To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 237.4.65
- compare with another revision
- download diff
- download tarball
- view history from revision 237.4.65
- Committer: Teddy Hogeborn
- Date: 2016-02-29 21:28:39 UTC
- mto: This revision was merged to the branch mainline in revision 814.
- Revision ID: teddy@recompile.se-20160229212839-hoz3rw1us3uds68n
Tags: version-1.7.3-1
* Makefile (version): Changed to "1.7.3".
* NEWS (Version 1.7.3): New entry.
* debian/changelog (1.7.3-1): - '' -
* NEWS (Version 1.7.3): New entry.
* debian/changelog (1.7.3-1): - '' -
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2018 Teddy Hogeborn
13
* Copyright © 2008-2018 Björn Påhlsson
14
*
15
* This file is part of Mandos.
16
*
17
* Mandos is free software: you can redistribute it and/or modify it
18
* under the terms of the GNU General Public License as published by
19
* the Free Software Foundation, either version 3 of the License, or
20
* (at your option) any later version.
21
*
22
* Mandos is distributed in the hope that it will be useful, but
12
* Copyright © 2008-2016 Teddy Hogeborn
13
* Copyright © 2008-2016 Björn Påhlsson
14
*
15
* This program is free software: you can redistribute it and/or
16
* modify it under the terms of the GNU General Public License as
17
* published by the Free Software Foundation, either version 3 of the
18
* License, or (at your option) any later version.
19
*
20
* This program is distributed in the hope that it will be useful, but
23
21
* WITHOUT ANY WARRANTY; without even the implied warranty of
24
22
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
25
23
* General Public License for more details.
26
24
*
27
25
* You should have received a copy of the GNU General Public License
28
* along with Mandos. If not, see <http://www.gnu.org/licenses/>.
26
* along with this program. If not, see
27
* <http://www.gnu.org/licenses/>.
29
28
*
30
29
* Contact the authors at <mandos@recompile.se>.
31
30
*/
48
47
strtof(), abort() */
49
48
#include <stdbool.h> /* bool, false, true */
50
49
#include <string.h> /* strcmp(), strlen(), strerror(),
51
asprintf(), strncpy(), strsignal()
52
*/
50
asprintf(), strncpy() */
53
51
#include <sys/ioctl.h> /* ioctl */
54
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
55
53
sockaddr_in6, PF_INET6,
420
418
if(result == NULL){
421
419
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
422
420
} else {
423
if(result->unsupported_algorithm != NULL) {
424
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
425
result->unsupported_algorithm);
426
}
421
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
422
result->unsupported_algorithm);
427
423
fprintf_plus(stderr, "Wrong key usage: %u\n",
428
424
result->wrong_key_usage);
429
425
if(result->file_name != NULL){
615
611
}
616
612
params.size += (unsigned int)bytes_read;
617
613
}
618
ret = close(dhpfile);
619
if(ret == -1){
620
perror_plus("close");
621
}
622
614
if(params.data == NULL){
623
615
dhparamsfilename = NULL;
624
616
}
633
625
safer_gnutls_strerror(ret));
634
626
dhparamsfilename = NULL;
635
627
}
636
free(params.data);
637
628
} while(false);
638
629
}
639
630
if(dhparamsfilename == NULL){
826
817
827
818
/* Set effective uid to 0, return errno */
828
819
__attribute__((warn_unused_result))
829
int raise_privileges(void){
830
int old_errno = errno;
831
int ret = 0;
820
error_t raise_privileges(void){
821
error_t old_errno = errno;
822
error_t ret_errno = 0;
832
823
if(seteuid(0) == -1){
833
ret = errno;
824
ret_errno = errno;
834
825
}
835
826
errno = old_errno;
836
return ret;
827
return ret_errno;
837
828
}
838
829
839
830
/* Set effective and real user ID to 0. Return errno. */
840
831
__attribute__((warn_unused_result))
841
int raise_privileges_permanently(void){
842
int old_errno = errno;
843
int ret = raise_privileges();
844
if(ret != 0){
832
error_t raise_privileges_permanently(void){
833
error_t old_errno = errno;
834
error_t ret_errno = raise_privileges();
835
if(ret_errno != 0){
845
836
errno = old_errno;
846
return ret;
837
return ret_errno;
847
838
}
848
839
if(setuid(0) == -1){
849
ret = errno;
840
ret_errno = errno;
850
841
}
851
842
errno = old_errno;
852
return ret;
843
return ret_errno;
853
844
}
854
845
855
846
/* Set effective user ID to unprivileged saved user ID */
856
847
__attribute__((warn_unused_result))
857
int lower_privileges(void){
858
int old_errno = errno;
859
int ret = 0;
848
error_t lower_privileges(void){
849
error_t old_errno = errno;
850
error_t ret_errno = 0;
860
851
if(seteuid(uid) == -1){
861
ret = errno;
852
ret_errno = errno;
862
853
}
863
854
errno = old_errno;
864
return ret;
855
return ret_errno;
865
856
}
866
857
867
858
/* Lower privileges permanently */
868
859
__attribute__((warn_unused_result))
869
int lower_privileges_permanently(void){
870
int old_errno = errno;
871
int ret = 0;
860
error_t lower_privileges_permanently(void){
861
error_t old_errno = errno;
862
error_t ret_errno = 0;
872
863
if(setuid(uid) == -1){
873
ret = errno;
864
ret_errno = errno;
874
865
}
875
866
errno = old_errno;
876
return ret;
867
return ret_errno;
877
868
}
878
869
879
870
/* Helper function to add_local_route() and delete_local_route() */
1086
1077
bool match = false;
1087
1078
{
1088
1079
char *interface = NULL;
1089
while((interface = argz_next(mc->interfaces,
1090
mc->interfaces_size,
1091
interface))){
1080
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
1081
interface))){
1092
1082
if(if_nametoindex(interface) == (unsigned int)if_index){
1093
1083
match = true;
1094
1084
break;
1247
1237
with an explicit route added with the server's address.
1248
1238
1249
1239
Avahi bug reference:
1250
https://lists.freedesktop.org/archives/avahi/2010-February/001833.html
1240
http://lists.freedesktop.org/archives/avahi/2010-February/001833.html
1251
1241
https://bugs.debian.org/587961
1252
1242
*/
1253
1243
if(debug){
1433
1423
&decrypted_buffer, mc);
1434
1424
if(decrypted_buffer_size >= 0){
1435
1425
1436
clearerr(stdout);
1437
1426
written = 0;
1438
1427
while(written < (size_t) decrypted_buffer_size){
1439
1428
if(quit_now){
1455
1444
}
1456
1445
written += (size_t)ret;
1457
1446
}
1458
ret = fflush(stdout);
1459
if(ret != 0){
1460
int e = errno;
1461
if(debug){
1462
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
1463
strerror(errno));
1464
}
1465
errno = e;
1466
goto mandos_end;
1467
}
1468
1447
retval = 0;
1469
1448
}
1470
1449
}
1501
1480
return retval;
1502
1481
}
1503
1482
1483
__attribute__((nonnull))
1504
1484
static void resolve_callback(AvahiSServiceResolver *r,
1505
1485
AvahiIfIndex interface,
1506
1486
AvahiProtocol proto,
1643
1623
__attribute__((nonnull, warn_unused_result))
1644
1624
bool get_flags(const char *ifname, struct ifreq *ifr){
1645
1625
int ret;
1646
int old_errno;
1626
error_t ret_errno;
1647
1627
1648
1628
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1649
1629
if(s < 0){
1650
old_errno = errno;
1630
ret_errno = errno;
1651
1631
perror_plus("socket");
1652
errno = old_errno;
1632
errno = ret_errno;
1653
1633
return false;
1654
1634
}
1655
1635
strncpy(ifr->ifr_name, ifname, IF_NAMESIZE);
1657
1637
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1658
1638
if(ret == -1){
1659
1639
if(debug){
1660
old_errno = errno;
1640
ret_errno = errno;
1661
1641
perror_plus("ioctl SIOCGIFFLAGS");
1662
errno = old_errno;
1663
}
1664
if((close(s) == -1) and debug){
1665
old_errno = errno;
1666
perror_plus("close");
1667
errno = old_errno;
1642
errno = ret_errno;
1668
1643
}
1669
1644
return false;
1670
1645
}
1671
if((close(s) == -1) and debug){
1672
old_errno = errno;
1673
perror_plus("close");
1674
errno = old_errno;
1675
}
1676
1646
return true;
1677
1647
}
1678
1648
1939
1909
return;
1940
1910
}
1941
1911
}
1942
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
1943
if(devnull == -1){
1944
perror_plus("open(\"/dev/null\", O_RDONLY)");
1945
return;
1946
}
1947
1912
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1948
1913
runnable_hook, alphasort);
1949
1914
if(numhooks == -1){
1950
1915
perror_plus("scandir");
1951
close(devnull);
1952
1916
return;
1953
1917
}
1954
1918
struct dirent *direntry;
1955
1919
int ret;
1920
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
1921
if(devnull == -1){
1922
perror_plus("open(\"/dev/null\", O_RDONLY)");
1923
return;
1924
}
1956
1925
for(int i = 0; i < numhooks; i++){
1957
1926
direntry = direntries[i];
1958
1927
if(debug){
2102
2071
}
2103
2072
2104
2073
__attribute__((nonnull, warn_unused_result))
2105
int bring_up_interface(const char *const interface,
2106
const float delay){
2107
int old_errno = errno;
2074
error_t bring_up_interface(const char *const interface,
2075
const float delay){
2076
error_t old_errno = errno;
2108
2077
int ret;
2109
2078
struct ifreq network;
2110
2079
unsigned int if_index = if_nametoindex(interface);
2120
2089
}
2121
2090
2122
2091
if(not interface_is_up(interface)){
2123
int ret_errno = 0;
2124
int ioctl_errno = 0;
2092
error_t ret_errno = 0, ioctl_errno = 0;
2125
2093
if(not get_flags(interface, &network)){
2126
2094
ret_errno = errno;
2127
2095
fprintf_plus(stderr, "Failed to get flags for interface "
2214
2182
2215
2183
/* Sleep checking until interface is running.
2216
2184
Check every 0.25s, up to total time of delay */
2217
for(int i = 0; i < delay * 4; i++){
2185
for(int i=0; i < delay * 4; i++){
2218
2186
if(interface_is_running(interface)){
2219
2187
break;
2220
2188
}
2230
2198
}
2231
2199
2232
2200
__attribute__((nonnull, warn_unused_result))
2233
int take_down_interface(const char *const interface){
2234
int old_errno = errno;
2201
error_t take_down_interface(const char *const interface){
2202
error_t old_errno = errno;
2235
2203
struct ifreq network;
2236
2204
unsigned int if_index = if_nametoindex(interface);
2237
2205
if(if_index == 0){
2240
2208
return ENXIO;
2241
2209
}
2242
2210
if(interface_is_up(interface)){
2243
int ret_errno = 0;
2244
int ioctl_errno = 0;
2211
error_t ret_errno = 0, ioctl_errno = 0;
2245
2212
if(not get_flags(interface, &network) and debug){
2246
2213
ret_errno = errno;
2247
2214
fprintf_plus(stderr, "Failed to get flags for interface "
2497
2464
.args_doc = "",
2498
2465
.doc = "Mandos client -- Get and decrypt"
2499
2466
" passwords from a Mandos server" };
2500
ret_errno = argp_parse(&argp, argc, argv,
2501
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
2502
switch(ret_errno){
2467
ret = argp_parse(&argp, argc, argv,
2468
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
2469
switch(ret){
2503
2470
case 0:
2504
2471
break;
2505
2472
case ENOMEM:
2506
2473
default:
2507
errno = ret_errno;
2474
errno = ret;
2508
2475
perror_plus("argp_parse");
2509
2476
exitcode = EX_OSERR;
2510
2477
goto end;
2516
2483
2517
2484
{
2518
2485
/* Work around Debian bug #633582:
2519
<https://bugs.debian.org/633582> */
2486
<http://bugs.debian.org/633582> */
2520
2487
2521
2488
/* Re-raise privileges */
2522
ret = raise_privileges();
2523
if(ret != 0){
2524
errno = ret;
2489
ret_errno = raise_privileges();
2490
if(ret_errno != 0){
2491
errno = ret_errno;
2525
2492
perror_plus("Failed to raise privileges");
2526
2493
} else {
2527
2494
struct stat st;
2591
2558
}
2592
2559
2593
2560
/* Lower privileges */
2594
ret = lower_privileges();
2595
if(ret != 0){
2596
errno = ret;
2561
ret_errno = lower_privileges();
2562
if(ret_errno != 0){
2563
errno = ret_errno;
2597
2564
perror_plus("Failed to lower privileges");
2598
2565
}
2599
2566
}
2927
2894
2928
2895
/* Allocate a new server */
2929
2896
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2930
&config, NULL, NULL, &ret);
2897
&config, NULL, NULL, &ret_errno);
2931
2898
2932
2899
/* Free the Avahi configuration data */
2933
2900
avahi_server_config_free(&config);
2936
2903
/* Check if creating the Avahi server object succeeded */
2937
2904
if(mc.server == NULL){
2938
2905
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2939
avahi_strerror(ret));
2906
avahi_strerror(ret_errno));
2940
2907
exitcode = EX_UNAVAILABLE;
2941
2908
goto end;
2942
2909
}
2977
2944
end:
2978
2945
2979
2946
if(debug){
2980
if(signal_received){
2981
fprintf_plus(stderr, "%s exiting due to signal %d: %s\n",
2982
argv[0], signal_received,
2983
strsignal(signal_received));
2984
} else {
2985
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2986
}
2947
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2987
2948
}
2988
2949
2989
2950
/* Cleanup things */
3028
2989
3029
2990
/* Re-raise privileges */
3030
2991
{
3031
ret = raise_privileges();
3032
if(ret != 0){
3033
errno = ret;
2992
ret_errno = raise_privileges();
2993
if(ret_errno != 0){
2994
errno = ret_errno;
3034
2995
perror_plus("Failed to raise privileges");
3035
2996
} else {
3036
2997
3041
3002
/* Take down the network interfaces which were brought up */
3042
3003
{
3043
3004
char *interface = NULL;
3044
while((interface = argz_next(interfaces_to_take_down,
3045
interfaces_to_take_down_size,
3046
interface))){
3047
ret = take_down_interface(interface);
3048
if(ret != 0){
3049
errno = ret;
3005
while((interface=argz_next(interfaces_to_take_down,
3006
interfaces_to_take_down_size,
3007
interface))){
3008
ret_errno = take_down_interface(interface);
3009
if(ret_errno != 0){
3010
errno = ret_errno;
3050
3011
perror_plus("Failed to take down interface");
3051
3012
}
3052
3013
}
3057
3018
}
3058
3019
}
3059
3020
3060
ret = lower_privileges_permanently();
3061
if(ret != 0){
3062
errno = ret;
3021
ret_errno = lower_privileges_permanently();
3022
if(ret_errno != 0){
3023
errno = ret_errno;
3063
3024
perror_plus("Failed to lower privileges permanently");
3064
3025
}
3065
3026
}
3078
3039
| O_PATH));
3079
3040
if(dir_fd == -1){
3080
3041
perror_plus("open");
3081
return;
3082
3042
}
3083
3043
int numentries = scandirat(dir_fd, ".", &direntries,
3084
3044
notdotentries, alphasort);
3101
3061
clean_dir_at(dir_fd, direntries[i]->d_name, level+1);
3102
3062
dret = 0;
3103
3063
}
3104
if((dret == -1) and (errno != ENOENT)){
3064
if(dret == -1){
3105
3065
fprintf_plus(stderr, "unlink(\"%s/%s\"): %s\n", dirname,
3106
3066
direntries[i]->d_name, strerror(errno));
3107
3067
}
3111
3071
3112
3072
/* need to clean even if 0 because man page doesn't specify */
3113
3073
free(direntries);
3074
if(numentries == -1){
3075
perror_plus("scandirat");
3076
}
3114
3077
dret = unlinkat(base, dirname, AT_REMOVEDIR);
3115
3078
if(dret == -1 and errno != ENOENT){
3116
3079
perror_plus("rmdir");
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0