To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 541
- compare with another revision
- download diff
- download tarball
- view history from revision 541
- Committer: Teddy Hogeborn
- Date: 2011-12-31 20:07:11 UTC
- mfrom: (535.1.9 wireless-network-hook)
- Revision ID: teddy@recompile.se-20111231200711-6dli3r8drftem57r
Merge new wireless network hook. Fix bridge network hook to use
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
- files added:
- network-hooks.d
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
53
53
sockaddr_in6, PF_INET6,
54
54
SOCK_STREAM, uid_t, gid_t, open(),
55
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
56
#include <sys/stat.h> /* open(), S_ISREG */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
58
inet_pton(), connect() */
59
59
#include <fcntl.h> /* open() */
73
73
*/
74
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
75
75
getuid(), getgid(), seteuid(),
76
setgid(), pause() */
76
setgid(), pause(), _exit() */
77
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
78
78
#include <iso646.h> /* not, or, and */
79
79
#include <argp.h> /* struct argp_option, error_t, struct
85
85
raise() */
86
86
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
87
87
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
89
WEXITSTATUS(), WTERMSIG() */
90
#include <grp.h> /* setgroups() */
88
91
89
92
#ifdef __linux__
90
93
#include <sys/klog.h> /* klogctl() */
108
111
init_gnutls_session(),
109
112
GNUTLS_* */
110
113
#include <gnutls/openpgp.h>
111
/* gnutls_certificate_set_openpgp_key_file(),
112
GNUTLS_OPENPGP_FMT_BASE64 */
114
/* gnutls_certificate_set_openpgp_key_file(),
115
GNUTLS_OPENPGP_FMT_BASE64 */
113
116
114
117
/* GPGME */
115
118
#include <gpgme.h> /* All GPGME types, constants and
123
126
#define PATHDIR "/conf/conf.d/mandos"
124
127
#define SECKEY "seckey.txt"
125
128
#define PUBKEY "pubkey.txt"
129
#define HOOKDIR "/lib/mandos/network-hooks.d"
126
130
127
131
bool debug = false;
128
132
static const char mandos_protocol_version[] = "1";
130
134
const char *argp_program_bug_address = "<mandos@recompile.se>";
131
135
static const char sys_class_net[] = "/sys/class/net";
132
136
char *connect_to = NULL;
137
const char *hookdir = HOOKDIR;
133
138
134
139
/* Doubly linked list that need to be circularly linked when used */
135
140
typedef struct server{
165
170
166
171
/* Function to use when printing errors */
167
172
void perror_plus(const char *print_text){
173
int e = errno;
168
174
fprintf(stderr, "Mandos plugin %s: ",
169
175
program_invocation_short_name);
176
errno = e;
170
177
perror(print_text);
171
178
}
172
179
180
__attribute__((format (gnu_printf, 2, 3)))
181
int fprintf_plus(FILE *stream, const char *format, ...){
182
va_list ap;
183
va_start (ap, format);
184
185
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
186
program_invocation_short_name));
187
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
188
}
189
173
190
/*
174
191
* Make additional room in "buffer" for at least BUFFER_SIZE more
175
192
* bytes. "buffer_capacity" is how much is currently allocated,
176
193
* "buffer_length" is how much is already used.
177
194
*/
178
195
size_t incbuffer(char **buffer, size_t buffer_length,
179
size_t buffer_capacity){
196
size_t buffer_capacity){
180
197
if(buffer_length + BUFFER_SIZE > buffer_capacity){
181
198
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
182
199
if(buffer == NULL){
188
205
}
189
206
190
207
/* Add server to set of servers to retry periodically */
191
int add_server(const char *ip, uint16_t port,
192
AvahiIfIndex if_index,
193
int af){
208
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
209
int af){
194
210
int ret;
195
211
server *new_server = malloc(sizeof(server));
196
212
if(new_server == NULL){
197
213
perror_plus("malloc");
198
return -1;
214
return false;
199
215
}
200
216
*new_server = (server){ .ip = strdup(ip),
201
.port = port,
202
.if_index = if_index,
203
.af = af };
217
.port = port,
218
.if_index = if_index,
219
.af = af };
204
220
if(new_server->ip == NULL){
205
221
perror_plus("strdup");
206
return -1;
222
return false;
207
223
}
208
224
/* Special case of first server */
209
225
if (mc.current_server == NULL){
220
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
221
237
if(ret == -1){
222
238
perror_plus("clock_gettime");
223
return -1;
239
return false;
224
240
}
225
return 0;
241
return true;
226
242
}
227
243
228
244
/*
229
245
* Initialize GPGME.
230
246
*/
231
static bool init_gpgme(const char *seckey,
232
const char *pubkey, const char *tempdir){
247
static bool init_gpgme(const char *seckey, const char *pubkey,
248
const char *tempdir){
233
249
gpgme_error_t rc;
234
250
gpgme_engine_info_t engine_info;
235
251
250
266
251
267
rc = gpgme_data_new_from_fd(&pgp_data, fd);
252
268
if(rc != GPG_ERR_NO_ERROR){
253
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
254
gpgme_strsource(rc), gpgme_strerror(rc));
269
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
270
gpgme_strsource(rc), gpgme_strerror(rc));
255
271
return false;
256
272
}
257
273
258
274
rc = gpgme_op_import(mc.ctx, pgp_data);
259
275
if(rc != GPG_ERR_NO_ERROR){
260
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
261
gpgme_strsource(rc), gpgme_strerror(rc));
276
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
277
gpgme_strsource(rc), gpgme_strerror(rc));
262
278
return false;
263
279
}
264
280
271
287
}
272
288
273
289
if(debug){
274
fprintf(stderr, "Initializing GPGME\n");
290
fprintf_plus(stderr, "Initializing GPGME\n");
275
291
}
276
292
277
293
/* Init GPGME */
278
294
gpgme_check_version(NULL);
279
295
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
280
296
if(rc != GPG_ERR_NO_ERROR){
281
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
282
gpgme_strsource(rc), gpgme_strerror(rc));
297
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
298
gpgme_strsource(rc), gpgme_strerror(rc));
283
299
return false;
284
300
}
285
301
286
302
/* Set GPGME home directory for the OpenPGP engine only */
287
303
rc = gpgme_get_engine_info(&engine_info);
288
304
if(rc != GPG_ERR_NO_ERROR){
289
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
290
gpgme_strsource(rc), gpgme_strerror(rc));
305
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
306
gpgme_strsource(rc), gpgme_strerror(rc));
291
307
return false;
292
308
}
293
309
while(engine_info != NULL){
299
315
engine_info = engine_info->next;
300
316
}
301
317
if(engine_info == NULL){
302
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
318
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
319
tempdir);
303
320
return false;
304
321
}
305
322
306
323
/* Create new GPGME "context" */
307
324
rc = gpgme_new(&(mc.ctx));
308
325
if(rc != GPG_ERR_NO_ERROR){
309
fprintf(stderr, "bad gpgme_new: %s: %s\n",
310
gpgme_strsource(rc), gpgme_strerror(rc));
326
fprintf_plus(stderr, "Mandos plugin mandos-client: "
327
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
328
gpgme_strerror(rc));
311
329
return false;
312
330
}
313
331
332
350
ssize_t plaintext_length = 0;
333
351
334
352
if(debug){
335
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
353
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
336
354
}
337
355
338
356
/* Create new GPGME data buffer from memory cryptotext */
339
357
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
340
358
0);
341
359
if(rc != GPG_ERR_NO_ERROR){
342
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
343
gpgme_strsource(rc), gpgme_strerror(rc));
360
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
361
gpgme_strsource(rc), gpgme_strerror(rc));
344
362
return -1;
345
363
}
346
364
347
365
/* Create new empty GPGME data buffer for the plaintext */
348
366
rc = gpgme_data_new(&dh_plain);
349
367
if(rc != GPG_ERR_NO_ERROR){
350
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
351
gpgme_strsource(rc), gpgme_strerror(rc));
368
fprintf_plus(stderr, "Mandos plugin mandos-client: "
369
"bad gpgme_data_new: %s: %s\n",
370
gpgme_strsource(rc), gpgme_strerror(rc));
352
371
gpgme_data_release(dh_crypto);
353
372
return -1;
354
373
}
357
376
data buffer */
358
377
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
359
378
if(rc != GPG_ERR_NO_ERROR){
360
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
361
gpgme_strsource(rc), gpgme_strerror(rc));
379
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
380
gpgme_strsource(rc), gpgme_strerror(rc));
362
381
plaintext_length = -1;
363
382
if(debug){
364
383
gpgme_decrypt_result_t result;
365
384
result = gpgme_op_decrypt_result(mc.ctx);
366
385
if(result == NULL){
367
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
386
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
368
387
} else {
369
fprintf(stderr, "Unsupported algorithm: %s\n",
370
result->unsupported_algorithm);
371
fprintf(stderr, "Wrong key usage: %u\n",
372
result->wrong_key_usage);
388
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
389
result->unsupported_algorithm);
390
fprintf_plus(stderr, "Wrong key usage: %u\n",
391
result->wrong_key_usage);
373
392
if(result->file_name != NULL){
374
fprintf(stderr, "File name: %s\n", result->file_name);
393
fprintf_plus(stderr, "File name: %s\n", result->file_name);
375
394
}
376
395
gpgme_recipient_t recipient;
377
396
recipient = result->recipients;
378
397
while(recipient != NULL){
379
fprintf(stderr, "Public key algorithm: %s\n",
380
gpgme_pubkey_algo_name(recipient->pubkey_algo));
381
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
382
fprintf(stderr, "Secret key available: %s\n",
383
recipient->status == GPG_ERR_NO_SECKEY
384
? "No" : "Yes");
398
fprintf_plus(stderr, "Public key algorithm: %s\n",
399
gpgme_pubkey_algo_name
400
(recipient->pubkey_algo));
401
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
402
fprintf_plus(stderr, "Secret key available: %s\n",
403
recipient->status == GPG_ERR_NO_SECKEY
404
? "No" : "Yes");
385
405
recipient = recipient->next;
386
406
}
387
407
}
390
410
}
391
411
392
412
if(debug){
393
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
413
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
394
414
}
395
415
396
416
/* Seek back to the beginning of the GPGME plaintext data buffer */
403
423
*plaintext = NULL;
404
424
while(true){
405
425
plaintext_capacity = incbuffer(plaintext,
406
(size_t)plaintext_length,
407
plaintext_capacity);
426
(size_t)plaintext_length,
427
plaintext_capacity);
408
428
if(plaintext_capacity == 0){
409
perror_plus("incbuffer");
410
plaintext_length = -1;
411
goto decrypt_end;
429
perror_plus("incbuffer");
430
plaintext_length = -1;
431
goto decrypt_end;
412
432
}
413
433
414
434
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
427
447
}
428
448
429
449
if(debug){
430
fprintf(stderr, "Decrypted password is: ");
450
fprintf_plus(stderr, "Decrypted password is: ");
431
451
for(ssize_t i = 0; i < plaintext_length; i++){
432
452
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
433
453
}
455
475
/* GnuTLS log function callback */
456
476
static void debuggnutls(__attribute__((unused)) int level,
457
477
const char* string){
458
fprintf(stderr, "GnuTLS: %s", string);
478
fprintf_plus(stderr, "GnuTLS: %s", string);
459
479
}
460
480
461
481
static int init_gnutls_global(const char *pubkeyfilename,
463
483
int ret;
464
484
465
485
if(debug){
466
fprintf(stderr, "Initializing GnuTLS\n");
486
fprintf_plus(stderr, "Initializing GnuTLS\n");
467
487
}
468
488
469
489
ret = gnutls_global_init();
470
490
if(ret != GNUTLS_E_SUCCESS){
471
fprintf(stderr, "GnuTLS global_init: %s\n",
472
safer_gnutls_strerror(ret));
491
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
492
safer_gnutls_strerror(ret));
473
493
return -1;
474
494
}
475
495
484
504
/* OpenPGP credentials */
485
505
ret = gnutls_certificate_allocate_credentials(&mc.cred);
486
506
if(ret != GNUTLS_E_SUCCESS){
487
fprintf(stderr, "GnuTLS memory error: %s\n",
488
safer_gnutls_strerror(ret));
507
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
508
safer_gnutls_strerror(ret));
489
509
gnutls_global_deinit();
490
510
return -1;
491
511
}
492
512
493
513
if(debug){
494
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
495
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
496
seckeyfilename);
514
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
515
" secret key %s as GnuTLS credentials\n",
516
pubkeyfilename,
517
seckeyfilename);
497
518
}
498
519
499
520
ret = gnutls_certificate_set_openpgp_key_file
500
521
(mc.cred, pubkeyfilename, seckeyfilename,
501
522
GNUTLS_OPENPGP_FMT_BASE64);
502
523
if(ret != GNUTLS_E_SUCCESS){
503
fprintf(stderr,
504
"Error[%d] while reading the OpenPGP key pair ('%s',"
505
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
506
fprintf(stderr, "The GnuTLS error is: %s\n",
507
safer_gnutls_strerror(ret));
524
fprintf_plus(stderr,
525
"Error[%d] while reading the OpenPGP key pair ('%s',"
526
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
527
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
528
safer_gnutls_strerror(ret));
508
529
goto globalfail;
509
530
}
510
531
511
532
/* GnuTLS server initialization */
512
533
ret = gnutls_dh_params_init(&mc.dh_params);
513
534
if(ret != GNUTLS_E_SUCCESS){
514
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
515
" %s\n", safer_gnutls_strerror(ret));
535
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
536
" initialization: %s\n",
537
safer_gnutls_strerror(ret));
516
538
goto globalfail;
517
539
}
518
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
519
541
if(ret != GNUTLS_E_SUCCESS){
520
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
521
safer_gnutls_strerror(ret));
542
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
543
safer_gnutls_strerror(ret));
522
544
goto globalfail;
523
545
}
524
546
544
566
}
545
567
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
546
568
if(ret != GNUTLS_E_SUCCESS){
547
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
548
safer_gnutls_strerror(ret));
569
fprintf_plus(stderr,
570
"Error in GnuTLS session initialization: %s\n",
571
safer_gnutls_strerror(ret));
549
572
}
550
573
551
574
{
558
581
}
559
582
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
560
583
if(ret != GNUTLS_E_SUCCESS){
561
fprintf(stderr, "Syntax error at: %s\n", err);
562
fprintf(stderr, "GnuTLS error: %s\n",
563
safer_gnutls_strerror(ret));
584
fprintf_plus(stderr, "Syntax error at: %s\n", err);
585
fprintf_plus(stderr, "GnuTLS error: %s\n",
586
safer_gnutls_strerror(ret));
564
587
gnutls_deinit(*session);
565
588
return -1;
566
589
}
575
598
}
576
599
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
577
600
if(ret != GNUTLS_E_SUCCESS){
578
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
579
safer_gnutls_strerror(ret));
601
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
602
safer_gnutls_strerror(ret));
580
603
gnutls_deinit(*session);
581
604
return -1;
582
605
}
627
650
pf = PF_INET;
628
651
break;
629
652
default:
630
fprintf(stderr, "Bad address family: %d\n", af);
653
fprintf_plus(stderr, "Bad address family: %d\n", af);
631
654
errno = EINVAL;
632
655
return -1;
633
656
}
638
661
}
639
662
640
663
if(debug){
641
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
642
"\n", ip, port);
664
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
665
PRIu16 "\n", ip, port);
643
666
}
644
667
645
668
tcp_sd = socket(pf, SOCK_STREAM, 0);
671
694
}
672
695
if(ret == 0){
673
696
int e = errno;
674
fprintf(stderr, "Bad address: %s\n", ip);
697
fprintf_plus(stderr, "Bad address: %s\n", ip);
675
698
errno = e;
676
699
goto mandos_end;
677
700
}
682
705
683
706
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
684
707
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
685
-Wunreachable-code*/
708
-Wunreachable-code*/
686
709
if(if_index == AVAHI_IF_UNSPEC){
687
fprintf(stderr, "An IPv6 link-local address is incomplete"
688
" without a network interface\n");
710
fprintf_plus(stderr, "An IPv6 link-local address is"
711
" incomplete without a network interface\n");
689
712
errno = EINVAL;
690
713
goto mandos_end;
691
714
}
709
732
if(if_indextoname((unsigned int)if_index, interface) == NULL){
710
733
perror_plus("if_indextoname");
711
734
} else {
712
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
713
ip, interface, port);
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
714
737
}
715
738
} else {
716
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
717
port);
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
740
ip, port);
718
741
}
719
742
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
720
743
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
730
753
perror_plus("inet_ntop");
731
754
} else {
732
755
if(strcmp(addrstr, ip) != 0){
733
fprintf(stderr, "Canonical address form: %s\n", addrstr);
756
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
734
757
}
735
758
}
736
759
}
764
787
while(true){
765
788
size_t out_size = strlen(out);
766
789
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
767
out_size - written));
790
out_size - written));
768
791
if(ret == -1){
769
792
int e = errno;
770
793
perror_plus("write");
790
813
}
791
814
792
815
if(debug){
793
fprintf(stderr, "Establishing TLS session with %s\n", ip);
816
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
794
817
}
795
818
796
819
if(quit_now){
816
839
817
840
if(ret != GNUTLS_E_SUCCESS){
818
841
if(debug){
819
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
842
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
820
843
gnutls_perror(ret);
821
844
}
822
845
errno = EPROTO;
826
849
/* Read OpenPGP packet that contains the wanted password */
827
850
828
851
if(debug){
829
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
830
ip);
852
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
853
" %s\n", ip);
831
854
}
832
855
833
856
while(true){
838
861
}
839
862
840
863
buffer_capacity = incbuffer(&buffer, buffer_length,
841
buffer_capacity);
864
buffer_capacity);
842
865
if(buffer_capacity == 0){
843
866
int e = errno;
844
867
perror_plus("incbuffer");
871
894
}
872
895
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
873
896
if(ret < 0){
874
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
897
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
898
"***\n");
875
899
gnutls_perror(ret);
876
900
errno = EPROTO;
877
901
goto mandos_end;
878
902
}
879
903
break;
880
904
default:
881
fprintf(stderr, "Unknown error while reading data from"
882
" encrypted session with Mandos server\n");
905
fprintf_plus(stderr, "Unknown error while reading data from"
906
" encrypted session with Mandos server\n");
883
907
gnutls_bye(session, GNUTLS_SHUT_RDWR);
884
908
errno = EIO;
885
909
goto mandos_end;
890
914
}
891
915
892
916
if(debug){
893
fprintf(stderr, "Closing TLS session\n");
917
fprintf_plus(stderr, "Closing TLS session\n");
894
918
}
895
919
896
920
if(quit_now){
908
932
909
933
if(buffer_length > 0){
910
934
ssize_t decrypted_buffer_size;
911
decrypted_buffer_size = pgp_packet_decrypt(buffer,
912
buffer_length,
935
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
913
936
&decrypted_buffer);
914
937
if(decrypted_buffer_size >= 0){
915
938
926
949
if(ret == 0 and ferror(stdout)){
927
950
int e = errno;
928
951
if(debug){
929
fprintf(stderr, "Error writing encrypted data: %s\n",
930
strerror(errno));
952
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
953
strerror(errno));
931
954
}
932
955
errno = e;
933
956
goto mandos_end;
990
1013
switch(event){
991
1014
default:
992
1015
case AVAHI_RESOLVER_FAILURE:
993
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
994
" of type '%s' in domain '%s': %s\n", name, type, domain,
995
avahi_strerror(avahi_server_errno(mc.server)));
1016
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1017
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1018
domain,
1019
avahi_strerror(avahi_server_errno(mc.server)));
996
1020
break;
997
1021
998
1022
case AVAHI_RESOLVER_FOUND:
1000
1024
char ip[AVAHI_ADDRESS_STR_MAX];
1001
1025
avahi_address_snprint(ip, sizeof(ip), address);
1002
1026
if(debug){
1003
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
1004
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
1005
ip, (intmax_t)interface, port);
1027
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1028
PRIdMAX ") on port %" PRIu16 "\n", name,
1029
host_name, ip, (intmax_t)interface, port);
1006
1030
}
1007
1031
int ret = start_mandos_communication(ip, port, interface,
1008
1032
avahi_proto_to_af(proto));
1009
1033
if(ret == 0){
1010
1034
avahi_simple_poll_quit(mc.simple_poll);
1011
1035
} else {
1012
ret = add_server(ip, port, interface,
1013
avahi_proto_to_af(proto));
1036
if(not add_server(ip, port, interface,
1037
avahi_proto_to_af(proto))){
1038
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1039
" list\n", name);
1040
}
1014
1041
}
1015
1042
}
1016
1043
}
1040
1067
default:
1041
1068
case AVAHI_BROWSER_FAILURE:
1042
1069
1043
fprintf(stderr, "(Avahi browser) %s\n",
1044
avahi_strerror(avahi_server_errno(mc.server)));
1070
fprintf_plus(stderr, "(Avahi browser) %s\n",
1071
avahi_strerror(avahi_server_errno(mc.server)));
1045
1072
avahi_simple_poll_quit(mc.simple_poll);
1046
1073
return;
1047
1074
1054
1081
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1055
1082
name, type, domain, protocol, 0,
1056
1083
resolve_callback, NULL) == NULL)
1057
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
1058
name, avahi_strerror(avahi_server_errno(mc.server)));
1084
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1085
" %s\n", name,
1086
avahi_strerror(avahi_server_errno(mc.server)));
1059
1087
break;
1060
1088
1061
1089
case AVAHI_BROWSER_REMOVE:
1064
1092
case AVAHI_BROWSER_ALL_FOR_NOW:
1065
1093
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1066
1094
if(debug){
1067
fprintf(stderr, "No Mandos server found, still searching...\n");
1095
fprintf_plus(stderr, "No Mandos server found, still"
1096
" searching...\n");
1068
1097
}
1069
1098
break;
1070
1099
}
1085
1114
errno = old_errno;
1086
1115
}
1087
1116
1088
/*
1089
* This function determines if a directory entry in /sys/class/net
1090
* corresponds to an acceptable network device.
1091
* (This function is passed to scandir(3) as a filter function.)
1092
*/
1093
int good_interface(const struct dirent *if_entry){
1094
ssize_t ssret;
1095
char *flagname = NULL;
1096
if(if_entry->d_name[0] == '.'){
1097
return 0;
1098
}
1099
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
1100
if_entry->d_name);
1101
if(ret < 0){
1102
perror_plus("asprintf");
1103
return 0;
1104
}
1105
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1106
if(flags_fd == -1){
1107
perror_plus("open");
1108
free(flagname);
1109
return 0;
1110
}
1111
free(flagname);
1112
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1113
/* read line from flags_fd */
1114
ssize_t to_read = 2+(sizeof(ifreq_flags)*2)+1; /* "0x1003\n" */
1115
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1116
flagstring[(size_t)to_read] = '\0';
1117
if(flagstring == NULL){
1118
perror_plus("malloc");
1119
close(flags_fd);
1120
return 0;
1121
}
1122
while(to_read > 0){
1123
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1124
(size_t)to_read));
1125
if(ssret == -1){
1126
perror_plus("read");
1127
free(flagstring);
1128
close(flags_fd);
1129
return 0;
1130
}
1131
to_read -= ssret;
1132
if(ssret == 0){
1133
break;
1134
}
1135
}
1136
close(flags_fd);
1137
intmax_t tmpmax;
1138
char *tmp;
1139
errno = 0;
1140
tmpmax = strtoimax(flagstring, &tmp, 0);
1141
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1142
and not (isspace(*tmp)))
1143
or tmpmax != (ifreq_flags)tmpmax){
1117
bool get_flags(const char *ifname, struct ifreq *ifr){
1118
int ret;
1119
1120
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1121
if(s < 0){
1122
perror_plus("socket");
1123
return false;
1124
}
1125
strcpy(ifr->ifr_name, ifname);
1126
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1127
if(ret == -1){
1144
1128
if(debug){
1145
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1146
flagstring, if_entry->d_name);
1129
perror_plus("ioctl SIOCGIFFLAGS");
1147
1130
}
1148
free(flagstring);
1149
return 0;
1131
return false;
1150
1132
}
1151
free(flagstring);
1152
ifreq_flags flags = (ifreq_flags)tmpmax;
1133
return true;
1134
}
1135
1136
bool good_flags(const char *ifname, const struct ifreq *ifr){
1137
1153
1138
/* Reject the loopback device */
1154
if(flags & IFF_LOOPBACK){
1139
if(ifr->ifr_flags & IFF_LOOPBACK){
1155
1140
if(debug){
1156
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1157
if_entry->d_name);
1141
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1142
ifname);
1158
1143
}
1159
return 0;
1144
return false;
1160
1145
}
1161
1146
/* Accept point-to-point devices only if connect_to is specified */
1162
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1147
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1163
1148
if(debug){
1164
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1165
if_entry->d_name);
1149
fprintf_plus(stderr, "Accepting point-to-point interface"
1150
" \"%s\"\n", ifname);
1166
1151
}
1167
return 1;
1152
return true;
1168
1153
}
1169
1154
/* Otherwise, reject non-broadcast-capable devices */
1170
if(not (flags & IFF_BROADCAST)){
1155
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1171
1156
if(debug){
1172
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1173
if_entry->d_name);
1157
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1158
" \"%s\"\n", ifname);
1174
1159
}
1175
return 0;
1160
return false;
1176
1161
}
1177
1162
/* Reject non-ARP interfaces (including dummy interfaces) */
1178
if(flags & IFF_NOARP){
1163
if(ifr->ifr_flags & IFF_NOARP){
1179
1164
if(debug){
1180
fprintf(stderr, "Rejecting non-ARP interface \"%s\"\n",
1181
if_entry->d_name);
1165
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1166
ifname);
1182
1167
}
1183
return 0;
1168
return false;
1184
1169
}
1170
1185
1171
/* Accept this device */
1186
1172
if(debug){
1187
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1188
if_entry->d_name);
1173
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1174
}
1175
return true;
1176
}
1177
1178
/*
1179
* This function determines if a directory entry in /sys/class/net
1180
* corresponds to an acceptable network device.
1181
* (This function is passed to scandir(3) as a filter function.)
1182
*/
1183
int good_interface(const struct dirent *if_entry){
1184
if(if_entry->d_name[0] == '.'){
1185
return 0;
1186
}
1187
1188
struct ifreq ifr;
1189
if(not get_flags(if_entry->d_name, &ifr)){
1190
if(debug){
1191
fprintf_plus(stderr, "Failed to get flags for interface "
1192
"\"%s\"\n", if_entry->d_name);
1193
}
1194
return 0;
1195
}
1196
1197
if(not good_flags(if_entry->d_name, &ifr)){
1198
return 0;
1199
}
1200
return 1;
1201
}
1202
1203
/*
1204
* This function determines if a directory entry in /sys/class/net
1205
* corresponds to an acceptable network device which is up.
1206
* (This function is passed to scandir(3) as a filter function.)
1207
*/
1208
int up_interface(const struct dirent *if_entry){
1209
if(if_entry->d_name[0] == '.'){
1210
return 0;
1211
}
1212
1213
struct ifreq ifr;
1214
if(not get_flags(if_entry->d_name, &ifr)){
1215
if(debug){
1216
fprintf_plus(stderr, "Failed to get flags for interface "
1217
"\"%s\"\n", if_entry->d_name);
1218
}
1219
return 0;
1220
}
1221
1222
/* Reject down interfaces */
1223
if(not (ifr.ifr_flags & IFF_UP)){
1224
if(debug){
1225
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1226
if_entry->d_name);
1227
}
1228
return 0;
1229
}
1230
1231
/* Reject non-running interfaces */
1232
if(not (ifr.ifr_flags & IFF_RUNNING)){
1233
if(debug){
1234
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1235
if_entry->d_name);
1236
}
1237
return 0;
1238
}
1239
1240
if(not good_flags(if_entry->d_name, &ifr)){
1241
return 0;
1189
1242
}
1190
1243
return 1;
1191
1244
}
1201
1254
return 1;
1202
1255
}
1203
1256
1257
/* Is this directory entry a runnable program? */
1258
int runnable_hook(const struct dirent *direntry){
1259
int ret;
1260
size_t sret;
1261
struct stat st;
1262
1263
if((direntry->d_name)[0] == '\0'){
1264
/* Empty name? */
1265
return 0;
1266
}
1267
1268
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1269
"abcdefghijklmnopqrstuvwxyz"
1270
"0123456789"
1271
"_-");
1272
if((direntry->d_name)[sret] != '\0'){
1273
/* Contains non-allowed characters */
1274
if(debug){
1275
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1276
direntry->d_name);
1277
}
1278
return 0;
1279
}
1280
1281
char *fullname = NULL;
1282
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1283
if(ret < 0){
1284
perror_plus("asprintf");
1285
return 0;
1286
}
1287
1288
ret = stat(fullname, &st);
1289
if(ret == -1){
1290
if(debug){
1291
perror_plus("Could not stat hook");
1292
}
1293
return 0;
1294
}
1295
if(not (S_ISREG(st.st_mode))){
1296
/* Not a regular file */
1297
if(debug){
1298
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1299
direntry->d_name);
1300
}
1301
return 0;
1302
}
1303
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1304
/* Not executable */
1305
if(debug){
1306
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1307
direntry->d_name);
1308
}
1309
return 0;
1310
}
1311
if(debug){
1312
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1313
direntry->d_name);
1314
}
1315
return 1;
1316
}
1317
1204
1318
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1205
1319
int ret;
1206
1320
struct timespec now;
1210
1324
while(true){
1211
1325
if(mc.current_server == NULL){
1212
1326
if (debug){
1213
fprintf(stderr,
1214
"Wait until first server is found. No timeout!\n");
1327
fprintf_plus(stderr, "Wait until first server is found."
1328
" No timeout!\n");
1215
1329
}
1216
1330
ret = avahi_simple_poll_iterate(s, -1);
1217
1331
} else {
1218
1332
if (debug){
1219
fprintf(stderr, "Check current_server if we should run it,"
1220
" or wait\n");
1333
fprintf_plus(stderr, "Check current_server if we should run"
1334
" it, or wait\n");
1221
1335
}
1222
1336
/* the current time */
1223
1337
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1239
1353
- ((intmax_t)waited_time.tv_nsec / 1000000));
1240
1354
1241
1355
if (debug){
1242
fprintf(stderr, "Blocking for %" PRIdMAX " ms\n", block_time);
1356
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1357
block_time);
1243
1358
}
1244
1359
1245
1360
if(block_time <= 0){
1265
1380
ret = avahi_simple_poll_iterate(s, (int)block_time);
1266
1381
}
1267
1382
if(ret != 0){
1268
if (ret > 0 or errno != EINTR) {
1383
if (ret > 0 or errno != EINTR){
1269
1384
return (ret != 1) ? ret : 0;
1270
1385
}
1271
1386
}
1272
1387
}
1273
1388
}
1274
1389
1390
bool run_network_hooks(const char *mode, const char *interface,
1391
const float delay){
1392
struct dirent **direntries;
1393
struct dirent *direntry;
1394
int ret;
1395
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1396
alphasort);
1397
if(numhooks == -1){
1398
perror_plus("scandir");
1399
} else {
1400
int devnull = open("/dev/null", O_RDONLY);
1401
for(int i = 0; i < numhooks; i++){
1402
direntry = direntries[i];
1403
char *fullname = NULL;
1404
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1405
if(ret < 0){
1406
perror_plus("asprintf");
1407
continue;
1408
}
1409
if(debug){
1410
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1411
direntry->d_name);
1412
}
1413
pid_t hook_pid = fork();
1414
if(hook_pid == 0){
1415
/* Child */
1416
/* Raise privileges */
1417
errno = 0;
1418
ret = seteuid(0);
1419
if(ret == -1){
1420
perror_plus("seteuid");
1421
}
1422
/* Raise privileges even more */
1423
errno = 0;
1424
ret = setuid(0);
1425
if(ret == -1){
1426
perror_plus("setuid");
1427
}
1428
/* Set group */
1429
errno = 0;
1430
ret = setgid(0);
1431
if(ret == -1){
1432
perror_plus("setgid");
1433
}
1434
/* Reset supplementary groups */
1435
errno = 0;
1436
ret = setgroups(0, NULL);
1437
if(ret == -1){
1438
perror_plus("setgroups");
1439
}
1440
dup2(devnull, STDIN_FILENO);
1441
close(devnull);
1442
dup2(STDERR_FILENO, STDOUT_FILENO);
1443
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1444
if(ret == -1){
1445
perror_plus("setenv");
1446
_exit(EX_OSERR);
1447
}
1448
ret = setenv("DEVICE", interface, 1);
1449
if(ret == -1){
1450
perror_plus("setenv");
1451
_exit(EX_OSERR);
1452
}
1453
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1454
if(ret == -1){
1455
perror_plus("setenv");
1456
_exit(EX_OSERR);
1457
}
1458
ret = setenv("MODE", mode, 1);
1459
if(ret == -1){
1460
perror_plus("setenv");
1461
_exit(EX_OSERR);
1462
}
1463
char *delaystring;
1464
ret = asprintf(&delaystring, "%f", delay);
1465
if(ret == -1){
1466
perror_plus("asprintf");
1467
_exit(EX_OSERR);
1468
}
1469
ret = setenv("DELAY", delaystring, 1);
1470
if(ret == -1){
1471
free(delaystring);
1472
perror_plus("setenv");
1473
_exit(EX_OSERR);
1474
}
1475
free(delaystring);
1476
if(connect_to != NULL){
1477
ret = setenv("CONNECT", connect_to, 1);
1478
if(ret == -1){
1479
perror_plus("setenv");
1480
_exit(EX_OSERR);
1481
}
1482
}
1483
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1484
perror_plus("execl");
1485
_exit(EXIT_FAILURE);
1486
}
1487
} else {
1488
int status;
1489
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1490
perror_plus("waitpid");
1491
free(fullname);
1492
continue;
1493
}
1494
if(WIFEXITED(status)){
1495
if(WEXITSTATUS(status) != 0){
1496
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1497
" with status %d\n", direntry->d_name,
1498
WEXITSTATUS(status));
1499
free(fullname);
1500
continue;
1501
}
1502
} else if(WIFSIGNALED(status)){
1503
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1504
" signal %d\n", direntry->d_name,
1505
WTERMSIG(status));
1506
free(fullname);
1507
continue;
1508
} else {
1509
fprintf_plus(stderr, "Warning: network hook \"%s\""
1510
" crashed\n", direntry->d_name);
1511
free(fullname);
1512
continue;
1513
}
1514
}
1515
free(fullname);
1516
if(debug){
1517
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1518
direntry->d_name);
1519
}
1520
}
1521
close(devnull);
1522
}
1523
return true;
1524
}
1525
1275
1526
int main(int argc, char *argv[]){
1276
1527
AvahiSServiceBrowser *sb = NULL;
1277
1528
int error;
1357
1608
.group = 2 },
1358
1609
{ .name = "retry", .key = 132,
1359
1610
.arg = "SECONDS",
1360
.doc = "Retry interval used when denied by the mandos server",
1611
.doc = "Retry interval used when denied by the Mandos server",
1612
.group = 2 },
1613
{ .name = "network-hook-dir", .key = 133,
1614
.arg = "DIR",
1615
.doc = "Directory where network hooks are located",
1361
1616
.group = 2 },
1362
1617
/*
1363
1618
* These reproduce what we would get without ARGP_NO_HELP
1417
1672
argp_error(state, "Bad retry interval");
1418
1673
}
1419
1674
break;
1675
case 133: /* --network-hook-dir */
1676
hookdir = arg;
1677
break;
1420
1678
/*
1421
1679
* These reproduce what we would get without ARGP_NO_HELP
1422
1680
*/
1428
1686
argp_state_help(state, state->out_stream,
1429
1687
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1430
1688
case 'V': /* --version */
1431
fprintf(state->out_stream, "%s\n", argp_program_version);
1689
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1432
1690
exit(argp_err_exit_status);
1433
1691
break;
1434
1692
default:
1461
1719
{
1462
1720
/* Work around Debian bug #633582:
1463
1721
<http://bugs.debian.org/633582> */
1464
struct stat st;
1465
1722
1466
1723
/* Re-raise priviliges */
1467
1724
errno = 0;
1468
1725
ret = seteuid(0);
1469
1726
if(ret == -1){
1470
1727
perror_plus("seteuid");
1471
}
1472
1473
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1474
int seckey_fd = open(seckey, O_RDONLY);
1475
if(seckey_fd == -1){
1476
perror_plus("open");
1477
} else {
1478
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1479
if(ret == -1){
1480
perror_plus("fstat");
1481
} else {
1482
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1483
ret = fchown(seckey_fd, uid, gid);
1484
if(ret == -1){
1485
perror_plus("fchown");
1486
}
1487
}
1488
}
1489
TEMP_FAILURE_RETRY(close(seckey_fd));
1490
}
1491
}
1492
1493
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1494
int pubkey_fd = open(pubkey, O_RDONLY);
1495
if(pubkey_fd == -1){
1496
perror_plus("open");
1497
} else {
1498
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1499
if(ret == -1){
1500
perror_plus("fstat");
1501
} else {
1502
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1503
ret = fchown(pubkey_fd, uid, gid);
1504
if(ret == -1){
1505
perror_plus("fchown");
1506
}
1507
}
1508
}
1509
TEMP_FAILURE_RETRY(close(pubkey_fd));
1510
}
1511
}
1512
1513
/* Lower privileges */
1514
errno = 0;
1515
ret = seteuid(uid);
1516
if(ret == -1){
1517
perror_plus("seteuid");
1518
}
1728
} else {
1729
struct stat st;
1730
1731
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1732
int seckey_fd = open(seckey, O_RDONLY);
1733
if(seckey_fd == -1){
1734
perror_plus("open");
1735
} else {
1736
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1737
if(ret == -1){
1738
perror_plus("fstat");
1739
} else {
1740
if(S_ISREG(st.st_mode)
1741
and st.st_uid == 0 and st.st_gid == 0){
1742
ret = fchown(seckey_fd, uid, gid);
1743
if(ret == -1){
1744
perror_plus("fchown");
1745
}
1746
}
1747
}
1748
TEMP_FAILURE_RETRY(close(seckey_fd));
1749
}
1750
}
1751
1752
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1753
int pubkey_fd = open(pubkey, O_RDONLY);
1754
if(pubkey_fd == -1){
1755
perror_plus("open");
1756
} else {
1757
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1758
if(ret == -1){
1759
perror_plus("fstat");
1760
} else {
1761
if(S_ISREG(st.st_mode)
1762
and st.st_uid == 0 and st.st_gid == 0){
1763
ret = fchown(pubkey_fd, uid, gid);
1764
if(ret == -1){
1765
perror_plus("fchown");
1766
}
1767
}
1768
}
1769
TEMP_FAILURE_RETRY(close(pubkey_fd));
1770
}
1771
}
1772
1773
/* Lower privileges */
1774
errno = 0;
1775
ret = seteuid(uid);
1776
if(ret == -1){
1777
perror_plus("seteuid");
1778
}
1779
}
1780
}
1781
1782
/* Run network hooks */
1783
if(not run_network_hooks("start", interface, delay)){
1784
goto end;
1519
1785
}
1520
1786
1521
1787
if(not debug){
1522
1788
avahi_set_log_function(empty_log);
1523
1789
}
1524
1790
1525
1791
if(interface[0] == '\0'){
1526
1792
struct dirent **direntries;
1527
ret = scandir(sys_class_net, &direntries, good_interface,
1793
/* First look for interfaces that are up */
1794
ret = scandir(sys_class_net, &direntries, up_interface,
1528
1795
alphasort);
1796
if(ret == 0){
1797
/* No up interfaces, look for any good interfaces */
1798
free(direntries);
1799
ret = scandir(sys_class_net, &direntries, good_interface,
1800
alphasort);
1801
}
1529
1802
if(ret >= 1){
1530
/* Pick the first good interface */
1803
/* Pick the first interface returned */
1531
1804
interface = strdup(direntries[0]->d_name);
1532
1805
if(debug){
1533
fprintf(stderr, "Using interface \"%s\"\n", interface);
1806
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1534
1807
}
1535
1808
if(interface == NULL){
1536
1809
perror_plus("malloc");
1541
1814
free(direntries);
1542
1815
} else {
1543
1816
free(direntries);
1544
fprintf(stderr, "Could not find a network interface\n");
1817
fprintf_plus(stderr, "Could not find a network interface\n");
1545
1818
exitcode = EXIT_FAILURE;
1546
1819
goto end;
1547
1820
}
1553
1826
srand((unsigned int) time(NULL));
1554
1827
mc.simple_poll = avahi_simple_poll_new();
1555
1828
if(mc.simple_poll == NULL){
1556
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1829
fprintf_plus(stderr,
1830
"Avahi: Failed to create simple poll object.\n");
1557
1831
exitcode = EX_UNAVAILABLE;
1558
1832
goto end;
1559
1833
}
1625
1899
if(strcmp(interface, "none") != 0){
1626
1900
if_index = (AvahiIfIndex) if_nametoindex(interface);
1627
1901
if(if_index == 0){
1628
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1902
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1629
1903
exitcode = EX_UNAVAILABLE;
1630
1904
goto end;
1631
1905
}
1751
2025
#endif /* __linux__ */
1752
2026
/* Lower privileges */
1753
2027
errno = 0;
1754
if(take_down_interface){
1755
/* Lower privileges */
1756
ret = seteuid(uid);
1757
if(ret == -1){
1758
perror_plus("seteuid");
1759
}
1760
} else {
1761
/* Lower privileges permanently */
1762
ret = setuid(uid);
1763
if(ret == -1){
1764
perror_plus("setuid");
1765
}
2028
/* Lower privileges */
2029
ret = seteuid(uid);
2030
if(ret == -1){
2031
perror_plus("seteuid");
1766
2032
}
1767
2033
}
1768
2034
1772
2038
1773
2039
ret = init_gnutls_global(pubkey, seckey);
1774
2040
if(ret == -1){
1775
fprintf(stderr, "init_gnutls_global failed\n");
2041
fprintf_plus(stderr, "init_gnutls_global failed\n");
1776
2042
exitcode = EX_UNAVAILABLE;
1777
2043
goto end;
1778
2044
} else {
1794
2060
}
1795
2061
1796
2062
if(not init_gpgme(pubkey, seckey, tempdir)){
1797
fprintf(stderr, "init_gpgme failed\n");
2063
fprintf_plus(stderr, "init_gpgme failed\n");
1798
2064
exitcode = EX_UNAVAILABLE;
1799
2065
goto end;
1800
2066
} else {
1810
2076
/* (Mainly meant for debugging) */
1811
2077
char *address = strrchr(connect_to, ':');
1812
2078
if(address == NULL){
1813
fprintf(stderr, "No colon in address\n");
2079
fprintf_plus(stderr, "No colon in address\n");
1814
2080
exitcode = EX_USAGE;
1815
2081
goto end;
1816
2082
}
1824
2090
tmpmax = strtoimax(address+1, &tmp, 10);
1825
2091
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1826
2092
or tmpmax != (uint16_t)tmpmax){
1827
fprintf(stderr, "Bad port number\n");
2093
fprintf_plus(stderr, "Bad port number\n");
1828
2094
exitcode = EX_USAGE;
1829
2095
goto end;
1830
2096
}
1860
2126
break;
1861
2127
}
1862
2128
if(debug){
1863
fprintf(stderr, "Retrying in %d seconds\n",
1864
(int)retry_interval);
2129
fprintf_plus(stderr, "Retrying in %d seconds\n",
2130
(int)retry_interval);
1865
2131
}
1866
2132
sleep((int)retry_interval);
1867
2133
}
1869
2135
if (not quit_now){
1870
2136
exitcode = EXIT_SUCCESS;
1871
2137
}
1872
2138
1873
2139
goto end;
1874
2140
}
1875
2141
1897
2163
1898
2164
/* Check if creating the Avahi server object succeeded */
1899
2165
if(mc.server == NULL){
1900
fprintf(stderr, "Failed to create Avahi server: %s\n",
1901
avahi_strerror(error));
2166
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2167
avahi_strerror(error));
1902
2168
exitcode = EX_UNAVAILABLE;
1903
2169
goto end;
1904
2170
}
1912
2178
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1913
2179
NULL, 0, browse_callback, NULL);
1914
2180
if(sb == NULL){
1915
fprintf(stderr, "Failed to create service browser: %s\n",
1916
avahi_strerror(avahi_server_errno(mc.server)));
2181
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2182
avahi_strerror(avahi_server_errno(mc.server)));
1917
2183
exitcode = EX_UNAVAILABLE;
1918
2184
goto end;
1919
2185
}
1925
2191
/* Run the main loop */
1926
2192
1927
2193
if(debug){
1928
fprintf(stderr, "Starting Avahi loop search\n");
2194
fprintf_plus(stderr, "Starting Avahi loop search\n");
1929
2195
}
1930
2196
1931
2197
ret = avahi_loop_with_timeout(mc.simple_poll,
1932
2198
(int)(retry_interval * 1000));
1933
2199
if(debug){
1934
fprintf(stderr, "avahi_loop_with_timeout exited %s\n",
1935
(ret == 0) ? "successfully" : "with error");
2200
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2201
(ret == 0) ? "successfully" : "with error");
1936
2202
}
1937
2203
1938
2204
end:
1939
2205
1940
2206
if(debug){
1941
fprintf(stderr, "%s exiting\n", argv[0]);
2207
fprintf_plus(stderr, "%s exiting\n", argv[0]);
1942
2208
}
1943
2209
1944
2210
/* Cleanup things */
1960
2226
if(gpgme_initialized){
1961
2227
gpgme_release(mc.ctx);
1962
2228
}
1963
2229
1964
2230
/* Cleans up the circular linked list of Mandos servers the client
1965
2231
has seen */
1966
2232
if(mc.current_server != NULL){
1972
2238
}
1973
2239
}
1974
2240
1975
/* Take down the network interface */
1976
if(take_down_interface){
1977
/* Re-raise priviliges */
2241
/* Run network hooks */
2242
run_network_hooks("stop", interface, delay);
2243
2244
/* Re-raise priviliges */
2245
{
1978
2246
errno = 0;
1979
2247
ret = seteuid(0);
1980
2248
if(ret == -1){
1981
2249
perror_plus("seteuid");
1982
2250
}
1983
if(geteuid() == 0){
2251
2252
/* Take down the network interface */
2253
if(take_down_interface and geteuid() == 0){
1984
2254
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1985
2255
if(ret == -1){
1986
2256
perror_plus("ioctl SIOCGIFFLAGS");
1987
} else if(network.ifr_flags & IFF_UP) {
2257
} else if(network.ifr_flags & IFF_UP){
1988
2258
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1989
2259
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1990
2260
if(ret == -1){
1995
2265
if(ret == -1){
1996
2266
perror_plus("close");
1997
2267
}
1998
/* Lower privileges permanently */
1999
errno = 0;
2000
ret = setuid(uid);
2001
if(ret == -1){
2002
perror_plus("setuid");
2003
}
2004
2268
}
2005
2269
}
2270
/* Lower privileges permanently */
2271
errno = 0;
2272
ret = setuid(uid);
2273
if(ret == -1){
2274
perror_plus("setuid");
2275
}
2006
2276
2007
2277
/* Removes the GPGME temp directory and all files inside */
2008
2278
if(tempdir_created){
2022
2292
}
2023
2293
ret = remove(fullname);
2024
2294
if(ret == -1){
2025
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
2026
strerror(errno));
2295
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2296
strerror(errno));
2027
2297
}
2028
2298
free(fullname);
2029
2299
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0