To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 541
- compare with another revision
- download diff
- download tarball
- view history from revision 541
- Committer: Teddy Hogeborn
- Date: 2011-12-31 20:07:11 UTC
- mfrom: (535.1.9 wireless-network-hook)
- Revision ID: teddy@recompile.se-20111231200711-6dli3r8drftem57r
Merge new wireless network hook. Fix bridge network hook to use
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
- files added:
- DBUS-API
- debian/source
- network-hooks.d
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
12
* Copyright © 2008-2011 Teddy Hogeborn
13
* Copyright © 2008-2011 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
26
26
* along with this program. If not, see
27
27
* <http://www.gnu.org/licenses/>.
28
28
*
29
* Contact the authors at <mandos@fukt.bsnet.se>.
29
* Contact the authors at <mandos@recompile.se>.
30
30
*/
31
31
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
43
43
stdout, ferror(), remove() */
44
44
#include <stdint.h> /* uint16_t, uint32_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof(), abort() */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
strtof(), abort() */
48
48
#include <stdbool.h> /* bool, false, true */
49
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
50
strerror(), asprintf(), strcpy() */
53
53
sockaddr_in6, PF_INET6,
54
54
SOCK_STREAM, uid_t, gid_t, open(),
55
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
56
#include <sys/stat.h> /* open(), S_ISREG */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
58
inet_pton(), connect() */
59
59
#include <fcntl.h> /* open() */
62
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
63
strtoimax() */
64
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
65
#include <errno.h> /* perror(), errno,
66
program_invocation_short_name */
67
#include <time.h> /* nanosleep(), time(), sleep() */
67
68
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
69
SIOCSIFFLAGS, if_indextoname(),
69
70
if_nametoindex(), IF_NAMESIZE */
72
73
*/
73
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
75
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
76
setgid(), pause(), _exit() */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
77
78
#include <iso646.h> /* not, or, and */
78
79
#include <argp.h> /* struct argp_option, error_t, struct
79
80
argp_state, struct argp,
82
83
#include <signal.h> /* sigemptyset(), sigaddset(),
83
84
sigaction(), SIGTERM, sig_atomic_t,
84
85
raise() */
85
#include <sysexits.h> /* EX_OSERR, EX_USAGE */
86
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
87
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
89
WEXITSTATUS(), WTERMSIG() */
90
#include <grp.h> /* setgroups() */
86
91
87
92
#ifdef __linux__
88
93
#include <sys/klog.h> /* klogctl() */
106
111
init_gnutls_session(),
107
112
GNUTLS_* */
108
113
#include <gnutls/openpgp.h>
109
/* gnutls_certificate_set_openpgp_key_file(),
110
GNUTLS_OPENPGP_FMT_BASE64 */
114
/* gnutls_certificate_set_openpgp_key_file(),
115
GNUTLS_OPENPGP_FMT_BASE64 */
111
116
112
117
/* GPGME */
113
118
#include <gpgme.h> /* All GPGME types, constants and
121
126
#define PATHDIR "/conf/conf.d/mandos"
122
127
#define SECKEY "seckey.txt"
123
128
#define PUBKEY "pubkey.txt"
129
#define HOOKDIR "/lib/mandos/network-hooks.d"
124
130
125
131
bool debug = false;
126
132
static const char mandos_protocol_version[] = "1";
127
133
const char *argp_program_version = "mandos-client " VERSION;
128
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
134
const char *argp_program_bug_address = "<mandos@recompile.se>";
135
static const char sys_class_net[] = "/sys/class/net";
136
char *connect_to = NULL;
137
const char *hookdir = HOOKDIR;
138
139
/* Doubly linked list that need to be circularly linked when used */
140
typedef struct server{
141
const char *ip;
142
uint16_t port;
143
AvahiIfIndex if_index;
144
int af;
145
struct timespec last_seen;
146
struct server *next;
147
struct server *prev;
148
} server;
129
149
130
150
/* Used for passing in values through the Avahi callback functions */
131
151
typedef struct {
136
156
gnutls_dh_params_t dh_params;
137
157
const char *priority;
138
158
gpgme_ctx_t ctx;
159
server *current_server;
139
160
} mandos_context;
140
161
141
162
/* global context so signal handler can reach it*/
142
163
mandos_context mc = { .simple_poll = NULL, .server = NULL,
143
164
.dh_bits = 1024, .priority = "SECURE256"
144
":!CTYPE-X.509:+CTYPE-OPENPGP" };
165
":!CTYPE-X.509:+CTYPE-OPENPGP",
166
.current_server = NULL };
145
167
146
168
sig_atomic_t quit_now = 0;
147
169
int signal_received = 0;
148
170
171
/* Function to use when printing errors */
172
void perror_plus(const char *print_text){
173
int e = errno;
174
fprintf(stderr, "Mandos plugin %s: ",
175
program_invocation_short_name);
176
errno = e;
177
perror(print_text);
178
}
179
180
__attribute__((format (gnu_printf, 2, 3)))
181
int fprintf_plus(FILE *stream, const char *format, ...){
182
va_list ap;
183
va_start (ap, format);
184
185
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
186
program_invocation_short_name));
187
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
188
}
189
149
190
/*
150
191
* Make additional room in "buffer" for at least BUFFER_SIZE more
151
192
* bytes. "buffer_capacity" is how much is currently allocated,
152
193
* "buffer_length" is how much is already used.
153
194
*/
154
195
size_t incbuffer(char **buffer, size_t buffer_length,
155
size_t buffer_capacity){
196
size_t buffer_capacity){
156
197
if(buffer_length + BUFFER_SIZE > buffer_capacity){
157
198
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
158
199
if(buffer == NULL){
163
204
return buffer_capacity;
164
205
}
165
206
207
/* Add server to set of servers to retry periodically */
208
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
209
int af){
210
int ret;
211
server *new_server = malloc(sizeof(server));
212
if(new_server == NULL){
213
perror_plus("malloc");
214
return false;
215
}
216
*new_server = (server){ .ip = strdup(ip),
217
.port = port,
218
.if_index = if_index,
219
.af = af };
220
if(new_server->ip == NULL){
221
perror_plus("strdup");
222
return false;
223
}
224
/* Special case of first server */
225
if (mc.current_server == NULL){
226
new_server->next = new_server;
227
new_server->prev = new_server;
228
mc.current_server = new_server;
229
/* Place the new server last in the list */
230
} else {
231
new_server->next = mc.current_server;
232
new_server->prev = mc.current_server->prev;
233
new_server->prev->next = new_server;
234
mc.current_server->prev = new_server;
235
}
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
237
if(ret == -1){
238
perror_plus("clock_gettime");
239
return false;
240
}
241
return true;
242
}
243
166
244
/*
167
245
* Initialize GPGME.
168
246
*/
169
static bool init_gpgme(const char *seckey,
170
const char *pubkey, const char *tempdir){
247
static bool init_gpgme(const char *seckey, const char *pubkey,
248
const char *tempdir){
171
249
gpgme_error_t rc;
172
250
gpgme_engine_info_t engine_info;
173
251
182
260
183
261
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
184
262
if(fd == -1){
185
perror("open");
263
perror_plus("open");
186
264
return false;
187
265
}
188
266
189
267
rc = gpgme_data_new_from_fd(&pgp_data, fd);
190
268
if(rc != GPG_ERR_NO_ERROR){
191
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
192
gpgme_strsource(rc), gpgme_strerror(rc));
269
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
270
gpgme_strsource(rc), gpgme_strerror(rc));
193
271
return false;
194
272
}
195
273
196
274
rc = gpgme_op_import(mc.ctx, pgp_data);
197
275
if(rc != GPG_ERR_NO_ERROR){
198
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
199
gpgme_strsource(rc), gpgme_strerror(rc));
276
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
277
gpgme_strsource(rc), gpgme_strerror(rc));
200
278
return false;
201
279
}
202
280
203
281
ret = (int)TEMP_FAILURE_RETRY(close(fd));
204
282
if(ret == -1){
205
perror("close");
283
perror_plus("close");
206
284
}
207
285
gpgme_data_release(pgp_data);
208
286
return true;
209
287
}
210
288
211
289
if(debug){
212
fprintf(stderr, "Initializing GPGME\n");
290
fprintf_plus(stderr, "Initializing GPGME\n");
213
291
}
214
292
215
293
/* Init GPGME */
216
294
gpgme_check_version(NULL);
217
295
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
218
296
if(rc != GPG_ERR_NO_ERROR){
219
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
220
gpgme_strsource(rc), gpgme_strerror(rc));
297
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
298
gpgme_strsource(rc), gpgme_strerror(rc));
221
299
return false;
222
300
}
223
301
224
/* Set GPGME home directory for the OpenPGP engine only */
302
/* Set GPGME home directory for the OpenPGP engine only */
225
303
rc = gpgme_get_engine_info(&engine_info);
226
304
if(rc != GPG_ERR_NO_ERROR){
227
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
228
gpgme_strsource(rc), gpgme_strerror(rc));
305
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
306
gpgme_strsource(rc), gpgme_strerror(rc));
229
307
return false;
230
308
}
231
309
while(engine_info != NULL){
237
315
engine_info = engine_info->next;
238
316
}
239
317
if(engine_info == NULL){
240
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
318
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
319
tempdir);
241
320
return false;
242
321
}
243
322
244
323
/* Create new GPGME "context" */
245
324
rc = gpgme_new(&(mc.ctx));
246
325
if(rc != GPG_ERR_NO_ERROR){
247
fprintf(stderr, "bad gpgme_new: %s: %s\n",
248
gpgme_strsource(rc), gpgme_strerror(rc));
326
fprintf_plus(stderr, "Mandos plugin mandos-client: "
327
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
328
gpgme_strerror(rc));
249
329
return false;
250
330
}
251
331
270
350
ssize_t plaintext_length = 0;
271
351
272
352
if(debug){
273
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
353
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
274
354
}
275
355
276
356
/* Create new GPGME data buffer from memory cryptotext */
277
357
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
278
358
0);
279
359
if(rc != GPG_ERR_NO_ERROR){
280
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
281
gpgme_strsource(rc), gpgme_strerror(rc));
360
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
361
gpgme_strsource(rc), gpgme_strerror(rc));
282
362
return -1;
283
363
}
284
364
285
365
/* Create new empty GPGME data buffer for the plaintext */
286
366
rc = gpgme_data_new(&dh_plain);
287
367
if(rc != GPG_ERR_NO_ERROR){
288
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
289
gpgme_strsource(rc), gpgme_strerror(rc));
368
fprintf_plus(stderr, "Mandos plugin mandos-client: "
369
"bad gpgme_data_new: %s: %s\n",
370
gpgme_strsource(rc), gpgme_strerror(rc));
290
371
gpgme_data_release(dh_crypto);
291
372
return -1;
292
373
}
295
376
data buffer */
296
377
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
297
378
if(rc != GPG_ERR_NO_ERROR){
298
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
299
gpgme_strsource(rc), gpgme_strerror(rc));
379
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
380
gpgme_strsource(rc), gpgme_strerror(rc));
300
381
plaintext_length = -1;
301
382
if(debug){
302
383
gpgme_decrypt_result_t result;
303
384
result = gpgme_op_decrypt_result(mc.ctx);
304
385
if(result == NULL){
305
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
386
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
306
387
} else {
307
fprintf(stderr, "Unsupported algorithm: %s\n",
308
result->unsupported_algorithm);
309
fprintf(stderr, "Wrong key usage: %u\n",
310
result->wrong_key_usage);
388
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
389
result->unsupported_algorithm);
390
fprintf_plus(stderr, "Wrong key usage: %u\n",
391
result->wrong_key_usage);
311
392
if(result->file_name != NULL){
312
fprintf(stderr, "File name: %s\n", result->file_name);
393
fprintf_plus(stderr, "File name: %s\n", result->file_name);
313
394
}
314
395
gpgme_recipient_t recipient;
315
396
recipient = result->recipients;
316
397
while(recipient != NULL){
317
fprintf(stderr, "Public key algorithm: %s\n",
318
gpgme_pubkey_algo_name(recipient->pubkey_algo));
319
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
320
fprintf(stderr, "Secret key available: %s\n",
321
recipient->status == GPG_ERR_NO_SECKEY
322
? "No" : "Yes");
398
fprintf_plus(stderr, "Public key algorithm: %s\n",
399
gpgme_pubkey_algo_name
400
(recipient->pubkey_algo));
401
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
402
fprintf_plus(stderr, "Secret key available: %s\n",
403
recipient->status == GPG_ERR_NO_SECKEY
404
? "No" : "Yes");
323
405
recipient = recipient->next;
324
406
}
325
407
}
328
410
}
329
411
330
412
if(debug){
331
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
413
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
332
414
}
333
415
334
416
/* Seek back to the beginning of the GPGME plaintext data buffer */
335
417
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
336
perror("gpgme_data_seek");
418
perror_plus("gpgme_data_seek");
337
419
plaintext_length = -1;
338
420
goto decrypt_end;
339
421
}
341
423
*plaintext = NULL;
342
424
while(true){
343
425
plaintext_capacity = incbuffer(plaintext,
344
(size_t)plaintext_length,
345
plaintext_capacity);
426
(size_t)plaintext_length,
427
plaintext_capacity);
346
428
if(plaintext_capacity == 0){
347
perror("incbuffer");
348
plaintext_length = -1;
349
goto decrypt_end;
429
perror_plus("incbuffer");
430
plaintext_length = -1;
431
goto decrypt_end;
350
432
}
351
433
352
434
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
357
439
break;
358
440
}
359
441
if(ret < 0){
360
perror("gpgme_data_read");
442
perror_plus("gpgme_data_read");
361
443
plaintext_length = -1;
362
444
goto decrypt_end;
363
445
}
365
447
}
366
448
367
449
if(debug){
368
fprintf(stderr, "Decrypted password is: ");
450
fprintf_plus(stderr, "Decrypted password is: ");
369
451
for(ssize_t i = 0; i < plaintext_length; i++){
370
452
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
371
453
}
393
475
/* GnuTLS log function callback */
394
476
static void debuggnutls(__attribute__((unused)) int level,
395
477
const char* string){
396
fprintf(stderr, "GnuTLS: %s", string);
478
fprintf_plus(stderr, "GnuTLS: %s", string);
397
479
}
398
480
399
481
static int init_gnutls_global(const char *pubkeyfilename,
401
483
int ret;
402
484
403
485
if(debug){
404
fprintf(stderr, "Initializing GnuTLS\n");
486
fprintf_plus(stderr, "Initializing GnuTLS\n");
405
487
}
406
488
407
489
ret = gnutls_global_init();
408
490
if(ret != GNUTLS_E_SUCCESS){
409
fprintf(stderr, "GnuTLS global_init: %s\n",
410
safer_gnutls_strerror(ret));
491
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
492
safer_gnutls_strerror(ret));
411
493
return -1;
412
494
}
413
495
420
502
}
421
503
422
504
/* OpenPGP credentials */
423
gnutls_certificate_allocate_credentials(&mc.cred);
505
ret = gnutls_certificate_allocate_credentials(&mc.cred);
424
506
if(ret != GNUTLS_E_SUCCESS){
425
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
426
from
427
-Wunreachable-code
428
*/
429
safer_gnutls_strerror(ret));
507
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
508
safer_gnutls_strerror(ret));
430
509
gnutls_global_deinit();
431
510
return -1;
432
511
}
433
512
434
513
if(debug){
435
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
436
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
437
seckeyfilename);
514
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
515
" secret key %s as GnuTLS credentials\n",
516
pubkeyfilename,
517
seckeyfilename);
438
518
}
439
519
440
520
ret = gnutls_certificate_set_openpgp_key_file
441
521
(mc.cred, pubkeyfilename, seckeyfilename,
442
522
GNUTLS_OPENPGP_FMT_BASE64);
443
523
if(ret != GNUTLS_E_SUCCESS){
444
fprintf(stderr,
445
"Error[%d] while reading the OpenPGP key pair ('%s',"
446
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
447
fprintf(stderr, "The GnuTLS error is: %s\n",
448
safer_gnutls_strerror(ret));
524
fprintf_plus(stderr,
525
"Error[%d] while reading the OpenPGP key pair ('%s',"
526
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
527
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
528
safer_gnutls_strerror(ret));
449
529
goto globalfail;
450
530
}
451
531
452
532
/* GnuTLS server initialization */
453
533
ret = gnutls_dh_params_init(&mc.dh_params);
454
534
if(ret != GNUTLS_E_SUCCESS){
455
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
456
" %s\n", safer_gnutls_strerror(ret));
535
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
536
" initialization: %s\n",
537
safer_gnutls_strerror(ret));
457
538
goto globalfail;
458
539
}
459
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
460
541
if(ret != GNUTLS_E_SUCCESS){
461
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
462
safer_gnutls_strerror(ret));
542
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
543
safer_gnutls_strerror(ret));
463
544
goto globalfail;
464
545
}
465
546
485
566
}
486
567
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
487
568
if(ret != GNUTLS_E_SUCCESS){
488
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
489
safer_gnutls_strerror(ret));
569
fprintf_plus(stderr,
570
"Error in GnuTLS session initialization: %s\n",
571
safer_gnutls_strerror(ret));
490
572
}
491
573
492
574
{
499
581
}
500
582
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
501
583
if(ret != GNUTLS_E_SUCCESS){
502
fprintf(stderr, "Syntax error at: %s\n", err);
503
fprintf(stderr, "GnuTLS error: %s\n",
504
safer_gnutls_strerror(ret));
584
fprintf_plus(stderr, "Syntax error at: %s\n", err);
585
fprintf_plus(stderr, "GnuTLS error: %s\n",
586
safer_gnutls_strerror(ret));
505
587
gnutls_deinit(*session);
506
588
return -1;
507
589
}
516
598
}
517
599
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
518
600
if(ret != GNUTLS_E_SUCCESS){
519
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
520
safer_gnutls_strerror(ret));
601
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
602
safer_gnutls_strerror(ret));
521
603
gnutls_deinit(*session);
522
604
return -1;
523
605
}
553
635
gnutls_session_t session;
554
636
int pf; /* Protocol family */
555
637
638
errno = 0;
639
556
640
if(quit_now){
641
errno = EINTR;
557
642
return -1;
558
643
}
559
644
565
650
pf = PF_INET;
566
651
break;
567
652
default:
568
fprintf(stderr, "Bad address family: %d\n", af);
653
fprintf_plus(stderr, "Bad address family: %d\n", af);
654
errno = EINVAL;
569
655
return -1;
570
656
}
571
657
575
661
}
576
662
577
663
if(debug){
578
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
579
"\n", ip, port);
664
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
665
PRIu16 "\n", ip, port);
580
666
}
581
667
582
668
tcp_sd = socket(pf, SOCK_STREAM, 0);
583
669
if(tcp_sd < 0){
584
perror("socket");
670
int e = errno;
671
perror_plus("socket");
672
errno = e;
585
673
goto mandos_end;
586
674
}
587
675
588
676
if(quit_now){
677
errno = EINTR;
589
678
goto mandos_end;
590
679
}
591
680
598
687
ret = inet_pton(af, ip, &to.in.sin_addr);
599
688
}
600
689
if(ret < 0 ){
601
perror("inet_pton");
690
int e = errno;
691
perror_plus("inet_pton");
692
errno = e;
602
693
goto mandos_end;
603
694
}
604
695
if(ret == 0){
605
fprintf(stderr, "Bad address: %s\n", ip);
696
int e = errno;
697
fprintf_plus(stderr, "Bad address: %s\n", ip);
698
errno = e;
606
699
goto mandos_end;
607
700
}
608
701
if(af == AF_INET6){
612
705
613
706
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
614
707
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
615
-Wunreachable-code*/
708
-Wunreachable-code*/
616
709
if(if_index == AVAHI_IF_UNSPEC){
617
fprintf(stderr, "An IPv6 link-local address is incomplete"
618
" without a network interface\n");
710
fprintf_plus(stderr, "An IPv6 link-local address is"
711
" incomplete without a network interface\n");
712
errno = EINVAL;
619
713
goto mandos_end;
620
714
}
621
715
/* Set the network interface number as scope */
628
722
}
629
723
630
724
if(quit_now){
725
errno = EINTR;
631
726
goto mandos_end;
632
727
}
633
728
635
730
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
636
731
char interface[IF_NAMESIZE];
637
732
if(if_indextoname((unsigned int)if_index, interface) == NULL){
638
perror("if_indextoname");
733
perror_plus("if_indextoname");
639
734
} else {
640
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
641
ip, interface, port);
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
642
737
}
643
738
} else {
644
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
645
port);
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
740
ip, port);
646
741
}
647
742
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
648
743
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
655
750
sizeof(addrstr));
656
751
}
657
752
if(pcret == NULL){
658
perror("inet_ntop");
753
perror_plus("inet_ntop");
659
754
} else {
660
755
if(strcmp(addrstr, ip) != 0){
661
fprintf(stderr, "Canonical address form: %s\n", addrstr);
756
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
662
757
}
663
758
}
664
759
}
665
760
666
761
if(quit_now){
762
errno = EINTR;
667
763
goto mandos_end;
668
764
}
669
765
673
769
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
674
770
}
675
771
if(ret < 0){
676
perror("connect");
772
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
773
int e = errno;
774
perror_plus("connect");
775
errno = e;
776
}
677
777
goto mandos_end;
678
778
}
679
779
680
780
if(quit_now){
781
errno = EINTR;
681
782
goto mandos_end;
682
783
}
683
784
686
787
while(true){
687
788
size_t out_size = strlen(out);
688
789
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
689
out_size - written));
790
out_size - written));
690
791
if(ret == -1){
691
perror("write");
792
int e = errno;
793
perror_plus("write");
794
errno = e;
692
795
goto mandos_end;
693
796
}
694
797
written += (size_t)ret;
704
807
}
705
808
706
809
if(quit_now){
810
errno = EINTR;
707
811
goto mandos_end;
708
812
}
709
813
}
710
814
711
815
if(debug){
712
fprintf(stderr, "Establishing TLS session with %s\n", ip);
816
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
713
817
}
714
818
715
819
if(quit_now){
820
errno = EINTR;
716
821
goto mandos_end;
717
822
}
718
823
824
/* Spurious warning from -Wint-to-pointer-cast */
719
825
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
720
826
721
827
if(quit_now){
828
errno = EINTR;
722
829
goto mandos_end;
723
830
}
724
831
725
832
do {
726
833
ret = gnutls_handshake(session);
727
834
if(quit_now){
835
errno = EINTR;
728
836
goto mandos_end;
729
837
}
730
838
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
731
839
732
840
if(ret != GNUTLS_E_SUCCESS){
733
841
if(debug){
734
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
842
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
735
843
gnutls_perror(ret);
736
844
}
845
errno = EPROTO;
737
846
goto mandos_end;
738
847
}
739
848
740
849
/* Read OpenPGP packet that contains the wanted password */
741
850
742
851
if(debug){
743
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
744
ip);
852
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
853
" %s\n", ip);
745
854
}
746
855
747
856
while(true){
748
857
749
858
if(quit_now){
859
errno = EINTR;
750
860
goto mandos_end;
751
861
}
752
862
753
863
buffer_capacity = incbuffer(&buffer, buffer_length,
754
buffer_capacity);
864
buffer_capacity);
755
865
if(buffer_capacity == 0){
756
perror("incbuffer");
866
int e = errno;
867
perror_plus("incbuffer");
868
errno = e;
757
869
goto mandos_end;
758
870
}
759
871
760
872
if(quit_now){
873
errno = EINTR;
761
874
goto mandos_end;
762
875
}
763
876
776
889
ret = gnutls_handshake(session);
777
890
778
891
if(quit_now){
892
errno = EINTR;
779
893
goto mandos_end;
780
894
}
781
895
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
782
896
if(ret < 0){
783
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
897
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
898
"***\n");
784
899
gnutls_perror(ret);
900
errno = EPROTO;
785
901
goto mandos_end;
786
902
}
787
903
break;
788
904
default:
789
fprintf(stderr, "Unknown error while reading data from"
790
" encrypted session with Mandos server\n");
905
fprintf_plus(stderr, "Unknown error while reading data from"
906
" encrypted session with Mandos server\n");
791
907
gnutls_bye(session, GNUTLS_SHUT_RDWR);
908
errno = EIO;
792
909
goto mandos_end;
793
910
}
794
911
} else {
797
914
}
798
915
799
916
if(debug){
800
fprintf(stderr, "Closing TLS session\n");
917
fprintf_plus(stderr, "Closing TLS session\n");
801
918
}
802
919
803
920
if(quit_now){
921
errno = EINTR;
804
922
goto mandos_end;
805
923
}
806
924
807
925
do {
808
926
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
809
927
if(quit_now){
928
errno = EINTR;
810
929
goto mandos_end;
811
930
}
812
931
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
813
932
814
933
if(buffer_length > 0){
815
934
ssize_t decrypted_buffer_size;
816
decrypted_buffer_size = pgp_packet_decrypt(buffer,
817
buffer_length,
935
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
818
936
&decrypted_buffer);
819
937
if(decrypted_buffer_size >= 0){
820
938
821
939
written = 0;
822
940
while(written < (size_t) decrypted_buffer_size){
823
941
if(quit_now){
942
errno = EINTR;
824
943
goto mandos_end;
825
944
}
826
945
828
947
(size_t)decrypted_buffer_size - written,
829
948
stdout);
830
949
if(ret == 0 and ferror(stdout)){
950
int e = errno;
831
951
if(debug){
832
fprintf(stderr, "Error writing encrypted data: %s\n",
833
strerror(errno));
952
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
953
strerror(errno));
834
954
}
955
errno = e;
835
956
goto mandos_end;
836
957
}
837
958
written += (size_t)ret;
843
964
/* Shutdown procedure */
844
965
845
966
mandos_end:
846
free(decrypted_buffer);
847
free(buffer);
848
if(tcp_sd >= 0){
849
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
850
}
851
if(ret == -1){
852
perror("close");
853
}
854
gnutls_deinit(session);
855
if(quit_now){
856
retval = -1;
967
{
968
int e = errno;
969
free(decrypted_buffer);
970
free(buffer);
971
if(tcp_sd >= 0){
972
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
973
}
974
if(ret == -1){
975
if(e == 0){
976
e = errno;
977
}
978
perror_plus("close");
979
}
980
gnutls_deinit(session);
981
errno = e;
982
if(quit_now){
983
errno = EINTR;
984
retval = -1;
985
}
857
986
}
858
987
return retval;
859
988
}
884
1013
switch(event){
885
1014
default:
886
1015
case AVAHI_RESOLVER_FAILURE:
887
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
888
" of type '%s' in domain '%s': %s\n", name, type, domain,
889
avahi_strerror(avahi_server_errno(mc.server)));
1016
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1017
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1018
domain,
1019
avahi_strerror(avahi_server_errno(mc.server)));
890
1020
break;
891
1021
892
1022
case AVAHI_RESOLVER_FOUND:
894
1024
char ip[AVAHI_ADDRESS_STR_MAX];
895
1025
avahi_address_snprint(ip, sizeof(ip), address);
896
1026
if(debug){
897
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
898
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
899
ip, (intmax_t)interface, port);
1027
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1028
PRIdMAX ") on port %" PRIu16 "\n", name,
1029
host_name, ip, (intmax_t)interface, port);
900
1030
}
901
1031
int ret = start_mandos_communication(ip, port, interface,
902
1032
avahi_proto_to_af(proto));
903
1033
if(ret == 0){
904
1034
avahi_simple_poll_quit(mc.simple_poll);
1035
} else {
1036
if(not add_server(ip, port, interface,
1037
avahi_proto_to_af(proto))){
1038
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1039
" list\n", name);
1040
}
905
1041
}
906
1042
}
907
1043
}
931
1067
default:
932
1068
case AVAHI_BROWSER_FAILURE:
933
1069
934
fprintf(stderr, "(Avahi browser) %s\n",
935
avahi_strerror(avahi_server_errno(mc.server)));
1070
fprintf_plus(stderr, "(Avahi browser) %s\n",
1071
avahi_strerror(avahi_server_errno(mc.server)));
936
1072
avahi_simple_poll_quit(mc.simple_poll);
937
1073
return;
938
1074
945
1081
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
946
1082
name, type, domain, protocol, 0,
947
1083
resolve_callback, NULL) == NULL)
948
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
949
name, avahi_strerror(avahi_server_errno(mc.server)));
1084
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1085
" %s\n", name,
1086
avahi_strerror(avahi_server_errno(mc.server)));
950
1087
break;
951
1088
952
1089
case AVAHI_BROWSER_REMOVE:
955
1092
case AVAHI_BROWSER_ALL_FOR_NOW:
956
1093
case AVAHI_BROWSER_CACHE_EXHAUSTED:
957
1094
if(debug){
958
fprintf(stderr, "No Mandos server found, still searching...\n");
1095
fprintf_plus(stderr, "No Mandos server found, still"
1096
" searching...\n");
959
1097
}
960
1098
break;
961
1099
}
962
1100
}
963
1101
964
/* stop main loop after sigterm has been called */
1102
/* Signal handler that stops main loop after SIGTERM */
965
1103
static void handle_sigterm(int sig){
966
1104
if(quit_now){
967
1105
return;
969
1107
quit_now = 1;
970
1108
signal_received = sig;
971
1109
int old_errno = errno;
1110
/* set main loop to exit */
972
1111
if(mc.simple_poll != NULL){
973
1112
avahi_simple_poll_quit(mc.simple_poll);
974
1113
}
975
1114
errno = old_errno;
976
1115
}
977
1116
1117
bool get_flags(const char *ifname, struct ifreq *ifr){
1118
int ret;
1119
1120
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1121
if(s < 0){
1122
perror_plus("socket");
1123
return false;
1124
}
1125
strcpy(ifr->ifr_name, ifname);
1126
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1127
if(ret == -1){
1128
if(debug){
1129
perror_plus("ioctl SIOCGIFFLAGS");
1130
}
1131
return false;
1132
}
1133
return true;
1134
}
1135
1136
bool good_flags(const char *ifname, const struct ifreq *ifr){
1137
1138
/* Reject the loopback device */
1139
if(ifr->ifr_flags & IFF_LOOPBACK){
1140
if(debug){
1141
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1142
ifname);
1143
}
1144
return false;
1145
}
1146
/* Accept point-to-point devices only if connect_to is specified */
1147
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1148
if(debug){
1149
fprintf_plus(stderr, "Accepting point-to-point interface"
1150
" \"%s\"\n", ifname);
1151
}
1152
return true;
1153
}
1154
/* Otherwise, reject non-broadcast-capable devices */
1155
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1156
if(debug){
1157
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1158
" \"%s\"\n", ifname);
1159
}
1160
return false;
1161
}
1162
/* Reject non-ARP interfaces (including dummy interfaces) */
1163
if(ifr->ifr_flags & IFF_NOARP){
1164
if(debug){
1165
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1166
ifname);
1167
}
1168
return false;
1169
}
1170
1171
/* Accept this device */
1172
if(debug){
1173
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1174
}
1175
return true;
1176
}
1177
1178
/*
1179
* This function determines if a directory entry in /sys/class/net
1180
* corresponds to an acceptable network device.
1181
* (This function is passed to scandir(3) as a filter function.)
1182
*/
1183
int good_interface(const struct dirent *if_entry){
1184
if(if_entry->d_name[0] == '.'){
1185
return 0;
1186
}
1187
1188
struct ifreq ifr;
1189
if(not get_flags(if_entry->d_name, &ifr)){
1190
if(debug){
1191
fprintf_plus(stderr, "Failed to get flags for interface "
1192
"\"%s\"\n", if_entry->d_name);
1193
}
1194
return 0;
1195
}
1196
1197
if(not good_flags(if_entry->d_name, &ifr)){
1198
return 0;
1199
}
1200
return 1;
1201
}
1202
1203
/*
1204
* This function determines if a directory entry in /sys/class/net
1205
* corresponds to an acceptable network device which is up.
1206
* (This function is passed to scandir(3) as a filter function.)
1207
*/
1208
int up_interface(const struct dirent *if_entry){
1209
if(if_entry->d_name[0] == '.'){
1210
return 0;
1211
}
1212
1213
struct ifreq ifr;
1214
if(not get_flags(if_entry->d_name, &ifr)){
1215
if(debug){
1216
fprintf_plus(stderr, "Failed to get flags for interface "
1217
"\"%s\"\n", if_entry->d_name);
1218
}
1219
return 0;
1220
}
1221
1222
/* Reject down interfaces */
1223
if(not (ifr.ifr_flags & IFF_UP)){
1224
if(debug){
1225
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1226
if_entry->d_name);
1227
}
1228
return 0;
1229
}
1230
1231
/* Reject non-running interfaces */
1232
if(not (ifr.ifr_flags & IFF_RUNNING)){
1233
if(debug){
1234
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1235
if_entry->d_name);
1236
}
1237
return 0;
1238
}
1239
1240
if(not good_flags(if_entry->d_name, &ifr)){
1241
return 0;
1242
}
1243
return 1;
1244
}
1245
1246
int notdotentries(const struct dirent *direntry){
1247
/* Skip "." and ".." */
1248
if(direntry->d_name[0] == '.'
1249
and (direntry->d_name[1] == '\0'
1250
or (direntry->d_name[1] == '.'
1251
and direntry->d_name[2] == '\0'))){
1252
return 0;
1253
}
1254
return 1;
1255
}
1256
1257
/* Is this directory entry a runnable program? */
1258
int runnable_hook(const struct dirent *direntry){
1259
int ret;
1260
size_t sret;
1261
struct stat st;
1262
1263
if((direntry->d_name)[0] == '\0'){
1264
/* Empty name? */
1265
return 0;
1266
}
1267
1268
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1269
"abcdefghijklmnopqrstuvwxyz"
1270
"0123456789"
1271
"_-");
1272
if((direntry->d_name)[sret] != '\0'){
1273
/* Contains non-allowed characters */
1274
if(debug){
1275
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1276
direntry->d_name);
1277
}
1278
return 0;
1279
}
1280
1281
char *fullname = NULL;
1282
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1283
if(ret < 0){
1284
perror_plus("asprintf");
1285
return 0;
1286
}
1287
1288
ret = stat(fullname, &st);
1289
if(ret == -1){
1290
if(debug){
1291
perror_plus("Could not stat hook");
1292
}
1293
return 0;
1294
}
1295
if(not (S_ISREG(st.st_mode))){
1296
/* Not a regular file */
1297
if(debug){
1298
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1299
direntry->d_name);
1300
}
1301
return 0;
1302
}
1303
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1304
/* Not executable */
1305
if(debug){
1306
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1307
direntry->d_name);
1308
}
1309
return 0;
1310
}
1311
if(debug){
1312
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1313
direntry->d_name);
1314
}
1315
return 1;
1316
}
1317
1318
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1319
int ret;
1320
struct timespec now;
1321
struct timespec waited_time;
1322
intmax_t block_time;
1323
1324
while(true){
1325
if(mc.current_server == NULL){
1326
if (debug){
1327
fprintf_plus(stderr, "Wait until first server is found."
1328
" No timeout!\n");
1329
}
1330
ret = avahi_simple_poll_iterate(s, -1);
1331
} else {
1332
if (debug){
1333
fprintf_plus(stderr, "Check current_server if we should run"
1334
" it, or wait\n");
1335
}
1336
/* the current time */
1337
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1338
if(ret == -1){
1339
perror_plus("clock_gettime");
1340
return -1;
1341
}
1342
/* Calculating in ms how long time between now and server
1343
who we visted longest time ago. Now - last seen. */
1344
waited_time.tv_sec = (now.tv_sec
1345
- mc.current_server->last_seen.tv_sec);
1346
waited_time.tv_nsec = (now.tv_nsec
1347
- mc.current_server->last_seen.tv_nsec);
1348
/* total time is 10s/10,000ms.
1349
Converting to s from ms by dividing by 1,000,
1350
and ns to ms by dividing by 1,000,000. */
1351
block_time = ((retry_interval
1352
- ((intmax_t)waited_time.tv_sec * 1000))
1353
- ((intmax_t)waited_time.tv_nsec / 1000000));
1354
1355
if (debug){
1356
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1357
block_time);
1358
}
1359
1360
if(block_time <= 0){
1361
ret = start_mandos_communication(mc.current_server->ip,
1362
mc.current_server->port,
1363
mc.current_server->if_index,
1364
mc.current_server->af);
1365
if(ret == 0){
1366
avahi_simple_poll_quit(mc.simple_poll);
1367
return 0;
1368
}
1369
ret = clock_gettime(CLOCK_MONOTONIC,
1370
&mc.current_server->last_seen);
1371
if(ret == -1){
1372
perror_plus("clock_gettime");
1373
return -1;
1374
}
1375
mc.current_server = mc.current_server->next;
1376
block_time = 0; /* Call avahi to find new Mandos
1377
servers, but don't block */
1378
}
1379
1380
ret = avahi_simple_poll_iterate(s, (int)block_time);
1381
}
1382
if(ret != 0){
1383
if (ret > 0 or errno != EINTR){
1384
return (ret != 1) ? ret : 0;
1385
}
1386
}
1387
}
1388
}
1389
1390
bool run_network_hooks(const char *mode, const char *interface,
1391
const float delay){
1392
struct dirent **direntries;
1393
struct dirent *direntry;
1394
int ret;
1395
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1396
alphasort);
1397
if(numhooks == -1){
1398
perror_plus("scandir");
1399
} else {
1400
int devnull = open("/dev/null", O_RDONLY);
1401
for(int i = 0; i < numhooks; i++){
1402
direntry = direntries[i];
1403
char *fullname = NULL;
1404
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1405
if(ret < 0){
1406
perror_plus("asprintf");
1407
continue;
1408
}
1409
if(debug){
1410
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1411
direntry->d_name);
1412
}
1413
pid_t hook_pid = fork();
1414
if(hook_pid == 0){
1415
/* Child */
1416
/* Raise privileges */
1417
errno = 0;
1418
ret = seteuid(0);
1419
if(ret == -1){
1420
perror_plus("seteuid");
1421
}
1422
/* Raise privileges even more */
1423
errno = 0;
1424
ret = setuid(0);
1425
if(ret == -1){
1426
perror_plus("setuid");
1427
}
1428
/* Set group */
1429
errno = 0;
1430
ret = setgid(0);
1431
if(ret == -1){
1432
perror_plus("setgid");
1433
}
1434
/* Reset supplementary groups */
1435
errno = 0;
1436
ret = setgroups(0, NULL);
1437
if(ret == -1){
1438
perror_plus("setgroups");
1439
}
1440
dup2(devnull, STDIN_FILENO);
1441
close(devnull);
1442
dup2(STDERR_FILENO, STDOUT_FILENO);
1443
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1444
if(ret == -1){
1445
perror_plus("setenv");
1446
_exit(EX_OSERR);
1447
}
1448
ret = setenv("DEVICE", interface, 1);
1449
if(ret == -1){
1450
perror_plus("setenv");
1451
_exit(EX_OSERR);
1452
}
1453
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1454
if(ret == -1){
1455
perror_plus("setenv");
1456
_exit(EX_OSERR);
1457
}
1458
ret = setenv("MODE", mode, 1);
1459
if(ret == -1){
1460
perror_plus("setenv");
1461
_exit(EX_OSERR);
1462
}
1463
char *delaystring;
1464
ret = asprintf(&delaystring, "%f", delay);
1465
if(ret == -1){
1466
perror_plus("asprintf");
1467
_exit(EX_OSERR);
1468
}
1469
ret = setenv("DELAY", delaystring, 1);
1470
if(ret == -1){
1471
free(delaystring);
1472
perror_plus("setenv");
1473
_exit(EX_OSERR);
1474
}
1475
free(delaystring);
1476
if(connect_to != NULL){
1477
ret = setenv("CONNECT", connect_to, 1);
1478
if(ret == -1){
1479
perror_plus("setenv");
1480
_exit(EX_OSERR);
1481
}
1482
}
1483
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1484
perror_plus("execl");
1485
_exit(EXIT_FAILURE);
1486
}
1487
} else {
1488
int status;
1489
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1490
perror_plus("waitpid");
1491
free(fullname);
1492
continue;
1493
}
1494
if(WIFEXITED(status)){
1495
if(WEXITSTATUS(status) != 0){
1496
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1497
" with status %d\n", direntry->d_name,
1498
WEXITSTATUS(status));
1499
free(fullname);
1500
continue;
1501
}
1502
} else if(WIFSIGNALED(status)){
1503
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1504
" signal %d\n", direntry->d_name,
1505
WTERMSIG(status));
1506
free(fullname);
1507
continue;
1508
} else {
1509
fprintf_plus(stderr, "Warning: network hook \"%s\""
1510
" crashed\n", direntry->d_name);
1511
free(fullname);
1512
continue;
1513
}
1514
}
1515
free(fullname);
1516
if(debug){
1517
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1518
direntry->d_name);
1519
}
1520
}
1521
close(devnull);
1522
}
1523
return true;
1524
}
1525
978
1526
int main(int argc, char *argv[]){
979
1527
AvahiSServiceBrowser *sb = NULL;
980
1528
int error;
982
1530
intmax_t tmpmax;
983
1531
char *tmp;
984
1532
int exitcode = EXIT_SUCCESS;
985
const char *interface = "eth0";
1533
const char *interface = "";
986
1534
struct ifreq network;
987
1535
int sd = -1;
988
1536
bool take_down_interface = false;
989
1537
uid_t uid;
990
1538
gid_t gid;
991
char *connect_to = NULL;
992
1539
char tempdir[] = "/tmp/mandosXXXXXX";
993
1540
bool tempdir_created = false;
994
1541
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
998
1545
bool gnutls_initialized = false;
999
1546
bool gpgme_initialized = false;
1000
1547
float delay = 2.5f;
1548
double retry_interval = 10; /* 10s between trying a server and
1549
retrying the same server again */
1001
1550
1002
1551
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1003
1552
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1009
1558
errno = 0;
1010
1559
ret = setgid(gid);
1011
1560
if(ret == -1){
1012
perror("setgid");
1561
perror_plus("setgid");
1013
1562
}
1014
1563
1015
1564
/* Lower user privileges (temporarily) */
1016
1565
errno = 0;
1017
1566
ret = seteuid(uid);
1018
1567
if(ret == -1){
1019
perror("seteuid");
1568
perror_plus("seteuid");
1020
1569
}
1021
1570
1022
1571
if(quit_now){
1057
1606
.arg = "SECONDS",
1058
1607
.doc = "Maximum delay to wait for interface startup",
1059
1608
.group = 2 },
1609
{ .name = "retry", .key = 132,
1610
.arg = "SECONDS",
1611
.doc = "Retry interval used when denied by the Mandos server",
1612
.group = 2 },
1613
{ .name = "network-hook-dir", .key = 133,
1614
.arg = "DIR",
1615
.doc = "Directory where network hooks are located",
1616
.group = 2 },
1060
1617
/*
1061
1618
* These reproduce what we would get without ARGP_NO_HELP
1062
1619
*/
1106
1663
if(errno != 0 or tmp == arg or *tmp != '\0'){
1107
1664
argp_error(state, "Bad delay");
1108
1665
}
1666
case 132: /* --retry */
1667
errno = 0;
1668
retry_interval = strtod(arg, &tmp);
1669
if(errno != 0 or tmp == arg or *tmp != '\0'
1670
or (retry_interval * 1000) > INT_MAX
1671
or retry_interval < 0){
1672
argp_error(state, "Bad retry interval");
1673
}
1674
break;
1675
case 133: /* --network-hook-dir */
1676
hookdir = arg;
1109
1677
break;
1110
1678
/*
1111
1679
* These reproduce what we would get without ARGP_NO_HELP
1118
1686
argp_state_help(state, state->out_stream,
1119
1687
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1120
1688
case 'V': /* --version */
1121
fprintf(state->out_stream, "%s\n", argp_program_version);
1689
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1122
1690
exit(argp_err_exit_status);
1123
1691
break;
1124
1692
default:
1139
1707
case ENOMEM:
1140
1708
default:
1141
1709
errno = ret;
1142
perror("argp_parse");
1710
perror_plus("argp_parse");
1143
1711
exitcode = EX_OSERR;
1144
1712
goto end;
1145
1713
case EINVAL:
1147
1715
goto end;
1148
1716
}
1149
1717
}
1718
1719
{
1720
/* Work around Debian bug #633582:
1721
<http://bugs.debian.org/633582> */
1722
1723
/* Re-raise priviliges */
1724
errno = 0;
1725
ret = seteuid(0);
1726
if(ret == -1){
1727
perror_plus("seteuid");
1728
} else {
1729
struct stat st;
1730
1731
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1732
int seckey_fd = open(seckey, O_RDONLY);
1733
if(seckey_fd == -1){
1734
perror_plus("open");
1735
} else {
1736
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1737
if(ret == -1){
1738
perror_plus("fstat");
1739
} else {
1740
if(S_ISREG(st.st_mode)
1741
and st.st_uid == 0 and st.st_gid == 0){
1742
ret = fchown(seckey_fd, uid, gid);
1743
if(ret == -1){
1744
perror_plus("fchown");
1745
}
1746
}
1747
}
1748
TEMP_FAILURE_RETRY(close(seckey_fd));
1749
}
1750
}
1751
1752
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1753
int pubkey_fd = open(pubkey, O_RDONLY);
1754
if(pubkey_fd == -1){
1755
perror_plus("open");
1756
} else {
1757
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1758
if(ret == -1){
1759
perror_plus("fstat");
1760
} else {
1761
if(S_ISREG(st.st_mode)
1762
and st.st_uid == 0 and st.st_gid == 0){
1763
ret = fchown(pubkey_fd, uid, gid);
1764
if(ret == -1){
1765
perror_plus("fchown");
1766
}
1767
}
1768
}
1769
TEMP_FAILURE_RETRY(close(pubkey_fd));
1770
}
1771
}
1772
1773
/* Lower privileges */
1774
errno = 0;
1775
ret = seteuid(uid);
1776
if(ret == -1){
1777
perror_plus("seteuid");
1778
}
1779
}
1780
}
1781
1782
/* Run network hooks */
1783
if(not run_network_hooks("start", interface, delay)){
1784
goto end;
1785
}
1150
1786
1151
1787
if(not debug){
1152
1788
avahi_set_log_function(empty_log);
1153
1789
}
1154
1790
1791
if(interface[0] == '\0'){
1792
struct dirent **direntries;
1793
/* First look for interfaces that are up */
1794
ret = scandir(sys_class_net, &direntries, up_interface,
1795
alphasort);
1796
if(ret == 0){
1797
/* No up interfaces, look for any good interfaces */
1798
free(direntries);
1799
ret = scandir(sys_class_net, &direntries, good_interface,
1800
alphasort);
1801
}
1802
if(ret >= 1){
1803
/* Pick the first interface returned */
1804
interface = strdup(direntries[0]->d_name);
1805
if(debug){
1806
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1807
}
1808
if(interface == NULL){
1809
perror_plus("malloc");
1810
free(direntries);
1811
exitcode = EXIT_FAILURE;
1812
goto end;
1813
}
1814
free(direntries);
1815
} else {
1816
free(direntries);
1817
fprintf_plus(stderr, "Could not find a network interface\n");
1818
exitcode = EXIT_FAILURE;
1819
goto end;
1820
}
1821
}
1822
1155
1823
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1156
1824
from the signal handler */
1157
1825
/* Initialize the pseudo-RNG for Avahi */
1158
1826
srand((unsigned int) time(NULL));
1159
1827
mc.simple_poll = avahi_simple_poll_new();
1160
1828
if(mc.simple_poll == NULL){
1161
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1162
exitcode = EXIT_FAILURE;
1829
fprintf_plus(stderr,
1830
"Avahi: Failed to create simple poll object.\n");
1831
exitcode = EX_UNAVAILABLE;
1163
1832
goto end;
1164
1833
}
1165
1834
1166
1835
sigemptyset(&sigterm_action.sa_mask);
1167
1836
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1168
1837
if(ret == -1){
1169
perror("sigaddset");
1170
exitcode = EXIT_FAILURE;
1838
perror_plus("sigaddset");
1839
exitcode = EX_OSERR;
1171
1840
goto end;
1172
1841
}
1173
1842
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1174
1843
if(ret == -1){
1175
perror("sigaddset");
1176
exitcode = EXIT_FAILURE;
1844
perror_plus("sigaddset");
1845
exitcode = EX_OSERR;
1177
1846
goto end;
1178
1847
}
1179
1848
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1180
1849
if(ret == -1){
1181
perror("sigaddset");
1182
exitcode = EXIT_FAILURE;
1850
perror_plus("sigaddset");
1851
exitcode = EX_OSERR;
1183
1852
goto end;
1184
1853
}
1185
1854
/* Need to check if the handler is SIG_IGN before handling:
1188
1857
*/
1189
1858
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1190
1859
if(ret == -1){
1191
perror("sigaction");
1192
return EXIT_FAILURE;
1860
perror_plus("sigaction");
1861
return EX_OSERR;
1193
1862
}
1194
1863
if(old_sigterm_action.sa_handler != SIG_IGN){
1195
1864
ret = sigaction(SIGINT, &sigterm_action, NULL);
1196
1865
if(ret == -1){
1197
perror("sigaction");
1198
exitcode = EXIT_FAILURE;
1866
perror_plus("sigaction");
1867
exitcode = EX_OSERR;
1199
1868
goto end;
1200
1869
}
1201
1870
}
1202
1871
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1203
1872
if(ret == -1){
1204
perror("sigaction");
1205
return EXIT_FAILURE;
1873
perror_plus("sigaction");
1874
return EX_OSERR;
1206
1875
}
1207
1876
if(old_sigterm_action.sa_handler != SIG_IGN){
1208
1877
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1209
1878
if(ret == -1){
1210
perror("sigaction");
1211
exitcode = EXIT_FAILURE;
1879
perror_plus("sigaction");
1880
exitcode = EX_OSERR;
1212
1881
goto end;
1213
1882
}
1214
1883
}
1215
1884
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1216
1885
if(ret == -1){
1217
perror("sigaction");
1218
return EXIT_FAILURE;
1886
perror_plus("sigaction");
1887
return EX_OSERR;
1219
1888
}
1220
1889
if(old_sigterm_action.sa_handler != SIG_IGN){
1221
1890
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1222
1891
if(ret == -1){
1223
perror("sigaction");
1224
exitcode = EXIT_FAILURE;
1892
perror_plus("sigaction");
1893
exitcode = EX_OSERR;
1225
1894
goto end;
1226
1895
}
1227
1896
}
1228
1897
1229
1898
/* If the interface is down, bring it up */
1230
if(interface[0] != '\0'){
1899
if(strcmp(interface, "none") != 0){
1231
1900
if_index = (AvahiIfIndex) if_nametoindex(interface);
1232
1901
if(if_index == 0){
1233
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1234
exitcode = EXIT_FAILURE;
1902
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1903
exitcode = EX_UNAVAILABLE;
1235
1904
goto end;
1236
1905
}
1237
1906
1243
1912
errno = 0;
1244
1913
ret = seteuid(0);
1245
1914
if(ret == -1){
1246
perror("seteuid");
1915
perror_plus("seteuid");
1247
1916
}
1248
1917
1249
1918
#ifdef __linux__
1253
1922
bool restore_loglevel = true;
1254
1923
if(ret == -1){
1255
1924
restore_loglevel = false;
1256
perror("klogctl");
1925
perror_plus("klogctl");
1257
1926
}
1258
1927
#endif /* __linux__ */
1259
1928
1260
1929
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1261
1930
if(sd < 0){
1262
perror("socket");
1263
exitcode = EXIT_FAILURE;
1931
perror_plus("socket");
1932
exitcode = EX_OSERR;
1264
1933
#ifdef __linux__
1265
1934
if(restore_loglevel){
1266
1935
ret = klogctl(7, NULL, 0);
1267
1936
if(ret == -1){
1268
perror("klogctl");
1937
perror_plus("klogctl");
1269
1938
}
1270
1939
}
1271
1940
#endif /* __linux__ */
1273
1942
errno = 0;
1274
1943
ret = seteuid(uid);
1275
1944
if(ret == -1){
1276
perror("seteuid");
1945
perror_plus("seteuid");
1277
1946
}
1278
1947
goto end;
1279
1948
}
1280
1949
strcpy(network.ifr_name, interface);
1281
1950
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1282
1951
if(ret == -1){
1283
perror("ioctl SIOCGIFFLAGS");
1952
perror_plus("ioctl SIOCGIFFLAGS");
1284
1953
#ifdef __linux__
1285
1954
if(restore_loglevel){
1286
1955
ret = klogctl(7, NULL, 0);
1287
1956
if(ret == -1){
1288
perror("klogctl");
1957
perror_plus("klogctl");
1289
1958
}
1290
1959
}
1291
1960
#endif /* __linux__ */
1292
exitcode = EXIT_FAILURE;
1961
exitcode = EX_OSERR;
1293
1962
/* Lower privileges */
1294
1963
errno = 0;
1295
1964
ret = seteuid(uid);
1296
1965
if(ret == -1){
1297
perror("seteuid");
1966
perror_plus("seteuid");
1298
1967
}
1299
1968
goto end;
1300
1969
}
1304
1973
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1305
1974
if(ret == -1){
1306
1975
take_down_interface = false;
1307
perror("ioctl SIOCSIFFLAGS");
1308
exitcode = EXIT_FAILURE;
1976
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1977
exitcode = EX_OSERR;
1309
1978
#ifdef __linux__
1310
1979
if(restore_loglevel){
1311
1980
ret = klogctl(7, NULL, 0);
1312
1981
if(ret == -1){
1313
perror("klogctl");
1982
perror_plus("klogctl");
1314
1983
}
1315
1984
}
1316
1985
#endif /* __linux__ */
1318
1987
errno = 0;
1319
1988
ret = seteuid(uid);
1320
1989
if(ret == -1){
1321
perror("seteuid");
1990
perror_plus("seteuid");
1322
1991
}
1323
1992
goto end;
1324
1993
}
1325
1994
}
1326
/* sleep checking until interface is running */
1995
/* Sleep checking until interface is running.
1996
Check every 0.25s, up to total time of delay */
1327
1997
for(int i=0; i < delay * 4; i++){
1328
1998
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1329
1999
if(ret == -1){
1330
perror("ioctl SIOCGIFFLAGS");
2000
perror_plus("ioctl SIOCGIFFLAGS");
1331
2001
} else if(network.ifr_flags & IFF_RUNNING){
1332
2002
break;
1333
2003
}
1334
2004
struct timespec sleeptime = { .tv_nsec = 250000000 };
1335
2005
ret = nanosleep(&sleeptime, NULL);
1336
2006
if(ret == -1 and errno != EINTR){
1337
perror("nanosleep");
2007
perror_plus("nanosleep");
1338
2008
}
1339
2009
}
1340
2010
if(not take_down_interface){
1341
2011
/* We won't need the socket anymore */
1342
2012
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1343
2013
if(ret == -1){
1344
perror("close");
2014
perror_plus("close");
1345
2015
}
1346
2016
}
1347
2017
#ifdef __linux__
1349
2019
/* Restores kernel loglevel to default */
1350
2020
ret = klogctl(7, NULL, 0);
1351
2021
if(ret == -1){
1352
perror("klogctl");
2022
perror_plus("klogctl");
1353
2023
}
1354
2024
}
1355
2025
#endif /* __linux__ */
1356
2026
/* Lower privileges */
1357
2027
errno = 0;
1358
if(take_down_interface){
1359
/* Lower privileges */
1360
ret = seteuid(uid);
1361
if(ret == -1){
1362
perror("seteuid");
1363
}
1364
} else {
1365
/* Lower privileges permanently */
1366
ret = setuid(uid);
1367
if(ret == -1){
1368
perror("setuid");
1369
}
2028
/* Lower privileges */
2029
ret = seteuid(uid);
2030
if(ret == -1){
2031
perror_plus("seteuid");
1370
2032
}
1371
2033
}
1372
2034
1376
2038
1377
2039
ret = init_gnutls_global(pubkey, seckey);
1378
2040
if(ret == -1){
1379
fprintf(stderr, "init_gnutls_global failed\n");
1380
exitcode = EXIT_FAILURE;
2041
fprintf_plus(stderr, "init_gnutls_global failed\n");
2042
exitcode = EX_UNAVAILABLE;
1381
2043
goto end;
1382
2044
} else {
1383
2045
gnutls_initialized = true;
1387
2049
goto end;
1388
2050
}
1389
2051
2052
if(mkdtemp(tempdir) == NULL){
2053
perror_plus("mkdtemp");
2054
goto end;
2055
}
1390
2056
tempdir_created = true;
1391
if(mkdtemp(tempdir) == NULL){
1392
tempdir_created = false;
1393
perror("mkdtemp");
1394
goto end;
1395
}
1396
2057
1397
2058
if(quit_now){
1398
2059
goto end;
1399
2060
}
1400
2061
1401
2062
if(not init_gpgme(pubkey, seckey, tempdir)){
1402
fprintf(stderr, "init_gpgme failed\n");
1403
exitcode = EXIT_FAILURE;
2063
fprintf_plus(stderr, "init_gpgme failed\n");
2064
exitcode = EX_UNAVAILABLE;
1404
2065
goto end;
1405
2066
} else {
1406
2067
gpgme_initialized = true;
1415
2076
/* (Mainly meant for debugging) */
1416
2077
char *address = strrchr(connect_to, ':');
1417
2078
if(address == NULL){
1418
fprintf(stderr, "No colon in address\n");
1419
exitcode = EXIT_FAILURE;
2079
fprintf_plus(stderr, "No colon in address\n");
2080
exitcode = EX_USAGE;
1420
2081
goto end;
1421
2082
}
1422
2083
1429
2090
tmpmax = strtoimax(address+1, &tmp, 10);
1430
2091
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1431
2092
or tmpmax != (uint16_t)tmpmax){
1432
fprintf(stderr, "Bad port number\n");
1433
exitcode = EXIT_FAILURE;
2093
fprintf_plus(stderr, "Bad port number\n");
2094
exitcode = EX_USAGE;
1434
2095
goto end;
1435
2096
}
1436
2097
1440
2101
1441
2102
port = (uint16_t)tmpmax;
1442
2103
*address = '\0';
1443
address = connect_to;
1444
2104
/* Colon in address indicates IPv6 */
1445
2105
int af;
1446
if(strchr(address, ':') != NULL){
2106
if(strchr(connect_to, ':') != NULL){
1447
2107
af = AF_INET6;
2108
/* Accept [] around IPv6 address - see RFC 5952 */
2109
if(connect_to[0] == '[' and address[-1] == ']')
2110
{
2111
connect_to++;
2112
address[-1] = '\0';
2113
}
1448
2114
} else {
1449
2115
af = AF_INET;
1450
2116
}
2117
address = connect_to;
1451
2118
1452
2119
if(quit_now){
1453
2120
goto end;
1454
2121
}
1455
2122
1456
ret = start_mandos_communication(address, port, if_index, af);
1457
if(ret < 0){
1458
exitcode = EXIT_FAILURE;
1459
} else {
2123
while(not quit_now){
2124
ret = start_mandos_communication(address, port, if_index, af);
2125
if(quit_now or ret == 0){
2126
break;
2127
}
2128
if(debug){
2129
fprintf_plus(stderr, "Retrying in %d seconds\n",
2130
(int)retry_interval);
2131
}
2132
sleep((int)retry_interval);
2133
}
2134
2135
if (not quit_now){
1460
2136
exitcode = EXIT_SUCCESS;
1461
2137
}
2138
1462
2139
goto end;
1463
2140
}
1464
2141
1486
2163
1487
2164
/* Check if creating the Avahi server object succeeded */
1488
2165
if(mc.server == NULL){
1489
fprintf(stderr, "Failed to create Avahi server: %s\n",
1490
avahi_strerror(error));
1491
exitcode = EXIT_FAILURE;
2166
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2167
avahi_strerror(error));
2168
exitcode = EX_UNAVAILABLE;
1492
2169
goto end;
1493
2170
}
1494
2171
1501
2178
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1502
2179
NULL, 0, browse_callback, NULL);
1503
2180
if(sb == NULL){
1504
fprintf(stderr, "Failed to create service browser: %s\n",
1505
avahi_strerror(avahi_server_errno(mc.server)));
1506
exitcode = EXIT_FAILURE;
2181
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2182
avahi_strerror(avahi_server_errno(mc.server)));
2183
exitcode = EX_UNAVAILABLE;
1507
2184
goto end;
1508
2185
}
1509
2186
1514
2191
/* Run the main loop */
1515
2192
1516
2193
if(debug){
1517
fprintf(stderr, "Starting Avahi loop search\n");
1518
}
1519
1520
avahi_simple_poll_loop(mc.simple_poll);
2194
fprintf_plus(stderr, "Starting Avahi loop search\n");
2195
}
2196
2197
ret = avahi_loop_with_timeout(mc.simple_poll,
2198
(int)(retry_interval * 1000));
2199
if(debug){
2200
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2201
(ret == 0) ? "successfully" : "with error");
2202
}
1521
2203
1522
2204
end:
1523
2205
1524
2206
if(debug){
1525
fprintf(stderr, "%s exiting\n", argv[0]);
2207
fprintf_plus(stderr, "%s exiting\n", argv[0]);
1526
2208
}
1527
2209
1528
2210
/* Cleanup things */
1545
2227
gpgme_release(mc.ctx);
1546
2228
}
1547
2229
1548
/* Take down the network interface */
1549
if(take_down_interface){
1550
/* Re-raise priviliges */
2230
/* Cleans up the circular linked list of Mandos servers the client
2231
has seen */
2232
if(mc.current_server != NULL){
2233
mc.current_server->prev->next = NULL;
2234
while(mc.current_server != NULL){
2235
server *next = mc.current_server->next;
2236
free(mc.current_server);
2237
mc.current_server = next;
2238
}
2239
}
2240
2241
/* Run network hooks */
2242
run_network_hooks("stop", interface, delay);
2243
2244
/* Re-raise priviliges */
2245
{
1551
2246
errno = 0;
1552
2247
ret = seteuid(0);
1553
2248
if(ret == -1){
1554
perror("seteuid");
2249
perror_plus("seteuid");
1555
2250
}
1556
if(geteuid() == 0){
2251
2252
/* Take down the network interface */
2253
if(take_down_interface and geteuid() == 0){
1557
2254
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1558
2255
if(ret == -1){
1559
perror("ioctl SIOCGIFFLAGS");
1560
} else if(network.ifr_flags & IFF_UP) {
2256
perror_plus("ioctl SIOCGIFFLAGS");
2257
} else if(network.ifr_flags & IFF_UP){
1561
2258
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1562
2259
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1563
2260
if(ret == -1){
1564
perror("ioctl SIOCSIFFLAGS");
2261
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1565
2262
}
1566
2263
}
1567
2264
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1568
2265
if(ret == -1){
1569
perror("close");
1570
}
1571
/* Lower privileges permanently */
1572
errno = 0;
1573
ret = setuid(uid);
1574
if(ret == -1){
1575
perror("setuid");
2266
perror_plus("close");
1576
2267
}
1577
2268
}
1578
2269
}
2270
/* Lower privileges permanently */
2271
errno = 0;
2272
ret = setuid(uid);
2273
if(ret == -1){
2274
perror_plus("setuid");
2275
}
1579
2276
1580
/* Removes the temp directory used by GPGME */
2277
/* Removes the GPGME temp directory and all files inside */
1581
2278
if(tempdir_created){
1582
DIR *d;
1583
struct dirent *direntry;
1584
d = opendir(tempdir);
1585
if(d == NULL){
1586
if(errno != ENOENT){
1587
perror("opendir");
1588
}
1589
} else {
1590
while(true){
1591
direntry = readdir(d);
1592
if(direntry == NULL){
1593
break;
1594
}
1595
/* Skip "." and ".." */
1596
if(direntry->d_name[0] == '.'
1597
and (direntry->d_name[1] == '\0'
1598
or (direntry->d_name[1] == '.'
1599
and direntry->d_name[2] == '\0'))){
1600
continue;
1601
}
2279
struct dirent **direntries = NULL;
2280
struct dirent *direntry = NULL;
2281
int numentries = scandir(tempdir, &direntries, notdotentries,
2282
alphasort);
2283
if (numentries > 0){
2284
for(int i = 0; i < numentries; i++){
2285
direntry = direntries[i];
1602
2286
char *fullname = NULL;
1603
2287
ret = asprintf(&fullname, "%s/%s", tempdir,
1604
2288
direntry->d_name);
1605
2289
if(ret < 0){
1606
perror("asprintf");
2290
perror_plus("asprintf");
1607
2291
continue;
1608
2292
}
1609
2293
ret = remove(fullname);
1610
2294
if(ret == -1){
1611
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1612
strerror(errno));
2295
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2296
strerror(errno));
1613
2297
}
1614
2298
free(fullname);
1615
2299
}
1616
closedir(d);
2300
}
2301
2302
/* need to clean even if 0 because man page doesn't specify */
2303
free(direntries);
2304
if (numentries == -1){
2305
perror_plus("scandir");
1617
2306
}
1618
2307
ret = rmdir(tempdir);
1619
2308
if(ret == -1 and errno != ENOENT){
1620
perror("rmdir");
2309
perror_plus("rmdir");
1621
2310
}
1622
2311
}
1623
2312
1628
2317
&old_sigterm_action,
1629
2318
NULL));
1630
2319
if(ret == -1){
1631
perror("sigaction");
2320
perror_plus("sigaction");
1632
2321
}
1633
2322
do {
1634
2323
ret = raise(signal_received);
1635
2324
} while(ret != 0 and errno == EINTR);
1636
2325
if(ret != 0){
1637
perror("raise");
2326
perror_plus("raise");
1638
2327
abort();
1639
2328
}
1640
2329
TEMP_FAILURE_RETRY(pause());
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0