(root)/mandos/release
» Revision
237.7.139
(compared to revision 237.2.216)
: plugins.d/mandos-client.c
To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 237.7.139
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.139
- Committer: Teddy Hogeborn
- Date: 2012-05-26 22:56:38 UTC
- mfrom: (237.21.1 socket-option)
- mto: (300.1.1 release) (237.7.144 trunk) (301.1.1 release)
- mto: This revision was merged to the branch mainline in revision 301.
- Revision ID: teddy@recompile.se-20120526225638-4hvqyrvmj0036lfn
Merge "--socket" option for server.
This is suggested by the GNU Coding Standards' Table of Long Options,
and will probably also allow socket activation (e.g. by systemd(8)).
This is suggested by the GNU Coding Standards' Table of Long Options,
and will probably also allow socket activation (e.g. by systemd(8)).
- files added:
- debian/source/local-options
- network-hooks.d
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2010 Teddy Hogeborn
13
* Copyright © 2008-2010 Björn Påhlsson
12
* Copyright © 2008-2012 Teddy Hogeborn
13
* Copyright © 2008-2012 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
26
26
* along with this program. If not, see
27
27
* <http://www.gnu.org/licenses/>.
28
28
*
29
* Contact the authors at <mandos@fukt.bsnet.se>.
29
* Contact the authors at <mandos@recompile.se>.
30
30
*/
31
31
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
41
41
42
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
47
strtof(), abort() */
53
53
sockaddr_in6, PF_INET6,
54
54
SOCK_STREAM, uid_t, gid_t, open(),
55
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
56
#include <sys/stat.h> /* open(), S_ISREG */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
58
inet_pton(), connect() */
59
59
#include <fcntl.h> /* open() */
62
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
63
strtoimax() */
64
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
65
#include <errno.h> /* perror(), errno,
66
program_invocation_short_name */
66
67
#include <time.h> /* nanosleep(), time(), sleep() */
67
68
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
69
SIOCSIFFLAGS, if_indextoname(),
72
73
*/
73
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
75
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
76
setgid(), pause(), _exit() */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
77
78
#include <iso646.h> /* not, or, and */
78
79
#include <argp.h> /* struct argp_option, error_t, struct
79
80
argp_state, struct argp,
84
85
raise() */
85
86
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
86
87
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
89
WEXITSTATUS(), WTERMSIG() */
90
#include <grp.h> /* setgroups() */
87
91
88
92
#ifdef __linux__
89
93
#include <sys/klog.h> /* klogctl() */
107
111
init_gnutls_session(),
108
112
GNUTLS_* */
109
113
#include <gnutls/openpgp.h>
110
/* gnutls_certificate_set_openpgp_key_file(),
111
GNUTLS_OPENPGP_FMT_BASE64 */
114
/* gnutls_certificate_set_openpgp_key_file(),
115
GNUTLS_OPENPGP_FMT_BASE64 */
112
116
113
117
/* GPGME */
114
118
#include <gpgme.h> /* All GPGME types, constants and
122
126
#define PATHDIR "/conf/conf.d/mandos"
123
127
#define SECKEY "seckey.txt"
124
128
#define PUBKEY "pubkey.txt"
129
#define HOOKDIR "/lib/mandos/network-hooks.d"
125
130
126
131
bool debug = false;
127
132
static const char mandos_protocol_version[] = "1";
128
133
const char *argp_program_version = "mandos-client " VERSION;
129
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
134
const char *argp_program_bug_address = "<mandos@recompile.se>";
130
135
static const char sys_class_net[] = "/sys/class/net";
131
136
char *connect_to = NULL;
137
const char *hookdir = HOOKDIR;
138
139
/* Doubly linked list that need to be circularly linked when used */
140
typedef struct server{
141
const char *ip;
142
uint16_t port;
143
AvahiIfIndex if_index;
144
int af;
145
struct timespec last_seen;
146
struct server *next;
147
struct server *prev;
148
} server;
132
149
133
150
/* Used for passing in values through the Avahi callback functions */
134
151
typedef struct {
139
156
gnutls_dh_params_t dh_params;
140
157
const char *priority;
141
158
gpgme_ctx_t ctx;
159
server *current_server;
142
160
} mandos_context;
143
161
144
162
/* global context so signal handler can reach it*/
145
163
mandos_context mc = { .simple_poll = NULL, .server = NULL,
146
164
.dh_bits = 1024, .priority = "SECURE256"
147
":!CTYPE-X.509:+CTYPE-OPENPGP" };
165
":!CTYPE-X.509:+CTYPE-OPENPGP",
166
.current_server = NULL };
148
167
149
168
sig_atomic_t quit_now = 0;
150
169
int signal_received = 0;
151
170
171
/* Function to use when printing errors */
172
void perror_plus(const char *print_text){
173
int e = errno;
174
fprintf(stderr, "Mandos plugin %s: ",
175
program_invocation_short_name);
176
errno = e;
177
perror(print_text);
178
}
179
180
__attribute__((format (gnu_printf, 2, 3)))
181
int fprintf_plus(FILE *stream, const char *format, ...){
182
va_list ap;
183
va_start (ap, format);
184
185
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
186
program_invocation_short_name));
187
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
188
}
189
152
190
/*
153
191
* Make additional room in "buffer" for at least BUFFER_SIZE more
154
192
* bytes. "buffer_capacity" is how much is currently allocated,
155
193
* "buffer_length" is how much is already used.
156
194
*/
157
195
size_t incbuffer(char **buffer, size_t buffer_length,
158
size_t buffer_capacity){
196
size_t buffer_capacity){
159
197
if(buffer_length + BUFFER_SIZE > buffer_capacity){
160
198
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
161
199
if(buffer == NULL){
166
204
return buffer_capacity;
167
205
}
168
206
207
/* Add server to set of servers to retry periodically */
208
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
209
int af){
210
int ret;
211
server *new_server = malloc(sizeof(server));
212
if(new_server == NULL){
213
perror_plus("malloc");
214
return false;
215
}
216
*new_server = (server){ .ip = strdup(ip),
217
.port = port,
218
.if_index = if_index,
219
.af = af };
220
if(new_server->ip == NULL){
221
perror_plus("strdup");
222
return false;
223
}
224
/* Special case of first server */
225
if (mc.current_server == NULL){
226
new_server->next = new_server;
227
new_server->prev = new_server;
228
mc.current_server = new_server;
229
/* Place the new server last in the list */
230
} else {
231
new_server->next = mc.current_server;
232
new_server->prev = mc.current_server->prev;
233
new_server->prev->next = new_server;
234
mc.current_server->prev = new_server;
235
}
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
237
if(ret == -1){
238
perror_plus("clock_gettime");
239
return false;
240
}
241
return true;
242
}
243
169
244
/*
170
245
* Initialize GPGME.
171
246
*/
172
static bool init_gpgme(const char *seckey,
173
const char *pubkey, const char *tempdir){
247
static bool init_gpgme(const char *seckey, const char *pubkey,
248
const char *tempdir){
174
249
gpgme_error_t rc;
175
250
gpgme_engine_info_t engine_info;
176
251
185
260
186
261
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
187
262
if(fd == -1){
188
perror("open");
263
perror_plus("open");
189
264
return false;
190
265
}
191
266
192
267
rc = gpgme_data_new_from_fd(&pgp_data, fd);
193
268
if(rc != GPG_ERR_NO_ERROR){
194
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
195
gpgme_strsource(rc), gpgme_strerror(rc));
269
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
270
gpgme_strsource(rc), gpgme_strerror(rc));
196
271
return false;
197
272
}
198
273
199
274
rc = gpgme_op_import(mc.ctx, pgp_data);
200
275
if(rc != GPG_ERR_NO_ERROR){
201
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
202
gpgme_strsource(rc), gpgme_strerror(rc));
276
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
277
gpgme_strsource(rc), gpgme_strerror(rc));
203
278
return false;
204
279
}
205
280
206
281
ret = (int)TEMP_FAILURE_RETRY(close(fd));
207
282
if(ret == -1){
208
perror("close");
283
perror_plus("close");
209
284
}
210
285
gpgme_data_release(pgp_data);
211
286
return true;
212
287
}
213
288
214
289
if(debug){
215
fprintf(stderr, "Initializing GPGME\n");
290
fprintf_plus(stderr, "Initializing GPGME\n");
216
291
}
217
292
218
293
/* Init GPGME */
219
294
gpgme_check_version(NULL);
220
295
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
221
296
if(rc != GPG_ERR_NO_ERROR){
222
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
223
gpgme_strsource(rc), gpgme_strerror(rc));
297
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
298
gpgme_strsource(rc), gpgme_strerror(rc));
224
299
return false;
225
300
}
226
301
227
/* Set GPGME home directory for the OpenPGP engine only */
302
/* Set GPGME home directory for the OpenPGP engine only */
228
303
rc = gpgme_get_engine_info(&engine_info);
229
304
if(rc != GPG_ERR_NO_ERROR){
230
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
231
gpgme_strsource(rc), gpgme_strerror(rc));
305
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
306
gpgme_strsource(rc), gpgme_strerror(rc));
232
307
return false;
233
308
}
234
309
while(engine_info != NULL){
240
315
engine_info = engine_info->next;
241
316
}
242
317
if(engine_info == NULL){
243
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
318
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
319
tempdir);
244
320
return false;
245
321
}
246
322
247
323
/* Create new GPGME "context" */
248
324
rc = gpgme_new(&(mc.ctx));
249
325
if(rc != GPG_ERR_NO_ERROR){
250
fprintf(stderr, "bad gpgme_new: %s: %s\n",
251
gpgme_strsource(rc), gpgme_strerror(rc));
326
fprintf_plus(stderr, "Mandos plugin mandos-client: "
327
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
328
gpgme_strerror(rc));
252
329
return false;
253
330
}
254
331
273
350
ssize_t plaintext_length = 0;
274
351
275
352
if(debug){
276
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
353
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
277
354
}
278
355
279
356
/* Create new GPGME data buffer from memory cryptotext */
280
357
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
281
358
0);
282
359
if(rc != GPG_ERR_NO_ERROR){
283
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
284
gpgme_strsource(rc), gpgme_strerror(rc));
360
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
361
gpgme_strsource(rc), gpgme_strerror(rc));
285
362
return -1;
286
363
}
287
364
288
365
/* Create new empty GPGME data buffer for the plaintext */
289
366
rc = gpgme_data_new(&dh_plain);
290
367
if(rc != GPG_ERR_NO_ERROR){
291
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
292
gpgme_strsource(rc), gpgme_strerror(rc));
368
fprintf_plus(stderr, "Mandos plugin mandos-client: "
369
"bad gpgme_data_new: %s: %s\n",
370
gpgme_strsource(rc), gpgme_strerror(rc));
293
371
gpgme_data_release(dh_crypto);
294
372
return -1;
295
373
}
298
376
data buffer */
299
377
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
300
378
if(rc != GPG_ERR_NO_ERROR){
301
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
302
gpgme_strsource(rc), gpgme_strerror(rc));
379
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
380
gpgme_strsource(rc), gpgme_strerror(rc));
303
381
plaintext_length = -1;
304
382
if(debug){
305
383
gpgme_decrypt_result_t result;
306
384
result = gpgme_op_decrypt_result(mc.ctx);
307
385
if(result == NULL){
308
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
386
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
309
387
} else {
310
fprintf(stderr, "Unsupported algorithm: %s\n",
311
result->unsupported_algorithm);
312
fprintf(stderr, "Wrong key usage: %u\n",
313
result->wrong_key_usage);
388
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
389
result->unsupported_algorithm);
390
fprintf_plus(stderr, "Wrong key usage: %u\n",
391
result->wrong_key_usage);
314
392
if(result->file_name != NULL){
315
fprintf(stderr, "File name: %s\n", result->file_name);
393
fprintf_plus(stderr, "File name: %s\n", result->file_name);
316
394
}
317
395
gpgme_recipient_t recipient;
318
396
recipient = result->recipients;
319
397
while(recipient != NULL){
320
fprintf(stderr, "Public key algorithm: %s\n",
321
gpgme_pubkey_algo_name(recipient->pubkey_algo));
322
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
323
fprintf(stderr, "Secret key available: %s\n",
324
recipient->status == GPG_ERR_NO_SECKEY
325
? "No" : "Yes");
398
fprintf_plus(stderr, "Public key algorithm: %s\n",
399
gpgme_pubkey_algo_name
400
(recipient->pubkey_algo));
401
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
402
fprintf_plus(stderr, "Secret key available: %s\n",
403
recipient->status == GPG_ERR_NO_SECKEY
404
? "No" : "Yes");
326
405
recipient = recipient->next;
327
406
}
328
407
}
331
410
}
332
411
333
412
if(debug){
334
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
413
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
335
414
}
336
415
337
416
/* Seek back to the beginning of the GPGME plaintext data buffer */
338
417
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
339
perror("gpgme_data_seek");
418
perror_plus("gpgme_data_seek");
340
419
plaintext_length = -1;
341
420
goto decrypt_end;
342
421
}
344
423
*plaintext = NULL;
345
424
while(true){
346
425
plaintext_capacity = incbuffer(plaintext,
347
(size_t)plaintext_length,
348
plaintext_capacity);
426
(size_t)plaintext_length,
427
plaintext_capacity);
349
428
if(plaintext_capacity == 0){
350
perror("incbuffer");
351
plaintext_length = -1;
352
goto decrypt_end;
429
perror_plus("incbuffer");
430
plaintext_length = -1;
431
goto decrypt_end;
353
432
}
354
433
355
434
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
360
439
break;
361
440
}
362
441
if(ret < 0){
363
perror("gpgme_data_read");
442
perror_plus("gpgme_data_read");
364
443
plaintext_length = -1;
365
444
goto decrypt_end;
366
445
}
368
447
}
369
448
370
449
if(debug){
371
fprintf(stderr, "Decrypted password is: ");
450
fprintf_plus(stderr, "Decrypted password is: ");
372
451
for(ssize_t i = 0; i < plaintext_length; i++){
373
452
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
374
453
}
396
475
/* GnuTLS log function callback */
397
476
static void debuggnutls(__attribute__((unused)) int level,
398
477
const char* string){
399
fprintf(stderr, "GnuTLS: %s", string);
478
fprintf_plus(stderr, "GnuTLS: %s", string);
400
479
}
401
480
402
481
static int init_gnutls_global(const char *pubkeyfilename,
404
483
int ret;
405
484
406
485
if(debug){
407
fprintf(stderr, "Initializing GnuTLS\n");
486
fprintf_plus(stderr, "Initializing GnuTLS\n");
408
487
}
409
488
410
489
ret = gnutls_global_init();
411
490
if(ret != GNUTLS_E_SUCCESS){
412
fprintf(stderr, "GnuTLS global_init: %s\n",
413
safer_gnutls_strerror(ret));
491
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
492
safer_gnutls_strerror(ret));
414
493
return -1;
415
494
}
416
495
423
502
}
424
503
425
504
/* OpenPGP credentials */
426
gnutls_certificate_allocate_credentials(&mc.cred);
505
ret = gnutls_certificate_allocate_credentials(&mc.cred);
427
506
if(ret != GNUTLS_E_SUCCESS){
428
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
429
from
430
-Wunreachable-code
431
*/
432
safer_gnutls_strerror(ret));
507
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
508
safer_gnutls_strerror(ret));
433
509
gnutls_global_deinit();
434
510
return -1;
435
511
}
436
512
437
513
if(debug){
438
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
439
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
440
seckeyfilename);
514
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
515
" secret key %s as GnuTLS credentials\n",
516
pubkeyfilename,
517
seckeyfilename);
441
518
}
442
519
443
520
ret = gnutls_certificate_set_openpgp_key_file
444
521
(mc.cred, pubkeyfilename, seckeyfilename,
445
522
GNUTLS_OPENPGP_FMT_BASE64);
446
523
if(ret != GNUTLS_E_SUCCESS){
447
fprintf(stderr,
448
"Error[%d] while reading the OpenPGP key pair ('%s',"
449
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
450
fprintf(stderr, "The GnuTLS error is: %s\n",
451
safer_gnutls_strerror(ret));
524
fprintf_plus(stderr,
525
"Error[%d] while reading the OpenPGP key pair ('%s',"
526
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
527
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
528
safer_gnutls_strerror(ret));
452
529
goto globalfail;
453
530
}
454
531
455
532
/* GnuTLS server initialization */
456
533
ret = gnutls_dh_params_init(&mc.dh_params);
457
534
if(ret != GNUTLS_E_SUCCESS){
458
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
459
" %s\n", safer_gnutls_strerror(ret));
535
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
536
" initialization: %s\n",
537
safer_gnutls_strerror(ret));
460
538
goto globalfail;
461
539
}
462
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
463
541
if(ret != GNUTLS_E_SUCCESS){
464
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
465
safer_gnutls_strerror(ret));
542
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
543
safer_gnutls_strerror(ret));
466
544
goto globalfail;
467
545
}
468
546
488
566
}
489
567
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
490
568
if(ret != GNUTLS_E_SUCCESS){
491
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
492
safer_gnutls_strerror(ret));
569
fprintf_plus(stderr,
570
"Error in GnuTLS session initialization: %s\n",
571
safer_gnutls_strerror(ret));
493
572
}
494
573
495
574
{
502
581
}
503
582
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
504
583
if(ret != GNUTLS_E_SUCCESS){
505
fprintf(stderr, "Syntax error at: %s\n", err);
506
fprintf(stderr, "GnuTLS error: %s\n",
507
safer_gnutls_strerror(ret));
584
fprintf_plus(stderr, "Syntax error at: %s\n", err);
585
fprintf_plus(stderr, "GnuTLS error: %s\n",
586
safer_gnutls_strerror(ret));
508
587
gnutls_deinit(*session);
509
588
return -1;
510
589
}
519
598
}
520
599
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
521
600
if(ret != GNUTLS_E_SUCCESS){
522
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
523
safer_gnutls_strerror(ret));
601
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
602
safer_gnutls_strerror(ret));
524
603
gnutls_deinit(*session);
525
604
return -1;
526
605
}
571
650
pf = PF_INET;
572
651
break;
573
652
default:
574
fprintf(stderr, "Bad address family: %d\n", af);
653
fprintf_plus(stderr, "Bad address family: %d\n", af);
575
654
errno = EINVAL;
576
655
return -1;
577
656
}
582
661
}
583
662
584
663
if(debug){
585
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
586
"\n", ip, port);
664
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
665
PRIu16 "\n", ip, port);
587
666
}
588
667
589
668
tcp_sd = socket(pf, SOCK_STREAM, 0);
590
669
if(tcp_sd < 0){
591
670
int e = errno;
592
perror("socket");
671
perror_plus("socket");
593
672
errno = e;
594
673
goto mandos_end;
595
674
}
609
688
}
610
689
if(ret < 0 ){
611
690
int e = errno;
612
perror("inet_pton");
691
perror_plus("inet_pton");
613
692
errno = e;
614
693
goto mandos_end;
615
694
}
616
695
if(ret == 0){
617
696
int e = errno;
618
fprintf(stderr, "Bad address: %s\n", ip);
697
fprintf_plus(stderr, "Bad address: %s\n", ip);
619
698
errno = e;
620
699
goto mandos_end;
621
700
}
626
705
627
706
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
628
707
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
629
-Wunreachable-code*/
708
-Wunreachable-code*/
630
709
if(if_index == AVAHI_IF_UNSPEC){
631
fprintf(stderr, "An IPv6 link-local address is incomplete"
632
" without a network interface\n");
710
fprintf_plus(stderr, "An IPv6 link-local address is"
711
" incomplete without a network interface\n");
633
712
errno = EINVAL;
634
713
goto mandos_end;
635
714
}
651
730
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
652
731
char interface[IF_NAMESIZE];
653
732
if(if_indextoname((unsigned int)if_index, interface) == NULL){
654
perror("if_indextoname");
733
perror_plus("if_indextoname");
655
734
} else {
656
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
657
ip, interface, port);
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
658
737
}
659
738
} else {
660
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
661
port);
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
740
ip, port);
662
741
}
663
742
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
664
743
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
671
750
sizeof(addrstr));
672
751
}
673
752
if(pcret == NULL){
674
perror("inet_ntop");
753
perror_plus("inet_ntop");
675
754
} else {
676
755
if(strcmp(addrstr, ip) != 0){
677
fprintf(stderr, "Canonical address form: %s\n", addrstr);
756
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
678
757
}
679
758
}
680
759
}
692
771
if(ret < 0){
693
772
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
694
773
int e = errno;
695
perror("connect");
774
perror_plus("connect");
696
775
errno = e;
697
776
}
698
777
goto mandos_end;
708
787
while(true){
709
788
size_t out_size = strlen(out);
710
789
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
711
out_size - written));
790
out_size - written));
712
791
if(ret == -1){
713
792
int e = errno;
714
perror("write");
793
perror_plus("write");
715
794
errno = e;
716
795
goto mandos_end;
717
796
}
734
813
}
735
814
736
815
if(debug){
737
fprintf(stderr, "Establishing TLS session with %s\n", ip);
816
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
738
817
}
739
818
740
819
if(quit_now){
742
821
goto mandos_end;
743
822
}
744
823
745
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
824
/* This casting via intptr_t is to eliminate warning about casting
825
an int to a pointer type. This is exactly how the GnuTLS Guile
826
function "set-session-transport-fd!" does it. */
827
gnutls_transport_set_ptr(session,
828
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
746
829
747
830
if(quit_now){
748
831
errno = EINTR;
759
842
760
843
if(ret != GNUTLS_E_SUCCESS){
761
844
if(debug){
762
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
845
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
763
846
gnutls_perror(ret);
764
847
}
765
848
errno = EPROTO;
769
852
/* Read OpenPGP packet that contains the wanted password */
770
853
771
854
if(debug){
772
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
773
ip);
855
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
856
" %s\n", ip);
774
857
}
775
858
776
859
while(true){
781
864
}
782
865
783
866
buffer_capacity = incbuffer(&buffer, buffer_length,
784
buffer_capacity);
867
buffer_capacity);
785
868
if(buffer_capacity == 0){
786
869
int e = errno;
787
perror("incbuffer");
870
perror_plus("incbuffer");
788
871
errno = e;
789
872
goto mandos_end;
790
873
}
814
897
}
815
898
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
816
899
if(ret < 0){
817
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
900
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
901
"***\n");
818
902
gnutls_perror(ret);
819
903
errno = EPROTO;
820
904
goto mandos_end;
821
905
}
822
906
break;
823
907
default:
824
fprintf(stderr, "Unknown error while reading data from"
825
" encrypted session with Mandos server\n");
908
fprintf_plus(stderr, "Unknown error while reading data from"
909
" encrypted session with Mandos server\n");
826
910
gnutls_bye(session, GNUTLS_SHUT_RDWR);
827
911
errno = EIO;
828
912
goto mandos_end;
833
917
}
834
918
835
919
if(debug){
836
fprintf(stderr, "Closing TLS session\n");
920
fprintf_plus(stderr, "Closing TLS session\n");
837
921
}
838
922
839
923
if(quit_now){
851
935
852
936
if(buffer_length > 0){
853
937
ssize_t decrypted_buffer_size;
854
decrypted_buffer_size = pgp_packet_decrypt(buffer,
855
buffer_length,
938
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
856
939
&decrypted_buffer);
857
940
if(decrypted_buffer_size >= 0){
858
941
869
952
if(ret == 0 and ferror(stdout)){
870
953
int e = errno;
871
954
if(debug){
872
fprintf(stderr, "Error writing encrypted data: %s\n",
873
strerror(errno));
955
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
956
strerror(errno));
874
957
}
875
958
errno = e;
876
959
goto mandos_end;
895
978
if(e == 0){
896
979
e = errno;
897
980
}
898
perror("close");
981
perror_plus("close");
899
982
}
900
983
gnutls_deinit(session);
984
errno = e;
901
985
if(quit_now){
902
e = EINTR;
986
errno = EINTR;
903
987
retval = -1;
904
988
}
905
errno = e;
906
989
}
907
990
return retval;
908
991
}
933
1016
switch(event){
934
1017
default:
935
1018
case AVAHI_RESOLVER_FAILURE:
936
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
937
" of type '%s' in domain '%s': %s\n", name, type, domain,
938
avahi_strerror(avahi_server_errno(mc.server)));
1019
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1020
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1021
domain,
1022
avahi_strerror(avahi_server_errno(mc.server)));
939
1023
break;
940
1024
941
1025
case AVAHI_RESOLVER_FOUND:
943
1027
char ip[AVAHI_ADDRESS_STR_MAX];
944
1028
avahi_address_snprint(ip, sizeof(ip), address);
945
1029
if(debug){
946
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
947
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
948
ip, (intmax_t)interface, port);
1030
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1031
PRIdMAX ") on port %" PRIu16 "\n", name,
1032
host_name, ip, (intmax_t)interface, port);
949
1033
}
950
1034
int ret = start_mandos_communication(ip, port, interface,
951
1035
avahi_proto_to_af(proto));
952
1036
if(ret == 0){
953
1037
avahi_simple_poll_quit(mc.simple_poll);
1038
} else {
1039
if(not add_server(ip, port, interface,
1040
avahi_proto_to_af(proto))){
1041
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1042
" list\n", name);
1043
}
954
1044
}
955
1045
}
956
1046
}
980
1070
default:
981
1071
case AVAHI_BROWSER_FAILURE:
982
1072
983
fprintf(stderr, "(Avahi browser) %s\n",
984
avahi_strerror(avahi_server_errno(mc.server)));
1073
fprintf_plus(stderr, "(Avahi browser) %s\n",
1074
avahi_strerror(avahi_server_errno(mc.server)));
985
1075
avahi_simple_poll_quit(mc.simple_poll);
986
1076
return;
987
1077
994
1084
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
995
1085
name, type, domain, protocol, 0,
996
1086
resolve_callback, NULL) == NULL)
997
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
998
name, avahi_strerror(avahi_server_errno(mc.server)));
1087
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1088
" %s\n", name,
1089
avahi_strerror(avahi_server_errno(mc.server)));
999
1090
break;
1000
1091
1001
1092
case AVAHI_BROWSER_REMOVE:
1004
1095
case AVAHI_BROWSER_ALL_FOR_NOW:
1005
1096
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1006
1097
if(debug){
1007
fprintf(stderr, "No Mandos server found, still searching...\n");
1098
fprintf_plus(stderr, "No Mandos server found, still"
1099
" searching...\n");
1008
1100
}
1009
1101
break;
1010
1102
}
1011
1103
}
1012
1104
1013
/* stop main loop after sigterm has been called */
1105
/* Signal handler that stops main loop after SIGTERM */
1014
1106
static void handle_sigterm(int sig){
1015
1107
if(quit_now){
1016
1108
return;
1018
1110
quit_now = 1;
1019
1111
signal_received = sig;
1020
1112
int old_errno = errno;
1113
/* set main loop to exit */
1021
1114
if(mc.simple_poll != NULL){
1022
1115
avahi_simple_poll_quit(mc.simple_poll);
1023
1116
}
1024
1117
errno = old_errno;
1025
1118
}
1026
1119
1027
/*
1028
* This function determines if a directory entry in /sys/class/net
1029
* corresponds to an acceptable network device.
1030
* (This function is passed to scandir(3) as a filter function.)
1031
*/
1032
int good_interface(const struct dirent *if_entry){
1033
ssize_t ssret;
1034
char *flagname = NULL;
1035
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
1036
if_entry->d_name);
1037
if(ret < 0){
1038
perror("asprintf");
1039
return 0;
1040
}
1041
if(if_entry->d_name[0] == '.'){
1042
return 0;
1043
}
1044
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1045
if(flags_fd == -1){
1046
perror("open");
1047
return 0;
1048
}
1049
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1050
/* read line from flags_fd */
1051
ssize_t to_read = (sizeof(ifreq_flags)*2)+3; /* "0x1003\n" */
1052
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1053
flagstring[(size_t)to_read] = '\0';
1054
if(flagstring == NULL){
1055
perror("malloc");
1056
close(flags_fd);
1057
return 0;
1058
}
1059
while(to_read > 0){
1060
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1061
(size_t)to_read));
1062
if(ssret == -1){
1063
perror("read");
1064
free(flagstring);
1065
close(flags_fd);
1066
return 0;
1067
}
1068
to_read -= ssret;
1069
if(ssret == 0){
1070
break;
1071
}
1072
}
1073
close(flags_fd);
1074
intmax_t tmpmax;
1075
char *tmp;
1076
errno = 0;
1077
tmpmax = strtoimax(flagstring, &tmp, 0);
1078
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1079
and not (isspace(*tmp)))
1080
or tmpmax != (ifreq_flags)tmpmax){
1120
bool get_flags(const char *ifname, struct ifreq *ifr){
1121
int ret;
1122
1123
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1124
if(s < 0){
1125
perror_plus("socket");
1126
return false;
1127
}
1128
strcpy(ifr->ifr_name, ifname);
1129
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1130
if(ret == -1){
1081
1131
if(debug){
1082
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1083
flagstring, if_entry->d_name);
1132
perror_plus("ioctl SIOCGIFFLAGS");
1084
1133
}
1085
free(flagstring);
1086
return 0;
1134
return false;
1087
1135
}
1088
free(flagstring);
1089
ifreq_flags flags = (ifreq_flags)tmpmax;
1136
return true;
1137
}
1138
1139
bool good_flags(const char *ifname, const struct ifreq *ifr){
1140
1090
1141
/* Reject the loopback device */
1091
if(flags & IFF_LOOPBACK){
1142
if(ifr->ifr_flags & IFF_LOOPBACK){
1092
1143
if(debug){
1093
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1094
if_entry->d_name);
1144
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1145
ifname);
1095
1146
}
1096
return 0;
1147
return false;
1097
1148
}
1098
1149
/* Accept point-to-point devices only if connect_to is specified */
1099
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1150
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1100
1151
if(debug){
1101
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1102
if_entry->d_name);
1152
fprintf_plus(stderr, "Accepting point-to-point interface"
1153
" \"%s\"\n", ifname);
1103
1154
}
1104
return 1;
1155
return true;
1105
1156
}
1106
1157
/* Otherwise, reject non-broadcast-capable devices */
1107
if(not (flags & IFF_BROADCAST)){
1108
if(debug){
1109
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1110
if_entry->d_name);
1111
}
1112
return 0;
1113
}
1158
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1159
if(debug){
1160
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1161
" \"%s\"\n", ifname);
1162
}
1163
return false;
1164
}
1165
/* Reject non-ARP interfaces (including dummy interfaces) */
1166
if(ifr->ifr_flags & IFF_NOARP){
1167
if(debug){
1168
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1169
ifname);
1170
}
1171
return false;
1172
}
1173
1114
1174
/* Accept this device */
1115
1175
if(debug){
1116
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1117
if_entry->d_name);
1118
}
1119
return 1;
1176
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1177
}
1178
return true;
1179
}
1180
1181
/*
1182
* This function determines if a directory entry in /sys/class/net
1183
* corresponds to an acceptable network device.
1184
* (This function is passed to scandir(3) as a filter function.)
1185
*/
1186
int good_interface(const struct dirent *if_entry){
1187
if(if_entry->d_name[0] == '.'){
1188
return 0;
1189
}
1190
1191
struct ifreq ifr;
1192
if(not get_flags(if_entry->d_name, &ifr)){
1193
if(debug){
1194
fprintf_plus(stderr, "Failed to get flags for interface "
1195
"\"%s\"\n", if_entry->d_name);
1196
}
1197
return 0;
1198
}
1199
1200
if(not good_flags(if_entry->d_name, &ifr)){
1201
return 0;
1202
}
1203
return 1;
1204
}
1205
1206
/*
1207
* This function determines if a directory entry in /sys/class/net
1208
* corresponds to an acceptable network device which is up.
1209
* (This function is passed to scandir(3) as a filter function.)
1210
*/
1211
int up_interface(const struct dirent *if_entry){
1212
if(if_entry->d_name[0] == '.'){
1213
return 0;
1214
}
1215
1216
struct ifreq ifr;
1217
if(not get_flags(if_entry->d_name, &ifr)){
1218
if(debug){
1219
fprintf_plus(stderr, "Failed to get flags for interface "
1220
"\"%s\"\n", if_entry->d_name);
1221
}
1222
return 0;
1223
}
1224
1225
/* Reject down interfaces */
1226
if(not (ifr.ifr_flags & IFF_UP)){
1227
if(debug){
1228
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1229
if_entry->d_name);
1230
}
1231
return 0;
1232
}
1233
1234
/* Reject non-running interfaces */
1235
if(not (ifr.ifr_flags & IFF_RUNNING)){
1236
if(debug){
1237
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1238
if_entry->d_name);
1239
}
1240
return 0;
1241
}
1242
1243
if(not good_flags(if_entry->d_name, &ifr)){
1244
return 0;
1245
}
1246
return 1;
1247
}
1248
1249
int notdotentries(const struct dirent *direntry){
1250
/* Skip "." and ".." */
1251
if(direntry->d_name[0] == '.'
1252
and (direntry->d_name[1] == '\0'
1253
or (direntry->d_name[1] == '.'
1254
and direntry->d_name[2] == '\0'))){
1255
return 0;
1256
}
1257
return 1;
1258
}
1259
1260
/* Is this directory entry a runnable program? */
1261
int runnable_hook(const struct dirent *direntry){
1262
int ret;
1263
size_t sret;
1264
struct stat st;
1265
1266
if((direntry->d_name)[0] == '\0'){
1267
/* Empty name? */
1268
return 0;
1269
}
1270
1271
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1272
"abcdefghijklmnopqrstuvwxyz"
1273
"0123456789"
1274
"_-");
1275
if((direntry->d_name)[sret] != '\0'){
1276
/* Contains non-allowed characters */
1277
if(debug){
1278
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1279
direntry->d_name);
1280
}
1281
return 0;
1282
}
1283
1284
char *fullname = NULL;
1285
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1286
if(ret < 0){
1287
perror_plus("asprintf");
1288
return 0;
1289
}
1290
1291
ret = stat(fullname, &st);
1292
if(ret == -1){
1293
if(debug){
1294
perror_plus("Could not stat hook");
1295
}
1296
return 0;
1297
}
1298
if(not (S_ISREG(st.st_mode))){
1299
/* Not a regular file */
1300
if(debug){
1301
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1302
direntry->d_name);
1303
}
1304
return 0;
1305
}
1306
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1307
/* Not executable */
1308
if(debug){
1309
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1310
direntry->d_name);
1311
}
1312
return 0;
1313
}
1314
if(debug){
1315
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1316
direntry->d_name);
1317
}
1318
return 1;
1319
}
1320
1321
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1322
int ret;
1323
struct timespec now;
1324
struct timespec waited_time;
1325
intmax_t block_time;
1326
1327
while(true){
1328
if(mc.current_server == NULL){
1329
if (debug){
1330
fprintf_plus(stderr, "Wait until first server is found."
1331
" No timeout!\n");
1332
}
1333
ret = avahi_simple_poll_iterate(s, -1);
1334
} else {
1335
if (debug){
1336
fprintf_plus(stderr, "Check current_server if we should run"
1337
" it, or wait\n");
1338
}
1339
/* the current time */
1340
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1341
if(ret == -1){
1342
perror_plus("clock_gettime");
1343
return -1;
1344
}
1345
/* Calculating in ms how long time between now and server
1346
who we visted longest time ago. Now - last seen. */
1347
waited_time.tv_sec = (now.tv_sec
1348
- mc.current_server->last_seen.tv_sec);
1349
waited_time.tv_nsec = (now.tv_nsec
1350
- mc.current_server->last_seen.tv_nsec);
1351
/* total time is 10s/10,000ms.
1352
Converting to s from ms by dividing by 1,000,
1353
and ns to ms by dividing by 1,000,000. */
1354
block_time = ((retry_interval
1355
- ((intmax_t)waited_time.tv_sec * 1000))
1356
- ((intmax_t)waited_time.tv_nsec / 1000000));
1357
1358
if (debug){
1359
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1360
block_time);
1361
}
1362
1363
if(block_time <= 0){
1364
ret = start_mandos_communication(mc.current_server->ip,
1365
mc.current_server->port,
1366
mc.current_server->if_index,
1367
mc.current_server->af);
1368
if(ret == 0){
1369
avahi_simple_poll_quit(mc.simple_poll);
1370
return 0;
1371
}
1372
ret = clock_gettime(CLOCK_MONOTONIC,
1373
&mc.current_server->last_seen);
1374
if(ret == -1){
1375
perror_plus("clock_gettime");
1376
return -1;
1377
}
1378
mc.current_server = mc.current_server->next;
1379
block_time = 0; /* Call avahi to find new Mandos
1380
servers, but don't block */
1381
}
1382
1383
ret = avahi_simple_poll_iterate(s, (int)block_time);
1384
}
1385
if(ret != 0){
1386
if (ret > 0 or errno != EINTR){
1387
return (ret != 1) ? ret : 0;
1388
}
1389
}
1390
}
1391
}
1392
1393
bool run_network_hooks(const char *mode, const char *interface,
1394
const float delay){
1395
struct dirent **direntries;
1396
struct dirent *direntry;
1397
int ret;
1398
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1399
alphasort);
1400
if(numhooks == -1){
1401
perror_plus("scandir");
1402
} else {
1403
int devnull = open("/dev/null", O_RDONLY);
1404
for(int i = 0; i < numhooks; i++){
1405
direntry = direntries[i];
1406
char *fullname = NULL;
1407
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1408
if(ret < 0){
1409
perror_plus("asprintf");
1410
continue;
1411
}
1412
if(debug){
1413
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1414
direntry->d_name);
1415
}
1416
pid_t hook_pid = fork();
1417
if(hook_pid == 0){
1418
/* Child */
1419
/* Raise privileges */
1420
errno = 0;
1421
ret = seteuid(0);
1422
if(ret == -1){
1423
perror_plus("seteuid");
1424
}
1425
/* Raise privileges even more */
1426
errno = 0;
1427
ret = setuid(0);
1428
if(ret == -1){
1429
perror_plus("setuid");
1430
}
1431
/* Set group */
1432
errno = 0;
1433
ret = setgid(0);
1434
if(ret == -1){
1435
perror_plus("setgid");
1436
}
1437
/* Reset supplementary groups */
1438
errno = 0;
1439
ret = setgroups(0, NULL);
1440
if(ret == -1){
1441
perror_plus("setgroups");
1442
}
1443
dup2(devnull, STDIN_FILENO);
1444
close(devnull);
1445
dup2(STDERR_FILENO, STDOUT_FILENO);
1446
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1447
if(ret == -1){
1448
perror_plus("setenv");
1449
_exit(EX_OSERR);
1450
}
1451
ret = setenv("DEVICE", interface, 1);
1452
if(ret == -1){
1453
perror_plus("setenv");
1454
_exit(EX_OSERR);
1455
}
1456
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1457
if(ret == -1){
1458
perror_plus("setenv");
1459
_exit(EX_OSERR);
1460
}
1461
ret = setenv("MODE", mode, 1);
1462
if(ret == -1){
1463
perror_plus("setenv");
1464
_exit(EX_OSERR);
1465
}
1466
char *delaystring;
1467
ret = asprintf(&delaystring, "%f", delay);
1468
if(ret == -1){
1469
perror_plus("asprintf");
1470
_exit(EX_OSERR);
1471
}
1472
ret = setenv("DELAY", delaystring, 1);
1473
if(ret == -1){
1474
free(delaystring);
1475
perror_plus("setenv");
1476
_exit(EX_OSERR);
1477
}
1478
free(delaystring);
1479
if(connect_to != NULL){
1480
ret = setenv("CONNECT", connect_to, 1);
1481
if(ret == -1){
1482
perror_plus("setenv");
1483
_exit(EX_OSERR);
1484
}
1485
}
1486
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1487
perror_plus("execl");
1488
_exit(EXIT_FAILURE);
1489
}
1490
} else {
1491
int status;
1492
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1493
perror_plus("waitpid");
1494
free(fullname);
1495
continue;
1496
}
1497
if(WIFEXITED(status)){
1498
if(WEXITSTATUS(status) != 0){
1499
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1500
" with status %d\n", direntry->d_name,
1501
WEXITSTATUS(status));
1502
free(fullname);
1503
continue;
1504
}
1505
} else if(WIFSIGNALED(status)){
1506
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1507
" signal %d\n", direntry->d_name,
1508
WTERMSIG(status));
1509
free(fullname);
1510
continue;
1511
} else {
1512
fprintf_plus(stderr, "Warning: network hook \"%s\""
1513
" crashed\n", direntry->d_name);
1514
free(fullname);
1515
continue;
1516
}
1517
}
1518
free(fullname);
1519
if(debug){
1520
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1521
direntry->d_name);
1522
}
1523
}
1524
close(devnull);
1525
}
1526
return true;
1120
1527
}
1121
1528
1122
1529
int main(int argc, char *argv[]){
1141
1548
bool gnutls_initialized = false;
1142
1549
bool gpgme_initialized = false;
1143
1550
float delay = 2.5f;
1551
double retry_interval = 10; /* 10s between trying a server and
1552
retrying the same server again */
1144
1553
1145
1554
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1146
1555
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1152
1561
errno = 0;
1153
1562
ret = setgid(gid);
1154
1563
if(ret == -1){
1155
perror("setgid");
1564
perror_plus("setgid");
1156
1565
}
1157
1566
1158
1567
/* Lower user privileges (temporarily) */
1159
1568
errno = 0;
1160
1569
ret = seteuid(uid);
1161
1570
if(ret == -1){
1162
perror("seteuid");
1571
perror_plus("seteuid");
1163
1572
}
1164
1573
1165
1574
if(quit_now){
1200
1609
.arg = "SECONDS",
1201
1610
.doc = "Maximum delay to wait for interface startup",
1202
1611
.group = 2 },
1612
{ .name = "retry", .key = 132,
1613
.arg = "SECONDS",
1614
.doc = "Retry interval used when denied by the Mandos server",
1615
.group = 2 },
1616
{ .name = "network-hook-dir", .key = 133,
1617
.arg = "DIR",
1618
.doc = "Directory where network hooks are located",
1619
.group = 2 },
1203
1620
/*
1204
1621
* These reproduce what we would get without ARGP_NO_HELP
1205
1622
*/
1249
1666
if(errno != 0 or tmp == arg or *tmp != '\0'){
1250
1667
argp_error(state, "Bad delay");
1251
1668
}
1669
case 132: /* --retry */
1670
errno = 0;
1671
retry_interval = strtod(arg, &tmp);
1672
if(errno != 0 or tmp == arg or *tmp != '\0'
1673
or (retry_interval * 1000) > INT_MAX
1674
or retry_interval < 0){
1675
argp_error(state, "Bad retry interval");
1676
}
1677
break;
1678
case 133: /* --network-hook-dir */
1679
hookdir = arg;
1252
1680
break;
1253
1681
/*
1254
1682
* These reproduce what we would get without ARGP_NO_HELP
1261
1689
argp_state_help(state, state->out_stream,
1262
1690
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1263
1691
case 'V': /* --version */
1264
fprintf(state->out_stream, "%s\n", argp_program_version);
1692
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1265
1693
exit(argp_err_exit_status);
1266
1694
break;
1267
1695
default:
1282
1710
case ENOMEM:
1283
1711
default:
1284
1712
errno = ret;
1285
perror("argp_parse");
1713
perror_plus("argp_parse");
1286
1714
exitcode = EX_OSERR;
1287
1715
goto end;
1288
1716
case EINVAL:
1290
1718
goto end;
1291
1719
}
1292
1720
}
1721
1722
{
1723
/* Work around Debian bug #633582:
1724
<http://bugs.debian.org/633582> */
1725
1726
/* Re-raise priviliges */
1727
errno = 0;
1728
ret = seteuid(0);
1729
if(ret == -1){
1730
perror_plus("seteuid");
1731
} else {
1732
struct stat st;
1733
1734
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1735
int seckey_fd = open(seckey, O_RDONLY);
1736
if(seckey_fd == -1){
1737
perror_plus("open");
1738
} else {
1739
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1740
if(ret == -1){
1741
perror_plus("fstat");
1742
} else {
1743
if(S_ISREG(st.st_mode)
1744
and st.st_uid == 0 and st.st_gid == 0){
1745
ret = fchown(seckey_fd, uid, gid);
1746
if(ret == -1){
1747
perror_plus("fchown");
1748
}
1749
}
1750
}
1751
TEMP_FAILURE_RETRY(close(seckey_fd));
1752
}
1753
}
1754
1755
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1756
int pubkey_fd = open(pubkey, O_RDONLY);
1757
if(pubkey_fd == -1){
1758
perror_plus("open");
1759
} else {
1760
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1761
if(ret == -1){
1762
perror_plus("fstat");
1763
} else {
1764
if(S_ISREG(st.st_mode)
1765
and st.st_uid == 0 and st.st_gid == 0){
1766
ret = fchown(pubkey_fd, uid, gid);
1767
if(ret == -1){
1768
perror_plus("fchown");
1769
}
1770
}
1771
}
1772
TEMP_FAILURE_RETRY(close(pubkey_fd));
1773
}
1774
}
1775
1776
/* Lower privileges */
1777
errno = 0;
1778
ret = seteuid(uid);
1779
if(ret == -1){
1780
perror_plus("seteuid");
1781
}
1782
}
1783
}
1784
1785
/* Run network hooks */
1786
if(not run_network_hooks("start", interface, delay)){
1787
goto end;
1788
}
1293
1789
1294
1790
if(not debug){
1295
1791
avahi_set_log_function(empty_log);
1296
1792
}
1297
1793
1298
1794
if(interface[0] == '\0'){
1299
1795
struct dirent **direntries;
1300
ret = scandir(sys_class_net, &direntries, good_interface,
1796
/* First look for interfaces that are up */
1797
ret = scandir(sys_class_net, &direntries, up_interface,
1301
1798
alphasort);
1799
if(ret == 0){
1800
/* No up interfaces, look for any good interfaces */
1801
free(direntries);
1802
ret = scandir(sys_class_net, &direntries, good_interface,
1803
alphasort);
1804
}
1302
1805
if(ret >= 1){
1303
/* Pick the first good interface */
1806
/* Pick the first interface returned */
1304
1807
interface = strdup(direntries[0]->d_name);
1305
1808
if(debug){
1306
fprintf(stderr, "Using interface \"%s\"\n", interface);
1809
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1307
1810
}
1308
1811
if(interface == NULL){
1309
perror("malloc");
1812
perror_plus("malloc");
1310
1813
free(direntries);
1311
1814
exitcode = EXIT_FAILURE;
1312
1815
goto end;
1314
1817
free(direntries);
1315
1818
} else {
1316
1819
free(direntries);
1317
fprintf(stderr, "Could not find a network interface\n");
1820
fprintf_plus(stderr, "Could not find a network interface\n");
1318
1821
exitcode = EXIT_FAILURE;
1319
1822
goto end;
1320
1823
}
1326
1829
srand((unsigned int) time(NULL));
1327
1830
mc.simple_poll = avahi_simple_poll_new();
1328
1831
if(mc.simple_poll == NULL){
1329
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1832
fprintf_plus(stderr,
1833
"Avahi: Failed to create simple poll object.\n");
1330
1834
exitcode = EX_UNAVAILABLE;
1331
1835
goto end;
1332
1836
}
1334
1838
sigemptyset(&sigterm_action.sa_mask);
1335
1839
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1336
1840
if(ret == -1){
1337
perror("sigaddset");
1841
perror_plus("sigaddset");
1338
1842
exitcode = EX_OSERR;
1339
1843
goto end;
1340
1844
}
1341
1845
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1342
1846
if(ret == -1){
1343
perror("sigaddset");
1847
perror_plus("sigaddset");
1344
1848
exitcode = EX_OSERR;
1345
1849
goto end;
1346
1850
}
1347
1851
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1348
1852
if(ret == -1){
1349
perror("sigaddset");
1853
perror_plus("sigaddset");
1350
1854
exitcode = EX_OSERR;
1351
1855
goto end;
1352
1856
}
1356
1860
*/
1357
1861
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1358
1862
if(ret == -1){
1359
perror("sigaction");
1863
perror_plus("sigaction");
1360
1864
return EX_OSERR;
1361
1865
}
1362
1866
if(old_sigterm_action.sa_handler != SIG_IGN){
1363
1867
ret = sigaction(SIGINT, &sigterm_action, NULL);
1364
1868
if(ret == -1){
1365
perror("sigaction");
1869
perror_plus("sigaction");
1366
1870
exitcode = EX_OSERR;
1367
1871
goto end;
1368
1872
}
1369
1873
}
1370
1874
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1371
1875
if(ret == -1){
1372
perror("sigaction");
1876
perror_plus("sigaction");
1373
1877
return EX_OSERR;
1374
1878
}
1375
1879
if(old_sigterm_action.sa_handler != SIG_IGN){
1376
1880
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1377
1881
if(ret == -1){
1378
perror("sigaction");
1882
perror_plus("sigaction");
1379
1883
exitcode = EX_OSERR;
1380
1884
goto end;
1381
1885
}
1382
1886
}
1383
1887
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1384
1888
if(ret == -1){
1385
perror("sigaction");
1889
perror_plus("sigaction");
1386
1890
return EX_OSERR;
1387
1891
}
1388
1892
if(old_sigterm_action.sa_handler != SIG_IGN){
1389
1893
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1390
1894
if(ret == -1){
1391
perror("sigaction");
1895
perror_plus("sigaction");
1392
1896
exitcode = EX_OSERR;
1393
1897
goto end;
1394
1898
}
1398
1902
if(strcmp(interface, "none") != 0){
1399
1903
if_index = (AvahiIfIndex) if_nametoindex(interface);
1400
1904
if(if_index == 0){
1401
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1905
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1402
1906
exitcode = EX_UNAVAILABLE;
1403
1907
goto end;
1404
1908
}
1411
1915
errno = 0;
1412
1916
ret = seteuid(0);
1413
1917
if(ret == -1){
1414
perror("seteuid");
1918
perror_plus("seteuid");
1415
1919
}
1416
1920
1417
1921
#ifdef __linux__
1421
1925
bool restore_loglevel = true;
1422
1926
if(ret == -1){
1423
1927
restore_loglevel = false;
1424
perror("klogctl");
1928
perror_plus("klogctl");
1425
1929
}
1426
1930
#endif /* __linux__ */
1427
1931
1428
1932
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1429
1933
if(sd < 0){
1430
perror("socket");
1934
perror_plus("socket");
1431
1935
exitcode = EX_OSERR;
1432
1936
#ifdef __linux__
1433
1937
if(restore_loglevel){
1434
1938
ret = klogctl(7, NULL, 0);
1435
1939
if(ret == -1){
1436
perror("klogctl");
1940
perror_plus("klogctl");
1437
1941
}
1438
1942
}
1439
1943
#endif /* __linux__ */
1441
1945
errno = 0;
1442
1946
ret = seteuid(uid);
1443
1947
if(ret == -1){
1444
perror("seteuid");
1948
perror_plus("seteuid");
1445
1949
}
1446
1950
goto end;
1447
1951
}
1448
1952
strcpy(network.ifr_name, interface);
1449
1953
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1450
1954
if(ret == -1){
1451
perror("ioctl SIOCGIFFLAGS");
1955
perror_plus("ioctl SIOCGIFFLAGS");
1452
1956
#ifdef __linux__
1453
1957
if(restore_loglevel){
1454
1958
ret = klogctl(7, NULL, 0);
1455
1959
if(ret == -1){
1456
perror("klogctl");
1960
perror_plus("klogctl");
1457
1961
}
1458
1962
}
1459
1963
#endif /* __linux__ */
1462
1966
errno = 0;
1463
1967
ret = seteuid(uid);
1464
1968
if(ret == -1){
1465
perror("seteuid");
1969
perror_plus("seteuid");
1466
1970
}
1467
1971
goto end;
1468
1972
}
1472
1976
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1473
1977
if(ret == -1){
1474
1978
take_down_interface = false;
1475
perror("ioctl SIOCSIFFLAGS +IFF_UP");
1979
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1476
1980
exitcode = EX_OSERR;
1477
1981
#ifdef __linux__
1478
1982
if(restore_loglevel){
1479
1983
ret = klogctl(7, NULL, 0);
1480
1984
if(ret == -1){
1481
perror("klogctl");
1985
perror_plus("klogctl");
1482
1986
}
1483
1987
}
1484
1988
#endif /* __linux__ */
1486
1990
errno = 0;
1487
1991
ret = seteuid(uid);
1488
1992
if(ret == -1){
1489
perror("seteuid");
1993
perror_plus("seteuid");
1490
1994
}
1491
1995
goto end;
1492
1996
}
1493
1997
}
1494
/* sleep checking until interface is running */
1998
/* Sleep checking until interface is running.
1999
Check every 0.25s, up to total time of delay */
1495
2000
for(int i=0; i < delay * 4; i++){
1496
2001
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1497
2002
if(ret == -1){
1498
perror("ioctl SIOCGIFFLAGS");
2003
perror_plus("ioctl SIOCGIFFLAGS");
1499
2004
} else if(network.ifr_flags & IFF_RUNNING){
1500
2005
break;
1501
2006
}
1502
2007
struct timespec sleeptime = { .tv_nsec = 250000000 };
1503
2008
ret = nanosleep(&sleeptime, NULL);
1504
2009
if(ret == -1 and errno != EINTR){
1505
perror("nanosleep");
2010
perror_plus("nanosleep");
1506
2011
}
1507
2012
}
1508
2013
if(not take_down_interface){
1509
2014
/* We won't need the socket anymore */
1510
2015
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1511
2016
if(ret == -1){
1512
perror("close");
2017
perror_plus("close");
1513
2018
}
1514
2019
}
1515
2020
#ifdef __linux__
1517
2022
/* Restores kernel loglevel to default */
1518
2023
ret = klogctl(7, NULL, 0);
1519
2024
if(ret == -1){
1520
perror("klogctl");
2025
perror_plus("klogctl");
1521
2026
}
1522
2027
}
1523
2028
#endif /* __linux__ */
1524
2029
/* Lower privileges */
1525
2030
errno = 0;
1526
if(take_down_interface){
1527
/* Lower privileges */
1528
ret = seteuid(uid);
1529
if(ret == -1){
1530
perror("seteuid");
1531
}
1532
} else {
1533
/* Lower privileges permanently */
1534
ret = setuid(uid);
1535
if(ret == -1){
1536
perror("setuid");
1537
}
2031
/* Lower privileges */
2032
ret = seteuid(uid);
2033
if(ret == -1){
2034
perror_plus("seteuid");
1538
2035
}
1539
2036
}
1540
2037
1544
2041
1545
2042
ret = init_gnutls_global(pubkey, seckey);
1546
2043
if(ret == -1){
1547
fprintf(stderr, "init_gnutls_global failed\n");
2044
fprintf_plus(stderr, "init_gnutls_global failed\n");
1548
2045
exitcode = EX_UNAVAILABLE;
1549
2046
goto end;
1550
2047
} else {
1555
2052
goto end;
1556
2053
}
1557
2054
2055
if(mkdtemp(tempdir) == NULL){
2056
perror_plus("mkdtemp");
2057
goto end;
2058
}
1558
2059
tempdir_created = true;
1559
if(mkdtemp(tempdir) == NULL){
1560
tempdir_created = false;
1561
perror("mkdtemp");
1562
goto end;
1563
}
1564
2060
1565
2061
if(quit_now){
1566
2062
goto end;
1567
2063
}
1568
2064
1569
2065
if(not init_gpgme(pubkey, seckey, tempdir)){
1570
fprintf(stderr, "init_gpgme failed\n");
2066
fprintf_plus(stderr, "init_gpgme failed\n");
1571
2067
exitcode = EX_UNAVAILABLE;
1572
2068
goto end;
1573
2069
} else {
1583
2079
/* (Mainly meant for debugging) */
1584
2080
char *address = strrchr(connect_to, ':');
1585
2081
if(address == NULL){
1586
fprintf(stderr, "No colon in address\n");
2082
fprintf_plus(stderr, "No colon in address\n");
1587
2083
exitcode = EX_USAGE;
1588
2084
goto end;
1589
2085
}
1597
2093
tmpmax = strtoimax(address+1, &tmp, 10);
1598
2094
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1599
2095
or tmpmax != (uint16_t)tmpmax){
1600
fprintf(stderr, "Bad port number\n");
2096
fprintf_plus(stderr, "Bad port number\n");
1601
2097
exitcode = EX_USAGE;
1602
2098
goto end;
1603
2099
}
1608
2104
1609
2105
port = (uint16_t)tmpmax;
1610
2106
*address = '\0';
1611
address = connect_to;
1612
2107
/* Colon in address indicates IPv6 */
1613
2108
int af;
1614
if(strchr(address, ':') != NULL){
2109
if(strchr(connect_to, ':') != NULL){
1615
2110
af = AF_INET6;
2111
/* Accept [] around IPv6 address - see RFC 5952 */
2112
if(connect_to[0] == '[' and address[-1] == ']')
2113
{
2114
connect_to++;
2115
address[-1] = '\0';
2116
}
1616
2117
} else {
1617
2118
af = AF_INET;
1618
2119
}
2120
address = connect_to;
1619
2121
1620
2122
if(quit_now){
1621
2123
goto end;
1622
2124
}
1623
2125
1624
2126
while(not quit_now){
1625
2127
ret = start_mandos_communication(address, port, if_index, af);
1626
2128
if(quit_now or ret == 0){
1627
2129
break;
1628
2130
}
1629
sleep(15);
1630
};
1631
2131
if(debug){
2132
fprintf_plus(stderr, "Retrying in %d seconds\n",
2133
(int)retry_interval);
2134
}
2135
sleep((int)retry_interval);
2136
}
2137
1632
2138
if (not quit_now){
1633
2139
exitcode = EXIT_SUCCESS;
1634
2140
}
1635
2141
1636
2142
goto end;
1637
2143
}
1638
2144
1660
2166
1661
2167
/* Check if creating the Avahi server object succeeded */
1662
2168
if(mc.server == NULL){
1663
fprintf(stderr, "Failed to create Avahi server: %s\n",
1664
avahi_strerror(error));
2169
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2170
avahi_strerror(error));
1665
2171
exitcode = EX_UNAVAILABLE;
1666
2172
goto end;
1667
2173
}
1675
2181
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1676
2182
NULL, 0, browse_callback, NULL);
1677
2183
if(sb == NULL){
1678
fprintf(stderr, "Failed to create service browser: %s\n",
1679
avahi_strerror(avahi_server_errno(mc.server)));
2184
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2185
avahi_strerror(avahi_server_errno(mc.server)));
1680
2186
exitcode = EX_UNAVAILABLE;
1681
2187
goto end;
1682
2188
}
1688
2194
/* Run the main loop */
1689
2195
1690
2196
if(debug){
1691
fprintf(stderr, "Starting Avahi loop search\n");
1692
}
1693
1694
avahi_simple_poll_loop(mc.simple_poll);
2197
fprintf_plus(stderr, "Starting Avahi loop search\n");
2198
}
2199
2200
ret = avahi_loop_with_timeout(mc.simple_poll,
2201
(int)(retry_interval * 1000));
2202
if(debug){
2203
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2204
(ret == 0) ? "successfully" : "with error");
2205
}
1695
2206
1696
2207
end:
1697
2208
1698
2209
if(debug){
1699
fprintf(stderr, "%s exiting\n", argv[0]);
2210
fprintf_plus(stderr, "%s exiting\n", argv[0]);
1700
2211
}
1701
2212
1702
2213
/* Cleanup things */
1719
2230
gpgme_release(mc.ctx);
1720
2231
}
1721
2232
1722
/* Take down the network interface */
1723
if(take_down_interface){
1724
/* Re-raise priviliges */
2233
/* Cleans up the circular linked list of Mandos servers the client
2234
has seen */
2235
if(mc.current_server != NULL){
2236
mc.current_server->prev->next = NULL;
2237
while(mc.current_server != NULL){
2238
server *next = mc.current_server->next;
2239
free(mc.current_server);
2240
mc.current_server = next;
2241
}
2242
}
2243
2244
/* Run network hooks */
2245
run_network_hooks("stop", interface, delay);
2246
2247
/* Re-raise priviliges */
2248
{
1725
2249
errno = 0;
1726
2250
ret = seteuid(0);
1727
2251
if(ret == -1){
1728
perror("seteuid");
2252
perror_plus("seteuid");
1729
2253
}
1730
if(geteuid() == 0){
2254
2255
/* Take down the network interface */
2256
if(take_down_interface and geteuid() == 0){
1731
2257
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1732
2258
if(ret == -1){
1733
perror("ioctl SIOCGIFFLAGS");
1734
} else if(network.ifr_flags & IFF_UP) {
2259
perror_plus("ioctl SIOCGIFFLAGS");
2260
} else if(network.ifr_flags & IFF_UP){
1735
2261
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1736
2262
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1737
2263
if(ret == -1){
1738
perror("ioctl SIOCSIFFLAGS -IFF_UP");
2264
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1739
2265
}
1740
2266
}
1741
2267
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1742
2268
if(ret == -1){
1743
perror("close");
1744
}
1745
/* Lower privileges permanently */
1746
errno = 0;
1747
ret = setuid(uid);
1748
if(ret == -1){
1749
perror("setuid");
2269
perror_plus("close");
1750
2270
}
1751
2271
}
1752
2272
}
2273
/* Lower privileges permanently */
2274
errno = 0;
2275
ret = setuid(uid);
2276
if(ret == -1){
2277
perror_plus("setuid");
2278
}
1753
2279
1754
/* Removes the temp directory used by GPGME */
2280
/* Removes the GPGME temp directory and all files inside */
1755
2281
if(tempdir_created){
1756
DIR *d;
1757
struct dirent *direntry;
1758
d = opendir(tempdir);
1759
if(d == NULL){
1760
if(errno != ENOENT){
1761
perror("opendir");
1762
}
1763
} else {
1764
while(true){
1765
direntry = readdir(d);
1766
if(direntry == NULL){
1767
break;
1768
}
1769
/* Skip "." and ".." */
1770
if(direntry->d_name[0] == '.'
1771
and (direntry->d_name[1] == '\0'
1772
or (direntry->d_name[1] == '.'
1773
and direntry->d_name[2] == '\0'))){
1774
continue;
1775
}
2282
struct dirent **direntries = NULL;
2283
struct dirent *direntry = NULL;
2284
int numentries = scandir(tempdir, &direntries, notdotentries,
2285
alphasort);
2286
if (numentries > 0){
2287
for(int i = 0; i < numentries; i++){
2288
direntry = direntries[i];
1776
2289
char *fullname = NULL;
1777
2290
ret = asprintf(&fullname, "%s/%s", tempdir,
1778
2291
direntry->d_name);
1779
2292
if(ret < 0){
1780
perror("asprintf");
2293
perror_plus("asprintf");
1781
2294
continue;
1782
2295
}
1783
2296
ret = remove(fullname);
1784
2297
if(ret == -1){
1785
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1786
strerror(errno));
2298
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2299
strerror(errno));
1787
2300
}
1788
2301
free(fullname);
1789
2302
}
1790
closedir(d);
2303
}
2304
2305
/* need to clean even if 0 because man page doesn't specify */
2306
free(direntries);
2307
if (numentries == -1){
2308
perror_plus("scandir");
1791
2309
}
1792
2310
ret = rmdir(tempdir);
1793
2311
if(ret == -1 and errno != ENOENT){
1794
perror("rmdir");
2312
perror_plus("rmdir");
1795
2313
}
1796
2314
}
1797
2315
1802
2320
&old_sigterm_action,
1803
2321
NULL));
1804
2322
if(ret == -1){
1805
perror("sigaction");
2323
perror_plus("sigaction");
1806
2324
}
1807
2325
do {
1808
2326
ret = raise(signal_received);
1809
2327
} while(ret != 0 and errno == EINTR);
1810
2328
if(ret != 0){
1811
perror("raise");
2329
perror_plus("raise");
1812
2330
abort();
1813
2331
}
1814
2332
TEMP_FAILURE_RETRY(pause());
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0