9
9
* "browse_callback", and parts of "main".
11
11
* Everything else is
12
* Copyright © 2008-2018 Teddy Hogeborn
13
* Copyright © 2008-2018 Björn Påhlsson
15
* This file is part of Mandos.
17
* Mandos is free software: you can redistribute it and/or modify it
18
* under the terms of the GNU General Public License as published by
19
* the Free Software Foundation, either version 3 of the License, or
20
* (at your option) any later version.
22
* Mandos is distributed in the hope that it will be useful, but
12
* Copyright © 2008-2015 Teddy Hogeborn
13
* Copyright © 2008-2015 Björn Påhlsson
15
* This program is free software: you can redistribute it and/or
16
* modify it under the terms of the GNU General Public License as
17
* published by the Free Software Foundation, either version 3 of the
18
* License, or (at your option) any later version.
20
* This program is distributed in the hope that it will be useful, but
23
21
* WITHOUT ANY WARRANTY; without even the implied warranty of
24
22
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
25
23
* General Public License for more details.
27
25
* You should have received a copy of the GNU General Public License
28
* along with Mandos. If not, see <http://www.gnu.org/licenses/>.
26
* along with this program. If not, see
27
* <http://www.gnu.org/licenses/>.
30
29
* Contact the authors at <mandos@recompile.se>.
48
47
strtof(), abort() */
49
48
#include <stdbool.h> /* bool, false, true */
50
49
#include <string.h> /* strcmp(), strlen(), strerror(),
51
asprintf(), strncpy(), strsignal()
50
asprintf(), strcpy() */
53
51
#include <sys/ioctl.h> /* ioctl */
54
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
55
53
sockaddr_in6, PF_INET6,
59
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
60
58
inet_pton(), connect(),
62
#include <fcntl.h> /* open(), unlinkat(), AT_REMOVEDIR */
60
#include <fcntl.h> /* open(), unlinkat() */
63
61
#include <dirent.h> /* opendir(), struct dirent, readdir()
65
63
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
67
#include <errno.h> /* perror(), errno, EINTR, EINVAL,
68
EAI_SYSTEM, ENETUNREACH,
69
EHOSTUNREACH, ECONNREFUSED, EPROTO,
70
EIO, ENOENT, ENXIO, ENOMEM, EISDIR,
65
#include <errno.h> /* perror(), errno,
72
66
program_invocation_short_name */
73
67
#include <time.h> /* nanosleep(), time(), sleep() */
74
68
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
519
513
fprintf_plus(stderr, "GnuTLS: %s", string);
522
__attribute__((nonnull(1, 2, 4), warn_unused_result))
516
__attribute__((nonnull, warn_unused_result))
523
517
static int init_gnutls_global(const char *pubkeyfilename,
524
518
const char *seckeyfilename,
525
519
const char *dhparamsfilename,
821
823
/* Set effective uid to 0, return errno */
822
824
__attribute__((warn_unused_result))
823
int raise_privileges(void){
824
int old_errno = errno;
825
error_t raise_privileges(void){
826
error_t old_errno = errno;
827
error_t ret_errno = 0;
826
828
if(seteuid(0) == -1){
829
831
errno = old_errno;
833
835
/* Set effective and real user ID to 0. Return errno. */
834
836
__attribute__((warn_unused_result))
835
int raise_privileges_permanently(void){
836
int old_errno = errno;
837
int ret = raise_privileges();
837
error_t raise_privileges_permanently(void){
838
error_t old_errno = errno;
839
error_t ret_errno = raise_privileges();
839
841
errno = old_errno;
842
844
if(setuid(0) == -1){
845
847
errno = old_errno;
849
851
/* Set effective user ID to unprivileged saved user ID */
850
852
__attribute__((warn_unused_result))
851
int lower_privileges(void){
852
int old_errno = errno;
853
error_t lower_privileges(void){
854
error_t old_errno = errno;
855
error_t ret_errno = 0;
854
856
if(seteuid(uid) == -1){
857
859
errno = old_errno;
861
863
/* Lower privileges permanently */
862
864
__attribute__((warn_unused_result))
863
int lower_privileges_permanently(void){
864
int old_errno = errno;
865
error_t lower_privileges_permanently(void){
866
error_t old_errno = errno;
867
error_t ret_errno = 0;
866
868
if(setuid(uid) == -1){
869
871
errno = old_errno;
873
875
/* Helper function to add_local_route() and delete_local_route() */
1637
1627
__attribute__((nonnull, warn_unused_result))
1638
1628
bool get_flags(const char *ifname, struct ifreq *ifr){
1642
1632
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1645
1635
perror_plus("socket");
1649
strncpy(ifr->ifr_name, ifname, IF_NAMESIZE);
1650
ifr->ifr_name[IF_NAMESIZE-1] = '\0'; /* NUL terminate */
1639
strcpy(ifr->ifr_name, ifname);
1651
1640
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1655
1644
perror_plus("ioctl SIOCGIFFLAGS");
1926
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
1928
perror_plus("open(\"/dev/null\", O_RDONLY)");
1916
#if __GLIBC_PREREQ(2, 15)
1931
1917
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1932
1918
runnable_hook, alphasort);
1919
#else /* not __GLIBC_PREREQ(2, 15) */
1920
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1922
#endif /* not __GLIBC_PREREQ(2, 15) */
1923
#else /* not __GLIBC__ */
1924
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1926
#endif /* not __GLIBC__ */
1933
1927
if(numhooks == -1){
1934
1928
perror_plus("scandir");
1938
1931
struct dirent *direntry;
1933
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
1935
perror_plus("open(\"/dev/null\", O_RDONLY)");
1940
1938
for(int i = 0; i < numhooks; i++){
1941
1939
direntry = direntries[i];
2292
2288
int main(int argc, char *argv[]){
2293
2289
mandos_context mc = { .server = NULL, .dh_bits = 0,
2294
.priority = "SECURE256:!CTYPE-X.509"
2295
":+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256",
2296
.current_server = NULL, .interfaces = NULL,
2297
.interfaces_size = 0 };
2290
.priority = "SECURE256:!CTYPE-X.509:"
2291
"+CTYPE-OPENPGP:!RSA", .current_server = NULL,
2292
.interfaces = NULL, .interfaces_size = 0 };
2298
2293
AvahiSServiceBrowser *sb = NULL;
2299
2294
error_t ret_errno;
2481
2476
.args_doc = "",
2482
2477
.doc = "Mandos client -- Get and decrypt"
2483
2478
" passwords from a Mandos server" };
2484
ret_errno = argp_parse(&argp, argc, argv,
2485
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
2479
ret = argp_parse(&argp, argc, argv,
2480
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
2492
2487
perror_plus("argp_parse");
2493
2488
exitcode = EX_OSERR;
3025
3014
/* Take down the network interfaces which were brought up */
3027
3016
char *interface = NULL;
3028
while((interface = argz_next(interfaces_to_take_down,
3029
interfaces_to_take_down_size,
3031
ret = take_down_interface(interface);
3017
while((interface=argz_next(interfaces_to_take_down,
3018
interfaces_to_take_down_size,
3020
ret_errno = take_down_interface(interface);
3034
3023
perror_plus("Failed to take down interface");
3051
3040
free(interfaces_to_take_down);
3052
3041
free(interfaces_hooks);
3054
void clean_dir_at(int base, const char * const dirname,
3056
struct dirent **direntries = NULL;
3058
int dir_fd = (int)TEMP_FAILURE_RETRY(openat(base, dirname,
3064
perror_plus("open");
3067
int numentries = scandirat(dir_fd, ".", &direntries,
3068
notdotentries, alphasort);
3069
if(numentries >= 0){
3070
for(int i = 0; i < numentries; i++){
3072
fprintf_plus(stderr, "Unlinking \"%s/%s\"\n",
3073
dirname, direntries[i]->d_name);
3075
dret = unlinkat(dir_fd, direntries[i]->d_name, 0);
3077
if(errno == EISDIR){
3078
dret = unlinkat(dir_fd, direntries[i]->d_name,
3081
if((dret == -1) and (errno == ENOTEMPTY)
3082
and (strcmp(direntries[i]->d_name, "private-keys-v1.d")
3083
== 0) and (level == 0)){
3084
/* Recurse only in this special case */
3085
clean_dir_at(dir_fd, direntries[i]->d_name, level+1);
3088
if((dret == -1) and (errno != ENOENT)){
3089
fprintf_plus(stderr, "unlink(\"%s/%s\"): %s\n", dirname,
3090
direntries[i]->d_name, strerror(errno));
3093
free(direntries[i]);
3096
/* need to clean even if 0 because man page doesn't specify */
3098
dret = unlinkat(base, dirname, AT_REMOVEDIR);
3099
if(dret == -1 and errno != ENOENT){
3100
perror_plus("rmdir");
3103
perror_plus("scandirat");
3108
3043
/* Removes the GPGME temp directory and all files inside */
3109
3044
if(tempdir != NULL){
3110
clean_dir_at(-1, tempdir, 0);
3045
struct dirent **direntries = NULL;
3046
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY
3050
if(tempdir_fd == -1){
3051
perror_plus("open");
3054
#if __GLIBC_PREREQ(2, 15)
3055
int numentries = scandirat(tempdir_fd, ".", &direntries,
3056
notdotentries, alphasort);
3057
#else /* not __GLIBC_PREREQ(2, 15) */
3058
int numentries = scandir(tempdir, &direntries, notdotentries,
3060
#endif /* not __GLIBC_PREREQ(2, 15) */
3061
#else /* not __GLIBC__ */
3062
int numentries = scandir(tempdir, &direntries, notdotentries,
3064
#endif /* not __GLIBC__ */
3065
if(numentries >= 0){
3066
for(int i = 0; i < numentries; i++){
3067
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
3069
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
3070
" \"%s\", 0): %s\n", tempdir,
3071
direntries[i]->d_name, strerror(errno));
3073
free(direntries[i]);
3076
/* need to clean even if 0 because man page doesn't specify */
3078
if(numentries == -1){
3079
perror_plus("scandir");
3081
ret = rmdir(tempdir);
3082
if(ret == -1 and errno != ENOENT){
3083
perror_plus("rmdir");