.

The privsep channel communicates that the script should be run by simply
writing a newline; anything else will result in ndhc terminating itself.

Before the recommended way to update system state after a change in
lease information was to run the fcactus program and watch the
associated leasefile for the interface for modification; now no external
program is needed for this job.
This commit is contained in:
Nicholas J. Kain
2022-02-24 00:52:26 -05:00
parent 2fb16567f1
commit a9874d4959
10 changed files with 2246 additions and 1262 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
ndhc.c
View File

@ -43,6 +43,7 @@
#include "duiaid.h"
#include "sockd.h"
#include "rfkill.h"
#include "scriptd.h"
struct client_state_t cs = {
.program_init = true,
@ -400,12 +401,15 @@ static void do_ndhc_work(void)
char state_dir[PATH_MAX] = "/etc/ndhc";
char chroot_dir[PATH_MAX] = "";
char resolv_conf_d[PATH_MAX] = "";
char script_file[PATH_MAX] = "";
uid_t ndhc_uid = 0;
gid_t ndhc_gid = 0;
int ifchSock[2];
int sockdSock[2];
int ifchStream[2];
int sockdSock[2];
int sockdStream[2];
int scriptdSock[2];
int scriptdStream[2];
static void create_ifch_ipc_sockets(void) {
if (socketpair(AF_UNIX, SOCK_DGRAM, 0, ifchSock) < 0)
@ -418,7 +422,14 @@ static void create_sockd_ipc_sockets(void) {
if (socketpair(AF_UNIX, SOCK_DGRAM, 0, sockdSock) < 0)
suicide("FATAL - can't create ndhc/sockd socket: %s", strerror(errno));
if (socketpair(AF_UNIX, SOCK_STREAM, 0, sockdStream) < 0)
suicide("FATAL - can't create ndhc/ifch socket: %s", strerror(errno));
suicide("FATAL - can't create ndhc/sockd socket: %s", strerror(errno));
}
static void create_scriptd_ipc_sockets(void) {
if (socketpair(AF_UNIX, SOCK_DGRAM, 0, scriptdSock) < 0)
suicide("FATAL - can't create ndhc/scriptd socket: %s", strerror(errno));
if (socketpair(AF_UNIX, SOCK_STREAM, 0, scriptdStream) < 0)
suicide("FATAL - can't create ndhc/scriptd socket: %s", strerror(errno));
}
static void spawn_ifch(void)
@ -455,6 +466,28 @@ static void spawn_sockd(void)
suicide("failed to fork ndhc-sockd: %s", strerror(errno));
}
static void spawn_scriptd(void)
{
valid_script_file = access(script_file, R_OK | X_OK) == 0;
if (!valid_script_file) return;
log_line("Found script file: '%s'", script_file);
create_scriptd_ipc_sockets();
pid_t scriptd_pid = fork();
if (scriptd_pid == 0) {
close(scriptdSock[0]);
close(scriptdStream[0]);
// Don't share the RNG state with the master process.
nk_random_init(&cs.rnd_state);
scriptd_main();
} else if (scriptd_pid > 0) {
close(scriptdSock[1]);
close(scriptdStream[1]);
} else
suicide("failed to fork ndhc-scriptd: %s", strerror(errno));
}
static void ndhc_main(void) {
prctl(PR_SET_NAME, "ndhc: master");
log_line("ndhc client " NDHC_VERSION " started on interface [%s].",
@ -548,6 +581,7 @@ int main(int argc, char *argv[])
spawn_ifch();
spawn_sockd();
spawn_scriptd();
ndhc_main();
exit(EXIT_SUCCESS);
}