To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 541
- compare with another revision
- download diff
- download tarball
- view history from revision 541
- Committer: Teddy Hogeborn
- Date: 2011-12-31 20:07:11 UTC
- mfrom: (535.1.9 wireless-network-hook)
- Revision ID: teddy@recompile.se-20111231200711-6dli3r8drftem57r
Merge new wireless network hook. Fix bridge network hook to use
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
- files removed:
- debian/mandos-client.examples
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2012 Teddy Hogeborn
13
* Copyright © 2008-2012 Björn Påhlsson
12
* Copyright © 2008-2011 Teddy Hogeborn
13
* Copyright © 2008-2011 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
41
41
42
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
47
strtof(), abort() */
61
61
*/
62
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
63
strtoimax() */
64
#include <assert.h> /* assert() */
64
65
#include <errno.h> /* perror(), errno,
65
66
program_invocation_short_name */
66
67
#include <time.h> /* nanosleep(), time(), sleep() */
87
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
88
89
WEXITSTATUS(), WTERMSIG() */
89
90
#include <grp.h> /* setgroups() */
90
#include <argz.h> /* argz_add_sep(), argz_next(),
91
argz_delete(), argz_append(),
92
argz_stringify(), argz_add(),
93
argz_count() */
94
91
95
92
#ifdef __linux__
96
93
#include <sys/klog.h> /* klogctl() */
138
135
static const char sys_class_net[] = "/sys/class/net";
139
136
char *connect_to = NULL;
140
137
const char *hookdir = HOOKDIR;
141
uid_t uid = 65534;
142
gid_t gid = 65534;
143
138
144
139
/* Doubly linked list that need to be circularly linked when used */
145
140
typedef struct server{
146
141
const char *ip;
147
in_port_t port;
142
uint16_t port;
148
143
AvahiIfIndex if_index;
149
144
int af;
150
145
struct timespec last_seen;
154
149
155
150
/* Used for passing in values through the Avahi callback functions */
156
151
typedef struct {
152
AvahiSimplePoll *simple_poll;
157
153
AvahiServer *server;
158
154
gnutls_certificate_credentials_t cred;
159
155
unsigned int dh_bits;
161
157
const char *priority;
162
158
gpgme_ctx_t ctx;
163
159
server *current_server;
164
char *interfaces;
165
size_t interfaces_size;
166
160
} mandos_context;
167
161
168
/* global so signal handler can reach it*/
169
AvahiSimplePoll *simple_poll;
162
/* global context so signal handler can reach it*/
163
mandos_context mc = { .simple_poll = NULL, .server = NULL,
164
.dh_bits = 1024, .priority = "SECURE256"
165
":!CTYPE-X.509:+CTYPE-OPENPGP",
166
.current_server = NULL };
170
167
171
168
sig_atomic_t quit_now = 0;
172
169
int signal_received = 0;
208
205
}
209
206
210
207
/* Add server to set of servers to retry periodically */
211
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
212
int af, server **current_server){
208
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
209
int af){
213
210
int ret;
214
211
server *new_server = malloc(sizeof(server));
215
212
if(new_server == NULL){
225
222
return false;
226
223
}
227
224
/* Special case of first server */
228
if(*current_server == NULL){
225
if (mc.current_server == NULL){
229
226
new_server->next = new_server;
230
227
new_server->prev = new_server;
231
*current_server = new_server;
228
mc.current_server = new_server;
232
229
/* Place the new server last in the list */
233
230
} else {
234
new_server->next = *current_server;
235
new_server->prev = (*current_server)->prev;
231
new_server->next = mc.current_server;
232
new_server->prev = mc.current_server->prev;
236
233
new_server->prev->next = new_server;
237
(*current_server)->prev = new_server;
234
mc.current_server->prev = new_server;
238
235
}
239
ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
240
237
if(ret == -1){
241
238
perror_plus("clock_gettime");
242
239
return false;
248
245
* Initialize GPGME.
249
246
*/
250
247
static bool init_gpgme(const char *seckey, const char *pubkey,
251
const char *tempdir, mandos_context *mc){
248
const char *tempdir){
252
249
gpgme_error_t rc;
253
250
gpgme_engine_info_t engine_info;
254
251
252
255
253
/*
256
254
* Helper function to insert pub and seckey to the engine keyring.
257
255
*/
273
271
return false;
274
272
}
275
273
276
rc = gpgme_op_import(mc->ctx, pgp_data);
274
rc = gpgme_op_import(mc.ctx, pgp_data);
277
275
if(rc != GPG_ERR_NO_ERROR){
278
276
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
279
277
gpgme_strsource(rc), gpgme_strerror(rc));
323
321
}
324
322
325
323
/* Create new GPGME "context" */
326
rc = gpgme_new(&(mc->ctx));
324
rc = gpgme_new(&(mc.ctx));
327
325
if(rc != GPG_ERR_NO_ERROR){
328
326
fprintf_plus(stderr, "Mandos plugin mandos-client: "
329
327
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
344
342
*/
345
343
static ssize_t pgp_packet_decrypt(const char *cryptotext,
346
344
size_t crypto_size,
347
char **plaintext,
348
mandos_context *mc){
345
char **plaintext){
349
346
gpgme_data_t dh_crypto, dh_plain;
350
347
gpgme_error_t rc;
351
348
ssize_t ret;
377
374
378
375
/* Decrypt data from the cryptotext data buffer to the plaintext
379
376
data buffer */
380
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
377
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
381
378
if(rc != GPG_ERR_NO_ERROR){
382
379
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
383
380
gpgme_strsource(rc), gpgme_strerror(rc));
384
381
plaintext_length = -1;
385
382
if(debug){
386
383
gpgme_decrypt_result_t result;
387
result = gpgme_op_decrypt_result(mc->ctx);
384
result = gpgme_op_decrypt_result(mc.ctx);
388
385
if(result == NULL){
389
386
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
390
387
} else {
468
465
}
469
466
470
467
static const char * safer_gnutls_strerror(int value){
471
const char *ret = gnutls_strerror(value);
468
const char *ret = gnutls_strerror(value); /* Spurious warning from
469
-Wunreachable-code */
472
470
if(ret == NULL)
473
471
ret = "(unknown)";
474
472
return ret;
481
479
}
482
480
483
481
static int init_gnutls_global(const char *pubkeyfilename,
484
const char *seckeyfilename,
485
mandos_context *mc){
482
const char *seckeyfilename){
486
483
int ret;
487
484
488
485
if(debug){
505
502
}
506
503
507
504
/* OpenPGP credentials */
508
ret = gnutls_certificate_allocate_credentials(&mc->cred);
505
ret = gnutls_certificate_allocate_credentials(&mc.cred);
509
506
if(ret != GNUTLS_E_SUCCESS){
510
507
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
511
508
safer_gnutls_strerror(ret));
521
518
}
522
519
523
520
ret = gnutls_certificate_set_openpgp_key_file
524
(mc->cred, pubkeyfilename, seckeyfilename,
521
(mc.cred, pubkeyfilename, seckeyfilename,
525
522
GNUTLS_OPENPGP_FMT_BASE64);
526
523
if(ret != GNUTLS_E_SUCCESS){
527
524
fprintf_plus(stderr,
533
530
}
534
531
535
532
/* GnuTLS server initialization */
536
ret = gnutls_dh_params_init(&mc->dh_params);
533
ret = gnutls_dh_params_init(&mc.dh_params);
537
534
if(ret != GNUTLS_E_SUCCESS){
538
535
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
539
536
" initialization: %s\n",
540
537
safer_gnutls_strerror(ret));
541
538
goto globalfail;
542
539
}
543
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
544
541
if(ret != GNUTLS_E_SUCCESS){
545
542
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
546
543
safer_gnutls_strerror(ret));
547
544
goto globalfail;
548
545
}
549
546
550
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
547
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
551
548
552
549
return 0;
553
550
554
551
globalfail:
555
552
556
gnutls_certificate_free_credentials(mc->cred);
553
gnutls_certificate_free_credentials(mc.cred);
557
554
gnutls_global_deinit();
558
gnutls_dh_params_deinit(mc->dh_params);
555
gnutls_dh_params_deinit(mc.dh_params);
559
556
return -1;
560
557
}
561
558
562
static int init_gnutls_session(gnutls_session_t *session,
563
mandos_context *mc){
559
static int init_gnutls_session(gnutls_session_t *session){
564
560
int ret;
565
561
/* GnuTLS session creation */
566
562
do {
578
574
{
579
575
const char *err;
580
576
do {
581
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
577
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
582
578
if(quit_now){
583
579
gnutls_deinit(*session);
584
580
return -1;
595
591
596
592
do {
597
593
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
598
mc->cred);
594
mc.cred);
599
595
if(quit_now){
600
596
gnutls_deinit(*session);
601
597
return -1;
611
607
/* ignore client certificate if any. */
612
608
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
613
609
614
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
610
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
615
611
616
612
return 0;
617
613
}
621
617
__attribute__((unused)) const char *txt){}
622
618
623
619
/* Called when a Mandos server is found */
624
static int start_mandos_communication(const char *ip, in_port_t port,
620
static int start_mandos_communication(const char *ip, uint16_t port,
625
621
AvahiIfIndex if_index,
626
int af, mandos_context *mc){
622
int af){
627
623
int ret, tcp_sd = -1;
628
624
ssize_t sret;
629
625
union {
659
655
return -1;
660
656
}
661
657
662
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
663
/* Check if the interface is one of the interfaces we are using */
664
bool match = false;
665
{
666
char *interface = NULL;
667
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
668
interface))){
669
if(if_nametoindex(interface) == (unsigned int)if_index){
670
match = true;
671
break;
672
}
673
}
674
}
675
if(not match){
676
if(debug){
677
char interface[IF_NAMESIZE];
678
if(if_indextoname((unsigned int)if_index, interface) == NULL){
679
perror_plus("if_indextoname");
680
} else {
681
fprintf_plus(stderr, "Skipping server on non-used interface"
682
" \"%s\"\n",
683
if_indextoname((unsigned int)if_index,
684
interface));
685
}
686
}
687
return -1;
688
}
689
}
690
691
ret = init_gnutls_session(&session, mc);
658
ret = init_gnutls_session(&session);
692
659
if(ret != 0){
693
660
return -1;
694
661
}
695
662
696
663
if(debug){
697
664
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
698
PRIuMAX "\n", ip, (uintmax_t)port);
665
PRIu16 "\n", ip, port);
699
666
}
700
667
701
668
tcp_sd = socket(pf, SOCK_STREAM, 0);
732
699
goto mandos_end;
733
700
}
734
701
if(af == AF_INET6){
735
to.in6.sin6_port = htons(port);
702
to.in6.sin6_port = htons(port); /* Spurious warnings from
703
-Wconversion and
704
-Wunreachable-code */
705
736
706
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
737
707
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
738
708
-Wunreachable-code*/
762
732
if(if_indextoname((unsigned int)if_index, interface) == NULL){
763
733
perror_plus("if_indextoname");
764
734
} else {
765
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
766
"\n", ip, interface, (uintmax_t)port);
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
767
737
}
768
738
} else {
769
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
770
ip, (uintmax_t)port);
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
740
ip, port);
771
741
}
772
742
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
773
743
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
851
821
goto mandos_end;
852
822
}
853
823
854
/* This casting via intptr_t is to eliminate warning about casting
855
an int to a pointer type. This is exactly how the GnuTLS Guile
856
function "set-session-transport-fd!" does it. */
857
gnutls_transport_set_ptr(session,
858
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
824
/* Spurious warning from -Wint-to-pointer-cast */
825
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
859
826
860
827
if(quit_now){
861
828
errno = EINTR;
966
933
if(buffer_length > 0){
967
934
ssize_t decrypted_buffer_size;
968
935
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
969
&decrypted_buffer, mc);
936
&decrypted_buffer);
970
937
if(decrypted_buffer_size >= 0){
971
938
972
939
written = 0;
1033
1000
AVAHI_GCC_UNUSED AvahiStringList *txt,
1034
1001
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1035
1002
flags,
1036
void* mc){
1037
if(r == NULL){
1038
return;
1039
}
1003
AVAHI_GCC_UNUSED void* userdata){
1004
assert(r);
1040
1005
1041
1006
/* Called whenever a service has been resolved successfully or
1042
1007
timed out */
1051
1016
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1052
1017
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1053
1018
domain,
1054
avahi_strerror(avahi_server_errno
1055
(((mandos_context*)mc)->server)));
1019
avahi_strerror(avahi_server_errno(mc.server)));
1056
1020
break;
1057
1021
1058
1022
case AVAHI_RESOLVER_FOUND:
1064
1028
PRIdMAX ") on port %" PRIu16 "\n", name,
1065
1029
host_name, ip, (intmax_t)interface, port);
1066
1030
}
1067
int ret = start_mandos_communication(ip, (in_port_t)port,
1068
interface,
1069
avahi_proto_to_af(proto),
1070
mc);
1031
int ret = start_mandos_communication(ip, port, interface,
1032
avahi_proto_to_af(proto));
1071
1033
if(ret == 0){
1072
avahi_simple_poll_quit(simple_poll);
1034
avahi_simple_poll_quit(mc.simple_poll);
1073
1035
} else {
1074
if(not add_server(ip, (in_port_t)port, interface,
1075
avahi_proto_to_af(proto),
1076
&((mandos_context*)mc)->current_server)){
1036
if(not add_server(ip, port, interface,
1037
avahi_proto_to_af(proto))){
1077
1038
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1078
1039
" list\n", name);
1079
1040
}
1092
1053
const char *domain,
1093
1054
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1094
1055
flags,
1095
void* mc){
1096
if(b == NULL){
1097
return;
1098
}
1056
AVAHI_GCC_UNUSED void* userdata){
1057
assert(b);
1099
1058
1100
1059
/* Called whenever a new services becomes available on the LAN or
1101
1060
is removed from the LAN */
1109
1068
case AVAHI_BROWSER_FAILURE:
1110
1069
1111
1070
fprintf_plus(stderr, "(Avahi browser) %s\n",
1112
avahi_strerror(avahi_server_errno
1113
(((mandos_context*)mc)->server)));
1114
avahi_simple_poll_quit(simple_poll);
1071
avahi_strerror(avahi_server_errno(mc.server)));
1072
avahi_simple_poll_quit(mc.simple_poll);
1115
1073
return;
1116
1074
1117
1075
case AVAHI_BROWSER_NEW:
1120
1078
the callback function is called the Avahi server will free the
1121
1079
resolver for us. */
1122
1080
1123
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1124
interface, protocol, name, type,
1125
domain, protocol, 0,
1126
resolve_callback, mc) == NULL)
1081
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1082
name, type, domain, protocol, 0,
1083
resolve_callback, NULL) == NULL)
1127
1084
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1128
1085
" %s\n", name,
1129
avahi_strerror(avahi_server_errno
1130
(((mandos_context*)mc)->server)));
1086
avahi_strerror(avahi_server_errno(mc.server)));
1131
1087
break;
1132
1088
1133
1089
case AVAHI_BROWSER_REMOVE:
1152
1108
signal_received = sig;
1153
1109
int old_errno = errno;
1154
1110
/* set main loop to exit */
1155
if(simple_poll != NULL){
1156
avahi_simple_poll_quit(simple_poll);
1111
if(mc.simple_poll != NULL){
1112
avahi_simple_poll_quit(mc.simple_poll);
1157
1113
}
1158
1114
errno = old_errno;
1159
1115
}
1160
1116
1161
1117
bool get_flags(const char *ifname, struct ifreq *ifr){
1162
1118
int ret;
1163
error_t ret_errno;
1164
1119
1165
1120
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1166
1121
if(s < 0){
1167
ret_errno = errno;
1168
1122
perror_plus("socket");
1169
errno = ret_errno;
1170
1123
return false;
1171
1124
}
1172
1125
strcpy(ifr->ifr_name, ifname);
1173
1126
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1174
1127
if(ret == -1){
1175
1128
if(debug){
1176
ret_errno = errno;
1177
1129
perror_plus("ioctl SIOCGIFFLAGS");
1178
errno = ret_errno;
1179
1130
}
1180
1131
return false;
1181
1132
}
1250
1201
}
1251
1202
1252
1203
/*
1253
* This function determines if a network interface is up.
1254
*/
1255
bool interface_is_up(const char *interface){
1256
struct ifreq ifr;
1257
if(not get_flags(interface, &ifr)){
1258
if(debug){
1259
fprintf_plus(stderr, "Failed to get flags for interface "
1260
"\"%s\"\n", interface);
1261
}
1262
return false;
1263
}
1264
1265
return (bool)(ifr.ifr_flags & IFF_UP);
1266
}
1267
1268
/*
1269
* This function determines if a network interface is running
1270
*/
1271
bool interface_is_running(const char *interface){
1272
struct ifreq ifr;
1273
if(not get_flags(interface, &ifr)){
1274
if(debug){
1275
fprintf_plus(stderr, "Failed to get flags for interface "
1276
"\"%s\"\n", interface);
1277
}
1278
return false;
1279
}
1280
1281
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1204
* This function determines if a directory entry in /sys/class/net
1205
* corresponds to an acceptable network device which is up.
1206
* (This function is passed to scandir(3) as a filter function.)
1207
*/
1208
int up_interface(const struct dirent *if_entry){
1209
if(if_entry->d_name[0] == '.'){
1210
return 0;
1211
}
1212
1213
struct ifreq ifr;
1214
if(not get_flags(if_entry->d_name, &ifr)){
1215
if(debug){
1216
fprintf_plus(stderr, "Failed to get flags for interface "
1217
"\"%s\"\n", if_entry->d_name);
1218
}
1219
return 0;
1220
}
1221
1222
/* Reject down interfaces */
1223
if(not (ifr.ifr_flags & IFF_UP)){
1224
if(debug){
1225
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1226
if_entry->d_name);
1227
}
1228
return 0;
1229
}
1230
1231
/* Reject non-running interfaces */
1232
if(not (ifr.ifr_flags & IFF_RUNNING)){
1233
if(debug){
1234
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1235
if_entry->d_name);
1236
}
1237
return 0;
1238
}
1239
1240
if(not good_flags(if_entry->d_name, &ifr)){
1241
return 0;
1242
}
1243
return 1;
1282
1244
}
1283
1245
1284
1246
int notdotentries(const struct dirent *direntry){
1353
1315
return 1;
1354
1316
}
1355
1317
1356
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1357
mandos_context *mc){
1318
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1358
1319
int ret;
1359
1320
struct timespec now;
1360
1321
struct timespec waited_time;
1361
1322
intmax_t block_time;
1362
1323
1363
1324
while(true){
1364
if(mc->current_server == NULL){
1325
if(mc.current_server == NULL){
1365
1326
if (debug){
1366
1327
fprintf_plus(stderr, "Wait until first server is found."
1367
1328
" No timeout!\n");
1381
1342
/* Calculating in ms how long time between now and server
1382
1343
who we visted longest time ago. Now - last seen. */
1383
1344
waited_time.tv_sec = (now.tv_sec
1384
- mc->current_server->last_seen.tv_sec);
1345
- mc.current_server->last_seen.tv_sec);
1385
1346
waited_time.tv_nsec = (now.tv_nsec
1386
- mc->current_server->last_seen.tv_nsec);
1347
- mc.current_server->last_seen.tv_nsec);
1387
1348
/* total time is 10s/10,000ms.
1388
1349
Converting to s from ms by dividing by 1,000,
1389
1350
and ns to ms by dividing by 1,000,000. */
1397
1358
}
1398
1359
1399
1360
if(block_time <= 0){
1400
ret = start_mandos_communication(mc->current_server->ip,
1401
mc->current_server->port,
1402
mc->current_server->if_index,
1403
mc->current_server->af, mc);
1361
ret = start_mandos_communication(mc.current_server->ip,
1362
mc.current_server->port,
1363
mc.current_server->if_index,
1364
mc.current_server->af);
1404
1365
if(ret == 0){
1405
avahi_simple_poll_quit(s);
1366
avahi_simple_poll_quit(mc.simple_poll);
1406
1367
return 0;
1407
1368
}
1408
1369
ret = clock_gettime(CLOCK_MONOTONIC,
1409
&mc->current_server->last_seen);
1370
&mc.current_server->last_seen);
1410
1371
if(ret == -1){
1411
1372
perror_plus("clock_gettime");
1412
1373
return -1;
1413
1374
}
1414
mc->current_server = mc->current_server->next;
1375
mc.current_server = mc.current_server->next;
1415
1376
block_time = 0; /* Call avahi to find new Mandos
1416
1377
servers, but don't block */
1417
1378
}
1426
1387
}
1427
1388
}
1428
1389
1429
/* Set effective uid to 0, return errno */
1430
error_t raise_privileges(void){
1431
error_t old_errno = errno;
1432
error_t ret_errno = 0;
1433
if(seteuid(0) == -1){
1434
ret_errno = errno;
1435
perror_plus("seteuid");
1436
}
1437
errno = old_errno;
1438
return ret_errno;
1439
}
1440
1441
/* Set effective and real user ID to 0. Return errno. */
1442
error_t raise_privileges_permanently(void){
1443
error_t old_errno = errno;
1444
error_t ret_errno = raise_privileges();
1445
if(ret_errno != 0){
1446
errno = old_errno;
1447
return ret_errno;
1448
}
1449
if(setuid(0) == -1){
1450
ret_errno = errno;
1451
perror_plus("seteuid");
1452
}
1453
errno = old_errno;
1454
return ret_errno;
1455
}
1456
1457
/* Set effective user ID to unprivileged saved user ID */
1458
error_t lower_privileges(void){
1459
error_t old_errno = errno;
1460
error_t ret_errno = 0;
1461
if(seteuid(uid) == -1){
1462
ret_errno = errno;
1463
perror_plus("seteuid");
1464
}
1465
errno = old_errno;
1466
return ret_errno;
1467
}
1468
1469
/* Lower privileges permanently */
1470
error_t lower_privileges_permanently(void){
1471
error_t old_errno = errno;
1472
error_t ret_errno = 0;
1473
if(setuid(uid) == -1){
1474
ret_errno = errno;
1475
perror_plus("setuid");
1476
}
1477
errno = old_errno;
1478
return ret_errno;
1479
}
1480
1481
1390
bool run_network_hooks(const char *mode, const char *interface,
1482
1391
const float delay){
1483
1392
struct dirent **direntries;
1486
1395
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1487
1396
alphasort);
1488
1397
if(numhooks == -1){
1489
if(errno == ENOENT){
1490
if(debug){
1491
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1492
" found\n", hookdir);
1493
}
1494
} else {
1495
perror_plus("scandir");
1496
}
1398
perror_plus("scandir");
1497
1399
} else {
1498
1400
int devnull = open("/dev/null", O_RDONLY);
1499
1401
for(int i = 0; i < numhooks; i++){
1512
1414
if(hook_pid == 0){
1513
1415
/* Child */
1514
1416
/* Raise privileges */
1515
raise_privileges_permanently();
1417
errno = 0;
1418
ret = seteuid(0);
1419
if(ret == -1){
1420
perror_plus("seteuid");
1421
}
1422
/* Raise privileges even more */
1423
errno = 0;
1424
ret = setuid(0);
1425
if(ret == -1){
1426
perror_plus("setuid");
1427
}
1516
1428
/* Set group */
1517
1429
errno = 0;
1518
1430
ret = setgid(0);
1611
1523
return true;
1612
1524
}
1613
1525
1614
error_t bring_up_interface(const char *const interface,
1615
const float delay){
1616
int sd = -1;
1617
error_t old_errno = errno;
1618
error_t ret_errno = 0;
1619
int ret, ret_setflags;
1620
struct ifreq network;
1621
unsigned int if_index = if_nametoindex(interface);
1622
if(if_index == 0){
1623
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1624
errno = old_errno;
1625
return ENXIO;
1626
}
1627
1628
if(quit_now){
1629
errno = old_errno;
1630
return EINTR;
1631
}
1632
1633
if(not interface_is_up(interface)){
1634
if(not get_flags(interface, &network) and debug){
1635
ret_errno = errno;
1636
fprintf_plus(stderr, "Failed to get flags for interface "
1637
"\"%s\"\n", interface);
1638
return ret_errno;
1639
}
1640
network.ifr_flags |= IFF_UP;
1641
1642
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1643
if(sd < 0){
1644
ret_errno = errno;
1645
perror_plus("socket");
1646
errno = old_errno;
1647
return ret_errno;
1648
}
1649
1650
if(quit_now){
1651
close(sd);
1652
errno = old_errno;
1653
return EINTR;
1654
}
1655
1656
if(debug){
1657
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
1658
interface);
1659
}
1660
1661
/* Raise priviliges */
1662
raise_privileges();
1663
1664
#ifdef __linux__
1665
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1666
messages about the network interface to mess up the prompt */
1667
int ret_linux = klogctl(8, NULL, 5);
1668
bool restore_loglevel = true;
1669
if(ret_linux == -1){
1670
restore_loglevel = false;
1671
perror_plus("klogctl");
1672
}
1673
#endif /* __linux__ */
1674
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1675
ret_errno = errno;
1676
#ifdef __linux__
1677
if(restore_loglevel){
1678
ret_linux = klogctl(7, NULL, 0);
1679
if(ret_linux == -1){
1680
perror_plus("klogctl");
1681
}
1682
}
1683
#endif /* __linux__ */
1684
1685
/* Lower privileges */
1686
lower_privileges();
1687
1688
/* Close the socket */
1689
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1690
if(ret == -1){
1691
perror_plus("close");
1692
}
1693
1694
if(ret_setflags == -1){
1695
errno = ret_errno;
1696
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1697
errno = old_errno;
1698
return ret_errno;
1699
}
1700
} else if(debug){
1701
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1702
interface);
1703
}
1704
1705
/* Sleep checking until interface is running.
1706
Check every 0.25s, up to total time of delay */
1707
for(int i=0; i < delay * 4; i++){
1708
if(interface_is_running(interface)){
1709
break;
1710
}
1711
struct timespec sleeptime = { .tv_nsec = 250000000 };
1712
ret = nanosleep(&sleeptime, NULL);
1713
if(ret == -1 and errno != EINTR){
1714
perror_plus("nanosleep");
1715
}
1716
}
1717
1718
errno = old_errno;
1719
return 0;
1720
}
1721
1722
error_t take_down_interface(const char *const interface){
1723
int sd = -1;
1724
error_t old_errno = errno;
1725
error_t ret_errno = 0;
1726
int ret, ret_setflags;
1727
struct ifreq network;
1728
unsigned int if_index = if_nametoindex(interface);
1729
if(if_index == 0){
1730
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1731
errno = old_errno;
1732
return ENXIO;
1733
}
1734
if(interface_is_up(interface)){
1735
if(not get_flags(interface, &network) and debug){
1736
ret_errno = errno;
1737
fprintf_plus(stderr, "Failed to get flags for interface "
1738
"\"%s\"\n", interface);
1739
return ret_errno;
1740
}
1741
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1742
1743
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1744
if(sd < 0){
1745
ret_errno = errno;
1746
perror_plus("socket");
1747
errno = old_errno;
1748
return ret_errno;
1749
}
1750
1751
if(debug){
1752
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
1753
interface);
1754
}
1755
1756
/* Raise priviliges */
1757
raise_privileges();
1758
1759
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1760
ret_errno = errno;
1761
1762
/* Lower privileges */
1763
lower_privileges();
1764
1765
/* Close the socket */
1766
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1767
if(ret == -1){
1768
perror_plus("close");
1769
}
1770
1771
if(ret_setflags == -1){
1772
errno = ret_errno;
1773
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1774
errno = old_errno;
1775
return ret_errno;
1776
}
1777
} else if(debug){
1778
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1779
interface);
1780
}
1781
1782
errno = old_errno;
1783
return 0;
1784
}
1785
1786
1526
int main(int argc, char *argv[]){
1787
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1788
.priority = "SECURE256:!CTYPE-X.509:"
1789
"+CTYPE-OPENPGP", .current_server = NULL,
1790
.interfaces = NULL, .interfaces_size = 0 };
1791
1527
AvahiSServiceBrowser *sb = NULL;
1792
error_t ret_errno;
1528
int error;
1793
1529
int ret;
1794
1530
intmax_t tmpmax;
1795
1531
char *tmp;
1796
1532
int exitcode = EXIT_SUCCESS;
1797
char *interfaces_to_take_down = NULL;
1798
size_t interfaces_to_take_down_size = 0;
1533
const char *interface = "";
1534
struct ifreq network;
1535
int sd = -1;
1536
bool take_down_interface = false;
1537
uid_t uid;
1538
gid_t gid;
1799
1539
char tempdir[] = "/tmp/mandosXXXXXX";
1800
1540
bool tempdir_created = false;
1801
1541
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1802
1542
const char *seckey = PATHDIR "/" SECKEY;
1803
1543
const char *pubkey = PATHDIR "/" PUBKEY;
1804
char *interfaces_hooks = NULL;
1805
size_t interfaces_hooks_size = 0;
1806
1544
1807
1545
bool gnutls_initialized = false;
1808
1546
bool gpgme_initialized = false;
1899
1637
connect_to = arg;
1900
1638
break;
1901
1639
case 'i': /* --interface */
1902
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
1903
arg, (int)',');
1904
if(ret_errno != 0){
1905
argp_error(state, "%s", strerror(ret_errno));
1906
}
1640
interface = arg;
1907
1641
break;
1908
1642
case 's': /* --seckey */
1909
1643
seckey = arg;
1987
1721
<http://bugs.debian.org/633582> */
1988
1722
1989
1723
/* Re-raise priviliges */
1990
if(raise_privileges() == 0){
1724
errno = 0;
1725
ret = seteuid(0);
1726
if(ret == -1){
1727
perror_plus("seteuid");
1728
} else {
1991
1729
struct stat st;
1992
1730
1993
1731
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2033
1771
}
2034
1772
2035
1773
/* Lower privileges */
2036
lower_privileges();
2037
}
2038
}
2039
2040
/* Remove invalid interface names (except "none") */
2041
{
2042
char *interface = NULL;
2043
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2044
interface))){
2045
if(strcmp(interface, "none") != 0
2046
and if_nametoindex(interface) == 0){
2047
if(interface[0] != '\0'){
2048
fprintf_plus(stderr, "Not using nonexisting interface"
2049
" \"%s\"\n", interface);
2050
}
2051
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2052
interface = NULL;
1774
errno = 0;
1775
ret = seteuid(uid);
1776
if(ret == -1){
1777
perror_plus("seteuid");
2053
1778
}
2054
1779
}
2055
1780
}
2056
1781
2057
1782
/* Run network hooks */
2058
{
2059
if(mc.interfaces != NULL){
2060
interfaces_hooks = malloc(mc.interfaces_size);
2061
if(interfaces_hooks == NULL){
2062
perror_plus("malloc");
2063
goto end;
2064
}
2065
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2066
interfaces_hooks_size = mc.interfaces_size;
2067
argz_stringify(interfaces_hooks, interfaces_hooks_size,
2068
(int)',');
2069
}
2070
if(not run_network_hooks("start", interfaces_hooks != NULL ?
2071
interfaces_hooks : "", delay)){
2072
goto end;
2073
}
1783
if(not run_network_hooks("start", interface, delay)){
1784
goto end;
2074
1785
}
2075
1786
2076
1787
if(not debug){
2077
1788
avahi_set_log_function(empty_log);
2078
1789
}
2079
1790
1791
if(interface[0] == '\0'){
1792
struct dirent **direntries;
1793
/* First look for interfaces that are up */
1794
ret = scandir(sys_class_net, &direntries, up_interface,
1795
alphasort);
1796
if(ret == 0){
1797
/* No up interfaces, look for any good interfaces */
1798
free(direntries);
1799
ret = scandir(sys_class_net, &direntries, good_interface,
1800
alphasort);
1801
}
1802
if(ret >= 1){
1803
/* Pick the first interface returned */
1804
interface = strdup(direntries[0]->d_name);
1805
if(debug){
1806
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1807
}
1808
if(interface == NULL){
1809
perror_plus("malloc");
1810
free(direntries);
1811
exitcode = EXIT_FAILURE;
1812
goto end;
1813
}
1814
free(direntries);
1815
} else {
1816
free(direntries);
1817
fprintf_plus(stderr, "Could not find a network interface\n");
1818
exitcode = EXIT_FAILURE;
1819
goto end;
1820
}
1821
}
1822
2080
1823
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
2081
1824
from the signal handler */
2082
1825
/* Initialize the pseudo-RNG for Avahi */
2083
1826
srand((unsigned int) time(NULL));
2084
simple_poll = avahi_simple_poll_new();
2085
if(simple_poll == NULL){
1827
mc.simple_poll = avahi_simple_poll_new();
1828
if(mc.simple_poll == NULL){
2086
1829
fprintf_plus(stderr,
2087
1830
"Avahi: Failed to create simple poll object.\n");
2088
1831
exitcode = EX_UNAVAILABLE;
2152
1895
}
2153
1896
}
2154
1897
2155
/* If no interfaces were specified, make a list */
2156
if(mc.interfaces == NULL){
2157
struct dirent **direntries;
2158
/* Look for any good interfaces */
2159
ret = scandir(sys_class_net, &direntries, good_interface,
2160
alphasort);
2161
if(ret >= 1){
2162
/* Add all found interfaces to interfaces list */
2163
for(int i = 0; i < ret; ++i){
2164
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2165
direntries[i]->d_name);
2166
if(ret_errno != 0){
2167
perror_plus("argz_add");
2168
continue;
2169
}
2170
if(debug){
2171
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2172
direntries[i]->d_name);
2173
}
2174
}
2175
free(direntries);
2176
} else {
2177
free(direntries);
2178
fprintf_plus(stderr, "Could not find a network interface\n");
2179
exitcode = EXIT_FAILURE;
2180
goto end;
2181
}
2182
}
2183
2184
/* Bring up interfaces which are down */
2185
{
2186
char *interface = NULL;
2187
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2188
interface))){
2189
/* If interface name is "none", stop bringing up interfaces.
2190
Also remove all instances of "none" from the list */
2191
if(strcmp(interface, "none") == 0){
2192
argz_delete(&mc.interfaces, &mc.interfaces_size,
2193
interface);
2194
interface = NULL;
2195
while((interface = argz_next(mc.interfaces,
2196
mc.interfaces_size, interface))){
2197
if(strcmp(interface, "none") == 0){
2198
argz_delete(&mc.interfaces, &mc.interfaces_size,
2199
interface);
2200
interface = NULL;
1898
/* If the interface is down, bring it up */
1899
if(strcmp(interface, "none") != 0){
1900
if_index = (AvahiIfIndex) if_nametoindex(interface);
1901
if(if_index == 0){
1902
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1903
exitcode = EX_UNAVAILABLE;
1904
goto end;
1905
}
1906
1907
if(quit_now){
1908
goto end;
1909
}
1910
1911
/* Re-raise priviliges */
1912
errno = 0;
1913
ret = seteuid(0);
1914
if(ret == -1){
1915
perror_plus("seteuid");
1916
}
1917
1918
#ifdef __linux__
1919
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1920
messages about the network interface to mess up the prompt */
1921
ret = klogctl(8, NULL, 5);
1922
bool restore_loglevel = true;
1923
if(ret == -1){
1924
restore_loglevel = false;
1925
perror_plus("klogctl");
1926
}
1927
#endif /* __linux__ */
1928
1929
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1930
if(sd < 0){
1931
perror_plus("socket");
1932
exitcode = EX_OSERR;
1933
#ifdef __linux__
1934
if(restore_loglevel){
1935
ret = klogctl(7, NULL, 0);
1936
if(ret == -1){
1937
perror_plus("klogctl");
1938
}
1939
}
1940
#endif /* __linux__ */
1941
/* Lower privileges */
1942
errno = 0;
1943
ret = seteuid(uid);
1944
if(ret == -1){
1945
perror_plus("seteuid");
1946
}
1947
goto end;
1948
}
1949
strcpy(network.ifr_name, interface);
1950
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1951
if(ret == -1){
1952
perror_plus("ioctl SIOCGIFFLAGS");
1953
#ifdef __linux__
1954
if(restore_loglevel){
1955
ret = klogctl(7, NULL, 0);
1956
if(ret == -1){
1957
perror_plus("klogctl");
1958
}
1959
}
1960
#endif /* __linux__ */
1961
exitcode = EX_OSERR;
1962
/* Lower privileges */
1963
errno = 0;
1964
ret = seteuid(uid);
1965
if(ret == -1){
1966
perror_plus("seteuid");
1967
}
1968
goto end;
1969
}
1970
if((network.ifr_flags & IFF_UP) == 0){
1971
network.ifr_flags |= IFF_UP;
1972
take_down_interface = true;
1973
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1974
if(ret == -1){
1975
take_down_interface = false;
1976
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1977
exitcode = EX_OSERR;
1978
#ifdef __linux__
1979
if(restore_loglevel){
1980
ret = klogctl(7, NULL, 0);
1981
if(ret == -1){
1982
perror_plus("klogctl");
2201
1983
}
2202
1984
}
1985
#endif /* __linux__ */
1986
/* Lower privileges */
1987
errno = 0;
1988
ret = seteuid(uid);
1989
if(ret == -1){
1990
perror_plus("seteuid");
1991
}
1992
goto end;
1993
}
1994
}
1995
/* Sleep checking until interface is running.
1996
Check every 0.25s, up to total time of delay */
1997
for(int i=0; i < delay * 4; i++){
1998
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1999
if(ret == -1){
2000
perror_plus("ioctl SIOCGIFFLAGS");
2001
} else if(network.ifr_flags & IFF_RUNNING){
2203
2002
break;
2204
2003
}
2205
bool interface_was_up = interface_is_up(interface);
2206
ret = bring_up_interface(interface, delay);
2207
if(not interface_was_up){
2208
if(ret != 0){
2209
errno = ret;
2210
perror_plus("Failed to bring up interface");
2211
} else {
2212
ret_errno = argz_add(&interfaces_to_take_down,
2213
&interfaces_to_take_down_size,
2214
interface);
2215
}
2216
}
2217
}
2218
if(debug and (interfaces_to_take_down == NULL)){
2219
fprintf_plus(stderr, "No interfaces were brought up\n");
2220
}
2221
}
2222
2223
/* If we only got one interface, explicitly use only that one */
2224
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2225
if(debug){
2226
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2227
mc.interfaces);
2228
}
2229
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2004
struct timespec sleeptime = { .tv_nsec = 250000000 };
2005
ret = nanosleep(&sleeptime, NULL);
2006
if(ret == -1 and errno != EINTR){
2007
perror_plus("nanosleep");
2008
}
2009
}
2010
if(not take_down_interface){
2011
/* We won't need the socket anymore */
2012
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2013
if(ret == -1){
2014
perror_plus("close");
2015
}
2016
}
2017
#ifdef __linux__
2018
if(restore_loglevel){
2019
/* Restores kernel loglevel to default */
2020
ret = klogctl(7, NULL, 0);
2021
if(ret == -1){
2022
perror_plus("klogctl");
2023
}
2024
}
2025
#endif /* __linux__ */
2026
/* Lower privileges */
2027
errno = 0;
2028
/* Lower privileges */
2029
ret = seteuid(uid);
2030
if(ret == -1){
2031
perror_plus("seteuid");
2032
}
2230
2033
}
2231
2034
2232
2035
if(quit_now){
2233
2036
goto end;
2234
2037
}
2235
2038
2236
ret = init_gnutls_global(pubkey, seckey, &mc);
2039
ret = init_gnutls_global(pubkey, seckey);
2237
2040
if(ret == -1){
2238
2041
fprintf_plus(stderr, "init_gnutls_global failed\n");
2239
2042
exitcode = EX_UNAVAILABLE;
2256
2059
goto end;
2257
2060
}
2258
2061
2259
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2062
if(not init_gpgme(pubkey, seckey, tempdir)){
2260
2063
fprintf_plus(stderr, "init_gpgme failed\n");
2261
2064
exitcode = EX_UNAVAILABLE;
2262
2065
goto end;
2272
2075
/* Connect directly, do not use Zeroconf */
2273
2076
/* (Mainly meant for debugging) */
2274
2077
char *address = strrchr(connect_to, ':');
2275
2276
2078
if(address == NULL){
2277
2079
fprintf_plus(stderr, "No colon in address\n");
2278
2080
exitcode = EX_USAGE;
2283
2085
goto end;
2284
2086
}
2285
2087
2286
in_port_t port;
2088
uint16_t port;
2287
2089
errno = 0;
2288
2090
tmpmax = strtoimax(address+1, &tmp, 10);
2289
2091
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2290
or tmpmax != (in_port_t)tmpmax){
2092
or tmpmax != (uint16_t)tmpmax){
2291
2093
fprintf_plus(stderr, "Bad port number\n");
2292
2094
exitcode = EX_USAGE;
2293
2095
goto end;
2294
2096
}
2295
2097
2296
2098
if(quit_now){
2297
2099
goto end;
2298
2100
}
2299
2101
2300
port = (in_port_t)tmpmax;
2102
port = (uint16_t)tmpmax;
2301
2103
*address = '\0';
2302
2104
/* Colon in address indicates IPv6 */
2303
2105
int af;
2319
2121
}
2320
2122
2321
2123
while(not quit_now){
2322
ret = start_mandos_communication(address, port, if_index, af,
2323
&mc);
2124
ret = start_mandos_communication(address, port, if_index, af);
2324
2125
if(quit_now or ret == 0){
2325
2126
break;
2326
2127
}
2352
2153
config.publish_domain = 0;
2353
2154
2354
2155
/* Allocate a new server */
2355
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2356
&config, NULL, NULL, &ret_errno);
2156
mc.server = avahi_server_new(avahi_simple_poll_get
2157
(mc.simple_poll), &config, NULL,
2158
NULL, &error);
2357
2159
2358
2160
/* Free the Avahi configuration data */
2359
2161
avahi_server_config_free(&config);
2362
2164
/* Check if creating the Avahi server object succeeded */
2363
2165
if(mc.server == NULL){
2364
2166
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2365
avahi_strerror(ret_errno));
2167
avahi_strerror(error));
2366
2168
exitcode = EX_UNAVAILABLE;
2367
2169
goto end;
2368
2170
}
2374
2176
/* Create the Avahi service browser */
2375
2177
sb = avahi_s_service_browser_new(mc.server, if_index,
2376
2178
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2377
NULL, 0, browse_callback,
2378
(void *)&mc);
2179
NULL, 0, browse_callback, NULL);
2379
2180
if(sb == NULL){
2380
2181
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2381
2182
avahi_strerror(avahi_server_errno(mc.server)));
2393
2194
fprintf_plus(stderr, "Starting Avahi loop search\n");
2394
2195
}
2395
2196
2396
ret = avahi_loop_with_timeout(simple_poll,
2397
(int)(retry_interval * 1000), &mc);
2197
ret = avahi_loop_with_timeout(mc.simple_poll,
2198
(int)(retry_interval * 1000));
2398
2199
if(debug){
2399
2200
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2400
2201
(ret == 0) ? "successfully" : "with error");
2407
2208
}
2408
2209
2409
2210
/* Cleanup things */
2410
free(mc.interfaces);
2411
2412
2211
if(sb != NULL)
2413
2212
avahi_s_service_browser_free(sb);
2414
2213
2415
2214
if(mc.server != NULL)
2416
2215
avahi_server_free(mc.server);
2417
2216
2418
if(simple_poll != NULL)
2419
avahi_simple_poll_free(simple_poll);
2217
if(mc.simple_poll != NULL)
2218
avahi_simple_poll_free(mc.simple_poll);
2420
2219
2421
2220
if(gnutls_initialized){
2422
2221
gnutls_certificate_free_credentials(mc.cred);
2439
2238
}
2440
2239
}
2441
2240
2241
/* Run network hooks */
2242
run_network_hooks("stop", interface, delay);
2243
2442
2244
/* Re-raise priviliges */
2443
2245
{
2444
raise_privileges();
2445
2446
/* Run network hooks */
2447
run_network_hooks("stop", interfaces_hooks != NULL ?
2448
interfaces_hooks : "", delay);
2449
2450
/* Take down the network interfaces which were brought up */
2451
{
2452
char *interface = NULL;
2453
while((interface=argz_next(interfaces_to_take_down,
2454
interfaces_to_take_down_size,
2455
interface))){
2456
ret_errno = take_down_interface(interface);
2457
if(ret_errno != 0){
2458
errno = ret_errno;
2459
perror_plus("Failed to take down interface");
2246
errno = 0;
2247
ret = seteuid(0);
2248
if(ret == -1){
2249
perror_plus("seteuid");
2250
}
2251
2252
/* Take down the network interface */
2253
if(take_down_interface and geteuid() == 0){
2254
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2255
if(ret == -1){
2256
perror_plus("ioctl SIOCGIFFLAGS");
2257
} else if(network.ifr_flags & IFF_UP){
2258
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2259
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2260
if(ret == -1){
2261
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2460
2262
}
2461
2263
}
2462
if(debug and (interfaces_to_take_down == NULL)){
2463
fprintf_plus(stderr, "No interfaces needed to be taken"
2464
" down\n");
2264
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2265
if(ret == -1){
2266
perror_plus("close");
2465
2267
}
2466
2268
}
2467
2468
lower_privileges_permanently();
2469
}
2470
2471
free(interfaces_to_take_down);
2472
free(interfaces_hooks);
2269
}
2270
/* Lower privileges permanently */
2271
errno = 0;
2272
ret = setuid(uid);
2273
if(ret == -1){
2274
perror_plus("setuid");
2275
}
2473
2276
2474
2277
/* Removes the GPGME temp directory and all files inside */
2475
2278
if(tempdir_created){
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0