To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 541
- compare with another revision
- download diff
- download tarball
- view history from revision 541
- Committer: Teddy Hogeborn
- Date: 2011-12-31 20:07:11 UTC
- mfrom: (535.1.9 wireless-network-hook)
- Revision ID: teddy@recompile.se-20111231200711-6dli3r8drftem57r
Merge new wireless network hook. Fix bridge network hook to use
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
- files added:
- DBUS-API
- debian/source
- network-hooks.d
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
12
* Copyright © 2008-2011 Teddy Hogeborn
13
* Copyright © 2008-2011 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
26
26
* along with this program. If not, see
27
27
* <http://www.gnu.org/licenses/>.
28
28
*
29
* Contact the authors at <mandos@fukt.bsnet.se>.
29
* Contact the authors at <mandos@recompile.se>.
30
30
*/
31
31
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
53
53
sockaddr_in6, PF_INET6,
54
54
SOCK_STREAM, uid_t, gid_t, open(),
55
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
56
#include <sys/stat.h> /* open(), S_ISREG */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
58
inet_pton(), connect() */
59
59
#include <fcntl.h> /* open() */
62
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
63
strtoimax() */
64
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
65
#include <errno.h> /* perror(), errno,
66
program_invocation_short_name */
67
#include <time.h> /* nanosleep(), time(), sleep() */
67
68
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
69
SIOCSIFFLAGS, if_indextoname(),
69
70
if_nametoindex(), IF_NAMESIZE */
72
73
*/
73
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
75
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
76
setgid(), pause(), _exit() */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
77
78
#include <iso646.h> /* not, or, and */
78
79
#include <argp.h> /* struct argp_option, error_t, struct
79
80
argp_state, struct argp,
84
85
raise() */
85
86
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
86
87
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
89
WEXITSTATUS(), WTERMSIG() */
90
#include <grp.h> /* setgroups() */
87
91
88
92
#ifdef __linux__
89
93
#include <sys/klog.h> /* klogctl() */
107
111
init_gnutls_session(),
108
112
GNUTLS_* */
109
113
#include <gnutls/openpgp.h>
110
/* gnutls_certificate_set_openpgp_key_file(),
111
GNUTLS_OPENPGP_FMT_BASE64 */
114
/* gnutls_certificate_set_openpgp_key_file(),
115
GNUTLS_OPENPGP_FMT_BASE64 */
112
116
113
117
/* GPGME */
114
118
#include <gpgme.h> /* All GPGME types, constants and
122
126
#define PATHDIR "/conf/conf.d/mandos"
123
127
#define SECKEY "seckey.txt"
124
128
#define PUBKEY "pubkey.txt"
129
#define HOOKDIR "/lib/mandos/network-hooks.d"
125
130
126
131
bool debug = false;
127
132
static const char mandos_protocol_version[] = "1";
128
133
const char *argp_program_version = "mandos-client " VERSION;
129
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
134
const char *argp_program_bug_address = "<mandos@recompile.se>";
135
static const char sys_class_net[] = "/sys/class/net";
136
char *connect_to = NULL;
137
const char *hookdir = HOOKDIR;
138
139
/* Doubly linked list that need to be circularly linked when used */
140
typedef struct server{
141
const char *ip;
142
uint16_t port;
143
AvahiIfIndex if_index;
144
int af;
145
struct timespec last_seen;
146
struct server *next;
147
struct server *prev;
148
} server;
130
149
131
150
/* Used for passing in values through the Avahi callback functions */
132
151
typedef struct {
137
156
gnutls_dh_params_t dh_params;
138
157
const char *priority;
139
158
gpgme_ctx_t ctx;
159
server *current_server;
140
160
} mandos_context;
141
161
142
162
/* global context so signal handler can reach it*/
143
163
mandos_context mc = { .simple_poll = NULL, .server = NULL,
144
164
.dh_bits = 1024, .priority = "SECURE256"
145
":!CTYPE-X.509:+CTYPE-OPENPGP" };
165
":!CTYPE-X.509:+CTYPE-OPENPGP",
166
.current_server = NULL };
146
167
147
168
sig_atomic_t quit_now = 0;
148
169
int signal_received = 0;
149
170
171
/* Function to use when printing errors */
172
void perror_plus(const char *print_text){
173
int e = errno;
174
fprintf(stderr, "Mandos plugin %s: ",
175
program_invocation_short_name);
176
errno = e;
177
perror(print_text);
178
}
179
180
__attribute__((format (gnu_printf, 2, 3)))
181
int fprintf_plus(FILE *stream, const char *format, ...){
182
va_list ap;
183
va_start (ap, format);
184
185
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
186
program_invocation_short_name));
187
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
188
}
189
150
190
/*
151
191
* Make additional room in "buffer" for at least BUFFER_SIZE more
152
192
* bytes. "buffer_capacity" is how much is currently allocated,
153
193
* "buffer_length" is how much is already used.
154
194
*/
155
195
size_t incbuffer(char **buffer, size_t buffer_length,
156
size_t buffer_capacity){
196
size_t buffer_capacity){
157
197
if(buffer_length + BUFFER_SIZE > buffer_capacity){
158
198
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
159
199
if(buffer == NULL){
164
204
return buffer_capacity;
165
205
}
166
206
207
/* Add server to set of servers to retry periodically */
208
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
209
int af){
210
int ret;
211
server *new_server = malloc(sizeof(server));
212
if(new_server == NULL){
213
perror_plus("malloc");
214
return false;
215
}
216
*new_server = (server){ .ip = strdup(ip),
217
.port = port,
218
.if_index = if_index,
219
.af = af };
220
if(new_server->ip == NULL){
221
perror_plus("strdup");
222
return false;
223
}
224
/* Special case of first server */
225
if (mc.current_server == NULL){
226
new_server->next = new_server;
227
new_server->prev = new_server;
228
mc.current_server = new_server;
229
/* Place the new server last in the list */
230
} else {
231
new_server->next = mc.current_server;
232
new_server->prev = mc.current_server->prev;
233
new_server->prev->next = new_server;
234
mc.current_server->prev = new_server;
235
}
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
237
if(ret == -1){
238
perror_plus("clock_gettime");
239
return false;
240
}
241
return true;
242
}
243
167
244
/*
168
245
* Initialize GPGME.
169
246
*/
170
static bool init_gpgme(const char *seckey,
171
const char *pubkey, const char *tempdir){
247
static bool init_gpgme(const char *seckey, const char *pubkey,
248
const char *tempdir){
172
249
gpgme_error_t rc;
173
250
gpgme_engine_info_t engine_info;
174
251
183
260
184
261
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
185
262
if(fd == -1){
186
perror("open");
263
perror_plus("open");
187
264
return false;
188
265
}
189
266
190
267
rc = gpgme_data_new_from_fd(&pgp_data, fd);
191
268
if(rc != GPG_ERR_NO_ERROR){
192
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
193
gpgme_strsource(rc), gpgme_strerror(rc));
269
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
270
gpgme_strsource(rc), gpgme_strerror(rc));
194
271
return false;
195
272
}
196
273
197
274
rc = gpgme_op_import(mc.ctx, pgp_data);
198
275
if(rc != GPG_ERR_NO_ERROR){
199
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
200
gpgme_strsource(rc), gpgme_strerror(rc));
276
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
277
gpgme_strsource(rc), gpgme_strerror(rc));
201
278
return false;
202
279
}
203
280
204
281
ret = (int)TEMP_FAILURE_RETRY(close(fd));
205
282
if(ret == -1){
206
perror("close");
283
perror_plus("close");
207
284
}
208
285
gpgme_data_release(pgp_data);
209
286
return true;
210
287
}
211
288
212
289
if(debug){
213
fprintf(stderr, "Initializing GPGME\n");
290
fprintf_plus(stderr, "Initializing GPGME\n");
214
291
}
215
292
216
293
/* Init GPGME */
217
294
gpgme_check_version(NULL);
218
295
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
219
296
if(rc != GPG_ERR_NO_ERROR){
220
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
221
gpgme_strsource(rc), gpgme_strerror(rc));
297
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
298
gpgme_strsource(rc), gpgme_strerror(rc));
222
299
return false;
223
300
}
224
301
225
/* Set GPGME home directory for the OpenPGP engine only */
302
/* Set GPGME home directory for the OpenPGP engine only */
226
303
rc = gpgme_get_engine_info(&engine_info);
227
304
if(rc != GPG_ERR_NO_ERROR){
228
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
229
gpgme_strsource(rc), gpgme_strerror(rc));
305
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
306
gpgme_strsource(rc), gpgme_strerror(rc));
230
307
return false;
231
308
}
232
309
while(engine_info != NULL){
238
315
engine_info = engine_info->next;
239
316
}
240
317
if(engine_info == NULL){
241
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
318
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
319
tempdir);
242
320
return false;
243
321
}
244
322
245
323
/* Create new GPGME "context" */
246
324
rc = gpgme_new(&(mc.ctx));
247
325
if(rc != GPG_ERR_NO_ERROR){
248
fprintf(stderr, "bad gpgme_new: %s: %s\n",
249
gpgme_strsource(rc), gpgme_strerror(rc));
326
fprintf_plus(stderr, "Mandos plugin mandos-client: "
327
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
328
gpgme_strerror(rc));
250
329
return false;
251
330
}
252
331
271
350
ssize_t plaintext_length = 0;
272
351
273
352
if(debug){
274
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
353
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
275
354
}
276
355
277
356
/* Create new GPGME data buffer from memory cryptotext */
278
357
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
279
358
0);
280
359
if(rc != GPG_ERR_NO_ERROR){
281
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
282
gpgme_strsource(rc), gpgme_strerror(rc));
360
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
361
gpgme_strsource(rc), gpgme_strerror(rc));
283
362
return -1;
284
363
}
285
364
286
365
/* Create new empty GPGME data buffer for the plaintext */
287
366
rc = gpgme_data_new(&dh_plain);
288
367
if(rc != GPG_ERR_NO_ERROR){
289
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
290
gpgme_strsource(rc), gpgme_strerror(rc));
368
fprintf_plus(stderr, "Mandos plugin mandos-client: "
369
"bad gpgme_data_new: %s: %s\n",
370
gpgme_strsource(rc), gpgme_strerror(rc));
291
371
gpgme_data_release(dh_crypto);
292
372
return -1;
293
373
}
296
376
data buffer */
297
377
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
298
378
if(rc != GPG_ERR_NO_ERROR){
299
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
300
gpgme_strsource(rc), gpgme_strerror(rc));
379
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
380
gpgme_strsource(rc), gpgme_strerror(rc));
301
381
plaintext_length = -1;
302
382
if(debug){
303
383
gpgme_decrypt_result_t result;
304
384
result = gpgme_op_decrypt_result(mc.ctx);
305
385
if(result == NULL){
306
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
386
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
307
387
} else {
308
fprintf(stderr, "Unsupported algorithm: %s\n",
309
result->unsupported_algorithm);
310
fprintf(stderr, "Wrong key usage: %u\n",
311
result->wrong_key_usage);
388
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
389
result->unsupported_algorithm);
390
fprintf_plus(stderr, "Wrong key usage: %u\n",
391
result->wrong_key_usage);
312
392
if(result->file_name != NULL){
313
fprintf(stderr, "File name: %s\n", result->file_name);
393
fprintf_plus(stderr, "File name: %s\n", result->file_name);
314
394
}
315
395
gpgme_recipient_t recipient;
316
396
recipient = result->recipients;
317
397
while(recipient != NULL){
318
fprintf(stderr, "Public key algorithm: %s\n",
319
gpgme_pubkey_algo_name(recipient->pubkey_algo));
320
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
321
fprintf(stderr, "Secret key available: %s\n",
322
recipient->status == GPG_ERR_NO_SECKEY
323
? "No" : "Yes");
398
fprintf_plus(stderr, "Public key algorithm: %s\n",
399
gpgme_pubkey_algo_name
400
(recipient->pubkey_algo));
401
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
402
fprintf_plus(stderr, "Secret key available: %s\n",
403
recipient->status == GPG_ERR_NO_SECKEY
404
? "No" : "Yes");
324
405
recipient = recipient->next;
325
406
}
326
407
}
329
410
}
330
411
331
412
if(debug){
332
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
413
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
333
414
}
334
415
335
416
/* Seek back to the beginning of the GPGME plaintext data buffer */
336
417
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
337
perror("gpgme_data_seek");
418
perror_plus("gpgme_data_seek");
338
419
plaintext_length = -1;
339
420
goto decrypt_end;
340
421
}
342
423
*plaintext = NULL;
343
424
while(true){
344
425
plaintext_capacity = incbuffer(plaintext,
345
(size_t)plaintext_length,
346
plaintext_capacity);
426
(size_t)plaintext_length,
427
plaintext_capacity);
347
428
if(plaintext_capacity == 0){
348
perror("incbuffer");
349
plaintext_length = -1;
350
goto decrypt_end;
429
perror_plus("incbuffer");
430
plaintext_length = -1;
431
goto decrypt_end;
351
432
}
352
433
353
434
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
358
439
break;
359
440
}
360
441
if(ret < 0){
361
perror("gpgme_data_read");
442
perror_plus("gpgme_data_read");
362
443
plaintext_length = -1;
363
444
goto decrypt_end;
364
445
}
366
447
}
367
448
368
449
if(debug){
369
fprintf(stderr, "Decrypted password is: ");
450
fprintf_plus(stderr, "Decrypted password is: ");
370
451
for(ssize_t i = 0; i < plaintext_length; i++){
371
452
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
372
453
}
394
475
/* GnuTLS log function callback */
395
476
static void debuggnutls(__attribute__((unused)) int level,
396
477
const char* string){
397
fprintf(stderr, "GnuTLS: %s", string);
478
fprintf_plus(stderr, "GnuTLS: %s", string);
398
479
}
399
480
400
481
static int init_gnutls_global(const char *pubkeyfilename,
402
483
int ret;
403
484
404
485
if(debug){
405
fprintf(stderr, "Initializing GnuTLS\n");
486
fprintf_plus(stderr, "Initializing GnuTLS\n");
406
487
}
407
488
408
489
ret = gnutls_global_init();
409
490
if(ret != GNUTLS_E_SUCCESS){
410
fprintf(stderr, "GnuTLS global_init: %s\n",
411
safer_gnutls_strerror(ret));
491
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
492
safer_gnutls_strerror(ret));
412
493
return -1;
413
494
}
414
495
421
502
}
422
503
423
504
/* OpenPGP credentials */
424
gnutls_certificate_allocate_credentials(&mc.cred);
505
ret = gnutls_certificate_allocate_credentials(&mc.cred);
425
506
if(ret != GNUTLS_E_SUCCESS){
426
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
427
from
428
-Wunreachable-code
429
*/
430
safer_gnutls_strerror(ret));
507
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
508
safer_gnutls_strerror(ret));
431
509
gnutls_global_deinit();
432
510
return -1;
433
511
}
434
512
435
513
if(debug){
436
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
437
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
438
seckeyfilename);
514
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
515
" secret key %s as GnuTLS credentials\n",
516
pubkeyfilename,
517
seckeyfilename);
439
518
}
440
519
441
520
ret = gnutls_certificate_set_openpgp_key_file
442
521
(mc.cred, pubkeyfilename, seckeyfilename,
443
522
GNUTLS_OPENPGP_FMT_BASE64);
444
523
if(ret != GNUTLS_E_SUCCESS){
445
fprintf(stderr,
446
"Error[%d] while reading the OpenPGP key pair ('%s',"
447
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
448
fprintf(stderr, "The GnuTLS error is: %s\n",
449
safer_gnutls_strerror(ret));
524
fprintf_plus(stderr,
525
"Error[%d] while reading the OpenPGP key pair ('%s',"
526
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
527
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
528
safer_gnutls_strerror(ret));
450
529
goto globalfail;
451
530
}
452
531
453
532
/* GnuTLS server initialization */
454
533
ret = gnutls_dh_params_init(&mc.dh_params);
455
534
if(ret != GNUTLS_E_SUCCESS){
456
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
457
" %s\n", safer_gnutls_strerror(ret));
535
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
536
" initialization: %s\n",
537
safer_gnutls_strerror(ret));
458
538
goto globalfail;
459
539
}
460
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
461
541
if(ret != GNUTLS_E_SUCCESS){
462
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
463
safer_gnutls_strerror(ret));
542
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
543
safer_gnutls_strerror(ret));
464
544
goto globalfail;
465
545
}
466
546
486
566
}
487
567
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
488
568
if(ret != GNUTLS_E_SUCCESS){
489
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
490
safer_gnutls_strerror(ret));
569
fprintf_plus(stderr,
570
"Error in GnuTLS session initialization: %s\n",
571
safer_gnutls_strerror(ret));
491
572
}
492
573
493
574
{
500
581
}
501
582
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
502
583
if(ret != GNUTLS_E_SUCCESS){
503
fprintf(stderr, "Syntax error at: %s\n", err);
504
fprintf(stderr, "GnuTLS error: %s\n",
505
safer_gnutls_strerror(ret));
584
fprintf_plus(stderr, "Syntax error at: %s\n", err);
585
fprintf_plus(stderr, "GnuTLS error: %s\n",
586
safer_gnutls_strerror(ret));
506
587
gnutls_deinit(*session);
507
588
return -1;
508
589
}
517
598
}
518
599
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
519
600
if(ret != GNUTLS_E_SUCCESS){
520
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
521
safer_gnutls_strerror(ret));
601
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
602
safer_gnutls_strerror(ret));
522
603
gnutls_deinit(*session);
523
604
return -1;
524
605
}
569
650
pf = PF_INET;
570
651
break;
571
652
default:
572
fprintf(stderr, "Bad address family: %d\n", af);
653
fprintf_plus(stderr, "Bad address family: %d\n", af);
573
654
errno = EINVAL;
574
655
return -1;
575
656
}
580
661
}
581
662
582
663
if(debug){
583
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
584
"\n", ip, port);
664
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
665
PRIu16 "\n", ip, port);
585
666
}
586
667
587
668
tcp_sd = socket(pf, SOCK_STREAM, 0);
588
669
if(tcp_sd < 0){
589
670
int e = errno;
590
perror("socket");
671
perror_plus("socket");
591
672
errno = e;
592
673
goto mandos_end;
593
674
}
607
688
}
608
689
if(ret < 0 ){
609
690
int e = errno;
610
perror("inet_pton");
691
perror_plus("inet_pton");
611
692
errno = e;
612
693
goto mandos_end;
613
694
}
614
695
if(ret == 0){
615
696
int e = errno;
616
fprintf(stderr, "Bad address: %s\n", ip);
697
fprintf_plus(stderr, "Bad address: %s\n", ip);
617
698
errno = e;
618
699
goto mandos_end;
619
700
}
624
705
625
706
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
626
707
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
627
-Wunreachable-code*/
708
-Wunreachable-code*/
628
709
if(if_index == AVAHI_IF_UNSPEC){
629
fprintf(stderr, "An IPv6 link-local address is incomplete"
630
" without a network interface\n");
710
fprintf_plus(stderr, "An IPv6 link-local address is"
711
" incomplete without a network interface\n");
631
712
errno = EINVAL;
632
713
goto mandos_end;
633
714
}
649
730
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
650
731
char interface[IF_NAMESIZE];
651
732
if(if_indextoname((unsigned int)if_index, interface) == NULL){
652
perror("if_indextoname");
733
perror_plus("if_indextoname");
653
734
} else {
654
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
655
ip, interface, port);
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
656
737
}
657
738
} else {
658
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
659
port);
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
740
ip, port);
660
741
}
661
742
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
662
743
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
669
750
sizeof(addrstr));
670
751
}
671
752
if(pcret == NULL){
672
perror("inet_ntop");
753
perror_plus("inet_ntop");
673
754
} else {
674
755
if(strcmp(addrstr, ip) != 0){
675
fprintf(stderr, "Canonical address form: %s\n", addrstr);
756
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
676
757
}
677
758
}
678
759
}
688
769
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
689
770
}
690
771
if(ret < 0){
691
int e = errno;
692
perror("connect");
693
errno = e;
772
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
773
int e = errno;
774
perror_plus("connect");
775
errno = e;
776
}
694
777
goto mandos_end;
695
778
}
696
779
704
787
while(true){
705
788
size_t out_size = strlen(out);
706
789
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
707
out_size - written));
790
out_size - written));
708
791
if(ret == -1){
709
792
int e = errno;
710
perror("write");
793
perror_plus("write");
711
794
errno = e;
712
795
goto mandos_end;
713
796
}
730
813
}
731
814
732
815
if(debug){
733
fprintf(stderr, "Establishing TLS session with %s\n", ip);
816
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
734
817
}
735
818
736
819
if(quit_now){
738
821
goto mandos_end;
739
822
}
740
823
824
/* Spurious warning from -Wint-to-pointer-cast */
741
825
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
742
826
743
827
if(quit_now){
755
839
756
840
if(ret != GNUTLS_E_SUCCESS){
757
841
if(debug){
758
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
842
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
759
843
gnutls_perror(ret);
760
844
}
761
845
errno = EPROTO;
765
849
/* Read OpenPGP packet that contains the wanted password */
766
850
767
851
if(debug){
768
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
769
ip);
852
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
853
" %s\n", ip);
770
854
}
771
855
772
856
while(true){
777
861
}
778
862
779
863
buffer_capacity = incbuffer(&buffer, buffer_length,
780
buffer_capacity);
864
buffer_capacity);
781
865
if(buffer_capacity == 0){
782
866
int e = errno;
783
perror("incbuffer");
867
perror_plus("incbuffer");
784
868
errno = e;
785
869
goto mandos_end;
786
870
}
810
894
}
811
895
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
812
896
if(ret < 0){
813
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
897
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
898
"***\n");
814
899
gnutls_perror(ret);
815
900
errno = EPROTO;
816
901
goto mandos_end;
817
902
}
818
903
break;
819
904
default:
820
fprintf(stderr, "Unknown error while reading data from"
821
" encrypted session with Mandos server\n");
905
fprintf_plus(stderr, "Unknown error while reading data from"
906
" encrypted session with Mandos server\n");
822
907
gnutls_bye(session, GNUTLS_SHUT_RDWR);
823
908
errno = EIO;
824
909
goto mandos_end;
829
914
}
830
915
831
916
if(debug){
832
fprintf(stderr, "Closing TLS session\n");
917
fprintf_plus(stderr, "Closing TLS session\n");
833
918
}
834
919
835
920
if(quit_now){
847
932
848
933
if(buffer_length > 0){
849
934
ssize_t decrypted_buffer_size;
850
decrypted_buffer_size = pgp_packet_decrypt(buffer,
851
buffer_length,
935
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
852
936
&decrypted_buffer);
853
937
if(decrypted_buffer_size >= 0){
854
938
865
949
if(ret == 0 and ferror(stdout)){
866
950
int e = errno;
867
951
if(debug){
868
fprintf(stderr, "Error writing encrypted data: %s\n",
869
strerror(errno));
952
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
953
strerror(errno));
870
954
}
871
955
errno = e;
872
956
goto mandos_end;
891
975
if(e == 0){
892
976
e = errno;
893
977
}
894
perror("close");
978
perror_plus("close");
895
979
}
896
980
gnutls_deinit(session);
981
errno = e;
897
982
if(quit_now){
898
e = EINTR;
983
errno = EINTR;
899
984
retval = -1;
900
985
}
901
errno = e;
902
986
}
903
987
return retval;
904
988
}
929
1013
switch(event){
930
1014
default:
931
1015
case AVAHI_RESOLVER_FAILURE:
932
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
933
" of type '%s' in domain '%s': %s\n", name, type, domain,
934
avahi_strerror(avahi_server_errno(mc.server)));
1016
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1017
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1018
domain,
1019
avahi_strerror(avahi_server_errno(mc.server)));
935
1020
break;
936
1021
937
1022
case AVAHI_RESOLVER_FOUND:
939
1024
char ip[AVAHI_ADDRESS_STR_MAX];
940
1025
avahi_address_snprint(ip, sizeof(ip), address);
941
1026
if(debug){
942
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
943
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
944
ip, (intmax_t)interface, port);
1027
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1028
PRIdMAX ") on port %" PRIu16 "\n", name,
1029
host_name, ip, (intmax_t)interface, port);
945
1030
}
946
1031
int ret = start_mandos_communication(ip, port, interface,
947
1032
avahi_proto_to_af(proto));
948
1033
if(ret == 0){
949
1034
avahi_simple_poll_quit(mc.simple_poll);
1035
} else {
1036
if(not add_server(ip, port, interface,
1037
avahi_proto_to_af(proto))){
1038
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1039
" list\n", name);
1040
}
950
1041
}
951
1042
}
952
1043
}
976
1067
default:
977
1068
case AVAHI_BROWSER_FAILURE:
978
1069
979
fprintf(stderr, "(Avahi browser) %s\n",
980
avahi_strerror(avahi_server_errno(mc.server)));
1070
fprintf_plus(stderr, "(Avahi browser) %s\n",
1071
avahi_strerror(avahi_server_errno(mc.server)));
981
1072
avahi_simple_poll_quit(mc.simple_poll);
982
1073
return;
983
1074
990
1081
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
991
1082
name, type, domain, protocol, 0,
992
1083
resolve_callback, NULL) == NULL)
993
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
994
name, avahi_strerror(avahi_server_errno(mc.server)));
1084
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1085
" %s\n", name,
1086
avahi_strerror(avahi_server_errno(mc.server)));
995
1087
break;
996
1088
997
1089
case AVAHI_BROWSER_REMOVE:
1000
1092
case AVAHI_BROWSER_ALL_FOR_NOW:
1001
1093
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1002
1094
if(debug){
1003
fprintf(stderr, "No Mandos server found, still searching...\n");
1095
fprintf_plus(stderr, "No Mandos server found, still"
1096
" searching...\n");
1004
1097
}
1005
1098
break;
1006
1099
}
1007
1100
}
1008
1101
1009
/* stop main loop after sigterm has been called */
1102
/* Signal handler that stops main loop after SIGTERM */
1010
1103
static void handle_sigterm(int sig){
1011
1104
if(quit_now){
1012
1105
return;
1014
1107
quit_now = 1;
1015
1108
signal_received = sig;
1016
1109
int old_errno = errno;
1110
/* set main loop to exit */
1017
1111
if(mc.simple_poll != NULL){
1018
1112
avahi_simple_poll_quit(mc.simple_poll);
1019
1113
}
1020
1114
errno = old_errno;
1021
1115
}
1022
1116
1117
bool get_flags(const char *ifname, struct ifreq *ifr){
1118
int ret;
1119
1120
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1121
if(s < 0){
1122
perror_plus("socket");
1123
return false;
1124
}
1125
strcpy(ifr->ifr_name, ifname);
1126
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1127
if(ret == -1){
1128
if(debug){
1129
perror_plus("ioctl SIOCGIFFLAGS");
1130
}
1131
return false;
1132
}
1133
return true;
1134
}
1135
1136
bool good_flags(const char *ifname, const struct ifreq *ifr){
1137
1138
/* Reject the loopback device */
1139
if(ifr->ifr_flags & IFF_LOOPBACK){
1140
if(debug){
1141
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1142
ifname);
1143
}
1144
return false;
1145
}
1146
/* Accept point-to-point devices only if connect_to is specified */
1147
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1148
if(debug){
1149
fprintf_plus(stderr, "Accepting point-to-point interface"
1150
" \"%s\"\n", ifname);
1151
}
1152
return true;
1153
}
1154
/* Otherwise, reject non-broadcast-capable devices */
1155
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1156
if(debug){
1157
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1158
" \"%s\"\n", ifname);
1159
}
1160
return false;
1161
}
1162
/* Reject non-ARP interfaces (including dummy interfaces) */
1163
if(ifr->ifr_flags & IFF_NOARP){
1164
if(debug){
1165
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1166
ifname);
1167
}
1168
return false;
1169
}
1170
1171
/* Accept this device */
1172
if(debug){
1173
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1174
}
1175
return true;
1176
}
1177
1178
/*
1179
* This function determines if a directory entry in /sys/class/net
1180
* corresponds to an acceptable network device.
1181
* (This function is passed to scandir(3) as a filter function.)
1182
*/
1183
int good_interface(const struct dirent *if_entry){
1184
if(if_entry->d_name[0] == '.'){
1185
return 0;
1186
}
1187
1188
struct ifreq ifr;
1189
if(not get_flags(if_entry->d_name, &ifr)){
1190
if(debug){
1191
fprintf_plus(stderr, "Failed to get flags for interface "
1192
"\"%s\"\n", if_entry->d_name);
1193
}
1194
return 0;
1195
}
1196
1197
if(not good_flags(if_entry->d_name, &ifr)){
1198
return 0;
1199
}
1200
return 1;
1201
}
1202
1203
/*
1204
* This function determines if a directory entry in /sys/class/net
1205
* corresponds to an acceptable network device which is up.
1206
* (This function is passed to scandir(3) as a filter function.)
1207
*/
1208
int up_interface(const struct dirent *if_entry){
1209
if(if_entry->d_name[0] == '.'){
1210
return 0;
1211
}
1212
1213
struct ifreq ifr;
1214
if(not get_flags(if_entry->d_name, &ifr)){
1215
if(debug){
1216
fprintf_plus(stderr, "Failed to get flags for interface "
1217
"\"%s\"\n", if_entry->d_name);
1218
}
1219
return 0;
1220
}
1221
1222
/* Reject down interfaces */
1223
if(not (ifr.ifr_flags & IFF_UP)){
1224
if(debug){
1225
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1226
if_entry->d_name);
1227
}
1228
return 0;
1229
}
1230
1231
/* Reject non-running interfaces */
1232
if(not (ifr.ifr_flags & IFF_RUNNING)){
1233
if(debug){
1234
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1235
if_entry->d_name);
1236
}
1237
return 0;
1238
}
1239
1240
if(not good_flags(if_entry->d_name, &ifr)){
1241
return 0;
1242
}
1243
return 1;
1244
}
1245
1246
int notdotentries(const struct dirent *direntry){
1247
/* Skip "." and ".." */
1248
if(direntry->d_name[0] == '.'
1249
and (direntry->d_name[1] == '\0'
1250
or (direntry->d_name[1] == '.'
1251
and direntry->d_name[2] == '\0'))){
1252
return 0;
1253
}
1254
return 1;
1255
}
1256
1257
/* Is this directory entry a runnable program? */
1258
int runnable_hook(const struct dirent *direntry){
1259
int ret;
1260
size_t sret;
1261
struct stat st;
1262
1263
if((direntry->d_name)[0] == '\0'){
1264
/* Empty name? */
1265
return 0;
1266
}
1267
1268
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1269
"abcdefghijklmnopqrstuvwxyz"
1270
"0123456789"
1271
"_-");
1272
if((direntry->d_name)[sret] != '\0'){
1273
/* Contains non-allowed characters */
1274
if(debug){
1275
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1276
direntry->d_name);
1277
}
1278
return 0;
1279
}
1280
1281
char *fullname = NULL;
1282
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1283
if(ret < 0){
1284
perror_plus("asprintf");
1285
return 0;
1286
}
1287
1288
ret = stat(fullname, &st);
1289
if(ret == -1){
1290
if(debug){
1291
perror_plus("Could not stat hook");
1292
}
1293
return 0;
1294
}
1295
if(not (S_ISREG(st.st_mode))){
1296
/* Not a regular file */
1297
if(debug){
1298
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1299
direntry->d_name);
1300
}
1301
return 0;
1302
}
1303
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1304
/* Not executable */
1305
if(debug){
1306
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1307
direntry->d_name);
1308
}
1309
return 0;
1310
}
1311
if(debug){
1312
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1313
direntry->d_name);
1314
}
1315
return 1;
1316
}
1317
1318
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1319
int ret;
1320
struct timespec now;
1321
struct timespec waited_time;
1322
intmax_t block_time;
1323
1324
while(true){
1325
if(mc.current_server == NULL){
1326
if (debug){
1327
fprintf_plus(stderr, "Wait until first server is found."
1328
" No timeout!\n");
1329
}
1330
ret = avahi_simple_poll_iterate(s, -1);
1331
} else {
1332
if (debug){
1333
fprintf_plus(stderr, "Check current_server if we should run"
1334
" it, or wait\n");
1335
}
1336
/* the current time */
1337
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1338
if(ret == -1){
1339
perror_plus("clock_gettime");
1340
return -1;
1341
}
1342
/* Calculating in ms how long time between now and server
1343
who we visted longest time ago. Now - last seen. */
1344
waited_time.tv_sec = (now.tv_sec
1345
- mc.current_server->last_seen.tv_sec);
1346
waited_time.tv_nsec = (now.tv_nsec
1347
- mc.current_server->last_seen.tv_nsec);
1348
/* total time is 10s/10,000ms.
1349
Converting to s from ms by dividing by 1,000,
1350
and ns to ms by dividing by 1,000,000. */
1351
block_time = ((retry_interval
1352
- ((intmax_t)waited_time.tv_sec * 1000))
1353
- ((intmax_t)waited_time.tv_nsec / 1000000));
1354
1355
if (debug){
1356
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1357
block_time);
1358
}
1359
1360
if(block_time <= 0){
1361
ret = start_mandos_communication(mc.current_server->ip,
1362
mc.current_server->port,
1363
mc.current_server->if_index,
1364
mc.current_server->af);
1365
if(ret == 0){
1366
avahi_simple_poll_quit(mc.simple_poll);
1367
return 0;
1368
}
1369
ret = clock_gettime(CLOCK_MONOTONIC,
1370
&mc.current_server->last_seen);
1371
if(ret == -1){
1372
perror_plus("clock_gettime");
1373
return -1;
1374
}
1375
mc.current_server = mc.current_server->next;
1376
block_time = 0; /* Call avahi to find new Mandos
1377
servers, but don't block */
1378
}
1379
1380
ret = avahi_simple_poll_iterate(s, (int)block_time);
1381
}
1382
if(ret != 0){
1383
if (ret > 0 or errno != EINTR){
1384
return (ret != 1) ? ret : 0;
1385
}
1386
}
1387
}
1388
}
1389
1390
bool run_network_hooks(const char *mode, const char *interface,
1391
const float delay){
1392
struct dirent **direntries;
1393
struct dirent *direntry;
1394
int ret;
1395
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1396
alphasort);
1397
if(numhooks == -1){
1398
perror_plus("scandir");
1399
} else {
1400
int devnull = open("/dev/null", O_RDONLY);
1401
for(int i = 0; i < numhooks; i++){
1402
direntry = direntries[i];
1403
char *fullname = NULL;
1404
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1405
if(ret < 0){
1406
perror_plus("asprintf");
1407
continue;
1408
}
1409
if(debug){
1410
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1411
direntry->d_name);
1412
}
1413
pid_t hook_pid = fork();
1414
if(hook_pid == 0){
1415
/* Child */
1416
/* Raise privileges */
1417
errno = 0;
1418
ret = seteuid(0);
1419
if(ret == -1){
1420
perror_plus("seteuid");
1421
}
1422
/* Raise privileges even more */
1423
errno = 0;
1424
ret = setuid(0);
1425
if(ret == -1){
1426
perror_plus("setuid");
1427
}
1428
/* Set group */
1429
errno = 0;
1430
ret = setgid(0);
1431
if(ret == -1){
1432
perror_plus("setgid");
1433
}
1434
/* Reset supplementary groups */
1435
errno = 0;
1436
ret = setgroups(0, NULL);
1437
if(ret == -1){
1438
perror_plus("setgroups");
1439
}
1440
dup2(devnull, STDIN_FILENO);
1441
close(devnull);
1442
dup2(STDERR_FILENO, STDOUT_FILENO);
1443
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1444
if(ret == -1){
1445
perror_plus("setenv");
1446
_exit(EX_OSERR);
1447
}
1448
ret = setenv("DEVICE", interface, 1);
1449
if(ret == -1){
1450
perror_plus("setenv");
1451
_exit(EX_OSERR);
1452
}
1453
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1454
if(ret == -1){
1455
perror_plus("setenv");
1456
_exit(EX_OSERR);
1457
}
1458
ret = setenv("MODE", mode, 1);
1459
if(ret == -1){
1460
perror_plus("setenv");
1461
_exit(EX_OSERR);
1462
}
1463
char *delaystring;
1464
ret = asprintf(&delaystring, "%f", delay);
1465
if(ret == -1){
1466
perror_plus("asprintf");
1467
_exit(EX_OSERR);
1468
}
1469
ret = setenv("DELAY", delaystring, 1);
1470
if(ret == -1){
1471
free(delaystring);
1472
perror_plus("setenv");
1473
_exit(EX_OSERR);
1474
}
1475
free(delaystring);
1476
if(connect_to != NULL){
1477
ret = setenv("CONNECT", connect_to, 1);
1478
if(ret == -1){
1479
perror_plus("setenv");
1480
_exit(EX_OSERR);
1481
}
1482
}
1483
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1484
perror_plus("execl");
1485
_exit(EXIT_FAILURE);
1486
}
1487
} else {
1488
int status;
1489
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1490
perror_plus("waitpid");
1491
free(fullname);
1492
continue;
1493
}
1494
if(WIFEXITED(status)){
1495
if(WEXITSTATUS(status) != 0){
1496
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1497
" with status %d\n", direntry->d_name,
1498
WEXITSTATUS(status));
1499
free(fullname);
1500
continue;
1501
}
1502
} else if(WIFSIGNALED(status)){
1503
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1504
" signal %d\n", direntry->d_name,
1505
WTERMSIG(status));
1506
free(fullname);
1507
continue;
1508
} else {
1509
fprintf_plus(stderr, "Warning: network hook \"%s\""
1510
" crashed\n", direntry->d_name);
1511
free(fullname);
1512
continue;
1513
}
1514
}
1515
free(fullname);
1516
if(debug){
1517
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1518
direntry->d_name);
1519
}
1520
}
1521
close(devnull);
1522
}
1523
return true;
1524
}
1525
1023
1526
int main(int argc, char *argv[]){
1024
1527
AvahiSServiceBrowser *sb = NULL;
1025
1528
int error;
1027
1530
intmax_t tmpmax;
1028
1531
char *tmp;
1029
1532
int exitcode = EXIT_SUCCESS;
1030
const char *interface = "eth0";
1533
const char *interface = "";
1031
1534
struct ifreq network;
1032
1535
int sd = -1;
1033
1536
bool take_down_interface = false;
1034
1537
uid_t uid;
1035
1538
gid_t gid;
1036
char *connect_to = NULL;
1037
1539
char tempdir[] = "/tmp/mandosXXXXXX";
1038
1540
bool tempdir_created = false;
1039
1541
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1043
1545
bool gnutls_initialized = false;
1044
1546
bool gpgme_initialized = false;
1045
1547
float delay = 2.5f;
1548
double retry_interval = 10; /* 10s between trying a server and
1549
retrying the same server again */
1046
1550
1047
1551
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1048
1552
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1054
1558
errno = 0;
1055
1559
ret = setgid(gid);
1056
1560
if(ret == -1){
1057
perror("setgid");
1561
perror_plus("setgid");
1058
1562
}
1059
1563
1060
1564
/* Lower user privileges (temporarily) */
1061
1565
errno = 0;
1062
1566
ret = seteuid(uid);
1063
1567
if(ret == -1){
1064
perror("seteuid");
1568
perror_plus("seteuid");
1065
1569
}
1066
1570
1067
1571
if(quit_now){
1102
1606
.arg = "SECONDS",
1103
1607
.doc = "Maximum delay to wait for interface startup",
1104
1608
.group = 2 },
1609
{ .name = "retry", .key = 132,
1610
.arg = "SECONDS",
1611
.doc = "Retry interval used when denied by the Mandos server",
1612
.group = 2 },
1613
{ .name = "network-hook-dir", .key = 133,
1614
.arg = "DIR",
1615
.doc = "Directory where network hooks are located",
1616
.group = 2 },
1105
1617
/*
1106
1618
* These reproduce what we would get without ARGP_NO_HELP
1107
1619
*/
1151
1663
if(errno != 0 or tmp == arg or *tmp != '\0'){
1152
1664
argp_error(state, "Bad delay");
1153
1665
}
1666
case 132: /* --retry */
1667
errno = 0;
1668
retry_interval = strtod(arg, &tmp);
1669
if(errno != 0 or tmp == arg or *tmp != '\0'
1670
or (retry_interval * 1000) > INT_MAX
1671
or retry_interval < 0){
1672
argp_error(state, "Bad retry interval");
1673
}
1674
break;
1675
case 133: /* --network-hook-dir */
1676
hookdir = arg;
1154
1677
break;
1155
1678
/*
1156
1679
* These reproduce what we would get without ARGP_NO_HELP
1163
1686
argp_state_help(state, state->out_stream,
1164
1687
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1165
1688
case 'V': /* --version */
1166
fprintf(state->out_stream, "%s\n", argp_program_version);
1689
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1167
1690
exit(argp_err_exit_status);
1168
1691
break;
1169
1692
default:
1184
1707
case ENOMEM:
1185
1708
default:
1186
1709
errno = ret;
1187
perror("argp_parse");
1710
perror_plus("argp_parse");
1188
1711
exitcode = EX_OSERR;
1189
1712
goto end;
1190
1713
case EINVAL:
1192
1715
goto end;
1193
1716
}
1194
1717
}
1718
1719
{
1720
/* Work around Debian bug #633582:
1721
<http://bugs.debian.org/633582> */
1722
1723
/* Re-raise priviliges */
1724
errno = 0;
1725
ret = seteuid(0);
1726
if(ret == -1){
1727
perror_plus("seteuid");
1728
} else {
1729
struct stat st;
1730
1731
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1732
int seckey_fd = open(seckey, O_RDONLY);
1733
if(seckey_fd == -1){
1734
perror_plus("open");
1735
} else {
1736
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1737
if(ret == -1){
1738
perror_plus("fstat");
1739
} else {
1740
if(S_ISREG(st.st_mode)
1741
and st.st_uid == 0 and st.st_gid == 0){
1742
ret = fchown(seckey_fd, uid, gid);
1743
if(ret == -1){
1744
perror_plus("fchown");
1745
}
1746
}
1747
}
1748
TEMP_FAILURE_RETRY(close(seckey_fd));
1749
}
1750
}
1751
1752
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1753
int pubkey_fd = open(pubkey, O_RDONLY);
1754
if(pubkey_fd == -1){
1755
perror_plus("open");
1756
} else {
1757
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1758
if(ret == -1){
1759
perror_plus("fstat");
1760
} else {
1761
if(S_ISREG(st.st_mode)
1762
and st.st_uid == 0 and st.st_gid == 0){
1763
ret = fchown(pubkey_fd, uid, gid);
1764
if(ret == -1){
1765
perror_plus("fchown");
1766
}
1767
}
1768
}
1769
TEMP_FAILURE_RETRY(close(pubkey_fd));
1770
}
1771
}
1772
1773
/* Lower privileges */
1774
errno = 0;
1775
ret = seteuid(uid);
1776
if(ret == -1){
1777
perror_plus("seteuid");
1778
}
1779
}
1780
}
1781
1782
/* Run network hooks */
1783
if(not run_network_hooks("start", interface, delay)){
1784
goto end;
1785
}
1195
1786
1196
1787
if(not debug){
1197
1788
avahi_set_log_function(empty_log);
1198
1789
}
1199
1790
1791
if(interface[0] == '\0'){
1792
struct dirent **direntries;
1793
/* First look for interfaces that are up */
1794
ret = scandir(sys_class_net, &direntries, up_interface,
1795
alphasort);
1796
if(ret == 0){
1797
/* No up interfaces, look for any good interfaces */
1798
free(direntries);
1799
ret = scandir(sys_class_net, &direntries, good_interface,
1800
alphasort);
1801
}
1802
if(ret >= 1){
1803
/* Pick the first interface returned */
1804
interface = strdup(direntries[0]->d_name);
1805
if(debug){
1806
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1807
}
1808
if(interface == NULL){
1809
perror_plus("malloc");
1810
free(direntries);
1811
exitcode = EXIT_FAILURE;
1812
goto end;
1813
}
1814
free(direntries);
1815
} else {
1816
free(direntries);
1817
fprintf_plus(stderr, "Could not find a network interface\n");
1818
exitcode = EXIT_FAILURE;
1819
goto end;
1820
}
1821
}
1822
1200
1823
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1201
1824
from the signal handler */
1202
1825
/* Initialize the pseudo-RNG for Avahi */
1203
1826
srand((unsigned int) time(NULL));
1204
1827
mc.simple_poll = avahi_simple_poll_new();
1205
1828
if(mc.simple_poll == NULL){
1206
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1829
fprintf_plus(stderr,
1830
"Avahi: Failed to create simple poll object.\n");
1207
1831
exitcode = EX_UNAVAILABLE;
1208
1832
goto end;
1209
1833
}
1211
1835
sigemptyset(&sigterm_action.sa_mask);
1212
1836
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1213
1837
if(ret == -1){
1214
perror("sigaddset");
1838
perror_plus("sigaddset");
1215
1839
exitcode = EX_OSERR;
1216
1840
goto end;
1217
1841
}
1218
1842
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1219
1843
if(ret == -1){
1220
perror("sigaddset");
1844
perror_plus("sigaddset");
1221
1845
exitcode = EX_OSERR;
1222
1846
goto end;
1223
1847
}
1224
1848
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1225
1849
if(ret == -1){
1226
perror("sigaddset");
1850
perror_plus("sigaddset");
1227
1851
exitcode = EX_OSERR;
1228
1852
goto end;
1229
1853
}
1233
1857
*/
1234
1858
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1235
1859
if(ret == -1){
1236
perror("sigaction");
1860
perror_plus("sigaction");
1237
1861
return EX_OSERR;
1238
1862
}
1239
1863
if(old_sigterm_action.sa_handler != SIG_IGN){
1240
1864
ret = sigaction(SIGINT, &sigterm_action, NULL);
1241
1865
if(ret == -1){
1242
perror("sigaction");
1866
perror_plus("sigaction");
1243
1867
exitcode = EX_OSERR;
1244
1868
goto end;
1245
1869
}
1246
1870
}
1247
1871
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1248
1872
if(ret == -1){
1249
perror("sigaction");
1873
perror_plus("sigaction");
1250
1874
return EX_OSERR;
1251
1875
}
1252
1876
if(old_sigterm_action.sa_handler != SIG_IGN){
1253
1877
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1254
1878
if(ret == -1){
1255
perror("sigaction");
1879
perror_plus("sigaction");
1256
1880
exitcode = EX_OSERR;
1257
1881
goto end;
1258
1882
}
1259
1883
}
1260
1884
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1261
1885
if(ret == -1){
1262
perror("sigaction");
1886
perror_plus("sigaction");
1263
1887
return EX_OSERR;
1264
1888
}
1265
1889
if(old_sigterm_action.sa_handler != SIG_IGN){
1266
1890
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1267
1891
if(ret == -1){
1268
perror("sigaction");
1892
perror_plus("sigaction");
1269
1893
exitcode = EX_OSERR;
1270
1894
goto end;
1271
1895
}
1272
1896
}
1273
1897
1274
1898
/* If the interface is down, bring it up */
1275
if(interface[0] != '\0'){
1899
if(strcmp(interface, "none") != 0){
1276
1900
if_index = (AvahiIfIndex) if_nametoindex(interface);
1277
1901
if(if_index == 0){
1278
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1902
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1279
1903
exitcode = EX_UNAVAILABLE;
1280
1904
goto end;
1281
1905
}
1288
1912
errno = 0;
1289
1913
ret = seteuid(0);
1290
1914
if(ret == -1){
1291
perror("seteuid");
1915
perror_plus("seteuid");
1292
1916
}
1293
1917
1294
1918
#ifdef __linux__
1298
1922
bool restore_loglevel = true;
1299
1923
if(ret == -1){
1300
1924
restore_loglevel = false;
1301
perror("klogctl");
1925
perror_plus("klogctl");
1302
1926
}
1303
1927
#endif /* __linux__ */
1304
1928
1305
1929
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1306
1930
if(sd < 0){
1307
perror("socket");
1931
perror_plus("socket");
1308
1932
exitcode = EX_OSERR;
1309
1933
#ifdef __linux__
1310
1934
if(restore_loglevel){
1311
1935
ret = klogctl(7, NULL, 0);
1312
1936
if(ret == -1){
1313
perror("klogctl");
1937
perror_plus("klogctl");
1314
1938
}
1315
1939
}
1316
1940
#endif /* __linux__ */
1318
1942
errno = 0;
1319
1943
ret = seteuid(uid);
1320
1944
if(ret == -1){
1321
perror("seteuid");
1945
perror_plus("seteuid");
1322
1946
}
1323
1947
goto end;
1324
1948
}
1325
1949
strcpy(network.ifr_name, interface);
1326
1950
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1327
1951
if(ret == -1){
1328
perror("ioctl SIOCGIFFLAGS");
1952
perror_plus("ioctl SIOCGIFFLAGS");
1329
1953
#ifdef __linux__
1330
1954
if(restore_loglevel){
1331
1955
ret = klogctl(7, NULL, 0);
1332
1956
if(ret == -1){
1333
perror("klogctl");
1957
perror_plus("klogctl");
1334
1958
}
1335
1959
}
1336
1960
#endif /* __linux__ */
1339
1963
errno = 0;
1340
1964
ret = seteuid(uid);
1341
1965
if(ret == -1){
1342
perror("seteuid");
1966
perror_plus("seteuid");
1343
1967
}
1344
1968
goto end;
1345
1969
}
1349
1973
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1350
1974
if(ret == -1){
1351
1975
take_down_interface = false;
1352
perror("ioctl SIOCSIFFLAGS");
1976
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1353
1977
exitcode = EX_OSERR;
1354
1978
#ifdef __linux__
1355
1979
if(restore_loglevel){
1356
1980
ret = klogctl(7, NULL, 0);
1357
1981
if(ret == -1){
1358
perror("klogctl");
1982
perror_plus("klogctl");
1359
1983
}
1360
1984
}
1361
1985
#endif /* __linux__ */
1363
1987
errno = 0;
1364
1988
ret = seteuid(uid);
1365
1989
if(ret == -1){
1366
perror("seteuid");
1990
perror_plus("seteuid");
1367
1991
}
1368
1992
goto end;
1369
1993
}
1370
1994
}
1371
/* sleep checking until interface is running */
1995
/* Sleep checking until interface is running.
1996
Check every 0.25s, up to total time of delay */
1372
1997
for(int i=0; i < delay * 4; i++){
1373
1998
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1374
1999
if(ret == -1){
1375
perror("ioctl SIOCGIFFLAGS");
2000
perror_plus("ioctl SIOCGIFFLAGS");
1376
2001
} else if(network.ifr_flags & IFF_RUNNING){
1377
2002
break;
1378
2003
}
1379
2004
struct timespec sleeptime = { .tv_nsec = 250000000 };
1380
2005
ret = nanosleep(&sleeptime, NULL);
1381
2006
if(ret == -1 and errno != EINTR){
1382
perror("nanosleep");
2007
perror_plus("nanosleep");
1383
2008
}
1384
2009
}
1385
2010
if(not take_down_interface){
1386
2011
/* We won't need the socket anymore */
1387
2012
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1388
2013
if(ret == -1){
1389
perror("close");
2014
perror_plus("close");
1390
2015
}
1391
2016
}
1392
2017
#ifdef __linux__
1394
2019
/* Restores kernel loglevel to default */
1395
2020
ret = klogctl(7, NULL, 0);
1396
2021
if(ret == -1){
1397
perror("klogctl");
2022
perror_plus("klogctl");
1398
2023
}
1399
2024
}
1400
2025
#endif /* __linux__ */
1401
2026
/* Lower privileges */
1402
2027
errno = 0;
1403
if(take_down_interface){
1404
/* Lower privileges */
1405
ret = seteuid(uid);
1406
if(ret == -1){
1407
perror("seteuid");
1408
}
1409
} else {
1410
/* Lower privileges permanently */
1411
ret = setuid(uid);
1412
if(ret == -1){
1413
perror("setuid");
1414
}
2028
/* Lower privileges */
2029
ret = seteuid(uid);
2030
if(ret == -1){
2031
perror_plus("seteuid");
1415
2032
}
1416
2033
}
1417
2034
1421
2038
1422
2039
ret = init_gnutls_global(pubkey, seckey);
1423
2040
if(ret == -1){
1424
fprintf(stderr, "init_gnutls_global failed\n");
2041
fprintf_plus(stderr, "init_gnutls_global failed\n");
1425
2042
exitcode = EX_UNAVAILABLE;
1426
2043
goto end;
1427
2044
} else {
1432
2049
goto end;
1433
2050
}
1434
2051
2052
if(mkdtemp(tempdir) == NULL){
2053
perror_plus("mkdtemp");
2054
goto end;
2055
}
1435
2056
tempdir_created = true;
1436
if(mkdtemp(tempdir) == NULL){
1437
tempdir_created = false;
1438
perror("mkdtemp");
1439
goto end;
1440
}
1441
2057
1442
2058
if(quit_now){
1443
2059
goto end;
1444
2060
}
1445
2061
1446
2062
if(not init_gpgme(pubkey, seckey, tempdir)){
1447
fprintf(stderr, "init_gpgme failed\n");
2063
fprintf_plus(stderr, "init_gpgme failed\n");
1448
2064
exitcode = EX_UNAVAILABLE;
1449
2065
goto end;
1450
2066
} else {
1460
2076
/* (Mainly meant for debugging) */
1461
2077
char *address = strrchr(connect_to, ':');
1462
2078
if(address == NULL){
1463
fprintf(stderr, "No colon in address\n");
2079
fprintf_plus(stderr, "No colon in address\n");
1464
2080
exitcode = EX_USAGE;
1465
2081
goto end;
1466
2082
}
1474
2090
tmpmax = strtoimax(address+1, &tmp, 10);
1475
2091
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1476
2092
or tmpmax != (uint16_t)tmpmax){
1477
fprintf(stderr, "Bad port number\n");
2093
fprintf_plus(stderr, "Bad port number\n");
1478
2094
exitcode = EX_USAGE;
1479
2095
goto end;
1480
2096
}
1485
2101
1486
2102
port = (uint16_t)tmpmax;
1487
2103
*address = '\0';
1488
address = connect_to;
1489
2104
/* Colon in address indicates IPv6 */
1490
2105
int af;
1491
if(strchr(address, ':') != NULL){
2106
if(strchr(connect_to, ':') != NULL){
1492
2107
af = AF_INET6;
2108
/* Accept [] around IPv6 address - see RFC 5952 */
2109
if(connect_to[0] == '[' and address[-1] == ']')
2110
{
2111
connect_to++;
2112
address[-1] = '\0';
2113
}
1493
2114
} else {
1494
2115
af = AF_INET;
1495
2116
}
2117
address = connect_to;
1496
2118
1497
2119
if(quit_now){
1498
2120
goto end;
1499
2121
}
1500
2122
1501
ret = start_mandos_communication(address, port, if_index, af);
1502
if(ret < 0){
1503
switch(errno){
1504
case ENETUNREACH:
1505
case EHOSTDOWN:
1506
case EHOSTUNREACH:
1507
exitcode = EX_NOHOST;
1508
break;
1509
case EINVAL:
1510
exitcode = EX_USAGE;
1511
break;
1512
case EIO:
1513
exitcode = EX_IOERR;
1514
break;
1515
case EPROTO:
1516
exitcode = EX_PROTOCOL;
1517
break;
1518
default:
1519
exitcode = EX_OSERR;
1520
break;
1521
}
1522
} else {
2123
while(not quit_now){
2124
ret = start_mandos_communication(address, port, if_index, af);
2125
if(quit_now or ret == 0){
2126
break;
2127
}
2128
if(debug){
2129
fprintf_plus(stderr, "Retrying in %d seconds\n",
2130
(int)retry_interval);
2131
}
2132
sleep((int)retry_interval);
2133
}
2134
2135
if (not quit_now){
1523
2136
exitcode = EXIT_SUCCESS;
1524
2137
}
2138
1525
2139
goto end;
1526
2140
}
1527
2141
1549
2163
1550
2164
/* Check if creating the Avahi server object succeeded */
1551
2165
if(mc.server == NULL){
1552
fprintf(stderr, "Failed to create Avahi server: %s\n",
1553
avahi_strerror(error));
2166
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2167
avahi_strerror(error));
1554
2168
exitcode = EX_UNAVAILABLE;
1555
2169
goto end;
1556
2170
}
1564
2178
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1565
2179
NULL, 0, browse_callback, NULL);
1566
2180
if(sb == NULL){
1567
fprintf(stderr, "Failed to create service browser: %s\n",
1568
avahi_strerror(avahi_server_errno(mc.server)));
2181
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2182
avahi_strerror(avahi_server_errno(mc.server)));
1569
2183
exitcode = EX_UNAVAILABLE;
1570
2184
goto end;
1571
2185
}
1577
2191
/* Run the main loop */
1578
2192
1579
2193
if(debug){
1580
fprintf(stderr, "Starting Avahi loop search\n");
1581
}
1582
1583
avahi_simple_poll_loop(mc.simple_poll);
2194
fprintf_plus(stderr, "Starting Avahi loop search\n");
2195
}
2196
2197
ret = avahi_loop_with_timeout(mc.simple_poll,
2198
(int)(retry_interval * 1000));
2199
if(debug){
2200
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2201
(ret == 0) ? "successfully" : "with error");
2202
}
1584
2203
1585
2204
end:
1586
2205
1587
2206
if(debug){
1588
fprintf(stderr, "%s exiting\n", argv[0]);
2207
fprintf_plus(stderr, "%s exiting\n", argv[0]);
1589
2208
}
1590
2209
1591
2210
/* Cleanup things */
1608
2227
gpgme_release(mc.ctx);
1609
2228
}
1610
2229
1611
/* Take down the network interface */
1612
if(take_down_interface){
1613
/* Re-raise priviliges */
2230
/* Cleans up the circular linked list of Mandos servers the client
2231
has seen */
2232
if(mc.current_server != NULL){
2233
mc.current_server->prev->next = NULL;
2234
while(mc.current_server != NULL){
2235
server *next = mc.current_server->next;
2236
free(mc.current_server);
2237
mc.current_server = next;
2238
}
2239
}
2240
2241
/* Run network hooks */
2242
run_network_hooks("stop", interface, delay);
2243
2244
/* Re-raise priviliges */
2245
{
1614
2246
errno = 0;
1615
2247
ret = seteuid(0);
1616
2248
if(ret == -1){
1617
perror("seteuid");
2249
perror_plus("seteuid");
1618
2250
}
1619
if(geteuid() == 0){
2251
2252
/* Take down the network interface */
2253
if(take_down_interface and geteuid() == 0){
1620
2254
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1621
2255
if(ret == -1){
1622
perror("ioctl SIOCGIFFLAGS");
1623
} else if(network.ifr_flags & IFF_UP) {
2256
perror_plus("ioctl SIOCGIFFLAGS");
2257
} else if(network.ifr_flags & IFF_UP){
1624
2258
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1625
2259
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1626
2260
if(ret == -1){
1627
perror("ioctl SIOCSIFFLAGS");
2261
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1628
2262
}
1629
2263
}
1630
2264
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1631
2265
if(ret == -1){
1632
perror("close");
1633
}
1634
/* Lower privileges permanently */
1635
errno = 0;
1636
ret = setuid(uid);
1637
if(ret == -1){
1638
perror("setuid");
2266
perror_plus("close");
1639
2267
}
1640
2268
}
1641
2269
}
2270
/* Lower privileges permanently */
2271
errno = 0;
2272
ret = setuid(uid);
2273
if(ret == -1){
2274
perror_plus("setuid");
2275
}
1642
2276
1643
/* Removes the temp directory used by GPGME */
2277
/* Removes the GPGME temp directory and all files inside */
1644
2278
if(tempdir_created){
1645
DIR *d;
1646
struct dirent *direntry;
1647
d = opendir(tempdir);
1648
if(d == NULL){
1649
if(errno != ENOENT){
1650
perror("opendir");
1651
}
1652
} else {
1653
while(true){
1654
direntry = readdir(d);
1655
if(direntry == NULL){
1656
break;
1657
}
1658
/* Skip "." and ".." */
1659
if(direntry->d_name[0] == '.'
1660
and (direntry->d_name[1] == '\0'
1661
or (direntry->d_name[1] == '.'
1662
and direntry->d_name[2] == '\0'))){
1663
continue;
1664
}
2279
struct dirent **direntries = NULL;
2280
struct dirent *direntry = NULL;
2281
int numentries = scandir(tempdir, &direntries, notdotentries,
2282
alphasort);
2283
if (numentries > 0){
2284
for(int i = 0; i < numentries; i++){
2285
direntry = direntries[i];
1665
2286
char *fullname = NULL;
1666
2287
ret = asprintf(&fullname, "%s/%s", tempdir,
1667
2288
direntry->d_name);
1668
2289
if(ret < 0){
1669
perror("asprintf");
2290
perror_plus("asprintf");
1670
2291
continue;
1671
2292
}
1672
2293
ret = remove(fullname);
1673
2294
if(ret == -1){
1674
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1675
strerror(errno));
2295
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2296
strerror(errno));
1676
2297
}
1677
2298
free(fullname);
1678
2299
}
1679
closedir(d);
2300
}
2301
2302
/* need to clean even if 0 because man page doesn't specify */
2303
free(direntries);
2304
if (numentries == -1){
2305
perror_plus("scandir");
1680
2306
}
1681
2307
ret = rmdir(tempdir);
1682
2308
if(ret == -1 and errno != ENOENT){
1683
perror("rmdir");
2309
perror_plus("rmdir");
1684
2310
}
1685
2311
}
1686
2312
1691
2317
&old_sigterm_action,
1692
2318
NULL));
1693
2319
if(ret == -1){
1694
perror("sigaction");
2320
perror_plus("sigaction");
1695
2321
}
1696
2322
do {
1697
2323
ret = raise(signal_received);
1698
2324
} while(ret != 0 and errno == EINTR);
1699
2325
if(ret != 0){
1700
perror("raise");
2326
perror_plus("raise");
1701
2327
abort();
1702
2328
}
1703
2329
TEMP_FAILURE_RETRY(pause());
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0