/mandos/release : revision 237.7.50

26

* along with this program. If not, see

27

* <http://www.gnu.org/licenses/>.

28

*

29

* Contact the authors at <mandos@recompile.se>.

29

* Contact the authors at <mandos@fukt.bsnet.se>.

30

*/

31

32

/* Needed by GPGME, specifically gpgme_data_seek() */

53

sockaddr_in6, PF_INET6,

54

SOCK_STREAM, uid_t, gid_t, open(),

55

opendir(), DIR */

56

#include <sys/stat.h> /* open(), S_ISREG */

56

#include <sys/stat.h> /* open() */

57

#include <sys/socket.h> /* socket(), struct sockaddr_in6,

58

inet_pton(), connect() */

59

#include <fcntl.h> /* open() */

85

raise() */

86

#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,

87

EX_NOHOST, EX_IOERR, EX_PROTOCOL */

88

#include <sys/wait.h> /* waitpid(), WIFEXITED(),

89

WEXITSTATUS(), WTERMSIG() */

90

88

91

89

#ifdef __linux__

92

90

#include <sys/klog.h> /* klogctl() */

110

108

init_gnutls_session(),

111

109

GNUTLS_* */

112

110

#include <gnutls/openpgp.h>

113

/* gnutls_certificate_set_openpgp_key_file(),

114

GNUTLS_OPENPGP_FMT_BASE64 */

111

/* gnutls_certificate_set_openpgp_key_file(),

112

GNUTLS_OPENPGP_FMT_BASE64 */

115

113

116

114

/* GPGME */

117

115

#include <gpgme.h> /* All GPGME types, constants and

125

123

#define PATHDIR "/conf/conf.d/mandos"

126

124

#define SECKEY "seckey.txt"

127

125

#define PUBKEY "pubkey.txt"

128

#define HOOKDIR "/lib/mandos/network-hooks.d"

129

126

130

127

bool debug = false;

131

128

static const char mandos_protocol_version[] = "1";

132

129

const char *argp_program_version = "mandos-client " VERSION;

133

const char *argp_program_bug_address = "<mandos@recompile.se>";

130

const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";

134

131

static const char sys_class_net[] = "/sys/class/net";

135

132

char *connect_to = NULL;

136

const char *hookdir = HOOKDIR;

137

133

138

134

/* Doubly linked list that need to be circularly linked when used */

139

135

typedef struct server{

174

170

perror(print_text);

175

171

}

176

172

177

int fprintf_plus(FILE *stream, const char *format, ...){

178

va_list ap;

179

va_start (ap, format);

180

181

TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ", program_invocation_short_name));

182

return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));

183

}

184

185

173

/*

186

174

* Make additional room in "buffer" for at least BUFFER_SIZE more

187

175

* bytes. "buffer_capacity" is how much is currently allocated,

188

176

* "buffer_length" is how much is already used.

189

177

*/

190

178

size_t incbuffer(char **buffer, size_t buffer_length,

191

size_t buffer_capacity){

179

size_t buffer_capacity){

192

180

if(buffer_length + BUFFER_SIZE > buffer_capacity){

193

181

*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);

194

182

if(buffer == NULL){

200

188

}

201

189

202

190

/* Add server to set of servers to retry periodically */

203

int add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,

204

int af){

191

int add_server(const char *ip, uint16_t port,

192

AvahiIfIndex if_index,

193

int af){

205

194

int ret;

206

195

server *new_server = malloc(sizeof(server));

207

196

if(new_server == NULL){

209

198

return -1;

210

199

}

211

200

*new_server = (server){ .ip = strdup(ip),

212

.port = port,

213

.if_index = if_index,

214

.af = af };

201

.port = port,

202

.if_index = if_index,

203

.af = af };

215

204

if(new_server->ip == NULL){

216

205

perror_plus("strdup");

217

206

return -1;

239

228

/*

240

229

* Initialize GPGME.

241

230

*/

242

static bool init_gpgme(const char *seckey, const char *pubkey,

243

const char *tempdir){

231

static bool init_gpgme(const char *seckey,

232

const char *pubkey, const char *tempdir){

244

233

gpgme_error_t rc;

245

234

gpgme_engine_info_t engine_info;

246

235

261

250

262

251

rc = gpgme_data_new_from_fd(&pgp_data, fd);

263

252

if(rc != GPG_ERR_NO_ERROR){

264

fprintf(stderr, "Mandos plugin mandos-client: "

265

"bad gpgme_data_new_from_fd: %s: %s\n",

253

fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",

266

254

gpgme_strsource(rc), gpgme_strerror(rc));

267

255

return false;

268

256

}

269

257

270

258

rc = gpgme_op_import(mc.ctx, pgp_data);

271

259

if(rc != GPG_ERR_NO_ERROR){

272

fprintf(stderr, "Mandos plugin mandos-client: "

273

"bad gpgme_op_import: %s: %s\n",

260

fprintf(stderr, "bad gpgme_op_import: %s: %s\n",

274

261

gpgme_strsource(rc), gpgme_strerror(rc));

275

262

return false;

276

263

}

284

271

}

285

272

286

273

if(debug){

287

fprintf(stderr, "Mandos plugin mandos-client: "

288

"Initializing GPGME\n");

274

fprintf(stderr, "Initializing GPGME\n");

289

275

}

290

276

291

277

/* Init GPGME */

292

278

gpgme_check_version(NULL);

293

279

rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);

294

280

if(rc != GPG_ERR_NO_ERROR){

295

fprintf(stderr, "Mandos plugin mandos-client: "

296

"bad gpgme_engine_check_version: %s: %s\n",

281

fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",

297

282

gpgme_strsource(rc), gpgme_strerror(rc));

298

283

return false;

299

284

}

301

286

/* Set GPGME home directory for the OpenPGP engine only */

302

287

rc = gpgme_get_engine_info(&engine_info);

303

288

if(rc != GPG_ERR_NO_ERROR){

304

fprintf(stderr, "Mandos plugin mandos-client: "

305

"bad gpgme_get_engine_info: %s: %s\n",

289

fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",

306

290

gpgme_strsource(rc), gpgme_strerror(rc));

307

291

return false;

308

292

}

315

299

engine_info = engine_info->next;

316

300

}

317

301

if(engine_info == NULL){

318

fprintf(stderr, "Mandos plugin mandos-client: "

319

"Could not set GPGME home dir to %s\n", tempdir);

302

fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);

320

303

return false;

321

304

}

322

305

323

306

/* Create new GPGME "context" */

324

307

rc = gpgme_new(&(mc.ctx));

325

308

if(rc != GPG_ERR_NO_ERROR){

326

fprintf(stderr, "Mandos plugin mandos-client: "

327

"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),

328

gpgme_strerror(rc));

309

fprintf(stderr, "bad gpgme_new: %s: %s\n",

310

gpgme_strsource(rc), gpgme_strerror(rc));

329

311

return false;

330

312

}

331

313

350

332

ssize_t plaintext_length = 0;

351

333

352

334

if(debug){

353

fprintf(stderr, "Mandos plugin mandos-client: "

354

"Trying to decrypt OpenPGP data\n");

335

fprintf(stderr, "Trying to decrypt OpenPGP data\n");

355

336

}

356

337

357

338

/* Create new GPGME data buffer from memory cryptotext */

358

339

rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,

359

340

0);

360

341

if(rc != GPG_ERR_NO_ERROR){

361

fprintf(stderr, "Mandos plugin mandos-client: "

362

"bad gpgme_data_new_from_mem: %s: %s\n",

342

fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",

363

343

gpgme_strsource(rc), gpgme_strerror(rc));

364

344

return -1;

365

345

}

367

347

/* Create new empty GPGME data buffer for the plaintext */

368

348

rc = gpgme_data_new(&dh_plain);

369

349

if(rc != GPG_ERR_NO_ERROR){

370

fprintf(stderr, "Mandos plugin mandos-client: "

371

"bad gpgme_data_new: %s: %s\n",

350

fprintf(stderr, "bad gpgme_data_new: %s: %s\n",

372

351

gpgme_strsource(rc), gpgme_strerror(rc));

373

352

gpgme_data_release(dh_crypto);

374

353

return -1;

378

357

data buffer */

379

358

rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);

380

359

if(rc != GPG_ERR_NO_ERROR){

381

fprintf(stderr, "Mandos plugin mandos-client: "

382

"bad gpgme_op_decrypt: %s: %s\n",

360

fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",

383

361

gpgme_strsource(rc), gpgme_strerror(rc));

384

362

plaintext_length = -1;

385

363

if(debug){

386

364

gpgme_decrypt_result_t result;

387

365

result = gpgme_op_decrypt_result(mc.ctx);

388

366

if(result == NULL){

389

fprintf(stderr, "Mandos plugin mandos-client: "

390

"gpgme_op_decrypt_result failed\n");

367

fprintf(stderr, "gpgme_op_decrypt_result failed\n");

391

368

} else {

392

fprintf(stderr, "Mandos plugin mandos-client: "

393

"Unsupported algorithm: %s\n",

369

fprintf(stderr, "Unsupported algorithm: %s\n",

394

370

result->unsupported_algorithm);

395

fprintf(stderr, "Mandos plugin mandos-client: "

396

"Wrong key usage: %u\n",

371

fprintf(stderr, "Wrong key usage: %u\n",

397

372

result->wrong_key_usage);

398

373

if(result->file_name != NULL){

399

fprintf(stderr, "Mandos plugin mandos-client: "

400

"File name: %s\n", result->file_name);

374

fprintf(stderr, "File name: %s\n", result->file_name);

401

375

}

402

376

gpgme_recipient_t recipient;

403

377

recipient = result->recipients;

404

378

while(recipient != NULL){

405

fprintf(stderr, "Mandos plugin mandos-client: "

406

"Public key algorithm: %s\n",

379

fprintf(stderr, "Public key algorithm: %s\n",

407

380

gpgme_pubkey_algo_name(recipient->pubkey_algo));

408

fprintf(stderr, "Mandos plugin mandos-client: "

409

"Key ID: %s\n", recipient->keyid);

410

fprintf(stderr, "Mandos plugin mandos-client: "

411

"Secret key available: %s\n",

381

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

382

fprintf(stderr, "Secret key available: %s\n",

412

383

recipient->status == GPG_ERR_NO_SECKEY

413

384

? "No" : "Yes");

414

385

recipient = recipient->next;

419

390

}

420

391

421

392

if(debug){

422

fprintf(stderr, "Mandos plugin mandos-client: "

423

"Decryption of OpenPGP data succeeded\n");

393

fprintf(stderr, "Decryption of OpenPGP data succeeded\n");

424

394

}

425

395

426

396

/* Seek back to the beginning of the GPGME plaintext data buffer */

433

403

*plaintext = NULL;

434

404

while(true){

435

405

plaintext_capacity = incbuffer(plaintext,

436

(size_t)plaintext_length,

437

plaintext_capacity);

406

(size_t)plaintext_length,

407

plaintext_capacity);

438

408

if(plaintext_capacity == 0){

439

perror_plus("incbuffer");

440

plaintext_length = -1;

441

goto decrypt_end;

409

perror_plus("incbuffer");

410

plaintext_length = -1;

411

goto decrypt_end;

442

412

}

443

413

444

414

ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,

457

427

}

458

428

459

429

if(debug){

460

fprintf(stderr, "Mandos plugin mandos-client: "

461

"Decrypted password is: ");

430

fprintf(stderr, "Decrypted password is: ");

462

431

for(ssize_t i = 0; i < plaintext_length; i++){

463

432

fprintf(stderr, "%02hhX ", (*plaintext)[i]);

464

433

}

486

455

/* GnuTLS log function callback */

487

456

static void debuggnutls(__attribute__((unused)) int level,

488

457

const char* string){

489

fprintf(stderr, "Mandos plugin mandos-client: GnuTLS: %s", string);

458

fprintf(stderr, "GnuTLS: %s", string);

490

459

}

491

460

492

461

static int init_gnutls_global(const char *pubkeyfilename,

494

463

int ret;

495

464

496

465

if(debug){

497

fprintf(stderr, "Mandos plugin mandos-client: "

498

"Initializing GnuTLS\n");

466

fprintf(stderr, "Initializing GnuTLS\n");

499

467

}

500

468

501

469

ret = gnutls_global_init();

502

470

if(ret != GNUTLS_E_SUCCESS){

503

fprintf(stderr, "Mandos plugin mandos-client: "

504

"GnuTLS global_init: %s\n", safer_gnutls_strerror(ret));

471

fprintf(stderr, "GnuTLS global_init: %s\n",

472

safer_gnutls_strerror(ret));

505

473

return -1;

506

474

}

507

475

516

484

/* OpenPGP credentials */

517

485

ret = gnutls_certificate_allocate_credentials(&mc.cred);

518

486

if(ret != GNUTLS_E_SUCCESS){

519

fprintf(stderr, "Mandos plugin mandos-client: "

520

"GnuTLS memory error: %s\n", safer_gnutls_strerror(ret));

487

fprintf(stderr, "GnuTLS memory error: %s\n",

488

safer_gnutls_strerror(ret));

521

489

gnutls_global_deinit();

522

490

return -1;

523

491

}

524

492

525

493

if(debug){

526

fprintf(stderr, "Mandos plugin mandos-client: "

527

"Attempting to use OpenPGP public key %s and"

494

fprintf(stderr, "Attempting to use OpenPGP public key %s and"

528

495

" secret key %s as GnuTLS credentials\n", pubkeyfilename,

529

496

seckeyfilename);

530

497

}

534

501

GNUTLS_OPENPGP_FMT_BASE64);

535

502

if(ret != GNUTLS_E_SUCCESS){

536

503

fprintf(stderr,

537

"Mandos plugin mandos-client: "

538

504

"Error[%d] while reading the OpenPGP key pair ('%s',"

539

505

" '%s')\n", ret, pubkeyfilename, seckeyfilename);

540

fprintf(stderr, "Mandos plugin mandos-client: "

541

"The GnuTLS error is: %s\n", safer_gnutls_strerror(ret));

506

fprintf(stderr, "The GnuTLS error is: %s\n",

507

safer_gnutls_strerror(ret));

542

508

goto globalfail;

543

509

}

544

510

545

511

/* GnuTLS server initialization */

546

512

ret = gnutls_dh_params_init(&mc.dh_params);

547

513

if(ret != GNUTLS_E_SUCCESS){

548

fprintf(stderr, "Mandos plugin mandos-client: "

549

"Error in GnuTLS DH parameter initialization:"

514

fprintf(stderr, "Error in GnuTLS DH parameter initialization:"

550

515

" %s\n", safer_gnutls_strerror(ret));

551

516

goto globalfail;

552

517

}

553

518

ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);

554

519

if(ret != GNUTLS_E_SUCCESS){

555

fprintf(stderr, "Mandos plugin mandos-client: "

556

"Error in GnuTLS prime generation: %s\n",

520

fprintf(stderr, "Error in GnuTLS prime generation: %s\n",

557

521

safer_gnutls_strerror(ret));

558

522

goto globalfail;

559

523

}

580

544

}

581

545

} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);

582

546

if(ret != GNUTLS_E_SUCCESS){

583

fprintf(stderr, "Mandos plugin mandos-client: "

584

"Error in GnuTLS session initialization: %s\n",

547

fprintf(stderr, "Error in GnuTLS session initialization: %s\n",

585

548

safer_gnutls_strerror(ret));

586

549

}

587

550

595

558

}

596

559

} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);

597

560

if(ret != GNUTLS_E_SUCCESS){

598

fprintf(stderr, "Mandos plugin mandos-client: "

599

"Syntax error at: %s\n", err);

600

fprintf(stderr, "Mandos plugin mandos-client: "

601

"GnuTLS error: %s\n", safer_gnutls_strerror(ret));

561

fprintf(stderr, "Syntax error at: %s\n", err);

562

fprintf(stderr, "GnuTLS error: %s\n",

563

safer_gnutls_strerror(ret));

602

564

gnutls_deinit(*session);

603

565

return -1;

604

566

}

613

575

}

614

576

} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);

615

577

if(ret != GNUTLS_E_SUCCESS){

616

fprintf(stderr, "Mandos plugin mandos-client: "

617

"Error setting GnuTLS credentials: %s\n",

578

fprintf(stderr, "Error setting GnuTLS credentials: %s\n",

618

579

safer_gnutls_strerror(ret));

619

580

gnutls_deinit(*session);

620

581

return -1;

666

627

pf = PF_INET;

667

628

break;

668

629

default:

669

fprintf(stderr, "Mandos plugin mandos-client: "

670

"Bad address family: %d\n", af);

630

fprintf(stderr, "Bad address family: %d\n", af);

671

631

errno = EINVAL;

672

632

return -1;

673

633

}

678

638

}

679

639

680

640

if(debug){

681

fprintf(stderr, "Mandos plugin mandos-client: "

682

"Setting up a TCP connection to %s, port %" PRIu16

641

fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16

683

642

"\n", ip, port);

684

643

}

685

644

712

671

}

713

672

if(ret == 0){

714

673

int e = errno;

715

fprintf(stderr, "Mandos plugin mandos-client: "

716

"Bad address: %s\n", ip);

674

fprintf(stderr, "Bad address: %s\n", ip);

717

675

errno = e;

718

676

goto mandos_end;

719

677

}

724

682

725

683

if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */

726

684

(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and

727

-Wunreachable-code*/

685

-Wunreachable-code*/

728

686

if(if_index == AVAHI_IF_UNSPEC){

729

fprintf(stderr, "Mandos plugin mandos-client: "

730

"An IPv6 link-local address is incomplete"

687

fprintf(stderr, "An IPv6 link-local address is incomplete"

731

688

" without a network interface\n");

732

689

errno = EINVAL;

733

690

goto mandos_end;

752

709

if(if_indextoname((unsigned int)if_index, interface) == NULL){

753

710

perror_plus("if_indextoname");

754

711

} else {

755

fprintf(stderr, "Mandos plugin mandos-client: "

756

"Connection to: %s%%%s, port %" PRIu16 "\n",

712

fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",

757

713

ip, interface, port);

758

714

}

759

715

} else {

760

fprintf(stderr, "Mandos plugin mandos-client: "

761

"Connection to: %s, port %" PRIu16 "\n", ip, port);

716

fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,

717

port);

762

718

}

763

719

char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?

764

720

INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";

774

730

perror_plus("inet_ntop");

775

731

} else {

776

732

if(strcmp(addrstr, ip) != 0){

777

fprintf(stderr, "Mandos plugin mandos-client: "

778

"Canonical address form: %s\n", addrstr);

733

fprintf(stderr, "Canonical address form: %s\n", addrstr);

779

734

}

780

735

}

781

736

}

809

764

while(true){

810

765

size_t out_size = strlen(out);

811

766

ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,

812

out_size - written));

767

out_size - written));

813

768

if(ret == -1){

814

769

int e = errno;

815

770

perror_plus("write");

835

790

}

836

791

837

792

if(debug){

838

fprintf(stderr, "Mandos plugin mandos-client: "

839

"Establishing TLS session with %s\n", ip);

793

fprintf(stderr, "Establishing TLS session with %s\n", ip);

840

794

}

841

795

842

796

if(quit_now){

862

816

863

817

if(ret != GNUTLS_E_SUCCESS){

864

818

if(debug){

865

fprintf(stderr, "Mandos plugin mandos-client: "

866

"*** GnuTLS Handshake failed ***\n");

819

fprintf(stderr, "*** GnuTLS Handshake failed ***\n");

867

820

gnutls_perror(ret);

868

821

}

869

822

errno = EPROTO;

873

826

/* Read OpenPGP packet that contains the wanted password */

874

827

875

828

if(debug){

876

fprintf(stderr, "Mandos plugin mandos-client: "

877

"Retrieving OpenPGP encrypted password from %s\n", ip);

829

fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",

830

ip);

878

831

}

879

832

880

833

while(true){

885

838

}

886

839

887

840

buffer_capacity = incbuffer(&buffer, buffer_length,

888

buffer_capacity);

841

buffer_capacity);

889

842

if(buffer_capacity == 0){

890

843

int e = errno;

891

844

perror_plus("incbuffer");

918

871

}

919

872

} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);

920

873

if(ret < 0){

921

fprintf(stderr, "Mandos plugin mandos-client: "

922

"*** GnuTLS Re-handshake failed ***\n");

874

fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");

923

875

gnutls_perror(ret);

924

876

errno = EPROTO;

925

877

goto mandos_end;

926

878

}

927

879

break;

928

880

default:

929

fprintf(stderr, "Mandos plugin mandos-client: "

930

"Unknown error while reading data from"

881

fprintf(stderr, "Unknown error while reading data from"

931

882

" encrypted session with Mandos server\n");

932

883

gnutls_bye(session, GNUTLS_SHUT_RDWR);

933

884

errno = EIO;

939

890

}

940

891

941

892

if(debug){

942

fprintf(stderr, "Mandos plugin mandos-client: "

943

"Closing TLS session\n");

893

fprintf(stderr, "Closing TLS session\n");

944

894

}

945

895

946

896

if(quit_now){

958

908

959

909

if(buffer_length > 0){

960

910

ssize_t decrypted_buffer_size;

961

decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,

911

decrypted_buffer_size = pgp_packet_decrypt(buffer,

912

buffer_length,

962

913

&decrypted_buffer);

963

914

if(decrypted_buffer_size >= 0){

964

915

975

926

if(ret == 0 and ferror(stdout)){

976

927

int e = errno;

977

928

if(debug){

978

fprintf(stderr, "Mandos plugin mandos-client: "

979

"Error writing encrypted data: %s\n",

929

fprintf(stderr, "Error writing encrypted data: %s\n",

980

930

strerror(errno));

981

931

}

982

932

errno = e;

1040

990

switch(event){

1041

991

default:

1042

992

case AVAHI_RESOLVER_FAILURE:

1043

fprintf(stderr, "Mandos plugin mandos-client: "

1044

"(Avahi Resolver) Failed to resolve service '%s'"

993

fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"

1045

994

" of type '%s' in domain '%s': %s\n", name, type, domain,

1046

995

avahi_strerror(avahi_server_errno(mc.server)));

1047

996

break;

1051

1000

char ip[AVAHI_ADDRESS_STR_MAX];

1052

1001

avahi_address_snprint(ip, sizeof(ip), address);

1053

1002

if(debug){

1054

fprintf(stderr, "Mandos plugin mandos-client: "

1055

"Mandos server \"%s\" found on %s (%s, %"

1003

fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"

1056

1004

PRIdMAX ") on port %" PRIu16 "\n", name, host_name,

1057

1005

ip, (intmax_t)interface, port);

1058

1006

}

1092

1040

default:

1093

1041

case AVAHI_BROWSER_FAILURE:

1094

1042

1095

fprintf(stderr, "Mandos plugin mandos-client: "

1096

"(Avahi browser) %s\n",

1043

fprintf(stderr, "(Avahi browser) %s\n",

1097

1044

avahi_strerror(avahi_server_errno(mc.server)));

1098

1045

avahi_simple_poll_quit(mc.simple_poll);

1099

1046

return;

1107

1054

if(avahi_s_service_resolver_new(mc.server, interface, protocol,

1108

1055

name, type, domain, protocol, 0,

1109

1056

resolve_callback, NULL) == NULL)

1110

fprintf(stderr, "Mandos plugin mandos-client: "

1111

"Avahi: Failed to resolve service '%s': %s\n",

1057

fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",

1112

1058

name, avahi_strerror(avahi_server_errno(mc.server)));

1113

1059

break;

1114

1060

1118

1064

case AVAHI_BROWSER_ALL_FOR_NOW:

1119

1065

case AVAHI_BROWSER_CACHE_EXHAUSTED:

1120

1066

if(debug){

1121

fprintf(stderr, "Mandos plugin mandos-client: "

1122

"No Mandos server found, still searching...\n");

1067

fprintf(stderr, "No Mandos server found, still searching...\n");

1123

1068

}

1124

1069

break;

1125

1070

}

1140

1085

errno = old_errno;

1141

1086

}

1142

1087

1143

bool get_flags(const char *ifname, struct ifreq *ifr){

1144

int ret;

1145

1146

int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

1147

if(s < 0){

1148

perror_plus("socket");

1149

return false;

1150

}

1151

strcpy(ifr->ifr_name, ifname);

1152

ret = ioctl(s, SIOCGIFFLAGS, ifr);

1153

if(ret == -1){

1088

/*

1089

* This function determines if a directory entry in /sys/class/net

1090

* corresponds to an acceptable network device.

1091

* (This function is passed to scandir(3) as a filter function.)

1092

*/

1093

int good_interface(const struct dirent *if_entry){

1094

ssize_t ssret;

1095

char *flagname = NULL;

1096

if(if_entry->d_name[0] == '.'){

1097

return 0;

1098

}

1099

int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,

1100

if_entry->d_name);

1101

if(ret < 0){

1102

perror_plus("asprintf");

1103

return 0;

1104

}

1105

int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));

1106

if(flags_fd == -1){

1107

perror_plus("open");

1108

free(flagname);

1109

return 0;

1110

}

1111

free(flagname);

1112

typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */

1113

/* read line from flags_fd */

1114

ssize_t to_read = 2+(sizeof(ifreq_flags)*2)+1; /* "0x1003\n" */

1115

char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */

1116

flagstring[(size_t)to_read] = '\0';

1117

if(flagstring == NULL){

1118

perror_plus("malloc");

1119

close(flags_fd);

1120

return 0;

1121

}

1122

while(to_read > 0){

1123

ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,

1124

(size_t)to_read));

1125

if(ssret == -1){

1126

perror_plus("read");

1127

free(flagstring);

1128

close(flags_fd);

1129

return 0;

1130

}

1131

to_read -= ssret;

1132

if(ssret == 0){

1133

break;

1134

}

1135

}

1136

close(flags_fd);

1137

intmax_t tmpmax;

1138

char *tmp;

1139

errno = 0;

1140

tmpmax = strtoimax(flagstring, &tmp, 0);

1141

if(errno != 0 or tmp == flagstring or (*tmp != '\0'

1142

and not (isspace(*tmp)))

1143

or tmpmax != (ifreq_flags)tmpmax){

1154

1144

if(debug){

1155

perror_plus("ioctl SIOCGIFFLAGS");

1145

fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",

1146

flagstring, if_entry->d_name);

1156

1147

}

1157

return false;

1148

free(flagstring);

1149

return 0;

1158

1150

}

1159

return true;

1160

}

1161

1162

bool good_flags(const char *ifname, const struct ifreq *ifr){

1163

1151

free(flagstring);

1152

ifreq_flags flags = (ifreq_flags)tmpmax;

1164

1153

/* Reject the loopback device */

1165

if(ifr->ifr_flags & IFF_LOOPBACK){

1154

if(flags & IFF_LOOPBACK){

1166

1155

if(debug){

1167

fprintf(stderr, "Mandos plugin mandos-client: "

1168

"Rejecting loopback interface \"%s\"\n", ifname);

1156

fprintf(stderr, "Rejecting loopback interface \"%s\"\n",

1157

if_entry->d_name);

1169

1158

}

1170

return false;

1159

return 0;

1171

1160

}

1172

1161

/* Accept point-to-point devices only if connect_to is specified */

1173

if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){

1162

if(connect_to != NULL and (flags & IFF_POINTOPOINT)){

1174

1163

if(debug){

1175

fprintf(stderr, "Mandos plugin mandos-client: "

1176

"Accepting point-to-point interface \"%s\"\n", ifname);

1164

fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",

1165

if_entry->d_name);

1177

1166

}

1178

return true;

1167

return 1;

1179

1168

}

1180

1169

/* Otherwise, reject non-broadcast-capable devices */

1181

if(not (ifr->ifr_flags & IFF_BROADCAST)){

1170

if(not (flags & IFF_BROADCAST)){

1182

1171

if(debug){

1183

fprintf(stderr, "Mandos plugin mandos-client: "

1184

"Rejecting non-broadcast interface \"%s\"\n", ifname);

1172

fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",

1173

if_entry->d_name);

1185

1174

}

1186

return false;

1175

return 0;

1187

1176

}

1188

1177

/* Reject non-ARP interfaces (including dummy interfaces) */

1189

if(ifr->ifr_flags & IFF_NOARP){

1178

if(flags & IFF_NOARP){

1190

1179

if(debug){

1191

fprintf(stderr, "Mandos plugin mandos-client: "

1192

"Rejecting non-ARP interface \"%s\"\n", ifname);

1180

fprintf(stderr, "Rejecting non-ARP interface \"%s\"\n",

1181

if_entry->d_name);

1193

1182

}

1194

return false;

1183

return 0;

1195

1184

}

1196

1197

1185

/* Accept this device */

1198

1186

if(debug){

1199

fprintf(stderr, "Mandos plugin mandos-client: "

1200

"Interface \"%s\" is good\n", ifname);

1201

}

1202

return true;

1203

}

1204

1205

/*

1206

* This function determines if a directory entry in /sys/class/net

1207

* corresponds to an acceptable network device.

1208

* (This function is passed to scandir(3) as a filter function.)

1209

*/

1210

int good_interface(const struct dirent *if_entry){

1211

if(if_entry->d_name[0] == '.'){

1212

return 0;

1213

}

1214

1215

struct ifreq ifr;

1216

if(not get_flags(if_entry->d_name, &ifr)){

1217

if(debug){

1218

fprintf(stderr, "Mandos plugin mandos-client: "

1219

"Failed to get flags for interface \"%s\"\n",

1220

if_entry->d_name);

1221

}

1222

return 0;

1223

}

1224

1225

if(not good_flags(if_entry->d_name, &ifr)){

1226

return 0;

1227

}

1228

return 1;

1229

}

1230

1231

/*

1232

* This function determines if a directory entry in /sys/class/net

1233

* corresponds to an acceptable network device which is up.

1234

* (This function is passed to scandir(3) as a filter function.)

1235

*/

1236

int up_interface(const struct dirent *if_entry){

1237

if(if_entry->d_name[0] == '.'){

1238

return 0;

1239

}

1240

1241

struct ifreq ifr;

1242

if(not get_flags(if_entry->d_name, &ifr)){

1243

if(debug){

1244

fprintf(stderr, "Mandos plugin mandos-client: "

1245

"Failed to get flags for interface \"%s\"\n",

1246

if_entry->d_name);

1247

}

1248

return 0;

1249

}

1250

1251

/* Reject down interfaces */

1252

if(not (ifr.ifr_flags & IFF_UP)){

1253

if(debug){

1254

fprintf(stderr, "Mandos plugin mandos-client: "

1255

"Rejecting down interface \"%s\"\n",

1256

if_entry->d_name);

1257

}

1258

return 0;

1259

}

1260

1261

/* Reject non-running interfaces */

1262

if(not (ifr.ifr_flags & IFF_RUNNING)){

1263

if(debug){

1264

fprintf(stderr, "Mandos plugin mandos-client: "

1265

"Rejecting non-running interface \"%s\"\n",

1266

if_entry->d_name);

1267

}

1268

return 0;

1269

}

1270

1271

if(not good_flags(if_entry->d_name, &ifr)){

1272

return 0;

1187

fprintf(stderr, "Interface \"%s\" is acceptable\n",

1188

if_entry->d_name);

1273

1189

}

1274

1190

return 1;

1275

1191

}

1285

1201

return 1;

1286

1202

}

1287

1203

1288

/* Is this directory entry a runnable program? */

1289

int runnable_hook(const struct dirent *direntry){

1290

int ret;

1291

size_t sret;

1292

struct stat st;

1293

1294

if((direntry->d_name)[0] == '\0'){

1295

/* Empty name? */

1296

return 0;

1297

}

1298

1299

sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"

1300

"abcdefghijklmnopqrstuvwxyz"

1301

"0123456789"

1302

"_-");

1303

if((direntry->d_name)[sret] != '\0'){

1304

/* Contains non-allowed characters */

1305

if(debug){

1306

fprintf(stderr, "Mandos plugin mandos-client: "

1307

"Ignoring hook \"%s\" with bad name\n",

1308

direntry->d_name);

1309

}

1310

return 0;

1311

}

1312

1313

char *fullname = NULL;

1314

ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);

1315

if(ret < 0){

1316

perror_plus("asprintf");

1317

return 0;

1318

}

1319

1320

ret = stat(fullname, &st);

1321

if(ret == -1){

1322

if(debug){

1323

perror_plus("Could not stat hook");

1324

}

1325

return 0;

1326

}

1327

if(not (S_ISREG(st.st_mode))){

1328

/* Not a regular file */

1329

if(debug){

1330

fprintf(stderr, "Mandos plugin mandos-client: "

1331

"Ignoring hook \"%s\" - not a file\n",

1332

direntry->d_name);

1333

}

1334

return 0;

1335

}

1336

if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){

1337

/* Not executable */

1338

if(debug){

1339

fprintf(stderr, "Mandos plugin mandos-client: "

1340

"Ignoring hook \"%s\" - not executable\n",

1341

direntry->d_name);

1342

}

1343

return 0;

1344

}

1345

return 1;

1346

}

1347

1348

1204

int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){

1349

1205

int ret;

1350

1206

struct timespec now;

1354

1210

while(true){

1355

1211

if(mc.current_server == NULL){

1356

1212

if (debug){

1357

fprintf(stderr, "Mandos plugin mandos-client: "

1213

fprintf(stderr,

1358

1214

"Wait until first server is found. No timeout!\n");

1359

1215

}

1360

1216

ret = avahi_simple_poll_iterate(s, -1);

1361

1217

} else {

1362

1218

if (debug){

1363

fprintf(stderr, "Mandos plugin mandos-client: "

1364

"Check current_server if we should run it,"

1219

fprintf(stderr, "Check current_server if we should run it,"

1365

1220

" or wait\n");

1366

1221

}

1367

1222

/* the current time */

1384

1239

- ((intmax_t)waited_time.tv_nsec / 1000000));

1385

1240

1386

1241

if (debug){

1387

fprintf(stderr, "Mandos plugin mandos-client: "

1388

"Blocking for %" PRIdMAX " ms\n", block_time);

1242

fprintf(stderr, "Blocking for %" PRIdMAX " ms\n", block_time);

1389

1243

}

1390

1244

1391

1245

if(block_time <= 0){

1411

1265

ret = avahi_simple_poll_iterate(s, (int)block_time);

1412

1266

}

1413

1267

if(ret != 0){

1414

if (ret > 0 or errno != EINTR){

1268

if (ret > 0 or errno != EINTR) {

1415

1269

return (ret != 1) ? ret : 0;

1416

1270

}

1417

1271

}

1505

1359

.arg = "SECONDS",

1506

1360

.doc = "Retry interval used when denied by the mandos server",

1507

1361

.group = 2 },

1508

{ .name = "network-hook-dir", .key = 133,

1509

.arg = "DIR",

1510

.doc = "Directory where network hooks are located",

1511

.group = 2 },

1512

1362

/*

1513

1363

* These reproduce what we would get without ARGP_NO_HELP

1514

1364

*/

1567

1417

argp_error(state, "Bad retry interval");

1568

1418

}

1569

1419

break;

1570

case 133: /* --network-hook-dir */

1571

hookdir = arg;

1572

break;

1573

1420

/*

1574

1421

* These reproduce what we would get without ARGP_NO_HELP

1575

1422

*/

1581

1428

argp_state_help(state, state->out_stream,

1582

1429

ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);

1583

1430

case 'V': /* --version */

1584

fprintf(state->out_stream, "Mandos plugin mandos-client: ");

1585

1431

fprintf(state->out_stream, "%s\n", argp_program_version);

1586

1432

exit(argp_err_exit_status);

1587

1433

break;

1672

1518

}

1673

1519

}

1674

1520

1675

/* Find network hooks and run them */

1676

{

1677

struct dirent **direntries;

1678

struct dirent *direntry;

1679

int numhooks = scandir(hookdir, &direntries, runnable_hook,

1680

alphasort);

1681

if(numhooks == -1){

1682

perror_plus("scandir");

1683

} else {

1684

int devnull = open("/dev/null", O_RDONLY);

1685

for(int i = 0; i < numhooks; i++){

1686

direntry = direntries[0];

1687

char *fullname = NULL;

1688

ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);

1689

if(ret < 0){

1690

perror_plus("asprintf");

1691

continue;

1692

}

1693

pid_t hook_pid = fork();

1694

if(hook_pid == 0){

1695

/* Child */

1696

dup2(devnull, STDIN_FILENO);

1697

close(devnull);

1698

dup2(STDERR_FILENO, STDOUT_FILENO);

1699

ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);

1700

if(ret == -1){

1701

perror_plus("setenv");

1702

exit(1);

1703

}

1704

ret = setenv("DEVICE", interface, 1);

1705

if(ret == -1){

1706

perror_plus("setenv");

1707

exit(1);

1708

}

1709

ret = setenv("VERBOSE", debug ? "1" : "0", 1);

1710

if(ret == -1){

1711

perror_plus("setenv");

1712

exit(1);

1713

}

1714

ret = setenv("MODE", "start", 1);

1715

if(ret == -1){

1716

perror_plus("setenv");

1717

exit(1);

1718

}

1719

char *delaystring;

1720

ret = asprintf(&delaystring, "%f", delay);

1721

if(ret == -1){

1722

perror_plus("asprintf");

1723

exit(1);

1724

}

1725

ret = setenv("DELAY", delaystring, 1);

1726

if(ret == -1){

1727

free(delaystring);

1728

perror_plus("setenv");

1729

exit(1);

1730

}

1731

free(delaystring);

1732

ret = execl(fullname, direntry->d_name, "start", NULL);

1733

perror_plus("execl");

1734

} else {

1735

int status;

1736

if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){

1737

perror_plus("waitpid");

1738

free(fullname);

1739

continue;

1740

}

1741

if(WIFEXITED(status)){

1742

if(WEXITSTATUS(status) != 0){

1743

fprintf(stderr, "Mandos plugin mandos-client: "

1744

"Warning: network hook \"%s\" exited"

1745

" with status %d\n", direntry->d_name,

1746

WEXITSTATUS(status));

1747

free(fullname);

1748

continue;

1749

}

1750

} else if(WIFSIGNALED(status)){

1751

fprintf(stderr, "Mandos plugin mandos-client: "

1752

"Warning: network hook \"%s\" died by"

1753

" signal %d\n", direntry->d_name,

1754

WTERMSIG(status));

1755

free(fullname);

1756

continue;

1757

} else {

1758

fprintf(stderr, "Mandos plugin mandos-client: "

1759

"Warning: network hook \"%s\" crashed\n",

1760

direntry->d_name);

1761

free(fullname);

1762

continue;

1763

}

1764

}

1765

free(fullname);

1766

if(quit_now){

1767

goto end;

1768

}

1769

}

1770

close(devnull);

1771

}

1772

}

1773

1774

1521

if(not debug){

1775

1522

avahi_set_log_function(empty_log);

1776

1523

}

1777

1524

1778

1525

if(interface[0] == '\0'){

1779

1526

struct dirent **direntries;

1780

/* First look for interfaces that are up */

1781

ret = scandir(sys_class_net, &direntries, up_interface,

1527

ret = scandir(sys_class_net, &direntries, good_interface,

1782

1528

alphasort);

1783

if(ret == 0){

1784

/* No up interfaces, look for any good interfaces */

1785

free(direntries);

1786

ret = scandir(sys_class_net, &direntries, good_interface,

1787

alphasort);

1788

}

1789

1529

if(ret >= 1){

1790

/* Pick the first interface returned */

1530

/* Pick the first good interface */

1791

1531

interface = strdup(direntries[0]->d_name);

1792

1532

if(debug){

1793

fprintf(stderr, "Mandos plugin mandos-client: "

1794

"Using interface \"%s\"\n", interface);

1533

fprintf(stderr, "Using interface \"%s\"\n", interface);

1795

1534

}

1796

1535

if(interface == NULL){

1797

1536

perror_plus("malloc");

1802

1541

free(direntries);

1803

1542

} else {

1804

1543

free(direntries);

1805

fprintf(stderr, "Mandos plugin mandos-client: "

1806

"Could not find a network interface\n");

1544

fprintf(stderr, "Could not find a network interface\n");

1807

1545

exitcode = EXIT_FAILURE;

1808

1546

goto end;

1809

1547

}

1815

1553

srand((unsigned int) time(NULL));

1816

1554

mc.simple_poll = avahi_simple_poll_new();

1817

1555

if(mc.simple_poll == NULL){

1818

fprintf(stderr, "Mandos plugin mandos-client: "

1819

"Avahi: Failed to create simple poll object.\n");

1556

fprintf(stderr, "Avahi: Failed to create simple poll object.\n");

1820

1557

exitcode = EX_UNAVAILABLE;

1821

1558

goto end;

1822

1559

}

1888

1625

if(strcmp(interface, "none") != 0){

1889

1626

if_index = (AvahiIfIndex) if_nametoindex(interface);

1890

1627

if(if_index == 0){

1891

fprintf(stderr, "Mandos plugin mandos-client: "

1892

"No such interface: \"%s\"\n", interface);

1628

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1893

1629

exitcode = EX_UNAVAILABLE;

1894

1630

goto end;

1895

1631

}

2036

1772

2037

1773

ret = init_gnutls_global(pubkey, seckey);

2038

1774

if(ret == -1){

2039

fprintf(stderr, "Mandos plugin mandos-client: "

2040

"init_gnutls_global failed\n");

1775

fprintf(stderr, "init_gnutls_global failed\n");

2041

1776

exitcode = EX_UNAVAILABLE;

2042

1777

goto end;

2043

1778

} else {

2059

1794

}

2060

1795

2061

1796

if(not init_gpgme(pubkey, seckey, tempdir)){

2062

fprintf(stderr, "Mandos plugin mandos-client: "

2063

"init_gpgme failed\n");

1797

fprintf(stderr, "init_gpgme failed\n");

2064

1798

exitcode = EX_UNAVAILABLE;

2065

1799

goto end;

2066

1800

} else {

2076

1810

/* (Mainly meant for debugging) */

2077

1811

char *address = strrchr(connect_to, ':');

2078

1812

if(address == NULL){

2079

fprintf(stderr, "Mandos plugin mandos-client: "

2080

"No colon in address\n");

1813

fprintf(stderr, "No colon in address\n");

2081

1814

exitcode = EX_USAGE;

2082

1815

goto end;

2083

1816

}

2091

1824

tmpmax = strtoimax(address+1, &tmp, 10);

2092

1825

if(errno != 0 or tmp == address+1 or *tmp != '\0'

2093

1826

or tmpmax != (uint16_t)tmpmax){

2094

fprintf(stderr, "Mandos plugin mandos-client: "

2095

"Bad port number\n");

1827

fprintf(stderr, "Bad port number\n");

2096

1828

exitcode = EX_USAGE;

2097

1829

goto end;

2098

1830

}

2128

1860

break;

2129

1861

}

2130

1862

if(debug){

2131

fprintf(stderr, "Mandos plugin mandos-client: "

2132

"Retrying in %d seconds\n", (int)retry_interval);

1863

fprintf(stderr, "Retrying in %d seconds\n",

1864

(int)retry_interval);

2133

1865

}

2134

1866

sleep((int)retry_interval);

2135

1867

}

2137

1869

if (not quit_now){

2138

1870

exitcode = EXIT_SUCCESS;

2139

1871

}

2140

1872

2141

1873

goto end;

2142

1874

}

2143

1875

2165

1897

2166

1898

/* Check if creating the Avahi server object succeeded */

2167

1899

if(mc.server == NULL){

2168

fprintf(stderr, "Mandos plugin mandos-client: "

2169

"Failed to create Avahi server: %s\n",

1900

fprintf(stderr, "Failed to create Avahi server: %s\n",

2170

1901

avahi_strerror(error));

2171

1902

exitcode = EX_UNAVAILABLE;

2172

1903

goto end;

2181

1912

AVAHI_PROTO_UNSPEC, "_mandos._tcp",

2182

1913

NULL, 0, browse_callback, NULL);

2183

1914

if(sb == NULL){

2184

fprintf(stderr, "Mandos plugin mandos-client: "

2185

"Failed to create service browser: %s\n",

1915

fprintf(stderr, "Failed to create service browser: %s\n",

2186

1916

avahi_strerror(avahi_server_errno(mc.server)));

2187

1917

exitcode = EX_UNAVAILABLE;

2188

1918

goto end;

2195

1925

/* Run the main loop */

2196

1926

2197

1927

if(debug){

2198

fprintf(stderr, "Mandos plugin mandos-client: "

2199

"Starting Avahi loop search\n");

1928

fprintf(stderr, "Starting Avahi loop search\n");

2200

1929

}

2201

1930

2202

1931

ret = avahi_loop_with_timeout(mc.simple_poll,

2203

1932

(int)(retry_interval * 1000));

2204

1933

if(debug){

2205

fprintf(stderr, "Mandos plugin mandos-client: "

2206

"avahi_loop_with_timeout exited %s\n",

1934

fprintf(stderr, "avahi_loop_with_timeout exited %s\n",

2207

1935

(ret == 0) ? "successfully" : "with error");

2208

1936

}

2209

1937

2210

1938

end:

2211

1939

2212

1940

if(debug){

2213

fprintf(stderr, "Mandos plugin mandos-client: "

2214

"%s exiting\n", argv[0]);

1941

fprintf(stderr, "%s exiting\n", argv[0]);

2215

1942

}

2216

1943

2217

1944

/* Cleanup things */

2245

1972

}

2246

1973

}

2247

1974

2248

/* XXX run network hooks "stop" here */

2249

2250

1975

/* Take down the network interface */

2251

1976

if(take_down_interface){

2252

1977

/* Re-raise priviliges */

2259

1984

ret = ioctl(sd, SIOCGIFFLAGS, &network);

2260

1985

if(ret == -1){

2261

1986

perror_plus("ioctl SIOCGIFFLAGS");

2262

} else if(network.ifr_flags & IFF_UP){

1987

} else if(network.ifr_flags & IFF_UP) {

2263

1988

network.ifr_flags &= ~(short)IFF_UP; /* clear flag */

2264

1989

ret = ioctl(sd, SIOCSIFFLAGS, &network);

2265

1990

if(ret == -1){

2297

2022

}

2298

2023

ret = remove(fullname);

2299

2024

if(ret == -1){

2300

fprintf(stderr, "Mandos plugin mandos-client: "

2301

"remove(\"%s\"): %s\n", fullname, strerror(errno));

2025

fprintf(stderr, "remove(\"%s\"): %s\n", fullname,

2026

strerror(errno));

2302

2027

}

2303

2028

free(fullname);

2304

2029

}