9
9
* "browse_callback", and parts of "main".
11
11
* Everything else is
12
* Copyright © 2008-2018 Teddy Hogeborn
13
* Copyright © 2008-2018 Björn Påhlsson
15
* This file is part of Mandos.
17
* Mandos is free software: you can redistribute it and/or modify it
18
* under the terms of the GNU General Public License as published by
19
* the Free Software Foundation, either version 3 of the License, or
20
* (at your option) any later version.
22
* Mandos is distributed in the hope that it will be useful, but
12
* Copyright © 2008-2016 Teddy Hogeborn
13
* Copyright © 2008-2016 Björn Påhlsson
15
* This program is free software: you can redistribute it and/or
16
* modify it under the terms of the GNU General Public License as
17
* published by the Free Software Foundation, either version 3 of the
18
* License, or (at your option) any later version.
20
* This program is distributed in the hope that it will be useful, but
23
21
* WITHOUT ANY WARRANTY; without even the implied warranty of
24
22
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
25
23
* General Public License for more details.
27
25
* You should have received a copy of the GNU General Public License
28
* along with Mandos. If not, see <http://www.gnu.org/licenses/>.
26
* along with this program. If not, see
27
* <http://www.gnu.org/licenses/>.
30
29
* Contact the authors at <mandos@recompile.se>.
48
47
strtof(), abort() */
49
48
#include <stdbool.h> /* bool, false, true */
50
49
#include <string.h> /* strcmp(), strlen(), strerror(),
51
asprintf(), strncpy(), strsignal()
50
asprintf(), strncpy() */
53
51
#include <sys/ioctl.h> /* ioctl */
54
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
55
53
sockaddr_in6, PF_INET6,
822
818
/* Set effective uid to 0, return errno */
823
819
__attribute__((warn_unused_result))
824
int raise_privileges(void){
825
int old_errno = errno;
820
error_t raise_privileges(void){
821
error_t old_errno = errno;
822
error_t ret_errno = 0;
827
823
if(seteuid(0) == -1){
830
826
errno = old_errno;
834
830
/* Set effective and real user ID to 0. Return errno. */
835
831
__attribute__((warn_unused_result))
836
int raise_privileges_permanently(void){
837
int old_errno = errno;
838
int ret = raise_privileges();
832
error_t raise_privileges_permanently(void){
833
error_t old_errno = errno;
834
error_t ret_errno = raise_privileges();
840
836
errno = old_errno;
843
839
if(setuid(0) == -1){
846
842
errno = old_errno;
850
846
/* Set effective user ID to unprivileged saved user ID */
851
847
__attribute__((warn_unused_result))
852
int lower_privileges(void){
853
int old_errno = errno;
848
error_t lower_privileges(void){
849
error_t old_errno = errno;
850
error_t ret_errno = 0;
855
851
if(seteuid(uid) == -1){
858
854
errno = old_errno;
862
858
/* Lower privileges permanently */
863
859
__attribute__((warn_unused_result))
864
int lower_privileges_permanently(void){
865
int old_errno = errno;
860
error_t lower_privileges_permanently(void){
861
error_t old_errno = errno;
862
error_t ret_errno = 0;
867
863
if(setuid(uid) == -1){
870
866
errno = old_errno;
874
870
/* Helper function to add_local_route() and delete_local_route() */
1081
1077
bool match = false;
1083
1079
char *interface = NULL;
1084
while((interface = argz_next(mc->interfaces,
1085
mc->interfaces_size,
1080
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
1087
1082
if(if_nametoindex(interface) == (unsigned int)if_index){
1242
1237
with an explicit route added with the server's address.
1244
1239
Avahi bug reference:
1245
https://lists.freedesktop.org/archives/avahi/2010-February/001833.html
1240
http://lists.freedesktop.org/archives/avahi/2010-February/001833.html
1246
1241
https://bugs.debian.org/587961
1638
1623
__attribute__((nonnull, warn_unused_result))
1639
1624
bool get_flags(const char *ifname, struct ifreq *ifr){
1643
1628
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1646
1631
perror_plus("socket");
1650
1635
strncpy(ifr->ifr_name, ifname, IF_NAMESIZE);
1929
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
1931
perror_plus("open(\"/dev/null\", O_RDONLY)");
1934
1912
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1935
1913
runnable_hook, alphasort);
1936
1914
if(numhooks == -1){
1937
1915
perror_plus("scandir");
1941
1918
struct dirent *direntry;
1920
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
1922
perror_plus("open(\"/dev/null\", O_RDONLY)");
1943
1925
for(int i = 0; i < numhooks; i++){
1944
1926
direntry = direntries[i];
2091
2073
__attribute__((nonnull, warn_unused_result))
2092
int bring_up_interface(const char *const interface,
2094
int old_errno = errno;
2074
error_t bring_up_interface(const char *const interface,
2076
error_t old_errno = errno;
2096
2078
struct ifreq network;
2097
2079
unsigned int if_index = if_nametoindex(interface);
2109
2091
if(not interface_is_up(interface)){
2111
int ioctl_errno = 0;
2092
error_t ret_errno = 0, ioctl_errno = 0;
2112
2093
if(not get_flags(interface, &network)){
2113
2094
ret_errno = errno;
2114
2095
fprintf_plus(stderr, "Failed to get flags for interface "
2202
2183
/* Sleep checking until interface is running.
2203
2184
Check every 0.25s, up to total time of delay */
2204
for(int i = 0; i < delay * 4; i++){
2185
for(int i=0; i < delay * 4; i++){
2205
2186
if(interface_is_running(interface)){
2219
2200
__attribute__((nonnull, warn_unused_result))
2220
int take_down_interface(const char *const interface){
2221
int old_errno = errno;
2201
error_t take_down_interface(const char *const interface){
2202
error_t old_errno = errno;
2222
2203
struct ifreq network;
2223
2204
unsigned int if_index = if_nametoindex(interface);
2224
2205
if(if_index == 0){
2229
2210
if(interface_is_up(interface)){
2231
int ioctl_errno = 0;
2211
error_t ret_errno = 0, ioctl_errno = 0;
2232
2212
if(not get_flags(interface, &network) and debug){
2233
2213
ret_errno = errno;
2234
2214
fprintf_plus(stderr, "Failed to get flags for interface "
2484
2464
.args_doc = "",
2485
2465
.doc = "Mandos client -- Get and decrypt"
2486
2466
" passwords from a Mandos server" };
2487
ret_errno = argp_parse(&argp, argc, argv,
2488
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
2467
ret = argp_parse(&argp, argc, argv,
2468
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
2495
2475
perror_plus("argp_parse");
2496
2476
exitcode = EX_OSERR;
2505
2485
/* Work around Debian bug #633582:
2506
<https://bugs.debian.org/633582> */
2486
<http://bugs.debian.org/633582> */
2508
2488
/* Re-raise privileges */
2509
ret = raise_privileges();
2489
ret_errno = raise_privileges();
2512
2492
perror_plus("Failed to raise privileges");
2514
2494
struct stat st;
2915
2895
/* Allocate a new server */
2916
2896
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2917
&config, NULL, NULL, &ret);
2897
&config, NULL, NULL, &ret_errno);
2919
2899
/* Free the Avahi configuration data */
2920
2900
avahi_server_config_free(&config);
2923
2903
/* Check if creating the Avahi server object succeeded */
2924
2904
if(mc.server == NULL){
2925
2905
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2926
avahi_strerror(ret));
2906
avahi_strerror(ret_errno));
2927
2907
exitcode = EX_UNAVAILABLE;
2967
if(signal_received){
2968
fprintf_plus(stderr, "%s exiting due to signal %d: %s\n",
2969
argv[0], signal_received,
2970
strsignal(signal_received));
2972
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2947
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2976
2950
/* Cleanup things */
3028
3002
/* Take down the network interfaces which were brought up */
3030
3004
char *interface = NULL;
3031
while((interface = argz_next(interfaces_to_take_down,
3032
interfaces_to_take_down_size,
3034
ret = take_down_interface(interface);
3005
while((interface=argz_next(interfaces_to_take_down,
3006
interfaces_to_take_down_size,
3008
ret_errno = take_down_interface(interface);
3037
3011
perror_plus("Failed to take down interface");
3088
3061
clean_dir_at(dir_fd, direntries[i]->d_name, level+1);
3091
if((dret == -1) and (errno != ENOENT)){
3092
3065
fprintf_plus(stderr, "unlink(\"%s/%s\"): %s\n", dirname,
3093
3066
direntries[i]->d_name, strerror(errno));
3099
3072
/* need to clean even if 0 because man page doesn't specify */
3100
3073
free(direntries);
3074
if(numentries == -1){
3075
perror_plus("scandirat");
3101
3077
dret = unlinkat(base, dirname, AT_REMOVEDIR);
3102
3078
if(dret == -1 and errno != ENOENT){
3103
3079
perror_plus("rmdir");