224
227
/* Special case of first server */
225
if (mc.current_server == NULL){
228
if(*current_server == NULL){
226
229
new_server->next = new_server;
227
230
new_server->prev = new_server;
228
mc.current_server = new_server;
231
*current_server = new_server;
229
232
/* Place the new server last in the list */
231
new_server->next = mc.current_server;
232
new_server->prev = mc.current_server->prev;
234
new_server->next = *current_server;
235
new_server->prev = (*current_server)->prev;
233
236
new_server->prev->next = new_server;
234
mc.current_server->prev = new_server;
237
(*current_server)->prev = new_server;
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
239
ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);
238
241
perror_plus("clock_gettime");
532
535
/* GnuTLS server initialization */
533
ret = gnutls_dh_params_init(&mc.dh_params);
536
ret = gnutls_dh_params_init(&mc->dh_params);
534
537
if(ret != GNUTLS_E_SUCCESS){
535
538
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
536
539
" initialization: %s\n",
537
540
safer_gnutls_strerror(ret));
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
543
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
541
544
if(ret != GNUTLS_E_SUCCESS){
542
545
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
543
546
safer_gnutls_strerror(ret));
547
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
550
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
553
gnutls_certificate_free_credentials(mc.cred);
556
gnutls_certificate_free_credentials(mc->cred);
554
557
gnutls_global_deinit();
555
gnutls_dh_params_deinit(mc.dh_params);
558
gnutls_dh_params_deinit(mc->dh_params);
559
static int init_gnutls_session(gnutls_session_t *session){
562
static int init_gnutls_session(gnutls_session_t *session,
561
565
/* GnuTLS session creation */
658
ret = init_gnutls_session(&session);
662
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
663
/* Check if the interface is one of the interfaces we are using */
666
char *interface = NULL;
667
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
669
if(if_nametoindex(interface) == (unsigned int)if_index){
677
char interface[IF_NAMESIZE];
678
if(if_indextoname((unsigned int)if_index, interface) == NULL){
679
perror_plus("if_indextoname");
681
fprintf_plus(stderr, "Skipping server on non-used interface"
683
if_indextoname((unsigned int)if_index,
691
ret = init_gnutls_session(&session, mc);
664
697
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
665
PRIu16 "\n", ip, port);
698
PRIuMAX "\n", ip, (uintmax_t)port);
668
701
tcp_sd = socket(pf, SOCK_STREAM, 0);
732
762
if(if_indextoname((unsigned int)if_index, interface) == NULL){
733
763
perror_plus("if_indextoname");
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
765
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
766
"\n", ip, interface, (uintmax_t)port);
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
769
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
770
ip, (uintmax_t)port);
742
772
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
743
773
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
1028
1064
PRIdMAX ") on port %" PRIu16 "\n", name,
1029
1065
host_name, ip, (intmax_t)interface, port);
1031
int ret = start_mandos_communication(ip, port, interface,
1032
avahi_proto_to_af(proto));
1067
int ret = start_mandos_communication(ip, (in_port_t)port,
1069
avahi_proto_to_af(proto),
1034
avahi_simple_poll_quit(mc.simple_poll);
1072
avahi_simple_poll_quit(simple_poll);
1036
if(not add_server(ip, port, interface,
1037
avahi_proto_to_af(proto))){
1074
if(not add_server(ip, (in_port_t)port, interface,
1075
avahi_proto_to_af(proto),
1076
&((mandos_context*)mc)->current_server)){
1038
1077
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1039
1078
" list\n", name);
1078
1120
the callback function is called the Avahi server will free the
1079
1121
resolver for us. */
1081
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1082
name, type, domain, protocol, 0,
1083
resolve_callback, NULL) == NULL)
1123
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1124
interface, protocol, name, type,
1125
domain, protocol, 0,
1126
resolve_callback, mc) == NULL)
1084
1127
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1086
avahi_strerror(avahi_server_errno(mc.server)));
1129
avahi_strerror(avahi_server_errno
1130
(((mandos_context*)mc)->server)));
1089
1133
case AVAHI_BROWSER_REMOVE:
1204
* This function determines if a directory entry in /sys/class/net
1205
* corresponds to an acceptable network device which is up.
1206
* (This function is passed to scandir(3) as a filter function.)
1208
int up_interface(const struct dirent *if_entry){
1209
if(if_entry->d_name[0] == '.'){
1214
if(not get_flags(if_entry->d_name, &ifr)){
1216
fprintf_plus(stderr, "Failed to get flags for interface "
1217
"\"%s\"\n", if_entry->d_name);
1222
/* Reject down interfaces */
1223
if(not (ifr.ifr_flags & IFF_UP)){
1225
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1231
/* Reject non-running interfaces */
1232
if(not (ifr.ifr_flags & IFF_RUNNING)){
1234
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1240
if(not good_flags(if_entry->d_name, &ifr)){
1253
* This function determines if a network interface is up.
1255
bool interface_is_up(const char *interface){
1257
if(not get_flags(interface, &ifr)){
1259
fprintf_plus(stderr, "Failed to get flags for interface "
1260
"\"%s\"\n", interface);
1265
return (bool)(ifr.ifr_flags & IFF_UP);
1269
* This function determines if a network interface is running
1271
bool interface_is_running(const char *interface){
1273
if(not get_flags(interface, &ifr)){
1275
fprintf_plus(stderr, "Failed to get flags for interface "
1276
"\"%s\"\n", interface);
1281
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1246
1284
int notdotentries(const struct dirent *direntry){
1360
1399
if(block_time <= 0){
1361
ret = start_mandos_communication(mc.current_server->ip,
1362
mc.current_server->port,
1363
mc.current_server->if_index,
1364
mc.current_server->af);
1400
ret = start_mandos_communication(mc->current_server->ip,
1401
mc->current_server->port,
1402
mc->current_server->if_index,
1403
mc->current_server->af, mc);
1366
avahi_simple_poll_quit(mc.simple_poll);
1405
avahi_simple_poll_quit(s);
1369
1408
ret = clock_gettime(CLOCK_MONOTONIC,
1370
&mc.current_server->last_seen);
1409
&mc->current_server->last_seen);
1372
1411
perror_plus("clock_gettime");
1375
mc.current_server = mc.current_server->next;
1414
mc->current_server = mc->current_server->next;
1376
1415
block_time = 0; /* Call avahi to find new Mandos
1377
1416
servers, but don't block */
1614
error_t bring_up_interface(const char *const interface,
1617
error_t old_errno = errno;
1618
error_t ret_errno = 0;
1619
int ret, ret_setflags;
1620
struct ifreq network;
1621
unsigned int if_index = if_nametoindex(interface);
1623
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1633
if(not interface_is_up(interface)){
1634
if(not get_flags(interface, &network) and debug){
1636
fprintf_plus(stderr, "Failed to get flags for interface "
1637
"\"%s\"\n", interface);
1640
network.ifr_flags |= IFF_UP;
1642
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1645
perror_plus("socket");
1657
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
1661
/* Raise priviliges */
1665
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1666
messages about the network interface to mess up the prompt */
1667
int ret_linux = klogctl(8, NULL, 5);
1668
bool restore_loglevel = true;
1669
if(ret_linux == -1){
1670
restore_loglevel = false;
1671
perror_plus("klogctl");
1673
#endif /* __linux__ */
1674
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1677
if(restore_loglevel){
1678
ret_linux = klogctl(7, NULL, 0);
1679
if(ret_linux == -1){
1680
perror_plus("klogctl");
1683
#endif /* __linux__ */
1685
/* Lower privileges */
1688
/* Close the socket */
1689
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1691
perror_plus("close");
1694
if(ret_setflags == -1){
1696
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1701
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1705
/* Sleep checking until interface is running.
1706
Check every 0.25s, up to total time of delay */
1707
for(int i=0; i < delay * 4; i++){
1708
if(interface_is_running(interface)){
1711
struct timespec sleeptime = { .tv_nsec = 250000000 };
1712
ret = nanosleep(&sleeptime, NULL);
1713
if(ret == -1 and errno != EINTR){
1714
perror_plus("nanosleep");
1722
error_t take_down_interface(const char *const interface){
1724
error_t old_errno = errno;
1725
error_t ret_errno = 0;
1726
int ret, ret_setflags;
1727
struct ifreq network;
1728
unsigned int if_index = if_nametoindex(interface);
1730
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1734
if(interface_is_up(interface)){
1735
if(not get_flags(interface, &network) and debug){
1737
fprintf_plus(stderr, "Failed to get flags for interface "
1738
"\"%s\"\n", interface);
1741
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1743
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1746
perror_plus("socket");
1752
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
1756
/* Raise priviliges */
1759
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1762
/* Lower privileges */
1765
/* Close the socket */
1766
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1768
perror_plus("close");
1771
if(ret_setflags == -1){
1773
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1778
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1526
1786
int main(int argc, char *argv[]){
1787
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1788
.priority = "SECURE256:!CTYPE-X.509:"
1789
"+CTYPE-OPENPGP", .current_server = NULL,
1790
.interfaces = NULL, .interfaces_size = 0 };
1527
1791
AvahiSServiceBrowser *sb = NULL;
1530
1794
intmax_t tmpmax;
1532
1796
int exitcode = EXIT_SUCCESS;
1533
const char *interface = "";
1534
struct ifreq network;
1536
bool take_down_interface = false;
1797
char *interfaces_to_take_down = NULL;
1798
size_t interfaces_to_take_down_size = 0;
1539
1799
char tempdir[] = "/tmp/mandosXXXXXX";
1540
1800
bool tempdir_created = false;
1541
1801
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1542
1802
const char *seckey = PATHDIR "/" SECKEY;
1543
1803
const char *pubkey = PATHDIR "/" PUBKEY;
1804
char *interfaces_hooks = NULL;
1805
size_t interfaces_hooks_size = 0;
1545
1807
bool gnutls_initialized = false;
1546
1808
bool gpgme_initialized = false;
1773
2035
/* Lower privileges */
1777
perror_plus("seteuid");
2040
/* Remove invalid interface names (except "none") */
2042
char *interface = NULL;
2043
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2045
if(strcmp(interface, "none") != 0
2046
and if_nametoindex(interface) == 0){
2047
if(interface[0] != '\0'){
2048
fprintf_plus(stderr, "Not using nonexisting interface"
2049
" \"%s\"\n", interface);
2051
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
1782
2057
/* Run network hooks */
1783
if(not run_network_hooks("start", interface, delay)){
2059
if(mc.interfaces != NULL){
2060
interfaces_hooks = malloc(mc.interfaces_size);
2061
if(interfaces_hooks == NULL){
2062
perror_plus("malloc");
2065
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2066
interfaces_hooks_size = mc.interfaces_size;
2067
argz_stringify(interfaces_hooks, interfaces_hooks_size,
2070
if(not run_network_hooks("start", interfaces_hooks != NULL ?
2071
interfaces_hooks : "", delay)){
1788
2077
avahi_set_log_function(empty_log);
1791
if(interface[0] == '\0'){
1792
struct dirent **direntries;
1793
/* First look for interfaces that are up */
1794
ret = scandir(sys_class_net, &direntries, up_interface,
1797
/* No up interfaces, look for any good interfaces */
1799
ret = scandir(sys_class_net, &direntries, good_interface,
1803
/* Pick the first interface returned */
1804
interface = strdup(direntries[0]->d_name);
1806
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1808
if(interface == NULL){
1809
perror_plus("malloc");
1811
exitcode = EXIT_FAILURE;
1817
fprintf_plus(stderr, "Could not find a network interface\n");
1818
exitcode = EXIT_FAILURE;
1823
2080
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1824
2081
from the signal handler */
1825
2082
/* Initialize the pseudo-RNG for Avahi */
1826
2083
srand((unsigned int) time(NULL));
1827
mc.simple_poll = avahi_simple_poll_new();
1828
if(mc.simple_poll == NULL){
2084
simple_poll = avahi_simple_poll_new();
2085
if(simple_poll == NULL){
1829
2086
fprintf_plus(stderr,
1830
2087
"Avahi: Failed to create simple poll object.\n");
1831
2088
exitcode = EX_UNAVAILABLE;
1898
/* If the interface is down, bring it up */
1899
if(strcmp(interface, "none") != 0){
1900
if_index = (AvahiIfIndex) if_nametoindex(interface);
1902
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1903
exitcode = EX_UNAVAILABLE;
1911
/* Re-raise priviliges */
1915
perror_plus("seteuid");
1919
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1920
messages about the network interface to mess up the prompt */
1921
ret = klogctl(8, NULL, 5);
1922
bool restore_loglevel = true;
1924
restore_loglevel = false;
1925
perror_plus("klogctl");
1927
#endif /* __linux__ */
1929
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1931
perror_plus("socket");
1932
exitcode = EX_OSERR;
1934
if(restore_loglevel){
1935
ret = klogctl(7, NULL, 0);
1937
perror_plus("klogctl");
1940
#endif /* __linux__ */
1941
/* Lower privileges */
1945
perror_plus("seteuid");
1949
strcpy(network.ifr_name, interface);
1950
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1952
perror_plus("ioctl SIOCGIFFLAGS");
1954
if(restore_loglevel){
1955
ret = klogctl(7, NULL, 0);
1957
perror_plus("klogctl");
1960
#endif /* __linux__ */
1961
exitcode = EX_OSERR;
1962
/* Lower privileges */
1966
perror_plus("seteuid");
1970
if((network.ifr_flags & IFF_UP) == 0){
1971
network.ifr_flags |= IFF_UP;
1972
take_down_interface = true;
1973
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1975
take_down_interface = false;
1976
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1977
exitcode = EX_OSERR;
1979
if(restore_loglevel){
1980
ret = klogctl(7, NULL, 0);
1982
perror_plus("klogctl");
2155
/* If no interfaces were specified, make a list */
2156
if(mc.interfaces == NULL){
2157
struct dirent **direntries;
2158
/* Look for any good interfaces */
2159
ret = scandir(sys_class_net, &direntries, good_interface,
2162
/* Add all found interfaces to interfaces list */
2163
for(int i = 0; i < ret; ++i){
2164
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2165
direntries[i]->d_name);
2167
perror_plus("argz_add");
2171
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2172
direntries[i]->d_name);
2178
fprintf_plus(stderr, "Could not find a network interface\n");
2179
exitcode = EXIT_FAILURE;
2184
/* Bring up interfaces which are down */
2186
char *interface = NULL;
2187
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2189
/* If interface name is "none", stop bringing up interfaces.
2190
Also remove all instances of "none" from the list */
2191
if(strcmp(interface, "none") == 0){
2192
argz_delete(&mc.interfaces, &mc.interfaces_size,
2195
while((interface = argz_next(mc.interfaces,
2196
mc.interfaces_size, interface))){
2197
if(strcmp(interface, "none") == 0){
2198
argz_delete(&mc.interfaces, &mc.interfaces_size,
1985
#endif /* __linux__ */
1986
/* Lower privileges */
1990
perror_plus("seteuid");
1995
/* Sleep checking until interface is running.
1996
Check every 0.25s, up to total time of delay */
1997
for(int i=0; i < delay * 4; i++){
1998
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2000
perror_plus("ioctl SIOCGIFFLAGS");
2001
} else if(network.ifr_flags & IFF_RUNNING){
2004
struct timespec sleeptime = { .tv_nsec = 250000000 };
2005
ret = nanosleep(&sleeptime, NULL);
2006
if(ret == -1 and errno != EINTR){
2007
perror_plus("nanosleep");
2010
if(not take_down_interface){
2011
/* We won't need the socket anymore */
2012
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2014
perror_plus("close");
2018
if(restore_loglevel){
2019
/* Restores kernel loglevel to default */
2020
ret = klogctl(7, NULL, 0);
2022
perror_plus("klogctl");
2025
#endif /* __linux__ */
2026
/* Lower privileges */
2028
/* Lower privileges */
2031
perror_plus("seteuid");
2205
bool interface_was_up = interface_is_up(interface);
2206
ret = bring_up_interface(interface, delay);
2207
if(not interface_was_up){
2210
perror_plus("Failed to bring up interface");
2212
ret_errno = argz_add(&interfaces_to_take_down,
2213
&interfaces_to_take_down_size,
2218
if(debug and (interfaces_to_take_down == NULL)){
2219
fprintf_plus(stderr, "No interfaces were brought up\n");
2223
/* If we only got one interface, explicitly use only that one */
2224
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2226
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2229
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2039
ret = init_gnutls_global(pubkey, seckey);
2236
ret = init_gnutls_global(pubkey, seckey, &mc);
2041
2238
fprintf_plus(stderr, "init_gnutls_global failed\n");
2042
2239
exitcode = EX_UNAVAILABLE;
2241
/* Run network hooks */
2242
run_network_hooks("stop", interface, delay);
2244
2442
/* Re-raise priviliges */
2249
perror_plus("seteuid");
2252
/* Take down the network interface */
2253
if(take_down_interface and geteuid() == 0){
2254
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2256
perror_plus("ioctl SIOCGIFFLAGS");
2257
} else if(network.ifr_flags & IFF_UP){
2258
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2259
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2261
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2446
/* Run network hooks */
2447
run_network_hooks("stop", interfaces_hooks != NULL ?
2448
interfaces_hooks : "", delay);
2450
/* Take down the network interfaces which were brought up */
2452
char *interface = NULL;
2453
while((interface=argz_next(interfaces_to_take_down,
2454
interfaces_to_take_down_size,
2456
ret_errno = take_down_interface(interface);
2459
perror_plus("Failed to take down interface");
2264
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2266
perror_plus("close");
2462
if(debug and (interfaces_to_take_down == NULL)){
2463
fprintf_plus(stderr, "No interfaces needed to be taken"
2270
/* Lower privileges permanently */
2274
perror_plus("setuid");
2468
lower_privileges_permanently();
2471
free(interfaces_to_take_down);
2472
free(interfaces_hooks);
2277
2474
/* Removes the GPGME temp directory and all files inside */
2278
2475
if(tempdir_created){