111
47
#include <avahi-common/malloc.h>
112
48
#include <avahi-common/error.h>
115
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
118
init_gnutls_session(),
120
#include <gnutls/openpgp.h>
121
/* gnutls_certificate_set_openpgp_key_file(),
122
GNUTLS_OPENPGP_FMT_BASE64 */
125
#include <gpgme.h> /* All GPGME types, constants and
128
GPGME_PROTOCOL_OpenPGP,
51
#include <sys/types.h> /* socket(), inet_pton() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton() */
54
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
55
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
57
#include <unistd.h> /* close() */
58
#include <netinet/in.h>
59
#include <stdbool.h> /* true */
60
#include <string.h> /* memset */
61
#include <arpa/inet.h> /* inet_pton() */
62
#include <iso646.h> /* not */
65
#include <errno.h> /* perror() */
72
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
74
#define CERTFILE CERT_ROOT "openpgp-client.txt"
75
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
131
76
#define BUFFER_SIZE 256
133
#define PATHDIR "/conf/conf.d/mandos"
134
#define SECKEY "seckey.txt"
135
#define PUBKEY "pubkey.txt"
136
#define HOOKDIR "/lib/mandos/network-hooks.d"
138
79
bool debug = false;
139
static const char mandos_protocol_version[] = "1";
140
const char *argp_program_version = "mandos-client " VERSION;
141
const char *argp_program_bug_address = "<mandos@recompile.se>";
142
static const char sys_class_net[] = "/sys/class/net";
143
char *connect_to = NULL;
144
const char *hookdir = HOOKDIR;
149
/* Doubly linked list that need to be circularly linked when used */
150
typedef struct server{
153
AvahiIfIndex if_index;
155
struct timespec last_seen;
160
/* Used for passing in values through the Avahi callback functions */
82
gnutls_session_t session;
163
83
gnutls_certificate_credentials_t cred;
164
unsigned int dh_bits;
165
84
gnutls_dh_params_t dh_params;
166
const char *priority;
88
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
89
char **new_packet, const char *homedir){
90
gpgme_data_t dh_crypto, dh_plain;
168
server *current_server;
170
size_t interfaces_size;
173
/* global so signal handler can reach it*/
174
AvahiSimplePoll *simple_poll;
176
sig_atomic_t quit_now = 0;
177
int signal_received = 0;
179
/* Function to use when printing errors */
180
void perror_plus(const char *print_text){
182
fprintf(stderr, "Mandos plugin %s: ",
183
program_invocation_short_name);
188
__attribute__((format (gnu_printf, 2, 3), nonnull))
189
int fprintf_plus(FILE *stream, const char *format, ...){
191
va_start (ap, format);
193
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
194
program_invocation_short_name));
195
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
199
* Make additional room in "buffer" for at least BUFFER_SIZE more
200
* bytes. "buffer_capacity" is how much is currently allocated,
201
* "buffer_length" is how much is already used.
203
__attribute__((nonnull, warn_unused_result))
204
size_t incbuffer(char **buffer, size_t buffer_length,
205
size_t buffer_capacity){
206
if(buffer_length + BUFFER_SIZE > buffer_capacity){
207
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
209
int old_errno = errno;
216
buffer_capacity += BUFFER_SIZE;
218
return buffer_capacity;
221
/* Add server to set of servers to retry periodically */
222
__attribute__((nonnull, warn_unused_result))
223
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
224
int af, server **current_server){
226
server *new_server = malloc(sizeof(server));
227
if(new_server == NULL){
228
perror_plus("malloc");
231
*new_server = (server){ .ip = strdup(ip),
233
.if_index = if_index,
235
if(new_server->ip == NULL){
236
perror_plus("strdup");
239
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
241
perror_plus("clock_gettime");
244
/* Special case of first server */
245
if(*current_server == NULL){
246
new_server->next = new_server;
247
new_server->prev = new_server;
248
*current_server = new_server;
250
/* Place the new server last in the list */
251
new_server->next = *current_server;
252
new_server->prev = (*current_server)->prev;
253
new_server->prev->next = new_server;
254
(*current_server)->prev = new_server;
262
__attribute__((nonnull, warn_unused_result))
263
static bool init_gpgme(const char * const seckey,
264
const char * const pubkey,
265
const char * const tempdir,
94
ssize_t new_packet_capacity = 0;
95
ssize_t new_packet_length = 0;
268
96
gpgme_engine_info_t engine_info;
271
* Helper function to insert pub and seckey to the engine keyring.
273
bool import_key(const char * const filename){
276
gpgme_data_t pgp_data;
278
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
284
rc = gpgme_data_new_from_fd(&pgp_data, fd);
285
if(rc != GPG_ERR_NO_ERROR){
286
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
287
gpgme_strsource(rc), gpgme_strerror(rc));
291
rc = gpgme_op_import(mc->ctx, pgp_data);
292
if(rc != GPG_ERR_NO_ERROR){
293
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
294
gpgme_strsource(rc), gpgme_strerror(rc));
298
ret = (int)TEMP_FAILURE_RETRY(close(fd));
300
perror_plus("close");
302
gpgme_data_release(pgp_data);
307
fprintf_plus(stderr, "Initializing GPGME\n");
99
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
311
103
gpgme_check_version(NULL);
312
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
313
if(rc != GPG_ERR_NO_ERROR){
314
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
315
gpgme_strsource(rc), gpgme_strerror(rc));
104
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
319
/* Set GPGME home directory for the OpenPGP engine only */
320
rc = gpgme_get_engine_info(&engine_info);
321
if(rc != GPG_ERR_NO_ERROR){
322
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
323
gpgme_strsource(rc), gpgme_strerror(rc));
106
/* Set GPGME home directory */
107
rc = gpgme_get_engine_info (&engine_info);
108
if (rc != GPG_ERR_NO_ERROR){
109
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
110
gpgme_strsource(rc), gpgme_strerror(rc));
326
113
while(engine_info != NULL){
327
114
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
328
115
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
329
engine_info->file_name, tempdir);
116
engine_info->file_name, homedir);
332
119
engine_info = engine_info->next;
334
121
if(engine_info == NULL){
335
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
340
/* Create new GPGME "context" */
341
rc = gpgme_new(&(mc->ctx));
342
if(rc != GPG_ERR_NO_ERROR){
343
fprintf_plus(stderr, "Mandos plugin mandos-client: "
344
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
349
if(not import_key(pubkey) or not import_key(seckey)){
357
* Decrypt OpenPGP data.
358
* Returns -1 on error
360
__attribute__((nonnull, warn_unused_result))
361
static ssize_t pgp_packet_decrypt(const char *cryptotext,
365
gpgme_data_t dh_crypto, dh_plain;
368
size_t plaintext_capacity = 0;
369
ssize_t plaintext_length = 0;
372
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
375
/* Create new GPGME data buffer from memory cryptotext */
376
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
378
if(rc != GPG_ERR_NO_ERROR){
379
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
380
gpgme_strsource(rc), gpgme_strerror(rc));
122
fprintf(stderr, "Could not set home dir to %s\n", homedir);
126
/* Create new GPGME data buffer from packet buffer */
127
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
128
if (rc != GPG_ERR_NO_ERROR){
129
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
130
gpgme_strsource(rc), gpgme_strerror(rc));
384
134
/* Create new empty GPGME data buffer for the plaintext */
385
135
rc = gpgme_data_new(&dh_plain);
386
if(rc != GPG_ERR_NO_ERROR){
387
fprintf_plus(stderr, "Mandos plugin mandos-client: "
388
"bad gpgme_data_new: %s: %s\n",
389
gpgme_strsource(rc), gpgme_strerror(rc));
390
gpgme_data_release(dh_crypto);
394
/* Decrypt data from the cryptotext data buffer to the plaintext
396
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
397
if(rc != GPG_ERR_NO_ERROR){
398
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
399
gpgme_strsource(rc), gpgme_strerror(rc));
400
plaintext_length = -1;
402
gpgme_decrypt_result_t result;
403
result = gpgme_op_decrypt_result(mc->ctx);
405
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
407
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
408
result->unsupported_algorithm);
409
fprintf_plus(stderr, "Wrong key usage: %u\n",
410
result->wrong_key_usage);
411
if(result->file_name != NULL){
412
fprintf_plus(stderr, "File name: %s\n", result->file_name);
414
gpgme_recipient_t recipient;
415
recipient = result->recipients;
136
if (rc != GPG_ERR_NO_ERROR){
137
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
138
gpgme_strsource(rc), gpgme_strerror(rc));
142
/* Create new GPGME "context" */
143
rc = gpgme_new(&ctx);
144
if (rc != GPG_ERR_NO_ERROR){
145
fprintf(stderr, "bad gpgme_new: %s: %s\n",
146
gpgme_strsource(rc), gpgme_strerror(rc));
150
/* Decrypt data from the FILE pointer to the plaintext data
152
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
153
if (rc != GPG_ERR_NO_ERROR){
154
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
155
gpgme_strsource(rc), gpgme_strerror(rc));
160
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
164
gpgme_decrypt_result_t result;
165
result = gpgme_op_decrypt_result(ctx);
167
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
169
fprintf(stderr, "Unsupported algorithm: %s\n",
170
result->unsupported_algorithm);
171
fprintf(stderr, "Wrong key usage: %d\n",
172
result->wrong_key_usage);
173
if(result->file_name != NULL){
174
fprintf(stderr, "File name: %s\n", result->file_name);
176
gpgme_recipient_t recipient;
177
recipient = result->recipients;
416
179
while(recipient != NULL){
417
fprintf_plus(stderr, "Public key algorithm: %s\n",
418
gpgme_pubkey_algo_name
419
(recipient->pubkey_algo));
420
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
421
fprintf_plus(stderr, "Secret key available: %s\n",
422
recipient->status == GPG_ERR_NO_SECKEY
180
fprintf(stderr, "Public key algorithm: %s\n",
181
gpgme_pubkey_algo_name(recipient->pubkey_algo));
182
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
183
fprintf(stderr, "Secret key available: %s\n",
184
recipient->status == GPG_ERR_NO_SECKEY
424
186
recipient = recipient->next;
432
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
192
/* Delete the GPGME FILE pointer cryptotext data buffer */
193
gpgme_data_release(dh_crypto);
435
195
/* Seek back to the beginning of the GPGME plaintext data buffer */
436
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
437
perror_plus("gpgme_data_seek");
438
plaintext_length = -1;
196
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
444
plaintext_capacity = incbuffer(plaintext,
445
(size_t)plaintext_length,
447
if(plaintext_capacity == 0){
448
perror_plus("incbuffer");
449
plaintext_length = -1;
200
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
201
*new_packet = realloc(*new_packet,
202
(unsigned int)new_packet_capacity
204
if (*new_packet == NULL){
208
new_packet_capacity += BUFFER_SIZE;
453
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
211
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
455
213
/* Print the data, if any */
461
perror_plus("gpgme_data_read");
462
plaintext_length = -1;
465
plaintext_length += ret;
469
fprintf_plus(stderr, "Decrypted password is: ");
470
for(ssize_t i = 0; i < plaintext_length; i++){
471
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
473
fprintf(stderr, "\n");
478
/* Delete the GPGME cryptotext data buffer */
479
gpgme_data_release(dh_crypto);
218
perror("gpgme_data_read");
221
new_packet_length += ret;
224
/* FIXME: check characters before printing to screen so to not print
225
terminal control characters */
227
/* fprintf(stderr, "decrypted password is: "); */
228
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
229
/* fprintf(stderr, "\n"); */
481
232
/* Delete the GPGME plaintext data buffer */
482
233
gpgme_data_release(dh_plain);
483
return plaintext_length;
234
return new_packet_length;
486
__attribute__((warn_unused_result))
487
static const char *safer_gnutls_strerror(int value){
488
const char *ret = gnutls_strerror(value);
237
static const char * safer_gnutls_strerror (int value) {
238
const char *ret = gnutls_strerror (value);
490
240
ret = "(unknown)";
494
/* GnuTLS log function callback */
495
__attribute__((nonnull))
496
static void debuggnutls(__attribute__((unused)) int level,
498
fprintf_plus(stderr, "GnuTLS: %s", string);
244
void debuggnutls(__attribute__((unused)) int level,
246
fprintf(stderr, "%s", string);
501
__attribute__((nonnull, warn_unused_result))
502
static int init_gnutls_global(const char *pubkeyfilename,
503
const char *seckeyfilename,
249
int initgnutls(encrypted_session *es){
508
fprintf_plus(stderr, "Initializing GnuTLS\n");
254
fprintf(stderr, "Initializing GnuTLS\n");
511
ret = gnutls_global_init();
512
if(ret != GNUTLS_E_SUCCESS){
513
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
514
safer_gnutls_strerror(ret));
257
if ((ret = gnutls_global_init ())
258
!= GNUTLS_E_SUCCESS) {
259
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
519
/* "Use a log level over 10 to enable all debugging options."
522
264
gnutls_global_set_log_level(11);
523
265
gnutls_global_set_log_function(debuggnutls);
526
/* OpenPGP credentials */
527
ret = gnutls_certificate_allocate_credentials(&mc->cred);
528
if(ret != GNUTLS_E_SUCCESS){
529
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
530
safer_gnutls_strerror(ret));
531
gnutls_global_deinit();
268
/* openpgp credentials */
269
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
270
!= GNUTLS_E_SUCCESS) {
271
fprintf (stderr, "memory error: %s\n",
272
safer_gnutls_strerror(ret));
536
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
537
" secret key %s as GnuTLS credentials\n",
277
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
278
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
542
282
ret = gnutls_certificate_set_openpgp_key_file
543
(mc->cred, pubkeyfilename, seckeyfilename,
544
GNUTLS_OPENPGP_FMT_BASE64);
545
if(ret != GNUTLS_E_SUCCESS){
547
"Error[%d] while reading the OpenPGP key pair ('%s',"
548
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
549
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
550
safer_gnutls_strerror(ret));
554
/* GnuTLS server initialization */
555
ret = gnutls_dh_params_init(&mc->dh_params);
556
if(ret != GNUTLS_E_SUCCESS){
557
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
558
" initialization: %s\n",
559
safer_gnutls_strerror(ret));
562
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
563
if(ret != GNUTLS_E_SUCCESS){
564
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
565
safer_gnutls_strerror(ret));
569
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
575
gnutls_certificate_free_credentials(mc->cred);
576
gnutls_global_deinit();
577
gnutls_dh_params_deinit(mc->dh_params);
581
__attribute__((nonnull, warn_unused_result))
582
static int init_gnutls_session(gnutls_session_t *session,
585
/* GnuTLS session creation */
587
ret = gnutls_init(session, GNUTLS_SERVER);
591
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
592
if(ret != GNUTLS_E_SUCCESS){
594
"Error in GnuTLS session initialization: %s\n",
595
safer_gnutls_strerror(ret));
601
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
603
gnutls_deinit(*session);
606
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
607
if(ret != GNUTLS_E_SUCCESS){
608
fprintf_plus(stderr, "Syntax error at: %s\n", err);
609
fprintf_plus(stderr, "GnuTLS error: %s\n",
610
safer_gnutls_strerror(ret));
611
gnutls_deinit(*session);
617
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
620
gnutls_deinit(*session);
623
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
624
if(ret != GNUTLS_E_SUCCESS){
625
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
626
safer_gnutls_strerror(ret));
627
gnutls_deinit(*session);
283
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
284
if (ret != GNUTLS_E_SUCCESS) {
286
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
288
ret, CERTFILE, KEYFILE);
289
fprintf(stdout, "The Error is: %s\n",
290
safer_gnutls_strerror(ret));
294
//GnuTLS server initialization
295
if ((ret = gnutls_dh_params_init (&es->dh_params))
296
!= GNUTLS_E_SUCCESS) {
297
fprintf (stderr, "Error in dh parameter initialization: %s\n",
298
safer_gnutls_strerror(ret));
302
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
303
!= GNUTLS_E_SUCCESS) {
304
fprintf (stderr, "Error in prime generation: %s\n",
305
safer_gnutls_strerror(ret));
309
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
311
// GnuTLS session creation
312
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
313
!= GNUTLS_E_SUCCESS){
314
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
315
safer_gnutls_strerror(ret));
318
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
319
!= GNUTLS_E_SUCCESS) {
320
fprintf(stderr, "Syntax error at: %s\n", err);
321
fprintf(stderr, "GnuTLS error: %s\n",
322
safer_gnutls_strerror(ret));
326
if ((ret = gnutls_credentials_set
327
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
328
!= GNUTLS_E_SUCCESS) {
329
fprintf(stderr, "Error setting a credentials set: %s\n",
330
safer_gnutls_strerror(ret));
631
334
/* ignore client certificate if any. */
632
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
335
gnutls_certificate_server_set_request (es->session,
634
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
338
gnutls_dh_set_prime_bits (es->session, DH_BITS);
639
/* Avahi log function callback */
640
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
641
__attribute__((unused)) const char *txt){}
343
void empty_log(__attribute__((unused)) AvahiLogLevel level,
344
__attribute__((unused)) const char *txt){}
643
/* Called when a Mandos server is found */
644
__attribute__((nonnull, warn_unused_result))
645
static int start_mandos_communication(const char *ip, in_port_t port,
646
AvahiIfIndex if_index,
647
int af, mandos_context *mc){
648
int ret, tcp_sd = -1;
650
struct sockaddr_storage to;
346
int start_mandos_communication(const char *ip, uint16_t port,
347
unsigned int if_index){
349
struct sockaddr_in6 to;
350
encrypted_session es;
651
351
char *buffer = NULL;
652
char *decrypted_buffer = NULL;
352
char *decrypted_buffer;
653
353
size_t buffer_length = 0;
654
354
size_t buffer_capacity = 0;
657
gnutls_session_t session;
658
int pf; /* Protocol family */
675
fprintf_plus(stderr, "Bad address family: %d\n", af);
680
/* If the interface is specified and we have a list of interfaces */
681
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
682
/* Check if the interface is one of the interfaces we are using */
685
char *interface = NULL;
686
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
688
if(if_nametoindex(interface) == (unsigned int)if_index){
695
/* This interface does not match any in the list, so we don't
696
connect to the server */
698
char interface[IF_NAMESIZE];
699
if(if_indextoname((unsigned int)if_index, interface) == NULL){
700
perror_plus("if_indextoname");
702
fprintf_plus(stderr, "Skipping server on non-used interface"
704
if_indextoname((unsigned int)if_index,
712
ret = init_gnutls_session(&session, mc);
718
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
719
PRIuMAX "\n", ip, (uintmax_t)port);
722
tcp_sd = socket(pf, SOCK_STREAM, 0);
725
perror_plus("socket");
735
memset(&to, 0, sizeof(to));
737
((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;
738
ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);
740
((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;
741
ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);
745
perror_plus("inet_pton");
355
ssize_t decrypted_buffer_size;
358
char interface[IF_NAMESIZE];
361
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
364
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
370
if(if_indextoname(if_index, interface) == NULL){
372
perror("if_indextoname");
378
fprintf(stderr, "Binding to interface %s\n", interface);
381
memset(&to,0,sizeof(to)); /* Spurious warning */
382
to.sin6_family = AF_INET6;
383
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
751
fprintf_plus(stderr, "Bad address: %s\n", ip);
756
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
757
if(IN6_IS_ADDR_LINKLOCAL
758
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
759
if(if_index == AVAHI_IF_UNSPEC){
760
fprintf_plus(stderr, "An IPv6 link-local address is"
761
" incomplete without a network interface\n");
765
/* Set the network interface number as scope */
766
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
769
((struct sockaddr_in *)&to)->sin_port = htons(port);
778
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
779
char interface[IF_NAMESIZE];
780
if(if_indextoname((unsigned int)if_index, interface) == NULL){
781
perror_plus("if_indextoname");
783
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
784
"\n", ip, interface, (uintmax_t)port);
787
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
788
ip, (uintmax_t)port);
790
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
791
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
793
ret = getnameinfo((struct sockaddr *)&to,
794
sizeof(struct sockaddr_in6),
795
addrstr, sizeof(addrstr), NULL, 0,
798
ret = getnameinfo((struct sockaddr *)&to,
799
sizeof(struct sockaddr_in),
800
addrstr, sizeof(addrstr), NULL, 0,
803
if(ret == EAI_SYSTEM){
804
perror_plus("getnameinfo");
805
} else if(ret != 0) {
806
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
807
} else if(strcmp(addrstr, ip) != 0){
808
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
818
ret = connect(tcp_sd, (struct sockaddr *)&to,
819
sizeof(struct sockaddr_in6));
821
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
822
sizeof(struct sockaddr_in));
825
if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
827
perror_plus("connect");
838
const char *out = mandos_protocol_version;
841
size_t out_size = strlen(out);
842
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
843
out_size - written));
846
perror_plus("write");
850
written += (size_t)ret;
851
if(written < out_size){
854
if(out == mandos_protocol_version){
869
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
877
/* This casting via intptr_t is to eliminate warning about casting
878
an int to a pointer type. This is exactly how the GnuTLS Guile
879
function "set-session-transport-fd!" does it. */
880
gnutls_transport_set_ptr(session,
881
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
889
ret = gnutls_handshake(session);
894
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
896
if(ret != GNUTLS_E_SUCCESS){
389
fprintf(stderr, "Bad address: %s\n", ip);
392
to.sin6_port = htons(port); /* Spurious warning */
394
to.sin6_scope_id = (uint32_t)if_index;
397
fprintf(stderr, "Connection to: %s\n", ip);
400
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
406
ret = initgnutls (&es);
412
gnutls_transport_set_ptr (es.session,
413
(gnutls_transport_ptr_t) tcp_sd);
416
fprintf(stderr, "Establishing TLS session with %s\n", ip);
419
ret = gnutls_handshake (es.session);
421
if (ret != GNUTLS_E_SUCCESS){
898
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
423
fprintf(stderr, "\n*** Handshake failed ***\n");
905
/* Read OpenPGP packet that contains the wanted password */
430
//Retrieve OpenPGP packet that contains the wanted password
908
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
433
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
919
buffer_capacity = incbuffer(&buffer, buffer_length,
921
if(buffer_capacity == 0){
923
perror_plus("incbuffer");
933
sret = gnutls_record_recv(session, buffer+buffer_length,
438
if (buffer_length + BUFFER_SIZE > buffer_capacity){
439
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
444
buffer_capacity += BUFFER_SIZE;
447
ret = gnutls_record_recv
448
(es.session, buffer+buffer_length, BUFFER_SIZE);
940
454
case GNUTLS_E_INTERRUPTED:
941
455
case GNUTLS_E_AGAIN:
943
457
case GNUTLS_E_REHANDSHAKE:
945
ret = gnutls_handshake(session);
951
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
953
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
458
ret = gnutls_handshake (es.session);
460
fprintf(stderr, "\n*** Handshake failed ***\n");
961
fprintf_plus(stderr, "Unknown error while reading data from"
962
" encrypted session with Mandos server\n");
963
gnutls_bye(session, GNUTLS_SHUT_RDWR);
467
fprintf(stderr, "Unknown error while reading data from"
468
" encrypted session with mandos server\n");
470
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
968
buffer_length += (size_t) sret;
973
fprintf_plus(stderr, "Closing TLS session\n");
982
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
987
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
989
if(buffer_length > 0){
990
ssize_t decrypted_buffer_size;
991
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
992
&decrypted_buffer, mc);
993
if(decrypted_buffer_size >= 0){
996
while(written < (size_t) decrypted_buffer_size){
1002
ret = (int)fwrite(decrypted_buffer + written, 1,
1003
(size_t)decrypted_buffer_size - written,
474
buffer_length += (size_t) ret;
478
if (buffer_length > 0){
479
decrypted_buffer_size = pgp_packet_decrypt(buffer,
483
if (decrypted_buffer_size >= 0){
484
while(written < decrypted_buffer_size){
485
ret = (int)fwrite (decrypted_buffer + written, 1,
486
(size_t)decrypted_buffer_size - written,
1005
488
if(ret == 0 and ferror(stdout)){
1008
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
490
fprintf(stderr, "Error writing encrypted data: %s\n",
1014
496
written += (size_t)ret;
1020
/* Shutdown procedure */
1025
free(decrypted_buffer);
1028
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
1034
perror_plus("close");
1036
gnutls_deinit(session);
498
free(decrypted_buffer);
507
fprintf(stderr, "Closing TLS session\n");
511
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
514
gnutls_deinit (es.session);
515
gnutls_certificate_free_credentials (es.cred);
516
gnutls_global_deinit ();
1046
__attribute__((nonnull))
1047
static void resolve_callback(AvahiSServiceResolver *r,
1048
AvahiIfIndex interface,
1049
AvahiProtocol proto,
1050
AvahiResolverEvent event,
1054
const char *host_name,
1055
const AvahiAddress *address,
1057
AVAHI_GCC_UNUSED AvahiStringList *txt,
1058
AVAHI_GCC_UNUSED AvahiLookupResultFlags
520
static AvahiSimplePoll *simple_poll = NULL;
521
static AvahiServer *server = NULL;
523
static void resolve_callback(
524
AvahiSServiceResolver *r,
525
AvahiIfIndex interface,
526
AVAHI_GCC_UNUSED AvahiProtocol protocol,
527
AvahiResolverEvent event,
531
const char *host_name,
532
const AvahiAddress *address,
534
AVAHI_GCC_UNUSED AvahiStringList *txt,
535
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
536
AVAHI_GCC_UNUSED void* userdata) {
538
assert(r); /* Spurious warning */
1065
540
/* Called whenever a service has been resolved successfully or
1074
545
case AVAHI_RESOLVER_FAILURE:
1075
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1076
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1078
avahi_strerror(avahi_server_errno
1079
(((mandos_context*)mc)->server)));
546
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
547
" type '%s' in domain '%s': %s\n", name, type, domain,
548
avahi_strerror(avahi_server_errno(server)));
1082
551
case AVAHI_RESOLVER_FOUND:
1084
553
char ip[AVAHI_ADDRESS_STR_MAX];
1085
554
avahi_address_snprint(ip, sizeof(ip), address);
1087
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1088
PRIdMAX ") on port %" PRIu16 "\n", name,
1089
host_name, ip, (intmax_t)interface, port);
556
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
557
" port %d\n", name, host_name, ip, port);
1091
int ret = start_mandos_communication(ip, (in_port_t)port,
1093
avahi_proto_to_af(proto),
1096
avahi_simple_poll_quit(simple_poll);
1098
if(not add_server(ip, (in_port_t)port, interface,
1099
avahi_proto_to_af(proto),
1100
&((mandos_context*)mc)->current_server)){
1101
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
559
int ret = start_mandos_communication(ip, port,
560
(unsigned int) interface);
1107
566
avahi_s_service_resolver_free(r);
1110
static void browse_callback(AvahiSServiceBrowser *b,
1111
AvahiIfIndex interface,
1112
AvahiProtocol protocol,
1113
AvahiBrowserEvent event,
1117
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1124
/* Called whenever a new services becomes available on the LAN or
1125
is removed from the LAN */
1133
case AVAHI_BROWSER_FAILURE:
1135
fprintf_plus(stderr, "(Avahi browser) %s\n",
1136
avahi_strerror(avahi_server_errno
1137
(((mandos_context*)mc)->server)));
1138
avahi_simple_poll_quit(simple_poll);
1141
case AVAHI_BROWSER_NEW:
1142
/* We ignore the returned Avahi resolver object. In the callback
1143
function we free it. If the Avahi server is terminated before
1144
the callback function is called the Avahi server will free the
1147
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1148
interface, protocol, name, type,
1149
domain, protocol, 0,
1150
resolve_callback, mc) == NULL)
1151
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1153
avahi_strerror(avahi_server_errno
1154
(((mandos_context*)mc)->server)));
1157
case AVAHI_BROWSER_REMOVE:
1160
case AVAHI_BROWSER_ALL_FOR_NOW:
1161
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1163
fprintf_plus(stderr, "No Mandos server found, still"
1170
/* Signal handler that stops main loop after SIGTERM */
1171
static void handle_sigterm(int sig){
1176
signal_received = sig;
1177
int old_errno = errno;
1178
/* set main loop to exit */
1179
if(simple_poll != NULL){
1180
avahi_simple_poll_quit(simple_poll);
1185
__attribute__((nonnull, warn_unused_result))
1186
bool get_flags(const char *ifname, struct ifreq *ifr){
1190
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1193
perror_plus("socket");
1197
strcpy(ifr->ifr_name, ifname);
1198
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1202
perror_plus("ioctl SIOCGIFFLAGS");
1210
__attribute__((nonnull, warn_unused_result))
1211
bool good_flags(const char *ifname, const struct ifreq *ifr){
1213
/* Reject the loopback device */
1214
if(ifr->ifr_flags & IFF_LOOPBACK){
1216
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1221
/* Accept point-to-point devices only if connect_to is specified */
1222
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1224
fprintf_plus(stderr, "Accepting point-to-point interface"
1225
" \"%s\"\n", ifname);
1229
/* Otherwise, reject non-broadcast-capable devices */
1230
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1232
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1233
" \"%s\"\n", ifname);
1237
/* Reject non-ARP interfaces (including dummy interfaces) */
1238
if(ifr->ifr_flags & IFF_NOARP){
1240
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1246
/* Accept this device */
1248
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1254
* This function determines if a directory entry in /sys/class/net
1255
* corresponds to an acceptable network device.
1256
* (This function is passed to scandir(3) as a filter function.)
1258
__attribute__((nonnull, warn_unused_result))
1259
int good_interface(const struct dirent *if_entry){
1260
if(if_entry->d_name[0] == '.'){
1265
if(not get_flags(if_entry->d_name, &ifr)){
1267
fprintf_plus(stderr, "Failed to get flags for interface "
1268
"\"%s\"\n", if_entry->d_name);
1273
if(not good_flags(if_entry->d_name, &ifr)){
1280
* This function determines if a network interface is up.
1282
__attribute__((nonnull, warn_unused_result))
1283
bool interface_is_up(const char *interface){
1285
if(not get_flags(interface, &ifr)){
1287
fprintf_plus(stderr, "Failed to get flags for interface "
1288
"\"%s\"\n", interface);
1293
return (bool)(ifr.ifr_flags & IFF_UP);
1297
* This function determines if a network interface is running
1299
__attribute__((nonnull, warn_unused_result))
1300
bool interface_is_running(const char *interface){
1302
if(not get_flags(interface, &ifr)){
1304
fprintf_plus(stderr, "Failed to get flags for interface "
1305
"\"%s\"\n", interface);
1310
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1313
__attribute__((nonnull, pure, warn_unused_result))
1314
int notdotentries(const struct dirent *direntry){
1315
/* Skip "." and ".." */
1316
if(direntry->d_name[0] == '.'
1317
and (direntry->d_name[1] == '\0'
1318
or (direntry->d_name[1] == '.'
1319
and direntry->d_name[2] == '\0'))){
1325
/* Is this directory entry a runnable program? */
1326
__attribute__((nonnull, warn_unused_result))
1327
int runnable_hook(const struct dirent *direntry){
1332
if((direntry->d_name)[0] == '\0'){
1337
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1338
"abcdefghijklmnopqrstuvwxyz"
1341
if((direntry->d_name)[sret] != '\0'){
1342
/* Contains non-allowed characters */
1344
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1350
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1353
perror_plus("Could not stat hook");
1357
if(not (S_ISREG(st.st_mode))){
1358
/* Not a regular file */
1360
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1365
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1366
/* Not executable */
1368
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1374
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1380
__attribute__((nonnull, warn_unused_result))
1381
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1382
mandos_context *mc){
1384
struct timespec now;
1385
struct timespec waited_time;
1386
intmax_t block_time;
1389
if(mc->current_server == NULL){
1391
fprintf_plus(stderr, "Wait until first server is found."
1394
ret = avahi_simple_poll_iterate(s, -1);
1397
fprintf_plus(stderr, "Check current_server if we should run"
1400
/* the current time */
1401
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1403
perror_plus("clock_gettime");
1406
/* Calculating in ms how long time between now and server
1407
who we visted longest time ago. Now - last seen. */
1408
waited_time.tv_sec = (now.tv_sec
1409
- mc->current_server->last_seen.tv_sec);
1410
waited_time.tv_nsec = (now.tv_nsec
1411
- mc->current_server->last_seen.tv_nsec);
1412
/* total time is 10s/10,000ms.
1413
Converting to s from ms by dividing by 1,000,
1414
and ns to ms by dividing by 1,000,000. */
1415
block_time = ((retry_interval
1416
- ((intmax_t)waited_time.tv_sec * 1000))
1417
- ((intmax_t)waited_time.tv_nsec / 1000000));
1420
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1424
if(block_time <= 0){
1425
ret = start_mandos_communication(mc->current_server->ip,
1426
mc->current_server->port,
1427
mc->current_server->if_index,
1428
mc->current_server->af, mc);
1430
avahi_simple_poll_quit(s);
1433
ret = clock_gettime(CLOCK_MONOTONIC,
1434
&mc->current_server->last_seen);
1436
perror_plus("clock_gettime");
1439
mc->current_server = mc->current_server->next;
1440
block_time = 0; /* Call avahi to find new Mandos
1441
servers, but don't block */
1444
ret = avahi_simple_poll_iterate(s, (int)block_time);
1447
if(ret > 0 or errno != EINTR){
1448
return (ret != 1) ? ret : 0;
1454
/* Set effective uid to 0, return errno */
1455
__attribute__((warn_unused_result))
1456
error_t raise_privileges(void){
1457
error_t old_errno = errno;
1458
error_t ret_errno = 0;
1459
if(seteuid(0) == -1){
1461
perror_plus("seteuid");
1467
/* Set effective and real user ID to 0. Return errno. */
1468
__attribute__((warn_unused_result))
1469
error_t raise_privileges_permanently(void){
1470
error_t old_errno = errno;
1471
error_t ret_errno = raise_privileges();
1476
if(setuid(0) == -1){
1478
perror_plus("seteuid");
1484
/* Set effective user ID to unprivileged saved user ID */
1485
__attribute__((warn_unused_result))
1486
error_t lower_privileges(void){
1487
error_t old_errno = errno;
1488
error_t ret_errno = 0;
1489
if(seteuid(uid) == -1){
1491
perror_plus("seteuid");
1497
/* Lower privileges permanently */
1498
__attribute__((warn_unused_result))
1499
error_t lower_privileges_permanently(void){
1500
error_t old_errno = errno;
1501
error_t ret_errno = 0;
1502
if(setuid(uid) == -1){
1504
perror_plus("setuid");
1512
* Based on the example in the GNU LibC manual chapter 13.13 "File
1513
* Descriptor Flags".
1514
| [[info:libc:Descriptor%20Flags][File Descriptor Flags]] |
1516
__attribute__((warn_unused_result))
1517
static int set_cloexec_flag(int fd){
1518
int ret = (int)TEMP_FAILURE_RETRY(fcntl(fd, F_GETFD, 0));
1519
/* If reading the flags failed, return error indication now. */
1523
/* Store modified flag word in the descriptor. */
1524
return (int)TEMP_FAILURE_RETRY(fcntl(fd, F_SETFD,
1527
#endif /* not O_CLOEXEC */
1529
__attribute__((nonnull))
1530
void run_network_hooks(const char *mode, const char *interface,
1532
struct dirent **direntries;
1533
if(hookdir_fd == -1){
1534
hookdir_fd = open(hookdir, O_RDONLY |
1537
#else /* not O_CLOEXEC */
1539
#endif /* not O_CLOEXEC */
1541
if(hookdir_fd == -1){
1542
if(errno == ENOENT){
1544
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1545
" found\n", hookdir);
1548
perror_plus("open");
1553
if(set_cloexec_flag(hookdir_fd) < 0){
1554
perror_plus("set_cloexec_flag");
1555
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1556
perror_plus("close");
1562
#endif /* not O_CLOEXEC */
1565
#if __GLIBC_PREREQ(2, 15)
1566
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1567
runnable_hook, alphasort);
1568
#else /* not __GLIBC_PREREQ(2, 15) */
1569
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1571
#endif /* not __GLIBC_PREREQ(2, 15) */
1572
#else /* not __GLIBC__ */
1573
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1575
#endif /* not __GLIBC__ */
1577
perror_plus("scandir");
1580
struct dirent *direntry;
1582
int devnull = open("/dev/null", O_RDONLY);
1583
for(int i = 0; i < numhooks; i++){
1584
direntry = direntries[i];
1586
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1589
pid_t hook_pid = fork();
1592
/* Raise privileges */
1593
if(raise_privileges_permanently() != 0){
1594
perror_plus("Failed to raise privileges");
1601
perror_plus("setgid");
1604
/* Reset supplementary groups */
1606
ret = setgroups(0, NULL);
1608
perror_plus("setgroups");
1611
ret = dup2(devnull, STDIN_FILENO);
1613
perror_plus("dup2(devnull, STDIN_FILENO)");
1616
ret = close(devnull);
1618
perror_plus("close");
1621
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1623
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1626
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1628
perror_plus("setenv");
1631
ret = setenv("DEVICE", interface, 1);
1633
perror_plus("setenv");
1636
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1638
perror_plus("setenv");
1641
ret = setenv("MODE", mode, 1);
1643
perror_plus("setenv");
1647
ret = asprintf(&delaystring, "%f", (double)delay);
1649
perror_plus("asprintf");
1652
ret = setenv("DELAY", delaystring, 1);
1655
perror_plus("setenv");
1659
if(connect_to != NULL){
1660
ret = setenv("CONNECT", connect_to, 1);
1662
perror_plus("setenv");
1666
if(fexecve(hookdir_fd, (char *const [])
1667
{ direntry->d_name, NULL }, environ) == -1){
1668
perror_plus("fexecve");
1669
_exit(EXIT_FAILURE);
1673
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1674
perror_plus("waitpid");
1677
if(WIFEXITED(status)){
1678
if(WEXITSTATUS(status) != 0){
1679
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1680
" with status %d\n", direntry->d_name,
1681
WEXITSTATUS(status));
1684
} else if(WIFSIGNALED(status)){
1685
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1686
" signal %d\n", direntry->d_name,
1690
fprintf_plus(stderr, "Warning: network hook \"%s\""
1691
" crashed\n", direntry->d_name);
1696
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1700
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1701
perror_plus("close");
1708
__attribute__((nonnull, warn_unused_result))
1709
error_t bring_up_interface(const char *const interface,
1711
error_t old_errno = errno;
1713
struct ifreq network;
1714
unsigned int if_index = if_nametoindex(interface);
1716
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1726
if(not interface_is_up(interface)){
1727
error_t ret_errno = 0, ioctl_errno = 0;
1728
if(not get_flags(interface, &network)){
1730
fprintf_plus(stderr, "Failed to get flags for interface "
1731
"\"%s\"\n", interface);
1735
network.ifr_flags |= IFF_UP; /* set flag */
1737
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1740
perror_plus("socket");
1746
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1748
perror_plus("close");
1755
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
1759
/* Raise privileges */
1760
ret_errno = raise_privileges();
1762
perror_plus("Failed to raise privileges");
1767
bool restore_loglevel = false;
1769
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1770
messages about the network interface to mess up the prompt */
1771
ret_linux = klogctl(8, NULL, 5);
1772
if(ret_linux == -1){
1773
perror_plus("klogctl");
1775
restore_loglevel = true;
1778
#endif /* __linux__ */
1779
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1780
ioctl_errno = errno;
1782
if(restore_loglevel){
1783
ret_linux = klogctl(7, NULL, 0);
1784
if(ret_linux == -1){
1785
perror_plus("klogctl");
1788
#endif /* __linux__ */
1790
/* If raise_privileges() succeeded above */
1792
/* Lower privileges */
1793
ret_errno = lower_privileges();
1796
perror_plus("Failed to lower privileges");
1800
/* Close the socket */
1801
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1803
perror_plus("close");
1806
if(ret_setflags == -1){
1807
errno = ioctl_errno;
1808
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1813
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1817
/* Sleep checking until interface is running.
1818
Check every 0.25s, up to total time of delay */
1819
for(int i=0; i < delay * 4; i++){
1820
if(interface_is_running(interface)){
1823
struct timespec sleeptime = { .tv_nsec = 250000000 };
1824
ret = nanosleep(&sleeptime, NULL);
1825
if(ret == -1 and errno != EINTR){
1826
perror_plus("nanosleep");
1834
__attribute__((nonnull, warn_unused_result))
1835
error_t take_down_interface(const char *const interface){
1836
error_t old_errno = errno;
1837
struct ifreq network;
1838
unsigned int if_index = if_nametoindex(interface);
1840
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1844
if(interface_is_up(interface)){
1845
error_t ret_errno = 0, ioctl_errno = 0;
1846
if(not get_flags(interface, &network) and debug){
1848
fprintf_plus(stderr, "Failed to get flags for interface "
1849
"\"%s\"\n", interface);
1853
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1855
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1858
perror_plus("socket");
1864
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
1868
/* Raise privileges */
1869
ret_errno = raise_privileges();
1871
perror_plus("Failed to raise privileges");
1874
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1875
ioctl_errno = errno;
1877
/* If raise_privileges() succeeded above */
1879
/* Lower privileges */
1880
ret_errno = lower_privileges();
1883
perror_plus("Failed to lower privileges");
1887
/* Close the socket */
1888
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1890
perror_plus("close");
1893
if(ret_setflags == -1){
1894
errno = ioctl_errno;
1895
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1900
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1908
int main(int argc, char *argv[]){
1909
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1910
.priority = "SECURE256:!CTYPE-X.509:"
1911
"+CTYPE-OPENPGP", .current_server = NULL,
1912
.interfaces = NULL, .interfaces_size = 0 };
1913
AvahiSServiceBrowser *sb = NULL;
1918
int exitcode = EXIT_SUCCESS;
1919
char *interfaces_to_take_down = NULL;
1920
size_t interfaces_to_take_down_size = 0;
1921
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
1922
char old_tempdir[] = "/tmp/mandosXXXXXX";
1923
char *tempdir = NULL;
1924
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1925
const char *seckey = PATHDIR "/" SECKEY;
1926
const char *pubkey = PATHDIR "/" PUBKEY;
1927
char *interfaces_hooks = NULL;
1929
bool gnutls_initialized = false;
1930
bool gpgme_initialized = false;
1932
double retry_interval = 10; /* 10s between trying a server and
1933
retrying the same server again */
1935
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1936
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1941
/* Lower any group privileges we might have, just to be safe */
1945
perror_plus("setgid");
1948
/* Lower user privileges (temporarily) */
1952
perror_plus("seteuid");
1960
struct argp_option options[] = {
1961
{ .name = "debug", .key = 128,
1962
.doc = "Debug mode", .group = 3 },
1963
{ .name = "connect", .key = 'c',
1964
.arg = "ADDRESS:PORT",
1965
.doc = "Connect directly to a specific Mandos server",
1967
{ .name = "interface", .key = 'i',
1969
.doc = "Network interface that will be used to search for"
1972
{ .name = "seckey", .key = 's',
1974
.doc = "OpenPGP secret key file base name",
1976
{ .name = "pubkey", .key = 'p',
1978
.doc = "OpenPGP public key file base name",
1980
{ .name = "dh-bits", .key = 129,
1982
.doc = "Bit length of the prime number used in the"
1983
" Diffie-Hellman key exchange",
1985
{ .name = "priority", .key = 130,
1987
.doc = "GnuTLS priority string for the TLS handshake",
1989
{ .name = "delay", .key = 131,
1991
.doc = "Maximum delay to wait for interface startup",
1993
{ .name = "retry", .key = 132,
1995
.doc = "Retry interval used when denied by the Mandos server",
1997
{ .name = "network-hook-dir", .key = 133,
1999
.doc = "Directory where network hooks are located",
2002
* These reproduce what we would get without ARGP_NO_HELP
2004
{ .name = "help", .key = '?',
2005
.doc = "Give this help list", .group = -1 },
2006
{ .name = "usage", .key = -3,
2007
.doc = "Give a short usage message", .group = -1 },
2008
{ .name = "version", .key = 'V',
2009
.doc = "Print program version", .group = -1 },
2013
error_t parse_opt(int key, char *arg,
2014
struct argp_state *state){
2017
case 128: /* --debug */
2020
case 'c': /* --connect */
2023
case 'i': /* --interface */
2024
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
2027
argp_error(state, "%s", strerror(ret_errno));
2030
case 's': /* --seckey */
2033
case 'p': /* --pubkey */
2036
case 129: /* --dh-bits */
2038
tmpmax = strtoimax(arg, &tmp, 10);
2039
if(errno != 0 or tmp == arg or *tmp != '\0'
2040
or tmpmax != (typeof(mc.dh_bits))tmpmax){
2041
argp_error(state, "Bad number of DH bits");
2043
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
2045
case 130: /* --priority */
2048
case 131: /* --delay */
2050
delay = strtof(arg, &tmp);
2051
if(errno != 0 or tmp == arg or *tmp != '\0'){
2052
argp_error(state, "Bad delay");
2054
case 132: /* --retry */
2056
retry_interval = strtod(arg, &tmp);
2057
if(errno != 0 or tmp == arg or *tmp != '\0'
2058
or (retry_interval * 1000) > INT_MAX
2059
or retry_interval < 0){
2060
argp_error(state, "Bad retry interval");
2063
case 133: /* --network-hook-dir */
2067
* These reproduce what we would get without ARGP_NO_HELP
2069
case '?': /* --help */
2070
argp_state_help(state, state->out_stream,
2071
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
2072
& ~(unsigned int)ARGP_HELP_EXIT_OK);
2073
case -3: /* --usage */
2074
argp_state_help(state, state->out_stream,
2075
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
2076
case 'V': /* --version */
2077
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
2078
exit(argp_err_exit_status);
2081
return ARGP_ERR_UNKNOWN;
2086
struct argp argp = { .options = options, .parser = parse_opt,
2088
.doc = "Mandos client -- Get and decrypt"
2089
" passwords from a Mandos server" };
2090
ret = argp_parse(&argp, argc, argv,
2091
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
569
static void browse_callback(
570
AvahiSServiceBrowser *b,
571
AvahiIfIndex interface,
572
AvahiProtocol protocol,
573
AvahiBrowserEvent event,
577
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
580
AvahiServer *s = userdata;
581
assert(b); /* Spurious warning */
583
/* Called whenever a new services becomes available on the LAN or
584
is removed from the LAN */
2098
perror_plus("argp_parse");
2099
exitcode = EX_OSERR;
2102
exitcode = EX_USAGE;
2108
/* Work around Debian bug #633582:
2109
<http://bugs.debian.org/633582> */
2111
/* Re-raise privileges */
2112
ret_errno = raise_privileges();
2115
perror_plus("Failed to raise privileges");
2119
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2120
int seckey_fd = open(seckey, O_RDONLY);
2121
if(seckey_fd == -1){
2122
perror_plus("open");
2124
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
2126
perror_plus("fstat");
2128
if(S_ISREG(st.st_mode)
2129
and st.st_uid == 0 and st.st_gid == 0){
2130
ret = fchown(seckey_fd, uid, gid);
2132
perror_plus("fchown");
2136
TEMP_FAILURE_RETRY(close(seckey_fd));
2140
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
2141
int pubkey_fd = open(pubkey, O_RDONLY);
2142
if(pubkey_fd == -1){
2143
perror_plus("open");
2145
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
2147
perror_plus("fstat");
2149
if(S_ISREG(st.st_mode)
2150
and st.st_uid == 0 and st.st_gid == 0){
2151
ret = fchown(pubkey_fd, uid, gid);
2153
perror_plus("fchown");
2157
TEMP_FAILURE_RETRY(close(pubkey_fd));
2161
/* Lower privileges */
2162
ret_errno = lower_privileges();
2165
perror_plus("Failed to lower privileges");
2170
/* Remove invalid interface names (except "none") */
2172
char *interface = NULL;
2173
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2175
if(strcmp(interface, "none") != 0
2176
and if_nametoindex(interface) == 0){
2177
if(interface[0] != '\0'){
2178
fprintf_plus(stderr, "Not using nonexisting interface"
2179
" \"%s\"\n", interface);
2181
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2187
/* Run network hooks */
2189
if(mc.interfaces != NULL){
2190
interfaces_hooks = malloc(mc.interfaces_size);
2191
if(interfaces_hooks == NULL){
2192
perror_plus("malloc");
2195
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2196
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2198
run_network_hooks("start", interfaces_hooks != NULL ?
2199
interfaces_hooks : "", delay);
2203
avahi_set_log_function(empty_log);
2206
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
2207
from the signal handler */
2208
/* Initialize the pseudo-RNG for Avahi */
2209
srand((unsigned int) time(NULL));
2210
simple_poll = avahi_simple_poll_new();
2211
if(simple_poll == NULL){
2212
fprintf_plus(stderr,
2213
"Avahi: Failed to create simple poll object.\n");
2214
exitcode = EX_UNAVAILABLE;
2218
sigemptyset(&sigterm_action.sa_mask);
2219
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
2221
perror_plus("sigaddset");
2222
exitcode = EX_OSERR;
2225
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
2227
perror_plus("sigaddset");
2228
exitcode = EX_OSERR;
2231
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
2233
perror_plus("sigaddset");
2234
exitcode = EX_OSERR;
2237
/* Need to check if the handler is SIG_IGN before handling:
2238
| [[info:libc:Initial Signal Actions]] |
2239
| [[info:libc:Basic Signal Handling]] |
2241
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
2243
perror_plus("sigaction");
2246
if(old_sigterm_action.sa_handler != SIG_IGN){
2247
ret = sigaction(SIGINT, &sigterm_action, NULL);
2249
perror_plus("sigaction");
2250
exitcode = EX_OSERR;
2254
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
2256
perror_plus("sigaction");
2259
if(old_sigterm_action.sa_handler != SIG_IGN){
2260
ret = sigaction(SIGHUP, &sigterm_action, NULL);
2262
perror_plus("sigaction");
2263
exitcode = EX_OSERR;
2267
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
2269
perror_plus("sigaction");
2272
if(old_sigterm_action.sa_handler != SIG_IGN){
2273
ret = sigaction(SIGTERM, &sigterm_action, NULL);
2275
perror_plus("sigaction");
2276
exitcode = EX_OSERR;
2281
/* If no interfaces were specified, make a list */
2282
if(mc.interfaces == NULL){
2283
struct dirent **direntries;
2284
/* Look for any good interfaces */
2285
ret = scandir(sys_class_net, &direntries, good_interface,
2288
/* Add all found interfaces to interfaces list */
2289
for(int i = 0; i < ret; ++i){
2290
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2291
direntries[i]->d_name);
2294
perror_plus("argz_add");
2298
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2299
direntries[i]->d_name);
2305
fprintf_plus(stderr, "Could not find a network interface\n");
2306
exitcode = EXIT_FAILURE;
2311
/* Bring up interfaces which are down, and remove any "none"s */
2313
char *interface = NULL;
2314
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2316
/* If interface name is "none", stop bringing up interfaces.
2317
Also remove all instances of "none" from the list */
2318
if(strcmp(interface, "none") == 0){
2319
argz_delete(&mc.interfaces, &mc.interfaces_size,
2322
while((interface = argz_next(mc.interfaces,
2323
mc.interfaces_size, interface))){
2324
if(strcmp(interface, "none") == 0){
2325
argz_delete(&mc.interfaces, &mc.interfaces_size,
2332
bool interface_was_up = interface_is_up(interface);
2333
errno = bring_up_interface(interface, delay);
2334
if(not interface_was_up){
2336
perror_plus("Failed to bring up interface");
2338
errno = argz_add(&interfaces_to_take_down,
2339
&interfaces_to_take_down_size,
2342
perror_plus("argz_add");
2347
if(debug and (interfaces_to_take_down == NULL)){
2348
fprintf_plus(stderr, "No interfaces were brought up\n");
2352
/* If we only got one interface, explicitly use only that one */
2353
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2355
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2358
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2365
ret = init_gnutls_global(pubkey, seckey, &mc);
2367
fprintf_plus(stderr, "init_gnutls_global failed\n");
2368
exitcode = EX_UNAVAILABLE;
2371
gnutls_initialized = true;
2378
/* Try /run/tmp before /tmp */
2379
tempdir = mkdtemp(run_tempdir);
2380
if(tempdir == NULL and errno == ENOENT){
2382
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2383
run_tempdir, old_tempdir);
2385
tempdir = mkdtemp(old_tempdir);
2387
if(tempdir == NULL){
2388
perror_plus("mkdtemp");
2396
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2397
fprintf_plus(stderr, "init_gpgme failed\n");
2398
exitcode = EX_UNAVAILABLE;
2401
gpgme_initialized = true;
2408
if(connect_to != NULL){
2409
/* Connect directly, do not use Zeroconf */
2410
/* (Mainly meant for debugging) */
2411
char *address = strrchr(connect_to, ':');
2413
if(address == NULL){
2414
fprintf_plus(stderr, "No colon in address\n");
2415
exitcode = EX_USAGE;
2425
tmpmax = strtoimax(address+1, &tmp, 10);
2426
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2427
or tmpmax != (in_port_t)tmpmax){
2428
fprintf_plus(stderr, "Bad port number\n");
2429
exitcode = EX_USAGE;
2437
port = (in_port_t)tmpmax;
2439
/* Colon in address indicates IPv6 */
2441
if(strchr(connect_to, ':') != NULL){
2443
/* Accept [] around IPv6 address - see RFC 5952 */
2444
if(connect_to[0] == '[' and address[-1] == ']')
2452
address = connect_to;
2458
while(not quit_now){
2459
ret = start_mandos_communication(address, port, if_index, af,
2461
if(quit_now or ret == 0){
2465
fprintf_plus(stderr, "Retrying in %d seconds\n",
2466
(int)retry_interval);
2468
sleep((unsigned int)retry_interval);
2472
exitcode = EXIT_SUCCESS;
588
case AVAHI_BROWSER_FAILURE:
590
fprintf(stderr, "(Browser) %s\n",
591
avahi_strerror(avahi_server_errno(server)));
592
avahi_simple_poll_quit(simple_poll);
595
case AVAHI_BROWSER_NEW:
596
/* We ignore the returned resolver object. In the callback
597
function we free it. If the server is terminated before
598
the callback function is called the server will free
599
the resolver for us. */
601
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
603
AVAHI_PROTO_INET6, 0,
604
resolve_callback, s)))
605
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
606
avahi_strerror(avahi_server_errno(s)));
609
case AVAHI_BROWSER_REMOVE:
612
case AVAHI_BROWSER_ALL_FOR_NOW:
613
case AVAHI_BROWSER_CACHE_EXHAUSTED:
618
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
2483
619
AvahiServerConfig config;
2484
/* Do not publish any local Zeroconf records */
620
AvahiSServiceBrowser *sb = NULL;
623
int returncode = EXIT_SUCCESS;
624
const char *interface = "eth0";
627
static struct option long_options[] = {
628
{"debug", no_argument, (int *)&debug, 1},
629
{"interface", required_argument, 0, 'i'},
632
int option_index = 0;
633
ret = getopt_long (argc, argv, "i:", long_options,
652
avahi_set_log_function(empty_log);
655
/* Initialize the psuedo-RNG */
656
srand((unsigned int) time(NULL));
658
/* Allocate main loop object */
659
if (!(simple_poll = avahi_simple_poll_new())) {
660
fprintf(stderr, "Failed to create simple poll object.\n");
665
/* Do not publish any local records */
2485
666
avahi_server_config_init(&config);
2486
667
config.publish_hinfo = 0;
2487
668
config.publish_addresses = 0;
2488
669
config.publish_workstation = 0;
2489
670
config.publish_domain = 0;
2491
672
/* Allocate a new server */
2492
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2493
&config, NULL, NULL, &ret_errno);
2495
/* Free the Avahi configuration data */
673
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
674
&config, NULL, NULL, &error);
676
/* Free the configuration data */
2496
677
avahi_server_config_free(&config);
2499
/* Check if creating the Avahi server object succeeded */
2500
if(mc.server == NULL){
2501
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2502
avahi_strerror(ret_errno));
2503
exitcode = EX_UNAVAILABLE;
2511
/* Create the Avahi service browser */
2512
sb = avahi_s_service_browser_new(mc.server, if_index,
2513
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2514
NULL, 0, browse_callback,
2517
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2518
avahi_strerror(avahi_server_errno(mc.server)));
2519
exitcode = EX_UNAVAILABLE;
2527
/* Run the main loop */
2530
fprintf_plus(stderr, "Starting Avahi loop search\n");
2533
ret = avahi_loop_with_timeout(simple_poll,
2534
(int)(retry_interval * 1000), &mc);
2536
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2537
(ret == 0) ? "successfully" : "with error");
2543
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2546
/* Cleanup things */
2547
free(mc.interfaces);
2550
avahi_s_service_browser_free(sb);
2552
if(mc.server != NULL)
2553
avahi_server_free(mc.server);
2555
if(simple_poll != NULL)
2556
avahi_simple_poll_free(simple_poll);
2558
if(gnutls_initialized){
2559
gnutls_certificate_free_credentials(mc.cred);
2560
gnutls_global_deinit();
2561
gnutls_dh_params_deinit(mc.dh_params);
2564
if(gpgme_initialized){
2565
gpgme_release(mc.ctx);
2568
/* Cleans up the circular linked list of Mandos servers the client
2570
if(mc.current_server != NULL){
2571
mc.current_server->prev->next = NULL;
2572
while(mc.current_server != NULL){
2573
server *next = mc.current_server->next;
2574
free(mc.current_server);
2575
mc.current_server = next;
2579
/* Re-raise privileges */
2581
ret_errno = raise_privileges();
2583
perror_plus("Failed to raise privileges");
2586
/* Run network hooks */
2587
run_network_hooks("stop", interfaces_hooks != NULL ?
2588
interfaces_hooks : "", delay);
2590
/* Take down the network interfaces which were brought up */
2592
char *interface = NULL;
2593
while((interface=argz_next(interfaces_to_take_down,
2594
interfaces_to_take_down_size,
2596
ret_errno = take_down_interface(interface);
2599
perror_plus("Failed to take down interface");
2602
if(debug and (interfaces_to_take_down == NULL)){
2603
fprintf_plus(stderr, "No interfaces needed to be taken"
2609
ret_errno = lower_privileges_permanently();
2611
perror_plus("Failed to lower privileges permanently");
2615
free(interfaces_to_take_down);
2616
free(interfaces_hooks);
2618
/* Removes the GPGME temp directory and all files inside */
2619
if(tempdir != NULL){
2620
struct dirent **direntries = NULL;
2621
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY));
2622
if(tempdir_fd == -1){
2623
perror_plus("open");
2625
int numentries = scandir(tempdir, &direntries, notdotentries,
2628
for(int i = 0; i < numentries; i++){
2629
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2631
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2632
" \"%s\", 0): %s\n", tempdir,
2633
direntries[i]->d_name, strerror(errno));
2637
/* need to clean even if 0 because man page doesn't specify */
2639
if(numentries == -1){
2640
perror_plus("scandir");
2642
ret = rmdir(tempdir);
2643
if(ret == -1 and errno != ENOENT){
2644
perror_plus("rmdir");
2647
TEMP_FAILURE_RETRY(close(tempdir_fd));
2652
sigemptyset(&old_sigterm_action.sa_mask);
2653
old_sigterm_action.sa_handler = SIG_DFL;
2654
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
2655
&old_sigterm_action,
2658
perror_plus("sigaction");
2661
ret = raise(signal_received);
2662
} while(ret != 0 and errno == EINTR);
2664
perror_plus("raise");
2667
TEMP_FAILURE_RETRY(pause());
679
/* Check if creating the server object succeeded */
681
fprintf(stderr, "Failed to create server: %s\n",
682
avahi_strerror(error));
683
returncode = EXIT_FAILURE;
687
/* Create the service browser */
688
sb = avahi_s_service_browser_new(server,
690
if_nametoindex(interface),
692
"_mandos._tcp", NULL, 0,
693
browse_callback, server);
695
fprintf(stderr, "Failed to create service browser: %s\n",
696
avahi_strerror(avahi_server_errno(server)));
697
returncode = EXIT_FAILURE;
701
/* Run the main loop */
704
fprintf(stderr, "Starting avahi loop search\n");
707
avahi_simple_poll_loop(simple_poll);
712
fprintf(stderr, "%s exiting\n", argv[0]);
717
avahi_s_service_browser_free(sb);
720
avahi_server_free(server);
723
avahi_simple_poll_free(simple_poll);