9
9
* "browse_callback", and parts of "main".
11
11
* Everything else is
12
* Copyright © 2008-2012 Teddy Hogeborn
13
* Copyright © 2008-2012 Björn Påhlsson
12
* Copyright © 2008-2014 Teddy Hogeborn
13
* Copyright © 2008-2014 Björn Påhlsson
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
56
56
#include <sys/stat.h> /* open(), S_ISREG */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
58
inet_pton(), connect(),
59
60
#include <fcntl.h> /* open() */
60
61
#include <dirent.h> /* opendir(), struct dirent, readdir()
73
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
75
getuid(), getgid(), seteuid(),
75
76
setgid(), pause(), _exit() */
76
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
77
#include <arpa/inet.h> /* inet_pton(), htons() */
77
78
#include <iso646.h> /* not, or, and */
78
79
#include <argp.h> /* struct argp_option, error_t, struct
79
80
argp_state, struct argp,
91
92
argz_delete(), argz_append(),
92
93
argz_stringify(), argz_add(),
95
#include <netdb.h> /* getnameinfo(), NI_NUMERICHOST,
96
EAI_SYSTEM, gai_strerror() */
96
99
#include <sys/klog.h> /* klogctl() */
161
164
const char *priority;
163
166
server *current_server;
168
size_t interfaces_size;
164
169
} mandos_context;
166
171
/* global so signal handler can reach it*/
167
172
AvahiSimplePoll *simple_poll;
168
mandos_context mc = { .server = NULL, .dh_bits = 1024,
169
.priority = "SECURE256:!CTYPE-X.509:"
170
"+CTYPE-OPENPGP", .current_server = NULL };
172
174
sig_atomic_t quit_now = 0;
173
175
int signal_received = 0;
181
183
perror(print_text);
184
__attribute__((format (gnu_printf, 2, 3)))
186
__attribute__((format (gnu_printf, 2, 3), nonnull))
185
187
int fprintf_plus(FILE *stream, const char *format, ...){
187
189
va_start (ap, format);
189
191
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
190
192
program_invocation_short_name));
191
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
193
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
196
198
* bytes. "buffer_capacity" is how much is currently allocated,
197
199
* "buffer_length" is how much is already used.
201
__attribute__((nonnull, warn_unused_result))
199
202
size_t incbuffer(char **buffer, size_t buffer_length,
200
203
size_t buffer_capacity){
201
204
if(buffer_length + BUFFER_SIZE > buffer_capacity){
202
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
205
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
207
int old_errno = errno;
206
214
buffer_capacity += BUFFER_SIZE;
208
216
return buffer_capacity;
211
219
/* Add server to set of servers to retry periodically */
220
__attribute__((nonnull, warn_unused_result))
212
221
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
222
int af, server **current_server){
215
224
server *new_server = malloc(sizeof(server));
216
225
if(new_server == NULL){
225
234
perror_plus("strdup");
237
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
239
perror_plus("clock_gettime");
228
242
/* Special case of first server */
229
if (mc.current_server == NULL){
243
if(*current_server == NULL){
230
244
new_server->next = new_server;
231
245
new_server->prev = new_server;
232
mc.current_server = new_server;
233
/* Place the new server last in the list */
246
*current_server = new_server;
235
new_server->next = mc.current_server;
236
new_server->prev = mc.current_server->prev;
248
/* Place the new server last in the list */
249
new_server->next = *current_server;
250
new_server->prev = (*current_server)->prev;
237
251
new_server->prev->next = new_server;
238
mc.current_server->prev = new_server;
240
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
242
perror_plus("clock_gettime");
252
(*current_server)->prev = new_server;
249
258
* Initialize GPGME.
251
static bool init_gpgme(const char *seckey, const char *pubkey,
252
const char *tempdir){
260
__attribute__((nonnull, warn_unused_result))
261
static bool init_gpgme(const char * const seckey,
262
const char * const pubkey,
263
const char * const tempdir,
253
265
gpgme_error_t rc;
254
266
gpgme_engine_info_t engine_info;
257
269
* Helper function to insert pub and seckey to the engine keyring.
259
bool import_key(const char *filename){
271
bool import_key(const char * const filename){
262
274
gpgme_data_t pgp_data;
378
392
/* Decrypt data from the cryptotext data buffer to the plaintext
380
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
394
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
381
395
if(rc != GPG_ERR_NO_ERROR){
382
396
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
383
397
gpgme_strsource(rc), gpgme_strerror(rc));
384
398
plaintext_length = -1;
386
400
gpgme_decrypt_result_t result;
387
result = gpgme_op_decrypt_result(mc.ctx);
401
result = gpgme_op_decrypt_result(mc->ctx);
388
402
if(result == NULL){
389
403
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
477
492
/* GnuTLS log function callback */
493
__attribute__((nonnull))
478
494
static void debuggnutls(__attribute__((unused)) int level,
479
495
const char* string){
480
496
fprintf_plus(stderr, "GnuTLS: %s", string);
499
__attribute__((nonnull, warn_unused_result))
483
500
static int init_gnutls_global(const char *pubkeyfilename,
484
const char *seckeyfilename){
501
const char *seckeyfilename,
522
540
ret = gnutls_certificate_set_openpgp_key_file
523
(mc.cred, pubkeyfilename, seckeyfilename,
541
(mc->cred, pubkeyfilename, seckeyfilename,
524
542
GNUTLS_OPENPGP_FMT_BASE64);
525
543
if(ret != GNUTLS_E_SUCCESS){
526
544
fprintf_plus(stderr,
534
552
/* GnuTLS server initialization */
535
ret = gnutls_dh_params_init(&mc.dh_params);
553
ret = gnutls_dh_params_init(&mc->dh_params);
536
554
if(ret != GNUTLS_E_SUCCESS){
537
555
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
538
556
" initialization: %s\n",
539
557
safer_gnutls_strerror(ret));
542
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
560
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
543
561
if(ret != GNUTLS_E_SUCCESS){
544
562
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
545
563
safer_gnutls_strerror(ret));
549
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
567
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
555
gnutls_certificate_free_credentials(mc.cred);
573
gnutls_certificate_free_credentials(mc->cred);
556
574
gnutls_global_deinit();
557
gnutls_dh_params_deinit(mc.dh_params);
575
gnutls_dh_params_deinit(mc->dh_params);
561
static int init_gnutls_session(gnutls_session_t *session){
579
__attribute__((nonnull, warn_unused_result))
580
static int init_gnutls_session(gnutls_session_t *session,
563
583
/* GnuTLS session creation */
619
639
__attribute__((unused)) const char *txt){}
621
641
/* Called when a Mandos server is found */
642
__attribute__((nonnull, warn_unused_result))
622
643
static int start_mandos_communication(const char *ip, in_port_t port,
623
644
AvahiIfIndex if_index,
645
int af, mandos_context *mc){
625
646
int ret, tcp_sd = -1;
628
struct sockaddr_in in;
629
struct sockaddr_in6 in6;
648
struct sockaddr_storage to;
631
649
char *buffer = NULL;
632
650
char *decrypted_buffer = NULL;
633
651
size_t buffer_length = 0;
660
ret = init_gnutls_session(&session);
678
/* If the interface is specified and we have a list of interfaces */
679
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
680
/* Check if the interface is one of the interfaces we are using */
683
char *interface = NULL;
684
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
686
if(if_nametoindex(interface) == (unsigned int)if_index){
693
/* This interface does not match any in the list, so we don't
694
connect to the server */
696
char interface[IF_NAMESIZE];
697
if(if_indextoname((unsigned int)if_index, interface) == NULL){
698
perror_plus("if_indextoname");
700
fprintf_plus(stderr, "Skipping server on non-used interface"
702
if_indextoname((unsigned int)if_index,
710
ret = init_gnutls_session(&session, mc);
683
733
memset(&to, 0, sizeof(to));
684
734
if(af == AF_INET6){
685
to.in6.sin6_family = (sa_family_t)af;
686
ret = inet_pton(af, ip, &to.in6.sin6_addr);
735
((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;
736
ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);
687
737
} else { /* IPv4 */
688
to.in.sin_family = (sa_family_t)af;
689
ret = inet_pton(af, ip, &to.in.sin_addr);
738
((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;
739
ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);
703
753
if(af == AF_INET6){
704
to.in6.sin6_port = htons(port);
705
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
706
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
754
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
755
if(IN6_IS_ADDR_LINKLOCAL
756
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
708
757
if(if_index == AVAHI_IF_UNSPEC){
709
758
fprintf_plus(stderr, "An IPv6 link-local address is"
710
759
" incomplete without a network interface\n");
741
788
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
742
789
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
744
790
if(af == AF_INET6){
745
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
791
ret = getnameinfo((struct sockaddr *)&to,
792
sizeof(struct sockaddr_in6),
793
addrstr, sizeof(addrstr), NULL, 0,
748
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
796
ret = getnameinfo((struct sockaddr *)&to,
797
sizeof(struct sockaddr_in),
798
addrstr, sizeof(addrstr), NULL, 0,
752
perror_plus("inet_ntop");
754
if(strcmp(addrstr, ip) != 0){
755
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
801
if(ret == EAI_SYSTEM){
802
perror_plus("getnameinfo");
803
} else if(ret != 0) {
804
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
805
} else if(strcmp(addrstr, ip) != 0){
806
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
765
815
if(af == AF_INET6){
766
ret = connect(tcp_sd, &to.in6, sizeof(to));
816
ret = connect(tcp_sd, (struct sockaddr *)&to,
817
sizeof(struct sockaddr_in6));
768
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
819
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
820
sizeof(struct sockaddr_in));
771
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
823
if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
773
825
perror_plus("connect");
1020
1073
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1021
1074
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1023
avahi_strerror(avahi_server_errno(mc.server)));
1076
avahi_strerror(avahi_server_errno
1077
(((mandos_context*)mc)->server)));
1026
1080
case AVAHI_RESOLVER_FOUND:
1035
1089
int ret = start_mandos_communication(ip, (in_port_t)port,
1037
avahi_proto_to_af(proto));
1091
avahi_proto_to_af(proto),
1039
1094
avahi_simple_poll_quit(simple_poll);
1041
1096
if(not add_server(ip, (in_port_t)port, interface,
1042
avahi_proto_to_af(proto))){
1097
avahi_proto_to_af(proto),
1098
&((mandos_context*)mc)->current_server)){
1043
1099
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1044
1100
" list\n", name);
1085
1142
the callback function is called the Avahi server will free the
1086
1143
resolver for us. */
1088
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1089
name, type, domain, protocol, 0,
1090
resolve_callback, NULL) == NULL)
1145
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1146
interface, protocol, name, type,
1147
domain, protocol, 0,
1148
resolve_callback, mc) == NULL)
1091
1149
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1093
avahi_strerror(avahi_server_errno(mc.server)));
1151
avahi_strerror(avahi_server_errno
1152
(((mandos_context*)mc)->server)));
1096
1155
case AVAHI_BROWSER_REMOVE:
1319
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1385
__attribute__((nonnull, warn_unused_result))
1386
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1387
mandos_context *mc){
1321
1389
struct timespec now;
1322
1390
struct timespec waited_time;
1323
1391
intmax_t block_time;
1326
if(mc.current_server == NULL){
1394
if(mc->current_server == NULL){
1328
1396
fprintf_plus(stderr, "Wait until first server is found."
1329
1397
" No timeout!\n");
1331
1399
ret = avahi_simple_poll_iterate(s, -1);
1334
1402
fprintf_plus(stderr, "Check current_server if we should run"
1335
1403
" it, or wait\n");
1343
1411
/* Calculating in ms how long time between now and server
1344
1412
who we visted longest time ago. Now - last seen. */
1345
1413
waited_time.tv_sec = (now.tv_sec
1346
- mc.current_server->last_seen.tv_sec);
1414
- mc->current_server->last_seen.tv_sec);
1347
1415
waited_time.tv_nsec = (now.tv_nsec
1348
- mc.current_server->last_seen.tv_nsec);
1416
- mc->current_server->last_seen.tv_nsec);
1349
1417
/* total time is 10s/10,000ms.
1350
1418
Converting to s from ms by dividing by 1,000,
1351
1419
and ns to ms by dividing by 1,000,000. */
1353
1421
- ((intmax_t)waited_time.tv_sec * 1000))
1354
1422
- ((intmax_t)waited_time.tv_nsec / 1000000));
1357
1425
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1361
1429
if(block_time <= 0){
1362
ret = start_mandos_communication(mc.current_server->ip,
1363
mc.current_server->port,
1364
mc.current_server->if_index,
1365
mc.current_server->af);
1430
ret = start_mandos_communication(mc->current_server->ip,
1431
mc->current_server->port,
1432
mc->current_server->if_index,
1433
mc->current_server->af, mc);
1367
avahi_simple_poll_quit(simple_poll);
1435
avahi_simple_poll_quit(s);
1370
1438
ret = clock_gettime(CLOCK_MONOTONIC,
1371
&mc.current_server->last_seen);
1439
&mc->current_server->last_seen);
1373
1441
perror_plus("clock_gettime");
1376
mc.current_server = mc.current_server->next;
1444
mc->current_server = mc->current_server->next;
1377
1445
block_time = 0; /* Call avahi to find new Mandos
1378
1446
servers, but don't block */
1474
1547
if(hook_pid == 0){
1476
1549
/* Raise privileges */
1477
raise_privileges_permanently();
1550
if(raise_privileges_permanently() != 0){
1551
perror_plus("Failed to raise privileges");
1478
1554
/* Set group */
1480
1556
ret = setgid(0);
1482
1558
perror_plus("setgid");
1484
1561
/* Reset supplementary groups */
1486
1563
ret = setgroups(0, NULL);
1488
1565
perror_plus("setgroups");
1490
dup2(devnull, STDIN_FILENO);
1492
dup2(STDERR_FILENO, STDOUT_FILENO);
1568
ret = dup2(devnull, STDIN_FILENO);
1570
perror_plus("dup2(devnull, STDIN_FILENO)");
1573
ret = close(devnull);
1575
perror_plus("close");
1578
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1580
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1493
1583
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1495
1585
perror_plus("setenv");
1595
1683
if(not interface_is_up(interface)){
1596
if(not get_flags(interface, &network) and debug){
1684
error_t ret_errno = 0, ioctl_errno = 0;
1685
if(not get_flags(interface, &network)){
1597
1686
ret_errno = errno;
1598
1687
fprintf_plus(stderr, "Failed to get flags for interface "
1599
1688
"\"%s\"\n", interface);
1600
1690
return ret_errno;
1602
network.ifr_flags |= IFF_UP;
1692
network.ifr_flags |= IFF_UP; /* set flag */
1604
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1694
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1606
1696
ret_errno = errno;
1607
1697
perror_plus("socket");
1608
1698
errno = old_errno;
1609
1699
return ret_errno;
1703
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1705
perror_plus("close");
1614
1707
errno = old_errno;
1623
/* Raise priviliges */
1716
/* Raise privileges */
1717
ret_errno = raise_privileges();
1719
perror_plus("Failed to raise privileges");
1626
1722
#ifdef __linux__
1627
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1628
messages about the network interface to mess up the prompt */
1629
int ret_linux = klogctl(8, NULL, 5);
1630
bool restore_loglevel = true;
1631
if(ret_linux == -1){
1632
restore_loglevel = false;
1633
perror_plus("klogctl");
1724
bool restore_loglevel = false;
1726
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1727
messages about the network interface to mess up the prompt */
1728
ret_linux = klogctl(8, NULL, 5);
1729
if(ret_linux == -1){
1730
perror_plus("klogctl");
1732
restore_loglevel = true;
1635
1735
#endif /* __linux__ */
1636
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1736
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1737
ioctl_errno = errno;
1638
1738
#ifdef __linux__
1639
1739
if(restore_loglevel){
1640
1740
ret_linux = klogctl(7, NULL, 0);
1696
1801
if(interface_is_up(interface)){
1802
error_t ret_errno = 0, ioctl_errno = 0;
1697
1803
if(not get_flags(interface, &network) and debug){
1698
1804
ret_errno = errno;
1699
1805
fprintf_plus(stderr, "Failed to get flags for interface "
1700
1806
"\"%s\"\n", interface);
1701
1808
return ret_errno;
1703
1810
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1705
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1812
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1707
1814
ret_errno = errno;
1708
1815
perror_plus("socket");
1709
1816
errno = old_errno;
1718
/* Raise priviliges */
1721
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1724
/* Lower privileges */
1825
/* Raise privileges */
1826
ret_errno = raise_privileges();
1828
perror_plus("Failed to raise privileges");
1831
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1832
ioctl_errno = errno;
1834
/* If raise_privileges() succeeded above */
1836
/* Lower privileges */
1837
ret_errno = lower_privileges();
1840
perror_plus("Failed to lower privileges");
1727
1844
/* Close the socket */
1728
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1845
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1730
1847
perror_plus("close");
1733
1850
if(ret_setflags == -1){
1851
errno = ioctl_errno;
1735
1852
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1736
1853
errno = old_errno;
1739
1856
} else if(debug){
1740
1857
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1748
1865
int main(int argc, char *argv[]){
1866
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1867
.priority = "SECURE256:!CTYPE-X.509:"
1868
"+CTYPE-OPENPGP", .current_server = NULL,
1869
.interfaces = NULL, .interfaces_size = 0 };
1749
1870
AvahiSServiceBrowser *sb = NULL;
1750
1871
error_t ret_errno;
1752
1873
intmax_t tmpmax;
1754
1875
int exitcode = EXIT_SUCCESS;
1755
char *interfaces = NULL;
1756
size_t interfaces_size = 0;
1757
1876
char *interfaces_to_take_down = NULL;
1758
1877
size_t interfaces_to_take_down_size = 0;
1759
char tempdir[] = "/tmp/mandosXXXXXX";
1760
bool tempdir_created = false;
1878
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
1879
char old_tempdir[] = "/tmp/mandosXXXXXX";
1880
char *tempdir = NULL;
1761
1881
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1762
1882
const char *seckey = PATHDIR "/" SECKEY;
1763
1883
const char *pubkey = PATHDIR "/" PUBKEY;
1764
1884
char *interfaces_hooks = NULL;
1765
size_t interfaces_hooks_size = 0;
1767
1886
bool gnutls_initialized = false;
1768
1887
bool gpgme_initialized = false;
1946
2065
/* Work around Debian bug #633582:
1947
2066
<http://bugs.debian.org/633582> */
1949
/* Re-raise priviliges */
1950
if(raise_privileges() == 0){
2068
/* Re-raise privileges */
2069
ret_errno = raise_privileges();
2072
perror_plus("Failed to raise privileges");
1951
2074
struct stat st;
1953
2076
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1995
2118
/* Lower privileges */
1999
perror_plus("seteuid");
2119
ret_errno = lower_privileges();
2122
perror_plus("Failed to lower privileges");
2004
/* Remove empty interface names */
2127
/* Remove invalid interface names (except "none") */
2006
2129
char *interface = NULL;
2007
while((interface = argz_next(interfaces, interfaces_size,
2130
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2009
if(if_nametoindex(interface) == 0){
2010
if(interface[0] != '\0' and strcmp(interface, "none") != 0){
2132
if(strcmp(interface, "none") != 0
2133
and if_nametoindex(interface) == 0){
2134
if(interface[0] != '\0'){
2011
2135
fprintf_plus(stderr, "Not using nonexisting interface"
2012
2136
" \"%s\"\n", interface);
2014
argz_delete(&interfaces, &interfaces_size, interface);
2138
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2015
2139
interface = NULL;
2020
2144
/* Run network hooks */
2023
if(interfaces != NULL){
2024
interfaces_hooks = malloc(interfaces_size);
2146
if(mc.interfaces != NULL){
2147
interfaces_hooks = malloc(mc.interfaces_size);
2025
2148
if(interfaces_hooks == NULL){
2026
2149
perror_plus("malloc");
2029
memcpy(interfaces_hooks, interfaces, interfaces_size);
2030
interfaces_hooks_size = interfaces_size;
2031
argz_stringify(interfaces_hooks, interfaces_hooks_size,
2034
if(not run_network_hooks("start", interfaces_hooks != NULL ?
2035
interfaces_hooks : "", delay)){
2152
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2153
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2155
run_network_hooks("start", interfaces_hooks != NULL ?
2156
interfaces_hooks : "", delay);
2148
/* If we only got one interface, explicitly use only that one */
2149
if(argz_count(interfaces, interfaces_size) == 1){
2151
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2154
if_index = (AvahiIfIndex)if_nametoindex(interfaces);
2157
/* Bring up interfaces which are down */
2158
if(not (argz_count(interfaces, interfaces_size) == 1
2159
and strcmp(interfaces, "none") == 0)){
2268
/* Bring up interfaces which are down, and remove any "none"s */
2160
2270
char *interface = NULL;
2161
while((interface = argz_next(interfaces, interfaces_size,
2271
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2273
/* If interface name is "none", stop bringing up interfaces.
2274
Also remove all instances of "none" from the list */
2275
if(strcmp(interface, "none") == 0){
2276
argz_delete(&mc.interfaces, &mc.interfaces_size,
2279
while((interface = argz_next(mc.interfaces,
2280
mc.interfaces_size, interface))){
2281
if(strcmp(interface, "none") == 0){
2282
argz_delete(&mc.interfaces, &mc.interfaces_size,
2163
2289
bool interface_was_up = interface_is_up(interface);
2164
ret = bring_up_interface(interface, delay);
2290
errno = bring_up_interface(interface, delay);
2165
2291
if(not interface_was_up){
2168
2293
perror_plus("Failed to bring up interface");
2170
ret_errno = argz_add(&interfaces_to_take_down,
2171
&interfaces_to_take_down_size,
2295
errno = argz_add(&interfaces_to_take_down,
2296
&interfaces_to_take_down_size,
2299
perror_plus("argz_add");
2178
interfaces_size = 0;
2179
2304
if(debug and (interfaces_to_take_down == NULL)){
2180
2305
fprintf_plus(stderr, "No interfaces were brought up\n");
2309
/* If we only got one interface, explicitly use only that one */
2310
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2312
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2315
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2188
ret = init_gnutls_global(pubkey, seckey);
2322
ret = init_gnutls_global(pubkey, seckey, &mc);
2190
2324
fprintf_plus(stderr, "init_gnutls_global failed\n");
2191
2325
exitcode = EX_UNAVAILABLE;
2201
if(mkdtemp(tempdir) == NULL){
2335
/* Try /run/tmp before /tmp */
2336
tempdir = mkdtemp(run_tempdir);
2337
if(tempdir == NULL and errno == ENOENT){
2339
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2340
run_tempdir, old_tempdir);
2342
tempdir = mkdtemp(old_tempdir);
2344
if(tempdir == NULL){
2202
2345
perror_plus("mkdtemp");
2205
tempdir_created = true;
2211
if(not init_gpgme(pubkey, seckey, tempdir)){
2353
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2212
2354
fprintf_plus(stderr, "init_gpgme failed\n");
2213
2355
exitcode = EX_UNAVAILABLE;
2325
2468
/* Create the Avahi service browser */
2326
2469
sb = avahi_s_service_browser_new(mc.server, if_index,
2327
2470
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2328
NULL, 0, browse_callback, NULL);
2471
NULL, 0, browse_callback,
2329
2473
if(sb == NULL){
2330
2474
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2331
2475
avahi_strerror(avahi_server_errno(mc.server)));
2390
/* Re-raise priviliges */
2536
/* Re-raise privileges */
2394
/* Run network hooks */
2395
run_network_hooks("stop", interfaces_hooks != NULL ?
2396
interfaces_hooks : "", delay);
2398
/* Take down the network interfaces which were brought up */
2400
char *interface = NULL;
2401
while((interface=argz_next(interfaces_to_take_down,
2402
interfaces_to_take_down_size,
2404
ret_errno = take_down_interface(interface);
2407
perror_plus("Failed to take down interface");
2410
if(debug and (interfaces_to_take_down == NULL)){
2411
fprintf_plus(stderr, "No interfaces needed to be taken"
2416
lower_privileges_permanently();
2538
ret_errno = raise_privileges();
2540
perror_plus("Failed to raise privileges");
2543
/* Run network hooks */
2544
run_network_hooks("stop", interfaces_hooks != NULL ?
2545
interfaces_hooks : "", delay);
2547
/* Take down the network interfaces which were brought up */
2549
char *interface = NULL;
2550
while((interface=argz_next(interfaces_to_take_down,
2551
interfaces_to_take_down_size,
2553
ret_errno = take_down_interface(interface);
2556
perror_plus("Failed to take down interface");
2559
if(debug and (interfaces_to_take_down == NULL)){
2560
fprintf_plus(stderr, "No interfaces needed to be taken"
2566
ret_errno = lower_privileges_permanently();
2568
perror_plus("Failed to lower privileges permanently");
2419
2572
free(interfaces_to_take_down);
2420
2573
free(interfaces_hooks);
2422
2575
/* Removes the GPGME temp directory and all files inside */
2423
if(tempdir_created){
2576
if(tempdir != NULL){
2424
2577
struct dirent **direntries = NULL;
2425
2578
struct dirent *direntry = NULL;
2426
2579
int numentries = scandir(tempdir, &direntries, notdotentries,
2428
if (numentries > 0){
2429
2582
for(int i = 0; i < numentries; i++){
2430
2583
direntry = direntries[i];
2431
2584
char *fullname = NULL;