To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 505.3.3
- compare with another revision
- download diff
- download tarball
- view history from revision 505.3.3
- Committer: teddy at bsnet
- Date: 2011-11-12 16:24:19 UTC
- mto: (505.2.5 mandos-client-network-hooks)
- mto: This revision was merged to the branch mainline in revision 525.
- Revision ID: teddy@fukt.bsnet.se-20111112162419-pe83skogsctxuzw7
* plugins.d/mandos-client.c: Prefix all printouts with "Mandos plugin
mandos-client: ".
* plugins.d/mandos-client.c (main): Wait for network hooks and check
the completion status.
mandos-client: ".
* plugins.d/mandos-client.c (main): Wait for network hooks and check
the completion status.
- files removed:
- network-hooks.d
- files modified:
- TODO
added
removed
plugins.d/mandos-client.c
110
110
init_gnutls_session(),
111
111
GNUTLS_* */
112
112
#include <gnutls/openpgp.h>
113
/* gnutls_certificate_set_openpgp_key_file(),
114
GNUTLS_OPENPGP_FMT_BASE64 */
113
/* gnutls_certificate_set_openpgp_key_file(),
114
GNUTLS_OPENPGP_FMT_BASE64 */
115
115
116
116
/* GPGME */
117
117
#include <gpgme.h> /* All GPGME types, constants and
133
133
const char *argp_program_bug_address = "<mandos@recompile.se>";
134
134
static const char sys_class_net[] = "/sys/class/net";
135
135
char *connect_to = NULL;
136
const char *hookdir = HOOKDIR;
137
136
138
137
/* Doubly linked list that need to be circularly linked when used */
139
138
typedef struct server{
174
173
perror(print_text);
175
174
}
176
175
177
int fprintf_plus(FILE *stream, const char *format, ...){
178
va_list ap;
179
va_start (ap, format);
180
181
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
182
program_invocation_short_name));
183
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
184
}
185
186
176
/*
187
177
* Make additional room in "buffer" for at least BUFFER_SIZE more
188
178
* bytes. "buffer_capacity" is how much is currently allocated,
189
179
* "buffer_length" is how much is already used.
190
180
*/
191
181
size_t incbuffer(char **buffer, size_t buffer_length,
192
size_t buffer_capacity){
182
size_t buffer_capacity){
193
183
if(buffer_length + BUFFER_SIZE > buffer_capacity){
194
184
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
195
185
if(buffer == NULL){
201
191
}
202
192
203
193
/* Add server to set of servers to retry periodically */
204
int add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
205
int af){
194
int add_server(const char *ip, uint16_t port,
195
AvahiIfIndex if_index,
196
int af){
206
197
int ret;
207
198
server *new_server = malloc(sizeof(server));
208
199
if(new_server == NULL){
210
201
return -1;
211
202
}
212
203
*new_server = (server){ .ip = strdup(ip),
213
.port = port,
214
.if_index = if_index,
215
.af = af };
204
.port = port,
205
.if_index = if_index,
206
.af = af };
216
207
if(new_server->ip == NULL){
217
208
perror_plus("strdup");
218
209
return -1;
240
231
/*
241
232
* Initialize GPGME.
242
233
*/
243
static bool init_gpgme(const char *seckey, const char *pubkey,
244
const char *tempdir){
234
static bool init_gpgme(const char *seckey,
235
const char *pubkey, const char *tempdir){
245
236
gpgme_error_t rc;
246
237
gpgme_engine_info_t engine_info;
247
238
262
253
263
254
rc = gpgme_data_new_from_fd(&pgp_data, fd);
264
255
if(rc != GPG_ERR_NO_ERROR){
265
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
266
gpgme_strsource(rc), gpgme_strerror(rc));
256
fprintf(stderr, "Mandos plugin mandos-client: "
257
"bad gpgme_data_new_from_fd: %s: %s\n",
258
gpgme_strsource(rc), gpgme_strerror(rc));
267
259
return false;
268
260
}
269
261
270
262
rc = gpgme_op_import(mc.ctx, pgp_data);
271
263
if(rc != GPG_ERR_NO_ERROR){
272
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
273
gpgme_strsource(rc), gpgme_strerror(rc));
264
fprintf(stderr, "Mandos plugin mandos-client: "
265
"bad gpgme_op_import: %s: %s\n",
266
gpgme_strsource(rc), gpgme_strerror(rc));
274
267
return false;
275
268
}
276
269
283
276
}
284
277
285
278
if(debug){
286
fprintf_plus(stderr, "Initializing GPGME\n");
279
fprintf(stderr, "Mandos plugin mandos-client: "
280
"Initializing GPGME\n");
287
281
}
288
282
289
283
/* Init GPGME */
290
284
gpgme_check_version(NULL);
291
285
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
292
286
if(rc != GPG_ERR_NO_ERROR){
293
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
294
gpgme_strsource(rc), gpgme_strerror(rc));
287
fprintf(stderr, "Mandos plugin mandos-client: "
288
"bad gpgme_engine_check_version: %s: %s\n",
289
gpgme_strsource(rc), gpgme_strerror(rc));
295
290
return false;
296
291
}
297
292
298
293
/* Set GPGME home directory for the OpenPGP engine only */
299
294
rc = gpgme_get_engine_info(&engine_info);
300
295
if(rc != GPG_ERR_NO_ERROR){
301
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
302
gpgme_strsource(rc), gpgme_strerror(rc));
296
fprintf(stderr, "Mandos plugin mandos-client: "
297
"bad gpgme_get_engine_info: %s: %s\n",
298
gpgme_strsource(rc), gpgme_strerror(rc));
303
299
return false;
304
300
}
305
301
while(engine_info != NULL){
311
307
engine_info = engine_info->next;
312
308
}
313
309
if(engine_info == NULL){
314
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
315
tempdir);
310
fprintf(stderr, "Mandos plugin mandos-client: "
311
"Could not set GPGME home dir to %s\n", tempdir);
316
312
return false;
317
313
}
318
314
319
315
/* Create new GPGME "context" */
320
316
rc = gpgme_new(&(mc.ctx));
321
317
if(rc != GPG_ERR_NO_ERROR){
322
fprintf_plus(stderr, "Mandos plugin mandos-client: "
323
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
324
gpgme_strerror(rc));
318
fprintf(stderr, "Mandos plugin mandos-client: "
319
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
320
gpgme_strerror(rc));
325
321
return false;
326
322
}
327
323
346
342
ssize_t plaintext_length = 0;
347
343
348
344
if(debug){
349
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
345
fprintf(stderr, "Mandos plugin mandos-client: "
346
"Trying to decrypt OpenPGP data\n");
350
347
}
351
348
352
349
/* Create new GPGME data buffer from memory cryptotext */
353
350
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
354
351
0);
355
352
if(rc != GPG_ERR_NO_ERROR){
356
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
357
gpgme_strsource(rc), gpgme_strerror(rc));
353
fprintf(stderr, "Mandos plugin mandos-client: "
354
"bad gpgme_data_new_from_mem: %s: %s\n",
355
gpgme_strsource(rc), gpgme_strerror(rc));
358
356
return -1;
359
357
}
360
358
361
359
/* Create new empty GPGME data buffer for the plaintext */
362
360
rc = gpgme_data_new(&dh_plain);
363
361
if(rc != GPG_ERR_NO_ERROR){
364
fprintf_plus(stderr, "Mandos plugin mandos-client: "
365
"bad gpgme_data_new: %s: %s\n",
366
gpgme_strsource(rc), gpgme_strerror(rc));
362
fprintf(stderr, "Mandos plugin mandos-client: "
363
"bad gpgme_data_new: %s: %s\n",
364
gpgme_strsource(rc), gpgme_strerror(rc));
367
365
gpgme_data_release(dh_crypto);
368
366
return -1;
369
367
}
372
370
data buffer */
373
371
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
374
372
if(rc != GPG_ERR_NO_ERROR){
375
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
376
gpgme_strsource(rc), gpgme_strerror(rc));
373
fprintf(stderr, "Mandos plugin mandos-client: "
374
"bad gpgme_op_decrypt: %s: %s\n",
375
gpgme_strsource(rc), gpgme_strerror(rc));
377
376
plaintext_length = -1;
378
377
if(debug){
379
378
gpgme_decrypt_result_t result;
380
379
result = gpgme_op_decrypt_result(mc.ctx);
381
380
if(result == NULL){
382
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
381
fprintf(stderr, "Mandos plugin mandos-client: "
382
"gpgme_op_decrypt_result failed\n");
383
383
} else {
384
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
385
result->unsupported_algorithm);
386
fprintf_plus(stderr, "Wrong key usage: %u\n",
387
result->wrong_key_usage);
384
fprintf(stderr, "Mandos plugin mandos-client: "
385
"Unsupported algorithm: %s\n",
386
result->unsupported_algorithm);
387
fprintf(stderr, "Mandos plugin mandos-client: "
388
"Wrong key usage: %u\n",
389
result->wrong_key_usage);
388
390
if(result->file_name != NULL){
389
fprintf_plus(stderr, "File name: %s\n", result->file_name);
391
fprintf(stderr, "Mandos plugin mandos-client: "
392
"File name: %s\n", result->file_name);
390
393
}
391
394
gpgme_recipient_t recipient;
392
395
recipient = result->recipients;
393
396
while(recipient != NULL){
394
fprintf_plus(stderr, "Public key algorithm: %s\n",
395
gpgme_pubkey_algo_name
396
(recipient->pubkey_algo));
397
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
398
fprintf_plus(stderr, "Secret key available: %s\n",
399
recipient->status == GPG_ERR_NO_SECKEY
400
? "No" : "Yes");
397
fprintf(stderr, "Mandos plugin mandos-client: "
398
"Public key algorithm: %s\n",
399
gpgme_pubkey_algo_name(recipient->pubkey_algo));
400
fprintf(stderr, "Mandos plugin mandos-client: "
401
"Key ID: %s\n", recipient->keyid);
402
fprintf(stderr, "Mandos plugin mandos-client: "
403
"Secret key available: %s\n",
404
recipient->status == GPG_ERR_NO_SECKEY
405
? "No" : "Yes");
401
406
recipient = recipient->next;
402
407
}
403
408
}
406
411
}
407
412
408
413
if(debug){
409
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
414
fprintf(stderr, "Mandos plugin mandos-client: "
415
"Decryption of OpenPGP data succeeded\n");
410
416
}
411
417
412
418
/* Seek back to the beginning of the GPGME plaintext data buffer */
419
425
*plaintext = NULL;
420
426
while(true){
421
427
plaintext_capacity = incbuffer(plaintext,
422
(size_t)plaintext_length,
423
plaintext_capacity);
428
(size_t)plaintext_length,
429
plaintext_capacity);
424
430
if(plaintext_capacity == 0){
425
perror_plus("incbuffer");
426
plaintext_length = -1;
427
goto decrypt_end;
431
perror_plus("incbuffer");
432
plaintext_length = -1;
433
goto decrypt_end;
428
434
}
429
435
430
436
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
443
449
}
444
450
445
451
if(debug){
446
fprintf_plus(stderr, "Decrypted password is: ");
452
fprintf(stderr, "Mandos plugin mandos-client: "
453
"Decrypted password is: ");
447
454
for(ssize_t i = 0; i < plaintext_length; i++){
448
455
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
449
456
}
471
478
/* GnuTLS log function callback */
472
479
static void debuggnutls(__attribute__((unused)) int level,
473
480
const char* string){
474
fprintf_plus(stderr, "GnuTLS: %s", string);
481
fprintf(stderr, "Mandos plugin mandos-client: GnuTLS: %s", string);
475
482
}
476
483
477
484
static int init_gnutls_global(const char *pubkeyfilename,
479
486
int ret;
480
487
481
488
if(debug){
482
fprintf_plus(stderr, "Initializing GnuTLS\n");
489
fprintf(stderr, "Mandos plugin mandos-client: "
490
"Initializing GnuTLS\n");
483
491
}
484
492
485
493
ret = gnutls_global_init();
486
494
if(ret != GNUTLS_E_SUCCESS){
487
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
488
safer_gnutls_strerror(ret));
495
fprintf(stderr, "Mandos plugin mandos-client: "
496
"GnuTLS global_init: %s\n", safer_gnutls_strerror(ret));
489
497
return -1;
490
498
}
491
499
500
508
/* OpenPGP credentials */
501
509
ret = gnutls_certificate_allocate_credentials(&mc.cred);
502
510
if(ret != GNUTLS_E_SUCCESS){
503
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
504
safer_gnutls_strerror(ret));
511
fprintf(stderr, "Mandos plugin mandos-client: "
512
"GnuTLS memory error: %s\n", safer_gnutls_strerror(ret));
505
513
gnutls_global_deinit();
506
514
return -1;
507
515
}
508
516
509
517
if(debug){
510
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
511
" secret key %s as GnuTLS credentials\n",
512
pubkeyfilename,
513
seckeyfilename);
518
fprintf(stderr, "Mandos plugin mandos-client: "
519
"Attempting to use OpenPGP public key %s and"
520
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
521
seckeyfilename);
514
522
}
515
523
516
524
ret = gnutls_certificate_set_openpgp_key_file
517
525
(mc.cred, pubkeyfilename, seckeyfilename,
518
526
GNUTLS_OPENPGP_FMT_BASE64);
519
527
if(ret != GNUTLS_E_SUCCESS){
520
fprintf_plus(stderr,
521
"Error[%d] while reading the OpenPGP key pair ('%s',"
522
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
523
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
524
safer_gnutls_strerror(ret));
528
fprintf(stderr,
529
"Mandos plugin mandos-client: "
530
"Error[%d] while reading the OpenPGP key pair ('%s',"
531
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
532
fprintf(stderr, "Mandos plugin mandos-client: "
533
"The GnuTLS error is: %s\n", safer_gnutls_strerror(ret));
525
534
goto globalfail;
526
535
}
527
536
528
537
/* GnuTLS server initialization */
529
538
ret = gnutls_dh_params_init(&mc.dh_params);
530
539
if(ret != GNUTLS_E_SUCCESS){
531
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
532
" initialization: %s\n",
533
safer_gnutls_strerror(ret));
540
fprintf(stderr, "Mandos plugin mandos-client: "
541
"Error in GnuTLS DH parameter initialization:"
542
" %s\n", safer_gnutls_strerror(ret));
534
543
goto globalfail;
535
544
}
536
545
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
537
546
if(ret != GNUTLS_E_SUCCESS){
538
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
539
safer_gnutls_strerror(ret));
547
fprintf(stderr, "Mandos plugin mandos-client: "
548
"Error in GnuTLS prime generation: %s\n",
549
safer_gnutls_strerror(ret));
540
550
goto globalfail;
541
551
}
542
552
562
572
}
563
573
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
564
574
if(ret != GNUTLS_E_SUCCESS){
565
fprintf_plus(stderr,
566
"Error in GnuTLS session initialization: %s\n",
567
safer_gnutls_strerror(ret));
575
fprintf(stderr, "Mandos plugin mandos-client: "
576
"Error in GnuTLS session initialization: %s\n",
577
safer_gnutls_strerror(ret));
568
578
}
569
579
570
580
{
577
587
}
578
588
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
579
589
if(ret != GNUTLS_E_SUCCESS){
580
fprintf_plus(stderr, "Syntax error at: %s\n", err);
581
fprintf_plus(stderr, "GnuTLS error: %s\n",
582
safer_gnutls_strerror(ret));
590
fprintf(stderr, "Mandos plugin mandos-client: "
591
"Syntax error at: %s\n", err);
592
fprintf(stderr, "Mandos plugin mandos-client: "
593
"GnuTLS error: %s\n", safer_gnutls_strerror(ret));
583
594
gnutls_deinit(*session);
584
595
return -1;
585
596
}
594
605
}
595
606
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
596
607
if(ret != GNUTLS_E_SUCCESS){
597
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
598
safer_gnutls_strerror(ret));
608
fprintf(stderr, "Mandos plugin mandos-client: "
609
"Error setting GnuTLS credentials: %s\n",
610
safer_gnutls_strerror(ret));
599
611
gnutls_deinit(*session);
600
612
return -1;
601
613
}
646
658
pf = PF_INET;
647
659
break;
648
660
default:
649
fprintf_plus(stderr, "Bad address family: %d\n", af);
661
fprintf(stderr, "Mandos plugin mandos-client: "
662
"Bad address family: %d\n", af);
650
663
errno = EINVAL;
651
664
return -1;
652
665
}
657
670
}
658
671
659
672
if(debug){
660
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
661
PRIu16 "\n", ip, port);
673
fprintf(stderr, "Mandos plugin mandos-client: "
674
"Setting up a TCP connection to %s, port %" PRIu16
675
"\n", ip, port);
662
676
}
663
677
664
678
tcp_sd = socket(pf, SOCK_STREAM, 0);
690
704
}
691
705
if(ret == 0){
692
706
int e = errno;
693
fprintf_plus(stderr, "Bad address: %s\n", ip);
707
fprintf(stderr, "Mandos plugin mandos-client: "
708
"Bad address: %s\n", ip);
694
709
errno = e;
695
710
goto mandos_end;
696
711
}
701
716
702
717
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
703
718
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
704
-Wunreachable-code*/
719
-Wunreachable-code*/
705
720
if(if_index == AVAHI_IF_UNSPEC){
706
fprintf_plus(stderr, "An IPv6 link-local address is"
707
" incomplete without a network interface\n");
721
fprintf(stderr, "Mandos plugin mandos-client: "
722
"An IPv6 link-local address is incomplete"
723
" without a network interface\n");
708
724
errno = EINVAL;
709
725
goto mandos_end;
710
726
}
728
744
if(if_indextoname((unsigned int)if_index, interface) == NULL){
729
745
perror_plus("if_indextoname");
730
746
} else {
731
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
732
"\n", ip, interface, port);
747
fprintf(stderr, "Mandos plugin mandos-client: "
748
"Connection to: %s%%%s, port %" PRIu16 "\n",
749
ip, interface, port);
733
750
}
734
751
} else {
735
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
736
ip, port);
752
fprintf(stderr, "Mandos plugin mandos-client: "
753
"Connection to: %s, port %" PRIu16 "\n", ip, port);
737
754
}
738
755
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
739
756
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
749
766
perror_plus("inet_ntop");
750
767
} else {
751
768
if(strcmp(addrstr, ip) != 0){
752
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
769
fprintf(stderr, "Mandos plugin mandos-client: "
770
"Canonical address form: %s\n", addrstr);
753
771
}
754
772
}
755
773
}
783
801
while(true){
784
802
size_t out_size = strlen(out);
785
803
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
786
out_size - written));
804
out_size - written));
787
805
if(ret == -1){
788
806
int e = errno;
789
807
perror_plus("write");
809
827
}
810
828
811
829
if(debug){
812
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
830
fprintf(stderr, "Mandos plugin mandos-client: "
831
"Establishing TLS session with %s\n", ip);
813
832
}
814
833
815
834
if(quit_now){
835
854
836
855
if(ret != GNUTLS_E_SUCCESS){
837
856
if(debug){
838
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
857
fprintf(stderr, "Mandos plugin mandos-client: "
858
"*** GnuTLS Handshake failed ***\n");
839
859
gnutls_perror(ret);
840
860
}
841
861
errno = EPROTO;
845
865
/* Read OpenPGP packet that contains the wanted password */
846
866
847
867
if(debug){
848
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
849
" %s\n", ip);
868
fprintf(stderr, "Mandos plugin mandos-client: "
869
"Retrieving OpenPGP encrypted password from %s\n", ip);
850
870
}
851
871
852
872
while(true){
857
877
}
858
878
859
879
buffer_capacity = incbuffer(&buffer, buffer_length,
860
buffer_capacity);
880
buffer_capacity);
861
881
if(buffer_capacity == 0){
862
882
int e = errno;
863
883
perror_plus("incbuffer");
890
910
}
891
911
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
892
912
if(ret < 0){
893
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
894
"***\n");
913
fprintf(stderr, "Mandos plugin mandos-client: "
914
"*** GnuTLS Re-handshake failed ***\n");
895
915
gnutls_perror(ret);
896
916
errno = EPROTO;
897
917
goto mandos_end;
898
918
}
899
919
break;
900
920
default:
901
fprintf_plus(stderr, "Unknown error while reading data from"
902
" encrypted session with Mandos server\n");
921
fprintf(stderr, "Mandos plugin mandos-client: "
922
"Unknown error while reading data from"
923
" encrypted session with Mandos server\n");
903
924
gnutls_bye(session, GNUTLS_SHUT_RDWR);
904
925
errno = EIO;
905
926
goto mandos_end;
910
931
}
911
932
912
933
if(debug){
913
fprintf_plus(stderr, "Closing TLS session\n");
934
fprintf(stderr, "Mandos plugin mandos-client: "
935
"Closing TLS session\n");
914
936
}
915
937
916
938
if(quit_now){
928
950
929
951
if(buffer_length > 0){
930
952
ssize_t decrypted_buffer_size;
931
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
953
decrypted_buffer_size = pgp_packet_decrypt(buffer,
954
buffer_length,
932
955
&decrypted_buffer);
933
956
if(decrypted_buffer_size >= 0){
934
957
945
968
if(ret == 0 and ferror(stdout)){
946
969
int e = errno;
947
970
if(debug){
948
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
949
strerror(errno));
971
fprintf(stderr, "Mandos plugin mandos-client: "
972
"Error writing encrypted data: %s\n",
973
strerror(errno));
950
974
}
951
975
errno = e;
952
976
goto mandos_end;
1009
1033
switch(event){
1010
1034
default:
1011
1035
case AVAHI_RESOLVER_FAILURE:
1012
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1013
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1014
domain,
1015
avahi_strerror(avahi_server_errno(mc.server)));
1036
fprintf(stderr, "Mandos plugin mandos-client: "
1037
"(Avahi Resolver) Failed to resolve service '%s'"
1038
" of type '%s' in domain '%s': %s\n", name, type, domain,
1039
avahi_strerror(avahi_server_errno(mc.server)));
1016
1040
break;
1017
1041
1018
1042
case AVAHI_RESOLVER_FOUND:
1020
1044
char ip[AVAHI_ADDRESS_STR_MAX];
1021
1045
avahi_address_snprint(ip, sizeof(ip), address);
1022
1046
if(debug){
1023
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1024
PRIdMAX ") on port %" PRIu16 "\n", name,
1025
host_name, ip, (intmax_t)interface, port);
1047
fprintf(stderr, "Mandos plugin mandos-client: "
1048
"Mandos server \"%s\" found on %s (%s, %"
1049
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
1050
ip, (intmax_t)interface, port);
1026
1051
}
1027
1052
int ret = start_mandos_communication(ip, port, interface,
1028
1053
avahi_proto_to_af(proto));
1060
1085
default:
1061
1086
case AVAHI_BROWSER_FAILURE:
1062
1087
1063
fprintf_plus(stderr, "(Avahi browser) %s\n",
1064
avahi_strerror(avahi_server_errno(mc.server)));
1088
fprintf(stderr, "Mandos plugin mandos-client: "
1089
"(Avahi browser) %s\n",
1090
avahi_strerror(avahi_server_errno(mc.server)));
1065
1091
avahi_simple_poll_quit(mc.simple_poll);
1066
1092
return;
1067
1093
1074
1100
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1075
1101
name, type, domain, protocol, 0,
1076
1102
resolve_callback, NULL) == NULL)
1077
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1078
" %s\n", name,
1079
avahi_strerror(avahi_server_errno(mc.server)));
1103
fprintf(stderr, "Mandos plugin mandos-client: "
1104
"Avahi: Failed to resolve service '%s': %s\n",
1105
name, avahi_strerror(avahi_server_errno(mc.server)));
1080
1106
break;
1081
1107
1082
1108
case AVAHI_BROWSER_REMOVE:
1085
1111
case AVAHI_BROWSER_ALL_FOR_NOW:
1086
1112
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1087
1113
if(debug){
1088
fprintf_plus(stderr, "No Mandos server found, still"
1089
" searching...\n");
1114
fprintf(stderr, "Mandos plugin mandos-client: "
1115
"No Mandos server found, still searching...\n");
1090
1116
}
1091
1117
break;
1092
1118
}
1131
1157
/* Reject the loopback device */
1132
1158
if(ifr->ifr_flags & IFF_LOOPBACK){
1133
1159
if(debug){
1134
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1135
ifname);
1160
fprintf(stderr, "Mandos plugin mandos-client: "
1161
"Rejecting loopback interface \"%s\"\n", ifname);
1136
1162
}
1137
1163
return false;
1138
1164
}
1139
1165
/* Accept point-to-point devices only if connect_to is specified */
1140
1166
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1141
1167
if(debug){
1142
fprintf_plus(stderr, "Accepting point-to-point interface"
1143
" \"%s\"\n", ifname);
1168
fprintf(stderr, "Mandos plugin mandos-client: "
1169
"Accepting point-to-point interface \"%s\"\n", ifname);
1144
1170
}
1145
1171
return true;
1146
1172
}
1147
1173
/* Otherwise, reject non-broadcast-capable devices */
1148
1174
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1149
1175
if(debug){
1150
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1151
" \"%s\"\n", ifname);
1176
fprintf(stderr, "Mandos plugin mandos-client: "
1177
"Rejecting non-broadcast interface \"%s\"\n", ifname);
1152
1178
}
1153
1179
return false;
1154
1180
}
1155
1181
/* Reject non-ARP interfaces (including dummy interfaces) */
1156
1182
if(ifr->ifr_flags & IFF_NOARP){
1157
1183
if(debug){
1158
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1159
ifname);
1184
fprintf(stderr, "Mandos plugin mandos-client: "
1185
"Rejecting non-ARP interface \"%s\"\n", ifname);
1160
1186
}
1161
1187
return false;
1162
1188
}
1163
1189
1164
1190
/* Accept this device */
1165
1191
if(debug){
1166
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1192
fprintf(stderr, "Mandos plugin mandos-client: "
1193
"Interface \"%s\" is good\n", ifname);
1167
1194
}
1168
1195
return true;
1169
1196
}
1181
1208
struct ifreq ifr;
1182
1209
if(not get_flags(if_entry->d_name, &ifr)){
1183
1210
if(debug){
1184
fprintf_plus(stderr, "Failed to get flags for interface "
1185
"\"%s\"\n", if_entry->d_name);
1211
fprintf(stderr, "Mandos plugin mandos-client: "
1212
"Failed to get flags for interface \"%s\"\n",
1213
if_entry->d_name);
1186
1214
}
1187
1215
return 0;
1188
1216
}
1206
1234
struct ifreq ifr;
1207
1235
if(not get_flags(if_entry->d_name, &ifr)){
1208
1236
if(debug){
1209
fprintf_plus(stderr, "Failed to get flags for interface "
1210
"\"%s\"\n", if_entry->d_name);
1237
fprintf(stderr, "Mandos plugin mandos-client: "
1238
"Failed to get flags for interface \"%s\"\n",
1239
if_entry->d_name);
1211
1240
}
1212
1241
return 0;
1213
1242
}
1215
1244
/* Reject down interfaces */
1216
1245
if(not (ifr.ifr_flags & IFF_UP)){
1217
1246
if(debug){
1218
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1219
if_entry->d_name);
1247
fprintf(stderr, "Mandos plugin mandos-client: "
1248
"Rejecting down interface \"%s\"\n",
1249
if_entry->d_name);
1220
1250
}
1221
1251
return 0;
1222
1252
}
1224
1254
/* Reject non-running interfaces */
1225
1255
if(not (ifr.ifr_flags & IFF_RUNNING)){
1226
1256
if(debug){
1227
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1228
if_entry->d_name);
1257
fprintf(stderr, "Mandos plugin mandos-client: "
1258
"Rejecting non-running interface \"%s\"\n",
1259
if_entry->d_name);
1229
1260
}
1230
1261
return 0;
1231
1262
}
1250
1281
/* Is this directory entry a runnable program? */
1251
1282
int runnable_hook(const struct dirent *direntry){
1252
1283
int ret;
1253
size_t sret;
1254
1284
struct stat st;
1255
1285
1256
1286
if((direntry->d_name)[0] == '\0'){
1258
1288
return 0;
1259
1289
}
1260
1290
1261
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1262
"abcdefghijklmnopqrstuvwxyz"
1263
"0123456789"
1264
"_-");
1265
if((direntry->d_name)[sret] != '\0'){
1266
/* Contains non-allowed characters */
1267
if(debug){
1268
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1269
direntry->d_name);
1270
}
1271
return 0;
1272
}
1273
1274
char *fullname = NULL;
1275
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1276
if(ret < 0){
1277
perror_plus("asprintf");
1278
return 0;
1279
}
1280
1281
ret = stat(fullname, &st);
1291
/* Save pointer to last character */
1292
char *end = strchr(direntry->d_name, '\0')-1;
1293
1294
if(*end == '~'){
1295
/* Backup name~ */
1296
return 0;
1297
}
1298
1299
if(((direntry->d_name)[0] == '#')
1300
and (*end == '#')){
1301
/* Temporary #name# */
1302
return 0;
1303
}
1304
1305
/* XXX more rules here */
1306
1307
ret = stat(direntry->d_name, &st);
1282
1308
if(ret == -1){
1283
1309
if(debug){
1284
perror_plus("Could not stat hook");
1310
perror_plus("Could not stat plugin");
1285
1311
}
1286
1312
return 0;
1287
1313
}
1288
1314
if(not (S_ISREG(st.st_mode))){
1289
1315
/* Not a regular file */
1290
if(debug){
1291
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1292
direntry->d_name);
1293
}
1294
1316
return 0;
1295
1317
}
1296
1318
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1297
1319
/* Not executable */
1298
if(debug){
1299
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1300
direntry->d_name);
1301
}
1302
1320
return 0;
1303
1321
}
1304
1322
return 1;
1313
1331
while(true){
1314
1332
if(mc.current_server == NULL){
1315
1333
if (debug){
1316
fprintf_plus(stderr, "Wait until first server is found."
1317
" No timeout!\n");
1334
fprintf(stderr, "Mandos plugin mandos-client: "
1335
"Wait until first server is found. No timeout!\n");
1318
1336
}
1319
1337
ret = avahi_simple_poll_iterate(s, -1);
1320
1338
} else {
1321
1339
if (debug){
1322
fprintf_plus(stderr, "Check current_server if we should run"
1323
" it, or wait\n");
1340
fprintf(stderr, "Mandos plugin mandos-client: "
1341
"Check current_server if we should run it,"
1342
" or wait\n");
1324
1343
}
1325
1344
/* the current time */
1326
1345
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1342
1361
- ((intmax_t)waited_time.tv_nsec / 1000000));
1343
1362
1344
1363
if (debug){
1345
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1346
block_time);
1364
fprintf(stderr, "Mandos plugin mandos-client: "
1365
"Blocking for %" PRIdMAX " ms\n", block_time);
1347
1366
}
1348
1367
1349
1368
if(block_time <= 0){
1376
1395
}
1377
1396
}
1378
1397
1379
bool run_network_hooks(const char *mode, const char *interface,
1380
const float delay){
1381
struct dirent **direntries;
1382
struct dirent *direntry;
1383
int ret;
1384
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1385
alphasort);
1386
if(numhooks == -1){
1387
perror_plus("scandir");
1388
} else {
1389
int devnull = open("/dev/null", O_RDONLY);
1390
for(int i = 0; i < numhooks; i++){
1391
direntry = direntries[0];
1392
char *fullname = NULL;
1393
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1394
if(ret < 0){
1395
perror_plus("asprintf");
1396
continue;
1397
}
1398
pid_t hook_pid = fork();
1399
if(hook_pid == 0){
1400
/* Child */
1401
dup2(devnull, STDIN_FILENO);
1402
close(devnull);
1403
dup2(STDERR_FILENO, STDOUT_FILENO);
1404
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1405
if(ret == -1){
1406
perror_plus("setenv");
1407
return false;
1408
}
1409
ret = setenv("DEVICE", interface, 1);
1410
if(ret == -1){
1411
perror_plus("setenv");
1412
return false;
1413
}
1414
ret = setenv("VERBOSE", debug ? "1" : "0", 1);
1415
if(ret == -1){
1416
perror_plus("setenv");
1417
return false;
1418
}
1419
ret = setenv("MODE", mode, 1);
1420
if(ret == -1){
1421
perror_plus("setenv");
1422
return false;
1423
}
1424
char *delaystring;
1425
ret = asprintf(&delaystring, "%f", delay);
1426
if(ret == -1){
1427
perror_plus("asprintf");
1428
return false;
1429
}
1430
ret = setenv("DELAY", delaystring, 1);
1431
if(ret == -1){
1432
free(delaystring);
1433
perror_plus("setenv");
1434
return false;
1435
}
1436
free(delaystring);
1437
ret = execl(fullname, direntry->d_name, mode, NULL);
1438
perror_plus("execl");
1439
} else {
1440
int status;
1441
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1442
perror_plus("waitpid");
1443
free(fullname);
1444
continue;
1445
}
1446
if(WIFEXITED(status)){
1447
if(WEXITSTATUS(status) != 0){
1448
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1449
" with status %d\n", direntry->d_name,
1450
WEXITSTATUS(status));
1451
free(fullname);
1452
continue;
1453
}
1454
} else if(WIFSIGNALED(status)){
1455
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1456
" signal %d\n", direntry->d_name,
1457
WTERMSIG(status));
1458
free(fullname);
1459
continue;
1460
} else {
1461
fprintf_plus(stderr, "Warning: network hook \"%s\""
1462
" crashed\n", direntry->d_name);
1463
free(fullname);
1464
continue;
1465
}
1466
}
1467
free(fullname);
1468
if(quit_now){
1469
break;
1470
}
1471
}
1472
close(devnull);
1473
}
1474
return true;
1475
}
1476
1477
1398
int main(int argc, char *argv[]){
1478
1399
AvahiSServiceBrowser *sb = NULL;
1479
1400
int error;
1561
1482
.arg = "SECONDS",
1562
1483
.doc = "Retry interval used when denied by the mandos server",
1563
1484
.group = 2 },
1564
{ .name = "network-hook-dir", .key = 133,
1565
.arg = "DIR",
1566
.doc = "Directory where network hooks are located",
1567
.group = 2 },
1568
1485
/*
1569
1486
* These reproduce what we would get without ARGP_NO_HELP
1570
1487
*/
1623
1540
argp_error(state, "Bad retry interval");
1624
1541
}
1625
1542
break;
1626
case 133: /* --network-hook-dir */
1627
hookdir = arg;
1628
break;
1629
1543
/*
1630
1544
* These reproduce what we would get without ARGP_NO_HELP
1631
1545
*/
1637
1551
argp_state_help(state, state->out_stream,
1638
1552
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1639
1553
case 'V': /* --version */
1640
fprintf_plus(state->out_stream,
1641
"Mandos plugin mandos-client: ");
1642
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1554
fprintf(state->out_stream, "Mandos plugin mandos-client: ");
1555
fprintf(state->out_stream, "%s\n", argp_program_version);
1643
1556
exit(argp_err_exit_status);
1644
1557
break;
1645
1558
default:
1690
1603
if(ret == -1){
1691
1604
perror_plus("fstat");
1692
1605
} else {
1693
if(S_ISREG(st.st_mode)
1694
and st.st_uid == 0 and st.st_gid == 0){
1606
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1695
1607
ret = fchown(seckey_fd, uid, gid);
1696
1608
if(ret == -1){
1697
1609
perror_plus("fchown");
1711
1623
if(ret == -1){
1712
1624
perror_plus("fstat");
1713
1625
} else {
1714
if(S_ISREG(st.st_mode)
1715
and st.st_uid == 0 and st.st_gid == 0){
1626
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1716
1627
ret = fchown(pubkey_fd, uid, gid);
1717
1628
if(ret == -1){
1718
1629
perror_plus("fchown");
1731
1642
}
1732
1643
}
1733
1644
1734
/* Run network hooks */
1645
/* Find network hooks and run them */
1735
1646
{
1736
/* Re-raise priviliges */
1737
errno = 0;
1738
ret = seteuid(0);
1739
if(ret == -1){
1740
perror_plus("seteuid");
1741
}
1742
if(not run_network_hooks("start", interface, delay)){
1743
goto end;
1744
}
1745
/* Lower privileges */
1746
errno = 0;
1747
ret = seteuid(uid);
1748
if(ret == -1){
1749
perror_plus("seteuid");
1647
struct dirent **direntries;
1648
struct dirent *direntry;
1649
int numhooks = scandir(HOOKDIR, &direntries, runnable_hook,
1650
alphasort);
1651
if(numhooks == -1){
1652
perror_plus("scandir");
1653
} else {
1654
int devnull = open("/dev/null", O_RDONLY);
1655
for(int i = 0; i < numhooks; i++){
1656
direntry = direntries[0];
1657
char *fullname = NULL;
1658
ret = asprintf(&fullname, "%s/%s", tempdir,
1659
direntry->d_name);
1660
if(ret < 0){
1661
perror_plus("asprintf");
1662
continue;
1663
}
1664
pid_t hook_pid = fork();
1665
if(hook_pid == 0){
1666
/* Child */
1667
dup2(devnull, STDIN_FILENO);
1668
close(devnull);
1669
dup2(STDERR_FILENO, STDOUT_FILENO);
1670
ret = setenv("DEVICE", interface, 1);
1671
if(ret == -1){
1672
perror_plus("setenv");
1673
exit(1);
1674
}
1675
ret = setenv("VERBOSE", debug ? "1" : "0", 1);
1676
if(ret == -1){
1677
perror_plus("setenv");
1678
exit(1);
1679
}
1680
ret = setenv("MODE", "start", 1);
1681
if(ret == -1){
1682
perror_plus("setenv");
1683
exit(1);
1684
}
1685
char *delaystring;
1686
ret = asprintf(&delaystring, "%f", delay);
1687
if(ret == -1){
1688
perror_plus("asprintf");
1689
exit(1);
1690
}
1691
ret = setenv("DELAY", delaystring, 1);
1692
if(ret == -1){
1693
free(delaystring);
1694
perror_plus("setenv");
1695
exit(1);
1696
}
1697
free(delaystring);
1698
ret = execl(fullname, direntry->d_name, "start", NULL);
1699
perror_plus("execl");
1700
} else {
1701
int status;
1702
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1703
perror_plus("waitpid");
1704
free(fullname);
1705
continue;
1706
}
1707
if(WIFEXITED(status)){
1708
if(WEXITSTATUS(status) != 0){
1709
fprintf(stderr, "Mandos plugin mandos-client: "
1710
"Warning: network hook \"%s\" exited"
1711
" with status %d\n", direntry->d_name,
1712
WEXITSTATUS(status));
1713
free(fullname);
1714
continue;
1715
}
1716
} else if(WIFSIGNALED(status)){
1717
fprintf(stderr, "Mandos plugin mandos-client: "
1718
"Warning: network hook \"%s\" died by"
1719
" signal %d\n", direntry->d_name,
1720
WTERMSIG(status));
1721
free(fullname);
1722
continue;
1723
} else {
1724
fprintf(stderr, "Mandos plugin mandos-client: "
1725
"Warning: network hook \"%s\" crashed\n",
1726
direntry->d_name);
1727
free(fullname);
1728
continue;
1729
}
1730
}
1731
free(fullname);
1732
if(quit_now){
1733
goto end;
1734
}
1735
}
1736
close(devnull);
1750
1737
}
1751
1738
}
1752
1739
1769
1756
/* Pick the first interface returned */
1770
1757
interface = strdup(direntries[0]->d_name);
1771
1758
if(debug){
1772
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1759
fprintf(stderr, "Mandos plugin mandos-client: "
1760
"Using interface \"%s\"\n", interface);
1773
1761
}
1774
1762
if(interface == NULL){
1775
1763
perror_plus("malloc");
1780
1768
free(direntries);
1781
1769
} else {
1782
1770
free(direntries);
1783
fprintf_plus(stderr, "Could not find a network interface\n");
1771
fprintf(stderr, "Mandos plugin mandos-client: "
1772
"Could not find a network interface\n");
1784
1773
exitcode = EXIT_FAILURE;
1785
1774
goto end;
1786
1775
}
1792
1781
srand((unsigned int) time(NULL));
1793
1782
mc.simple_poll = avahi_simple_poll_new();
1794
1783
if(mc.simple_poll == NULL){
1795
fprintf_plus(stderr,
1796
"Avahi: Failed to create simple poll object.\n");
1784
fprintf(stderr, "Mandos plugin mandos-client: "
1785
"Avahi: Failed to create simple poll object.\n");
1797
1786
exitcode = EX_UNAVAILABLE;
1798
1787
goto end;
1799
1788
}
1865
1854
if(strcmp(interface, "none") != 0){
1866
1855
if_index = (AvahiIfIndex) if_nametoindex(interface);
1867
1856
if(if_index == 0){
1868
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1857
fprintf(stderr, "Mandos plugin mandos-client: "
1858
"No such interface: \"%s\"\n", interface);
1869
1859
exitcode = EX_UNAVAILABLE;
1870
1860
goto end;
1871
1861
}
1991
1981
#endif /* __linux__ */
1992
1982
/* Lower privileges */
1993
1983
errno = 0;
1994
/* Lower privileges */
1995
ret = seteuid(uid);
1996
if(ret == -1){
1997
perror_plus("seteuid");
1984
if(take_down_interface){
1985
/* Lower privileges */
1986
ret = seteuid(uid);
1987
if(ret == -1){
1988
perror_plus("seteuid");
1989
}
1990
} else {
1991
/* Lower privileges permanently */
1992
ret = setuid(uid);
1993
if(ret == -1){
1994
perror_plus("setuid");
1995
}
1998
1996
}
1999
1997
}
2000
1998
2004
2002
2005
2003
ret = init_gnutls_global(pubkey, seckey);
2006
2004
if(ret == -1){
2007
fprintf_plus(stderr, "init_gnutls_global failed\n");
2005
fprintf(stderr, "Mandos plugin mandos-client: "
2006
"init_gnutls_global failed\n");
2008
2007
exitcode = EX_UNAVAILABLE;
2009
2008
goto end;
2010
2009
} else {
2026
2025
}
2027
2026
2028
2027
if(not init_gpgme(pubkey, seckey, tempdir)){
2029
fprintf_plus(stderr, "init_gpgme failed\n");
2028
fprintf(stderr, "Mandos plugin mandos-client: "
2029
"init_gpgme failed\n");
2030
2030
exitcode = EX_UNAVAILABLE;
2031
2031
goto end;
2032
2032
} else {
2042
2042
/* (Mainly meant for debugging) */
2043
2043
char *address = strrchr(connect_to, ':');
2044
2044
if(address == NULL){
2045
fprintf_plus(stderr, "No colon in address\n");
2045
fprintf(stderr, "Mandos plugin mandos-client: "
2046
"No colon in address\n");
2046
2047
exitcode = EX_USAGE;
2047
2048
goto end;
2048
2049
}
2056
2057
tmpmax = strtoimax(address+1, &tmp, 10);
2057
2058
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2058
2059
or tmpmax != (uint16_t)tmpmax){
2059
fprintf_plus(stderr, "Bad port number\n");
2060
fprintf(stderr, "Mandos plugin mandos-client: "
2061
"Bad port number\n");
2060
2062
exitcode = EX_USAGE;
2061
2063
goto end;
2062
2064
}
2092
2094
break;
2093
2095
}
2094
2096
if(debug){
2095
fprintf_plus(stderr, "Retrying in %d seconds\n",
2096
(int)retry_interval);
2097
fprintf(stderr, "Mandos plugin mandos-client: "
2098
"Retrying in %d seconds\n", (int)retry_interval);
2097
2099
}
2098
2100
sleep((int)retry_interval);
2099
2101
}
2129
2131
2130
2132
/* Check if creating the Avahi server object succeeded */
2131
2133
if(mc.server == NULL){
2132
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2133
avahi_strerror(error));
2134
fprintf(stderr, "Mandos plugin mandos-client: "
2135
"Failed to create Avahi server: %s\n",
2136
avahi_strerror(error));
2134
2137
exitcode = EX_UNAVAILABLE;
2135
2138
goto end;
2136
2139
}
2144
2147
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2145
2148
NULL, 0, browse_callback, NULL);
2146
2149
if(sb == NULL){
2147
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2148
avahi_strerror(avahi_server_errno(mc.server)));
2150
fprintf(stderr, "Mandos plugin mandos-client: "
2151
"Failed to create service browser: %s\n",
2152
avahi_strerror(avahi_server_errno(mc.server)));
2149
2153
exitcode = EX_UNAVAILABLE;
2150
2154
goto end;
2151
2155
}
2157
2161
/* Run the main loop */
2158
2162
2159
2163
if(debug){
2160
fprintf_plus(stderr, "Starting Avahi loop search\n");
2164
fprintf(stderr, "Mandos plugin mandos-client: "
2165
"Starting Avahi loop search\n");
2161
2166
}
2162
2167
2163
2168
ret = avahi_loop_with_timeout(mc.simple_poll,
2164
2169
(int)(retry_interval * 1000));
2165
2170
if(debug){
2166
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2167
(ret == 0) ? "successfully" : "with error");
2171
fprintf(stderr, "Mandos plugin mandos-client: "
2172
"avahi_loop_with_timeout exited %s\n",
2173
(ret == 0) ? "successfully" : "with error");
2168
2174
}
2169
2175
2170
2176
end:
2171
2177
2172
2178
if(debug){
2173
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2179
fprintf(stderr, "Mandos plugin mandos-client: "
2180
"%s exiting\n", argv[0]);
2174
2181
}
2175
2182
2176
2183
/* Cleanup things */
2204
2211
}
2205
2212
}
2206
2213
2207
/* Re-raise priviliges */
2208
{
2214
/* XXX run network hooks "stop" here */
2215
2216
/* Take down the network interface */
2217
if(take_down_interface){
2218
/* Re-raise priviliges */
2209
2219
errno = 0;
2210
2220
ret = seteuid(0);
2211
2221
if(ret == -1){
2212
2222
perror_plus("seteuid");
2213
2223
}
2214
/* Run network hooks */
2215
if(not run_network_hooks("stop", interface, delay)){
2216
goto end;
2217
}
2218
2219
/* Take down the network interface */
2220
if(take_down_interface and geteuid() == 0){
2224
if(geteuid() == 0){
2221
2225
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2222
2226
if(ret == -1){
2223
2227
perror_plus("ioctl SIOCGIFFLAGS");
2232
2236
if(ret == -1){
2233
2237
perror_plus("close");
2234
2238
}
2239
/* Lower privileges permanently */
2240
errno = 0;
2241
ret = setuid(uid);
2242
if(ret == -1){
2243
perror_plus("setuid");
2244
}
2235
2245
}
2236
2246
}
2237
/* Lower privileges permanently */
2238
errno = 0;
2239
ret = setuid(uid);
2240
if(ret == -1){
2241
perror_plus("setuid");
2242
}
2243
2247
2244
2248
/* Removes the GPGME temp directory and all files inside */
2245
2249
if(tempdir_created){
2259
2263
}
2260
2264
ret = remove(fullname);
2261
2265
if(ret == -1){
2262
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2263
strerror(errno));
2266
fprintf(stderr, "Mandos plugin mandos-client: "
2267
"remove(\"%s\"): %s\n", fullname, strerror(errno));
2264
2268
}
2265
2269
free(fullname);
2266
2270
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0