To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 308
- compare with another revision
- download diff
- download tarball
- view history from revision 308
- Committer: Teddy Hogeborn
- Date: 2009-02-09 19:26:19 UTC
- Revision ID: teddy@fukt.bsnet.se-20090209192619-7rse82x9pypq4ihk
* plugin-runner.c: Comment change.
* plugins.d/mandos-client.c: Comment changes.
(quit_now): New global flag.
(handle_sigterm): Only call avahi_simple_poll_quit once.
(main): Also handle SIGINT and SIGHUP.
* plugins.d/mandos-client.c: Comment changes.
(quit_now): New global flag.
(handle_sigterm): Only call avahi_simple_poll_quit once.
(main): Also handle SIGINT and SIGHUP.
- files modified:
- INSTALL
added
removed
plugins.d/mandos-client.c
30
30
*/
31
31
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
33
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
34
#define _FILE_OFFSET_BITS 64
38
#endif
39
35
40
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
37
42
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
39
stdout, ferror(), sscanf(),
40
remove() */
44
41
#include <stdint.h> /* uint16_t, uint32_t */
45
42
#include <stddef.h> /* NULL, size_t, ssize_t */
46
43
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof() */
44
srand() */
48
45
#include <stdbool.h> /* bool, false, true */
49
46
#include <string.h> /* memset(), strcmp(), strlen(),
50
47
strerror(), asprintf(), strcpy() */
59
56
#include <fcntl.h> /* open() */
60
57
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
58
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
59
#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */
64
60
#include <assert.h> /* assert() */
65
61
#include <errno.h> /* perror(), errno */
66
62
#include <time.h> /* nanosleep(), time() */
71
67
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
68
*/
73
69
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
70
getuid(), getgid(), setuid(),
75
71
setgid() */
76
72
#include <arpa/inet.h> /* inet_pton(), htons */
77
73
#include <iso646.h> /* not, or, and */
80
76
argp_parse(), ARGP_KEY_ARG,
81
77
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
78
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
79
sigaction(), SIGTERM, sigaction,
80
sig_atomic_t */
85
81
86
82
#ifdef __linux__
87
83
#include <sys/klog.h> /* klogctl() */
138
134
} mandos_context;
139
135
140
136
/* global context so signal handler can reach it*/
141
mandos_context mc = { .simple_poll = NULL, .server = NULL,
142
.dh_bits = 1024, .priority = "SECURE256"
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
137
mandos_context mc;
144
138
145
139
/*
146
140
* Make additional room in "buffer" for at least BUFFER_SIZE more
164
158
*/
165
159
static bool init_gpgme(const char *seckey,
166
160
const char *pubkey, const char *tempdir){
161
int ret;
167
162
gpgme_error_t rc;
168
163
gpgme_engine_info_t engine_info;
169
164
172
167
* Helper function to insert pub and seckey to the engine keyring.
173
168
*/
174
169
bool import_key(const char *filename){
175
int ret;
176
170
int fd;
177
171
gpgme_data_t pgp_data;
178
172
249
243
return false;
250
244
}
251
245
252
return true;
246
return true;
253
247
}
254
248
255
249
/*
309
303
}
310
304
gpgme_recipient_t recipient;
311
305
recipient = result->recipients;
312
while(recipient != NULL){
313
fprintf(stderr, "Public key algorithm: %s\n",
314
gpgme_pubkey_algo_name(recipient->pubkey_algo));
315
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
316
fprintf(stderr, "Secret key available: %s\n",
317
recipient->status == GPG_ERR_NO_SECKEY
318
? "No" : "Yes");
319
recipient = recipient->next;
306
if(recipient){
307
while(recipient != NULL){
308
fprintf(stderr, "Public key algorithm: %s\n",
309
gpgme_pubkey_algo_name(recipient->pubkey_algo));
310
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
311
fprintf(stderr, "Secret key available: %s\n",
312
recipient->status == GPG_ERR_NO_SECKEY
313
? "No" : "Yes");
314
recipient = recipient->next;
315
}
320
316
}
321
317
}
322
318
}
474
470
static int init_gnutls_session(gnutls_session_t *session){
475
471
int ret;
476
472
/* GnuTLS session creation */
477
do {
478
ret = gnutls_init(session, GNUTLS_SERVER);
479
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
473
ret = gnutls_init(session, GNUTLS_SERVER);
480
474
if(ret != GNUTLS_E_SUCCESS){
481
475
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
482
476
safer_gnutls_strerror(ret));
484
478
485
479
{
486
480
const char *err;
487
do {
488
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
489
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
481
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
490
482
if(ret != GNUTLS_E_SUCCESS){
491
483
fprintf(stderr, "Syntax error at: %s\n", err);
492
484
fprintf(stderr, "GnuTLS error: %s\n",
496
488
}
497
489
}
498
490
499
do {
500
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
501
mc.cred);
502
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
491
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
492
mc.cred);
503
493
if(ret != GNUTLS_E_SUCCESS){
504
494
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
505
495
safer_gnutls_strerror(ret));
508
498
}
509
499
510
500
/* ignore client certificate if any. */
511
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
501
gnutls_certificate_server_set_request(*session,
502
GNUTLS_CERT_IGNORE);
512
503
513
504
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
514
505
519
510
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
520
511
__attribute__((unused)) const char *txt){}
521
512
522
sig_atomic_t quit_now = 0;
523
int signal_received = 0;
524
525
513
/* Called when a Mandos server is found */
526
514
static int start_mandos_communication(const char *ip, uint16_t port,
527
515
AvahiIfIndex if_index,
528
516
int af){
529
int ret, tcp_sd = -1;
517
int ret, tcp_sd;
530
518
ssize_t sret;
531
519
union {
532
520
struct sockaddr_in in;
536
524
char *decrypted_buffer;
537
525
size_t buffer_length = 0;
538
526
size_t buffer_capacity = 0;
527
ssize_t decrypted_buffer_size;
539
528
size_t written;
540
529
int retval = 0;
541
530
gnutls_session_t session;
542
531
int pf; /* Protocol family */
543
532
544
if(quit_now){
545
return -1;
546
}
547
548
533
switch(af){
549
534
case AF_INET6:
550
535
pf = PF_INET6;
570
555
tcp_sd = socket(pf, SOCK_STREAM, 0);
571
556
if(tcp_sd < 0){
572
557
perror("socket");
573
retval = -1;
574
goto mandos_end;
575
}
576
577
if(quit_now){
578
goto mandos_end;
558
return -1;
579
559
}
580
560
581
561
memset(&to, 0, sizeof(to));
582
562
if(af == AF_INET6){
583
to.in6.sin6_family = (sa_family_t)af;
563
to.in6.sin6_family = (uint16_t)af;
584
564
ret = inet_pton(af, ip, &to.in6.sin6_addr);
585
565
} else { /* IPv4 */
586
566
to.in.sin_family = (sa_family_t)af;
588
568
}
589
569
if(ret < 0 ){
590
570
perror("inet_pton");
591
retval = -1;
592
goto mandos_end;
571
return -1;
593
572
}
594
573
if(ret == 0){
595
574
fprintf(stderr, "Bad address: %s\n", ip);
596
retval = -1;
597
goto mandos_end;
575
return -1;
598
576
}
599
577
if(af == AF_INET6){
600
578
to.in6.sin6_port = htons(port); /* Spurious warnings from
607
585
if(if_index == AVAHI_IF_UNSPEC){
608
586
fprintf(stderr, "An IPv6 link-local address is incomplete"
609
587
" without a network interface\n");
610
retval = -1;
611
goto mandos_end;
588
return -1;
612
589
}
613
590
/* Set the network interface number as scope */
614
591
to.in6.sin6_scope_id = (uint32_t)if_index;
619
596
-Wunreachable-code */
620
597
}
621
598
622
if(quit_now){
623
goto mandos_end;
624
}
625
626
599
if(debug){
627
600
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
628
601
char interface[IF_NAMESIZE];
655
628
}
656
629
}
657
630
658
if(quit_now){
659
goto mandos_end;
660
}
661
662
631
if(af == AF_INET6){
663
632
ret = connect(tcp_sd, &to.in6, sizeof(to));
664
633
} else {
666
635
}
667
636
if(ret < 0){
668
637
perror("connect");
669
retval = -1;
670
goto mandos_end;
671
}
672
673
if(quit_now){
674
goto mandos_end;
638
return -1;
675
639
}
676
640
677
641
const char *out = mandos_protocol_version;
696
660
break;
697
661
}
698
662
}
699
700
if(quit_now){
701
goto mandos_end;
702
}
703
663
}
704
664
705
665
if(debug){
706
666
fprintf(stderr, "Establishing TLS session with %s\n", ip);
707
667
}
708
668
709
if(quit_now){
710
goto mandos_end;
711
}
712
713
669
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
714
670
715
if(quit_now){
716
goto mandos_end;
717
}
718
719
do {
671
do{
720
672
ret = gnutls_handshake(session);
721
if(quit_now){
722
goto mandos_end;
723
}
724
673
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
725
674
726
675
if(ret != GNUTLS_E_SUCCESS){
740
689
}
741
690
742
691
while(true){
743
744
if(quit_now){
745
goto mandos_end;
746
}
747
748
692
buffer_capacity = incbuffer(&buffer, buffer_length,
749
693
buffer_capacity);
750
694
if(buffer_capacity == 0){
753
697
goto mandos_end;
754
698
}
755
699
756
if(quit_now){
757
goto mandos_end;
758
}
759
760
700
sret = gnutls_record_recv(session, buffer+buffer_length,
761
701
BUFFER_SIZE);
762
702
if(sret == 0){
768
708
case GNUTLS_E_AGAIN:
769
709
break;
770
710
case GNUTLS_E_REHANDSHAKE:
771
do {
711
do{
772
712
ret = gnutls_handshake(session);
773
774
if(quit_now){
775
goto mandos_end;
776
}
777
713
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
778
714
if(ret < 0){
779
715
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
798
734
fprintf(stderr, "Closing TLS session\n");
799
735
}
800
736
801
if(quit_now){
802
goto mandos_end;
803
}
804
805
737
gnutls_bye(session, GNUTLS_SHUT_RDWR);
806
738
807
if(quit_now){
808
goto mandos_end;
809
}
810
811
739
if(buffer_length > 0){
812
ssize_t decrypted_buffer_size;
813
740
decrypted_buffer_size = pgp_packet_decrypt(buffer,
814
741
buffer_length,
815
742
&decrypted_buffer);
816
743
if(decrypted_buffer_size >= 0){
817
818
744
written = 0;
819
745
while(written < (size_t) decrypted_buffer_size){
820
if(quit_now){
821
goto mandos_end;
822
}
823
824
746
ret = (int)fwrite(decrypted_buffer + written, 1,
825
747
(size_t)decrypted_buffer_size - written,
826
748
stdout);
846
768
847
769
mandos_end:
848
770
free(buffer);
849
if(tcp_sd >= 0){
850
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
851
}
771
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
852
772
if(ret == -1){
853
773
perror("close");
854
774
}
855
775
gnutls_deinit(session);
856
if(quit_now){
857
retval = -1;
858
}
859
776
return retval;
860
777
}
861
778
878
795
/* Called whenever a service has been resolved successfully or
879
796
timed out */
880
797
881
if(quit_now){
882
return;
883
}
884
885
798
switch(event){
886
799
default:
887
800
case AVAHI_RESOLVER_FAILURE:
924
837
/* Called whenever a new services becomes available on the LAN or
925
838
is removed from the LAN */
926
839
927
if(quit_now){
928
return;
929
}
930
931
840
switch(event){
932
841
default:
933
842
case AVAHI_BROWSER_FAILURE:
943
852
the callback function is called the Avahi server will free the
944
853
resolver for us. */
945
854
946
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
947
name, type, domain, protocol, 0,
948
resolve_callback, NULL) == NULL)
855
if(!(avahi_s_service_resolver_new(mc.server, interface,
856
protocol, name, type, domain,
857
AVAHI_PROTO_INET6, 0,
858
resolve_callback, NULL)))
949
859
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
950
860
name, avahi_strerror(avahi_server_errno(mc.server)));
951
861
break;
962
872
}
963
873
}
964
874
965
/* stop main loop after sigterm has been called */
966
static void handle_sigterm(int sig){
875
sig_atomic_t quit_now = 0;
876
877
static void handle_sigterm(__attribute__((unused)) int sig){
967
878
if(quit_now){
968
879
return;
969
880
}
970
881
quit_now = 1;
971
signal_received = sig;
972
882
int old_errno = errno;
973
883
if(mc.simple_poll != NULL){
974
884
avahi_simple_poll_quit(mc.simple_poll);
981
891
int error;
982
892
int ret;
983
893
intmax_t tmpmax;
984
char *tmp;
894
int numchars;
985
895
int exitcode = EXIT_SUCCESS;
986
896
const char *interface = "eth0";
987
897
struct ifreq network;
988
int sd = -1;
989
bool take_down_interface = false;
898
int sd;
990
899
uid_t uid;
991
900
gid_t gid;
992
901
char *connect_to = NULL;
996
905
const char *seckey = PATHDIR "/" SECKEY;
997
906
const char *pubkey = PATHDIR "/" PUBKEY;
998
907
908
/* Initialize Mandos context */
909
mc = (mandos_context){ .simple_poll = NULL, .server = NULL,
910
.dh_bits = 1024, .priority = "SECURE256"
911
":!CTYPE-X.509:+CTYPE-OPENPGP" };
999
912
bool gnutls_initialized = false;
1000
913
bool gpgme_initialized = false;
1001
float delay = 2.5f;
1002
1003
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
914
double delay = 2.5;
915
916
struct sigaction old_sigterm_action;
1004
917
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1005
918
1006
uid = getuid();
1007
gid = getgid();
1008
1009
/* Lower any group privileges we might have, just to be safe */
1010
errno = 0;
1011
ret = setgid(gid);
1012
if(ret == -1){
1013
perror("setgid");
1014
}
1015
1016
/* Lower user privileges (temporarily) */
1017
errno = 0;
1018
ret = seteuid(uid);
1019
if(ret == -1){
1020
perror("seteuid");
1021
}
1022
1023
if(quit_now){
1024
goto end;
1025
}
1026
1027
919
{
1028
920
struct argp_option options[] = {
1029
921
{ .name = "debug", .key = 128,
1080
972
pubkey = arg;
1081
973
break;
1082
974
case 129: /* --dh-bits */
1083
errno = 0;
1084
tmpmax = strtoimax(arg, &tmp, 10);
1085
if(errno != 0 or tmp == arg or *tmp != '\0'
1086
or tmpmax != (typeof(mc.dh_bits))tmpmax){
975
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
976
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
977
or arg[numchars] != '\0'){
1087
978
fprintf(stderr, "Bad number of DH bits\n");
1088
979
exit(EXIT_FAILURE);
1089
980
}
1093
984
mc.priority = arg;
1094
985
break;
1095
986
case 131: /* --delay */
1096
errno = 0;
1097
delay = strtof(arg, &tmp);
1098
if(errno != 0 or tmp == arg or *tmp != '\0'){
987
ret = sscanf(arg, "%lf%n", &delay, &numchars);
988
if(ret < 1 or arg[numchars] != '\0'){
1099
989
fprintf(stderr, "Bad delay\n");
1100
990
exit(EXIT_FAILURE);
1101
991
}
1122
1012
}
1123
1013
}
1124
1014
1125
if(not debug){
1126
avahi_set_log_function(empty_log);
1127
}
1128
1129
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1130
from the signal handler */
1131
/* Initialize the pseudo-RNG for Avahi */
1132
srand((unsigned int) time(NULL));
1133
mc.simple_poll = avahi_simple_poll_new();
1134
if(mc.simple_poll == NULL){
1135
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1136
exitcode = EXIT_FAILURE;
1137
goto end;
1138
}
1139
1140
sigemptyset(&sigterm_action.sa_mask);
1141
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1142
if(ret == -1){
1143
perror("sigaddset");
1144
exitcode = EXIT_FAILURE;
1145
goto end;
1146
}
1147
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1148
if(ret == -1){
1149
perror("sigaddset");
1150
exitcode = EXIT_FAILURE;
1151
goto end;
1152
}
1153
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1154
if(ret == -1){
1155
perror("sigaddset");
1156
exitcode = EXIT_FAILURE;
1157
goto end;
1158
}
1159
/* Need to check if the handler is SIG_IGN before handling:
1160
| [[info:libc:Initial Signal Actions]] |
1161
| [[info:libc:Basic Signal Handling]] |
1162
*/
1163
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1164
if(ret == -1){
1165
perror("sigaction");
1166
return EXIT_FAILURE;
1167
}
1168
if(old_sigterm_action.sa_handler != SIG_IGN){
1169
ret = sigaction(SIGINT, &sigterm_action, NULL);
1170
if(ret == -1){
1171
perror("sigaction");
1172
exitcode = EXIT_FAILURE;
1173
goto end;
1174
}
1175
}
1176
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1177
if(ret == -1){
1178
perror("sigaction");
1179
return EXIT_FAILURE;
1180
}
1181
if(old_sigterm_action.sa_handler != SIG_IGN){
1182
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1183
if(ret == -1){
1184
perror("sigaction");
1185
exitcode = EXIT_FAILURE;
1186
goto end;
1187
}
1188
}
1189
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1190
if(ret == -1){
1191
perror("sigaction");
1192
return EXIT_FAILURE;
1193
}
1194
if(old_sigterm_action.sa_handler != SIG_IGN){
1195
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1196
if(ret == -1){
1197
perror("sigaction");
1198
exitcode = EXIT_FAILURE;
1199
goto end;
1200
}
1201
}
1202
1203
1015
/* If the interface is down, bring it up */
1204
1016
if(interface[0] != '\0'){
1205
if_index = (AvahiIfIndex) if_nametoindex(interface);
1206
if(if_index == 0){
1207
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1208
exitcode = EXIT_FAILURE;
1209
goto end;
1210
}
1211
1212
if(quit_now){
1213
goto end;
1214
}
1215
1216
/* Re-raise priviliges */
1217
errno = 0;
1218
ret = seteuid(0);
1219
if(ret == -1){
1220
perror("seteuid");
1221
}
1222
1223
1017
#ifdef __linux__
1224
1018
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1225
1019
messages to mess up the prompt */
1243
1037
}
1244
1038
}
1245
1039
#endif /* __linux__ */
1246
/* Lower privileges */
1247
errno = 0;
1248
ret = seteuid(uid);
1249
if(ret == -1){
1250
perror("seteuid");
1251
}
1252
1040
goto end;
1253
1041
}
1254
1042
strcpy(network.ifr_name, interface);
1264
1052
}
1265
1053
#endif /* __linux__ */
1266
1054
exitcode = EXIT_FAILURE;
1267
/* Lower privileges */
1268
errno = 0;
1269
ret = seteuid(uid);
1270
if(ret == -1){
1271
perror("seteuid");
1272
}
1273
1055
goto end;
1274
1056
}
1275
1057
if((network.ifr_flags & IFF_UP) == 0){
1276
1058
network.ifr_flags |= IFF_UP;
1277
take_down_interface = true;
1278
1059
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1279
1060
if(ret == -1){
1280
take_down_interface = false;
1281
1061
perror("ioctl SIOCSIFFLAGS");
1282
1062
exitcode = EXIT_FAILURE;
1283
1063
#ifdef __linux__
1288
1068
}
1289
1069
}
1290
1070
#endif /* __linux__ */
1291
/* Lower privileges */
1292
errno = 0;
1293
ret = seteuid(uid);
1294
if(ret == -1){
1295
perror("seteuid");
1296
}
1297
1071
goto end;
1298
1072
}
1299
1073
}
1311
1085
perror("nanosleep");
1312
1086
}
1313
1087
}
1314
if(not take_down_interface){
1315
/* We won't need the socket anymore */
1316
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1317
if(ret == -1){
1318
perror("close");
1319
}
1088
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1089
if(ret == -1){
1090
perror("close");
1320
1091
}
1321
1092
#ifdef __linux__
1322
1093
if(restore_loglevel){
1327
1098
}
1328
1099
}
1329
1100
#endif /* __linux__ */
1330
/* Lower privileges */
1331
errno = 0;
1332
if(take_down_interface){
1333
/* Lower privileges */
1334
ret = seteuid(uid);
1335
if(ret == -1){
1336
perror("seteuid");
1337
}
1338
} else {
1339
/* Lower privileges permanently */
1340
ret = setuid(uid);
1341
if(ret == -1){
1342
perror("setuid");
1343
}
1344
}
1345
}
1346
1347
if(quit_now){
1348
goto end;
1101
}
1102
1103
uid = getuid();
1104
gid = getgid();
1105
1106
errno = 0;
1107
setgid(gid);
1108
if(ret == -1){
1109
perror("setgid");
1110
}
1111
1112
ret = setuid(uid);
1113
if(ret == -1){
1114
perror("setuid");
1349
1115
}
1350
1116
1351
1117
ret = init_gnutls_global(pubkey, seckey);
1357
1123
gnutls_initialized = true;
1358
1124
}
1359
1125
1360
if(quit_now){
1361
goto end;
1362
}
1363
1364
tempdir_created = true;
1365
1126
if(mkdtemp(tempdir) == NULL){
1366
tempdir_created = false;
1367
1127
perror("mkdtemp");
1368
1128
goto end;
1369
1129
}
1370
1371
if(quit_now){
1372
goto end;
1373
}
1130
tempdir_created = true;
1374
1131
1375
1132
if(not init_gpgme(pubkey, seckey, tempdir)){
1376
1133
fprintf(stderr, "init_gpgme failed\n");
1380
1137
gpgme_initialized = true;
1381
1138
}
1382
1139
1383
if(quit_now){
1384
goto end;
1140
if(interface[0] != '\0'){
1141
if_index = (AvahiIfIndex) if_nametoindex(interface);
1142
if(if_index == 0){
1143
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1144
exitcode = EXIT_FAILURE;
1145
goto end;
1146
}
1385
1147
}
1386
1148
1387
1149
if(connect_to != NULL){
1393
1155
exitcode = EXIT_FAILURE;
1394
1156
goto end;
1395
1157
}
1396
1397
if(quit_now){
1398
goto end;
1399
}
1400
1401
1158
uint16_t port;
1402
errno = 0;
1403
tmpmax = strtoimax(address+1, &tmp, 10);
1404
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1405
or tmpmax != (uint16_t)tmpmax){
1159
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1160
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1161
or address[numchars+1] != '\0'){
1406
1162
fprintf(stderr, "Bad port number\n");
1407
1163
exitcode = EXIT_FAILURE;
1408
1164
goto end;
1409
1165
}
1410
1411
if(quit_now){
1412
goto end;
1413
}
1414
1415
1166
port = (uint16_t)tmpmax;
1416
1167
*address = '\0';
1417
1168
address = connect_to;
1422
1173
} else {
1423
1174
af = AF_INET;
1424
1175
}
1425
1426
if(quit_now){
1427
goto end;
1428
}
1429
1430
1176
ret = start_mandos_communication(address, port, if_index, af);
1431
1177
if(ret < 0){
1432
1178
exitcode = EXIT_FAILURE;
1436
1182
goto end;
1437
1183
}
1438
1184
1439
if(quit_now){
1185
if(not debug){
1186
avahi_set_log_function(empty_log);
1187
}
1188
1189
/* Initialize the pseudo-RNG for Avahi */
1190
srand((unsigned int) time(NULL));
1191
1192
/* Allocate main Avahi loop object */
1193
mc.simple_poll = avahi_simple_poll_new();
1194
if(mc.simple_poll == NULL){
1195
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1196
exitcode = EXIT_FAILURE;
1440
1197
goto end;
1441
1198
}
1442
1199
1466
1223
goto end;
1467
1224
}
1468
1225
1469
if(quit_now){
1470
goto end;
1471
}
1472
1473
1226
/* Create the Avahi service browser */
1474
1227
sb = avahi_s_service_browser_new(mc.server, if_index,
1475
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1228
AVAHI_PROTO_INET6, "_mandos._tcp",
1476
1229
NULL, 0, browse_callback, NULL);
1477
1230
if(sb == NULL){
1478
1231
fprintf(stderr, "Failed to create service browser: %s\n",
1481
1234
goto end;
1482
1235
}
1483
1236
1484
if(quit_now){
1485
goto end;
1486
}
1237
sigemptyset(&sigterm_action.sa_mask);
1238
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1239
if(ret == -1){
1240
perror("sigaddset");
1241
exitcode = EXIT_FAILURE;
1242
goto end;
1243
}
1244
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1245
if(ret == -1){
1246
perror("sigaddset");
1247
exitcode = EXIT_FAILURE;
1248
goto end;
1249
}
1250
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1251
if(ret == -1){
1252
perror("sigaddset");
1253
exitcode = EXIT_FAILURE;
1254
goto end;
1255
}
1256
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1257
if(ret == -1){
1258
perror("sigaction");
1259
exitcode = EXIT_FAILURE;
1260
goto end;
1261
}
1487
1262
1488
1263
/* Run the main loop */
1489
1264
1519
1294
gpgme_release(mc.ctx);
1520
1295
}
1521
1296
1522
/* Take down the network interface */
1523
if(take_down_interface){
1524
/* Re-raise priviliges */
1525
errno = 0;
1526
ret = seteuid(0);
1527
if(ret == -1){
1528
perror("seteuid");
1529
}
1530
if(geteuid() == 0){
1531
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1532
if(ret == -1){
1533
perror("ioctl SIOCGIFFLAGS");
1534
} else if(network.ifr_flags & IFF_UP) {
1535
network.ifr_flags &= ~IFF_UP; /* clear flag */
1536
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1537
if(ret == -1){
1538
perror("ioctl SIOCSIFFLAGS");
1539
}
1540
}
1541
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1542
if(ret == -1){
1543
perror("close");
1544
}
1545
/* Lower privileges permanently */
1546
errno = 0;
1547
ret = setuid(uid);
1548
if(ret == -1){
1549
perror("setuid");
1550
}
1551
}
1552
}
1553
1554
1297
/* Removes the temp directory used by GPGME */
1555
1298
if(tempdir_created){
1556
1299
DIR *d;
1595
1338
}
1596
1339
}
1597
1340
1598
if(quit_now){
1599
sigemptyset(&old_sigterm_action.sa_mask);
1600
old_sigterm_action.sa_handler = SIG_DFL;
1601
ret = sigaction(signal_received, &old_sigterm_action, NULL);
1602
if(ret == -1){
1603
perror("sigaction");
1604
}
1605
raise(signal_received);
1606
}
1607
1608
1341
return exitcode;
1609
1342
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0