262
250
rc = gpgme_data_new_from_fd(&pgp_data, fd);
263
251
if(rc != GPG_ERR_NO_ERROR){
264
fprintf(stderr, "Mandos plugin mandos-client: "
265
"bad gpgme_data_new_from_fd: %s: %s\n",
252
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
266
253
gpgme_strsource(rc), gpgme_strerror(rc));
270
257
rc = gpgme_op_import(mc.ctx, pgp_data);
271
258
if(rc != GPG_ERR_NO_ERROR){
272
fprintf(stderr, "Mandos plugin mandos-client: "
273
"bad gpgme_op_import: %s: %s\n",
259
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
274
260
gpgme_strsource(rc), gpgme_strerror(rc));
287
fprintf(stderr, "Mandos plugin mandos-client: "
288
"Initializing GPGME\n");
273
fprintf(stderr, "Initializing GPGME\n");
292
277
gpgme_check_version(NULL);
293
278
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
294
279
if(rc != GPG_ERR_NO_ERROR){
295
fprintf(stderr, "Mandos plugin mandos-client: "
296
"bad gpgme_engine_check_version: %s: %s\n",
280
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
297
281
gpgme_strsource(rc), gpgme_strerror(rc));
301
/* Set GPGME home directory for the OpenPGP engine only */
285
/* Set GPGME home directory for the OpenPGP engine only */
302
286
rc = gpgme_get_engine_info(&engine_info);
303
287
if(rc != GPG_ERR_NO_ERROR){
304
fprintf(stderr, "Mandos plugin mandos-client: "
305
"bad gpgme_get_engine_info: %s: %s\n",
288
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
306
289
gpgme_strsource(rc), gpgme_strerror(rc));
379
357
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
380
358
if(rc != GPG_ERR_NO_ERROR){
381
fprintf(stderr, "Mandos plugin mandos-client: "
382
"bad gpgme_op_decrypt: %s: %s\n",
359
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
383
360
gpgme_strsource(rc), gpgme_strerror(rc));
384
361
plaintext_length = -1;
386
363
gpgme_decrypt_result_t result;
387
364
result = gpgme_op_decrypt_result(mc.ctx);
388
365
if(result == NULL){
389
fprintf(stderr, "Mandos plugin mandos-client: "
390
"gpgme_op_decrypt_result failed\n");
366
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
392
fprintf(stderr, "Mandos plugin mandos-client: "
393
"Unsupported algorithm: %s\n",
368
fprintf(stderr, "Unsupported algorithm: %s\n",
394
369
result->unsupported_algorithm);
395
fprintf(stderr, "Mandos plugin mandos-client: "
396
"Wrong key usage: %u\n",
370
fprintf(stderr, "Wrong key usage: %u\n",
397
371
result->wrong_key_usage);
398
372
if(result->file_name != NULL){
399
fprintf(stderr, "Mandos plugin mandos-client: "
400
"File name: %s\n", result->file_name);
373
fprintf(stderr, "File name: %s\n", result->file_name);
402
375
gpgme_recipient_t recipient;
403
376
recipient = result->recipients;
404
377
while(recipient != NULL){
405
fprintf(stderr, "Mandos plugin mandos-client: "
406
"Public key algorithm: %s\n",
378
fprintf(stderr, "Public key algorithm: %s\n",
407
379
gpgme_pubkey_algo_name(recipient->pubkey_algo));
408
fprintf(stderr, "Mandos plugin mandos-client: "
409
"Key ID: %s\n", recipient->keyid);
410
fprintf(stderr, "Mandos plugin mandos-client: "
411
"Secret key available: %s\n",
380
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
381
fprintf(stderr, "Secret key available: %s\n",
412
382
recipient->status == GPG_ERR_NO_SECKEY
414
384
recipient = recipient->next;
534
500
GNUTLS_OPENPGP_FMT_BASE64);
535
501
if(ret != GNUTLS_E_SUCCESS){
537
"Mandos plugin mandos-client: "
538
503
"Error[%d] while reading the OpenPGP key pair ('%s',"
539
504
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
540
fprintf(stderr, "Mandos plugin mandos-client: "
541
"The GnuTLS error is: %s\n", safer_gnutls_strerror(ret));
505
fprintf(stderr, "The GnuTLS error is: %s\n",
506
safer_gnutls_strerror(ret));
545
510
/* GnuTLS server initialization */
546
511
ret = gnutls_dh_params_init(&mc.dh_params);
547
512
if(ret != GNUTLS_E_SUCCESS){
548
fprintf(stderr, "Mandos plugin mandos-client: "
549
"Error in GnuTLS DH parameter initialization:"
513
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
550
514
" %s\n", safer_gnutls_strerror(ret));
553
517
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
554
518
if(ret != GNUTLS_E_SUCCESS){
555
fprintf(stderr, "Mandos plugin mandos-client: "
556
"Error in GnuTLS prime generation: %s\n",
519
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
557
520
safer_gnutls_strerror(ret));
1140
1084
errno = old_errno;
1143
bool get_flags(const char *ifname, struct ifreq *ifr){
1146
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1148
perror_plus("socket");
1151
strcpy(ifr->ifr_name, ifname);
1152
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1088
* This function determines if a directory entry in /sys/class/net
1089
* corresponds to an acceptable network device.
1090
* (This function is passed to scandir(3) as a filter function.)
1092
int good_interface(const struct dirent *if_entry){
1094
char *flagname = NULL;
1095
if(if_entry->d_name[0] == '.'){
1098
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
1101
perror_plus("asprintf");
1104
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1106
perror_plus("open");
1111
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1112
/* read line from flags_fd */
1113
ssize_t to_read = 2+(sizeof(ifreq_flags)*2)+1; /* "0x1003\n" */
1114
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1115
flagstring[(size_t)to_read] = '\0';
1116
if(flagstring == NULL){
1117
perror_plus("malloc");
1122
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1125
perror_plus("read");
1139
tmpmax = strtoimax(flagstring, &tmp, 0);
1140
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1141
and not (isspace(*tmp)))
1142
or tmpmax != (ifreq_flags)tmpmax){
1155
perror_plus("ioctl SIOCGIFFLAGS");
1144
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1145
flagstring, if_entry->d_name);
1162
bool good_flags(const char *ifname, const struct ifreq *ifr){
1151
ifreq_flags flags = (ifreq_flags)tmpmax;
1164
1152
/* Reject the loopback device */
1165
if(ifr->ifr_flags & IFF_LOOPBACK){
1153
if(flags & IFF_LOOPBACK){
1167
fprintf(stderr, "Mandos plugin mandos-client: "
1168
"Rejecting loopback interface \"%s\"\n", ifname);
1155
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1172
1160
/* Accept point-to-point devices only if connect_to is specified */
1173
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1161
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1175
fprintf(stderr, "Mandos plugin mandos-client: "
1176
"Accepting point-to-point interface \"%s\"\n", ifname);
1163
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1180
1168
/* Otherwise, reject non-broadcast-capable devices */
1181
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1169
if(not (flags & IFF_BROADCAST)){
1183
fprintf(stderr, "Mandos plugin mandos-client: "
1184
"Rejecting non-broadcast interface \"%s\"\n", ifname);
1171
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1188
1176
/* Reject non-ARP interfaces (including dummy interfaces) */
1189
if(ifr->ifr_flags & IFF_NOARP){
1177
if(flags & IFF_NOARP){
1191
fprintf(stderr, "Mandos plugin mandos-client: "
1192
"Rejecting non-ARP interface \"%s\"\n", ifname);
1179
fprintf(stderr, "Rejecting non-ARP interface \"%s\"\n",
1197
1184
/* Accept this device */
1199
fprintf(stderr, "Mandos plugin mandos-client: "
1200
"Interface \"%s\" is good\n", ifname);
1206
* This function determines if a directory entry in /sys/class/net
1207
* corresponds to an acceptable network device.
1208
* (This function is passed to scandir(3) as a filter function.)
1210
int good_interface(const struct dirent *if_entry){
1211
if(if_entry->d_name[0] == '.'){
1216
if(not get_flags(if_entry->d_name, &ifr)){
1218
fprintf(stderr, "Mandos plugin mandos-client: "
1219
"Failed to get flags for interface \"%s\"\n",
1225
if(not good_flags(if_entry->d_name, &ifr)){
1232
* This function determines if a directory entry in /sys/class/net
1233
* corresponds to an acceptable network device which is up.
1234
* (This function is passed to scandir(3) as a filter function.)
1236
int up_interface(const struct dirent *if_entry){
1237
if(if_entry->d_name[0] == '.'){
1242
if(not get_flags(if_entry->d_name, &ifr)){
1244
fprintf(stderr, "Mandos plugin mandos-client: "
1245
"Failed to get flags for interface \"%s\"\n",
1251
/* Reject down interfaces */
1252
if(not (ifr.ifr_flags & IFF_UP)){
1254
fprintf(stderr, "Mandos plugin mandos-client: "
1255
"Rejecting down interface \"%s\"\n",
1261
/* Reject non-running interfaces */
1262
if(not (ifr.ifr_flags & IFF_RUNNING)){
1264
fprintf(stderr, "Mandos plugin mandos-client: "
1265
"Rejecting non-running interface \"%s\"\n",
1271
if(not good_flags(if_entry->d_name, &ifr)){
1186
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1288
/* Is this directory entry a runnable program? */
1289
int runnable_hook(const struct dirent *direntry){
1294
if((direntry->d_name)[0] == '\0'){
1299
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1300
"abcdefghijklmnopqrstuvwxyz"
1303
if((direntry->d_name)[sret] != '\0'){
1304
/* Contains non-allowed characters */
1306
fprintf(stderr, "Mandos plugin mandos-client: "
1307
"Ignoring hook \"%s\" with bad name\n",
1313
char *fullname = NULL;
1314
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1316
perror_plus("asprintf");
1320
ret = stat(fullname, &st);
1323
perror_plus("Could not stat hook");
1327
if(not (S_ISREG(st.st_mode))){
1328
/* Not a regular file */
1330
fprintf(stderr, "Mandos plugin mandos-client: "
1331
"Ignoring hook \"%s\" - not a file\n",
1336
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1337
/* Not executable */
1339
fprintf(stderr, "Mandos plugin mandos-client: "
1340
"Ignoring hook \"%s\" - not executable\n",
1348
1203
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1350
1205
struct timespec now;
1351
1206
struct timespec waited_time;
1352
1207
intmax_t block_time;
1355
1210
if(mc.current_server == NULL){
1357
fprintf(stderr, "Mandos plugin mandos-client: "
1358
1213
"Wait until first server is found. No timeout!\n");
1360
1215
ret = avahi_simple_poll_iterate(s, -1);
1363
fprintf(stderr, "Mandos plugin mandos-client: "
1364
"Check current_server if we should run it,"
1218
fprintf(stderr, "Check current_server if we should run it,"
1367
1221
/* the current time */
1624
1468
perror_plus("seteuid");
1627
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1628
int seckey_fd = open(seckey, O_RDONLY);
1629
if(seckey_fd == -1){
1630
perror_plus("open");
1471
int seckey_fd = open(PATHDIR "/" SECKEY, O_RDONLY);
1472
if(seckey_fd == -1){
1473
perror_plus("open");
1475
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1477
perror_plus("fstat");
1632
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1634
perror_plus("fstat");
1636
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1637
ret = fchown(seckey_fd, uid, gid);
1639
perror_plus("fchown");
1479
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1480
ret = fchown(seckey_fd, uid, gid);
1482
perror_plus("fchown");
1643
TEMP_FAILURE_RETRY(close(seckey_fd));
1486
TEMP_FAILURE_RETRY(close(seckey_fd));
1647
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1648
int pubkey_fd = open(pubkey, O_RDONLY);
1649
if(pubkey_fd == -1){
1650
perror_plus("open");
1489
int pubkey_fd = open(PATHDIR "/" PUBKEY, O_RDONLY);
1490
if(pubkey_fd == -1){
1491
perror_plus("open");
1493
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1495
perror_plus("fstat");
1652
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1654
perror_plus("fstat");
1656
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1657
ret = fchown(pubkey_fd, uid, gid);
1659
perror_plus("fchown");
1497
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1498
ret = fchown(pubkey_fd, uid, gid);
1500
perror_plus("fchown");
1663
TEMP_FAILURE_RETRY(close(pubkey_fd));
1504
TEMP_FAILURE_RETRY(close(pubkey_fd));
1667
1507
/* Lower privileges */
1675
/* Find network hooks and run them */
1677
struct dirent **direntries;
1678
struct dirent *direntry;
1679
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1682
perror_plus("scandir");
1684
int devnull = open("/dev/null", O_RDONLY);
1685
for(int i = 0; i < numhooks; i++){
1686
direntry = direntries[0];
1687
char *fullname = NULL;
1688
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1690
perror_plus("asprintf");
1693
pid_t hook_pid = fork();
1696
dup2(devnull, STDIN_FILENO);
1698
dup2(STDERR_FILENO, STDOUT_FILENO);
1699
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1701
perror_plus("setenv");
1704
ret = setenv("DEVICE", interface, 1);
1706
perror_plus("setenv");
1709
ret = setenv("VERBOSE", debug ? "1" : "0", 1);
1711
perror_plus("setenv");
1714
ret = setenv("MODE", "start", 1);
1716
perror_plus("setenv");
1720
ret = asprintf(&delaystring, "%f", delay);
1722
perror_plus("asprintf");
1725
ret = setenv("DELAY", delaystring, 1);
1728
perror_plus("setenv");
1732
ret = execl(fullname, direntry->d_name, "start", NULL);
1733
perror_plus("execl");
1736
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1737
perror_plus("waitpid");
1741
if(WIFEXITED(status)){
1742
if(WEXITSTATUS(status) != 0){
1743
fprintf(stderr, "Mandos plugin mandos-client: "
1744
"Warning: network hook \"%s\" exited"
1745
" with status %d\n", direntry->d_name,
1746
WEXITSTATUS(status));
1750
} else if(WIFSIGNALED(status)){
1751
fprintf(stderr, "Mandos plugin mandos-client: "
1752
"Warning: network hook \"%s\" died by"
1753
" signal %d\n", direntry->d_name,
1758
fprintf(stderr, "Mandos plugin mandos-client: "
1759
"Warning: network hook \"%s\" crashed\n",
1775
1516
avahi_set_log_function(empty_log);
1778
1519
if(interface[0] == '\0'){
1779
1520
struct dirent **direntries;
1780
/* First look for interfaces that are up */
1781
ret = scandir(sys_class_net, &direntries, up_interface,
1521
ret = scandir(sys_class_net, &direntries, good_interface,
1784
/* No up interfaces, look for any good interfaces */
1786
ret = scandir(sys_class_net, &direntries, good_interface,
1790
/* Pick the first interface returned */
1524
/* Pick the first good interface */
1791
1525
interface = strdup(direntries[0]->d_name);
1793
fprintf(stderr, "Mandos plugin mandos-client: "
1794
"Using interface \"%s\"\n", interface);
1527
fprintf(stderr, "Using interface \"%s\"\n", interface);
1796
1529
if(interface == NULL){
1797
1530
perror_plus("malloc");