250
255
rc = gpgme_data_new_from_fd(&pgp_data, fd);
251
256
if(rc != GPG_ERR_NO_ERROR){
252
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
257
fprintf(stderr, "Mandos plugin mandos-client: "
258
"bad gpgme_data_new_from_fd: %s: %s\n",
253
259
gpgme_strsource(rc), gpgme_strerror(rc));
257
263
rc = gpgme_op_import(mc.ctx, pgp_data);
258
264
if(rc != GPG_ERR_NO_ERROR){
259
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
265
fprintf(stderr, "Mandos plugin mandos-client: "
266
"bad gpgme_op_import: %s: %s\n",
260
267
gpgme_strsource(rc), gpgme_strerror(rc));
273
fprintf(stderr, "Initializing GPGME\n");
280
fprintf(stderr, "Mandos plugin mandos-client: "
281
"Initializing GPGME\n");
277
285
gpgme_check_version(NULL);
278
286
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
279
287
if(rc != GPG_ERR_NO_ERROR){
280
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
288
fprintf(stderr, "Mandos plugin mandos-client: "
289
"bad gpgme_engine_check_version: %s: %s\n",
281
290
gpgme_strsource(rc), gpgme_strerror(rc));
285
/* Set GPGME home directory for the OpenPGP engine only */
294
/* Set GPGME home directory for the OpenPGP engine only */
286
295
rc = gpgme_get_engine_info(&engine_info);
287
296
if(rc != GPG_ERR_NO_ERROR){
288
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
297
fprintf(stderr, "Mandos plugin mandos-client: "
298
"bad gpgme_get_engine_info: %s: %s\n",
289
299
gpgme_strsource(rc), gpgme_strerror(rc));
357
372
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
358
373
if(rc != GPG_ERR_NO_ERROR){
359
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
374
fprintf(stderr, "Mandos plugin mandos-client: "
375
"bad gpgme_op_decrypt: %s: %s\n",
360
376
gpgme_strsource(rc), gpgme_strerror(rc));
361
377
plaintext_length = -1;
363
379
gpgme_decrypt_result_t result;
364
380
result = gpgme_op_decrypt_result(mc.ctx);
365
381
if(result == NULL){
366
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
382
fprintf(stderr, "Mandos plugin mandos-client: "
383
"gpgme_op_decrypt_result failed\n");
368
fprintf(stderr, "Unsupported algorithm: %s\n",
385
fprintf(stderr, "Mandos plugin mandos-client: "
386
"Unsupported algorithm: %s\n",
369
387
result->unsupported_algorithm);
370
fprintf(stderr, "Wrong key usage: %u\n",
388
fprintf(stderr, "Mandos plugin mandos-client: "
389
"Wrong key usage: %u\n",
371
390
result->wrong_key_usage);
372
391
if(result->file_name != NULL){
373
fprintf(stderr, "File name: %s\n", result->file_name);
392
fprintf(stderr, "Mandos plugin mandos-client: "
393
"File name: %s\n", result->file_name);
375
395
gpgme_recipient_t recipient;
376
396
recipient = result->recipients;
377
397
while(recipient != NULL){
378
fprintf(stderr, "Public key algorithm: %s\n",
398
fprintf(stderr, "Mandos plugin mandos-client: "
399
"Public key algorithm: %s\n",
379
400
gpgme_pubkey_algo_name(recipient->pubkey_algo));
380
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
381
fprintf(stderr, "Secret key available: %s\n",
401
fprintf(stderr, "Mandos plugin mandos-client: "
402
"Key ID: %s\n", recipient->keyid);
403
fprintf(stderr, "Mandos plugin mandos-client: "
404
"Secret key available: %s\n",
382
405
recipient->status == GPG_ERR_NO_SECKEY
384
407
recipient = recipient->next;
500
527
GNUTLS_OPENPGP_FMT_BASE64);
501
528
if(ret != GNUTLS_E_SUCCESS){
530
"Mandos plugin mandos-client: "
503
531
"Error[%d] while reading the OpenPGP key pair ('%s',"
504
532
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
505
fprintf(stderr, "The GnuTLS error is: %s\n",
506
safer_gnutls_strerror(ret));
533
fprintf(stderr, "Mandos plugin mandos-client: "
534
"The GnuTLS error is: %s\n", safer_gnutls_strerror(ret));
510
538
/* GnuTLS server initialization */
511
539
ret = gnutls_dh_params_init(&mc.dh_params);
512
540
if(ret != GNUTLS_E_SUCCESS){
513
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
541
fprintf(stderr, "Mandos plugin mandos-client: "
542
"Error in GnuTLS DH parameter initialization:"
514
543
" %s\n", safer_gnutls_strerror(ret));
517
546
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
518
547
if(ret != GNUTLS_E_SUCCESS){
519
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
548
fprintf(stderr, "Mandos plugin mandos-client: "
549
"Error in GnuTLS prime generation: %s\n",
520
550
safer_gnutls_strerror(ret));
1084
1134
errno = old_errno;
1088
* This function determines if a directory entry in /sys/class/net
1089
* corresponds to an acceptable network device.
1090
* (This function is passed to scandir(3) as a filter function.)
1092
int good_interface(const struct dirent *if_entry){
1094
char *flagname = NULL;
1095
if(if_entry->d_name[0] == '.'){
1098
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
1101
perror_plus("asprintf");
1104
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1106
perror_plus("open");
1111
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1112
/* read line from flags_fd */
1113
ssize_t to_read = 2+(sizeof(ifreq_flags)*2)+1; /* "0x1003\n" */
1114
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1115
flagstring[(size_t)to_read] = '\0';
1116
if(flagstring == NULL){
1117
perror_plus("malloc");
1122
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1125
perror_plus("read");
1139
tmpmax = strtoimax(flagstring, &tmp, 0);
1140
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1141
and not (isspace(*tmp)))
1142
or tmpmax != (ifreq_flags)tmpmax){
1137
bool get_flags(const char *ifname, struct ifreq *ifr){
1140
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1142
perror_plus("socket");
1145
strcpy(ifr->ifr_name, ifname);
1146
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1144
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1145
flagstring, if_entry->d_name);
1149
perror_plus("ioctl SIOCGIFFLAGS");
1151
ifreq_flags flags = (ifreq_flags)tmpmax;
1156
bool good_flags(const char *ifname, const struct ifreq *ifr){
1152
1158
/* Reject the loopback device */
1153
if(flags & IFF_LOOPBACK){
1159
if(ifr->ifr_flags & IFF_LOOPBACK){
1155
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1161
fprintf(stderr, "Mandos plugin mandos-client: "
1162
"Rejecting loopback interface \"%s\"\n", ifname);
1160
1166
/* Accept point-to-point devices only if connect_to is specified */
1161
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1167
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1163
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1169
fprintf(stderr, "Mandos plugin mandos-client: "
1170
"Accepting point-to-point interface \"%s\"\n", ifname);
1168
1174
/* Otherwise, reject non-broadcast-capable devices */
1169
if(not (flags & IFF_BROADCAST)){
1175
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1171
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1177
fprintf(stderr, "Mandos plugin mandos-client: "
1178
"Rejecting non-broadcast interface \"%s\"\n", ifname);
1176
1182
/* Reject non-ARP interfaces (including dummy interfaces) */
1177
if(flags & IFF_NOARP){
1183
if(ifr->ifr_flags & IFF_NOARP){
1179
fprintf(stderr, "Rejecting non-ARP interface \"%s\"\n",
1185
fprintf(stderr, "Mandos plugin mandos-client: "
1186
"Rejecting non-ARP interface \"%s\"\n", ifname);
1184
1191
/* Accept this device */
1186
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1193
fprintf(stderr, "Mandos plugin mandos-client: "
1194
"Interface \"%s\" is good\n", ifname);
1200
* This function determines if a directory entry in /sys/class/net
1201
* corresponds to an acceptable network device.
1202
* (This function is passed to scandir(3) as a filter function.)
1204
int good_interface(const struct dirent *if_entry){
1205
if(if_entry->d_name[0] == '.'){
1210
if(not get_flags(if_entry->d_name, &ifr)){
1212
fprintf(stderr, "Mandos plugin mandos-client: "
1213
"Failed to get flags for interface \"%s\"\n",
1219
if(not good_flags(if_entry->d_name, &ifr)){
1226
* This function determines if a directory entry in /sys/class/net
1227
* corresponds to an acceptable network device which is up.
1228
* (This function is passed to scandir(3) as a filter function.)
1230
int up_interface(const struct dirent *if_entry){
1231
if(if_entry->d_name[0] == '.'){
1236
if(not get_flags(if_entry->d_name, &ifr)){
1238
fprintf(stderr, "Mandos plugin mandos-client: "
1239
"Failed to get flags for interface \"%s\"\n",
1245
/* Reject down interfaces */
1246
if(not (ifr.ifr_flags & IFF_UP)){
1248
fprintf(stderr, "Mandos plugin mandos-client: "
1249
"Rejecting down interface \"%s\"\n",
1255
/* Reject non-running interfaces */
1256
if(not (ifr.ifr_flags & IFF_RUNNING)){
1258
fprintf(stderr, "Mandos plugin mandos-client: "
1259
"Rejecting non-running interface \"%s\"\n",
1265
if(not good_flags(if_entry->d_name, &ifr)){
1282
/* Is this directory entry a runnable program? */
1283
int runnable_hook(const struct dirent *direntry){
1287
if((direntry->d_name)[0] == '\0'){
1292
/* Save pointer to last character */
1293
char *end = strchr(direntry->d_name, '\0')-1;
1300
if(((direntry->d_name)[0] == '#')
1302
/* Temporary #name# */
1306
/* XXX more rules here */
1308
char *fullname = NULL;
1309
ret = asprintf(&fullname, "%s/%s", hookdir,
1312
perror_plus("asprintf");
1316
ret = stat(fullname, &st);
1319
perror_plus("Could not stat plugin");
1323
if(not (S_ISREG(st.st_mode))){
1324
/* Not a regular file */
1327
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1328
/* Not executable */
1203
1334
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1205
1336
struct timespec now;
1206
1337
struct timespec waited_time;
1207
1338
intmax_t block_time;
1210
1341
if(mc.current_server == NULL){
1343
fprintf(stderr, "Mandos plugin mandos-client: "
1213
1344
"Wait until first server is found. No timeout!\n");
1215
1346
ret = avahi_simple_poll_iterate(s, -1);
1218
fprintf(stderr, "Check current_server if we should run it,"
1349
fprintf(stderr, "Mandos plugin mandos-client: "
1350
"Check current_server if we should run it,"
1221
1353
/* the current time */
1468
1610
perror_plus("seteuid");
1471
int seckey_fd = open(PATHDIR "/" SECKEY, O_RDONLY);
1472
if(seckey_fd == -1){
1473
perror_plus("open");
1475
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1477
perror_plus("fstat");
1613
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1614
int seckey_fd = open(seckey, O_RDONLY);
1615
if(seckey_fd == -1){
1616
perror_plus("open");
1479
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1480
ret = fchown(seckey_fd, uid, gid);
1482
perror_plus("fchown");
1618
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1620
perror_plus("fstat");
1622
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1623
ret = fchown(seckey_fd, uid, gid);
1625
perror_plus("fchown");
1629
TEMP_FAILURE_RETRY(close(seckey_fd));
1486
TEMP_FAILURE_RETRY(close(seckey_fd));
1489
int pubkey_fd = open(PATHDIR "/" PUBKEY, O_RDONLY);
1490
if(pubkey_fd == -1){
1491
perror_plus("open");
1493
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1495
perror_plus("fstat");
1633
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1634
int pubkey_fd = open(pubkey, O_RDONLY);
1635
if(pubkey_fd == -1){
1636
perror_plus("open");
1497
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1498
ret = fchown(pubkey_fd, uid, gid);
1500
perror_plus("fchown");
1638
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1640
perror_plus("fstat");
1642
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1643
ret = fchown(pubkey_fd, uid, gid);
1645
perror_plus("fchown");
1649
TEMP_FAILURE_RETRY(close(pubkey_fd));
1504
TEMP_FAILURE_RETRY(close(pubkey_fd));
1507
1653
/* Lower privileges */
1661
/* Find network hooks and run them */
1663
struct dirent **direntries;
1664
struct dirent *direntry;
1665
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1668
perror_plus("scandir");
1670
int devnull = open("/dev/null", O_RDONLY);
1671
for(int i = 0; i < numhooks; i++){
1672
direntry = direntries[0];
1673
char *fullname = NULL;
1674
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1676
perror_plus("asprintf");
1679
pid_t hook_pid = fork();
1682
dup2(devnull, STDIN_FILENO);
1684
dup2(STDERR_FILENO, STDOUT_FILENO);
1685
ret = setenv("DEVICE", interface, 1);
1687
perror_plus("setenv");
1690
ret = setenv("VERBOSE", debug ? "1" : "0", 1);
1692
perror_plus("setenv");
1695
ret = setenv("MODE", "start", 1);
1697
perror_plus("setenv");
1701
ret = asprintf(&delaystring, "%f", delay);
1703
perror_plus("asprintf");
1706
ret = setenv("DELAY", delaystring, 1);
1709
perror_plus("setenv");
1713
ret = execl(fullname, direntry->d_name, "start", NULL);
1714
perror_plus("execl");
1717
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1718
perror_plus("waitpid");
1722
if(WIFEXITED(status)){
1723
if(WEXITSTATUS(status) != 0){
1724
fprintf(stderr, "Mandos plugin mandos-client: "
1725
"Warning: network hook \"%s\" exited"
1726
" with status %d\n", direntry->d_name,
1727
WEXITSTATUS(status));
1731
} else if(WIFSIGNALED(status)){
1732
fprintf(stderr, "Mandos plugin mandos-client: "
1733
"Warning: network hook \"%s\" died by"
1734
" signal %d\n", direntry->d_name,
1739
fprintf(stderr, "Mandos plugin mandos-client: "
1740
"Warning: network hook \"%s\" crashed\n",
1516
1756
avahi_set_log_function(empty_log);
1519
1759
if(interface[0] == '\0'){
1520
1760
struct dirent **direntries;
1521
ret = scandir(sys_class_net, &direntries, good_interface,
1761
/* First look for interfaces that are up */
1762
ret = scandir(sys_class_net, &direntries, up_interface,
1765
/* No up interfaces, look for any good interfaces */
1767
ret = scandir(sys_class_net, &direntries, good_interface,
1524
/* Pick the first good interface */
1771
/* Pick the first interface returned */
1525
1772
interface = strdup(direntries[0]->d_name);
1527
fprintf(stderr, "Using interface \"%s\"\n", interface);
1774
fprintf(stderr, "Mandos plugin mandos-client: "
1775
"Using interface \"%s\"\n", interface);
1529
1777
if(interface == NULL){
1530
1778
perror_plus("malloc");