To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 541
- compare with another revision
- download diff
- download tarball
- view history from revision 541
- Committer: Teddy Hogeborn
- Date: 2011-12-31 20:07:11 UTC
- mfrom: (535.1.9 wireless-network-hook)
- Revision ID: teddy@recompile.se-20111231200711-6dli3r8drftem57r
Merge new wireless network hook. Fix bridge network hook to use
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
- files removed:
- debian/mandos-client.examples
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2013 Teddy Hogeborn
13
* Copyright © 2008-2013 Björn Påhlsson
12
* Copyright © 2008-2011 Teddy Hogeborn
13
* Copyright © 2008-2011 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
41
41
42
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
47
strtof(), abort() */
61
61
*/
62
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
63
strtoimax() */
64
#include <assert.h> /* assert() */
64
65
#include <errno.h> /* perror(), errno,
65
66
program_invocation_short_name */
66
67
#include <time.h> /* nanosleep(), time(), sleep() */
87
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
88
89
WEXITSTATUS(), WTERMSIG() */
89
90
#include <grp.h> /* setgroups() */
90
#include <argz.h> /* argz_add_sep(), argz_next(),
91
argz_delete(), argz_append(),
92
argz_stringify(), argz_add(),
93
argz_count() */
94
91
95
92
#ifdef __linux__
96
93
#include <sys/klog.h> /* klogctl() */
138
135
static const char sys_class_net[] = "/sys/class/net";
139
136
char *connect_to = NULL;
140
137
const char *hookdir = HOOKDIR;
141
uid_t uid = 65534;
142
gid_t gid = 65534;
143
138
144
139
/* Doubly linked list that need to be circularly linked when used */
145
140
typedef struct server{
146
141
const char *ip;
147
in_port_t port;
142
uint16_t port;
148
143
AvahiIfIndex if_index;
149
144
int af;
150
145
struct timespec last_seen;
154
149
155
150
/* Used for passing in values through the Avahi callback functions */
156
151
typedef struct {
152
AvahiSimplePoll *simple_poll;
157
153
AvahiServer *server;
158
154
gnutls_certificate_credentials_t cred;
159
155
unsigned int dh_bits;
161
157
const char *priority;
162
158
gpgme_ctx_t ctx;
163
159
server *current_server;
164
char *interfaces;
165
size_t interfaces_size;
166
160
} mandos_context;
167
161
168
/* global so signal handler can reach it*/
169
AvahiSimplePoll *simple_poll;
162
/* global context so signal handler can reach it*/
163
mandos_context mc = { .simple_poll = NULL, .server = NULL,
164
.dh_bits = 1024, .priority = "SECURE256"
165
":!CTYPE-X.509:+CTYPE-OPENPGP",
166
.current_server = NULL };
170
167
171
168
sig_atomic_t quit_now = 0;
172
169
int signal_received = 0;
187
184
188
185
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
189
186
program_invocation_short_name));
190
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
187
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
191
188
}
192
189
193
190
/*
208
205
}
209
206
210
207
/* Add server to set of servers to retry periodically */
211
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
212
int af, server **current_server){
208
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
209
int af){
213
210
int ret;
214
211
server *new_server = malloc(sizeof(server));
215
212
if(new_server == NULL){
225
222
return false;
226
223
}
227
224
/* Special case of first server */
228
if(*current_server == NULL){
225
if (mc.current_server == NULL){
229
226
new_server->next = new_server;
230
227
new_server->prev = new_server;
231
*current_server = new_server;
228
mc.current_server = new_server;
232
229
/* Place the new server last in the list */
233
230
} else {
234
new_server->next = *current_server;
235
new_server->prev = (*current_server)->prev;
231
new_server->next = mc.current_server;
232
new_server->prev = mc.current_server->prev;
236
233
new_server->prev->next = new_server;
237
(*current_server)->prev = new_server;
234
mc.current_server->prev = new_server;
238
235
}
239
ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
240
237
if(ret == -1){
241
238
perror_plus("clock_gettime");
242
239
return false;
248
245
* Initialize GPGME.
249
246
*/
250
247
static bool init_gpgme(const char *seckey, const char *pubkey,
251
const char *tempdir, mandos_context *mc){
248
const char *tempdir){
252
249
gpgme_error_t rc;
253
250
gpgme_engine_info_t engine_info;
254
251
252
255
253
/*
256
254
* Helper function to insert pub and seckey to the engine keyring.
257
255
*/
273
271
return false;
274
272
}
275
273
276
rc = gpgme_op_import(mc->ctx, pgp_data);
274
rc = gpgme_op_import(mc.ctx, pgp_data);
277
275
if(rc != GPG_ERR_NO_ERROR){
278
276
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
279
277
gpgme_strsource(rc), gpgme_strerror(rc));
323
321
}
324
322
325
323
/* Create new GPGME "context" */
326
rc = gpgme_new(&(mc->ctx));
324
rc = gpgme_new(&(mc.ctx));
327
325
if(rc != GPG_ERR_NO_ERROR){
328
326
fprintf_plus(stderr, "Mandos plugin mandos-client: "
329
327
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
344
342
*/
345
343
static ssize_t pgp_packet_decrypt(const char *cryptotext,
346
344
size_t crypto_size,
347
char **plaintext,
348
mandos_context *mc){
345
char **plaintext){
349
346
gpgme_data_t dh_crypto, dh_plain;
350
347
gpgme_error_t rc;
351
348
ssize_t ret;
377
374
378
375
/* Decrypt data from the cryptotext data buffer to the plaintext
379
376
data buffer */
380
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
377
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
381
378
if(rc != GPG_ERR_NO_ERROR){
382
379
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
383
380
gpgme_strsource(rc), gpgme_strerror(rc));
384
381
plaintext_length = -1;
385
382
if(debug){
386
383
gpgme_decrypt_result_t result;
387
result = gpgme_op_decrypt_result(mc->ctx);
384
result = gpgme_op_decrypt_result(mc.ctx);
388
385
if(result == NULL){
389
386
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
390
387
} else {
468
465
}
469
466
470
467
static const char * safer_gnutls_strerror(int value){
471
const char *ret = gnutls_strerror(value);
468
const char *ret = gnutls_strerror(value); /* Spurious warning from
469
-Wunreachable-code */
472
470
if(ret == NULL)
473
471
ret = "(unknown)";
474
472
return ret;
481
479
}
482
480
483
481
static int init_gnutls_global(const char *pubkeyfilename,
484
const char *seckeyfilename,
485
mandos_context *mc){
482
const char *seckeyfilename){
486
483
int ret;
487
484
488
485
if(debug){
505
502
}
506
503
507
504
/* OpenPGP credentials */
508
ret = gnutls_certificate_allocate_credentials(&mc->cred);
505
ret = gnutls_certificate_allocate_credentials(&mc.cred);
509
506
if(ret != GNUTLS_E_SUCCESS){
510
507
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
511
508
safer_gnutls_strerror(ret));
521
518
}
522
519
523
520
ret = gnutls_certificate_set_openpgp_key_file
524
(mc->cred, pubkeyfilename, seckeyfilename,
521
(mc.cred, pubkeyfilename, seckeyfilename,
525
522
GNUTLS_OPENPGP_FMT_BASE64);
526
523
if(ret != GNUTLS_E_SUCCESS){
527
524
fprintf_plus(stderr,
533
530
}
534
531
535
532
/* GnuTLS server initialization */
536
ret = gnutls_dh_params_init(&mc->dh_params);
533
ret = gnutls_dh_params_init(&mc.dh_params);
537
534
if(ret != GNUTLS_E_SUCCESS){
538
535
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
539
536
" initialization: %s\n",
540
537
safer_gnutls_strerror(ret));
541
538
goto globalfail;
542
539
}
543
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
544
541
if(ret != GNUTLS_E_SUCCESS){
545
542
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
546
543
safer_gnutls_strerror(ret));
547
544
goto globalfail;
548
545
}
549
546
550
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
547
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
551
548
552
549
return 0;
553
550
554
551
globalfail:
555
552
556
gnutls_certificate_free_credentials(mc->cred);
553
gnutls_certificate_free_credentials(mc.cred);
557
554
gnutls_global_deinit();
558
gnutls_dh_params_deinit(mc->dh_params);
555
gnutls_dh_params_deinit(mc.dh_params);
559
556
return -1;
560
557
}
561
558
562
static int init_gnutls_session(gnutls_session_t *session,
563
mandos_context *mc){
559
static int init_gnutls_session(gnutls_session_t *session){
564
560
int ret;
565
561
/* GnuTLS session creation */
566
562
do {
578
574
{
579
575
const char *err;
580
576
do {
581
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
577
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
582
578
if(quit_now){
583
579
gnutls_deinit(*session);
584
580
return -1;
595
591
596
592
do {
597
593
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
598
mc->cred);
594
mc.cred);
599
595
if(quit_now){
600
596
gnutls_deinit(*session);
601
597
return -1;
611
607
/* ignore client certificate if any. */
612
608
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
613
609
614
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
610
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
615
611
616
612
return 0;
617
613
}
621
617
__attribute__((unused)) const char *txt){}
622
618
623
619
/* Called when a Mandos server is found */
624
static int start_mandos_communication(const char *ip, in_port_t port,
620
static int start_mandos_communication(const char *ip, uint16_t port,
625
621
AvahiIfIndex if_index,
626
int af, mandos_context *mc){
622
int af){
627
623
int ret, tcp_sd = -1;
628
624
ssize_t sret;
629
625
union {
659
655
return -1;
660
656
}
661
657
662
/* If the interface is specified and we have a list of interfaces */
663
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
664
/* Check if the interface is one of the interfaces we are using */
665
bool match = false;
666
{
667
char *interface = NULL;
668
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
669
interface))){
670
if(if_nametoindex(interface) == (unsigned int)if_index){
671
match = true;
672
break;
673
}
674
}
675
}
676
if(not match){
677
/* This interface does not match any in the list, so we don't
678
connect to the server */
679
if(debug){
680
char interface[IF_NAMESIZE];
681
if(if_indextoname((unsigned int)if_index, interface) == NULL){
682
perror_plus("if_indextoname");
683
} else {
684
fprintf_plus(stderr, "Skipping server on non-used interface"
685
" \"%s\"\n",
686
if_indextoname((unsigned int)if_index,
687
interface));
688
}
689
}
690
return -1;
691
}
692
}
693
694
ret = init_gnutls_session(&session, mc);
658
ret = init_gnutls_session(&session);
695
659
if(ret != 0){
696
660
return -1;
697
661
}
698
662
699
663
if(debug){
700
664
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
701
PRIuMAX "\n", ip, (uintmax_t)port);
665
PRIu16 "\n", ip, port);
702
666
}
703
667
704
668
tcp_sd = socket(pf, SOCK_STREAM, 0);
735
699
goto mandos_end;
736
700
}
737
701
if(af == AF_INET6){
738
to.in6.sin6_port = htons(port);
702
to.in6.sin6_port = htons(port); /* Spurious warnings from
703
-Wconversion and
704
-Wunreachable-code */
705
739
706
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
740
707
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
741
708
-Wunreachable-code*/
765
732
if(if_indextoname((unsigned int)if_index, interface) == NULL){
766
733
perror_plus("if_indextoname");
767
734
} else {
768
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
769
"\n", ip, interface, (uintmax_t)port);
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
770
737
}
771
738
} else {
772
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
773
ip, (uintmax_t)port);
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
740
ip, port);
774
741
}
775
742
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
776
743
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
854
821
goto mandos_end;
855
822
}
856
823
857
/* This casting via intptr_t is to eliminate warning about casting
858
an int to a pointer type. This is exactly how the GnuTLS Guile
859
function "set-session-transport-fd!" does it. */
860
gnutls_transport_set_ptr(session,
861
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
824
/* Spurious warning from -Wint-to-pointer-cast */
825
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
862
826
863
827
if(quit_now){
864
828
errno = EINTR;
969
933
if(buffer_length > 0){
970
934
ssize_t decrypted_buffer_size;
971
935
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
972
&decrypted_buffer, mc);
936
&decrypted_buffer);
973
937
if(decrypted_buffer_size >= 0){
974
938
975
939
written = 0;
1036
1000
AVAHI_GCC_UNUSED AvahiStringList *txt,
1037
1001
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1038
1002
flags,
1039
void* mc){
1040
if(r == NULL){
1041
return;
1042
}
1003
AVAHI_GCC_UNUSED void* userdata){
1004
assert(r);
1043
1005
1044
1006
/* Called whenever a service has been resolved successfully or
1045
1007
timed out */
1054
1016
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1055
1017
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1056
1018
domain,
1057
avahi_strerror(avahi_server_errno
1058
(((mandos_context*)mc)->server)));
1019
avahi_strerror(avahi_server_errno(mc.server)));
1059
1020
break;
1060
1021
1061
1022
case AVAHI_RESOLVER_FOUND:
1067
1028
PRIdMAX ") on port %" PRIu16 "\n", name,
1068
1029
host_name, ip, (intmax_t)interface, port);
1069
1030
}
1070
int ret = start_mandos_communication(ip, (in_port_t)port,
1071
interface,
1072
avahi_proto_to_af(proto),
1073
mc);
1031
int ret = start_mandos_communication(ip, port, interface,
1032
avahi_proto_to_af(proto));
1074
1033
if(ret == 0){
1075
avahi_simple_poll_quit(simple_poll);
1034
avahi_simple_poll_quit(mc.simple_poll);
1076
1035
} else {
1077
if(not add_server(ip, (in_port_t)port, interface,
1078
avahi_proto_to_af(proto),
1079
&((mandos_context*)mc)->current_server)){
1036
if(not add_server(ip, port, interface,
1037
avahi_proto_to_af(proto))){
1080
1038
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1081
1039
" list\n", name);
1082
1040
}
1095
1053
const char *domain,
1096
1054
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1097
1055
flags,
1098
void* mc){
1099
if(b == NULL){
1100
return;
1101
}
1056
AVAHI_GCC_UNUSED void* userdata){
1057
assert(b);
1102
1058
1103
1059
/* Called whenever a new services becomes available on the LAN or
1104
1060
is removed from the LAN */
1112
1068
case AVAHI_BROWSER_FAILURE:
1113
1069
1114
1070
fprintf_plus(stderr, "(Avahi browser) %s\n",
1115
avahi_strerror(avahi_server_errno
1116
(((mandos_context*)mc)->server)));
1117
avahi_simple_poll_quit(simple_poll);
1071
avahi_strerror(avahi_server_errno(mc.server)));
1072
avahi_simple_poll_quit(mc.simple_poll);
1118
1073
return;
1119
1074
1120
1075
case AVAHI_BROWSER_NEW:
1123
1078
the callback function is called the Avahi server will free the
1124
1079
resolver for us. */
1125
1080
1126
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1127
interface, protocol, name, type,
1128
domain, protocol, 0,
1129
resolve_callback, mc) == NULL)
1081
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1082
name, type, domain, protocol, 0,
1083
resolve_callback, NULL) == NULL)
1130
1084
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1131
1085
" %s\n", name,
1132
avahi_strerror(avahi_server_errno
1133
(((mandos_context*)mc)->server)));
1086
avahi_strerror(avahi_server_errno(mc.server)));
1134
1087
break;
1135
1088
1136
1089
case AVAHI_BROWSER_REMOVE:
1155
1108
signal_received = sig;
1156
1109
int old_errno = errno;
1157
1110
/* set main loop to exit */
1158
if(simple_poll != NULL){
1159
avahi_simple_poll_quit(simple_poll);
1111
if(mc.simple_poll != NULL){
1112
avahi_simple_poll_quit(mc.simple_poll);
1160
1113
}
1161
1114
errno = old_errno;
1162
1115
}
1163
1116
1164
1117
bool get_flags(const char *ifname, struct ifreq *ifr){
1165
1118
int ret;
1166
error_t ret_errno;
1167
1119
1168
1120
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1169
1121
if(s < 0){
1170
ret_errno = errno;
1171
1122
perror_plus("socket");
1172
errno = ret_errno;
1173
1123
return false;
1174
1124
}
1175
1125
strcpy(ifr->ifr_name, ifname);
1176
1126
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1177
1127
if(ret == -1){
1178
1128
if(debug){
1179
ret_errno = errno;
1180
1129
perror_plus("ioctl SIOCGIFFLAGS");
1181
errno = ret_errno;
1182
1130
}
1183
1131
return false;
1184
1132
}
1253
1201
}
1254
1202
1255
1203
/*
1256
* This function determines if a network interface is up.
1257
*/
1258
bool interface_is_up(const char *interface){
1259
struct ifreq ifr;
1260
if(not get_flags(interface, &ifr)){
1261
if(debug){
1262
fprintf_plus(stderr, "Failed to get flags for interface "
1263
"\"%s\"\n", interface);
1264
}
1265
return false;
1266
}
1267
1268
return (bool)(ifr.ifr_flags & IFF_UP);
1269
}
1270
1271
/*
1272
* This function determines if a network interface is running
1273
*/
1274
bool interface_is_running(const char *interface){
1275
struct ifreq ifr;
1276
if(not get_flags(interface, &ifr)){
1277
if(debug){
1278
fprintf_plus(stderr, "Failed to get flags for interface "
1279
"\"%s\"\n", interface);
1280
}
1281
return false;
1282
}
1283
1284
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1204
* This function determines if a directory entry in /sys/class/net
1205
* corresponds to an acceptable network device which is up.
1206
* (This function is passed to scandir(3) as a filter function.)
1207
*/
1208
int up_interface(const struct dirent *if_entry){
1209
if(if_entry->d_name[0] == '.'){
1210
return 0;
1211
}
1212
1213
struct ifreq ifr;
1214
if(not get_flags(if_entry->d_name, &ifr)){
1215
if(debug){
1216
fprintf_plus(stderr, "Failed to get flags for interface "
1217
"\"%s\"\n", if_entry->d_name);
1218
}
1219
return 0;
1220
}
1221
1222
/* Reject down interfaces */
1223
if(not (ifr.ifr_flags & IFF_UP)){
1224
if(debug){
1225
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1226
if_entry->d_name);
1227
}
1228
return 0;
1229
}
1230
1231
/* Reject non-running interfaces */
1232
if(not (ifr.ifr_flags & IFF_RUNNING)){
1233
if(debug){
1234
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1235
if_entry->d_name);
1236
}
1237
return 0;
1238
}
1239
1240
if(not good_flags(if_entry->d_name, &ifr)){
1241
return 0;
1242
}
1243
return 1;
1285
1244
}
1286
1245
1287
1246
int notdotentries(const struct dirent *direntry){
1356
1315
return 1;
1357
1316
}
1358
1317
1359
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1360
mandos_context *mc){
1318
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1361
1319
int ret;
1362
1320
struct timespec now;
1363
1321
struct timespec waited_time;
1364
1322
intmax_t block_time;
1365
1323
1366
1324
while(true){
1367
if(mc->current_server == NULL){
1325
if(mc.current_server == NULL){
1368
1326
if (debug){
1369
1327
fprintf_plus(stderr, "Wait until first server is found."
1370
1328
" No timeout!\n");
1384
1342
/* Calculating in ms how long time between now and server
1385
1343
who we visted longest time ago. Now - last seen. */
1386
1344
waited_time.tv_sec = (now.tv_sec
1387
- mc->current_server->last_seen.tv_sec);
1345
- mc.current_server->last_seen.tv_sec);
1388
1346
waited_time.tv_nsec = (now.tv_nsec
1389
- mc->current_server->last_seen.tv_nsec);
1347
- mc.current_server->last_seen.tv_nsec);
1390
1348
/* total time is 10s/10,000ms.
1391
1349
Converting to s from ms by dividing by 1,000,
1392
1350
and ns to ms by dividing by 1,000,000. */
1400
1358
}
1401
1359
1402
1360
if(block_time <= 0){
1403
ret = start_mandos_communication(mc->current_server->ip,
1404
mc->current_server->port,
1405
mc->current_server->if_index,
1406
mc->current_server->af, mc);
1361
ret = start_mandos_communication(mc.current_server->ip,
1362
mc.current_server->port,
1363
mc.current_server->if_index,
1364
mc.current_server->af);
1407
1365
if(ret == 0){
1408
avahi_simple_poll_quit(s);
1366
avahi_simple_poll_quit(mc.simple_poll);
1409
1367
return 0;
1410
1368
}
1411
1369
ret = clock_gettime(CLOCK_MONOTONIC,
1412
&mc->current_server->last_seen);
1370
&mc.current_server->last_seen);
1413
1371
if(ret == -1){
1414
1372
perror_plus("clock_gettime");
1415
1373
return -1;
1416
1374
}
1417
mc->current_server = mc->current_server->next;
1375
mc.current_server = mc.current_server->next;
1418
1376
block_time = 0; /* Call avahi to find new Mandos
1419
1377
servers, but don't block */
1420
1378
}
1429
1387
}
1430
1388
}
1431
1389
1432
/* Set effective uid to 0, return errno */
1433
error_t raise_privileges(void){
1434
error_t old_errno = errno;
1435
error_t ret_errno = 0;
1436
if(seteuid(0) == -1){
1437
ret_errno = errno;
1438
perror_plus("seteuid");
1439
}
1440
errno = old_errno;
1441
return ret_errno;
1442
}
1443
1444
/* Set effective and real user ID to 0. Return errno. */
1445
error_t raise_privileges_permanently(void){
1446
error_t old_errno = errno;
1447
error_t ret_errno = raise_privileges();
1448
if(ret_errno != 0){
1449
errno = old_errno;
1450
return ret_errno;
1451
}
1452
if(setuid(0) == -1){
1453
ret_errno = errno;
1454
perror_plus("seteuid");
1455
}
1456
errno = old_errno;
1457
return ret_errno;
1458
}
1459
1460
/* Set effective user ID to unprivileged saved user ID */
1461
error_t lower_privileges(void){
1462
error_t old_errno = errno;
1463
error_t ret_errno = 0;
1464
if(seteuid(uid) == -1){
1465
ret_errno = errno;
1466
perror_plus("seteuid");
1467
}
1468
errno = old_errno;
1469
return ret_errno;
1470
}
1471
1472
/* Lower privileges permanently */
1473
error_t lower_privileges_permanently(void){
1474
error_t old_errno = errno;
1475
error_t ret_errno = 0;
1476
if(setuid(uid) == -1){
1477
ret_errno = errno;
1478
perror_plus("setuid");
1479
}
1480
errno = old_errno;
1481
return ret_errno;
1482
}
1483
1484
1390
bool run_network_hooks(const char *mode, const char *interface,
1485
1391
const float delay){
1486
1392
struct dirent **direntries;
1489
1395
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1490
1396
alphasort);
1491
1397
if(numhooks == -1){
1492
if(errno == ENOENT){
1493
if(debug){
1494
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1495
" found\n", hookdir);
1496
}
1497
} else {
1498
perror_plus("scandir");
1499
}
1398
perror_plus("scandir");
1500
1399
} else {
1501
1400
int devnull = open("/dev/null", O_RDONLY);
1502
1401
for(int i = 0; i < numhooks; i++){
1515
1414
if(hook_pid == 0){
1516
1415
/* Child */
1517
1416
/* Raise privileges */
1518
raise_privileges_permanently();
1417
errno = 0;
1418
ret = seteuid(0);
1419
if(ret == -1){
1420
perror_plus("seteuid");
1421
}
1422
/* Raise privileges even more */
1423
errno = 0;
1424
ret = setuid(0);
1425
if(ret == -1){
1426
perror_plus("setuid");
1427
}
1519
1428
/* Set group */
1520
1429
errno = 0;
1521
1430
ret = setgid(0);
1614
1523
return true;
1615
1524
}
1616
1525
1617
error_t bring_up_interface(const char *const interface,
1618
const float delay){
1619
int sd = -1;
1620
error_t old_errno = errno;
1621
error_t ret_errno = 0;
1622
int ret, ret_setflags;
1623
struct ifreq network;
1624
unsigned int if_index = if_nametoindex(interface);
1625
if(if_index == 0){
1626
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1627
errno = old_errno;
1628
return ENXIO;
1629
}
1630
1631
if(quit_now){
1632
errno = old_errno;
1633
return EINTR;
1634
}
1635
1636
if(not interface_is_up(interface)){
1637
if(not get_flags(interface, &network) and debug){
1638
ret_errno = errno;
1639
fprintf_plus(stderr, "Failed to get flags for interface "
1640
"\"%s\"\n", interface);
1641
return ret_errno;
1642
}
1643
network.ifr_flags |= IFF_UP;
1644
1645
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1646
if(sd < 0){
1647
ret_errno = errno;
1648
perror_plus("socket");
1649
errno = old_errno;
1650
return ret_errno;
1651
}
1652
1653
if(quit_now){
1654
close(sd);
1655
errno = old_errno;
1656
return EINTR;
1657
}
1658
1659
if(debug){
1660
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
1661
interface);
1662
}
1663
1664
/* Raise priviliges */
1665
raise_privileges();
1666
1667
#ifdef __linux__
1668
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1669
messages about the network interface to mess up the prompt */
1670
int ret_linux = klogctl(8, NULL, 5);
1671
bool restore_loglevel = true;
1672
if(ret_linux == -1){
1673
restore_loglevel = false;
1674
perror_plus("klogctl");
1675
}
1676
#endif /* __linux__ */
1677
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1678
ret_errno = errno;
1679
#ifdef __linux__
1680
if(restore_loglevel){
1681
ret_linux = klogctl(7, NULL, 0);
1682
if(ret_linux == -1){
1683
perror_plus("klogctl");
1684
}
1685
}
1686
#endif /* __linux__ */
1687
1688
/* Lower privileges */
1689
lower_privileges();
1690
1691
/* Close the socket */
1692
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1693
if(ret == -1){
1694
perror_plus("close");
1695
}
1696
1697
if(ret_setflags == -1){
1698
errno = ret_errno;
1699
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1700
errno = old_errno;
1701
return ret_errno;
1702
}
1703
} else if(debug){
1704
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1705
interface);
1706
}
1707
1708
/* Sleep checking until interface is running.
1709
Check every 0.25s, up to total time of delay */
1710
for(int i=0; i < delay * 4; i++){
1711
if(interface_is_running(interface)){
1712
break;
1713
}
1714
struct timespec sleeptime = { .tv_nsec = 250000000 };
1715
ret = nanosleep(&sleeptime, NULL);
1716
if(ret == -1 and errno != EINTR){
1717
perror_plus("nanosleep");
1718
}
1719
}
1720
1721
errno = old_errno;
1722
return 0;
1723
}
1724
1725
error_t take_down_interface(const char *const interface){
1726
int sd = -1;
1727
error_t old_errno = errno;
1728
error_t ret_errno = 0;
1729
int ret, ret_setflags;
1730
struct ifreq network;
1731
unsigned int if_index = if_nametoindex(interface);
1732
if(if_index == 0){
1733
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1734
errno = old_errno;
1735
return ENXIO;
1736
}
1737
if(interface_is_up(interface)){
1738
if(not get_flags(interface, &network) and debug){
1739
ret_errno = errno;
1740
fprintf_plus(stderr, "Failed to get flags for interface "
1741
"\"%s\"\n", interface);
1742
return ret_errno;
1743
}
1744
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1745
1746
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1747
if(sd < 0){
1748
ret_errno = errno;
1749
perror_plus("socket");
1750
errno = old_errno;
1751
return ret_errno;
1752
}
1753
1754
if(debug){
1755
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
1756
interface);
1757
}
1758
1759
/* Raise priviliges */
1760
raise_privileges();
1761
1762
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1763
ret_errno = errno;
1764
1765
/* Lower privileges */
1766
lower_privileges();
1767
1768
/* Close the socket */
1769
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1770
if(ret == -1){
1771
perror_plus("close");
1772
}
1773
1774
if(ret_setflags == -1){
1775
errno = ret_errno;
1776
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1777
errno = old_errno;
1778
return ret_errno;
1779
}
1780
} else if(debug){
1781
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1782
interface);
1783
}
1784
1785
errno = old_errno;
1786
return 0;
1787
}
1788
1789
1526
int main(int argc, char *argv[]){
1790
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1791
.priority = "SECURE256:!CTYPE-X.509:"
1792
"+CTYPE-OPENPGP", .current_server = NULL,
1793
.interfaces = NULL, .interfaces_size = 0 };
1794
1527
AvahiSServiceBrowser *sb = NULL;
1795
error_t ret_errno;
1528
int error;
1796
1529
int ret;
1797
1530
intmax_t tmpmax;
1798
1531
char *tmp;
1799
1532
int exitcode = EXIT_SUCCESS;
1800
char *interfaces_to_take_down = NULL;
1801
size_t interfaces_to_take_down_size = 0;
1533
const char *interface = "";
1534
struct ifreq network;
1535
int sd = -1;
1536
bool take_down_interface = false;
1537
uid_t uid;
1538
gid_t gid;
1802
1539
char tempdir[] = "/tmp/mandosXXXXXX";
1803
1540
bool tempdir_created = false;
1804
1541
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1805
1542
const char *seckey = PATHDIR "/" SECKEY;
1806
1543
const char *pubkey = PATHDIR "/" PUBKEY;
1807
char *interfaces_hooks = NULL;
1808
size_t interfaces_hooks_size = 0;
1809
1544
1810
1545
bool gnutls_initialized = false;
1811
1546
bool gpgme_initialized = false;
1902
1637
connect_to = arg;
1903
1638
break;
1904
1639
case 'i': /* --interface */
1905
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
1906
arg, (int)',');
1907
if(ret_errno != 0){
1908
argp_error(state, "%s", strerror(ret_errno));
1909
}
1640
interface = arg;
1910
1641
break;
1911
1642
case 's': /* --seckey */
1912
1643
seckey = arg;
1990
1721
<http://bugs.debian.org/633582> */
1991
1722
1992
1723
/* Re-raise priviliges */
1993
if(raise_privileges() == 0){
1724
errno = 0;
1725
ret = seteuid(0);
1726
if(ret == -1){
1727
perror_plus("seteuid");
1728
} else {
1994
1729
struct stat st;
1995
1730
1996
1731
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2036
1771
}
2037
1772
2038
1773
/* Lower privileges */
2039
lower_privileges();
2040
}
2041
}
2042
2043
/* Remove invalid interface names (except "none") */
2044
{
2045
char *interface = NULL;
2046
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2047
interface))){
2048
if(strcmp(interface, "none") != 0
2049
and if_nametoindex(interface) == 0){
2050
if(interface[0] != '\0'){
2051
fprintf_plus(stderr, "Not using nonexisting interface"
2052
" \"%s\"\n", interface);
2053
}
2054
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2055
interface = NULL;
1774
errno = 0;
1775
ret = seteuid(uid);
1776
if(ret == -1){
1777
perror_plus("seteuid");
2056
1778
}
2057
1779
}
2058
1780
}
2059
1781
2060
1782
/* Run network hooks */
2061
{
2062
if(mc.interfaces != NULL){
2063
interfaces_hooks = malloc(mc.interfaces_size);
2064
if(interfaces_hooks == NULL){
2065
perror_plus("malloc");
2066
goto end;
2067
}
2068
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2069
interfaces_hooks_size = mc.interfaces_size;
2070
argz_stringify(interfaces_hooks, interfaces_hooks_size,
2071
(int)',');
2072
}
2073
if(not run_network_hooks("start", interfaces_hooks != NULL ?
2074
interfaces_hooks : "", delay)){
2075
goto end;
2076
}
1783
if(not run_network_hooks("start", interface, delay)){
1784
goto end;
2077
1785
}
2078
1786
2079
1787
if(not debug){
2080
1788
avahi_set_log_function(empty_log);
2081
1789
}
2082
1790
1791
if(interface[0] == '\0'){
1792
struct dirent **direntries;
1793
/* First look for interfaces that are up */
1794
ret = scandir(sys_class_net, &direntries, up_interface,
1795
alphasort);
1796
if(ret == 0){
1797
/* No up interfaces, look for any good interfaces */
1798
free(direntries);
1799
ret = scandir(sys_class_net, &direntries, good_interface,
1800
alphasort);
1801
}
1802
if(ret >= 1){
1803
/* Pick the first interface returned */
1804
interface = strdup(direntries[0]->d_name);
1805
if(debug){
1806
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1807
}
1808
if(interface == NULL){
1809
perror_plus("malloc");
1810
free(direntries);
1811
exitcode = EXIT_FAILURE;
1812
goto end;
1813
}
1814
free(direntries);
1815
} else {
1816
free(direntries);
1817
fprintf_plus(stderr, "Could not find a network interface\n");
1818
exitcode = EXIT_FAILURE;
1819
goto end;
1820
}
1821
}
1822
2083
1823
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
2084
1824
from the signal handler */
2085
1825
/* Initialize the pseudo-RNG for Avahi */
2086
1826
srand((unsigned int) time(NULL));
2087
simple_poll = avahi_simple_poll_new();
2088
if(simple_poll == NULL){
1827
mc.simple_poll = avahi_simple_poll_new();
1828
if(mc.simple_poll == NULL){
2089
1829
fprintf_plus(stderr,
2090
1830
"Avahi: Failed to create simple poll object.\n");
2091
1831
exitcode = EX_UNAVAILABLE;
2155
1895
}
2156
1896
}
2157
1897
2158
/* If no interfaces were specified, make a list */
2159
if(mc.interfaces == NULL){
2160
struct dirent **direntries;
2161
/* Look for any good interfaces */
2162
ret = scandir(sys_class_net, &direntries, good_interface,
2163
alphasort);
2164
if(ret >= 1){
2165
/* Add all found interfaces to interfaces list */
2166
for(int i = 0; i < ret; ++i){
2167
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2168
direntries[i]->d_name);
2169
if(ret_errno != 0){
2170
perror_plus("argz_add");
2171
continue;
2172
}
2173
if(debug){
2174
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2175
direntries[i]->d_name);
2176
}
2177
}
2178
free(direntries);
2179
} else {
2180
free(direntries);
2181
fprintf_plus(stderr, "Could not find a network interface\n");
2182
exitcode = EXIT_FAILURE;
2183
goto end;
2184
}
2185
}
2186
2187
/* Bring up interfaces which are down, and remove any "none"s */
2188
{
2189
char *interface = NULL;
2190
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2191
interface))){
2192
/* If interface name is "none", stop bringing up interfaces.
2193
Also remove all instances of "none" from the list */
2194
if(strcmp(interface, "none") == 0){
2195
argz_delete(&mc.interfaces, &mc.interfaces_size,
2196
interface);
2197
interface = NULL;
2198
while((interface = argz_next(mc.interfaces,
2199
mc.interfaces_size, interface))){
2200
if(strcmp(interface, "none") == 0){
2201
argz_delete(&mc.interfaces, &mc.interfaces_size,
2202
interface);
2203
interface = NULL;
1898
/* If the interface is down, bring it up */
1899
if(strcmp(interface, "none") != 0){
1900
if_index = (AvahiIfIndex) if_nametoindex(interface);
1901
if(if_index == 0){
1902
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1903
exitcode = EX_UNAVAILABLE;
1904
goto end;
1905
}
1906
1907
if(quit_now){
1908
goto end;
1909
}
1910
1911
/* Re-raise priviliges */
1912
errno = 0;
1913
ret = seteuid(0);
1914
if(ret == -1){
1915
perror_plus("seteuid");
1916
}
1917
1918
#ifdef __linux__
1919
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1920
messages about the network interface to mess up the prompt */
1921
ret = klogctl(8, NULL, 5);
1922
bool restore_loglevel = true;
1923
if(ret == -1){
1924
restore_loglevel = false;
1925
perror_plus("klogctl");
1926
}
1927
#endif /* __linux__ */
1928
1929
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1930
if(sd < 0){
1931
perror_plus("socket");
1932
exitcode = EX_OSERR;
1933
#ifdef __linux__
1934
if(restore_loglevel){
1935
ret = klogctl(7, NULL, 0);
1936
if(ret == -1){
1937
perror_plus("klogctl");
1938
}
1939
}
1940
#endif /* __linux__ */
1941
/* Lower privileges */
1942
errno = 0;
1943
ret = seteuid(uid);
1944
if(ret == -1){
1945
perror_plus("seteuid");
1946
}
1947
goto end;
1948
}
1949
strcpy(network.ifr_name, interface);
1950
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1951
if(ret == -1){
1952
perror_plus("ioctl SIOCGIFFLAGS");
1953
#ifdef __linux__
1954
if(restore_loglevel){
1955
ret = klogctl(7, NULL, 0);
1956
if(ret == -1){
1957
perror_plus("klogctl");
1958
}
1959
}
1960
#endif /* __linux__ */
1961
exitcode = EX_OSERR;
1962
/* Lower privileges */
1963
errno = 0;
1964
ret = seteuid(uid);
1965
if(ret == -1){
1966
perror_plus("seteuid");
1967
}
1968
goto end;
1969
}
1970
if((network.ifr_flags & IFF_UP) == 0){
1971
network.ifr_flags |= IFF_UP;
1972
take_down_interface = true;
1973
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1974
if(ret == -1){
1975
take_down_interface = false;
1976
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1977
exitcode = EX_OSERR;
1978
#ifdef __linux__
1979
if(restore_loglevel){
1980
ret = klogctl(7, NULL, 0);
1981
if(ret == -1){
1982
perror_plus("klogctl");
2204
1983
}
2205
1984
}
1985
#endif /* __linux__ */
1986
/* Lower privileges */
1987
errno = 0;
1988
ret = seteuid(uid);
1989
if(ret == -1){
1990
perror_plus("seteuid");
1991
}
1992
goto end;
1993
}
1994
}
1995
/* Sleep checking until interface is running.
1996
Check every 0.25s, up to total time of delay */
1997
for(int i=0; i < delay * 4; i++){
1998
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1999
if(ret == -1){
2000
perror_plus("ioctl SIOCGIFFLAGS");
2001
} else if(network.ifr_flags & IFF_RUNNING){
2206
2002
break;
2207
2003
}
2208
bool interface_was_up = interface_is_up(interface);
2209
ret = bring_up_interface(interface, delay);
2210
if(not interface_was_up){
2211
if(ret != 0){
2212
errno = ret;
2213
perror_plus("Failed to bring up interface");
2214
} else {
2215
ret_errno = argz_add(&interfaces_to_take_down,
2216
&interfaces_to_take_down_size,
2217
interface);
2218
}
2219
}
2220
}
2221
if(debug and (interfaces_to_take_down == NULL)){
2222
fprintf_plus(stderr, "No interfaces were brought up\n");
2223
}
2224
}
2225
2226
/* If we only got one interface, explicitly use only that one */
2227
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2228
if(debug){
2229
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2230
mc.interfaces);
2231
}
2232
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2004
struct timespec sleeptime = { .tv_nsec = 250000000 };
2005
ret = nanosleep(&sleeptime, NULL);
2006
if(ret == -1 and errno != EINTR){
2007
perror_plus("nanosleep");
2008
}
2009
}
2010
if(not take_down_interface){
2011
/* We won't need the socket anymore */
2012
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2013
if(ret == -1){
2014
perror_plus("close");
2015
}
2016
}
2017
#ifdef __linux__
2018
if(restore_loglevel){
2019
/* Restores kernel loglevel to default */
2020
ret = klogctl(7, NULL, 0);
2021
if(ret == -1){
2022
perror_plus("klogctl");
2023
}
2024
}
2025
#endif /* __linux__ */
2026
/* Lower privileges */
2027
errno = 0;
2028
/* Lower privileges */
2029
ret = seteuid(uid);
2030
if(ret == -1){
2031
perror_plus("seteuid");
2032
}
2233
2033
}
2234
2034
2235
2035
if(quit_now){
2236
2036
goto end;
2237
2037
}
2238
2038
2239
ret = init_gnutls_global(pubkey, seckey, &mc);
2039
ret = init_gnutls_global(pubkey, seckey);
2240
2040
if(ret == -1){
2241
2041
fprintf_plus(stderr, "init_gnutls_global failed\n");
2242
2042
exitcode = EX_UNAVAILABLE;
2259
2059
goto end;
2260
2060
}
2261
2061
2262
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2062
if(not init_gpgme(pubkey, seckey, tempdir)){
2263
2063
fprintf_plus(stderr, "init_gpgme failed\n");
2264
2064
exitcode = EX_UNAVAILABLE;
2265
2065
goto end;
2275
2075
/* Connect directly, do not use Zeroconf */
2276
2076
/* (Mainly meant for debugging) */
2277
2077
char *address = strrchr(connect_to, ':');
2278
2279
2078
if(address == NULL){
2280
2079
fprintf_plus(stderr, "No colon in address\n");
2281
2080
exitcode = EX_USAGE;
2286
2085
goto end;
2287
2086
}
2288
2087
2289
in_port_t port;
2088
uint16_t port;
2290
2089
errno = 0;
2291
2090
tmpmax = strtoimax(address+1, &tmp, 10);
2292
2091
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2293
or tmpmax != (in_port_t)tmpmax){
2092
or tmpmax != (uint16_t)tmpmax){
2294
2093
fprintf_plus(stderr, "Bad port number\n");
2295
2094
exitcode = EX_USAGE;
2296
2095
goto end;
2297
2096
}
2298
2097
2299
2098
if(quit_now){
2300
2099
goto end;
2301
2100
}
2302
2101
2303
port = (in_port_t)tmpmax;
2102
port = (uint16_t)tmpmax;
2304
2103
*address = '\0';
2305
2104
/* Colon in address indicates IPv6 */
2306
2105
int af;
2322
2121
}
2323
2122
2324
2123
while(not quit_now){
2325
ret = start_mandos_communication(address, port, if_index, af,
2326
&mc);
2124
ret = start_mandos_communication(address, port, if_index, af);
2327
2125
if(quit_now or ret == 0){
2328
2126
break;
2329
2127
}
2331
2129
fprintf_plus(stderr, "Retrying in %d seconds\n",
2332
2130
(int)retry_interval);
2333
2131
}
2334
sleep((unsigned int)retry_interval);
2132
sleep((int)retry_interval);
2335
2133
}
2336
2134
2337
2135
if (not quit_now){
2355
2153
config.publish_domain = 0;
2356
2154
2357
2155
/* Allocate a new server */
2358
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2359
&config, NULL, NULL, &ret_errno);
2156
mc.server = avahi_server_new(avahi_simple_poll_get
2157
(mc.simple_poll), &config, NULL,
2158
NULL, &error);
2360
2159
2361
2160
/* Free the Avahi configuration data */
2362
2161
avahi_server_config_free(&config);
2365
2164
/* Check if creating the Avahi server object succeeded */
2366
2165
if(mc.server == NULL){
2367
2166
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2368
avahi_strerror(ret_errno));
2167
avahi_strerror(error));
2369
2168
exitcode = EX_UNAVAILABLE;
2370
2169
goto end;
2371
2170
}
2377
2176
/* Create the Avahi service browser */
2378
2177
sb = avahi_s_service_browser_new(mc.server, if_index,
2379
2178
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2380
NULL, 0, browse_callback,
2381
(void *)&mc);
2179
NULL, 0, browse_callback, NULL);
2382
2180
if(sb == NULL){
2383
2181
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2384
2182
avahi_strerror(avahi_server_errno(mc.server)));
2396
2194
fprintf_plus(stderr, "Starting Avahi loop search\n");
2397
2195
}
2398
2196
2399
ret = avahi_loop_with_timeout(simple_poll,
2400
(int)(retry_interval * 1000), &mc);
2197
ret = avahi_loop_with_timeout(mc.simple_poll,
2198
(int)(retry_interval * 1000));
2401
2199
if(debug){
2402
2200
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2403
2201
(ret == 0) ? "successfully" : "with error");
2410
2208
}
2411
2209
2412
2210
/* Cleanup things */
2413
free(mc.interfaces);
2414
2415
2211
if(sb != NULL)
2416
2212
avahi_s_service_browser_free(sb);
2417
2213
2418
2214
if(mc.server != NULL)
2419
2215
avahi_server_free(mc.server);
2420
2216
2421
if(simple_poll != NULL)
2422
avahi_simple_poll_free(simple_poll);
2217
if(mc.simple_poll != NULL)
2218
avahi_simple_poll_free(mc.simple_poll);
2423
2219
2424
2220
if(gnutls_initialized){
2425
2221
gnutls_certificate_free_credentials(mc.cred);
2442
2238
}
2443
2239
}
2444
2240
2241
/* Run network hooks */
2242
run_network_hooks("stop", interface, delay);
2243
2445
2244
/* Re-raise priviliges */
2446
2245
{
2447
raise_privileges();
2448
2449
/* Run network hooks */
2450
run_network_hooks("stop", interfaces_hooks != NULL ?
2451
interfaces_hooks : "", delay);
2452
2453
/* Take down the network interfaces which were brought up */
2454
{
2455
char *interface = NULL;
2456
while((interface=argz_next(interfaces_to_take_down,
2457
interfaces_to_take_down_size,
2458
interface))){
2459
ret_errno = take_down_interface(interface);
2460
if(ret_errno != 0){
2461
errno = ret_errno;
2462
perror_plus("Failed to take down interface");
2246
errno = 0;
2247
ret = seteuid(0);
2248
if(ret == -1){
2249
perror_plus("seteuid");
2250
}
2251
2252
/* Take down the network interface */
2253
if(take_down_interface and geteuid() == 0){
2254
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2255
if(ret == -1){
2256
perror_plus("ioctl SIOCGIFFLAGS");
2257
} else if(network.ifr_flags & IFF_UP){
2258
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2259
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2260
if(ret == -1){
2261
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2463
2262
}
2464
2263
}
2465
if(debug and (interfaces_to_take_down == NULL)){
2466
fprintf_plus(stderr, "No interfaces needed to be taken"
2467
" down\n");
2264
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2265
if(ret == -1){
2266
perror_plus("close");
2468
2267
}
2469
2268
}
2470
2471
lower_privileges_permanently();
2472
}
2473
2474
free(interfaces_to_take_down);
2475
free(interfaces_hooks);
2269
}
2270
/* Lower privileges permanently */
2271
errno = 0;
2272
ret = setuid(uid);
2273
if(ret == -1){
2274
perror_plus("setuid");
2275
}
2476
2276
2477
2277
/* Removes the GPGME temp directory and all files inside */
2478
2278
if(tempdir_created){
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0