OpenVAS Manager  7.0.3~git
openvasmd.c File Reference

The OpenVAS Manager daemon. More...

#include <locale.h>
#include <arpa/inet.h>
#include <assert.h>
#include <errno.h>
#include <fcntl.h>
#include <glib.h>
#include <glib/gstdio.h>
#include <gnutls/gnutls.h>
#include <grp.h>
#include <netdb.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <pwd.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/select.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <openvas/misc/openvas_logging.h>
#include <openvas/misc/openvas_proctitle.h>
#include <openvas/misc/openvas_server.h>
#include <openvas/base/pidfile.h>
#include <openvas/base/pwpolicy.h>
#include "logf.h"
#include "manage.h"
#include "scanner.h"
#include "ompd.h"
#include "ovas-mngr-comm.h"
#include "utils.h"
#include <execinfo.h>
Include dependency graph for openvasmd.c:

Go to the source code of this file.

Data Structures

struct  connection_watcher_data_t
 

Macros

#define G_LOG_DOMAIN   "md main"
 GLib log domain. More...
 
#define OPENVASMD_VERSION   "-1"
 The version number of this program. More...
 
#define OPENVAS_OS_NAME   "-1"
 The name of the underlying Operating System. More...
 
#define OPENVASSD_ADDRESS   OPENVAS_RUN_DIR "/openvassd.sock"
 Scanner (openvassd) address. More...
 
#define SCANNERCERT   "/var/lib/openvas/CA/servercert.pem"
 Location of scanner certificate. More...
 
#define SCANNERKEY   "/var/lib/openvas/private/CA/serverkey.pem"
 Location of scanner certificate private key. More...
 
#define CACERT   "/var/lib/openvas/CA/cacert.pem"
 Location of Certificate Authority certificate. More...
 
#define CLIENTCERT   "/var/lib/openvas/CA/clientcert.pem"
 Location of client certificate. More...
 
#define CLIENTKEY   "/var/lib/openvas/private/CA/clientkey.pem"
 Location of client certificate private key. More...
 
#define OPENVASSD_PORT   9391
 Scanner port. More...
 
#define OPENVASMD_PORT   9390
 Manager port. More...
 
#define MAX_CONNECTIONS   512
 Second argument to ‘listen’. More...
 
#define DEFAULT_CLIENT_WATCH_INTERVAL   1
 Default value for client_watch_interval. More...
 
#define BA_SIZE   100
 

Functions

int serve_client (int server_socket, openvas_connection_t *client_connection)
 Serve the client. More...
 
void setup_signal_handler (int signal, void(*handler)(int), int block)
 Setup signal handler. More...
 
void setup_signal_handler_info (int signal, void(*handler)(int, siginfo_t *, void *), int block)
 Setup signal handler. More...
 
void handle_sigabrt (int given_signal)
 Handle a SIGABRT signal. More...
 
void handle_termination_signal (int signal)
 Handle a termination signal. More...
 
void handle_sighup_update (int signal)
 Handle a SIGHUP signal by updating the NVT cache. More...
 
void handle_sigsegv (int given_signal)
 Handle a SIGSEGV signal. More...
 
void handle_sigchld (int given_signal, siginfo_t *info, void *ucontext)
 Handle a SIGCHLD signal. More...
 
void spin_progress ()
 Nudge the progress indicator. More...
 
void handle_sigabrt_simple (int signal)
 Handle a SIGABRT signal. More...
 
int main (int argc, char **argv)
 Entry point to the manager. More...
 

Variables

int client_watch_interval = DEFAULT_CLIENT_WATCH_INTERVAL
 Interval in seconds to check whether client connection was closed. More...
 
int manager_socket = -1
 The socket accepting OMP connections from clients. More...
 
int manager_socket_2 = -1
 The optional, second socket accepting OMP connections from clients. More...
 
int use_tls = 0
 Whether to use TLS for client connections. More...
 
gnutls_session_t client_session
 The client session. More...
 
gnutls_certificate_credentials_t client_credentials
 The client credentials. More...
 
int is_parent = 1
 Is this process parent or child? More...
 
volatile int termination_signal = 0
 Flag for signal handlers. More...
 
volatile int sighup_update_nvt_cache = 0
 Flag for SIGHUP handler. More...
 
gboolean disable_encrypted_credentials
 Flag indicating that encrypted credentials are disabled. More...
 
gboolean scheduling_enabled
 Flag indicating that task scheduling is enabled. More...
 
char client_address [INET6_ADDRSTRLEN]
 The OMP client's address. More...
 
sigset_t * sigmask_normal = NULL
 Signal mask to restore when going from blocked to normal signaling. More...
 
gchar * priorities_option = "NORMAL"
 GnuTLS priorities. More...
 
gchar * dh_params_option = NULL
 GnuTLS DH params file. More...
 
int update_in_progress = 0
 Whether a SIGHUP initiated NVT update is in progress. More...
 
GSList * log_config = NULL
 Logging parameters, as passed to setup_log_handlers. More...
 

Detailed Description

The OpenVAS Manager daemon.

This file defines the OpenVAS Manager daemon. The Manager serves the OpenVAS Management Protocol (OMP) to clients such as OpenVAS-Client. The Manager and OMP give clients full access to an OpenVAS Scanner.

The entry point to the daemon is the main function. From there the references in the function documentation describe the flow of control in the program.

Definition in file openvasmd.c.

Macro Definition Documentation

◆ BA_SIZE

#define BA_SIZE   100

Definition at line 958 of file openvasmd.c.

◆ CACERT

#define CACERT   "/var/lib/openvas/CA/cacert.pem"

Location of Certificate Authority certificate.

Definition at line 165 of file openvasmd.c.

◆ CLIENTCERT

#define CLIENTCERT   "/var/lib/openvas/CA/clientcert.pem"

Location of client certificate.

Definition at line 172 of file openvasmd.c.

◆ CLIENTKEY

#define CLIENTKEY   "/var/lib/openvas/private/CA/clientkey.pem"

Location of client certificate private key.

Definition at line 179 of file openvasmd.c.

◆ DEFAULT_CLIENT_WATCH_INTERVAL

#define DEFAULT_CLIENT_WATCH_INTERVAL   1

Default value for client_watch_interval.

Definition at line 204 of file openvasmd.c.

◆ G_LOG_DOMAIN

#define G_LOG_DOMAIN   "md main"

GLib log domain.

Definition at line 126 of file openvasmd.c.

◆ MAX_CONNECTIONS

#define MAX_CONNECTIONS   512

Second argument to ‘listen’.

Definition at line 199 of file openvasmd.c.

◆ OPENVAS_OS_NAME

#define OPENVAS_OS_NAME   "-1"

The name of the underlying Operating System.

Definition at line 139 of file openvasmd.c.

◆ OPENVASMD_PORT

#define OPENVASMD_PORT   9390

Manager port.

Used if /etc/services "omp" and –sport are missing.

Definition at line 194 of file openvasmd.c.

◆ OPENVASMD_VERSION

#define OPENVASMD_VERSION   "-1"

The version number of this program.

Definition at line 132 of file openvasmd.c.

◆ OPENVASSD_ADDRESS

#define OPENVASSD_ADDRESS   OPENVAS_RUN_DIR "/openvassd.sock"

Scanner (openvassd) address.

Definition at line 145 of file openvasmd.c.

◆ OPENVASSD_PORT

#define OPENVASSD_PORT   9391

Scanner port.

Used if /etc/services "otp" and –port missing.

Definition at line 187 of file openvasmd.c.

◆ SCANNERCERT

#define SCANNERCERT   "/var/lib/openvas/CA/servercert.pem"

Location of scanner certificate.

Definition at line 151 of file openvasmd.c.

◆ SCANNERKEY

#define SCANNERKEY   "/var/lib/openvas/private/CA/serverkey.pem"

Location of scanner certificate private key.

Definition at line 158 of file openvasmd.c.

Function Documentation

◆ handle_sigabrt()

void handle_sigabrt ( int  given_signal)

Handle a SIGABRT signal.

Parameters
[in]given_signalThe signal that caused this function to run.

Definition at line 967 of file openvasmd.c.

968 {
969  static int in_sigabrt = 0;
970 
971  if (in_sigabrt) _exit (EXIT_FAILURE);
972  in_sigabrt = 1;
973 
974 #ifndef NDEBUG
975  void *frames[BA_SIZE];
976  int frame_count, index;
977  char **frames_text;
978 
979  /* Print a backtrace. */
980  frame_count = backtrace (frames, BA_SIZE);
981  frames_text = backtrace_symbols (frames, frame_count);
982  if (frames_text == NULL)
983  {
984  perror ("backtrace symbols");
985  frame_count = 0;
986  }
987  for (index = 0; index < frame_count; index++)
988  g_debug ("%s\n", frames_text[index]);
989  free (frames_text);
990 #endif
991 
992  manage_cleanup_process_error (given_signal);
993  cleanup ();
994  /* Raise signal again, to exit with the correct return value. */
995  setup_signal_handler (given_signal, SIG_DFL, 0);
996  raise (given_signal);
997 }
#define BA_SIZE
Definition: openvasmd.c:958
void setup_signal_handler(int signal, void(*handler)(int), int block)
Setup signal handler.
Definition: openvasmd.c:907
void manage_cleanup_process_error(int)
Cleanup as immediately as possible.
Definition: manage_sql.c:17154

References BA_SIZE, and manage_cleanup_process_error().

Here is the call graph for this function:

◆ handle_sigabrt_simple()

void handle_sigabrt_simple ( int  signal)

Handle a SIGABRT signal.

Parameters
[in]signalThe signal that caused this function to run.

Definition at line 1097 of file openvasmd.c.

1098 {
1099  exit (EXIT_FAILURE);
1100 }

◆ handle_sigchld()

void handle_sigchld ( int  given_signal,
siginfo_t *  info,
void *  ucontext 
)

Handle a SIGCHLD signal.

Parameters
[in]given_signalThe signal that caused this function to run.
[in]infoSignal info.
[in]ucontextUser context.

Definition at line 1052 of file openvasmd.c.

1053 {
1054  int status, pid;
1055  while ((pid = waitpid (-1, &status, WNOHANG)) > 0)
1056  if (update_in_progress == pid)
1057  /* This was the NVT update child, so allow updates again. */
1058  update_in_progress = 0;
1059 }
int update_in_progress
Whether a SIGHUP initiated NVT update is in progress.
Definition: openvasmd.c:305

References update_in_progress.

◆ handle_sighup_update()

void handle_sighup_update ( int  signal)

Handle a SIGHUP signal by updating the NVT cache.

Parameters
[in]signalThe signal that caused this function to run.

Definition at line 1018 of file openvasmd.c.

1019 {
1020  /* Queue the update of the NVT cache. */
1022 }
volatile int sighup_update_nvt_cache
Flag for SIGHUP handler.
Definition: openvasmd.c:261

References sighup_update_nvt_cache.

◆ handle_sigsegv()

void handle_sigsegv ( int  given_signal)

Handle a SIGSEGV signal.

Parameters
[in]given_signalThe signal that caused this function to run.

Definition at line 1030 of file openvasmd.c.

1031 {
1032  manage_cleanup_process_error (given_signal);
1033 
1034  /* This previously called "cleanup", but it seems that the regular manager
1035  * code runs again before the default handler is invoked, at least when the
1036  * SIGKILL is sent from the command line. This was leading to errors which
1037  * were preventing the default handler from running and dumping core. */
1038 
1039  /* Raise signal again, to exit with the correct return value. */
1040  setup_signal_handler (given_signal, SIG_DFL, 0);
1041  raise (given_signal);
1042 }
void setup_signal_handler(int signal, void(*handler)(int), int block)
Setup signal handler.
Definition: openvasmd.c:907
void manage_cleanup_process_error(int)
Cleanup as immediately as possible.
Definition: manage_sql.c:17154

References manage_cleanup_process_error(), and setup_signal_handler().

Here is the call graph for this function:

◆ handle_termination_signal()

void handle_termination_signal ( int  signal)

Handle a termination signal.

Parameters
[in]signalThe signal that caused this function to run.

Definition at line 1005 of file openvasmd.c.

1006 {
1007  termination_signal = signal;
1008 
1009  sql_cancel ();
1010 }
int sql_cancel()
volatile int termination_signal
Flag for signal handlers.
Definition: openvasmd.c:256

References sql_cancel(), and termination_signal.

Here is the call graph for this function:

◆ main()

int main ( int  argc,
char **  argv 
)

Entry point to the manager.

Parameters
[in]argcThe number of arguments in argv.
[in]argvThe list of arguments to the program.
Returns
EXIT_SUCCESS on success, EXIT_FAILURE on failure.

Definition at line 1691 of file openvasmd.c.

1692 {
1693  /* Process options. */
1694 
1695  static gboolean backup_database = FALSE;
1696  static gboolean check_alerts = FALSE;
1697  static gboolean migrate_database = FALSE;
1698  static gboolean encrypt_all_credentials = FALSE;
1699  static gboolean decrypt_all_credentials = FALSE;
1700  static gboolean disable_password_policy = FALSE;
1701  static gboolean disable_scheduling = FALSE;
1702  static gboolean get_users = FALSE;
1703  static gboolean get_scanners = FALSE;
1704  static gboolean update_nvt_cache = FALSE;
1705  static gboolean rebuild_nvt_cache = FALSE;
1706  static gboolean foreground = FALSE;
1707  static gboolean print_version = FALSE;
1708  static gboolean progress = FALSE;
1709  static int max_ips_per_target = MANAGE_MAX_HOSTS;
1710  static int max_email_attachment_size = 0;
1711  static int max_email_include_size = 0;
1712  static int max_email_message_size = 0;
1713  static int verbose = 0;
1714  static gchar *create_user = NULL;
1715  static gchar *delete_user = NULL;
1716  static gchar *inheritor = NULL;
1717  static gchar *user = NULL;
1718  static gchar *create_scanner = NULL;
1719  static gchar *modify_scanner = NULL;
1720  static gchar *scanner_host = NULL;
1721  static gchar *otp_scanner = NULL;
1722  static gchar *scanner_port = NULL;
1723  static gchar *scanner_type = NULL;
1724  static gchar *scanner_ca_pub = NULL;
1725  static gchar *scanner_key_pub = NULL;
1726  static gchar *scanner_key_priv = NULL;
1727  static int schedule_timeout = SCHEDULE_TIMEOUT_DEFAULT;
1728  static gchar *delete_scanner = NULL;
1729  static gchar *verify_scanner = NULL;
1730  static gchar *priorities = "NORMAL";
1731  static gchar *dh_params = NULL;
1732  static gchar *listen_owner = NULL;
1733  static gchar *listen_group = NULL;
1734  static gchar *listen_mode = NULL;
1735  static gchar *new_password = NULL;
1736  static gchar *optimize = NULL;
1737  static gchar *password = NULL;
1738  static gchar *manager_address_string = NULL;
1739  static gchar *manager_address_string_2 = NULL;
1740  static gchar *manager_address_string_unix = NULL;
1741  static gchar *manager_port_string = NULL;
1742  static gchar *manager_port_string_2 = NULL;
1743  static gchar *modify_setting = NULL;
1744  static gchar *scanner_name = NULL;
1745  static gchar *rc_name = NULL;
1746  static gchar *role = NULL;
1747  static gchar *disable = NULL;
1748  static gchar *value = NULL;
1749  GError *error = NULL;
1750  GOptionContext *option_context;
1751  static GOptionEntry option_entries[]
1752  = {
1753  { "backup", '\0', 0, G_OPTION_ARG_NONE, &backup_database, "Backup the database.", NULL },
1754  { "check-alerts", '\0', 0, G_OPTION_ARG_NONE, &check_alerts, "Check SecInfo alerts.", NULL },
1755  { "client-watch-interval", '\0', 0, G_OPTION_ARG_INT,
1757  "Check if client connection was closed every <number> seconds."
1758  " 0 to disable. Defaults to "
1759  G_STRINGIFY (DEFAULT_CLIENT_WATCH_INTERVAL) " seconds.",
1760  "<number>" },
1761  { "database", 'd', 0, G_OPTION_ARG_STRING, &database, "Use <file/name> as database for SQLite/Postgres.", "<file/name>" },
1762  { "disable-cmds", '\0', 0, G_OPTION_ARG_STRING, &disable, "Disable comma-separated <commands>.", "<commands>" },
1763  { "disable-encrypted-credentials", '\0', 0, G_OPTION_ARG_NONE,
1765  "Do not encrypt or decrypt credentials.", NULL },
1766  {"disable-password-policy", '\0', 0, G_OPTION_ARG_NONE,
1767  &disable_password_policy, "Do not restrict passwords to the policy.",
1768  NULL},
1769  { "disable-scheduling", '\0', 0, G_OPTION_ARG_NONE, &disable_scheduling, "Disable task scheduling.", NULL },
1770  { "create-user", '\0', 0, G_OPTION_ARG_STRING, &create_user, "Create admin user <username> and exit.", "<username>" },
1771  { "delete-user", '\0', 0, G_OPTION_ARG_STRING, &delete_user, "Delete user <username> and exit.", "<username>" },
1772  { "get-users", '\0', 0, G_OPTION_ARG_NONE, &get_users, "List users and exit.", NULL },
1773  { "create-scanner", '\0', 0, G_OPTION_ARG_STRING, &create_scanner,
1774  "Create global scanner <scanner> and exit.", "<scanner>" },
1775  { "modify-scanner", '\0', 0, G_OPTION_ARG_STRING, &modify_scanner,
1776  "Modify scanner <scanner-uuid> and exit.", "<scanner-uuid>" },
1777  { "scanner-name", '\0', 0, G_OPTION_ARG_STRING, &scanner_name, "Name for --modify-scanner.", "<name>" },
1778  { "scanner-host", '\0', 0, G_OPTION_ARG_STRING, &scanner_host,
1779  "Scanner host for --create-scanner and --modify-scanner. Default is " OPENVASSD_ADDRESS ".",
1780  "<scanner-host>" },
1781  { "otp-scanner", '\0', 0, G_OPTION_ARG_STRING, &otp_scanner,
1782  "Path to scanner unix socket file. Used by --rebuild and --update", "<unixsocket>" },
1783  { "scanner-port", '\0', 0, G_OPTION_ARG_STRING, &scanner_port,
1784  "Scanner port for --create-scanner and --modify-scanner. Default is " G_STRINGIFY (OPENVASSD_PORT) ".",
1785  "<scanner-port>" },
1786  { "scanner-type", '\0', 0, G_OPTION_ARG_STRING, &scanner_type,
1787  "Scanner type for --create-scanner and --mdoify-scanner. Either 'OpenVAS' or 'OSP'.",
1788  "<scanner-type>" },
1789  { "scanner-ca-pub", '\0', 0, G_OPTION_ARG_STRING, &scanner_ca_pub,
1790  "Scanner CA Certificate path for --[create|modify]-scanner.", "<scanner-ca-pub>" },
1791  { "scanner-key-pub", '\0', 0, G_OPTION_ARG_STRING, &scanner_key_pub,
1792  "Scanner Certificate path for --[create|modify]-scanner.", "<scanner-key-public>" },
1793  { "scanner-key-priv", '\0', 0, G_OPTION_ARG_STRING, &scanner_key_priv,
1794  "Scanner private key path for --[create|modify]-scanner.", "<scanner-key-private>" },
1795  { "verify-scanner", '\0', 0, G_OPTION_ARG_STRING, &verify_scanner,
1796  "Verify scanner <scanner-uuid> and exit.", "<scanner-uuid>" },
1797  { "delete-scanner", '\0', 0, G_OPTION_ARG_STRING, &delete_scanner, "Delete scanner <scanner-uuid> and exit.", "<scanner-uuid>" },
1798  { "get-scanners", '\0', 0, G_OPTION_ARG_NONE, &get_scanners, "List scanners and exit.", NULL },
1799  { "schedule-timeout", '\0', 0, G_OPTION_ARG_INT, &schedule_timeout, "Time out tasks that are more than <time> minutes overdue. -1 to disable, 0 for minimum time, default: " G_STRINGIFY (SCHEDULE_TIMEOUT_DEFAULT), "<time>" },
1800  { "foreground", 'f', 0, G_OPTION_ARG_NONE, &foreground, "Run in foreground.", NULL },
1801  { "inheritor", '\0', 0, G_OPTION_ARG_STRING, &inheritor, "Have <username> inherit from deleted user.", "<username>" },
1802  { "listen", 'a', 0, G_OPTION_ARG_STRING, &manager_address_string, "Listen on <address>.", "<address>" },
1803  { "listen2", '\0', 0, G_OPTION_ARG_STRING, &manager_address_string_2, "Listen also on <address>.", "<address>" },
1804  { "listen-owner", '\0', 0, G_OPTION_ARG_STRING, &listen_owner,
1805  "Owner of the unix socket", "<string>" },
1806  { "listen-group", '\0', 0, G_OPTION_ARG_STRING, &listen_group,
1807  "Group of the unix socket", "<string>" },
1808  { "listen-mode", '\0', 0, G_OPTION_ARG_STRING, &listen_mode,
1809  "File mode of the unix socket", "<string>" },
1810  { "max-ips-per-target", '\0', 0, G_OPTION_ARG_INT, &max_ips_per_target, "Maximum number of IPs per target.", "<number>"},
1811  { "max-email-attachment-size", '\0', 0, G_OPTION_ARG_INT, &max_email_attachment_size, "Maximum size of alert email attachments, in bytes.", "<number>"},
1812  { "max-email-include-size", '\0', 0, G_OPTION_ARG_INT, &max_email_include_size, "Maximum size of inlined content in alert emails, in bytes.", "<number>"},
1813  { "max-email-message-size", '\0', 0, G_OPTION_ARG_INT, &max_email_message_size, "Maximum size of user-defined message text in alert emails, in bytes.", "<number>"},
1814  { "migrate", 'm', 0, G_OPTION_ARG_NONE, &migrate_database, "Migrate the database and exit.", NULL },
1815  { "modify-setting", '\0', 0, G_OPTION_ARG_STRING, &modify_setting,
1816  "Modify setting <uuid> and exit.", "<uuid>" },
1817  { "encrypt-all-credentials", '\0', 0, G_OPTION_ARG_NONE,
1818  &encrypt_all_credentials, "(Re-)Encrypt all credentials.", NULL },
1819  { "decrypt-all-credentials", '\0',
1820  G_OPTION_FLAG_HIDDEN, G_OPTION_ARG_NONE,
1821  &decrypt_all_credentials, NULL, NULL },
1822  { "new-password", '\0', 0, G_OPTION_ARG_STRING, &new_password, "Modify user's password and exit.", "<password>" },
1823  { "optimize", '\0', 0, G_OPTION_ARG_STRING, &optimize, "Run an optimization: vacuum, analyze, cleanup-config-prefs, remove-open-port-results, cleanup-port-names, cleanup-result-severities, cleanup-schedule-times, rebuild-report-cache or update-report-cache.", "<name>" },
1824  { "password", '\0', 0, G_OPTION_ARG_STRING, &password, "Password, for --create-user.", "<password>" },
1825  { "port", 'p', 0, G_OPTION_ARG_STRING, &manager_port_string, "Use port number <number>.", "<number>" },
1826  { "port2", '\0', 0, G_OPTION_ARG_STRING, &manager_port_string_2, "Use port number <number> for address 2.", "<number>" },
1827  { "progress", '\0', 0, G_OPTION_ARG_NONE, &progress, "Display progress during --rebuild and --update.", NULL },
1828  { "rebuild", '\0', 0, G_OPTION_ARG_NONE, &rebuild_nvt_cache, "Rebuild the NVT cache and exit.", NULL },
1829  { "role", '\0', 0, G_OPTION_ARG_STRING, &role, "Role for --create-user and --get-users.", "<role>" },
1830  { "update", 'u', 0, G_OPTION_ARG_NONE, &update_nvt_cache, "Update the NVT cache and exit.", NULL },
1831  { "unix-socket", 'c', 0, G_OPTION_ARG_STRING, &manager_address_string_unix, "Listen on UNIX socket at <filename>.", "<filename>" },
1832  { "user", '\0', 0, G_OPTION_ARG_STRING, &user, "User for --new-password.", "<username>" },
1833  { "gnutls-priorities", '\0', 0, G_OPTION_ARG_STRING, &priorities, "Sets the GnuTLS priorities for the Manager socket.", "<priorities-string>" },
1834  { "dh-params", '\0', 0, G_OPTION_ARG_STRING, &dh_params, "Diffie-Hellman parameters file", "<file>" },
1835  { "value", '\0', 0, G_OPTION_ARG_STRING, &value, "Value for --modify-setting.", "<value>" },
1836  { "verbose", 'v', 0, G_OPTION_ARG_NONE, &verbose, "Has no effect. See INSTALL for logging config.", NULL },
1837  { "version", '\0', 0, G_OPTION_ARG_NONE, &print_version, "Print version and exit.", NULL },
1838  { NULL }
1839  };
1840 
1841  /* Set locale based on environment variables. */
1842 
1843  setlocale (LC_ALL, "C.UTF-8");
1844 
1845  /* Process options. */
1846 
1847  option_context = g_option_context_new ("- Manager of the Open Vulnerability Assessment System");
1848  g_option_context_add_main_entries (option_context, option_entries, NULL);
1849  if (!g_option_context_parse (option_context, &argc, &argv, &error))
1850  {
1851  g_option_context_free (option_context);
1852  g_critical ("%s: g_option_context_parse: %s\n\n", __FUNCTION__,
1853  error->message);
1854  exit (EXIT_FAILURE);
1855  }
1856  g_option_context_free (option_context);
1857 
1858  if (print_version)
1859  {
1860  printf ("OpenVAS Manager %s\n", OPENVASMD_VERSION);
1861 #ifdef OPENVASMD_GIT_REVISION
1862  printf ("GIT revision %s\n", OPENVASMD_GIT_REVISION);
1863 #endif
1864  printf ("Manager DB revision %i\n", manage_db_supported_version ());
1865  printf ("Copyright (C) 2010-2016 Greenbone Networks GmbH\n");
1866  printf ("License GPLv2+: GNU GPL version 2 or later\n");
1867  printf
1868  ("This is free software: you are free to change and redistribute it.\n"
1869  "There is NO WARRANTY, to the extent permitted by law.\n\n");
1870  exit (EXIT_SUCCESS);
1871  }
1872 
1873  /* Ensure client_watch_interval is not negative */
1874 
1875  if (client_watch_interval < 0)
1876  {
1878  }
1879 
1880  /* Set schedule_timeout */
1881 
1882  set_schedule_timeout (schedule_timeout);
1883 
1884  /* Check which type of socket to use. */
1885 
1886  if (manager_address_string_unix == NULL)
1887  {
1888  if (manager_address_string || manager_address_string_2)
1889  use_tls = 1;
1890  else
1891  {
1892  use_tls = 0;
1893  manager_address_string_unix = g_build_filename (OPENVAS_RUN_DIR,
1894  "openvasmd.sock",
1895  NULL);
1896  }
1897  }
1898  else
1899  {
1900  use_tls = 0;
1901  if (manager_address_string || manager_address_string_2)
1902  {
1903  g_critical ("%s: --listen or --listen2 given with --unix-socket\n",
1904  __FUNCTION__);
1905  return EXIT_FAILURE;
1906  }
1907  }
1908 
1909  if (use_tls == 0
1910  && (manager_port_string || manager_port_string_2))
1911  {
1912  g_critical ("%s: --port or --port2 given when listening on UNIX socket\n",
1913  __FUNCTION__);
1914  return EXIT_FAILURE;
1915  }
1916 
1917  /* Set process title. */
1918 
1919  proctitle_init (argc, argv);
1920  proctitle_set ("openvasmd: Initializing.");
1921 
1922  /* Setup initial signal handlers. */
1923 
1925 
1926  /* Switch to UTC for scheduling. */
1927 
1928  if (migrate_database
1930  g_info ("%s: leaving TZ as is, for migrator\n", __FUNCTION__);
1931  else if (setenv ("TZ", "utc 0", 1) == -1)
1932  {
1933  g_critical ("%s: failed to set timezone\n", __FUNCTION__);
1934  exit (EXIT_FAILURE);
1935  }
1936  tzset ();
1937 
1938  /* Set umask to hoard created files, including the database. */
1939 
1940  umask (S_IRGRP | S_IWGRP | S_IXGRP | S_IROTH | S_IWOTH | S_IXOTH);
1941 
1942  /* Setup logging. */
1943 
1944  rc_name = g_build_filename (OPENVAS_SYSCONF_DIR,
1945  "openvasmd_log.conf",
1946  NULL);
1947  if (g_file_test (rc_name, G_FILE_TEST_EXISTS))
1948  log_config = load_log_configuration (rc_name);
1949  g_free (rc_name);
1950  setup_log_handlers (log_config);
1951 
1952 #ifdef OPENVASMD_GIT_REVISION
1953  g_message (" OpenVAS Manager version %s (GIT revision %s) (DB revision %i)\n",
1955  OPENVASMD_GIT_REVISION,
1957 #else
1958  g_message (" OpenVAS Manager version %s (DB revision %i)\n",
1961 #endif
1962 
1963  if (backup_database)
1964  {
1965  g_info (" Backing up database.\n");
1966 
1967  /* Backup the database and then exit. */
1968  switch (manage_backup_db (database))
1969  {
1970  case 0:
1971  g_info (" Backup succeeded.\n");
1972  return EXIT_SUCCESS;
1973  case -1:
1974  g_critical ("%s: database backup failed\n",
1975  __FUNCTION__);
1976  return EXIT_FAILURE;
1977  default:
1978  assert (0);
1979  g_critical ("%s: strange return from manage_backup_db\n",
1980  __FUNCTION__);
1981  return EXIT_FAILURE;
1982  }
1983  }
1984 
1985  if (disable_password_policy)
1986  openvas_disable_password_policy ();
1987  else
1988  {
1989  gchar *password_policy;
1990  password_policy = g_build_filename (OPENVAS_SYSCONF_DIR,
1991  "pwpolicy.conf",
1992  NULL);
1993  if (g_file_test (password_policy, G_FILE_TEST_EXISTS) == FALSE)
1994  g_warning ("%s: password policy missing: %s\n",
1995  __FUNCTION__,
1996  password_policy);
1997  g_free (password_policy);
1998  }
1999 
2000  if (optimize)
2001  {
2002  int ret;
2003 
2004  ret = manage_optimize (log_config, database, optimize);
2005  log_config_free ();
2006  if (ret)
2007  return EXIT_FAILURE;
2008  return EXIT_SUCCESS;
2009  }
2010 
2011  if (create_scanner)
2012  {
2013  int ret;
2014  scanner_type_t type;
2015  char *stype;
2016 
2017  /* Create the scanner and then exit. */
2018 
2019  if (!scanner_host)
2021  if (!scanner_port)
2022  scanner_port = G_STRINGIFY (OPENVASSD_PORT);
2023  if (!scanner_ca_pub)
2025  if (!scanner_key_pub)
2027  if (!scanner_key_priv)
2029 
2030  if (!scanner_type || !strcasecmp (scanner_type, "OpenVAS"))
2031  type = SCANNER_TYPE_OPENVAS;
2032  else if (!strcasecmp (scanner_type, "OSP"))
2033  type = SCANNER_TYPE_OSP;
2034  else
2035  {
2036  printf ("Invalid scanner type value.\n");
2037  return EXIT_FAILURE;
2038  }
2039  stype = g_strdup_printf ("%u", type);
2041  scanner_host, scanner_port, stype,
2044  g_free (stype);
2045  log_config_free ();
2046  if (ret)
2047  return EXIT_FAILURE;
2048  return EXIT_SUCCESS;
2049  }
2050 
2051  if (modify_scanner)
2052  {
2053  int ret;
2054  char *stype;
2055 
2056  /* Modify the scanner and then exit. */
2057 
2058  if (scanner_type)
2059  {
2060  scanner_type_t type;
2061 
2062  if (strcasecmp (scanner_type, "OpenVAS") == 0)
2063  type = SCANNER_TYPE_OPENVAS;
2064  else if (strcasecmp (scanner_type, "OSP") == 0)
2065  type = SCANNER_TYPE_OSP;
2066  else
2067  {
2068  g_warning ("Invalid scanner type value.\n");
2069  return EXIT_FAILURE;
2070  }
2071 
2072  stype = g_strdup_printf ("%u", type);
2073  }
2074  else
2075  stype = NULL;
2076 
2081  g_free (stype);
2082  log_config_free ();
2083  if (ret)
2084  return EXIT_FAILURE;
2085  return EXIT_SUCCESS;
2086  }
2087 
2088  if (check_alerts)
2089  {
2090  int ret;
2091 
2092  ret = manage_check_alerts (log_config, database);
2093  log_config_free ();
2094  if (ret)
2095  return EXIT_FAILURE;
2096  return EXIT_SUCCESS;
2097  }
2098 
2099  if (create_user)
2100  {
2101  int ret;
2102 
2103  ret = manage_create_user (log_config, database, create_user, password, role);
2104  log_config_free ();
2105  if (ret)
2106  return EXIT_FAILURE;
2107  return EXIT_SUCCESS;
2108  }
2109 
2110  if (delete_user)
2111  {
2112  int ret;
2113 
2114  ret = manage_delete_user (log_config, database, delete_user, inheritor);
2115  log_config_free ();
2116  if (ret)
2117  return EXIT_FAILURE;
2118  return EXIT_SUCCESS;
2119  }
2120 
2121  if (get_users)
2122  {
2123  int ret;
2124 
2125  ret = manage_get_users (log_config, database, role);
2126  log_config_free ();
2127  if (ret)
2128  return EXIT_FAILURE;
2129  return EXIT_SUCCESS;
2130  }
2131 
2132  if (get_scanners)
2133  {
2134  int ret;
2135 
2136  ret = manage_get_scanners (log_config, database);
2137  log_config_free ();
2138  if (ret)
2139  return EXIT_FAILURE;
2140  return EXIT_SUCCESS;
2141  }
2142 
2143  if (delete_scanner)
2144  {
2145  int ret;
2146 
2147  ret = manage_delete_scanner (log_config, database, delete_scanner);
2148  log_config_free ();
2149  if (ret)
2150  return EXIT_FAILURE;
2151  return EXIT_SUCCESS;
2152  }
2153 
2154  if (verify_scanner)
2155  {
2156  int ret;
2157 
2158  ret = manage_verify_scanner (log_config, database, verify_scanner);
2159  log_config_free ();
2160  if (ret)
2161  return EXIT_FAILURE;
2162  return EXIT_SUCCESS;
2163  }
2164 
2165  if (new_password)
2166  {
2167  int ret;
2168 
2169  ret = manage_set_password (log_config, database, user, new_password);
2170  log_config_free ();
2171  if (ret)
2172  return EXIT_FAILURE;
2173  return EXIT_SUCCESS;
2174  }
2175 
2176  if (modify_setting)
2177  {
2178  int ret;
2179 
2180  ret = manage_modify_setting (log_config, database, user,
2181  modify_setting, value);
2182  log_config_free ();
2183  if (ret)
2184  return EXIT_FAILURE;
2185  return EXIT_SUCCESS;
2186  }
2187 
2188  if (migrate_database)
2189  {
2190  g_info (" Migrating database.\n");
2191 
2192  /* Migrate the database to the version supported by this manager. */
2193  switch (manage_migrate (log_config, database))
2194  {
2195  case 0:
2196  g_info (" Migration succeeded.\n");
2197  return EXIT_SUCCESS;
2198  case 1:
2199  g_warning ("%s: databases are already at the supported version\n",
2200  __FUNCTION__);
2201  return EXIT_SUCCESS;
2202  case 2:
2203  g_warning ("%s: database migration too hard\n",
2204  __FUNCTION__);
2205  return EXIT_FAILURE;
2206  case 11:
2207  g_warning ("%s: cannot migrate SCAP database\n",
2208  __FUNCTION__);
2209  return EXIT_FAILURE;
2210  case 12:
2211  g_warning ("%s: cannot migrate CERT database\n",
2212  __FUNCTION__);
2213  return EXIT_FAILURE;
2214  case -1:
2215  g_critical ("%s: database migration failed\n",
2216  __FUNCTION__);
2217  return EXIT_FAILURE;
2218  case -11:
2219  g_critical ("%s: SCAP database migration failed\n",
2220  __FUNCTION__);
2221  return EXIT_FAILURE;
2222  case -12:
2223  g_critical ("%s: CERT database migration failed\n",
2224  __FUNCTION__);
2225  return EXIT_FAILURE;
2226  default:
2227  assert (0);
2228  g_critical ("%s: strange return from manage_migrate\n",
2229  __FUNCTION__);
2230  return EXIT_FAILURE;
2231  }
2232  }
2233 
2234  if (encrypt_all_credentials)
2235  {
2236  int ret;
2237 
2238  ret = manage_encrypt_all_credentials (log_config, database);
2239  log_config_free ();
2240  if (ret)
2241  return EXIT_FAILURE;
2242  return EXIT_SUCCESS;
2243  }
2244 
2245  if (decrypt_all_credentials)
2246  {
2247  int ret;
2248 
2249  ret = manage_decrypt_all_credentials (log_config, database);
2250  log_config_free ();
2251  if (ret)
2252  return EXIT_FAILURE;
2253  return EXIT_SUCCESS;
2254  }
2255 
2256  if (update_nvt_cache || rebuild_nvt_cache)
2257  {
2258  int ret;
2259 
2260  /* Run the NVT caching manager: update NVT cache and then exit. */
2261 
2262  /* Use --otp-scanner if provided instead of default scanner. */
2263  if (otp_scanner)
2264  {
2265  openvas_scanner_set_unix (otp_scanner);
2267  {
2269  return EXIT_FAILURE;
2270  }
2271  }
2272  if (progress)
2273  {
2274  if (update_nvt_cache)
2275  printf ("Updating NVT cache... \\");
2276  else
2277  printf ("Rebuilding NVT cache... \\");
2278  fflush (stdout);
2279  }
2280  ret = rebuild_nvt_cache_retry (update_nvt_cache, 1,
2281  progress ? spin_progress : NULL,
2282  0);
2283  if (progress)
2284  {
2285  putchar ('\b');
2286  if (ret == EXIT_SUCCESS)
2287  printf ("done.\n");
2288  else
2289  printf ("failed.\n");
2290  fflush (stdout);
2291  }
2292  return ret;
2293  }
2294 
2295  /* Run the standard manager. */
2296 
2297  if (foreground == FALSE)
2298  {
2299  /* Fork into the background. */
2300  pid_t pid = fork ();
2301  switch (pid)
2302  {
2303  case 0:
2304  /* Child. */
2305  break;
2306  case -1:
2307  /* Parent when error. */
2308  g_critical ("%s: failed to fork into background: %s\n",
2309  __FUNCTION__,
2310  strerror (errno));
2311  log_config_free ();
2312  exit (EXIT_FAILURE);
2313  break;
2314  default:
2315  /* Parent. */
2316  log_config_free ();
2317  exit (EXIT_SUCCESS);
2318  break;
2319  }
2320  }
2321 
2322  /* Initialise OMP daemon. */
2323 
2324  switch (init_ompd (log_config, 0, database, max_ips_per_target,
2325  max_email_attachment_size, max_email_include_size,
2326  max_email_message_size, NULL,
2327  fork_connection_for_event, 0))
2328  {
2329  case 0:
2330  break;
2331  case -2:
2332  g_critical ("%s: database is wrong version\n", __FUNCTION__);
2333  log_config_free ();
2334  exit (EXIT_FAILURE);
2335  break;
2336  case -3:
2337  g_critical ("%s: database must be initialised"
2338  " (with --update or --rebuild)\n",
2339  __FUNCTION__);
2340  log_config_free ();
2341  exit (EXIT_FAILURE);
2342  break;
2343  case -4:
2344  g_critical ("%s: --max-ips-per-target out of range"
2345  " (min=1, max=%i, requested=%i)\n",
2346  __FUNCTION__,
2348  max_ips_per_target);
2349  log_config_free ();
2350  exit (EXIT_FAILURE);
2351  break;
2352  case -1:
2353  default:
2354  g_critical ("%s: failed to initialise OMP daemon\n", __FUNCTION__);
2355  log_config_free ();
2356  exit (EXIT_FAILURE);
2357  }
2358 
2359  /* Register the `cleanup' function. */
2360 
2361  if (atexit (&cleanup))
2362  {
2363  g_critical ("%s: failed to register `atexit' cleanup function\n",
2364  __FUNCTION__);
2365  log_config_free ();
2366  exit (EXIT_FAILURE);
2367  }
2368 
2369  /* Set our pidfile. */
2370 
2371  if (pidfile_create ("openvasmd")) exit (EXIT_FAILURE);
2372 
2373  /* Setup global variables. */
2374 
2375  if (disable)
2376  disabled_commands = g_strsplit (disable, ",", 0);
2377 
2378  scheduling_enabled = (disable_scheduling == FALSE);
2379 
2380  /* Create the manager socket(s). */
2381 
2382 #if LOG
2383  /* Open the log file. */
2384 
2385  if (g_mkdir_with_parents (OPENVAS_LOG_DIR,
2386  0755) /* "rwxr-xr-x" */
2387  == -1)
2388  {
2389  g_critical ("%s: failed to create log directory: %s\n",
2390  __FUNCTION__,
2391  strerror (errno));
2392  exit (EXIT_FAILURE);
2393  }
2394 
2395  log_stream = fopen (LOG_FILE, "w");
2396  if (log_stream == NULL)
2397  {
2398  g_critical ("%s: failed to open log file: %s\n",
2399  __FUNCTION__,
2400  strerror (errno));
2401  exit (EXIT_FAILURE);
2402  }
2403 #endif
2404 
2405  /* Register the signal handlers. */
2406 
2408  setup_signal_handler (SIGABRT, handle_sigabrt, 1);
2412  setup_signal_handler (SIGSEGV, handle_sigsegv, 1);
2414 
2415  /* Setup security. */
2416 
2417  if (use_tls)
2418  {
2419  if (openvas_server_new (GNUTLS_SERVER,
2420  CACERT,
2421  SCANNERCERT,
2422  SCANNERKEY,
2423  &client_session,
2425  {
2426  g_critical ("%s: client server initialisation failed\n",
2427  __FUNCTION__);
2428  exit (EXIT_FAILURE);
2429  }
2430  priorities_option = priorities;
2431  set_gnutls_priority (&client_session, priorities);
2432  dh_params_option = dh_params;
2433  if (dh_params && set_gnutls_dhparams (client_credentials, dh_params))
2434  g_warning ("Couldn't set DH parameters from %s\n", dh_params);
2435  }
2436 
2438  g_message ("Encryption of credentials has been disabled.");
2439 
2440  if (manager_listen (use_tls
2441  ? NULL
2442  : manager_address_string_unix,
2443  use_tls
2444  ? (manager_address_string
2445  ? manager_address_string
2446  : (ipv6_is_enabled () ? "::" : "0.0.0.0"))
2447  : NULL,
2448  manager_port_string,
2449  listen_owner,
2450  listen_group,
2451  listen_mode,
2452  &manager_socket))
2453  return EXIT_FAILURE;
2454  if (manager_listen (NULL,
2455  manager_address_string_2,
2456  manager_port_string_2,
2457  NULL,
2458  NULL,
2459  NULL,
2460  &manager_socket_2))
2461  return EXIT_FAILURE;
2462 
2463  /* Initialise the process for manage_schedule. */
2464 
2465  init_manage_process (0, database);
2466 
2467  /* Initialize the authentication system. */
2468 
2469  // TODO Should be part of manage init.
2470  if (openvas_auth_init ())
2471  exit (EXIT_FAILURE);
2472 
2473  /* Enter the main forever-loop. */
2474 
2475  proctitle_set ("openvasmd");
2476  serve_and_schedule ();
2477 
2478  return EXIT_SUCCESS;
2479 }
void handle_sigsegv(int given_signal)
Handle a SIGSEGV signal.
Definition: openvasmd.c:1030
void init_manage_process(int, const gchar *)
Initialize the manage library for a process.
Definition: manage_sql.c:14303
int delete_user(const char *, const char *, int, int, const char *, const char *)
#define LOG_FILE
Name of log file.
Definition: logf.h:51
void handle_sigabrt_simple(int signal)
Handle a SIGABRT signal.
Definition: openvasmd.c:1097
GSList * log_config
Logging parameters, as passed to setup_log_handlers.
Definition: openvasmd.c:310
int modify_scanner(const char *, const char *, const char *, const char *, const char *, const char *, const char *, const char *)
int use_tls
Whether to use TLS for client connections.
Definition: openvasmd.c:231
#define SCANNERKEY
Location of scanner certificate private key.
Definition: openvasmd.c:158
int manager_socket_2
The optional, second socket accepting OMP connections from clients.
Definition: openvasmd.c:219
int client_watch_interval
Interval in seconds to check whether client connection was closed.
Definition: openvasmd.c:209
int manage_verify_scanner(GSList *, const gchar *, const gchar *)
int verify_scanner(const char *, char **)
int manage_get_users(GSList *, const gchar *, const gchar *)
int manage_encrypt_all_credentials(GSList *, const gchar *)
Encrypt or re-encrypt all credentials.
Definition: manage_sql.c:6567
int create_user(const gchar *, const gchar *, const gchar *, int, const gchar *, int, const array_t *, array_t *, gchar **, array_t *, gchar **, gchar **, user_t *, int)
int manage_modify_scanner(GSList *, const gchar *, const char *, const char *, const char *, const char *, const char *, const char *, const char *, const char *)
void handle_sigchld(int given_signal, siginfo_t *info, void *ucontext)
Handle a SIGCHLD signal.
Definition: openvasmd.c:1052
int delete_scanner(const char *, int)
gnutls_session_t client_session
The client session.
Definition: openvasmd.c:236
int manage_optimize(GSList *, const gchar *, const gchar *)
#define MANAGE_ABSOLUTE_MAX_IPS_PER_TARGET
Absolute maximum number of IPs per target.
Definition: manage.h:1531
void handle_sighup_update(int signal)
Handle a SIGHUP signal by updating the NVT cache.
Definition: openvasmd.c:1018
void setup_signal_handler_info(int signal, void(*handler)(int, siginfo_t *, void *), int block)
Setup signal handler.
Definition: openvasmd.c:935
int manage_backup_db(const gchar *)
Backup the database to a file.
Definition: manage_pg.c:2680
#define OPENVASSD_ADDRESS
Scanner (openvassd) address.
Definition: openvasmd.c:145
int manage_create_scanner(GSList *, const char *, const char *, const char *, const char *, const char *, const char *, const char *, const char *)
#define DEFAULT_CLIENT_WATCH_INTERVAL
Default value for client_watch_interval.
Definition: openvasmd.c:204
void(* progress)()
Function to mark progress.
Definition: manage_sql.c:352
gnutls_certificate_credentials_t client_credentials
The client credentials.
Definition: openvasmd.c:241
int manage_migrate(GSList *, const gchar *)
Migrate database to version supported by this manager.
int manage_create_user(GSList *, const gchar *, const gchar *, const gchar *, const gchar *)
void handle_sigabrt(int given_signal)
Handle a SIGABRT signal.
Definition: openvasmd.c:967
int manage_decrypt_all_credentials(GSList *, const gchar *)
Decrypt all credentials.
Definition: manage_sql.c:6599
#define CLIENTCERT
Location of client certificate.
Definition: openvasmd.c:172
void set_schedule_timeout(int new_timeout)
Set the schedule timeout.
Definition: manage.c:6928
char * scanner_host(scanner_t)
int scanner_port(scanner_t)
void handle_termination_signal(int signal)
Handle a termination signal.
Definition: openvasmd.c:1005
int manage_set_password(GSList *, const gchar *, const gchar *, const gchar *)
int manage_modify_setting(GSList *, const gchar *, const gchar *, const gchar *, const char *)
char * scanner_ca_pub(scanner_t)
#define SCANNERCERT
Location of scanner certificate.
Definition: openvasmd.c:151
gchar * dh_params_option
GnuTLS DH params file.
Definition: openvasmd.c:300
int openvas_scanner_connect()
Create a new connection to the scanner and set it as current scanner.
Definition: scanner.c:619
gboolean manage_migrate_needs_timezone(GSList *, const gchar *)
Check whether the migration needs the real timezone.
char * scanner_key_priv(scanner_t)
#define MANAGE_MAX_HOSTS
Default maximum number of hosts a target may specify.
Definition: manage.h:1536
int init_ompd(GSList *log_config, int nvt_cache_mode, const gchar *database, int max_ips_per_target, int max_email_attachment_size, int max_email_include_size, int max_email_message_size, void(*progress)(), int(*fork_connection)(openvas_connection_t *, gchar *), int skip_db_check)
Initialise the OMP library for the OMP daemon.
Definition: ompd.c:117
int openvas_scanner_init(int cache_mode)
Initializes the already setup connection with the Scanner.
Definition: scanner.c:778
#define OPENVASMD_VERSION
The version number of this program.
Definition: openvasmd.c:132
int manage_db_supported_version()
Return the database version supported by this manager.
Definition: manage_sql.c:6250
int openvas_scanner_set_unix(const char *path)
Set the scanner's unix socket path.
Definition: scanner.c:833
#define g_info(...)
Defines g_info for glib versions older than 2.40.
Definition: manage.h:55
#define CLIENTKEY
Location of client certificate private key.
Definition: openvasmd.c:179
#define CACERT
Location of Certificate Authority certificate.
Definition: openvasmd.c:165
int manage_delete_scanner(GSList *, const gchar *, const gchar *)
int manage_check_alerts(GSList *, const gchar *)
Check if any SecInfo alerts are due.
Definition: manage_sql.c:6886
char * scanner_name(scanner_t)
scanner_type
Scanner types.
Definition: manage.h:267
void setup_signal_handler(int signal, void(*handler)(int), int block)
Setup signal handler.
Definition: openvasmd.c:907
int modify_setting(const gchar *, const gchar *, const gchar *, gchar **)
gboolean scheduling_enabled
Flag indicating that task scheduling is enabled.
Definition: openvasmd.c:280
#define SCHEDULE_TIMEOUT_DEFAULT
Default for schedule_timeout in minutes.
Definition: manage.h:2803
void spin_progress()
Nudge the progress indicator.
Definition: openvasmd.c:1067
enum scanner_type scanner_type_t
Scanner types.
int create_scanner(const char *, const char *, const char *, const char *, const char *, scanner_t *, const char *, const char *)
#define OPENVASSD_PORT
Scanner port.
Definition: openvasmd.c:187
gboolean disable_encrypted_credentials
Flag indicating that encrypted credentials are disabled.
Definition: openvasmd.c:275
gchar * priorities_option
GnuTLS priorities.
Definition: openvasmd.c:295
int manage_get_scanners(GSList *, const gchar *)
int manage_delete_user(GSList *, const gchar *, const gchar *, const gchar *)
char * scanner_key_pub(scanner_t)
int manager_socket
The socket accepting OMP connections from clients.
Definition: openvasmd.c:214
int openvas_scanner_close()
Finish the connection to the Scanner and free internal buffers.
Definition: scanner.c:551

◆ serve_client()

int serve_client ( int  server_socket,
openvas_connection_t *  client_connection 
)

Serve the client.

Connect to the openvassd scanner, then call serve_omp to serve OMP.

In all cases, close client_socket before returning.

Parameters
[in]server_socketThe socket connected to the Manager.
[in]client_connectionThe connection to the client.
Returns
EXIT_SUCCESS on success, EXIT_FAILURE on failure.

Definition at line 435 of file openvasmd.c.

436 {
437  pthread_t watch_thread;
438  connection_watcher_data_t *watcher_data;
439 
440  if (server_socket > 0)
441  {
442  int optval;
443 
444  optval = 1;
445  if (setsockopt (server_socket,
446  SOL_SOCKET, SO_KEEPALIVE,
447  &optval, sizeof (int)))
448  {
449  g_critical ("%s: failed to set SO_KEEPALIVE on scanner socket: %s\n",
450  __FUNCTION__,
451  strerror (errno));
452  exit (EXIT_FAILURE);
453  }
454  }
455 
457  {
458  watcher_data = connection_watcher_data_new (client_connection);
459  pthread_create (&watch_thread, NULL, watch_client_connection,
460  watcher_data);
461  }
462  else
463  {
464  watcher_data = NULL;
465  }
466 
467  if (client_connection->tls
468  && openvas_server_attach (client_connection->socket, &client_session))
469  {
470  g_debug ("%s: failed to attach client session to socket %i\n",
471  __FUNCTION__,
472  client_connection->socket);
473  goto fail;
474  }
475 
476  /* The socket must have O_NONBLOCK set, in case an "asynchronous network
477  * error" removes the data between `select' and `read'. */
478  if (fcntl (client_connection->socket, F_SETFL, O_NONBLOCK) == -1)
479  {
480  g_warning ("%s: failed to set real client socket flag: %s\n",
481  __FUNCTION__,
482  strerror (errno));
483  goto fail;
484  }
485 
486  /* Serve OMP. */
487 
488  /* It's up to serve_omp to openvas_server_free client_*. */
489  if (serve_omp (client_connection, database, disabled_commands, NULL))
490  goto server_fail;
491 
492  if (watcher_data)
493  {
494  pthread_mutex_lock (&(watcher_data->mutex));
495  watcher_data->connection_closed = 1;
496  pthread_mutex_unlock (&(watcher_data->mutex));
497  pthread_cancel (watch_thread);
498  pthread_join (watch_thread, NULL);
499  g_free (watcher_data);
500  }
501  return EXIT_SUCCESS;
502 
503  fail:
504  if (watcher_data)
505  {
506  pthread_mutex_lock (&(watcher_data->mutex));
507  openvas_connection_free (client_connection);
508  watcher_data->connection_closed = 1;
509  pthread_mutex_unlock (&(watcher_data->mutex));
510  }
511  else
512  {
513  openvas_connection_free (client_connection);
514  }
515  server_fail:
516  if (watcher_data)
517  {
518  pthread_mutex_lock (&(watcher_data->mutex));
519  watcher_data->connection_closed = 1;
520  pthread_mutex_unlock (&(watcher_data->mutex));
521  pthread_cancel (watch_thread);
522  pthread_join (watch_thread, NULL);
523  g_free (watcher_data);
524  }
525  return EXIT_FAILURE;
526 }
int client_watch_interval
Interval in seconds to check whether client connection was closed.
Definition: openvasmd.c:209
gnutls_session_t client_session
The client session.
Definition: openvasmd.c:236
int serve_omp(openvas_connection_t *client_connection, const gchar *database, gchar **disable, void(*progress)())
Serve the OpenVAS Management Protocol (OMP).
Definition: ompd.c:493
pthread_mutex_t mutex
Definition: openvasmd.c:339

References client_watch_interval.

◆ setup_signal_handler()

void setup_signal_handler ( int  signal,
void(*)(int)  handler,
int  block 
)

Setup signal handler.

Exit on failure.

Parameters
[in]signalSignal.
[in]handlerHandler.
[in]blockWhether to block all other signals during handler.

Definition at line 907 of file openvasmd.c.

908 {
909  struct sigaction action;
910 
911  memset (&action, '\0', sizeof (action));
912  if (block)
913  sigfillset (&action.sa_mask);
914  else
915  sigemptyset (&action.sa_mask);
916  action.sa_handler = handler;
917  if (sigaction (signal, &action, NULL) == -1)
918  {
919  g_critical ("%s: failed to register %s handler\n",
920  __FUNCTION__, sys_siglist[signal]);
921  exit (EXIT_FAILURE);
922  }
923 }

Referenced by handle_sigsegv().

Here is the caller graph for this function:

◆ setup_signal_handler_info()

void setup_signal_handler_info ( int  signal,
void(*)(int, siginfo_t *, void *)  handler,
int  block 
)

Setup signal handler.

Exit on failure.

Parameters
[in]signalSignal.
[in]handlerHandler.
[in]blockWhether to block all other signals during handler.

Definition at line 935 of file openvasmd.c.

938 {
939  struct sigaction action;
940 
941  memset (&action, '\0', sizeof (action));
942  if (block)
943  sigfillset (&action.sa_mask);
944  else
945  sigemptyset (&action.sa_mask);
946  action.sa_flags |= SA_SIGINFO;
947  action.sa_sigaction = handler;
948  if (sigaction (signal, &action, NULL) == -1)
949  {
950  g_critical ("%s: failed to register %s handler\n",
951  __FUNCTION__, sys_siglist[signal]);
952  exit (EXIT_FAILURE);
953  }
954 }

◆ spin_progress()

void spin_progress ( )

Nudge the progress indicator.

Definition at line 1067 of file openvasmd.c.

1068 {
1069  static char current = '/';
1070  switch (current)
1071  {
1072  case '\\':
1073  current = '|';
1074  break;
1075  case '|':
1076  current = '/';
1077  break;
1078  case '/':
1079  current = '-';
1080  break;
1081  case '-':
1082  current = '\\';
1083  break;
1084  }
1085  putchar ('\b');
1086  putchar (current);
1087  fflush (stdout);
1088  g_debug (" %c\n", current);
1089 }

Variable Documentation

◆ client_address

char client_address[INET6_ADDRSTRLEN]

The OMP client's address.

Definition at line 285 of file openvasmd.c.

◆ client_credentials

gnutls_certificate_credentials_t client_credentials

The client credentials.

Definition at line 241 of file openvasmd.c.

◆ client_session

gnutls_session_t client_session

The client session.

Definition at line 236 of file openvasmd.c.

◆ client_watch_interval

int client_watch_interval = DEFAULT_CLIENT_WATCH_INTERVAL

Interval in seconds to check whether client connection was closed.

Definition at line 209 of file openvasmd.c.

Referenced by serve_client().

◆ dh_params_option

gchar* dh_params_option = NULL

GnuTLS DH params file.

Definition at line 300 of file openvasmd.c.

◆ disable_encrypted_credentials

gboolean disable_encrypted_credentials

Flag indicating that encrypted credentials are disabled.

Setting this flag does not change any existing encrypted tuples but simply won't encrypt or decrypt anything. The variable is controlled by the command line option –disable-encrypted-credentials.

Definition at line 275 of file openvasmd.c.

Referenced by lsc_crypt_decrypt(), migrate_156_to_157(), migrate_158_to_159(), migrate_160_to_161(), and migrate_165_to_166().

◆ is_parent

int is_parent = 1

Is this process parent or child?

Definition at line 251 of file openvasmd.c.

◆ log_config

GSList* log_config = NULL

Logging parameters, as passed to setup_log_handlers.

Definition at line 310 of file openvasmd.c.

◆ manager_socket

int manager_socket = -1

The socket accepting OMP connections from clients.

Definition at line 214 of file openvasmd.c.

◆ manager_socket_2

int manager_socket_2 = -1

The optional, second socket accepting OMP connections from clients.

Definition at line 219 of file openvasmd.c.

◆ priorities_option

gchar* priorities_option = "NORMAL"

GnuTLS priorities.

Definition at line 295 of file openvasmd.c.

◆ scheduling_enabled

gboolean scheduling_enabled

Flag indicating that task scheduling is enabled.

Definition at line 280 of file openvasmd.c.

◆ sighup_update_nvt_cache

volatile int sighup_update_nvt_cache = 0

Flag for SIGHUP handler.

Definition at line 261 of file openvasmd.c.

Referenced by handle_sighup_update().

◆ sigmask_normal

sigset_t* sigmask_normal = NULL

Signal mask to restore when going from blocked to normal signaling.

Definition at line 290 of file openvasmd.c.

◆ termination_signal

volatile int termination_signal = 0

Flag for signal handlers.

Definition at line 256 of file openvasmd.c.

Referenced by handle_termination_signal().

◆ update_in_progress

int update_in_progress = 0

Whether a SIGHUP initiated NVT update is in progress.

Definition at line 305 of file openvasmd.c.

Referenced by handle_sigchld().

◆ use_tls

int use_tls = 0

Whether to use TLS for client connections.

Definition at line 231 of file openvasmd.c.