111
33
#include <avahi-common/malloc.h>
112
34
#include <avahi-common/error.h>
115
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
118
init_gnutls_session(),
120
#include <gnutls/openpgp.h>
121
/* gnutls_certificate_set_openpgp_key_file(),
122
GNUTLS_OPENPGP_FMT_BASE64 */
125
#include <gpgme.h> /* All GPGME types, constants and
128
GPGME_PROTOCOL_OpenPGP,
37
#include <sys/types.h> /* socket(), setsockopt(), inet_pton() */
38
#include <sys/socket.h> /* socket(), setsockopt(), struct sockaddr_in6, struct in6_addr, inet_pton() */
39
#include <gnutls/gnutls.h> /* ALL GNUTLS STUFF */
40
#include <gnutls/openpgp.h> /* gnutls with openpgp stuff */
42
#include <unistd.h> /* close() */
43
#include <netinet/in.h>
44
#include <stdbool.h> /* true */
45
#include <string.h> /* memset */
46
#include <arpa/inet.h> /* inet_pton() */
47
#include <iso646.h> /* not */
50
#include <errno.h> /* perror() */
57
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
59
#define CERTFILE CERT_ROOT "openpgp-client.txt"
60
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
131
61
#define BUFFER_SIZE 256
133
#define PATHDIR "/conf/conf.d/mandos"
134
#define SECKEY "seckey.txt"
135
#define PUBKEY "pubkey.txt"
136
#define HOOKDIR "/lib/mandos/network-hooks.d"
138
64
bool debug = false;
139
static const char mandos_protocol_version[] = "1";
140
const char *argp_program_version = "mandos-client " VERSION;
141
const char *argp_program_bug_address = "<mandos@recompile.se>";
142
static const char sys_class_net[] = "/sys/class/net";
143
char *connect_to = NULL;
144
const char *hookdir = HOOKDIR;
149
/* Doubly linked list that need to be circularly linked when used */
150
typedef struct server{
153
AvahiIfIndex if_index;
155
struct timespec last_seen;
160
/* Used for passing in values through the Avahi callback functions */
65
char *interface = "eth0";
68
gnutls_session_t session;
163
69
gnutls_certificate_credentials_t cred;
164
unsigned int dh_bits;
165
70
gnutls_dh_params_t dh_params;
166
const char *priority;
74
ssize_t gpg_packet_decrypt (char *packet, size_t packet_size, char **new_packet, char *homedir){
75
gpgme_data_t dh_crypto, dh_plain;
168
server *current_server;
170
size_t interfaces_size;
173
/* global so signal handler can reach it*/
174
AvahiSimplePoll *simple_poll;
176
sig_atomic_t quit_now = 0;
177
int signal_received = 0;
179
/* Function to use when printing errors */
180
void perror_plus(const char *print_text){
182
fprintf(stderr, "Mandos plugin %s: ",
183
program_invocation_short_name);
188
__attribute__((format (gnu_printf, 2, 3), nonnull))
189
int fprintf_plus(FILE *stream, const char *format, ...){
191
va_start (ap, format);
193
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
194
program_invocation_short_name));
195
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
199
* Make additional room in "buffer" for at least BUFFER_SIZE more
200
* bytes. "buffer_capacity" is how much is currently allocated,
201
* "buffer_length" is how much is already used.
203
__attribute__((nonnull, warn_unused_result))
204
size_t incbuffer(char **buffer, size_t buffer_length,
205
size_t buffer_capacity){
206
if(buffer_length + BUFFER_SIZE > buffer_capacity){
207
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
209
int old_errno = errno;
216
buffer_capacity += BUFFER_SIZE;
218
return buffer_capacity;
221
/* Add server to set of servers to retry periodically */
222
__attribute__((nonnull, warn_unused_result))
223
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
224
int af, server **current_server){
226
server *new_server = malloc(sizeof(server));
227
if(new_server == NULL){
228
perror_plus("malloc");
231
*new_server = (server){ .ip = strdup(ip),
233
.if_index = if_index,
235
if(new_server->ip == NULL){
236
perror_plus("strdup");
240
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
242
perror_plus("clock_gettime");
243
free(new_server->ip);
247
/* Special case of first server */
248
if(*current_server == NULL){
249
new_server->next = new_server;
250
new_server->prev = new_server;
251
*current_server = new_server;
253
/* Place the new server last in the list */
254
new_server->next = *current_server;
255
new_server->prev = (*current_server)->prev;
256
new_server->prev->next = new_server;
257
(*current_server)->prev = new_server;
265
__attribute__((nonnull, warn_unused_result))
266
static bool init_gpgme(const char * const seckey,
267
const char * const pubkey,
268
const char * const tempdir,
79
size_t new_packet_capacity = 0;
80
size_t new_packet_length = 0;
271
81
gpgme_engine_info_t engine_info;
274
* Helper function to insert pub and seckey to the engine keyring.
276
bool import_key(const char * const filename){
279
gpgme_data_t pgp_data;
281
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
287
rc = gpgme_data_new_from_fd(&pgp_data, fd);
288
if(rc != GPG_ERR_NO_ERROR){
289
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
290
gpgme_strsource(rc), gpgme_strerror(rc));
294
rc = gpgme_op_import(mc->ctx, pgp_data);
295
if(rc != GPG_ERR_NO_ERROR){
296
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
297
gpgme_strsource(rc), gpgme_strerror(rc));
301
ret = (int)TEMP_FAILURE_RETRY(close(fd));
303
perror_plus("close");
305
gpgme_data_release(pgp_data);
310
fprintf_plus(stderr, "Initializing GPGME\n");
84
fprintf(stderr, "Attempting to decrypt password from gpg packet\n");
314
88
gpgme_check_version(NULL);
315
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
316
if(rc != GPG_ERR_NO_ERROR){
317
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
318
gpgme_strsource(rc), gpgme_strerror(rc));
89
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
322
/* Set GPGME home directory for the OpenPGP engine only */
323
rc = gpgme_get_engine_info(&engine_info);
324
if(rc != GPG_ERR_NO_ERROR){
325
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
326
gpgme_strsource(rc), gpgme_strerror(rc));
91
/* Set GPGME home directory */
92
rc = gpgme_get_engine_info (&engine_info);
93
if (rc != GPG_ERR_NO_ERROR){
94
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
95
gpgme_strsource(rc), gpgme_strerror(rc));
329
98
while(engine_info != NULL){
330
99
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
331
100
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
332
engine_info->file_name, tempdir);
101
engine_info->file_name, homedir);
335
104
engine_info = engine_info->next;
337
106
if(engine_info == NULL){
338
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
343
/* Create new GPGME "context" */
344
rc = gpgme_new(&(mc->ctx));
345
if(rc != GPG_ERR_NO_ERROR){
346
fprintf_plus(stderr, "Mandos plugin mandos-client: "
347
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
352
if(not import_key(pubkey) or not import_key(seckey)){
360
* Decrypt OpenPGP data.
361
* Returns -1 on error
363
__attribute__((nonnull, warn_unused_result))
364
static ssize_t pgp_packet_decrypt(const char *cryptotext,
368
gpgme_data_t dh_crypto, dh_plain;
371
size_t plaintext_capacity = 0;
372
ssize_t plaintext_length = 0;
375
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
378
/* Create new GPGME data buffer from memory cryptotext */
379
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
381
if(rc != GPG_ERR_NO_ERROR){
382
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
383
gpgme_strsource(rc), gpgme_strerror(rc));
107
fprintf(stderr, "Could not set home dir to %s\n", homedir);
111
/* Create new GPGME data buffer from packet buffer */
112
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
113
if (rc != GPG_ERR_NO_ERROR){
114
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
115
gpgme_strsource(rc), gpgme_strerror(rc));
387
119
/* Create new empty GPGME data buffer for the plaintext */
388
120
rc = gpgme_data_new(&dh_plain);
389
if(rc != GPG_ERR_NO_ERROR){
390
fprintf_plus(stderr, "Mandos plugin mandos-client: "
391
"bad gpgme_data_new: %s: %s\n",
392
gpgme_strsource(rc), gpgme_strerror(rc));
393
gpgme_data_release(dh_crypto);
397
/* Decrypt data from the cryptotext data buffer to the plaintext
399
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
400
if(rc != GPG_ERR_NO_ERROR){
401
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
402
gpgme_strsource(rc), gpgme_strerror(rc));
403
plaintext_length = -1;
405
gpgme_decrypt_result_t result;
406
result = gpgme_op_decrypt_result(mc->ctx);
408
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
410
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
411
result->unsupported_algorithm);
412
fprintf_plus(stderr, "Wrong key usage: %u\n",
413
result->wrong_key_usage);
414
if(result->file_name != NULL){
415
fprintf_plus(stderr, "File name: %s\n", result->file_name);
417
gpgme_recipient_t recipient;
418
recipient = result->recipients;
121
if (rc != GPG_ERR_NO_ERROR){
122
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
123
gpgme_strsource(rc), gpgme_strerror(rc));
127
/* Create new GPGME "context" */
128
rc = gpgme_new(&ctx);
129
if (rc != GPG_ERR_NO_ERROR){
130
fprintf(stderr, "bad gpgme_new: %s: %s\n",
131
gpgme_strsource(rc), gpgme_strerror(rc));
135
/* Decrypt data from the FILE pointer to the plaintext data buffer */
136
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
137
if (rc != GPG_ERR_NO_ERROR){
138
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
139
gpgme_strsource(rc), gpgme_strerror(rc));
144
fprintf(stderr, "decryption of gpg packet succeeded\n");
148
gpgme_decrypt_result_t result;
149
result = gpgme_op_decrypt_result(ctx);
151
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
153
fprintf(stderr, "Unsupported algorithm: %s\n", result->unsupported_algorithm);
154
fprintf(stderr, "Wrong key usage: %d\n", result->wrong_key_usage);
155
if(result->file_name != NULL){
156
fprintf(stderr, "File name: %s\n", result->file_name);
158
gpgme_recipient_t recipient;
159
recipient = result->recipients;
419
161
while(recipient != NULL){
420
fprintf_plus(stderr, "Public key algorithm: %s\n",
421
gpgme_pubkey_algo_name
422
(recipient->pubkey_algo));
423
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
424
fprintf_plus(stderr, "Secret key available: %s\n",
425
recipient->status == GPG_ERR_NO_SECKEY
162
fprintf(stderr, "Public key algorithm: %s\n",
163
gpgme_pubkey_algo_name(recipient->pubkey_algo));
164
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
165
fprintf(stderr, "Secret key available: %s\n",
166
recipient->status == GPG_ERR_NO_SECKEY ? "No" : "Yes");
427
167
recipient = recipient->next;
435
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
173
/* Delete the GPGME FILE pointer cryptotext data buffer */
174
gpgme_data_release(dh_crypto);
438
176
/* Seek back to the beginning of the GPGME plaintext data buffer */
439
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
440
perror_plus("gpgme_data_seek");
441
plaintext_length = -1;
177
gpgme_data_seek(dh_plain, 0, SEEK_SET);
447
plaintext_capacity = incbuffer(plaintext,
448
(size_t)plaintext_length,
450
if(plaintext_capacity == 0){
451
perror_plus("incbuffer");
452
plaintext_length = -1;
181
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
182
*new_packet = realloc(*new_packet, new_packet_capacity + BUFFER_SIZE);
183
if (*new_packet == NULL){
187
new_packet_capacity += BUFFER_SIZE;
456
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
190
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length, BUFFER_SIZE);
458
191
/* Print the data, if any */
193
/* If password is empty, then a incorrect error will be printed */
464
perror_plus("gpgme_data_read");
465
plaintext_length = -1;
468
plaintext_length += ret;
472
fprintf_plus(stderr, "Decrypted password is: ");
473
for(ssize_t i = 0; i < plaintext_length; i++){
474
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
476
fprintf(stderr, "\n");
481
/* Delete the GPGME cryptotext data buffer */
482
gpgme_data_release(dh_crypto);
197
perror("gpgme_data_read");
200
new_packet_length += ret;
203
/* FIXME: check characters before printing to screen so to not print
204
terminal control characters */
206
/* fprintf(stderr, "decrypted password is: "); */
207
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
208
/* fprintf(stderr, "\n"); */
484
211
/* Delete the GPGME plaintext data buffer */
485
212
gpgme_data_release(dh_plain);
486
return plaintext_length;
213
return new_packet_length;
489
__attribute__((warn_unused_result))
490
static const char *safer_gnutls_strerror(int value){
491
const char *ret = gnutls_strerror(value);
216
static const char * safer_gnutls_strerror (int value) {
217
const char *ret = gnutls_strerror (value);
493
219
ret = "(unknown)";
497
/* GnuTLS log function callback */
498
__attribute__((nonnull))
499
static void debuggnutls(__attribute__((unused)) int level,
501
fprintf_plus(stderr, "GnuTLS: %s", string);
223
void debuggnutls(int level, const char* string){
224
fprintf(stderr, "%s", string);
504
__attribute__((nonnull, warn_unused_result))
505
static int init_gnutls_global(const char *pubkeyfilename,
506
const char *seckeyfilename,
227
int initgnutls(encrypted_session *es){
511
fprintf_plus(stderr, "Initializing GnuTLS\n");
232
fprintf(stderr, "Initializing gnutls\n");
514
ret = gnutls_global_init();
515
if(ret != GNUTLS_E_SUCCESS){
516
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
517
safer_gnutls_strerror(ret));
236
if ((ret = gnutls_global_init ())
237
!= GNUTLS_E_SUCCESS) {
238
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
522
/* "Use a log level over 10 to enable all debugging options."
525
243
gnutls_global_set_log_level(11);
526
244
gnutls_global_set_log_function(debuggnutls);
529
/* OpenPGP credentials */
530
ret = gnutls_certificate_allocate_credentials(&mc->cred);
531
if(ret != GNUTLS_E_SUCCESS){
532
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
533
safer_gnutls_strerror(ret));
534
gnutls_global_deinit();
248
/* openpgp credentials */
249
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
250
!= GNUTLS_E_SUCCESS) {
251
fprintf (stderr, "memory error: %s\n", safer_gnutls_strerror(ret));
539
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
540
" secret key %s as GnuTLS credentials\n",
256
fprintf(stderr, "Attempting to use openpgp certificate %s"
257
" and keyfile %s as gnutls credentials\n", CERTFILE, KEYFILE);
545
260
ret = gnutls_certificate_set_openpgp_key_file
546
(mc->cred, pubkeyfilename, seckeyfilename,
547
GNUTLS_OPENPGP_FMT_BASE64);
548
if(ret != GNUTLS_E_SUCCESS){
550
"Error[%d] while reading the OpenPGP key pair ('%s',"
551
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
552
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
553
safer_gnutls_strerror(ret));
557
/* GnuTLS server initialization */
558
ret = gnutls_dh_params_init(&mc->dh_params);
559
if(ret != GNUTLS_E_SUCCESS){
560
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
561
" initialization: %s\n",
562
safer_gnutls_strerror(ret));
565
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
566
if(ret != GNUTLS_E_SUCCESS){
567
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
568
safer_gnutls_strerror(ret));
572
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
578
gnutls_certificate_free_credentials(mc->cred);
579
gnutls_global_deinit();
580
gnutls_dh_params_deinit(mc->dh_params);
584
__attribute__((nonnull, warn_unused_result))
585
static int init_gnutls_session(gnutls_session_t *session,
588
/* GnuTLS session creation */
590
ret = gnutls_init(session, GNUTLS_SERVER);
594
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
595
if(ret != GNUTLS_E_SUCCESS){
597
"Error in GnuTLS session initialization: %s\n",
598
safer_gnutls_strerror(ret));
604
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
606
gnutls_deinit(*session);
609
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
610
if(ret != GNUTLS_E_SUCCESS){
611
fprintf_plus(stderr, "Syntax error at: %s\n", err);
612
fprintf_plus(stderr, "GnuTLS error: %s\n",
613
safer_gnutls_strerror(ret));
614
gnutls_deinit(*session);
620
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
623
gnutls_deinit(*session);
626
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
627
if(ret != GNUTLS_E_SUCCESS){
628
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
629
safer_gnutls_strerror(ret));
630
gnutls_deinit(*session);
261
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
262
if (ret != GNUTLS_E_SUCCESS) {
264
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s', '%s')\n",
265
ret, CERTFILE, KEYFILE);
266
fprintf(stdout, "The Error is: %s\n",
267
safer_gnutls_strerror(ret));
271
//Gnutls server initialization
272
if ((ret = gnutls_dh_params_init (&es->dh_params))
273
!= GNUTLS_E_SUCCESS) {
274
fprintf (stderr, "Error in dh parameter initialization: %s\n",
275
safer_gnutls_strerror(ret));
279
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
280
!= GNUTLS_E_SUCCESS) {
281
fprintf (stderr, "Error in prime generation: %s\n",
282
safer_gnutls_strerror(ret));
286
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
288
// Gnutls session creation
289
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
290
!= GNUTLS_E_SUCCESS){
291
fprintf(stderr, "Error in gnutls session initialization: %s\n",
292
safer_gnutls_strerror(ret));
295
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
296
!= GNUTLS_E_SUCCESS) {
297
fprintf(stderr, "Syntax error at: %s\n", err);
298
fprintf(stderr, "Gnutls error: %s\n",
299
safer_gnutls_strerror(ret));
303
if ((ret = gnutls_credentials_set
304
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
305
!= GNUTLS_E_SUCCESS) {
306
fprintf(stderr, "Error setting a credentials set: %s\n",
307
safer_gnutls_strerror(ret));
634
311
/* ignore client certificate if any. */
635
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
312
gnutls_certificate_server_set_request (es->session, GNUTLS_CERT_IGNORE);
637
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
314
gnutls_dh_set_prime_bits (es->session, DH_BITS);
642
/* Avahi log function callback */
643
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
644
__attribute__((unused)) const char *txt){}
319
void empty_log(AvahiLogLevel level, const char *txt){}
646
/* Called when a Mandos server is found */
647
__attribute__((nonnull, warn_unused_result))
648
static int start_mandos_communication(const char *ip, in_port_t port,
649
AvahiIfIndex if_index,
650
int af, mandos_context *mc){
651
int ret, tcp_sd = -1;
653
struct sockaddr_storage to;
321
int start_mandos_communication(char *ip, uint16_t port){
323
struct sockaddr_in6 to;
324
encrypted_session es;
654
325
char *buffer = NULL;
655
char *decrypted_buffer = NULL;
326
char *decrypted_buffer;
656
327
size_t buffer_length = 0;
657
328
size_t buffer_capacity = 0;
660
gnutls_session_t session;
661
int pf; /* Protocol family */
678
fprintf_plus(stderr, "Bad address family: %d\n", af);
683
/* If the interface is specified and we have a list of interfaces */
684
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
685
/* Check if the interface is one of the interfaces we are using */
688
char *interface = NULL;
689
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
691
if(if_nametoindex(interface) == (unsigned int)if_index){
698
/* This interface does not match any in the list, so we don't
699
connect to the server */
701
char interface[IF_NAMESIZE];
702
if(if_indextoname((unsigned int)if_index, interface) == NULL){
703
perror_plus("if_indextoname");
705
fprintf_plus(stderr, "Skipping server on non-used interface"
707
if_indextoname((unsigned int)if_index,
715
ret = init_gnutls_session(&session, mc);
721
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
722
PRIuMAX "\n", ip, (uintmax_t)port);
725
tcp_sd = socket(pf, SOCK_STREAM, 0);
728
perror_plus("socket");
738
memset(&to, 0, sizeof(to));
740
((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;
741
ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);
743
((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;
744
ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);
748
perror_plus("inet_pton");
329
ssize_t decrypted_buffer_size;
333
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
336
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
343
fprintf(stderr, "Binding to interface %s\n", interface);
346
ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, interface, 5);
348
perror("setsockopt bindtodevice");
352
memset(&to,0,sizeof(to));
353
to.sin6_family = AF_INET6;
354
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
754
fprintf_plus(stderr, "Bad address: %s\n", ip);
759
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
760
if(IN6_IS_ADDR_LINKLOCAL
761
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
762
if(if_index == AVAHI_IF_UNSPEC){
763
fprintf_plus(stderr, "An IPv6 link-local address is"
764
" incomplete without a network interface\n");
768
/* Set the network interface number as scope */
769
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
772
((struct sockaddr_in *)&to)->sin_port = htons(port);
781
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
782
char interface[IF_NAMESIZE];
783
if(if_indextoname((unsigned int)if_index, interface) == NULL){
784
perror_plus("if_indextoname");
786
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
787
"\n", ip, interface, (uintmax_t)port);
790
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
791
ip, (uintmax_t)port);
793
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
794
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
796
ret = getnameinfo((struct sockaddr *)&to,
797
sizeof(struct sockaddr_in6),
798
addrstr, sizeof(addrstr), NULL, 0,
801
ret = getnameinfo((struct sockaddr *)&to,
802
sizeof(struct sockaddr_in),
803
addrstr, sizeof(addrstr), NULL, 0,
806
if(ret == EAI_SYSTEM){
807
perror_plus("getnameinfo");
808
} else if(ret != 0) {
809
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
810
} else if(strcmp(addrstr, ip) != 0){
811
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
821
ret = connect(tcp_sd, (struct sockaddr *)&to,
822
sizeof(struct sockaddr_in6));
824
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
825
sizeof(struct sockaddr_in));
828
if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
830
perror_plus("connect");
841
const char *out = mandos_protocol_version;
844
size_t out_size = strlen(out);
845
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
846
out_size - written));
849
perror_plus("write");
853
written += (size_t)ret;
854
if(written < out_size){
857
if(out == mandos_protocol_version){
872
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
880
/* This casting via intptr_t is to eliminate warning about casting
881
an int to a pointer type. This is exactly how the GnuTLS Guile
882
function "set-session-transport-fd!" does it. */
883
gnutls_transport_set_ptr(session,
884
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
892
ret = gnutls_handshake(session);
897
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
899
if(ret != GNUTLS_E_SUCCESS){
901
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
908
/* Read OpenPGP packet that contains the wanted password */
911
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
922
buffer_capacity = incbuffer(&buffer, buffer_length,
924
if(buffer_capacity == 0){
926
perror_plus("incbuffer");
936
sret = gnutls_record_recv(session, buffer+buffer_length,
360
fprintf(stderr, "Bad address: %s\n", ip);
363
to.sin6_port = htons(port);
364
to.sin6_scope_id = if_nametoindex(interface);
367
fprintf(stderr, "Connection to: %s\n", ip);
370
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
376
ret = initgnutls (&es);
383
gnutls_transport_set_ptr (es.session, (gnutls_transport_ptr_t) tcp_sd);
386
fprintf(stderr, "Establishing tls session with %s\n", ip);
390
ret = gnutls_handshake (es.session);
392
if (ret != GNUTLS_E_SUCCESS){
393
fprintf(stderr, "\n*** Handshake failed ***\n");
399
//Retrieve gpg packet that contains the wanted password
402
fprintf(stderr, "Retrieving pgp encrypted password from %s\n", ip);
406
if (buffer_length + BUFFER_SIZE > buffer_capacity){
407
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
412
buffer_capacity += BUFFER_SIZE;
415
ret = gnutls_record_recv
416
(es.session, buffer+buffer_length, BUFFER_SIZE);
943
422
case GNUTLS_E_INTERRUPTED:
944
423
case GNUTLS_E_AGAIN:
946
425
case GNUTLS_E_REHANDSHAKE:
948
ret = gnutls_handshake(session);
954
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
956
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
426
ret = gnutls_handshake (es.session);
428
fprintf(stderr, "\n*** Handshake failed ***\n");
964
fprintf_plus(stderr, "Unknown error while reading data from"
965
" encrypted session with Mandos server\n");
966
gnutls_bye(session, GNUTLS_SHUT_RDWR);
971
buffer_length += (size_t) sret;
976
fprintf_plus(stderr, "Closing TLS session\n");
985
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
990
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
992
if(buffer_length > 0){
993
ssize_t decrypted_buffer_size;
994
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
995
&decrypted_buffer, mc);
996
if(decrypted_buffer_size >= 0){
999
while(written < (size_t) decrypted_buffer_size){
1005
ret = (int)fwrite(decrypted_buffer + written, 1,
1006
(size_t)decrypted_buffer_size - written,
1008
if(ret == 0 and ferror(stdout)){
1011
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
1017
written += (size_t)ret;
1023
/* Shutdown procedure */
1028
free(decrypted_buffer);
1031
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
1037
perror_plus("close");
1039
gnutls_deinit(session);
435
fprintf(stderr, "Unknown error while reading data from encrypted session with mandos server\n");
437
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
441
buffer_length += ret;
445
if (buffer_length > 0){
446
if ((decrypted_buffer_size = gpg_packet_decrypt(buffer, buffer_length, &decrypted_buffer, CERT_ROOT)) >= 0){
447
fwrite (decrypted_buffer, 1, decrypted_buffer_size, stdout);
448
free(decrypted_buffer);
457
fprintf(stderr, "Closing tls session\n");
461
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
464
gnutls_deinit (es.session);
465
gnutls_certificate_free_credentials (es.cred);
466
gnutls_global_deinit ();
1049
__attribute__((nonnull))
1050
static void resolve_callback(AvahiSServiceResolver *r,
1051
AvahiIfIndex interface,
1052
AvahiProtocol proto,
1053
AvahiResolverEvent event,
1057
const char *host_name,
1058
const AvahiAddress *address,
1060
AVAHI_GCC_UNUSED AvahiStringList *txt,
1061
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1068
/* Called whenever a service has been resolved successfully or
1077
case AVAHI_RESOLVER_FAILURE:
1078
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1079
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1081
avahi_strerror(avahi_server_errno
1082
(((mandos_context*)mc)->server)));
1085
case AVAHI_RESOLVER_FOUND:
1087
char ip[AVAHI_ADDRESS_STR_MAX];
1088
avahi_address_snprint(ip, sizeof(ip), address);
1090
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1091
PRIdMAX ") on port %" PRIu16 "\n", name,
1092
host_name, ip, (intmax_t)interface, port);
1094
int ret = start_mandos_communication(ip, (in_port_t)port,
1096
avahi_proto_to_af(proto),
1099
avahi_simple_poll_quit(simple_poll);
1101
if(not add_server(ip, (in_port_t)port, interface,
1102
avahi_proto_to_af(proto),
1103
&((mandos_context*)mc)->current_server)){
1104
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1110
avahi_s_service_resolver_free(r);
1113
static void browse_callback(AvahiSServiceBrowser *b,
1114
AvahiIfIndex interface,
1115
AvahiProtocol protocol,
1116
AvahiBrowserEvent event,
1120
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1127
/* Called whenever a new services becomes available on the LAN or
1128
is removed from the LAN */
1136
case AVAHI_BROWSER_FAILURE:
1138
fprintf_plus(stderr, "(Avahi browser) %s\n",
1139
avahi_strerror(avahi_server_errno
1140
(((mandos_context*)mc)->server)));
1141
avahi_simple_poll_quit(simple_poll);
1144
case AVAHI_BROWSER_NEW:
1145
/* We ignore the returned Avahi resolver object. In the callback
1146
function we free it. If the Avahi server is terminated before
1147
the callback function is called the Avahi server will free the
1150
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1151
interface, protocol, name, type,
1152
domain, protocol, 0,
1153
resolve_callback, mc) == NULL)
1154
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1156
avahi_strerror(avahi_server_errno
1157
(((mandos_context*)mc)->server)));
1160
case AVAHI_BROWSER_REMOVE:
1163
case AVAHI_BROWSER_ALL_FOR_NOW:
1164
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1166
fprintf_plus(stderr, "No Mandos server found, still"
1173
/* Signal handler that stops main loop after SIGTERM */
1174
static void handle_sigterm(int sig){
1179
signal_received = sig;
1180
int old_errno = errno;
1181
/* set main loop to exit */
1182
if(simple_poll != NULL){
1183
avahi_simple_poll_quit(simple_poll);
1188
__attribute__((nonnull, warn_unused_result))
1189
bool get_flags(const char *ifname, struct ifreq *ifr){
1193
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1196
perror_plus("socket");
1200
strcpy(ifr->ifr_name, ifname);
1201
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1205
perror_plus("ioctl SIOCGIFFLAGS");
1213
__attribute__((nonnull, warn_unused_result))
1214
bool good_flags(const char *ifname, const struct ifreq *ifr){
1216
/* Reject the loopback device */
1217
if(ifr->ifr_flags & IFF_LOOPBACK){
1219
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1224
/* Accept point-to-point devices only if connect_to is specified */
1225
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1227
fprintf_plus(stderr, "Accepting point-to-point interface"
1228
" \"%s\"\n", ifname);
1232
/* Otherwise, reject non-broadcast-capable devices */
1233
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1235
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1236
" \"%s\"\n", ifname);
1240
/* Reject non-ARP interfaces (including dummy interfaces) */
1241
if(ifr->ifr_flags & IFF_NOARP){
1243
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1249
/* Accept this device */
1251
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1257
* This function determines if a directory entry in /sys/class/net
1258
* corresponds to an acceptable network device.
1259
* (This function is passed to scandir(3) as a filter function.)
1261
__attribute__((nonnull, warn_unused_result))
1262
int good_interface(const struct dirent *if_entry){
1263
if(if_entry->d_name[0] == '.'){
1268
if(not get_flags(if_entry->d_name, &ifr)){
1270
fprintf_plus(stderr, "Failed to get flags for interface "
1271
"\"%s\"\n", if_entry->d_name);
1276
if(not good_flags(if_entry->d_name, &ifr)){
1283
* This function determines if a network interface is up.
1285
__attribute__((nonnull, warn_unused_result))
1286
bool interface_is_up(const char *interface){
1288
if(not get_flags(interface, &ifr)){
1290
fprintf_plus(stderr, "Failed to get flags for interface "
1291
"\"%s\"\n", interface);
1296
return (bool)(ifr.ifr_flags & IFF_UP);
1300
* This function determines if a network interface is running
1302
__attribute__((nonnull, warn_unused_result))
1303
bool interface_is_running(const char *interface){
1305
if(not get_flags(interface, &ifr)){
1307
fprintf_plus(stderr, "Failed to get flags for interface "
1308
"\"%s\"\n", interface);
1313
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1316
__attribute__((nonnull, pure, warn_unused_result))
1317
int notdotentries(const struct dirent *direntry){
1318
/* Skip "." and ".." */
1319
if(direntry->d_name[0] == '.'
1320
and (direntry->d_name[1] == '\0'
1321
or (direntry->d_name[1] == '.'
1322
and direntry->d_name[2] == '\0'))){
1328
/* Is this directory entry a runnable program? */
1329
__attribute__((nonnull, warn_unused_result))
1330
int runnable_hook(const struct dirent *direntry){
1335
if((direntry->d_name)[0] == '\0'){
1340
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1341
"abcdefghijklmnopqrstuvwxyz"
1344
if((direntry->d_name)[sret] != '\0'){
1345
/* Contains non-allowed characters */
1347
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1353
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1356
perror_plus("Could not stat hook");
1360
if(not (S_ISREG(st.st_mode))){
1361
/* Not a regular file */
1363
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1368
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1369
/* Not executable */
1371
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1377
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1383
__attribute__((nonnull, warn_unused_result))
1384
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1385
mandos_context *mc){
1387
struct timespec now;
1388
struct timespec waited_time;
1389
intmax_t block_time;
1392
if(mc->current_server == NULL){
1394
fprintf_plus(stderr, "Wait until first server is found."
1397
ret = avahi_simple_poll_iterate(s, -1);
1400
fprintf_plus(stderr, "Check current_server if we should run"
1403
/* the current time */
1404
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1406
perror_plus("clock_gettime");
1409
/* Calculating in ms how long time between now and server
1410
who we visted longest time ago. Now - last seen. */
1411
waited_time.tv_sec = (now.tv_sec
1412
- mc->current_server->last_seen.tv_sec);
1413
waited_time.tv_nsec = (now.tv_nsec
1414
- mc->current_server->last_seen.tv_nsec);
1415
/* total time is 10s/10,000ms.
1416
Converting to s from ms by dividing by 1,000,
1417
and ns to ms by dividing by 1,000,000. */
1418
block_time = ((retry_interval
1419
- ((intmax_t)waited_time.tv_sec * 1000))
1420
- ((intmax_t)waited_time.tv_nsec / 1000000));
1423
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1427
if(block_time <= 0){
1428
ret = start_mandos_communication(mc->current_server->ip,
1429
mc->current_server->port,
1430
mc->current_server->if_index,
1431
mc->current_server->af, mc);
1433
avahi_simple_poll_quit(s);
1436
ret = clock_gettime(CLOCK_MONOTONIC,
1437
&mc->current_server->last_seen);
1439
perror_plus("clock_gettime");
1442
mc->current_server = mc->current_server->next;
1443
block_time = 0; /* Call avahi to find new Mandos
1444
servers, but don't block */
1447
ret = avahi_simple_poll_iterate(s, (int)block_time);
1450
if(ret > 0 or errno != EINTR){
1451
return (ret != 1) ? ret : 0;
1457
/* Set effective uid to 0, return errno */
1458
__attribute__((warn_unused_result))
1459
error_t raise_privileges(void){
1460
error_t old_errno = errno;
1461
error_t ret_errno = 0;
1462
if(seteuid(0) == -1){
1469
/* Set effective and real user ID to 0. Return errno. */
1470
__attribute__((warn_unused_result))
1471
error_t raise_privileges_permanently(void){
1472
error_t old_errno = errno;
1473
error_t ret_errno = raise_privileges();
1478
if(setuid(0) == -1){
1485
/* Set effective user ID to unprivileged saved user ID */
1486
__attribute__((warn_unused_result))
1487
error_t lower_privileges(void){
1488
error_t old_errno = errno;
1489
error_t ret_errno = 0;
1490
if(seteuid(uid) == -1){
1497
/* Lower privileges permanently */
1498
__attribute__((warn_unused_result))
1499
error_t lower_privileges_permanently(void){
1500
error_t old_errno = errno;
1501
error_t ret_errno = 0;
1502
if(setuid(uid) == -1){
1509
__attribute__((nonnull))
1510
void run_network_hooks(const char *mode, const char *interface,
1512
struct dirent **direntries = NULL;
1513
if(hookdir_fd == -1){
1514
hookdir_fd = open(hookdir, O_RDONLY);
1515
if(hookdir_fd == -1){
1516
if(errno == ENOENT){
1518
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1519
" found\n", hookdir);
1522
perror_plus("open");
1528
#if __GLIBC_PREREQ(2, 15)
1529
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1530
runnable_hook, alphasort);
1531
#else /* not __GLIBC_PREREQ(2, 15) */
1532
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1534
#endif /* not __GLIBC_PREREQ(2, 15) */
1535
#else /* not __GLIBC__ */
1536
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1538
#endif /* not __GLIBC__ */
1540
perror_plus("scandir");
1543
struct dirent *direntry;
1545
int devnull = open("/dev/null", O_RDONLY);
1546
for(int i = 0; i < numhooks; i++){
1547
direntry = direntries[i];
1549
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1552
pid_t hook_pid = fork();
1555
/* Raise privileges */
1556
errno = raise_privileges_permanently();
1558
perror_plus("Failed to raise privileges");
1565
perror_plus("setgid");
1568
/* Reset supplementary groups */
1570
ret = setgroups(0, NULL);
1572
perror_plus("setgroups");
1575
ret = dup2(devnull, STDIN_FILENO);
1577
perror_plus("dup2(devnull, STDIN_FILENO)");
1580
ret = close(devnull);
1582
perror_plus("close");
1585
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1587
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1590
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1592
perror_plus("setenv");
1595
ret = setenv("DEVICE", interface, 1);
1597
perror_plus("setenv");
1600
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1602
perror_plus("setenv");
1605
ret = setenv("MODE", mode, 1);
1607
perror_plus("setenv");
1611
ret = asprintf(&delaystring, "%f", (double)delay);
1613
perror_plus("asprintf");
1616
ret = setenv("DELAY", delaystring, 1);
1619
perror_plus("setenv");
1623
if(connect_to != NULL){
1624
ret = setenv("CONNECT", connect_to, 1);
1626
perror_plus("setenv");
1630
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1632
perror_plus("openat");
1633
_exit(EXIT_FAILURE);
1635
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1636
perror_plus("close");
1637
_exit(EXIT_FAILURE);
1639
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1641
perror_plus("fexecve");
1642
_exit(EXIT_FAILURE);
1646
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1647
perror_plus("waitpid");
1650
if(WIFEXITED(status)){
1651
if(WEXITSTATUS(status) != 0){
1652
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1653
" with status %d\n", direntry->d_name,
1654
WEXITSTATUS(status));
1657
} else if(WIFSIGNALED(status)){
1658
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1659
" signal %d\n", direntry->d_name,
1663
fprintf_plus(stderr, "Warning: network hook \"%s\""
1664
" crashed\n", direntry->d_name);
1669
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1674
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1675
perror_plus("close");
1682
__attribute__((nonnull, warn_unused_result))
1683
error_t bring_up_interface(const char *const interface,
1685
error_t old_errno = errno;
1687
struct ifreq network;
1688
unsigned int if_index = if_nametoindex(interface);
1690
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1700
if(not interface_is_up(interface)){
1701
error_t ret_errno = 0, ioctl_errno = 0;
1702
if(not get_flags(interface, &network)){
1704
fprintf_plus(stderr, "Failed to get flags for interface "
1705
"\"%s\"\n", interface);
1709
network.ifr_flags |= IFF_UP; /* set flag */
1711
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1714
perror_plus("socket");
1720
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1722
perror_plus("close");
1729
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
1733
/* Raise privileges */
1734
ret_errno = raise_privileges();
1737
perror_plus("Failed to raise privileges");
1742
bool restore_loglevel = false;
1744
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1745
messages about the network interface to mess up the prompt */
1746
ret_linux = klogctl(8, NULL, 5);
1747
if(ret_linux == -1){
1748
perror_plus("klogctl");
1750
restore_loglevel = true;
1753
#endif /* __linux__ */
1754
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1755
ioctl_errno = errno;
1757
if(restore_loglevel){
1758
ret_linux = klogctl(7, NULL, 0);
1759
if(ret_linux == -1){
1760
perror_plus("klogctl");
1763
#endif /* __linux__ */
1765
/* If raise_privileges() succeeded above */
1767
/* Lower privileges */
1768
ret_errno = lower_privileges();
1771
perror_plus("Failed to lower privileges");
1775
/* Close the socket */
1776
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1778
perror_plus("close");
1781
if(ret_setflags == -1){
1782
errno = ioctl_errno;
1783
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1788
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1792
/* Sleep checking until interface is running.
1793
Check every 0.25s, up to total time of delay */
1794
for(int i=0; i < delay * 4; i++){
1795
if(interface_is_running(interface)){
1798
struct timespec sleeptime = { .tv_nsec = 250000000 };
1799
ret = nanosleep(&sleeptime, NULL);
1800
if(ret == -1 and errno != EINTR){
1801
perror_plus("nanosleep");
1809
__attribute__((nonnull, warn_unused_result))
1810
error_t take_down_interface(const char *const interface){
1811
error_t old_errno = errno;
1812
struct ifreq network;
1813
unsigned int if_index = if_nametoindex(interface);
1815
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1819
if(interface_is_up(interface)){
1820
error_t ret_errno = 0, ioctl_errno = 0;
1821
if(not get_flags(interface, &network) and debug){
1823
fprintf_plus(stderr, "Failed to get flags for interface "
1824
"\"%s\"\n", interface);
1828
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1830
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1833
perror_plus("socket");
1839
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
1843
/* Raise privileges */
1844
ret_errno = raise_privileges();
1847
perror_plus("Failed to raise privileges");
1850
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1851
ioctl_errno = errno;
1853
/* If raise_privileges() succeeded above */
1855
/* Lower privileges */
1856
ret_errno = lower_privileges();
1859
perror_plus("Failed to lower privileges");
1863
/* Close the socket */
1864
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1866
perror_plus("close");
1869
if(ret_setflags == -1){
1870
errno = ioctl_errno;
1871
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1876
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1884
int main(int argc, char *argv[]){
1885
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1886
.priority = "SECURE256:!CTYPE-X.509:"
1887
"+CTYPE-OPENPGP", .current_server = NULL,
1888
.interfaces = NULL, .interfaces_size = 0 };
1889
AvahiSServiceBrowser *sb = NULL;
1894
int exitcode = EXIT_SUCCESS;
1895
char *interfaces_to_take_down = NULL;
1896
size_t interfaces_to_take_down_size = 0;
1897
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
1898
char old_tempdir[] = "/tmp/mandosXXXXXX";
1899
char *tempdir = NULL;
1900
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1901
const char *seckey = PATHDIR "/" SECKEY;
1902
const char *pubkey = PATHDIR "/" PUBKEY;
1903
char *interfaces_hooks = NULL;
1905
bool gnutls_initialized = false;
1906
bool gpgme_initialized = false;
1908
double retry_interval = 10; /* 10s between trying a server and
1909
retrying the same server again */
1911
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1912
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1917
/* Lower any group privileges we might have, just to be safe */
1921
perror_plus("setgid");
1924
/* Lower user privileges (temporarily) */
1928
perror_plus("seteuid");
1936
struct argp_option options[] = {
1937
{ .name = "debug", .key = 128,
1938
.doc = "Debug mode", .group = 3 },
1939
{ .name = "connect", .key = 'c',
1940
.arg = "ADDRESS:PORT",
1941
.doc = "Connect directly to a specific Mandos server",
1943
{ .name = "interface", .key = 'i',
1945
.doc = "Network interface that will be used to search for"
1948
{ .name = "seckey", .key = 's',
1950
.doc = "OpenPGP secret key file base name",
1952
{ .name = "pubkey", .key = 'p',
1954
.doc = "OpenPGP public key file base name",
1956
{ .name = "dh-bits", .key = 129,
1958
.doc = "Bit length of the prime number used in the"
1959
" Diffie-Hellman key exchange",
1961
{ .name = "priority", .key = 130,
1963
.doc = "GnuTLS priority string for the TLS handshake",
1965
{ .name = "delay", .key = 131,
1967
.doc = "Maximum delay to wait for interface startup",
1969
{ .name = "retry", .key = 132,
1971
.doc = "Retry interval used when denied by the Mandos server",
1973
{ .name = "network-hook-dir", .key = 133,
1975
.doc = "Directory where network hooks are located",
1978
* These reproduce what we would get without ARGP_NO_HELP
1980
{ .name = "help", .key = '?',
1981
.doc = "Give this help list", .group = -1 },
1982
{ .name = "usage", .key = -3,
1983
.doc = "Give a short usage message", .group = -1 },
1984
{ .name = "version", .key = 'V',
1985
.doc = "Print program version", .group = -1 },
1989
error_t parse_opt(int key, char *arg,
1990
struct argp_state *state){
1993
case 128: /* --debug */
1996
case 'c': /* --connect */
1999
case 'i': /* --interface */
2000
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
2003
argp_error(state, "%s", strerror(ret_errno));
2006
case 's': /* --seckey */
2009
case 'p': /* --pubkey */
2012
case 129: /* --dh-bits */
2014
tmpmax = strtoimax(arg, &tmp, 10);
2015
if(errno != 0 or tmp == arg or *tmp != '\0'
2016
or tmpmax != (typeof(mc.dh_bits))tmpmax){
2017
argp_error(state, "Bad number of DH bits");
2019
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
2021
case 130: /* --priority */
2024
case 131: /* --delay */
2026
delay = strtof(arg, &tmp);
2027
if(errno != 0 or tmp == arg or *tmp != '\0'){
2028
argp_error(state, "Bad delay");
2030
case 132: /* --retry */
2032
retry_interval = strtod(arg, &tmp);
2033
if(errno != 0 or tmp == arg or *tmp != '\0'
2034
or (retry_interval * 1000) > INT_MAX
2035
or retry_interval < 0){
2036
argp_error(state, "Bad retry interval");
2039
case 133: /* --network-hook-dir */
2043
* These reproduce what we would get without ARGP_NO_HELP
2045
case '?': /* --help */
2046
argp_state_help(state, state->out_stream,
2047
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
2048
& ~(unsigned int)ARGP_HELP_EXIT_OK);
2049
case -3: /* --usage */
2050
argp_state_help(state, state->out_stream,
2051
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
2052
case 'V': /* --version */
2053
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
2054
exit(argp_err_exit_status);
2057
return ARGP_ERR_UNKNOWN;
2062
struct argp argp = { .options = options, .parser = parse_opt,
2064
.doc = "Mandos client -- Get and decrypt"
2065
" passwords from a Mandos server" };
2066
ret = argp_parse(&argp, argc, argv,
2067
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
2074
perror_plus("argp_parse");
2075
exitcode = EX_OSERR;
2078
exitcode = EX_USAGE;
2084
/* Work around Debian bug #633582:
2085
<http://bugs.debian.org/633582> */
2087
/* Re-raise privileges */
2088
ret_errno = raise_privileges();
2091
perror_plus("Failed to raise privileges");
2095
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2096
int seckey_fd = open(seckey, O_RDONLY);
2097
if(seckey_fd == -1){
2098
perror_plus("open");
2100
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
2102
perror_plus("fstat");
2104
if(S_ISREG(st.st_mode)
2105
and st.st_uid == 0 and st.st_gid == 0){
2106
ret = fchown(seckey_fd, uid, gid);
2108
perror_plus("fchown");
2112
TEMP_FAILURE_RETRY(close(seckey_fd));
2116
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
2117
int pubkey_fd = open(pubkey, O_RDONLY);
2118
if(pubkey_fd == -1){
2119
perror_plus("open");
2121
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
2123
perror_plus("fstat");
2125
if(S_ISREG(st.st_mode)
2126
and st.st_uid == 0 and st.st_gid == 0){
2127
ret = fchown(pubkey_fd, uid, gid);
2129
perror_plus("fchown");
2133
TEMP_FAILURE_RETRY(close(pubkey_fd));
2137
/* Lower privileges */
2138
ret_errno = lower_privileges();
2141
perror_plus("Failed to lower privileges");
2146
/* Remove invalid interface names (except "none") */
2148
char *interface = NULL;
2149
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2151
if(strcmp(interface, "none") != 0
2152
and if_nametoindex(interface) == 0){
2153
if(interface[0] != '\0'){
2154
fprintf_plus(stderr, "Not using nonexisting interface"
2155
" \"%s\"\n", interface);
2157
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2163
/* Run network hooks */
2165
if(mc.interfaces != NULL){
2166
interfaces_hooks = malloc(mc.interfaces_size);
2167
if(interfaces_hooks == NULL){
2168
perror_plus("malloc");
2171
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2172
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2174
run_network_hooks("start", interfaces_hooks != NULL ?
2175
interfaces_hooks : "", delay);
2179
avahi_set_log_function(empty_log);
2182
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
2183
from the signal handler */
2184
/* Initialize the pseudo-RNG for Avahi */
2185
srand((unsigned int) time(NULL));
2186
simple_poll = avahi_simple_poll_new();
2187
if(simple_poll == NULL){
2188
fprintf_plus(stderr,
2189
"Avahi: Failed to create simple poll object.\n");
2190
exitcode = EX_UNAVAILABLE;
2194
sigemptyset(&sigterm_action.sa_mask);
2195
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
2197
perror_plus("sigaddset");
2198
exitcode = EX_OSERR;
2201
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
2203
perror_plus("sigaddset");
2204
exitcode = EX_OSERR;
2207
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
2209
perror_plus("sigaddset");
2210
exitcode = EX_OSERR;
2213
/* Need to check if the handler is SIG_IGN before handling:
2214
| [[info:libc:Initial Signal Actions]] |
2215
| [[info:libc:Basic Signal Handling]] |
2217
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
2219
perror_plus("sigaction");
2222
if(old_sigterm_action.sa_handler != SIG_IGN){
2223
ret = sigaction(SIGINT, &sigterm_action, NULL);
2225
perror_plus("sigaction");
2226
exitcode = EX_OSERR;
2230
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
2232
perror_plus("sigaction");
2235
if(old_sigterm_action.sa_handler != SIG_IGN){
2236
ret = sigaction(SIGHUP, &sigterm_action, NULL);
2238
perror_plus("sigaction");
2239
exitcode = EX_OSERR;
2243
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
2245
perror_plus("sigaction");
2248
if(old_sigterm_action.sa_handler != SIG_IGN){
2249
ret = sigaction(SIGTERM, &sigterm_action, NULL);
2251
perror_plus("sigaction");
2252
exitcode = EX_OSERR;
2257
/* If no interfaces were specified, make a list */
2258
if(mc.interfaces == NULL){
2259
struct dirent **direntries = NULL;
2260
/* Look for any good interfaces */
2261
ret = scandir(sys_class_net, &direntries, good_interface,
2264
/* Add all found interfaces to interfaces list */
2265
for(int i = 0; i < ret; ++i){
2266
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2267
direntries[i]->d_name);
2270
perror_plus("argz_add");
2274
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2275
direntries[i]->d_name);
2283
fprintf_plus(stderr, "Could not find a network interface\n");
2284
exitcode = EXIT_FAILURE;
2289
/* Bring up interfaces which are down, and remove any "none"s */
2291
char *interface = NULL;
2292
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2294
/* If interface name is "none", stop bringing up interfaces.
2295
Also remove all instances of "none" from the list */
2296
if(strcmp(interface, "none") == 0){
2297
argz_delete(&mc.interfaces, &mc.interfaces_size,
2300
while((interface = argz_next(mc.interfaces,
2301
mc.interfaces_size, interface))){
2302
if(strcmp(interface, "none") == 0){
2303
argz_delete(&mc.interfaces, &mc.interfaces_size,
2310
bool interface_was_up = interface_is_up(interface);
2311
errno = bring_up_interface(interface, delay);
2312
if(not interface_was_up){
2314
perror_plus("Failed to bring up interface");
2316
errno = argz_add(&interfaces_to_take_down,
2317
&interfaces_to_take_down_size,
2320
perror_plus("argz_add");
2325
if(debug and (interfaces_to_take_down == NULL)){
2326
fprintf_plus(stderr, "No interfaces were brought up\n");
2330
/* If we only got one interface, explicitly use only that one */
2331
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2333
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2336
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2343
ret = init_gnutls_global(pubkey, seckey, &mc);
2345
fprintf_plus(stderr, "init_gnutls_global failed\n");
2346
exitcode = EX_UNAVAILABLE;
2349
gnutls_initialized = true;
2356
/* Try /run/tmp before /tmp */
2357
tempdir = mkdtemp(run_tempdir);
2358
if(tempdir == NULL and errno == ENOENT){
2360
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2361
run_tempdir, old_tempdir);
2363
tempdir = mkdtemp(old_tempdir);
2365
if(tempdir == NULL){
2366
perror_plus("mkdtemp");
2374
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2375
fprintf_plus(stderr, "init_gpgme failed\n");
2376
exitcode = EX_UNAVAILABLE;
2379
gpgme_initialized = true;
2386
if(connect_to != NULL){
2387
/* Connect directly, do not use Zeroconf */
2388
/* (Mainly meant for debugging) */
2389
char *address = strrchr(connect_to, ':');
2391
if(address == NULL){
2392
fprintf_plus(stderr, "No colon in address\n");
2393
exitcode = EX_USAGE;
2403
tmpmax = strtoimax(address+1, &tmp, 10);
2404
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2405
or tmpmax != (in_port_t)tmpmax){
2406
fprintf_plus(stderr, "Bad port number\n");
2407
exitcode = EX_USAGE;
2415
port = (in_port_t)tmpmax;
2417
/* Colon in address indicates IPv6 */
2419
if(strchr(connect_to, ':') != NULL){
2421
/* Accept [] around IPv6 address - see RFC 5952 */
2422
if(connect_to[0] == '[' and address[-1] == ']')
2430
address = connect_to;
2436
while(not quit_now){
2437
ret = start_mandos_communication(address, port, if_index, af,
2439
if(quit_now or ret == 0){
2443
fprintf_plus(stderr, "Retrying in %d seconds\n",
2444
(int)retry_interval);
2446
sleep((unsigned int)retry_interval);
2450
exitcode = EXIT_SUCCESS;
470
static AvahiSimplePoll *simple_poll = NULL;
471
static AvahiServer *server = NULL;
473
static void resolve_callback(
474
AvahiSServiceResolver *r,
475
AVAHI_GCC_UNUSED AvahiIfIndex interface,
476
AVAHI_GCC_UNUSED AvahiProtocol protocol,
477
AvahiResolverEvent event,
481
const char *host_name,
482
const AvahiAddress *address,
484
AvahiStringList *txt,
485
AvahiLookupResultFlags flags,
486
AVAHI_GCC_UNUSED void* userdata) {
490
/* Called whenever a service has been resolved successfully or timed out */
493
case AVAHI_RESOLVER_FAILURE:
494
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of type '%s' in domain '%s': %s\n", name, type, domain, avahi_strerror(avahi_server_errno(server)));
497
case AVAHI_RESOLVER_FOUND: {
498
char ip[AVAHI_ADDRESS_STR_MAX];
499
avahi_address_snprint(ip, sizeof(ip), address);
501
fprintf(stderr, "Mandos server found at %s on port %d\n", ip, port);
503
int ret = start_mandos_communication(ip, port);
511
avahi_s_service_resolver_free(r);
514
static void browse_callback(
515
AvahiSServiceBrowser *b,
516
AvahiIfIndex interface,
517
AvahiProtocol protocol,
518
AvahiBrowserEvent event,
522
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
525
AvahiServer *s = userdata;
528
/* Called whenever a new services becomes available on the LAN or is removed from the LAN */
532
case AVAHI_BROWSER_FAILURE:
534
fprintf(stderr, "(Browser) %s\n", avahi_strerror(avahi_server_errno(server)));
535
avahi_simple_poll_quit(simple_poll);
538
case AVAHI_BROWSER_NEW:
539
/* We ignore the returned resolver object. In the callback
540
function we free it. If the server is terminated before
541
the callback function is called the server will free
542
the resolver for us. */
544
if (!(avahi_s_service_resolver_new(s, interface, protocol, name, type, domain, AVAHI_PROTO_INET6, 0, resolve_callback, s)))
545
fprintf(stderr, "Failed to resolve service '%s': %s\n", name, avahi_strerror(avahi_server_errno(s)));
549
case AVAHI_BROWSER_REMOVE:
552
case AVAHI_BROWSER_ALL_FOR_NOW:
553
case AVAHI_BROWSER_CACHE_EXHAUSTED:
558
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
2461
559
AvahiServerConfig config;
2462
/* Do not publish any local Zeroconf records */
560
AvahiSServiceBrowser *sb = NULL;
563
int returncode = EXIT_SUCCESS;
566
static struct option long_options[] = {
567
{"debug", no_argument, (int *)&debug, 1},
568
{"interface", required_argument, 0, 'i'},
571
int option_index = 0;
572
ret = getopt_long (argc, argv, "i:", long_options, &option_index);
590
avahi_set_log_function(empty_log);
593
/* Initialize the psuedo-RNG */
596
/* Allocate main loop object */
597
if (!(simple_poll = avahi_simple_poll_new())) {
598
fprintf(stderr, "Failed to create simple poll object.\n");
603
/* Do not publish any local records */
2463
604
avahi_server_config_init(&config);
2464
605
config.publish_hinfo = 0;
2465
606
config.publish_addresses = 0;
2466
607
config.publish_workstation = 0;
2467
608
config.publish_domain = 0;
2469
610
/* Allocate a new server */
2470
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2471
&config, NULL, NULL, &ret_errno);
2473
/* Free the Avahi configuration data */
611
server = avahi_server_new(avahi_simple_poll_get(simple_poll), &config, NULL, NULL, &error);
613
/* Free the configuration data */
2474
614
avahi_server_config_free(&config);
2477
/* Check if creating the Avahi server object succeeded */
2478
if(mc.server == NULL){
2479
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2480
avahi_strerror(ret_errno));
2481
exitcode = EX_UNAVAILABLE;
2489
/* Create the Avahi service browser */
2490
sb = avahi_s_service_browser_new(mc.server, if_index,
2491
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2492
NULL, 0, browse_callback,
2495
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2496
avahi_strerror(avahi_server_errno(mc.server)));
2497
exitcode = EX_UNAVAILABLE;
2505
/* Run the main loop */
2508
fprintf_plus(stderr, "Starting Avahi loop search\n");
2511
ret = avahi_loop_with_timeout(simple_poll,
2512
(int)(retry_interval * 1000), &mc);
2514
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2515
(ret == 0) ? "successfully" : "with error");
2521
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2524
/* Cleanup things */
2525
free(mc.interfaces);
2528
avahi_s_service_browser_free(sb);
2530
if(mc.server != NULL)
2531
avahi_server_free(mc.server);
2533
if(simple_poll != NULL)
2534
avahi_simple_poll_free(simple_poll);
2536
if(gnutls_initialized){
2537
gnutls_certificate_free_credentials(mc.cred);
2538
gnutls_global_deinit();
2539
gnutls_dh_params_deinit(mc.dh_params);
2542
if(gpgme_initialized){
2543
gpgme_release(mc.ctx);
2546
/* Cleans up the circular linked list of Mandos servers the client
2548
if(mc.current_server != NULL){
2549
mc.current_server->prev->next = NULL;
2550
while(mc.current_server != NULL){
2551
server *next = mc.current_server->next;
2552
free(mc.current_server);
2553
mc.current_server = next;
2557
/* Re-raise privileges */
2559
ret_errno = raise_privileges();
2562
perror_plus("Failed to raise privileges");
2565
/* Run network hooks */
2566
run_network_hooks("stop", interfaces_hooks != NULL ?
2567
interfaces_hooks : "", delay);
2569
/* Take down the network interfaces which were brought up */
2571
char *interface = NULL;
2572
while((interface=argz_next(interfaces_to_take_down,
2573
interfaces_to_take_down_size,
2575
ret_errno = take_down_interface(interface);
2578
perror_plus("Failed to take down interface");
2581
if(debug and (interfaces_to_take_down == NULL)){
2582
fprintf_plus(stderr, "No interfaces needed to be taken"
2588
ret_errno = lower_privileges_permanently();
2591
perror_plus("Failed to lower privileges permanently");
2595
free(interfaces_to_take_down);
2596
free(interfaces_hooks);
2598
/* Removes the GPGME temp directory and all files inside */
2599
if(tempdir != NULL){
2600
struct dirent **direntries = NULL;
2601
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2603
if(tempdir_fd == -1){
2604
perror_plus("open");
2607
#if __GLIBC_PREREQ(2, 15)
2608
int numentries = scandirat(tempdir_fd, ".", &direntries,
2609
notdotentries, alphasort);
2610
#else /* not __GLIBC_PREREQ(2, 15) */
2611
int numentries = scandir(tempdir, &direntries, notdotentries,
2613
#endif /* not __GLIBC_PREREQ(2, 15) */
2614
#else /* not __GLIBC__ */
2615
int numentries = scandir(tempdir, &direntries, notdotentries,
2617
#endif /* not __GLIBC__ */
2618
if(numentries >= 0){
2619
for(int i = 0; i < numentries; i++){
2620
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2622
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2623
" \"%s\", 0): %s\n", tempdir,
2624
direntries[i]->d_name, strerror(errno));
2628
/* need to clean even if 0 because man page doesn't specify */
2630
if(numentries == -1){
2631
perror_plus("scandir");
2633
ret = rmdir(tempdir);
2634
if(ret == -1 and errno != ENOENT){
2635
perror_plus("rmdir");
2638
TEMP_FAILURE_RETRY(close(tempdir_fd));
2643
sigemptyset(&old_sigterm_action.sa_mask);
2644
old_sigterm_action.sa_handler = SIG_DFL;
2645
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
2646
&old_sigterm_action,
2649
perror_plus("sigaction");
2652
ret = raise(signal_received);
2653
} while(ret != 0 and errno == EINTR);
2655
perror_plus("raise");
2658
TEMP_FAILURE_RETRY(pause());
616
/* Check if creating the server object succeeded */
618
fprintf(stderr, "Failed to create server: %s\n", avahi_strerror(error));
619
returncode = EXIT_FAILURE;
623
/* Create the service browser */
624
if (!(sb = avahi_s_service_browser_new(server, if_nametoindex("eth0"), AVAHI_PROTO_INET6, "_mandos._tcp", NULL, 0, browse_callback, server))) {
625
fprintf(stderr, "Failed to create service browser: %s\n", avahi_strerror(avahi_server_errno(server)));
626
returncode = EXIT_FAILURE;
630
/* Run the main loop */
633
fprintf(stderr, "Starting avahi loop search\n");
636
avahi_simple_poll_loop(simple_poll);
641
fprintf(stderr, "%s exiting\n", argv[0]);
646
avahi_s_service_browser_free(sb);
649
avahi_server_free(server);
652
avahi_simple_poll_free(simple_poll);