33
111
#include <avahi-common/malloc.h>
34
112
#include <avahi-common/error.h>
37
#include <sys/types.h> /* socket(), setsockopt(), inet_pton() */
38
#include <sys/socket.h> /* socket(), setsockopt(), struct sockaddr_in6, struct in6_addr, inet_pton() */
39
#include <gnutls/gnutls.h> /* ALL GNUTLS STUFF */
40
#include <gnutls/openpgp.h> /* gnutls with openpgp stuff */
42
#include <unistd.h> /* close() */
43
#include <netinet/in.h>
44
#include <stdbool.h> /* true */
45
#include <string.h> /* memset */
46
#include <arpa/inet.h> /* inet_pton() */
47
#include <iso646.h> /* not */
50
#include <errno.h> /* perror() */
57
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
59
#define CERTFILE CERT_ROOT "openpgp-client.txt"
60
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
115
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
118
init_gnutls_session(),
120
#include <gnutls/openpgp.h>
121
/* gnutls_certificate_set_openpgp_key_file(),
122
GNUTLS_OPENPGP_FMT_BASE64 */
125
#include <gpgme.h> /* All GPGME types, constants and
128
GPGME_PROTOCOL_OpenPGP,
61
131
#define BUFFER_SIZE 256
133
#define PATHDIR "/conf/conf.d/mandos"
134
#define SECKEY "seckey.txt"
135
#define PUBKEY "pubkey.txt"
136
#define HOOKDIR "/lib/mandos/network-hooks.d"
64
138
bool debug = false;
65
char *interface = "eth0";
139
static const char mandos_protocol_version[] = "1";
140
const char *argp_program_version = "mandos-client " VERSION;
141
const char *argp_program_bug_address = "<mandos@recompile.se>";
142
static const char sys_class_net[] = "/sys/class/net";
143
char *connect_to = NULL;
144
const char *hookdir = HOOKDIR;
149
/* Doubly linked list that need to be circularly linked when used */
150
typedef struct server{
153
AvahiIfIndex if_index;
155
struct timespec last_seen;
160
/* Used for passing in values through the Avahi callback functions */
68
gnutls_session_t session;
69
163
gnutls_certificate_credentials_t cred;
164
unsigned int dh_bits;
70
165
gnutls_dh_params_t dh_params;
74
ssize_t gpg_packet_decrypt (char *packet, size_t packet_size, char **new_packet, char *homedir){
75
gpgme_data_t dh_crypto, dh_plain;
166
const char *priority;
168
server *current_server;
170
size_t interfaces_size;
173
/* global so signal handler can reach it*/
174
AvahiSimplePoll *simple_poll;
176
sig_atomic_t quit_now = 0;
177
int signal_received = 0;
179
/* Function to use when printing errors */
180
void perror_plus(const char *print_text){
182
fprintf(stderr, "Mandos plugin %s: ",
183
program_invocation_short_name);
188
__attribute__((format (gnu_printf, 2, 3), nonnull))
189
int fprintf_plus(FILE *stream, const char *format, ...){
191
va_start (ap, format);
193
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
194
program_invocation_short_name));
195
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
199
* Make additional room in "buffer" for at least BUFFER_SIZE more
200
* bytes. "buffer_capacity" is how much is currently allocated,
201
* "buffer_length" is how much is already used.
203
__attribute__((nonnull, warn_unused_result))
204
size_t incbuffer(char **buffer, size_t buffer_length,
205
size_t buffer_capacity){
206
if(buffer_length + BUFFER_SIZE > buffer_capacity){
207
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
209
int old_errno = errno;
216
buffer_capacity += BUFFER_SIZE;
218
return buffer_capacity;
221
/* Add server to set of servers to retry periodically */
222
__attribute__((nonnull, warn_unused_result))
223
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
224
int af, server **current_server){
226
server *new_server = malloc(sizeof(server));
227
if(new_server == NULL){
228
perror_plus("malloc");
231
*new_server = (server){ .ip = strdup(ip),
233
.if_index = if_index,
235
if(new_server->ip == NULL){
236
perror_plus("strdup");
240
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
242
perror_plus("clock_gettime");
244
#pragma GCC diagnostic push
245
#pragma GCC diagnostic ignored "-Wcast-qual"
247
free((char *)(new_server->ip));
249
#pragma GCC diagnostic pop
254
/* Special case of first server */
255
if(*current_server == NULL){
256
new_server->next = new_server;
257
new_server->prev = new_server;
258
*current_server = new_server;
260
/* Place the new server last in the list */
261
new_server->next = *current_server;
262
new_server->prev = (*current_server)->prev;
263
new_server->prev->next = new_server;
264
(*current_server)->prev = new_server;
272
__attribute__((nonnull, warn_unused_result))
273
static bool init_gpgme(const char * const seckey,
274
const char * const pubkey,
275
const char * const tempdir,
79
size_t new_packet_capacity = 0;
80
size_t new_packet_length = 0;
81
278
gpgme_engine_info_t engine_info;
84
fprintf(stderr, "Attempting to decrypt password from gpg packet\n");
281
* Helper function to insert pub and seckey to the engine keyring.
283
bool import_key(const char * const filename){
286
gpgme_data_t pgp_data;
288
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
294
rc = gpgme_data_new_from_fd(&pgp_data, fd);
295
if(rc != GPG_ERR_NO_ERROR){
296
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
297
gpgme_strsource(rc), gpgme_strerror(rc));
301
rc = gpgme_op_import(mc->ctx, pgp_data);
302
if(rc != GPG_ERR_NO_ERROR){
303
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
304
gpgme_strsource(rc), gpgme_strerror(rc));
308
ret = (int)TEMP_FAILURE_RETRY(close(fd));
310
perror_plus("close");
312
gpgme_data_release(pgp_data);
317
fprintf_plus(stderr, "Initializing GPGME\n");
88
321
gpgme_check_version(NULL);
89
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
322
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
323
if(rc != GPG_ERR_NO_ERROR){
324
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
325
gpgme_strsource(rc), gpgme_strerror(rc));
91
/* Set GPGME home directory */
92
rc = gpgme_get_engine_info (&engine_info);
93
if (rc != GPG_ERR_NO_ERROR){
94
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
95
gpgme_strsource(rc), gpgme_strerror(rc));
329
/* Set GPGME home directory for the OpenPGP engine only */
330
rc = gpgme_get_engine_info(&engine_info);
331
if(rc != GPG_ERR_NO_ERROR){
332
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
333
gpgme_strsource(rc), gpgme_strerror(rc));
98
336
while(engine_info != NULL){
99
337
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
100
338
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
101
engine_info->file_name, homedir);
339
engine_info->file_name, tempdir);
104
342
engine_info = engine_info->next;
106
344
if(engine_info == NULL){
107
fprintf(stderr, "Could not set home dir to %s\n", homedir);
111
/* Create new GPGME data buffer from packet buffer */
112
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
113
if (rc != GPG_ERR_NO_ERROR){
114
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
115
gpgme_strsource(rc), gpgme_strerror(rc));
345
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
350
/* Create new GPGME "context" */
351
rc = gpgme_new(&(mc->ctx));
352
if(rc != GPG_ERR_NO_ERROR){
353
fprintf_plus(stderr, "Mandos plugin mandos-client: "
354
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
359
if(not import_key(pubkey) or not import_key(seckey)){
367
* Decrypt OpenPGP data.
368
* Returns -1 on error
370
__attribute__((nonnull, warn_unused_result))
371
static ssize_t pgp_packet_decrypt(const char *cryptotext,
375
gpgme_data_t dh_crypto, dh_plain;
378
size_t plaintext_capacity = 0;
379
ssize_t plaintext_length = 0;
382
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
385
/* Create new GPGME data buffer from memory cryptotext */
386
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
388
if(rc != GPG_ERR_NO_ERROR){
389
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
390
gpgme_strsource(rc), gpgme_strerror(rc));
119
394
/* Create new empty GPGME data buffer for the plaintext */
120
395
rc = gpgme_data_new(&dh_plain);
121
if (rc != GPG_ERR_NO_ERROR){
122
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
123
gpgme_strsource(rc), gpgme_strerror(rc));
127
/* Create new GPGME "context" */
128
rc = gpgme_new(&ctx);
129
if (rc != GPG_ERR_NO_ERROR){
130
fprintf(stderr, "bad gpgme_new: %s: %s\n",
131
gpgme_strsource(rc), gpgme_strerror(rc));
135
/* Decrypt data from the FILE pointer to the plaintext data buffer */
136
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
137
if (rc != GPG_ERR_NO_ERROR){
138
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
139
gpgme_strsource(rc), gpgme_strerror(rc));
144
fprintf(stderr, "decryption of gpg packet succeeded\n");
148
gpgme_decrypt_result_t result;
149
result = gpgme_op_decrypt_result(ctx);
151
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
153
fprintf(stderr, "Unsupported algorithm: %s\n", result->unsupported_algorithm);
154
fprintf(stderr, "Wrong key usage: %d\n", result->wrong_key_usage);
155
if(result->file_name != NULL){
156
fprintf(stderr, "File name: %s\n", result->file_name);
158
gpgme_recipient_t recipient;
159
recipient = result->recipients;
396
if(rc != GPG_ERR_NO_ERROR){
397
fprintf_plus(stderr, "Mandos plugin mandos-client: "
398
"bad gpgme_data_new: %s: %s\n",
399
gpgme_strsource(rc), gpgme_strerror(rc));
400
gpgme_data_release(dh_crypto);
404
/* Decrypt data from the cryptotext data buffer to the plaintext
406
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
407
if(rc != GPG_ERR_NO_ERROR){
408
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
409
gpgme_strsource(rc), gpgme_strerror(rc));
410
plaintext_length = -1;
412
gpgme_decrypt_result_t result;
413
result = gpgme_op_decrypt_result(mc->ctx);
415
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
417
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
418
result->unsupported_algorithm);
419
fprintf_plus(stderr, "Wrong key usage: %u\n",
420
result->wrong_key_usage);
421
if(result->file_name != NULL){
422
fprintf_plus(stderr, "File name: %s\n", result->file_name);
424
gpgme_recipient_t recipient;
425
recipient = result->recipients;
161
426
while(recipient != NULL){
162
fprintf(stderr, "Public key algorithm: %s\n",
163
gpgme_pubkey_algo_name(recipient->pubkey_algo));
164
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
165
fprintf(stderr, "Secret key available: %s\n",
166
recipient->status == GPG_ERR_NO_SECKEY ? "No" : "Yes");
427
fprintf_plus(stderr, "Public key algorithm: %s\n",
428
gpgme_pubkey_algo_name
429
(recipient->pubkey_algo));
430
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
431
fprintf_plus(stderr, "Secret key available: %s\n",
432
recipient->status == GPG_ERR_NO_SECKEY
167
434
recipient = recipient->next;
173
/* Delete the GPGME FILE pointer cryptotext data buffer */
174
gpgme_data_release(dh_crypto);
442
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
176
445
/* Seek back to the beginning of the GPGME plaintext data buffer */
177
gpgme_data_seek(dh_plain, 0, SEEK_SET);
446
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
447
perror_plus("gpgme_data_seek");
448
plaintext_length = -1;
181
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
182
*new_packet = realloc(*new_packet, new_packet_capacity + BUFFER_SIZE);
183
if (*new_packet == NULL){
187
new_packet_capacity += BUFFER_SIZE;
454
plaintext_capacity = incbuffer(plaintext,
455
(size_t)plaintext_length,
457
if(plaintext_capacity == 0){
458
perror_plus("incbuffer");
459
plaintext_length = -1;
190
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length, BUFFER_SIZE);
463
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
191
465
/* Print the data, if any */
193
/* If password is empty, then a incorrect error will be printed */
197
perror("gpgme_data_read");
200
new_packet_length += ret;
203
/* FIXME: check characters before printing to screen so to not print
204
terminal control characters */
206
/* fprintf(stderr, "decrypted password is: "); */
207
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
208
/* fprintf(stderr, "\n"); */
471
perror_plus("gpgme_data_read");
472
plaintext_length = -1;
475
plaintext_length += ret;
479
fprintf_plus(stderr, "Decrypted password is: ");
480
for(ssize_t i = 0; i < plaintext_length; i++){
481
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
483
fprintf(stderr, "\n");
488
/* Delete the GPGME cryptotext data buffer */
489
gpgme_data_release(dh_crypto);
211
491
/* Delete the GPGME plaintext data buffer */
212
492
gpgme_data_release(dh_plain);
213
return new_packet_length;
493
return plaintext_length;
216
static const char * safer_gnutls_strerror (int value) {
217
const char *ret = gnutls_strerror (value);
496
__attribute__((warn_unused_result))
497
static const char *safer_gnutls_strerror(int value){
498
const char *ret = gnutls_strerror(value);
219
500
ret = "(unknown)";
223
void debuggnutls(int level, const char* string){
224
fprintf(stderr, "%s", string);
504
/* GnuTLS log function callback */
505
__attribute__((nonnull))
506
static void debuggnutls(__attribute__((unused)) int level,
508
fprintf_plus(stderr, "GnuTLS: %s", string);
227
int initgnutls(encrypted_session *es){
511
__attribute__((nonnull, warn_unused_result))
512
static int init_gnutls_global(const char *pubkeyfilename,
513
const char *seckeyfilename,
232
fprintf(stderr, "Initializing gnutls\n");
518
fprintf_plus(stderr, "Initializing GnuTLS\n");
236
if ((ret = gnutls_global_init ())
237
!= GNUTLS_E_SUCCESS) {
238
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
521
ret = gnutls_global_init();
522
if(ret != GNUTLS_E_SUCCESS){
523
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
524
safer_gnutls_strerror(ret));
529
/* "Use a log level over 10 to enable all debugging options."
243
532
gnutls_global_set_log_level(11);
244
533
gnutls_global_set_log_function(debuggnutls);
248
/* openpgp credentials */
249
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
250
!= GNUTLS_E_SUCCESS) {
251
fprintf (stderr, "memory error: %s\n", safer_gnutls_strerror(ret));
536
/* OpenPGP credentials */
537
ret = gnutls_certificate_allocate_credentials(&mc->cred);
538
if(ret != GNUTLS_E_SUCCESS){
539
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
540
safer_gnutls_strerror(ret));
541
gnutls_global_deinit();
256
fprintf(stderr, "Attempting to use openpgp certificate %s"
257
" and keyfile %s as gnutls credentials\n", CERTFILE, KEYFILE);
546
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
547
" secret key %s as GnuTLS credentials\n",
260
552
ret = gnutls_certificate_set_openpgp_key_file
261
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
262
if (ret != GNUTLS_E_SUCCESS) {
264
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s', '%s')\n",
265
ret, CERTFILE, KEYFILE);
266
fprintf(stdout, "The Error is: %s\n",
267
safer_gnutls_strerror(ret));
271
//Gnutls server initialization
272
if ((ret = gnutls_dh_params_init (&es->dh_params))
273
!= GNUTLS_E_SUCCESS) {
274
fprintf (stderr, "Error in dh parameter initialization: %s\n",
275
safer_gnutls_strerror(ret));
279
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
280
!= GNUTLS_E_SUCCESS) {
281
fprintf (stderr, "Error in prime generation: %s\n",
282
safer_gnutls_strerror(ret));
286
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
288
// Gnutls session creation
289
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
290
!= GNUTLS_E_SUCCESS){
291
fprintf(stderr, "Error in gnutls session initialization: %s\n",
292
safer_gnutls_strerror(ret));
295
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
296
!= GNUTLS_E_SUCCESS) {
297
fprintf(stderr, "Syntax error at: %s\n", err);
298
fprintf(stderr, "Gnutls error: %s\n",
299
safer_gnutls_strerror(ret));
303
if ((ret = gnutls_credentials_set
304
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
305
!= GNUTLS_E_SUCCESS) {
306
fprintf(stderr, "Error setting a credentials set: %s\n",
307
safer_gnutls_strerror(ret));
553
(mc->cred, pubkeyfilename, seckeyfilename,
554
GNUTLS_OPENPGP_FMT_BASE64);
555
if(ret != GNUTLS_E_SUCCESS){
557
"Error[%d] while reading the OpenPGP key pair ('%s',"
558
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
559
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
560
safer_gnutls_strerror(ret));
564
/* GnuTLS server initialization */
565
ret = gnutls_dh_params_init(&mc->dh_params);
566
if(ret != GNUTLS_E_SUCCESS){
567
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
568
" initialization: %s\n",
569
safer_gnutls_strerror(ret));
572
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
573
if(ret != GNUTLS_E_SUCCESS){
574
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
575
safer_gnutls_strerror(ret));
579
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
585
gnutls_certificate_free_credentials(mc->cred);
586
gnutls_global_deinit();
587
gnutls_dh_params_deinit(mc->dh_params);
591
__attribute__((nonnull, warn_unused_result))
592
static int init_gnutls_session(gnutls_session_t *session,
595
/* GnuTLS session creation */
597
ret = gnutls_init(session, GNUTLS_SERVER);
601
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
602
if(ret != GNUTLS_E_SUCCESS){
604
"Error in GnuTLS session initialization: %s\n",
605
safer_gnutls_strerror(ret));
611
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
613
gnutls_deinit(*session);
616
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
617
if(ret != GNUTLS_E_SUCCESS){
618
fprintf_plus(stderr, "Syntax error at: %s\n", err);
619
fprintf_plus(stderr, "GnuTLS error: %s\n",
620
safer_gnutls_strerror(ret));
621
gnutls_deinit(*session);
627
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
630
gnutls_deinit(*session);
633
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
634
if(ret != GNUTLS_E_SUCCESS){
635
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
636
safer_gnutls_strerror(ret));
637
gnutls_deinit(*session);
311
641
/* ignore client certificate if any. */
312
gnutls_certificate_server_set_request (es->session, GNUTLS_CERT_IGNORE);
642
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
314
gnutls_dh_set_prime_bits (es->session, DH_BITS);
644
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
319
void empty_log(AvahiLogLevel level, const char *txt){}
649
/* Avahi log function callback */
650
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
651
__attribute__((unused)) const char *txt){}
321
int start_mandos_communication(char *ip, uint16_t port){
323
struct sockaddr_in6 to;
324
encrypted_session es;
653
/* Called when a Mandos server is found */
654
__attribute__((nonnull, warn_unused_result))
655
static int start_mandos_communication(const char *ip, in_port_t port,
656
AvahiIfIndex if_index,
657
int af, mandos_context *mc){
658
int ret, tcp_sd = -1;
660
struct sockaddr_storage to;
325
661
char *buffer = NULL;
326
char *decrypted_buffer;
662
char *decrypted_buffer = NULL;
327
663
size_t buffer_length = 0;
328
664
size_t buffer_capacity = 0;
329
ssize_t decrypted_buffer_size;
333
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
336
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
343
fprintf(stderr, "Binding to interface %s\n", interface);
346
ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, interface, 5);
348
perror("setsockopt bindtodevice");
352
memset(&to,0,sizeof(to));
353
to.sin6_family = AF_INET6;
354
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
667
gnutls_session_t session;
668
int pf; /* Protocol family */
685
fprintf_plus(stderr, "Bad address family: %d\n", af);
690
/* If the interface is specified and we have a list of interfaces */
691
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
692
/* Check if the interface is one of the interfaces we are using */
695
char *interface = NULL;
696
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
698
if(if_nametoindex(interface) == (unsigned int)if_index){
705
/* This interface does not match any in the list, so we don't
706
connect to the server */
708
char interface[IF_NAMESIZE];
709
if(if_indextoname((unsigned int)if_index, interface) == NULL){
710
perror_plus("if_indextoname");
712
fprintf_plus(stderr, "Skipping server on non-used interface"
714
if_indextoname((unsigned int)if_index,
722
ret = init_gnutls_session(&session, mc);
728
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
729
PRIuMAX "\n", ip, (uintmax_t)port);
732
tcp_sd = socket(pf, SOCK_STREAM, 0);
735
perror_plus("socket");
745
memset(&to, 0, sizeof(to));
747
((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;
748
ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);
750
((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;
751
ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);
755
perror_plus("inet_pton");
360
fprintf(stderr, "Bad address: %s\n", ip);
363
to.sin6_port = htons(port);
364
to.sin6_scope_id = if_nametoindex(interface);
367
fprintf(stderr, "Connection to: %s\n", ip);
370
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
376
ret = initgnutls (&es);
383
gnutls_transport_set_ptr (es.session, (gnutls_transport_ptr_t) tcp_sd);
386
fprintf(stderr, "Establishing tls session with %s\n", ip);
390
ret = gnutls_handshake (es.session);
392
if (ret != GNUTLS_E_SUCCESS){
393
fprintf(stderr, "\n*** Handshake failed ***\n");
399
//Retrieve gpg packet that contains the wanted password
402
fprintf(stderr, "Retrieving pgp encrypted password from %s\n", ip);
406
if (buffer_length + BUFFER_SIZE > buffer_capacity){
407
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
412
buffer_capacity += BUFFER_SIZE;
415
ret = gnutls_record_recv
416
(es.session, buffer+buffer_length, BUFFER_SIZE);
761
fprintf_plus(stderr, "Bad address: %s\n", ip);
766
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
767
if(IN6_IS_ADDR_LINKLOCAL
768
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
769
if(if_index == AVAHI_IF_UNSPEC){
770
fprintf_plus(stderr, "An IPv6 link-local address is"
771
" incomplete without a network interface\n");
775
/* Set the network interface number as scope */
776
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
779
((struct sockaddr_in *)&to)->sin_port = htons(port);
788
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
789
char interface[IF_NAMESIZE];
790
if(if_indextoname((unsigned int)if_index, interface) == NULL){
791
perror_plus("if_indextoname");
793
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
794
"\n", ip, interface, (uintmax_t)port);
797
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
798
ip, (uintmax_t)port);
800
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
801
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
803
ret = getnameinfo((struct sockaddr *)&to,
804
sizeof(struct sockaddr_in6),
805
addrstr, sizeof(addrstr), NULL, 0,
808
ret = getnameinfo((struct sockaddr *)&to,
809
sizeof(struct sockaddr_in),
810
addrstr, sizeof(addrstr), NULL, 0,
813
if(ret == EAI_SYSTEM){
814
perror_plus("getnameinfo");
815
} else if(ret != 0) {
816
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
817
} else if(strcmp(addrstr, ip) != 0){
818
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
828
ret = connect(tcp_sd, (struct sockaddr *)&to,
829
sizeof(struct sockaddr_in6));
831
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
832
sizeof(struct sockaddr_in));
835
if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
837
perror_plus("connect");
848
const char *out = mandos_protocol_version;
851
size_t out_size = strlen(out);
852
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
853
out_size - written));
856
perror_plus("write");
860
written += (size_t)ret;
861
if(written < out_size){
864
if(out == mandos_protocol_version){
879
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
887
/* This casting via intptr_t is to eliminate warning about casting
888
an int to a pointer type. This is exactly how the GnuTLS Guile
889
function "set-session-transport-fd!" does it. */
890
gnutls_transport_set_ptr(session,
891
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
899
ret = gnutls_handshake(session);
904
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
906
if(ret != GNUTLS_E_SUCCESS){
908
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
915
/* Read OpenPGP packet that contains the wanted password */
918
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
929
buffer_capacity = incbuffer(&buffer, buffer_length,
931
if(buffer_capacity == 0){
933
perror_plus("incbuffer");
943
sret = gnutls_record_recv(session, buffer+buffer_length,
422
950
case GNUTLS_E_INTERRUPTED:
423
951
case GNUTLS_E_AGAIN:
425
953
case GNUTLS_E_REHANDSHAKE:
426
ret = gnutls_handshake (es.session);
428
fprintf(stderr, "\n*** Handshake failed ***\n");
955
ret = gnutls_handshake(session);
961
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
963
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
435
fprintf(stderr, "Unknown error while reading data from encrypted session with mandos server\n");
437
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
441
buffer_length += ret;
445
if (buffer_length > 0){
446
if ((decrypted_buffer_size = gpg_packet_decrypt(buffer, buffer_length, &decrypted_buffer, CERT_ROOT)) >= 0){
447
fwrite (decrypted_buffer, 1, decrypted_buffer_size, stdout);
448
free(decrypted_buffer);
971
fprintf_plus(stderr, "Unknown error while reading data from"
972
" encrypted session with Mandos server\n");
973
gnutls_bye(session, GNUTLS_SHUT_RDWR);
978
buffer_length += (size_t) sret;
983
fprintf_plus(stderr, "Closing TLS session\n");
992
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
997
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
999
if(buffer_length > 0){
1000
ssize_t decrypted_buffer_size;
1001
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
1002
&decrypted_buffer, mc);
1003
if(decrypted_buffer_size >= 0){
1006
while(written < (size_t) decrypted_buffer_size){
1012
ret = (int)fwrite(decrypted_buffer + written, 1,
1013
(size_t)decrypted_buffer_size - written,
1015
if(ret == 0 and ferror(stdout)){
1018
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
1024
written += (size_t)ret;
1030
/* Shutdown procedure */
1035
free(decrypted_buffer);
1038
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
1044
perror_plus("close");
1046
gnutls_deinit(session);
457
fprintf(stderr, "Closing tls session\n");
461
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
464
gnutls_deinit (es.session);
465
gnutls_certificate_free_credentials (es.cred);
466
gnutls_global_deinit ();
470
static AvahiSimplePoll *simple_poll = NULL;
471
static AvahiServer *server = NULL;
473
static void resolve_callback(
474
AvahiSServiceResolver *r,
475
AVAHI_GCC_UNUSED AvahiIfIndex interface,
476
AVAHI_GCC_UNUSED AvahiProtocol protocol,
477
AvahiResolverEvent event,
481
const char *host_name,
482
const AvahiAddress *address,
484
AvahiStringList *txt,
485
AvahiLookupResultFlags flags,
486
AVAHI_GCC_UNUSED void* userdata) {
490
/* Called whenever a service has been resolved successfully or timed out */
493
case AVAHI_RESOLVER_FAILURE:
494
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of type '%s' in domain '%s': %s\n", name, type, domain, avahi_strerror(avahi_server_errno(server)));
497
case AVAHI_RESOLVER_FOUND: {
498
char ip[AVAHI_ADDRESS_STR_MAX];
499
avahi_address_snprint(ip, sizeof(ip), address);
501
fprintf(stderr, "Mandos server found at %s on port %d\n", ip, port);
503
int ret = start_mandos_communication(ip, port);
1056
__attribute__((nonnull))
1057
static void resolve_callback(AvahiSServiceResolver *r,
1058
AvahiIfIndex interface,
1059
AvahiProtocol proto,
1060
AvahiResolverEvent event,
1064
const char *host_name,
1065
const AvahiAddress *address,
1067
AVAHI_GCC_UNUSED AvahiStringList *txt,
1068
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1075
/* Called whenever a service has been resolved successfully or
511
1079
avahi_s_service_resolver_free(r);
514
static void browse_callback(
515
AvahiSServiceBrowser *b,
516
AvahiIfIndex interface,
517
AvahiProtocol protocol,
518
AvahiBrowserEvent event,
522
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
525
AvahiServer *s = userdata;
528
/* Called whenever a new services becomes available on the LAN or is removed from the LAN */
532
case AVAHI_BROWSER_FAILURE:
534
fprintf(stderr, "(Browser) %s\n", avahi_strerror(avahi_server_errno(server)));
535
avahi_simple_poll_quit(simple_poll);
538
case AVAHI_BROWSER_NEW:
539
/* We ignore the returned resolver object. In the callback
540
function we free it. If the server is terminated before
541
the callback function is called the server will free
542
the resolver for us. */
544
if (!(avahi_s_service_resolver_new(s, interface, protocol, name, type, domain, AVAHI_PROTO_INET6, 0, resolve_callback, s)))
545
fprintf(stderr, "Failed to resolve service '%s': %s\n", name, avahi_strerror(avahi_server_errno(s)));
549
case AVAHI_BROWSER_REMOVE:
552
case AVAHI_BROWSER_ALL_FOR_NOW:
553
case AVAHI_BROWSER_CACHE_EXHAUSTED:
558
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
1085
case AVAHI_RESOLVER_FAILURE:
1086
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1087
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1089
avahi_strerror(avahi_server_errno
1090
(((mandos_context*)mc)->server)));
1093
case AVAHI_RESOLVER_FOUND:
1095
char ip[AVAHI_ADDRESS_STR_MAX];
1096
avahi_address_snprint(ip, sizeof(ip), address);
1098
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1099
PRIdMAX ") on port %" PRIu16 "\n", name,
1100
host_name, ip, (intmax_t)interface, port);
1102
int ret = start_mandos_communication(ip, (in_port_t)port,
1104
avahi_proto_to_af(proto),
1107
avahi_simple_poll_quit(simple_poll);
1109
if(not add_server(ip, (in_port_t)port, interface,
1110
avahi_proto_to_af(proto),
1111
&((mandos_context*)mc)->current_server)){
1112
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1118
avahi_s_service_resolver_free(r);
1121
static void browse_callback(AvahiSServiceBrowser *b,
1122
AvahiIfIndex interface,
1123
AvahiProtocol protocol,
1124
AvahiBrowserEvent event,
1128
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1135
/* Called whenever a new services becomes available on the LAN or
1136
is removed from the LAN */
1144
case AVAHI_BROWSER_FAILURE:
1146
fprintf_plus(stderr, "(Avahi browser) %s\n",
1147
avahi_strerror(avahi_server_errno
1148
(((mandos_context*)mc)->server)));
1149
avahi_simple_poll_quit(simple_poll);
1152
case AVAHI_BROWSER_NEW:
1153
/* We ignore the returned Avahi resolver object. In the callback
1154
function we free it. If the Avahi server is terminated before
1155
the callback function is called the Avahi server will free the
1158
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1159
interface, protocol, name, type,
1160
domain, protocol, 0,
1161
resolve_callback, mc) == NULL)
1162
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1164
avahi_strerror(avahi_server_errno
1165
(((mandos_context*)mc)->server)));
1168
case AVAHI_BROWSER_REMOVE:
1171
case AVAHI_BROWSER_ALL_FOR_NOW:
1172
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1174
fprintf_plus(stderr, "No Mandos server found, still"
1181
/* Signal handler that stops main loop after SIGTERM */
1182
static void handle_sigterm(int sig){
1187
signal_received = sig;
1188
int old_errno = errno;
1189
/* set main loop to exit */
1190
if(simple_poll != NULL){
1191
avahi_simple_poll_quit(simple_poll);
1196
__attribute__((nonnull, warn_unused_result))
1197
bool get_flags(const char *ifname, struct ifreq *ifr){
1201
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1204
perror_plus("socket");
1208
strcpy(ifr->ifr_name, ifname);
1209
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1213
perror_plus("ioctl SIOCGIFFLAGS");
1221
__attribute__((nonnull, warn_unused_result))
1222
bool good_flags(const char *ifname, const struct ifreq *ifr){
1224
/* Reject the loopback device */
1225
if(ifr->ifr_flags & IFF_LOOPBACK){
1227
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1232
/* Accept point-to-point devices only if connect_to is specified */
1233
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1235
fprintf_plus(stderr, "Accepting point-to-point interface"
1236
" \"%s\"\n", ifname);
1240
/* Otherwise, reject non-broadcast-capable devices */
1241
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1243
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1244
" \"%s\"\n", ifname);
1248
/* Reject non-ARP interfaces (including dummy interfaces) */
1249
if(ifr->ifr_flags & IFF_NOARP){
1251
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1257
/* Accept this device */
1259
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1265
* This function determines if a directory entry in /sys/class/net
1266
* corresponds to an acceptable network device.
1267
* (This function is passed to scandir(3) as a filter function.)
1269
__attribute__((nonnull, warn_unused_result))
1270
int good_interface(const struct dirent *if_entry){
1271
if(if_entry->d_name[0] == '.'){
1276
if(not get_flags(if_entry->d_name, &ifr)){
1278
fprintf_plus(stderr, "Failed to get flags for interface "
1279
"\"%s\"\n", if_entry->d_name);
1284
if(not good_flags(if_entry->d_name, &ifr)){
1291
* This function determines if a network interface is up.
1293
__attribute__((nonnull, warn_unused_result))
1294
bool interface_is_up(const char *interface){
1296
if(not get_flags(interface, &ifr)){
1298
fprintf_plus(stderr, "Failed to get flags for interface "
1299
"\"%s\"\n", interface);
1304
return (bool)(ifr.ifr_flags & IFF_UP);
1308
* This function determines if a network interface is running
1310
__attribute__((nonnull, warn_unused_result))
1311
bool interface_is_running(const char *interface){
1313
if(not get_flags(interface, &ifr)){
1315
fprintf_plus(stderr, "Failed to get flags for interface "
1316
"\"%s\"\n", interface);
1321
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1324
__attribute__((nonnull, pure, warn_unused_result))
1325
int notdotentries(const struct dirent *direntry){
1326
/* Skip "." and ".." */
1327
if(direntry->d_name[0] == '.'
1328
and (direntry->d_name[1] == '\0'
1329
or (direntry->d_name[1] == '.'
1330
and direntry->d_name[2] == '\0'))){
1336
/* Is this directory entry a runnable program? */
1337
__attribute__((nonnull, warn_unused_result))
1338
int runnable_hook(const struct dirent *direntry){
1343
if((direntry->d_name)[0] == '\0'){
1348
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1349
"abcdefghijklmnopqrstuvwxyz"
1352
if((direntry->d_name)[sret] != '\0'){
1353
/* Contains non-allowed characters */
1355
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1361
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1364
perror_plus("Could not stat hook");
1368
if(not (S_ISREG(st.st_mode))){
1369
/* Not a regular file */
1371
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1376
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1377
/* Not executable */
1379
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1385
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1391
__attribute__((nonnull, warn_unused_result))
1392
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1393
mandos_context *mc){
1395
struct timespec now;
1396
struct timespec waited_time;
1397
intmax_t block_time;
1400
if(mc->current_server == NULL){
1402
fprintf_plus(stderr, "Wait until first server is found."
1405
ret = avahi_simple_poll_iterate(s, -1);
1408
fprintf_plus(stderr, "Check current_server if we should run"
1411
/* the current time */
1412
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1414
perror_plus("clock_gettime");
1417
/* Calculating in ms how long time between now and server
1418
who we visted longest time ago. Now - last seen. */
1419
waited_time.tv_sec = (now.tv_sec
1420
- mc->current_server->last_seen.tv_sec);
1421
waited_time.tv_nsec = (now.tv_nsec
1422
- mc->current_server->last_seen.tv_nsec);
1423
/* total time is 10s/10,000ms.
1424
Converting to s from ms by dividing by 1,000,
1425
and ns to ms by dividing by 1,000,000. */
1426
block_time = ((retry_interval
1427
- ((intmax_t)waited_time.tv_sec * 1000))
1428
- ((intmax_t)waited_time.tv_nsec / 1000000));
1431
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1435
if(block_time <= 0){
1436
ret = start_mandos_communication(mc->current_server->ip,
1437
mc->current_server->port,
1438
mc->current_server->if_index,
1439
mc->current_server->af, mc);
1441
avahi_simple_poll_quit(s);
1444
ret = clock_gettime(CLOCK_MONOTONIC,
1445
&mc->current_server->last_seen);
1447
perror_plus("clock_gettime");
1450
mc->current_server = mc->current_server->next;
1451
block_time = 0; /* Call avahi to find new Mandos
1452
servers, but don't block */
1455
ret = avahi_simple_poll_iterate(s, (int)block_time);
1458
if(ret > 0 or errno != EINTR){
1459
return (ret != 1) ? ret : 0;
1465
/* Set effective uid to 0, return errno */
1466
__attribute__((warn_unused_result))
1467
error_t raise_privileges(void){
1468
error_t old_errno = errno;
1469
error_t ret_errno = 0;
1470
if(seteuid(0) == -1){
1477
/* Set effective and real user ID to 0. Return errno. */
1478
__attribute__((warn_unused_result))
1479
error_t raise_privileges_permanently(void){
1480
error_t old_errno = errno;
1481
error_t ret_errno = raise_privileges();
1486
if(setuid(0) == -1){
1493
/* Set effective user ID to unprivileged saved user ID */
1494
__attribute__((warn_unused_result))
1495
error_t lower_privileges(void){
1496
error_t old_errno = errno;
1497
error_t ret_errno = 0;
1498
if(seteuid(uid) == -1){
1505
/* Lower privileges permanently */
1506
__attribute__((warn_unused_result))
1507
error_t lower_privileges_permanently(void){
1508
error_t old_errno = errno;
1509
error_t ret_errno = 0;
1510
if(setuid(uid) == -1){
1517
__attribute__((nonnull))
1518
void run_network_hooks(const char *mode, const char *interface,
1520
struct dirent **direntries = NULL;
1521
if(hookdir_fd == -1){
1522
hookdir_fd = open(hookdir, O_RDONLY);
1523
if(hookdir_fd == -1){
1524
if(errno == ENOENT){
1526
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1527
" found\n", hookdir);
1530
perror_plus("open");
1536
#if __GLIBC_PREREQ(2, 15)
1537
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1538
runnable_hook, alphasort);
1539
#else /* not __GLIBC_PREREQ(2, 15) */
1540
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1542
#endif /* not __GLIBC_PREREQ(2, 15) */
1543
#else /* not __GLIBC__ */
1544
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1546
#endif /* not __GLIBC__ */
1548
perror_plus("scandir");
1551
struct dirent *direntry;
1553
int devnull = open("/dev/null", O_RDONLY);
1554
for(int i = 0; i < numhooks; i++){
1555
direntry = direntries[i];
1557
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1560
pid_t hook_pid = fork();
1563
/* Raise privileges */
1564
errno = raise_privileges_permanently();
1566
perror_plus("Failed to raise privileges");
1573
perror_plus("setgid");
1576
/* Reset supplementary groups */
1578
ret = setgroups(0, NULL);
1580
perror_plus("setgroups");
1583
ret = dup2(devnull, STDIN_FILENO);
1585
perror_plus("dup2(devnull, STDIN_FILENO)");
1588
ret = close(devnull);
1590
perror_plus("close");
1593
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1595
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1598
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1600
perror_plus("setenv");
1603
ret = setenv("DEVICE", interface, 1);
1605
perror_plus("setenv");
1608
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1610
perror_plus("setenv");
1613
ret = setenv("MODE", mode, 1);
1615
perror_plus("setenv");
1619
ret = asprintf(&delaystring, "%f", (double)delay);
1621
perror_plus("asprintf");
1624
ret = setenv("DELAY", delaystring, 1);
1627
perror_plus("setenv");
1631
if(connect_to != NULL){
1632
ret = setenv("CONNECT", connect_to, 1);
1634
perror_plus("setenv");
1638
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1640
perror_plus("openat");
1641
_exit(EXIT_FAILURE);
1643
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1644
perror_plus("close");
1645
_exit(EXIT_FAILURE);
1647
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1649
perror_plus("fexecve");
1650
_exit(EXIT_FAILURE);
1654
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1655
perror_plus("waitpid");
1659
if(WIFEXITED(status)){
1660
if(WEXITSTATUS(status) != 0){
1661
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1662
" with status %d\n", direntry->d_name,
1663
WEXITSTATUS(status));
1667
} else if(WIFSIGNALED(status)){
1668
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1669
" signal %d\n", direntry->d_name,
1674
fprintf_plus(stderr, "Warning: network hook \"%s\""
1675
" crashed\n", direntry->d_name);
1681
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1687
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1688
perror_plus("close");
1695
__attribute__((nonnull, warn_unused_result))
1696
error_t bring_up_interface(const char *const interface,
1698
error_t old_errno = errno;
1700
struct ifreq network;
1701
unsigned int if_index = if_nametoindex(interface);
1703
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1713
if(not interface_is_up(interface)){
1714
error_t ret_errno = 0, ioctl_errno = 0;
1715
if(not get_flags(interface, &network)){
1717
fprintf_plus(stderr, "Failed to get flags for interface "
1718
"\"%s\"\n", interface);
1722
network.ifr_flags |= IFF_UP; /* set flag */
1724
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1727
perror_plus("socket");
1733
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1735
perror_plus("close");
1742
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
1746
/* Raise privileges */
1747
ret_errno = raise_privileges();
1750
perror_plus("Failed to raise privileges");
1755
bool restore_loglevel = false;
1757
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1758
messages about the network interface to mess up the prompt */
1759
ret_linux = klogctl(8, NULL, 5);
1760
if(ret_linux == -1){
1761
perror_plus("klogctl");
1763
restore_loglevel = true;
1766
#endif /* __linux__ */
1767
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1768
ioctl_errno = errno;
1770
if(restore_loglevel){
1771
ret_linux = klogctl(7, NULL, 0);
1772
if(ret_linux == -1){
1773
perror_plus("klogctl");
1776
#endif /* __linux__ */
1778
/* If raise_privileges() succeeded above */
1780
/* Lower privileges */
1781
ret_errno = lower_privileges();
1784
perror_plus("Failed to lower privileges");
1788
/* Close the socket */
1789
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1791
perror_plus("close");
1794
if(ret_setflags == -1){
1795
errno = ioctl_errno;
1796
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1801
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1805
/* Sleep checking until interface is running.
1806
Check every 0.25s, up to total time of delay */
1807
for(int i=0; i < delay * 4; i++){
1808
if(interface_is_running(interface)){
1811
struct timespec sleeptime = { .tv_nsec = 250000000 };
1812
ret = nanosleep(&sleeptime, NULL);
1813
if(ret == -1 and errno != EINTR){
1814
perror_plus("nanosleep");
1822
__attribute__((nonnull, warn_unused_result))
1823
error_t take_down_interface(const char *const interface){
1824
error_t old_errno = errno;
1825
struct ifreq network;
1826
unsigned int if_index = if_nametoindex(interface);
1828
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1832
if(interface_is_up(interface)){
1833
error_t ret_errno = 0, ioctl_errno = 0;
1834
if(not get_flags(interface, &network) and debug){
1836
fprintf_plus(stderr, "Failed to get flags for interface "
1837
"\"%s\"\n", interface);
1841
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1843
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1846
perror_plus("socket");
1852
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
1856
/* Raise privileges */
1857
ret_errno = raise_privileges();
1860
perror_plus("Failed to raise privileges");
1863
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1864
ioctl_errno = errno;
1866
/* If raise_privileges() succeeded above */
1868
/* Lower privileges */
1869
ret_errno = lower_privileges();
1872
perror_plus("Failed to lower privileges");
1876
/* Close the socket */
1877
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1879
perror_plus("close");
1882
if(ret_setflags == -1){
1883
errno = ioctl_errno;
1884
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1889
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1897
int main(int argc, char *argv[]){
1898
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1899
.priority = "SECURE256:!CTYPE-X.509:"
1900
"+CTYPE-OPENPGP", .current_server = NULL,
1901
.interfaces = NULL, .interfaces_size = 0 };
1902
AvahiSServiceBrowser *sb = NULL;
1907
int exitcode = EXIT_SUCCESS;
1908
char *interfaces_to_take_down = NULL;
1909
size_t interfaces_to_take_down_size = 0;
1910
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
1911
char old_tempdir[] = "/tmp/mandosXXXXXX";
1912
char *tempdir = NULL;
1913
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1914
const char *seckey = PATHDIR "/" SECKEY;
1915
const char *pubkey = PATHDIR "/" PUBKEY;
1916
char *interfaces_hooks = NULL;
1918
bool gnutls_initialized = false;
1919
bool gpgme_initialized = false;
1921
double retry_interval = 10; /* 10s between trying a server and
1922
retrying the same server again */
1924
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1925
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1930
/* Lower any group privileges we might have, just to be safe */
1934
perror_plus("setgid");
1937
/* Lower user privileges (temporarily) */
1941
perror_plus("seteuid");
1949
struct argp_option options[] = {
1950
{ .name = "debug", .key = 128,
1951
.doc = "Debug mode", .group = 3 },
1952
{ .name = "connect", .key = 'c',
1953
.arg = "ADDRESS:PORT",
1954
.doc = "Connect directly to a specific Mandos server",
1956
{ .name = "interface", .key = 'i',
1958
.doc = "Network interface that will be used to search for"
1961
{ .name = "seckey", .key = 's',
1963
.doc = "OpenPGP secret key file base name",
1965
{ .name = "pubkey", .key = 'p',
1967
.doc = "OpenPGP public key file base name",
1969
{ .name = "dh-bits", .key = 129,
1971
.doc = "Bit length of the prime number used in the"
1972
" Diffie-Hellman key exchange",
1974
{ .name = "priority", .key = 130,
1976
.doc = "GnuTLS priority string for the TLS handshake",
1978
{ .name = "delay", .key = 131,
1980
.doc = "Maximum delay to wait for interface startup",
1982
{ .name = "retry", .key = 132,
1984
.doc = "Retry interval used when denied by the Mandos server",
1986
{ .name = "network-hook-dir", .key = 133,
1988
.doc = "Directory where network hooks are located",
1991
* These reproduce what we would get without ARGP_NO_HELP
1993
{ .name = "help", .key = '?',
1994
.doc = "Give this help list", .group = -1 },
1995
{ .name = "usage", .key = -3,
1996
.doc = "Give a short usage message", .group = -1 },
1997
{ .name = "version", .key = 'V',
1998
.doc = "Print program version", .group = -1 },
2002
error_t parse_opt(int key, char *arg,
2003
struct argp_state *state){
2006
case 128: /* --debug */
2009
case 'c': /* --connect */
2012
case 'i': /* --interface */
2013
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
2016
argp_error(state, "%s", strerror(ret_errno));
2019
case 's': /* --seckey */
2022
case 'p': /* --pubkey */
2025
case 129: /* --dh-bits */
2027
tmpmax = strtoimax(arg, &tmp, 10);
2028
if(errno != 0 or tmp == arg or *tmp != '\0'
2029
or tmpmax != (typeof(mc.dh_bits))tmpmax){
2030
argp_error(state, "Bad number of DH bits");
2032
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
2034
case 130: /* --priority */
2037
case 131: /* --delay */
2039
delay = strtof(arg, &tmp);
2040
if(errno != 0 or tmp == arg or *tmp != '\0'){
2041
argp_error(state, "Bad delay");
2043
case 132: /* --retry */
2045
retry_interval = strtod(arg, &tmp);
2046
if(errno != 0 or tmp == arg or *tmp != '\0'
2047
or (retry_interval * 1000) > INT_MAX
2048
or retry_interval < 0){
2049
argp_error(state, "Bad retry interval");
2052
case 133: /* --network-hook-dir */
2056
* These reproduce what we would get without ARGP_NO_HELP
2058
case '?': /* --help */
2059
argp_state_help(state, state->out_stream,
2060
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
2061
& ~(unsigned int)ARGP_HELP_EXIT_OK);
2062
case -3: /* --usage */
2063
argp_state_help(state, state->out_stream,
2064
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
2065
case 'V': /* --version */
2066
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
2067
exit(argp_err_exit_status);
2070
return ARGP_ERR_UNKNOWN;
2075
struct argp argp = { .options = options, .parser = parse_opt,
2077
.doc = "Mandos client -- Get and decrypt"
2078
" passwords from a Mandos server" };
2079
ret = argp_parse(&argp, argc, argv,
2080
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
2087
perror_plus("argp_parse");
2088
exitcode = EX_OSERR;
2091
exitcode = EX_USAGE;
2097
/* Work around Debian bug #633582:
2098
<http://bugs.debian.org/633582> */
2100
/* Re-raise privileges */
2101
ret_errno = raise_privileges();
2104
perror_plus("Failed to raise privileges");
2108
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2109
int seckey_fd = open(seckey, O_RDONLY);
2110
if(seckey_fd == -1){
2111
perror_plus("open");
2113
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
2115
perror_plus("fstat");
2117
if(S_ISREG(st.st_mode)
2118
and st.st_uid == 0 and st.st_gid == 0){
2119
ret = fchown(seckey_fd, uid, gid);
2121
perror_plus("fchown");
2125
TEMP_FAILURE_RETRY(close(seckey_fd));
2129
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
2130
int pubkey_fd = open(pubkey, O_RDONLY);
2131
if(pubkey_fd == -1){
2132
perror_plus("open");
2134
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
2136
perror_plus("fstat");
2138
if(S_ISREG(st.st_mode)
2139
and st.st_uid == 0 and st.st_gid == 0){
2140
ret = fchown(pubkey_fd, uid, gid);
2142
perror_plus("fchown");
2146
TEMP_FAILURE_RETRY(close(pubkey_fd));
2150
/* Lower privileges */
2151
ret_errno = lower_privileges();
2154
perror_plus("Failed to lower privileges");
2159
/* Remove invalid interface names (except "none") */
2161
char *interface = NULL;
2162
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2164
if(strcmp(interface, "none") != 0
2165
and if_nametoindex(interface) == 0){
2166
if(interface[0] != '\0'){
2167
fprintf_plus(stderr, "Not using nonexisting interface"
2168
" \"%s\"\n", interface);
2170
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2176
/* Run network hooks */
2178
if(mc.interfaces != NULL){
2179
interfaces_hooks = malloc(mc.interfaces_size);
2180
if(interfaces_hooks == NULL){
2181
perror_plus("malloc");
2184
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2185
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2187
run_network_hooks("start", interfaces_hooks != NULL ?
2188
interfaces_hooks : "", delay);
2192
avahi_set_log_function(empty_log);
2195
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
2196
from the signal handler */
2197
/* Initialize the pseudo-RNG for Avahi */
2198
srand((unsigned int) time(NULL));
2199
simple_poll = avahi_simple_poll_new();
2200
if(simple_poll == NULL){
2201
fprintf_plus(stderr,
2202
"Avahi: Failed to create simple poll object.\n");
2203
exitcode = EX_UNAVAILABLE;
2207
sigemptyset(&sigterm_action.sa_mask);
2208
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
2210
perror_plus("sigaddset");
2211
exitcode = EX_OSERR;
2214
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
2216
perror_plus("sigaddset");
2217
exitcode = EX_OSERR;
2220
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
2222
perror_plus("sigaddset");
2223
exitcode = EX_OSERR;
2226
/* Need to check if the handler is SIG_IGN before handling:
2227
| [[info:libc:Initial Signal Actions]] |
2228
| [[info:libc:Basic Signal Handling]] |
2230
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
2232
perror_plus("sigaction");
2235
if(old_sigterm_action.sa_handler != SIG_IGN){
2236
ret = sigaction(SIGINT, &sigterm_action, NULL);
2238
perror_plus("sigaction");
2239
exitcode = EX_OSERR;
2243
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
2245
perror_plus("sigaction");
2248
if(old_sigterm_action.sa_handler != SIG_IGN){
2249
ret = sigaction(SIGHUP, &sigterm_action, NULL);
2251
perror_plus("sigaction");
2252
exitcode = EX_OSERR;
2256
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
2258
perror_plus("sigaction");
2261
if(old_sigterm_action.sa_handler != SIG_IGN){
2262
ret = sigaction(SIGTERM, &sigterm_action, NULL);
2264
perror_plus("sigaction");
2265
exitcode = EX_OSERR;
2270
/* If no interfaces were specified, make a list */
2271
if(mc.interfaces == NULL){
2272
struct dirent **direntries = NULL;
2273
/* Look for any good interfaces */
2274
ret = scandir(sys_class_net, &direntries, good_interface,
2277
/* Add all found interfaces to interfaces list */
2278
for(int i = 0; i < ret; ++i){
2279
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2280
direntries[i]->d_name);
2283
perror_plus("argz_add");
2284
free(direntries[i]);
2288
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2289
direntries[i]->d_name);
2291
free(direntries[i]);
2298
fprintf_plus(stderr, "Could not find a network interface\n");
2299
exitcode = EXIT_FAILURE;
2304
/* Bring up interfaces which are down, and remove any "none"s */
2306
char *interface = NULL;
2307
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2309
/* If interface name is "none", stop bringing up interfaces.
2310
Also remove all instances of "none" from the list */
2311
if(strcmp(interface, "none") == 0){
2312
argz_delete(&mc.interfaces, &mc.interfaces_size,
2315
while((interface = argz_next(mc.interfaces,
2316
mc.interfaces_size, interface))){
2317
if(strcmp(interface, "none") == 0){
2318
argz_delete(&mc.interfaces, &mc.interfaces_size,
2325
bool interface_was_up = interface_is_up(interface);
2326
errno = bring_up_interface(interface, delay);
2327
if(not interface_was_up){
2329
perror_plus("Failed to bring up interface");
2331
errno = argz_add(&interfaces_to_take_down,
2332
&interfaces_to_take_down_size,
2335
perror_plus("argz_add");
2340
if(debug and (interfaces_to_take_down == NULL)){
2341
fprintf_plus(stderr, "No interfaces were brought up\n");
2345
/* If we only got one interface, explicitly use only that one */
2346
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2348
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2351
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2358
ret = init_gnutls_global(pubkey, seckey, &mc);
2360
fprintf_plus(stderr, "init_gnutls_global failed\n");
2361
exitcode = EX_UNAVAILABLE;
2364
gnutls_initialized = true;
2371
/* Try /run/tmp before /tmp */
2372
tempdir = mkdtemp(run_tempdir);
2373
if(tempdir == NULL and errno == ENOENT){
2375
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2376
run_tempdir, old_tempdir);
2378
tempdir = mkdtemp(old_tempdir);
2380
if(tempdir == NULL){
2381
perror_plus("mkdtemp");
2389
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2390
fprintf_plus(stderr, "init_gpgme failed\n");
2391
exitcode = EX_UNAVAILABLE;
2394
gpgme_initialized = true;
2401
if(connect_to != NULL){
2402
/* Connect directly, do not use Zeroconf */
2403
/* (Mainly meant for debugging) */
2404
char *address = strrchr(connect_to, ':');
2406
if(address == NULL){
2407
fprintf_plus(stderr, "No colon in address\n");
2408
exitcode = EX_USAGE;
2418
tmpmax = strtoimax(address+1, &tmp, 10);
2419
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2420
or tmpmax != (in_port_t)tmpmax){
2421
fprintf_plus(stderr, "Bad port number\n");
2422
exitcode = EX_USAGE;
2430
port = (in_port_t)tmpmax;
2432
/* Colon in address indicates IPv6 */
2434
if(strchr(connect_to, ':') != NULL){
2436
/* Accept [] around IPv6 address - see RFC 5952 */
2437
if(connect_to[0] == '[' and address[-1] == ']')
2445
address = connect_to;
2451
while(not quit_now){
2452
ret = start_mandos_communication(address, port, if_index, af,
2454
if(quit_now or ret == 0){
2458
fprintf_plus(stderr, "Retrying in %d seconds\n",
2459
(int)retry_interval);
2461
sleep((unsigned int)retry_interval);
2465
exitcode = EXIT_SUCCESS;
559
2476
AvahiServerConfig config;
560
AvahiSServiceBrowser *sb = NULL;
563
int returncode = EXIT_SUCCESS;
566
static struct option long_options[] = {
567
{"debug", no_argument, (int *)&debug, 1},
568
{"interface", required_argument, 0, 'i'},
571
int option_index = 0;
572
ret = getopt_long (argc, argv, "i:", long_options, &option_index);
590
avahi_set_log_function(empty_log);
593
/* Initialize the psuedo-RNG */
596
/* Allocate main loop object */
597
if (!(simple_poll = avahi_simple_poll_new())) {
598
fprintf(stderr, "Failed to create simple poll object.\n");
603
/* Do not publish any local records */
2477
/* Do not publish any local Zeroconf records */
604
2478
avahi_server_config_init(&config);
605
2479
config.publish_hinfo = 0;
606
2480
config.publish_addresses = 0;
607
2481
config.publish_workstation = 0;
608
2482
config.publish_domain = 0;
610
2484
/* Allocate a new server */
611
server = avahi_server_new(avahi_simple_poll_get(simple_poll), &config, NULL, NULL, &error);
613
/* Free the configuration data */
2485
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2486
&config, NULL, NULL, &ret_errno);
2488
/* Free the Avahi configuration data */
614
2489
avahi_server_config_free(&config);
616
/* Check if creating the server object succeeded */
618
fprintf(stderr, "Failed to create server: %s\n", avahi_strerror(error));
619
returncode = EXIT_FAILURE;
623
/* Create the service browser */
624
if (!(sb = avahi_s_service_browser_new(server, if_nametoindex("eth0"), AVAHI_PROTO_INET6, "_mandos._tcp", NULL, 0, browse_callback, server))) {
625
fprintf(stderr, "Failed to create service browser: %s\n", avahi_strerror(avahi_server_errno(server)));
626
returncode = EXIT_FAILURE;
630
/* Run the main loop */
633
fprintf(stderr, "Starting avahi loop search\n");
636
avahi_simple_poll_loop(simple_poll);
641
fprintf(stderr, "%s exiting\n", argv[0]);
646
avahi_s_service_browser_free(sb);
649
avahi_server_free(server);
652
avahi_simple_poll_free(simple_poll);
2492
/* Check if creating the Avahi server object succeeded */
2493
if(mc.server == NULL){
2494
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2495
avahi_strerror(ret_errno));
2496
exitcode = EX_UNAVAILABLE;
2504
/* Create the Avahi service browser */
2505
sb = avahi_s_service_browser_new(mc.server, if_index,
2506
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2507
NULL, 0, browse_callback,
2510
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2511
avahi_strerror(avahi_server_errno(mc.server)));
2512
exitcode = EX_UNAVAILABLE;
2520
/* Run the main loop */
2523
fprintf_plus(stderr, "Starting Avahi loop search\n");
2526
ret = avahi_loop_with_timeout(simple_poll,
2527
(int)(retry_interval * 1000), &mc);
2529
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2530
(ret == 0) ? "successfully" : "with error");
2536
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2539
/* Cleanup things */
2540
free(mc.interfaces);
2543
avahi_s_service_browser_free(sb);
2545
if(mc.server != NULL)
2546
avahi_server_free(mc.server);
2548
if(simple_poll != NULL)
2549
avahi_simple_poll_free(simple_poll);
2551
if(gnutls_initialized){
2552
gnutls_certificate_free_credentials(mc.cred);
2553
gnutls_global_deinit();
2554
gnutls_dh_params_deinit(mc.dh_params);
2557
if(gpgme_initialized){
2558
gpgme_release(mc.ctx);
2561
/* Cleans up the circular linked list of Mandos servers the client
2563
if(mc.current_server != NULL){
2564
mc.current_server->prev->next = NULL;
2565
while(mc.current_server != NULL){
2566
server *next = mc.current_server->next;
2568
#pragma GCC diagnostic push
2569
#pragma GCC diagnostic ignored "-Wcast-qual"
2571
free((char *)(mc.current_server->ip));
2573
#pragma GCC diagnostic pop
2575
free(mc.current_server);
2576
mc.current_server = next;
2580
/* Re-raise privileges */
2582
ret_errno = raise_privileges();
2585
perror_plus("Failed to raise privileges");
2588
/* Run network hooks */
2589
run_network_hooks("stop", interfaces_hooks != NULL ?
2590
interfaces_hooks : "", delay);
2592
/* Take down the network interfaces which were brought up */
2594
char *interface = NULL;
2595
while((interface=argz_next(interfaces_to_take_down,
2596
interfaces_to_take_down_size,
2598
ret_errno = take_down_interface(interface);
2601
perror_plus("Failed to take down interface");
2604
if(debug and (interfaces_to_take_down == NULL)){
2605
fprintf_plus(stderr, "No interfaces needed to be taken"
2611
ret_errno = lower_privileges_permanently();
2614
perror_plus("Failed to lower privileges permanently");
2618
free(interfaces_to_take_down);
2619
free(interfaces_hooks);
2621
/* Removes the GPGME temp directory and all files inside */
2622
if(tempdir != NULL){
2623
struct dirent **direntries = NULL;
2624
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2626
if(tempdir_fd == -1){
2627
perror_plus("open");
2630
#if __GLIBC_PREREQ(2, 15)
2631
int numentries = scandirat(tempdir_fd, ".", &direntries,
2632
notdotentries, alphasort);
2633
#else /* not __GLIBC_PREREQ(2, 15) */
2634
int numentries = scandir(tempdir, &direntries, notdotentries,
2636
#endif /* not __GLIBC_PREREQ(2, 15) */
2637
#else /* not __GLIBC__ */
2638
int numentries = scandir(tempdir, &direntries, notdotentries,
2640
#endif /* not __GLIBC__ */
2641
if(numentries >= 0){
2642
for(int i = 0; i < numentries; i++){
2643
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2645
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2646
" \"%s\", 0): %s\n", tempdir,
2647
direntries[i]->d_name, strerror(errno));
2649
free(direntries[i]);
2652
/* need to clean even if 0 because man page doesn't specify */
2654
if(numentries == -1){
2655
perror_plus("scandir");
2657
ret = rmdir(tempdir);
2658
if(ret == -1 and errno != ENOENT){
2659
perror_plus("rmdir");
2662
TEMP_FAILURE_RETRY(close(tempdir_fd));
2667
sigemptyset(&old_sigterm_action.sa_mask);
2668
old_sigterm_action.sa_handler = SIG_DFL;
2669
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
2670
&old_sigterm_action,
2673
perror_plus("sigaction");
2676
ret = raise(signal_received);
2677
} while(ret != 0 and errno == EINTR);
2679
perror_plus("raise");
2682
TEMP_FAILURE_RETRY(pause());