To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 541
- compare with another revision
- download diff
- download tarball
- view history from revision 541
- Committer: Teddy Hogeborn
- Date: 2011-12-31 20:07:11 UTC
- mfrom: (535.1.9 wireless-network-hook)
- Revision ID: teddy@recompile.se-20111231200711-6dli3r8drftem57r
Merge new wireless network hook. Fix bridge network hook to use
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
- files added:
- DBUS-API
- debian/source
- network-hooks.d
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
12
* Copyright © 2008-2011 Teddy Hogeborn
13
* Copyright © 2008-2011 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
26
26
* along with this program. If not, see
27
27
* <http://www.gnu.org/licenses/>.
28
28
*
29
* Contact the authors at <mandos@fukt.bsnet.se>.
29
* Contact the authors at <mandos@recompile.se>.
30
30
*/
31
31
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
53
53
sockaddr_in6, PF_INET6,
54
54
SOCK_STREAM, uid_t, gid_t, open(),
55
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
56
#include <sys/stat.h> /* open(), S_ISREG */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
58
inet_pton(), connect() */
59
59
#include <fcntl.h> /* open() */
62
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
63
strtoimax() */
64
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
65
#include <errno.h> /* perror(), errno,
66
program_invocation_short_name */
67
#include <time.h> /* nanosleep(), time(), sleep() */
67
68
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
69
SIOCSIFFLAGS, if_indextoname(),
69
70
if_nametoindex(), IF_NAMESIZE */
72
73
*/
73
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
75
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
76
setgid(), pause(), _exit() */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
77
78
#include <iso646.h> /* not, or, and */
78
79
#include <argp.h> /* struct argp_option, error_t, struct
79
80
argp_state, struct argp,
84
85
raise() */
85
86
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
86
87
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
89
WEXITSTATUS(), WTERMSIG() */
90
#include <grp.h> /* setgroups() */
87
91
88
92
#ifdef __linux__
89
93
#include <sys/klog.h> /* klogctl() */
107
111
init_gnutls_session(),
108
112
GNUTLS_* */
109
113
#include <gnutls/openpgp.h>
110
/* gnutls_certificate_set_openpgp_key_file(),
111
GNUTLS_OPENPGP_FMT_BASE64 */
114
/* gnutls_certificate_set_openpgp_key_file(),
115
GNUTLS_OPENPGP_FMT_BASE64 */
112
116
113
117
/* GPGME */
114
118
#include <gpgme.h> /* All GPGME types, constants and
122
126
#define PATHDIR "/conf/conf.d/mandos"
123
127
#define SECKEY "seckey.txt"
124
128
#define PUBKEY "pubkey.txt"
129
#define HOOKDIR "/lib/mandos/network-hooks.d"
125
130
126
131
bool debug = false;
127
132
static const char mandos_protocol_version[] = "1";
128
133
const char *argp_program_version = "mandos-client " VERSION;
129
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
134
const char *argp_program_bug_address = "<mandos@recompile.se>";
130
135
static const char sys_class_net[] = "/sys/class/net";
131
136
char *connect_to = NULL;
137
const char *hookdir = HOOKDIR;
138
139
/* Doubly linked list that need to be circularly linked when used */
140
typedef struct server{
141
const char *ip;
142
uint16_t port;
143
AvahiIfIndex if_index;
144
int af;
145
struct timespec last_seen;
146
struct server *next;
147
struct server *prev;
148
} server;
132
149
133
150
/* Used for passing in values through the Avahi callback functions */
134
151
typedef struct {
139
156
gnutls_dh_params_t dh_params;
140
157
const char *priority;
141
158
gpgme_ctx_t ctx;
159
server *current_server;
142
160
} mandos_context;
143
161
144
162
/* global context so signal handler can reach it*/
145
163
mandos_context mc = { .simple_poll = NULL, .server = NULL,
146
164
.dh_bits = 1024, .priority = "SECURE256"
147
":!CTYPE-X.509:+CTYPE-OPENPGP" };
165
":!CTYPE-X.509:+CTYPE-OPENPGP",
166
.current_server = NULL };
148
167
149
168
sig_atomic_t quit_now = 0;
150
169
int signal_received = 0;
151
170
171
/* Function to use when printing errors */
172
void perror_plus(const char *print_text){
173
int e = errno;
174
fprintf(stderr, "Mandos plugin %s: ",
175
program_invocation_short_name);
176
errno = e;
177
perror(print_text);
178
}
179
180
__attribute__((format (gnu_printf, 2, 3)))
181
int fprintf_plus(FILE *stream, const char *format, ...){
182
va_list ap;
183
va_start (ap, format);
184
185
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
186
program_invocation_short_name));
187
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
188
}
189
152
190
/*
153
191
* Make additional room in "buffer" for at least BUFFER_SIZE more
154
192
* bytes. "buffer_capacity" is how much is currently allocated,
155
193
* "buffer_length" is how much is already used.
156
194
*/
157
195
size_t incbuffer(char **buffer, size_t buffer_length,
158
size_t buffer_capacity){
196
size_t buffer_capacity){
159
197
if(buffer_length + BUFFER_SIZE > buffer_capacity){
160
198
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
161
199
if(buffer == NULL){
166
204
return buffer_capacity;
167
205
}
168
206
207
/* Add server to set of servers to retry periodically */
208
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
209
int af){
210
int ret;
211
server *new_server = malloc(sizeof(server));
212
if(new_server == NULL){
213
perror_plus("malloc");
214
return false;
215
}
216
*new_server = (server){ .ip = strdup(ip),
217
.port = port,
218
.if_index = if_index,
219
.af = af };
220
if(new_server->ip == NULL){
221
perror_plus("strdup");
222
return false;
223
}
224
/* Special case of first server */
225
if (mc.current_server == NULL){
226
new_server->next = new_server;
227
new_server->prev = new_server;
228
mc.current_server = new_server;
229
/* Place the new server last in the list */
230
} else {
231
new_server->next = mc.current_server;
232
new_server->prev = mc.current_server->prev;
233
new_server->prev->next = new_server;
234
mc.current_server->prev = new_server;
235
}
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
237
if(ret == -1){
238
perror_plus("clock_gettime");
239
return false;
240
}
241
return true;
242
}
243
169
244
/*
170
245
* Initialize GPGME.
171
246
*/
172
static bool init_gpgme(const char *seckey,
173
const char *pubkey, const char *tempdir){
247
static bool init_gpgme(const char *seckey, const char *pubkey,
248
const char *tempdir){
174
249
gpgme_error_t rc;
175
250
gpgme_engine_info_t engine_info;
176
251
185
260
186
261
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
187
262
if(fd == -1){
188
perror("open");
263
perror_plus("open");
189
264
return false;
190
265
}
191
266
192
267
rc = gpgme_data_new_from_fd(&pgp_data, fd);
193
268
if(rc != GPG_ERR_NO_ERROR){
194
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
195
gpgme_strsource(rc), gpgme_strerror(rc));
269
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
270
gpgme_strsource(rc), gpgme_strerror(rc));
196
271
return false;
197
272
}
198
273
199
274
rc = gpgme_op_import(mc.ctx, pgp_data);
200
275
if(rc != GPG_ERR_NO_ERROR){
201
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
202
gpgme_strsource(rc), gpgme_strerror(rc));
276
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
277
gpgme_strsource(rc), gpgme_strerror(rc));
203
278
return false;
204
279
}
205
280
206
281
ret = (int)TEMP_FAILURE_RETRY(close(fd));
207
282
if(ret == -1){
208
perror("close");
283
perror_plus("close");
209
284
}
210
285
gpgme_data_release(pgp_data);
211
286
return true;
212
287
}
213
288
214
289
if(debug){
215
fprintf(stderr, "Initializing GPGME\n");
290
fprintf_plus(stderr, "Initializing GPGME\n");
216
291
}
217
292
218
293
/* Init GPGME */
219
294
gpgme_check_version(NULL);
220
295
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
221
296
if(rc != GPG_ERR_NO_ERROR){
222
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
223
gpgme_strsource(rc), gpgme_strerror(rc));
297
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
298
gpgme_strsource(rc), gpgme_strerror(rc));
224
299
return false;
225
300
}
226
301
227
/* Set GPGME home directory for the OpenPGP engine only */
302
/* Set GPGME home directory for the OpenPGP engine only */
228
303
rc = gpgme_get_engine_info(&engine_info);
229
304
if(rc != GPG_ERR_NO_ERROR){
230
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
231
gpgme_strsource(rc), gpgme_strerror(rc));
305
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
306
gpgme_strsource(rc), gpgme_strerror(rc));
232
307
return false;
233
308
}
234
309
while(engine_info != NULL){
240
315
engine_info = engine_info->next;
241
316
}
242
317
if(engine_info == NULL){
243
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
318
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
319
tempdir);
244
320
return false;
245
321
}
246
322
247
323
/* Create new GPGME "context" */
248
324
rc = gpgme_new(&(mc.ctx));
249
325
if(rc != GPG_ERR_NO_ERROR){
250
fprintf(stderr, "bad gpgme_new: %s: %s\n",
251
gpgme_strsource(rc), gpgme_strerror(rc));
326
fprintf_plus(stderr, "Mandos plugin mandos-client: "
327
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
328
gpgme_strerror(rc));
252
329
return false;
253
330
}
254
331
273
350
ssize_t plaintext_length = 0;
274
351
275
352
if(debug){
276
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
353
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
277
354
}
278
355
279
356
/* Create new GPGME data buffer from memory cryptotext */
280
357
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
281
358
0);
282
359
if(rc != GPG_ERR_NO_ERROR){
283
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
284
gpgme_strsource(rc), gpgme_strerror(rc));
360
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
361
gpgme_strsource(rc), gpgme_strerror(rc));
285
362
return -1;
286
363
}
287
364
288
365
/* Create new empty GPGME data buffer for the plaintext */
289
366
rc = gpgme_data_new(&dh_plain);
290
367
if(rc != GPG_ERR_NO_ERROR){
291
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
292
gpgme_strsource(rc), gpgme_strerror(rc));
368
fprintf_plus(stderr, "Mandos plugin mandos-client: "
369
"bad gpgme_data_new: %s: %s\n",
370
gpgme_strsource(rc), gpgme_strerror(rc));
293
371
gpgme_data_release(dh_crypto);
294
372
return -1;
295
373
}
298
376
data buffer */
299
377
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
300
378
if(rc != GPG_ERR_NO_ERROR){
301
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
302
gpgme_strsource(rc), gpgme_strerror(rc));
379
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
380
gpgme_strsource(rc), gpgme_strerror(rc));
303
381
plaintext_length = -1;
304
382
if(debug){
305
383
gpgme_decrypt_result_t result;
306
384
result = gpgme_op_decrypt_result(mc.ctx);
307
385
if(result == NULL){
308
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
386
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
309
387
} else {
310
fprintf(stderr, "Unsupported algorithm: %s\n",
311
result->unsupported_algorithm);
312
fprintf(stderr, "Wrong key usage: %u\n",
313
result->wrong_key_usage);
388
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
389
result->unsupported_algorithm);
390
fprintf_plus(stderr, "Wrong key usage: %u\n",
391
result->wrong_key_usage);
314
392
if(result->file_name != NULL){
315
fprintf(stderr, "File name: %s\n", result->file_name);
393
fprintf_plus(stderr, "File name: %s\n", result->file_name);
316
394
}
317
395
gpgme_recipient_t recipient;
318
396
recipient = result->recipients;
319
397
while(recipient != NULL){
320
fprintf(stderr, "Public key algorithm: %s\n",
321
gpgme_pubkey_algo_name(recipient->pubkey_algo));
322
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
323
fprintf(stderr, "Secret key available: %s\n",
324
recipient->status == GPG_ERR_NO_SECKEY
325
? "No" : "Yes");
398
fprintf_plus(stderr, "Public key algorithm: %s\n",
399
gpgme_pubkey_algo_name
400
(recipient->pubkey_algo));
401
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
402
fprintf_plus(stderr, "Secret key available: %s\n",
403
recipient->status == GPG_ERR_NO_SECKEY
404
? "No" : "Yes");
326
405
recipient = recipient->next;
327
406
}
328
407
}
331
410
}
332
411
333
412
if(debug){
334
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
413
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
335
414
}
336
415
337
416
/* Seek back to the beginning of the GPGME plaintext data buffer */
338
417
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
339
perror("gpgme_data_seek");
418
perror_plus("gpgme_data_seek");
340
419
plaintext_length = -1;
341
420
goto decrypt_end;
342
421
}
344
423
*plaintext = NULL;
345
424
while(true){
346
425
plaintext_capacity = incbuffer(plaintext,
347
(size_t)plaintext_length,
348
plaintext_capacity);
426
(size_t)plaintext_length,
427
plaintext_capacity);
349
428
if(plaintext_capacity == 0){
350
perror("incbuffer");
351
plaintext_length = -1;
352
goto decrypt_end;
429
perror_plus("incbuffer");
430
plaintext_length = -1;
431
goto decrypt_end;
353
432
}
354
433
355
434
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
360
439
break;
361
440
}
362
441
if(ret < 0){
363
perror("gpgme_data_read");
442
perror_plus("gpgme_data_read");
364
443
plaintext_length = -1;
365
444
goto decrypt_end;
366
445
}
368
447
}
369
448
370
449
if(debug){
371
fprintf(stderr, "Decrypted password is: ");
450
fprintf_plus(stderr, "Decrypted password is: ");
372
451
for(ssize_t i = 0; i < plaintext_length; i++){
373
452
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
374
453
}
396
475
/* GnuTLS log function callback */
397
476
static void debuggnutls(__attribute__((unused)) int level,
398
477
const char* string){
399
fprintf(stderr, "GnuTLS: %s", string);
478
fprintf_plus(stderr, "GnuTLS: %s", string);
400
479
}
401
480
402
481
static int init_gnutls_global(const char *pubkeyfilename,
404
483
int ret;
405
484
406
485
if(debug){
407
fprintf(stderr, "Initializing GnuTLS\n");
486
fprintf_plus(stderr, "Initializing GnuTLS\n");
408
487
}
409
488
410
489
ret = gnutls_global_init();
411
490
if(ret != GNUTLS_E_SUCCESS){
412
fprintf(stderr, "GnuTLS global_init: %s\n",
413
safer_gnutls_strerror(ret));
491
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
492
safer_gnutls_strerror(ret));
414
493
return -1;
415
494
}
416
495
423
502
}
424
503
425
504
/* OpenPGP credentials */
426
gnutls_certificate_allocate_credentials(&mc.cred);
505
ret = gnutls_certificate_allocate_credentials(&mc.cred);
427
506
if(ret != GNUTLS_E_SUCCESS){
428
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
429
from
430
-Wunreachable-code
431
*/
432
safer_gnutls_strerror(ret));
507
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
508
safer_gnutls_strerror(ret));
433
509
gnutls_global_deinit();
434
510
return -1;
435
511
}
436
512
437
513
if(debug){
438
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
439
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
440
seckeyfilename);
514
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
515
" secret key %s as GnuTLS credentials\n",
516
pubkeyfilename,
517
seckeyfilename);
441
518
}
442
519
443
520
ret = gnutls_certificate_set_openpgp_key_file
444
521
(mc.cred, pubkeyfilename, seckeyfilename,
445
522
GNUTLS_OPENPGP_FMT_BASE64);
446
523
if(ret != GNUTLS_E_SUCCESS){
447
fprintf(stderr,
448
"Error[%d] while reading the OpenPGP key pair ('%s',"
449
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
450
fprintf(stderr, "The GnuTLS error is: %s\n",
451
safer_gnutls_strerror(ret));
524
fprintf_plus(stderr,
525
"Error[%d] while reading the OpenPGP key pair ('%s',"
526
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
527
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
528
safer_gnutls_strerror(ret));
452
529
goto globalfail;
453
530
}
454
531
455
532
/* GnuTLS server initialization */
456
533
ret = gnutls_dh_params_init(&mc.dh_params);
457
534
if(ret != GNUTLS_E_SUCCESS){
458
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
459
" %s\n", safer_gnutls_strerror(ret));
535
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
536
" initialization: %s\n",
537
safer_gnutls_strerror(ret));
460
538
goto globalfail;
461
539
}
462
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
463
541
if(ret != GNUTLS_E_SUCCESS){
464
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
465
safer_gnutls_strerror(ret));
542
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
543
safer_gnutls_strerror(ret));
466
544
goto globalfail;
467
545
}
468
546
488
566
}
489
567
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
490
568
if(ret != GNUTLS_E_SUCCESS){
491
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
492
safer_gnutls_strerror(ret));
569
fprintf_plus(stderr,
570
"Error in GnuTLS session initialization: %s\n",
571
safer_gnutls_strerror(ret));
493
572
}
494
573
495
574
{
502
581
}
503
582
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
504
583
if(ret != GNUTLS_E_SUCCESS){
505
fprintf(stderr, "Syntax error at: %s\n", err);
506
fprintf(stderr, "GnuTLS error: %s\n",
507
safer_gnutls_strerror(ret));
584
fprintf_plus(stderr, "Syntax error at: %s\n", err);
585
fprintf_plus(stderr, "GnuTLS error: %s\n",
586
safer_gnutls_strerror(ret));
508
587
gnutls_deinit(*session);
509
588
return -1;
510
589
}
519
598
}
520
599
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
521
600
if(ret != GNUTLS_E_SUCCESS){
522
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
523
safer_gnutls_strerror(ret));
601
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
602
safer_gnutls_strerror(ret));
524
603
gnutls_deinit(*session);
525
604
return -1;
526
605
}
571
650
pf = PF_INET;
572
651
break;
573
652
default:
574
fprintf(stderr, "Bad address family: %d\n", af);
653
fprintf_plus(stderr, "Bad address family: %d\n", af);
575
654
errno = EINVAL;
576
655
return -1;
577
656
}
582
661
}
583
662
584
663
if(debug){
585
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
586
"\n", ip, port);
664
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
665
PRIu16 "\n", ip, port);
587
666
}
588
667
589
668
tcp_sd = socket(pf, SOCK_STREAM, 0);
590
669
if(tcp_sd < 0){
591
670
int e = errno;
592
perror("socket");
671
perror_plus("socket");
593
672
errno = e;
594
673
goto mandos_end;
595
674
}
609
688
}
610
689
if(ret < 0 ){
611
690
int e = errno;
612
perror("inet_pton");
691
perror_plus("inet_pton");
613
692
errno = e;
614
693
goto mandos_end;
615
694
}
616
695
if(ret == 0){
617
696
int e = errno;
618
fprintf(stderr, "Bad address: %s\n", ip);
697
fprintf_plus(stderr, "Bad address: %s\n", ip);
619
698
errno = e;
620
699
goto mandos_end;
621
700
}
626
705
627
706
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
628
707
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
629
-Wunreachable-code*/
708
-Wunreachable-code*/
630
709
if(if_index == AVAHI_IF_UNSPEC){
631
fprintf(stderr, "An IPv6 link-local address is incomplete"
632
" without a network interface\n");
710
fprintf_plus(stderr, "An IPv6 link-local address is"
711
" incomplete without a network interface\n");
633
712
errno = EINVAL;
634
713
goto mandos_end;
635
714
}
651
730
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
652
731
char interface[IF_NAMESIZE];
653
732
if(if_indextoname((unsigned int)if_index, interface) == NULL){
654
perror("if_indextoname");
733
perror_plus("if_indextoname");
655
734
} else {
656
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
657
ip, interface, port);
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
658
737
}
659
738
} else {
660
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
661
port);
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
740
ip, port);
662
741
}
663
742
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
664
743
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
671
750
sizeof(addrstr));
672
751
}
673
752
if(pcret == NULL){
674
perror("inet_ntop");
753
perror_plus("inet_ntop");
675
754
} else {
676
755
if(strcmp(addrstr, ip) != 0){
677
fprintf(stderr, "Canonical address form: %s\n", addrstr);
756
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
678
757
}
679
758
}
680
759
}
690
769
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
691
770
}
692
771
if(ret < 0){
693
int e = errno;
694
perror("connect");
695
errno = e;
772
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
773
int e = errno;
774
perror_plus("connect");
775
errno = e;
776
}
696
777
goto mandos_end;
697
778
}
698
779
706
787
while(true){
707
788
size_t out_size = strlen(out);
708
789
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
709
out_size - written));
790
out_size - written));
710
791
if(ret == -1){
711
792
int e = errno;
712
perror("write");
793
perror_plus("write");
713
794
errno = e;
714
795
goto mandos_end;
715
796
}
732
813
}
733
814
734
815
if(debug){
735
fprintf(stderr, "Establishing TLS session with %s\n", ip);
816
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
736
817
}
737
818
738
819
if(quit_now){
740
821
goto mandos_end;
741
822
}
742
823
824
/* Spurious warning from -Wint-to-pointer-cast */
743
825
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
744
826
745
827
if(quit_now){
757
839
758
840
if(ret != GNUTLS_E_SUCCESS){
759
841
if(debug){
760
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
842
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
761
843
gnutls_perror(ret);
762
844
}
763
845
errno = EPROTO;
767
849
/* Read OpenPGP packet that contains the wanted password */
768
850
769
851
if(debug){
770
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
771
ip);
852
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
853
" %s\n", ip);
772
854
}
773
855
774
856
while(true){
779
861
}
780
862
781
863
buffer_capacity = incbuffer(&buffer, buffer_length,
782
buffer_capacity);
864
buffer_capacity);
783
865
if(buffer_capacity == 0){
784
866
int e = errno;
785
perror("incbuffer");
867
perror_plus("incbuffer");
786
868
errno = e;
787
869
goto mandos_end;
788
870
}
812
894
}
813
895
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
814
896
if(ret < 0){
815
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
897
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
898
"***\n");
816
899
gnutls_perror(ret);
817
900
errno = EPROTO;
818
901
goto mandos_end;
819
902
}
820
903
break;
821
904
default:
822
fprintf(stderr, "Unknown error while reading data from"
823
" encrypted session with Mandos server\n");
905
fprintf_plus(stderr, "Unknown error while reading data from"
906
" encrypted session with Mandos server\n");
824
907
gnutls_bye(session, GNUTLS_SHUT_RDWR);
825
908
errno = EIO;
826
909
goto mandos_end;
831
914
}
832
915
833
916
if(debug){
834
fprintf(stderr, "Closing TLS session\n");
917
fprintf_plus(stderr, "Closing TLS session\n");
835
918
}
836
919
837
920
if(quit_now){
849
932
850
933
if(buffer_length > 0){
851
934
ssize_t decrypted_buffer_size;
852
decrypted_buffer_size = pgp_packet_decrypt(buffer,
853
buffer_length,
935
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
854
936
&decrypted_buffer);
855
937
if(decrypted_buffer_size >= 0){
856
938
867
949
if(ret == 0 and ferror(stdout)){
868
950
int e = errno;
869
951
if(debug){
870
fprintf(stderr, "Error writing encrypted data: %s\n",
871
strerror(errno));
952
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
953
strerror(errno));
872
954
}
873
955
errno = e;
874
956
goto mandos_end;
893
975
if(e == 0){
894
976
e = errno;
895
977
}
896
perror("close");
978
perror_plus("close");
897
979
}
898
980
gnutls_deinit(session);
981
errno = e;
899
982
if(quit_now){
900
e = EINTR;
983
errno = EINTR;
901
984
retval = -1;
902
985
}
903
errno = e;
904
986
}
905
987
return retval;
906
988
}
931
1013
switch(event){
932
1014
default:
933
1015
case AVAHI_RESOLVER_FAILURE:
934
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
935
" of type '%s' in domain '%s': %s\n", name, type, domain,
936
avahi_strerror(avahi_server_errno(mc.server)));
1016
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1017
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1018
domain,
1019
avahi_strerror(avahi_server_errno(mc.server)));
937
1020
break;
938
1021
939
1022
case AVAHI_RESOLVER_FOUND:
941
1024
char ip[AVAHI_ADDRESS_STR_MAX];
942
1025
avahi_address_snprint(ip, sizeof(ip), address);
943
1026
if(debug){
944
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
945
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
946
ip, (intmax_t)interface, port);
1027
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1028
PRIdMAX ") on port %" PRIu16 "\n", name,
1029
host_name, ip, (intmax_t)interface, port);
947
1030
}
948
1031
int ret = start_mandos_communication(ip, port, interface,
949
1032
avahi_proto_to_af(proto));
950
1033
if(ret == 0){
951
1034
avahi_simple_poll_quit(mc.simple_poll);
1035
} else {
1036
if(not add_server(ip, port, interface,
1037
avahi_proto_to_af(proto))){
1038
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1039
" list\n", name);
1040
}
952
1041
}
953
1042
}
954
1043
}
978
1067
default:
979
1068
case AVAHI_BROWSER_FAILURE:
980
1069
981
fprintf(stderr, "(Avahi browser) %s\n",
982
avahi_strerror(avahi_server_errno(mc.server)));
1070
fprintf_plus(stderr, "(Avahi browser) %s\n",
1071
avahi_strerror(avahi_server_errno(mc.server)));
983
1072
avahi_simple_poll_quit(mc.simple_poll);
984
1073
return;
985
1074
992
1081
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
993
1082
name, type, domain, protocol, 0,
994
1083
resolve_callback, NULL) == NULL)
995
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
996
name, avahi_strerror(avahi_server_errno(mc.server)));
1084
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1085
" %s\n", name,
1086
avahi_strerror(avahi_server_errno(mc.server)));
997
1087
break;
998
1088
999
1089
case AVAHI_BROWSER_REMOVE:
1002
1092
case AVAHI_BROWSER_ALL_FOR_NOW:
1003
1093
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1004
1094
if(debug){
1005
fprintf(stderr, "No Mandos server found, still searching...\n");
1095
fprintf_plus(stderr, "No Mandos server found, still"
1096
" searching...\n");
1006
1097
}
1007
1098
break;
1008
1099
}
1009
1100
}
1010
1101
1011
/* stop main loop after sigterm has been called */
1102
/* Signal handler that stops main loop after SIGTERM */
1012
1103
static void handle_sigterm(int sig){
1013
1104
if(quit_now){
1014
1105
return;
1016
1107
quit_now = 1;
1017
1108
signal_received = sig;
1018
1109
int old_errno = errno;
1110
/* set main loop to exit */
1019
1111
if(mc.simple_poll != NULL){
1020
1112
avahi_simple_poll_quit(mc.simple_poll);
1021
1113
}
1022
1114
errno = old_errno;
1023
1115
}
1024
1116
1025
/*
1026
* This function determines if a directory entry in /sys/class/net
1027
* corresponds to an acceptable network device.
1028
* (This function is passed to scandir(3) as a filter function.)
1029
*/
1030
int good_interface(const struct dirent *if_entry){
1031
ssize_t ssret;
1032
char *flagname = NULL;
1033
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
1034
if_entry->d_name);
1035
if(ret < 0){
1036
perror("asprintf");
1037
return 0;
1038
}
1039
if(if_entry->d_name[0] == '.'){
1040
return 0;
1041
}
1042
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1043
if(flags_fd == -1){
1044
perror("open");
1045
return 0;
1046
}
1047
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1048
/* read line from flags_fd */
1049
ssize_t to_read = (sizeof(ifreq_flags)*2)+3; /* "0x1003\n" */
1050
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1051
flagstring[(size_t)to_read] = '\0';
1052
if(flagstring == NULL){
1053
perror("malloc");
1054
close(flags_fd);
1055
return 0;
1056
}
1057
while(to_read > 0){
1058
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1059
(size_t)to_read));
1060
if(ssret == -1){
1061
perror("read");
1062
free(flagstring);
1063
close(flags_fd);
1064
return 0;
1065
}
1066
to_read -= ssret;
1067
if(ssret == 0){
1068
break;
1069
}
1070
}
1071
close(flags_fd);
1072
intmax_t tmpmax;
1073
char *tmp;
1074
errno = 0;
1075
tmpmax = strtoimax(flagstring, &tmp, 0);
1076
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1077
and not (isspace(*tmp)))
1078
or tmpmax != (ifreq_flags)tmpmax){
1117
bool get_flags(const char *ifname, struct ifreq *ifr){
1118
int ret;
1119
1120
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1121
if(s < 0){
1122
perror_plus("socket");
1123
return false;
1124
}
1125
strcpy(ifr->ifr_name, ifname);
1126
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1127
if(ret == -1){
1079
1128
if(debug){
1080
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1081
flagstring, if_entry->d_name);
1129
perror_plus("ioctl SIOCGIFFLAGS");
1082
1130
}
1083
free(flagstring);
1084
return 0;
1131
return false;
1085
1132
}
1086
free(flagstring);
1087
ifreq_flags flags = (ifreq_flags)tmpmax;
1133
return true;
1134
}
1135
1136
bool good_flags(const char *ifname, const struct ifreq *ifr){
1137
1088
1138
/* Reject the loopback device */
1089
if(flags & IFF_LOOPBACK){
1139
if(ifr->ifr_flags & IFF_LOOPBACK){
1090
1140
if(debug){
1091
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1092
if_entry->d_name);
1141
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1142
ifname);
1093
1143
}
1094
return 0;
1144
return false;
1095
1145
}
1096
1146
/* Accept point-to-point devices only if connect_to is specified */
1097
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1147
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1098
1148
if(debug){
1099
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1100
if_entry->d_name);
1149
fprintf_plus(stderr, "Accepting point-to-point interface"
1150
" \"%s\"\n", ifname);
1101
1151
}
1102
return 1;
1152
return true;
1103
1153
}
1104
1154
/* Otherwise, reject non-broadcast-capable devices */
1105
if(not (flags & IFF_BROADCAST)){
1106
if(debug){
1107
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1108
if_entry->d_name);
1109
}
1110
return 0;
1111
}
1155
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1156
if(debug){
1157
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1158
" \"%s\"\n", ifname);
1159
}
1160
return false;
1161
}
1162
/* Reject non-ARP interfaces (including dummy interfaces) */
1163
if(ifr->ifr_flags & IFF_NOARP){
1164
if(debug){
1165
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1166
ifname);
1167
}
1168
return false;
1169
}
1170
1112
1171
/* Accept this device */
1113
1172
if(debug){
1114
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1115
if_entry->d_name);
1116
}
1117
return 1;
1173
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1174
}
1175
return true;
1176
}
1177
1178
/*
1179
* This function determines if a directory entry in /sys/class/net
1180
* corresponds to an acceptable network device.
1181
* (This function is passed to scandir(3) as a filter function.)
1182
*/
1183
int good_interface(const struct dirent *if_entry){
1184
if(if_entry->d_name[0] == '.'){
1185
return 0;
1186
}
1187
1188
struct ifreq ifr;
1189
if(not get_flags(if_entry->d_name, &ifr)){
1190
if(debug){
1191
fprintf_plus(stderr, "Failed to get flags for interface "
1192
"\"%s\"\n", if_entry->d_name);
1193
}
1194
return 0;
1195
}
1196
1197
if(not good_flags(if_entry->d_name, &ifr)){
1198
return 0;
1199
}
1200
return 1;
1201
}
1202
1203
/*
1204
* This function determines if a directory entry in /sys/class/net
1205
* corresponds to an acceptable network device which is up.
1206
* (This function is passed to scandir(3) as a filter function.)
1207
*/
1208
int up_interface(const struct dirent *if_entry){
1209
if(if_entry->d_name[0] == '.'){
1210
return 0;
1211
}
1212
1213
struct ifreq ifr;
1214
if(not get_flags(if_entry->d_name, &ifr)){
1215
if(debug){
1216
fprintf_plus(stderr, "Failed to get flags for interface "
1217
"\"%s\"\n", if_entry->d_name);
1218
}
1219
return 0;
1220
}
1221
1222
/* Reject down interfaces */
1223
if(not (ifr.ifr_flags & IFF_UP)){
1224
if(debug){
1225
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1226
if_entry->d_name);
1227
}
1228
return 0;
1229
}
1230
1231
/* Reject non-running interfaces */
1232
if(not (ifr.ifr_flags & IFF_RUNNING)){
1233
if(debug){
1234
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1235
if_entry->d_name);
1236
}
1237
return 0;
1238
}
1239
1240
if(not good_flags(if_entry->d_name, &ifr)){
1241
return 0;
1242
}
1243
return 1;
1244
}
1245
1246
int notdotentries(const struct dirent *direntry){
1247
/* Skip "." and ".." */
1248
if(direntry->d_name[0] == '.'
1249
and (direntry->d_name[1] == '\0'
1250
or (direntry->d_name[1] == '.'
1251
and direntry->d_name[2] == '\0'))){
1252
return 0;
1253
}
1254
return 1;
1255
}
1256
1257
/* Is this directory entry a runnable program? */
1258
int runnable_hook(const struct dirent *direntry){
1259
int ret;
1260
size_t sret;
1261
struct stat st;
1262
1263
if((direntry->d_name)[0] == '\0'){
1264
/* Empty name? */
1265
return 0;
1266
}
1267
1268
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1269
"abcdefghijklmnopqrstuvwxyz"
1270
"0123456789"
1271
"_-");
1272
if((direntry->d_name)[sret] != '\0'){
1273
/* Contains non-allowed characters */
1274
if(debug){
1275
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1276
direntry->d_name);
1277
}
1278
return 0;
1279
}
1280
1281
char *fullname = NULL;
1282
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1283
if(ret < 0){
1284
perror_plus("asprintf");
1285
return 0;
1286
}
1287
1288
ret = stat(fullname, &st);
1289
if(ret == -1){
1290
if(debug){
1291
perror_plus("Could not stat hook");
1292
}
1293
return 0;
1294
}
1295
if(not (S_ISREG(st.st_mode))){
1296
/* Not a regular file */
1297
if(debug){
1298
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1299
direntry->d_name);
1300
}
1301
return 0;
1302
}
1303
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1304
/* Not executable */
1305
if(debug){
1306
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1307
direntry->d_name);
1308
}
1309
return 0;
1310
}
1311
if(debug){
1312
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1313
direntry->d_name);
1314
}
1315
return 1;
1316
}
1317
1318
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1319
int ret;
1320
struct timespec now;
1321
struct timespec waited_time;
1322
intmax_t block_time;
1323
1324
while(true){
1325
if(mc.current_server == NULL){
1326
if (debug){
1327
fprintf_plus(stderr, "Wait until first server is found."
1328
" No timeout!\n");
1329
}
1330
ret = avahi_simple_poll_iterate(s, -1);
1331
} else {
1332
if (debug){
1333
fprintf_plus(stderr, "Check current_server if we should run"
1334
" it, or wait\n");
1335
}
1336
/* the current time */
1337
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1338
if(ret == -1){
1339
perror_plus("clock_gettime");
1340
return -1;
1341
}
1342
/* Calculating in ms how long time between now and server
1343
who we visted longest time ago. Now - last seen. */
1344
waited_time.tv_sec = (now.tv_sec
1345
- mc.current_server->last_seen.tv_sec);
1346
waited_time.tv_nsec = (now.tv_nsec
1347
- mc.current_server->last_seen.tv_nsec);
1348
/* total time is 10s/10,000ms.
1349
Converting to s from ms by dividing by 1,000,
1350
and ns to ms by dividing by 1,000,000. */
1351
block_time = ((retry_interval
1352
- ((intmax_t)waited_time.tv_sec * 1000))
1353
- ((intmax_t)waited_time.tv_nsec / 1000000));
1354
1355
if (debug){
1356
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1357
block_time);
1358
}
1359
1360
if(block_time <= 0){
1361
ret = start_mandos_communication(mc.current_server->ip,
1362
mc.current_server->port,
1363
mc.current_server->if_index,
1364
mc.current_server->af);
1365
if(ret == 0){
1366
avahi_simple_poll_quit(mc.simple_poll);
1367
return 0;
1368
}
1369
ret = clock_gettime(CLOCK_MONOTONIC,
1370
&mc.current_server->last_seen);
1371
if(ret == -1){
1372
perror_plus("clock_gettime");
1373
return -1;
1374
}
1375
mc.current_server = mc.current_server->next;
1376
block_time = 0; /* Call avahi to find new Mandos
1377
servers, but don't block */
1378
}
1379
1380
ret = avahi_simple_poll_iterate(s, (int)block_time);
1381
}
1382
if(ret != 0){
1383
if (ret > 0 or errno != EINTR){
1384
return (ret != 1) ? ret : 0;
1385
}
1386
}
1387
}
1388
}
1389
1390
bool run_network_hooks(const char *mode, const char *interface,
1391
const float delay){
1392
struct dirent **direntries;
1393
struct dirent *direntry;
1394
int ret;
1395
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1396
alphasort);
1397
if(numhooks == -1){
1398
perror_plus("scandir");
1399
} else {
1400
int devnull = open("/dev/null", O_RDONLY);
1401
for(int i = 0; i < numhooks; i++){
1402
direntry = direntries[i];
1403
char *fullname = NULL;
1404
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1405
if(ret < 0){
1406
perror_plus("asprintf");
1407
continue;
1408
}
1409
if(debug){
1410
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1411
direntry->d_name);
1412
}
1413
pid_t hook_pid = fork();
1414
if(hook_pid == 0){
1415
/* Child */
1416
/* Raise privileges */
1417
errno = 0;
1418
ret = seteuid(0);
1419
if(ret == -1){
1420
perror_plus("seteuid");
1421
}
1422
/* Raise privileges even more */
1423
errno = 0;
1424
ret = setuid(0);
1425
if(ret == -1){
1426
perror_plus("setuid");
1427
}
1428
/* Set group */
1429
errno = 0;
1430
ret = setgid(0);
1431
if(ret == -1){
1432
perror_plus("setgid");
1433
}
1434
/* Reset supplementary groups */
1435
errno = 0;
1436
ret = setgroups(0, NULL);
1437
if(ret == -1){
1438
perror_plus("setgroups");
1439
}
1440
dup2(devnull, STDIN_FILENO);
1441
close(devnull);
1442
dup2(STDERR_FILENO, STDOUT_FILENO);
1443
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1444
if(ret == -1){
1445
perror_plus("setenv");
1446
_exit(EX_OSERR);
1447
}
1448
ret = setenv("DEVICE", interface, 1);
1449
if(ret == -1){
1450
perror_plus("setenv");
1451
_exit(EX_OSERR);
1452
}
1453
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1454
if(ret == -1){
1455
perror_plus("setenv");
1456
_exit(EX_OSERR);
1457
}
1458
ret = setenv("MODE", mode, 1);
1459
if(ret == -1){
1460
perror_plus("setenv");
1461
_exit(EX_OSERR);
1462
}
1463
char *delaystring;
1464
ret = asprintf(&delaystring, "%f", delay);
1465
if(ret == -1){
1466
perror_plus("asprintf");
1467
_exit(EX_OSERR);
1468
}
1469
ret = setenv("DELAY", delaystring, 1);
1470
if(ret == -1){
1471
free(delaystring);
1472
perror_plus("setenv");
1473
_exit(EX_OSERR);
1474
}
1475
free(delaystring);
1476
if(connect_to != NULL){
1477
ret = setenv("CONNECT", connect_to, 1);
1478
if(ret == -1){
1479
perror_plus("setenv");
1480
_exit(EX_OSERR);
1481
}
1482
}
1483
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1484
perror_plus("execl");
1485
_exit(EXIT_FAILURE);
1486
}
1487
} else {
1488
int status;
1489
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1490
perror_plus("waitpid");
1491
free(fullname);
1492
continue;
1493
}
1494
if(WIFEXITED(status)){
1495
if(WEXITSTATUS(status) != 0){
1496
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1497
" with status %d\n", direntry->d_name,
1498
WEXITSTATUS(status));
1499
free(fullname);
1500
continue;
1501
}
1502
} else if(WIFSIGNALED(status)){
1503
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1504
" signal %d\n", direntry->d_name,
1505
WTERMSIG(status));
1506
free(fullname);
1507
continue;
1508
} else {
1509
fprintf_plus(stderr, "Warning: network hook \"%s\""
1510
" crashed\n", direntry->d_name);
1511
free(fullname);
1512
continue;
1513
}
1514
}
1515
free(fullname);
1516
if(debug){
1517
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1518
direntry->d_name);
1519
}
1520
}
1521
close(devnull);
1522
}
1523
return true;
1118
1524
}
1119
1525
1120
1526
int main(int argc, char *argv[]){
1139
1545
bool gnutls_initialized = false;
1140
1546
bool gpgme_initialized = false;
1141
1547
float delay = 2.5f;
1548
double retry_interval = 10; /* 10s between trying a server and
1549
retrying the same server again */
1142
1550
1143
1551
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1144
1552
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1150
1558
errno = 0;
1151
1559
ret = setgid(gid);
1152
1560
if(ret == -1){
1153
perror("setgid");
1561
perror_plus("setgid");
1154
1562
}
1155
1563
1156
1564
/* Lower user privileges (temporarily) */
1157
1565
errno = 0;
1158
1566
ret = seteuid(uid);
1159
1567
if(ret == -1){
1160
perror("seteuid");
1568
perror_plus("seteuid");
1161
1569
}
1162
1570
1163
1571
if(quit_now){
1198
1606
.arg = "SECONDS",
1199
1607
.doc = "Maximum delay to wait for interface startup",
1200
1608
.group = 2 },
1609
{ .name = "retry", .key = 132,
1610
.arg = "SECONDS",
1611
.doc = "Retry interval used when denied by the Mandos server",
1612
.group = 2 },
1613
{ .name = "network-hook-dir", .key = 133,
1614
.arg = "DIR",
1615
.doc = "Directory where network hooks are located",
1616
.group = 2 },
1201
1617
/*
1202
1618
* These reproduce what we would get without ARGP_NO_HELP
1203
1619
*/
1247
1663
if(errno != 0 or tmp == arg or *tmp != '\0'){
1248
1664
argp_error(state, "Bad delay");
1249
1665
}
1666
case 132: /* --retry */
1667
errno = 0;
1668
retry_interval = strtod(arg, &tmp);
1669
if(errno != 0 or tmp == arg or *tmp != '\0'
1670
or (retry_interval * 1000) > INT_MAX
1671
or retry_interval < 0){
1672
argp_error(state, "Bad retry interval");
1673
}
1674
break;
1675
case 133: /* --network-hook-dir */
1676
hookdir = arg;
1250
1677
break;
1251
1678
/*
1252
1679
* These reproduce what we would get without ARGP_NO_HELP
1259
1686
argp_state_help(state, state->out_stream,
1260
1687
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1261
1688
case 'V': /* --version */
1262
fprintf(state->out_stream, "%s\n", argp_program_version);
1689
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1263
1690
exit(argp_err_exit_status);
1264
1691
break;
1265
1692
default:
1280
1707
case ENOMEM:
1281
1708
default:
1282
1709
errno = ret;
1283
perror("argp_parse");
1710
perror_plus("argp_parse");
1284
1711
exitcode = EX_OSERR;
1285
1712
goto end;
1286
1713
case EINVAL:
1288
1715
goto end;
1289
1716
}
1290
1717
}
1718
1719
{
1720
/* Work around Debian bug #633582:
1721
<http://bugs.debian.org/633582> */
1722
1723
/* Re-raise priviliges */
1724
errno = 0;
1725
ret = seteuid(0);
1726
if(ret == -1){
1727
perror_plus("seteuid");
1728
} else {
1729
struct stat st;
1730
1731
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1732
int seckey_fd = open(seckey, O_RDONLY);
1733
if(seckey_fd == -1){
1734
perror_plus("open");
1735
} else {
1736
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1737
if(ret == -1){
1738
perror_plus("fstat");
1739
} else {
1740
if(S_ISREG(st.st_mode)
1741
and st.st_uid == 0 and st.st_gid == 0){
1742
ret = fchown(seckey_fd, uid, gid);
1743
if(ret == -1){
1744
perror_plus("fchown");
1745
}
1746
}
1747
}
1748
TEMP_FAILURE_RETRY(close(seckey_fd));
1749
}
1750
}
1751
1752
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1753
int pubkey_fd = open(pubkey, O_RDONLY);
1754
if(pubkey_fd == -1){
1755
perror_plus("open");
1756
} else {
1757
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1758
if(ret == -1){
1759
perror_plus("fstat");
1760
} else {
1761
if(S_ISREG(st.st_mode)
1762
and st.st_uid == 0 and st.st_gid == 0){
1763
ret = fchown(pubkey_fd, uid, gid);
1764
if(ret == -1){
1765
perror_plus("fchown");
1766
}
1767
}
1768
}
1769
TEMP_FAILURE_RETRY(close(pubkey_fd));
1770
}
1771
}
1772
1773
/* Lower privileges */
1774
errno = 0;
1775
ret = seteuid(uid);
1776
if(ret == -1){
1777
perror_plus("seteuid");
1778
}
1779
}
1780
}
1781
1782
/* Run network hooks */
1783
if(not run_network_hooks("start", interface, delay)){
1784
goto end;
1785
}
1291
1786
1292
1787
if(not debug){
1293
1788
avahi_set_log_function(empty_log);
1294
1789
}
1295
1790
1296
1791
if(interface[0] == '\0'){
1297
1792
struct dirent **direntries;
1298
ret = scandir(sys_class_net, &direntries, good_interface,
1793
/* First look for interfaces that are up */
1794
ret = scandir(sys_class_net, &direntries, up_interface,
1299
1795
alphasort);
1796
if(ret == 0){
1797
/* No up interfaces, look for any good interfaces */
1798
free(direntries);
1799
ret = scandir(sys_class_net, &direntries, good_interface,
1800
alphasort);
1801
}
1300
1802
if(ret >= 1){
1301
/* Pick the first good interface */
1803
/* Pick the first interface returned */
1302
1804
interface = strdup(direntries[0]->d_name);
1303
1805
if(debug){
1304
fprintf(stderr, "Using interface \"%s\"\n", interface);
1806
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1305
1807
}
1306
1808
if(interface == NULL){
1307
perror("malloc");
1809
perror_plus("malloc");
1308
1810
free(direntries);
1309
1811
exitcode = EXIT_FAILURE;
1310
1812
goto end;
1312
1814
free(direntries);
1313
1815
} else {
1314
1816
free(direntries);
1315
fprintf(stderr, "Could not find a network interface\n");
1817
fprintf_plus(stderr, "Could not find a network interface\n");
1316
1818
exitcode = EXIT_FAILURE;
1317
1819
goto end;
1318
1820
}
1324
1826
srand((unsigned int) time(NULL));
1325
1827
mc.simple_poll = avahi_simple_poll_new();
1326
1828
if(mc.simple_poll == NULL){
1327
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1829
fprintf_plus(stderr,
1830
"Avahi: Failed to create simple poll object.\n");
1328
1831
exitcode = EX_UNAVAILABLE;
1329
1832
goto end;
1330
1833
}
1332
1835
sigemptyset(&sigterm_action.sa_mask);
1333
1836
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1334
1837
if(ret == -1){
1335
perror("sigaddset");
1838
perror_plus("sigaddset");
1336
1839
exitcode = EX_OSERR;
1337
1840
goto end;
1338
1841
}
1339
1842
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1340
1843
if(ret == -1){
1341
perror("sigaddset");
1844
perror_plus("sigaddset");
1342
1845
exitcode = EX_OSERR;
1343
1846
goto end;
1344
1847
}
1345
1848
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1346
1849
if(ret == -1){
1347
perror("sigaddset");
1850
perror_plus("sigaddset");
1348
1851
exitcode = EX_OSERR;
1349
1852
goto end;
1350
1853
}
1354
1857
*/
1355
1858
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1356
1859
if(ret == -1){
1357
perror("sigaction");
1860
perror_plus("sigaction");
1358
1861
return EX_OSERR;
1359
1862
}
1360
1863
if(old_sigterm_action.sa_handler != SIG_IGN){
1361
1864
ret = sigaction(SIGINT, &sigterm_action, NULL);
1362
1865
if(ret == -1){
1363
perror("sigaction");
1866
perror_plus("sigaction");
1364
1867
exitcode = EX_OSERR;
1365
1868
goto end;
1366
1869
}
1367
1870
}
1368
1871
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1369
1872
if(ret == -1){
1370
perror("sigaction");
1873
perror_plus("sigaction");
1371
1874
return EX_OSERR;
1372
1875
}
1373
1876
if(old_sigterm_action.sa_handler != SIG_IGN){
1374
1877
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1375
1878
if(ret == -1){
1376
perror("sigaction");
1879
perror_plus("sigaction");
1377
1880
exitcode = EX_OSERR;
1378
1881
goto end;
1379
1882
}
1380
1883
}
1381
1884
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1382
1885
if(ret == -1){
1383
perror("sigaction");
1886
perror_plus("sigaction");
1384
1887
return EX_OSERR;
1385
1888
}
1386
1889
if(old_sigterm_action.sa_handler != SIG_IGN){
1387
1890
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1388
1891
if(ret == -1){
1389
perror("sigaction");
1892
perror_plus("sigaction");
1390
1893
exitcode = EX_OSERR;
1391
1894
goto end;
1392
1895
}
1396
1899
if(strcmp(interface, "none") != 0){
1397
1900
if_index = (AvahiIfIndex) if_nametoindex(interface);
1398
1901
if(if_index == 0){
1399
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1902
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1400
1903
exitcode = EX_UNAVAILABLE;
1401
1904
goto end;
1402
1905
}
1409
1912
errno = 0;
1410
1913
ret = seteuid(0);
1411
1914
if(ret == -1){
1412
perror("seteuid");
1915
perror_plus("seteuid");
1413
1916
}
1414
1917
1415
1918
#ifdef __linux__
1419
1922
bool restore_loglevel = true;
1420
1923
if(ret == -1){
1421
1924
restore_loglevel = false;
1422
perror("klogctl");
1925
perror_plus("klogctl");
1423
1926
}
1424
1927
#endif /* __linux__ */
1425
1928
1426
1929
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1427
1930
if(sd < 0){
1428
perror("socket");
1931
perror_plus("socket");
1429
1932
exitcode = EX_OSERR;
1430
1933
#ifdef __linux__
1431
1934
if(restore_loglevel){
1432
1935
ret = klogctl(7, NULL, 0);
1433
1936
if(ret == -1){
1434
perror("klogctl");
1937
perror_plus("klogctl");
1435
1938
}
1436
1939
}
1437
1940
#endif /* __linux__ */
1439
1942
errno = 0;
1440
1943
ret = seteuid(uid);
1441
1944
if(ret == -1){
1442
perror("seteuid");
1945
perror_plus("seteuid");
1443
1946
}
1444
1947
goto end;
1445
1948
}
1446
1949
strcpy(network.ifr_name, interface);
1447
1950
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1448
1951
if(ret == -1){
1449
perror("ioctl SIOCGIFFLAGS");
1952
perror_plus("ioctl SIOCGIFFLAGS");
1450
1953
#ifdef __linux__
1451
1954
if(restore_loglevel){
1452
1955
ret = klogctl(7, NULL, 0);
1453
1956
if(ret == -1){
1454
perror("klogctl");
1957
perror_plus("klogctl");
1455
1958
}
1456
1959
}
1457
1960
#endif /* __linux__ */
1460
1963
errno = 0;
1461
1964
ret = seteuid(uid);
1462
1965
if(ret == -1){
1463
perror("seteuid");
1966
perror_plus("seteuid");
1464
1967
}
1465
1968
goto end;
1466
1969
}
1470
1973
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1471
1974
if(ret == -1){
1472
1975
take_down_interface = false;
1473
perror("ioctl SIOCSIFFLAGS +IFF_UP");
1976
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1474
1977
exitcode = EX_OSERR;
1475
1978
#ifdef __linux__
1476
1979
if(restore_loglevel){
1477
1980
ret = klogctl(7, NULL, 0);
1478
1981
if(ret == -1){
1479
perror("klogctl");
1982
perror_plus("klogctl");
1480
1983
}
1481
1984
}
1482
1985
#endif /* __linux__ */
1484
1987
errno = 0;
1485
1988
ret = seteuid(uid);
1486
1989
if(ret == -1){
1487
perror("seteuid");
1990
perror_plus("seteuid");
1488
1991
}
1489
1992
goto end;
1490
1993
}
1491
1994
}
1492
/* sleep checking until interface is running */
1995
/* Sleep checking until interface is running.
1996
Check every 0.25s, up to total time of delay */
1493
1997
for(int i=0; i < delay * 4; i++){
1494
1998
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1495
1999
if(ret == -1){
1496
perror("ioctl SIOCGIFFLAGS");
2000
perror_plus("ioctl SIOCGIFFLAGS");
1497
2001
} else if(network.ifr_flags & IFF_RUNNING){
1498
2002
break;
1499
2003
}
1500
2004
struct timespec sleeptime = { .tv_nsec = 250000000 };
1501
2005
ret = nanosleep(&sleeptime, NULL);
1502
2006
if(ret == -1 and errno != EINTR){
1503
perror("nanosleep");
2007
perror_plus("nanosleep");
1504
2008
}
1505
2009
}
1506
2010
if(not take_down_interface){
1507
2011
/* We won't need the socket anymore */
1508
2012
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1509
2013
if(ret == -1){
1510
perror("close");
2014
perror_plus("close");
1511
2015
}
1512
2016
}
1513
2017
#ifdef __linux__
1515
2019
/* Restores kernel loglevel to default */
1516
2020
ret = klogctl(7, NULL, 0);
1517
2021
if(ret == -1){
1518
perror("klogctl");
2022
perror_plus("klogctl");
1519
2023
}
1520
2024
}
1521
2025
#endif /* __linux__ */
1522
2026
/* Lower privileges */
1523
2027
errno = 0;
1524
if(take_down_interface){
1525
/* Lower privileges */
1526
ret = seteuid(uid);
1527
if(ret == -1){
1528
perror("seteuid");
1529
}
1530
} else {
1531
/* Lower privileges permanently */
1532
ret = setuid(uid);
1533
if(ret == -1){
1534
perror("setuid");
1535
}
2028
/* Lower privileges */
2029
ret = seteuid(uid);
2030
if(ret == -1){
2031
perror_plus("seteuid");
1536
2032
}
1537
2033
}
1538
2034
1542
2038
1543
2039
ret = init_gnutls_global(pubkey, seckey);
1544
2040
if(ret == -1){
1545
fprintf(stderr, "init_gnutls_global failed\n");
2041
fprintf_plus(stderr, "init_gnutls_global failed\n");
1546
2042
exitcode = EX_UNAVAILABLE;
1547
2043
goto end;
1548
2044
} else {
1553
2049
goto end;
1554
2050
}
1555
2051
2052
if(mkdtemp(tempdir) == NULL){
2053
perror_plus("mkdtemp");
2054
goto end;
2055
}
1556
2056
tempdir_created = true;
1557
if(mkdtemp(tempdir) == NULL){
1558
tempdir_created = false;
1559
perror("mkdtemp");
1560
goto end;
1561
}
1562
2057
1563
2058
if(quit_now){
1564
2059
goto end;
1565
2060
}
1566
2061
1567
2062
if(not init_gpgme(pubkey, seckey, tempdir)){
1568
fprintf(stderr, "init_gpgme failed\n");
2063
fprintf_plus(stderr, "init_gpgme failed\n");
1569
2064
exitcode = EX_UNAVAILABLE;
1570
2065
goto end;
1571
2066
} else {
1581
2076
/* (Mainly meant for debugging) */
1582
2077
char *address = strrchr(connect_to, ':');
1583
2078
if(address == NULL){
1584
fprintf(stderr, "No colon in address\n");
2079
fprintf_plus(stderr, "No colon in address\n");
1585
2080
exitcode = EX_USAGE;
1586
2081
goto end;
1587
2082
}
1595
2090
tmpmax = strtoimax(address+1, &tmp, 10);
1596
2091
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1597
2092
or tmpmax != (uint16_t)tmpmax){
1598
fprintf(stderr, "Bad port number\n");
2093
fprintf_plus(stderr, "Bad port number\n");
1599
2094
exitcode = EX_USAGE;
1600
2095
goto end;
1601
2096
}
1606
2101
1607
2102
port = (uint16_t)tmpmax;
1608
2103
*address = '\0';
1609
address = connect_to;
1610
2104
/* Colon in address indicates IPv6 */
1611
2105
int af;
1612
if(strchr(address, ':') != NULL){
2106
if(strchr(connect_to, ':') != NULL){
1613
2107
af = AF_INET6;
2108
/* Accept [] around IPv6 address - see RFC 5952 */
2109
if(connect_to[0] == '[' and address[-1] == ']')
2110
{
2111
connect_to++;
2112
address[-1] = '\0';
2113
}
1614
2114
} else {
1615
2115
af = AF_INET;
1616
2116
}
2117
address = connect_to;
1617
2118
1618
2119
if(quit_now){
1619
2120
goto end;
1620
2121
}
1621
2122
1622
ret = start_mandos_communication(address, port, if_index, af);
1623
if(ret < 0){
1624
switch(errno){
1625
case ENETUNREACH:
1626
case EHOSTDOWN:
1627
case EHOSTUNREACH:
1628
exitcode = EX_NOHOST;
1629
break;
1630
case EINVAL:
1631
exitcode = EX_USAGE;
1632
break;
1633
case EIO:
1634
exitcode = EX_IOERR;
1635
break;
1636
case EPROTO:
1637
exitcode = EX_PROTOCOL;
1638
break;
1639
default:
1640
exitcode = EX_OSERR;
1641
break;
1642
}
1643
} else {
2123
while(not quit_now){
2124
ret = start_mandos_communication(address, port, if_index, af);
2125
if(quit_now or ret == 0){
2126
break;
2127
}
2128
if(debug){
2129
fprintf_plus(stderr, "Retrying in %d seconds\n",
2130
(int)retry_interval);
2131
}
2132
sleep((int)retry_interval);
2133
}
2134
2135
if (not quit_now){
1644
2136
exitcode = EXIT_SUCCESS;
1645
2137
}
2138
1646
2139
goto end;
1647
2140
}
1648
2141
1670
2163
1671
2164
/* Check if creating the Avahi server object succeeded */
1672
2165
if(mc.server == NULL){
1673
fprintf(stderr, "Failed to create Avahi server: %s\n",
1674
avahi_strerror(error));
2166
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2167
avahi_strerror(error));
1675
2168
exitcode = EX_UNAVAILABLE;
1676
2169
goto end;
1677
2170
}
1685
2178
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1686
2179
NULL, 0, browse_callback, NULL);
1687
2180
if(sb == NULL){
1688
fprintf(stderr, "Failed to create service browser: %s\n",
1689
avahi_strerror(avahi_server_errno(mc.server)));
2181
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2182
avahi_strerror(avahi_server_errno(mc.server)));
1690
2183
exitcode = EX_UNAVAILABLE;
1691
2184
goto end;
1692
2185
}
1698
2191
/* Run the main loop */
1699
2192
1700
2193
if(debug){
1701
fprintf(stderr, "Starting Avahi loop search\n");
1702
}
1703
1704
avahi_simple_poll_loop(mc.simple_poll);
2194
fprintf_plus(stderr, "Starting Avahi loop search\n");
2195
}
2196
2197
ret = avahi_loop_with_timeout(mc.simple_poll,
2198
(int)(retry_interval * 1000));
2199
if(debug){
2200
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2201
(ret == 0) ? "successfully" : "with error");
2202
}
1705
2203
1706
2204
end:
1707
2205
1708
2206
if(debug){
1709
fprintf(stderr, "%s exiting\n", argv[0]);
2207
fprintf_plus(stderr, "%s exiting\n", argv[0]);
1710
2208
}
1711
2209
1712
2210
/* Cleanup things */
1729
2227
gpgme_release(mc.ctx);
1730
2228
}
1731
2229
1732
/* Take down the network interface */
1733
if(take_down_interface){
1734
/* Re-raise priviliges */
2230
/* Cleans up the circular linked list of Mandos servers the client
2231
has seen */
2232
if(mc.current_server != NULL){
2233
mc.current_server->prev->next = NULL;
2234
while(mc.current_server != NULL){
2235
server *next = mc.current_server->next;
2236
free(mc.current_server);
2237
mc.current_server = next;
2238
}
2239
}
2240
2241
/* Run network hooks */
2242
run_network_hooks("stop", interface, delay);
2243
2244
/* Re-raise priviliges */
2245
{
1735
2246
errno = 0;
1736
2247
ret = seteuid(0);
1737
2248
if(ret == -1){
1738
perror("seteuid");
2249
perror_plus("seteuid");
1739
2250
}
1740
if(geteuid() == 0){
2251
2252
/* Take down the network interface */
2253
if(take_down_interface and geteuid() == 0){
1741
2254
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1742
2255
if(ret == -1){
1743
perror("ioctl SIOCGIFFLAGS");
1744
} else if(network.ifr_flags & IFF_UP) {
2256
perror_plus("ioctl SIOCGIFFLAGS");
2257
} else if(network.ifr_flags & IFF_UP){
1745
2258
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1746
2259
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1747
2260
if(ret == -1){
1748
perror("ioctl SIOCSIFFLAGS -IFF_UP");
2261
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1749
2262
}
1750
2263
}
1751
2264
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1752
2265
if(ret == -1){
1753
perror("close");
1754
}
1755
/* Lower privileges permanently */
1756
errno = 0;
1757
ret = setuid(uid);
1758
if(ret == -1){
1759
perror("setuid");
2266
perror_plus("close");
1760
2267
}
1761
2268
}
1762
2269
}
2270
/* Lower privileges permanently */
2271
errno = 0;
2272
ret = setuid(uid);
2273
if(ret == -1){
2274
perror_plus("setuid");
2275
}
1763
2276
1764
/* Removes the temp directory used by GPGME */
2277
/* Removes the GPGME temp directory and all files inside */
1765
2278
if(tempdir_created){
1766
DIR *d;
1767
struct dirent *direntry;
1768
d = opendir(tempdir);
1769
if(d == NULL){
1770
if(errno != ENOENT){
1771
perror("opendir");
1772
}
1773
} else {
1774
while(true){
1775
direntry = readdir(d);
1776
if(direntry == NULL){
1777
break;
1778
}
1779
/* Skip "." and ".." */
1780
if(direntry->d_name[0] == '.'
1781
and (direntry->d_name[1] == '\0'
1782
or (direntry->d_name[1] == '.'
1783
and direntry->d_name[2] == '\0'))){
1784
continue;
1785
}
2279
struct dirent **direntries = NULL;
2280
struct dirent *direntry = NULL;
2281
int numentries = scandir(tempdir, &direntries, notdotentries,
2282
alphasort);
2283
if (numentries > 0){
2284
for(int i = 0; i < numentries; i++){
2285
direntry = direntries[i];
1786
2286
char *fullname = NULL;
1787
2287
ret = asprintf(&fullname, "%s/%s", tempdir,
1788
2288
direntry->d_name);
1789
2289
if(ret < 0){
1790
perror("asprintf");
2290
perror_plus("asprintf");
1791
2291
continue;
1792
2292
}
1793
2293
ret = remove(fullname);
1794
2294
if(ret == -1){
1795
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1796
strerror(errno));
2295
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2296
strerror(errno));
1797
2297
}
1798
2298
free(fullname);
1799
2299
}
1800
closedir(d);
2300
}
2301
2302
/* need to clean even if 0 because man page doesn't specify */
2303
free(direntries);
2304
if (numentries == -1){
2305
perror_plus("scandir");
1801
2306
}
1802
2307
ret = rmdir(tempdir);
1803
2308
if(ret == -1 and errno != ENOENT){
1804
perror("rmdir");
2309
perror_plus("rmdir");
1805
2310
}
1806
2311
}
1807
2312
1812
2317
&old_sigterm_action,
1813
2318
NULL));
1814
2319
if(ret == -1){
1815
perror("sigaction");
2320
perror_plus("sigaction");
1816
2321
}
1817
2322
do {
1818
2323
ret = raise(signal_received);
1819
2324
} while(ret != 0 and errno == EINTR);
1820
2325
if(ret != 0){
1821
perror("raise");
2326
perror_plus("raise");
1822
2327
abort();
1823
2328
}
1824
2329
TEMP_FAILURE_RETRY(pause());
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0