250
254
rc = gpgme_data_new_from_fd(&pgp_data, fd);
251
255
if(rc != GPG_ERR_NO_ERROR){
252
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
256
fprintf(stderr, "Mandos plugin mandos-client: "
257
"bad gpgme_data_new_from_fd: %s: %s\n",
253
258
gpgme_strsource(rc), gpgme_strerror(rc));
257
262
rc = gpgme_op_import(mc.ctx, pgp_data);
258
263
if(rc != GPG_ERR_NO_ERROR){
259
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
264
fprintf(stderr, "Mandos plugin mandos-client: "
265
"bad gpgme_op_import: %s: %s\n",
260
266
gpgme_strsource(rc), gpgme_strerror(rc));
273
fprintf(stderr, "Initializing GPGME\n");
279
fprintf(stderr, "Mandos plugin mandos-client: "
280
"Initializing GPGME\n");
277
284
gpgme_check_version(NULL);
278
285
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
279
286
if(rc != GPG_ERR_NO_ERROR){
280
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
287
fprintf(stderr, "Mandos plugin mandos-client: "
288
"bad gpgme_engine_check_version: %s: %s\n",
281
289
gpgme_strsource(rc), gpgme_strerror(rc));
285
/* Set GPGME home directory for the OpenPGP engine only */
293
/* Set GPGME home directory for the OpenPGP engine only */
286
294
rc = gpgme_get_engine_info(&engine_info);
287
295
if(rc != GPG_ERR_NO_ERROR){
288
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
296
fprintf(stderr, "Mandos plugin mandos-client: "
297
"bad gpgme_get_engine_info: %s: %s\n",
289
298
gpgme_strsource(rc), gpgme_strerror(rc));
357
371
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
358
372
if(rc != GPG_ERR_NO_ERROR){
359
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
373
fprintf(stderr, "Mandos plugin mandos-client: "
374
"bad gpgme_op_decrypt: %s: %s\n",
360
375
gpgme_strsource(rc), gpgme_strerror(rc));
361
376
plaintext_length = -1;
363
378
gpgme_decrypt_result_t result;
364
379
result = gpgme_op_decrypt_result(mc.ctx);
365
380
if(result == NULL){
366
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
381
fprintf(stderr, "Mandos plugin mandos-client: "
382
"gpgme_op_decrypt_result failed\n");
368
fprintf(stderr, "Unsupported algorithm: %s\n",
384
fprintf(stderr, "Mandos plugin mandos-client: "
385
"Unsupported algorithm: %s\n",
369
386
result->unsupported_algorithm);
370
fprintf(stderr, "Wrong key usage: %u\n",
387
fprintf(stderr, "Mandos plugin mandos-client: "
388
"Wrong key usage: %u\n",
371
389
result->wrong_key_usage);
372
390
if(result->file_name != NULL){
373
fprintf(stderr, "File name: %s\n", result->file_name);
391
fprintf(stderr, "Mandos plugin mandos-client: "
392
"File name: %s\n", result->file_name);
375
394
gpgme_recipient_t recipient;
376
395
recipient = result->recipients;
377
396
while(recipient != NULL){
378
fprintf(stderr, "Public key algorithm: %s\n",
397
fprintf(stderr, "Mandos plugin mandos-client: "
398
"Public key algorithm: %s\n",
379
399
gpgme_pubkey_algo_name(recipient->pubkey_algo));
380
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
381
fprintf(stderr, "Secret key available: %s\n",
400
fprintf(stderr, "Mandos plugin mandos-client: "
401
"Key ID: %s\n", recipient->keyid);
402
fprintf(stderr, "Mandos plugin mandos-client: "
403
"Secret key available: %s\n",
382
404
recipient->status == GPG_ERR_NO_SECKEY
384
406
recipient = recipient->next;
500
526
GNUTLS_OPENPGP_FMT_BASE64);
501
527
if(ret != GNUTLS_E_SUCCESS){
529
"Mandos plugin mandos-client: "
503
530
"Error[%d] while reading the OpenPGP key pair ('%s',"
504
531
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
505
fprintf(stderr, "The GnuTLS error is: %s\n",
506
safer_gnutls_strerror(ret));
532
fprintf(stderr, "Mandos plugin mandos-client: "
533
"The GnuTLS error is: %s\n", safer_gnutls_strerror(ret));
510
537
/* GnuTLS server initialization */
511
538
ret = gnutls_dh_params_init(&mc.dh_params);
512
539
if(ret != GNUTLS_E_SUCCESS){
513
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
540
fprintf(stderr, "Mandos plugin mandos-client: "
541
"Error in GnuTLS DH parameter initialization:"
514
542
" %s\n", safer_gnutls_strerror(ret));
517
545
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
518
546
if(ret != GNUTLS_E_SUCCESS){
519
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
547
fprintf(stderr, "Mandos plugin mandos-client: "
548
"Error in GnuTLS prime generation: %s\n",
520
549
safer_gnutls_strerror(ret));
1084
1132
errno = old_errno;
1088
* This function determines if a directory entry in /sys/class/net
1089
* corresponds to an acceptable network device.
1090
* (This function is passed to scandir(3) as a filter function.)
1092
int good_interface(const struct dirent *if_entry){
1094
char *flagname = NULL;
1095
if(if_entry->d_name[0] == '.'){
1098
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
1101
perror_plus("asprintf");
1104
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1106
perror_plus("open");
1111
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1112
/* read line from flags_fd */
1113
ssize_t to_read = 2+(sizeof(ifreq_flags)*2)+1; /* "0x1003\n" */
1114
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1115
flagstring[(size_t)to_read] = '\0';
1116
if(flagstring == NULL){
1117
perror_plus("malloc");
1122
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1125
perror_plus("read");
1139
tmpmax = strtoimax(flagstring, &tmp, 0);
1140
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1141
and not (isspace(*tmp)))
1142
or tmpmax != (ifreq_flags)tmpmax){
1135
bool get_flags(const char *ifname, struct ifreq *ifr){
1138
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1140
perror_plus("socket");
1143
strcpy(ifr->ifr_name, ifname);
1144
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1144
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1145
flagstring, if_entry->d_name);
1147
perror_plus("ioctl SIOCGIFFLAGS");
1151
ifreq_flags flags = (ifreq_flags)tmpmax;
1154
bool good_flags(const char *ifname, const struct ifreq *ifr){
1152
1156
/* Reject the loopback device */
1153
if(flags & IFF_LOOPBACK){
1157
if(ifr->ifr_flags & IFF_LOOPBACK){
1155
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1159
fprintf(stderr, "Mandos plugin mandos-client: "
1160
"Rejecting loopback interface \"%s\"\n", ifname);
1160
1164
/* Accept point-to-point devices only if connect_to is specified */
1161
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1165
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1163
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1167
fprintf(stderr, "Mandos plugin mandos-client: "
1168
"Accepting point-to-point interface \"%s\"\n", ifname);
1168
1172
/* Otherwise, reject non-broadcast-capable devices */
1169
if(not (flags & IFF_BROADCAST)){
1173
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1171
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1175
fprintf(stderr, "Mandos plugin mandos-client: "
1176
"Rejecting non-broadcast interface \"%s\"\n", ifname);
1176
1180
/* Reject non-ARP interfaces (including dummy interfaces) */
1177
if(flags & IFF_NOARP){
1181
if(ifr->ifr_flags & IFF_NOARP){
1179
fprintf(stderr, "Rejecting non-ARP interface \"%s\"\n",
1183
fprintf(stderr, "Mandos plugin mandos-client: "
1184
"Rejecting non-ARP interface \"%s\"\n", ifname);
1184
1189
/* Accept this device */
1186
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1191
fprintf(stderr, "Mandos plugin mandos-client: "
1192
"Interface \"%s\" is good\n", ifname);
1198
* This function determines if a directory entry in /sys/class/net
1199
* corresponds to an acceptable network device.
1200
* (This function is passed to scandir(3) as a filter function.)
1202
int good_interface(const struct dirent *if_entry){
1203
if(if_entry->d_name[0] == '.'){
1208
if(not get_flags(if_entry->d_name, &ifr)){
1210
fprintf(stderr, "Mandos plugin mandos-client: "
1211
"Failed to get flags for interface \"%s\"\n",
1217
if(not good_flags(if_entry->d_name, &ifr)){
1224
* This function determines if a directory entry in /sys/class/net
1225
* corresponds to an acceptable network device which is up.
1226
* (This function is passed to scandir(3) as a filter function.)
1228
int up_interface(const struct dirent *if_entry){
1229
if(if_entry->d_name[0] == '.'){
1234
if(not get_flags(if_entry->d_name, &ifr)){
1236
fprintf(stderr, "Mandos plugin mandos-client: "
1237
"Failed to get flags for interface \"%s\"\n",
1243
/* Reject down interfaces */
1244
if(not (ifr.ifr_flags & IFF_UP)){
1246
fprintf(stderr, "Mandos plugin mandos-client: "
1247
"Rejecting down interface \"%s\"\n",
1253
/* Reject non-running interfaces */
1254
if(not (ifr.ifr_flags & IFF_RUNNING)){
1256
fprintf(stderr, "Mandos plugin mandos-client: "
1257
"Rejecting non-running interface \"%s\"\n",
1263
if(not good_flags(if_entry->d_name, &ifr)){
1280
/* Is this directory entry a runnable program? */
1281
int runnable_hook(const struct dirent *direntry){
1286
if((direntry->d_name)[0] == '\0'){
1291
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1292
"abcdefghijklmnopqrstuvwxyz"
1295
if((direntry->d_name)[sret] != '\0'){
1296
/* Contains non-allowed characters */
1298
fprintf(stderr, "Mandos plugin mandos-client: "
1299
"Ignoring hook \"%s\" with bad name\n",
1305
char *fullname = NULL;
1306
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1308
perror_plus("asprintf");
1312
ret = stat(fullname, &st);
1315
perror_plus("Could not stat hook");
1319
if(not (S_ISREG(st.st_mode))){
1320
/* Not a regular file */
1322
fprintf(stderr, "Mandos plugin mandos-client: "
1323
"Ignoring hook \"%s\" - not a file\n",
1328
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1329
/* Not executable */
1331
fprintf(stderr, "Mandos plugin mandos-client: "
1332
"Ignoring hook \"%s\" - not executable\n",
1203
1340
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1205
1342
struct timespec now;
1206
1343
struct timespec waited_time;
1207
1344
intmax_t block_time;
1210
1347
if(mc.current_server == NULL){
1349
fprintf(stderr, "Mandos plugin mandos-client: "
1213
1350
"Wait until first server is found. No timeout!\n");
1215
1352
ret = avahi_simple_poll_iterate(s, -1);
1218
fprintf(stderr, "Check current_server if we should run it,"
1355
fprintf(stderr, "Mandos plugin mandos-client: "
1356
"Check current_server if we should run it,"
1221
1359
/* the current time */
1468
1616
perror_plus("seteuid");
1471
int seckey_fd = open(PATHDIR "/" SECKEY, O_RDONLY);
1472
if(seckey_fd == -1){
1473
perror_plus("open");
1475
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1477
perror_plus("fstat");
1619
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1620
int seckey_fd = open(seckey, O_RDONLY);
1621
if(seckey_fd == -1){
1622
perror_plus("open");
1479
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1480
ret = fchown(seckey_fd, uid, gid);
1482
perror_plus("fchown");
1624
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1626
perror_plus("fstat");
1628
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1629
ret = fchown(seckey_fd, uid, gid);
1631
perror_plus("fchown");
1635
TEMP_FAILURE_RETRY(close(seckey_fd));
1486
TEMP_FAILURE_RETRY(close(seckey_fd));
1489
int pubkey_fd = open(PATHDIR "/" PUBKEY, O_RDONLY);
1490
if(pubkey_fd == -1){
1491
perror_plus("open");
1493
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1495
perror_plus("fstat");
1639
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1640
int pubkey_fd = open(pubkey, O_RDONLY);
1641
if(pubkey_fd == -1){
1642
perror_plus("open");
1497
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1498
ret = fchown(pubkey_fd, uid, gid);
1500
perror_plus("fchown");
1644
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1646
perror_plus("fstat");
1648
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1649
ret = fchown(pubkey_fd, uid, gid);
1651
perror_plus("fchown");
1655
TEMP_FAILURE_RETRY(close(pubkey_fd));
1504
TEMP_FAILURE_RETRY(close(pubkey_fd));
1507
1659
/* Lower privileges */
1667
/* Find network hooks and run them */
1669
struct dirent **direntries;
1670
struct dirent *direntry;
1671
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1674
perror_plus("scandir");
1676
int devnull = open("/dev/null", O_RDONLY);
1677
for(int i = 0; i < numhooks; i++){
1678
direntry = direntries[0];
1679
char *fullname = NULL;
1680
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1682
perror_plus("asprintf");
1685
pid_t hook_pid = fork();
1688
dup2(devnull, STDIN_FILENO);
1690
dup2(STDERR_FILENO, STDOUT_FILENO);
1691
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1693
perror_plus("setenv");
1696
ret = setenv("DEVICE", interface, 1);
1698
perror_plus("setenv");
1701
ret = setenv("VERBOSE", debug ? "1" : "0", 1);
1703
perror_plus("setenv");
1706
ret = setenv("MODE", "start", 1);
1708
perror_plus("setenv");
1712
ret = asprintf(&delaystring, "%f", delay);
1714
perror_plus("asprintf");
1717
ret = setenv("DELAY", delaystring, 1);
1720
perror_plus("setenv");
1724
ret = execl(fullname, direntry->d_name, "start", NULL);
1725
perror_plus("execl");
1728
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1729
perror_plus("waitpid");
1733
if(WIFEXITED(status)){
1734
if(WEXITSTATUS(status) != 0){
1735
fprintf(stderr, "Mandos plugin mandos-client: "
1736
"Warning: network hook \"%s\" exited"
1737
" with status %d\n", direntry->d_name,
1738
WEXITSTATUS(status));
1742
} else if(WIFSIGNALED(status)){
1743
fprintf(stderr, "Mandos plugin mandos-client: "
1744
"Warning: network hook \"%s\" died by"
1745
" signal %d\n", direntry->d_name,
1750
fprintf(stderr, "Mandos plugin mandos-client: "
1751
"Warning: network hook \"%s\" crashed\n",
1516
1767
avahi_set_log_function(empty_log);
1519
1770
if(interface[0] == '\0'){
1520
1771
struct dirent **direntries;
1521
ret = scandir(sys_class_net, &direntries, good_interface,
1772
/* First look for interfaces that are up */
1773
ret = scandir(sys_class_net, &direntries, up_interface,
1776
/* No up interfaces, look for any good interfaces */
1778
ret = scandir(sys_class_net, &direntries, good_interface,
1524
/* Pick the first good interface */
1782
/* Pick the first interface returned */
1525
1783
interface = strdup(direntries[0]->d_name);
1527
fprintf(stderr, "Using interface \"%s\"\n", interface);
1785
fprintf(stderr, "Mandos plugin mandos-client: "
1786
"Using interface \"%s\"\n", interface);
1529
1788
if(interface == NULL){
1530
1789
perror_plus("malloc");