To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 541
- compare with another revision
- download diff
- download tarball
- view history from revision 541
- Committer: Teddy Hogeborn
- Date: 2011-12-31 20:07:11 UTC
- mfrom: (535.1.9 wireless-network-hook)
- Revision ID: teddy@recompile.se-20111231200711-6dli3r8drftem57r
Merge new wireless network hook. Fix bridge network hook to use
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
- files removed:
- debian/mandos-client.examples
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2013 Teddy Hogeborn
13
* Copyright © 2008-2013 Björn Påhlsson
12
* Copyright © 2008-2011 Teddy Hogeborn
13
* Copyright © 2008-2011 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
41
41
42
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
47
strtof(), abort() */
61
61
*/
62
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
63
strtoimax() */
64
#include <assert.h> /* assert() */
64
65
#include <errno.h> /* perror(), errno,
65
66
program_invocation_short_name */
66
67
#include <time.h> /* nanosleep(), time(), sleep() */
87
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
88
89
WEXITSTATUS(), WTERMSIG() */
89
90
#include <grp.h> /* setgroups() */
90
#include <argz.h> /* argz_add_sep(), argz_next(),
91
argz_delete(), argz_append(),
92
argz_stringify(), argz_add(),
93
argz_count() */
94
91
95
92
#ifdef __linux__
96
93
#include <sys/klog.h> /* klogctl() */
138
135
static const char sys_class_net[] = "/sys/class/net";
139
136
char *connect_to = NULL;
140
137
const char *hookdir = HOOKDIR;
141
uid_t uid = 65534;
142
gid_t gid = 65534;
143
138
144
139
/* Doubly linked list that need to be circularly linked when used */
145
140
typedef struct server{
146
141
const char *ip;
147
in_port_t port;
142
uint16_t port;
148
143
AvahiIfIndex if_index;
149
144
int af;
150
145
struct timespec last_seen;
154
149
155
150
/* Used for passing in values through the Avahi callback functions */
156
151
typedef struct {
152
AvahiSimplePoll *simple_poll;
157
153
AvahiServer *server;
158
154
gnutls_certificate_credentials_t cred;
159
155
unsigned int dh_bits;
161
157
const char *priority;
162
158
gpgme_ctx_t ctx;
163
159
server *current_server;
164
char *interfaces;
165
size_t interfaces_size;
166
160
} mandos_context;
167
161
168
/* global so signal handler can reach it*/
169
AvahiSimplePoll *simple_poll;
162
/* global context so signal handler can reach it*/
163
mandos_context mc = { .simple_poll = NULL, .server = NULL,
164
.dh_bits = 1024, .priority = "SECURE256"
165
":!CTYPE-X.509:+CTYPE-OPENPGP",
166
.current_server = NULL };
170
167
171
168
sig_atomic_t quit_now = 0;
172
169
int signal_received = 0;
187
184
188
185
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
189
186
program_invocation_short_name));
190
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
187
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
191
188
}
192
189
193
190
/*
208
205
}
209
206
210
207
/* Add server to set of servers to retry periodically */
211
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
212
int af, server **current_server){
208
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
209
int af){
213
210
int ret;
214
211
server *new_server = malloc(sizeof(server));
215
212
if(new_server == NULL){
225
222
return false;
226
223
}
227
224
/* Special case of first server */
228
if(*current_server == NULL){
225
if (mc.current_server == NULL){
229
226
new_server->next = new_server;
230
227
new_server->prev = new_server;
231
*current_server = new_server;
228
mc.current_server = new_server;
232
229
/* Place the new server last in the list */
233
230
} else {
234
new_server->next = *current_server;
235
new_server->prev = (*current_server)->prev;
231
new_server->next = mc.current_server;
232
new_server->prev = mc.current_server->prev;
236
233
new_server->prev->next = new_server;
237
(*current_server)->prev = new_server;
234
mc.current_server->prev = new_server;
238
235
}
239
ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
240
237
if(ret == -1){
241
238
perror_plus("clock_gettime");
242
239
return false;
248
245
* Initialize GPGME.
249
246
*/
250
247
static bool init_gpgme(const char *seckey, const char *pubkey,
251
const char *tempdir, mandos_context *mc){
248
const char *tempdir){
252
249
gpgme_error_t rc;
253
250
gpgme_engine_info_t engine_info;
254
251
252
255
253
/*
256
254
* Helper function to insert pub and seckey to the engine keyring.
257
255
*/
273
271
return false;
274
272
}
275
273
276
rc = gpgme_op_import(mc->ctx, pgp_data);
274
rc = gpgme_op_import(mc.ctx, pgp_data);
277
275
if(rc != GPG_ERR_NO_ERROR){
278
276
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
279
277
gpgme_strsource(rc), gpgme_strerror(rc));
323
321
}
324
322
325
323
/* Create new GPGME "context" */
326
rc = gpgme_new(&(mc->ctx));
324
rc = gpgme_new(&(mc.ctx));
327
325
if(rc != GPG_ERR_NO_ERROR){
328
326
fprintf_plus(stderr, "Mandos plugin mandos-client: "
329
327
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
344
342
*/
345
343
static ssize_t pgp_packet_decrypt(const char *cryptotext,
346
344
size_t crypto_size,
347
char **plaintext,
348
mandos_context *mc){
345
char **plaintext){
349
346
gpgme_data_t dh_crypto, dh_plain;
350
347
gpgme_error_t rc;
351
348
ssize_t ret;
377
374
378
375
/* Decrypt data from the cryptotext data buffer to the plaintext
379
376
data buffer */
380
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
377
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
381
378
if(rc != GPG_ERR_NO_ERROR){
382
379
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
383
380
gpgme_strsource(rc), gpgme_strerror(rc));
384
381
plaintext_length = -1;
385
382
if(debug){
386
383
gpgme_decrypt_result_t result;
387
result = gpgme_op_decrypt_result(mc->ctx);
384
result = gpgme_op_decrypt_result(mc.ctx);
388
385
if(result == NULL){
389
386
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
390
387
} else {
468
465
}
469
466
470
467
static const char * safer_gnutls_strerror(int value){
471
const char *ret = gnutls_strerror(value);
468
const char *ret = gnutls_strerror(value); /* Spurious warning from
469
-Wunreachable-code */
472
470
if(ret == NULL)
473
471
ret = "(unknown)";
474
472
return ret;
481
479
}
482
480
483
481
static int init_gnutls_global(const char *pubkeyfilename,
484
const char *seckeyfilename,
485
mandos_context *mc){
482
const char *seckeyfilename){
486
483
int ret;
487
484
488
485
if(debug){
505
502
}
506
503
507
504
/* OpenPGP credentials */
508
ret = gnutls_certificate_allocate_credentials(&mc->cred);
505
ret = gnutls_certificate_allocate_credentials(&mc.cred);
509
506
if(ret != GNUTLS_E_SUCCESS){
510
507
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
511
508
safer_gnutls_strerror(ret));
521
518
}
522
519
523
520
ret = gnutls_certificate_set_openpgp_key_file
524
(mc->cred, pubkeyfilename, seckeyfilename,
521
(mc.cred, pubkeyfilename, seckeyfilename,
525
522
GNUTLS_OPENPGP_FMT_BASE64);
526
523
if(ret != GNUTLS_E_SUCCESS){
527
524
fprintf_plus(stderr,
533
530
}
534
531
535
532
/* GnuTLS server initialization */
536
ret = gnutls_dh_params_init(&mc->dh_params);
533
ret = gnutls_dh_params_init(&mc.dh_params);
537
534
if(ret != GNUTLS_E_SUCCESS){
538
535
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
539
536
" initialization: %s\n",
540
537
safer_gnutls_strerror(ret));
541
538
goto globalfail;
542
539
}
543
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
544
541
if(ret != GNUTLS_E_SUCCESS){
545
542
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
546
543
safer_gnutls_strerror(ret));
547
544
goto globalfail;
548
545
}
549
546
550
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
547
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
551
548
552
549
return 0;
553
550
554
551
globalfail:
555
552
556
gnutls_certificate_free_credentials(mc->cred);
553
gnutls_certificate_free_credentials(mc.cred);
557
554
gnutls_global_deinit();
558
gnutls_dh_params_deinit(mc->dh_params);
555
gnutls_dh_params_deinit(mc.dh_params);
559
556
return -1;
560
557
}
561
558
562
static int init_gnutls_session(gnutls_session_t *session,
563
mandos_context *mc){
559
static int init_gnutls_session(gnutls_session_t *session){
564
560
int ret;
565
561
/* GnuTLS session creation */
566
562
do {
578
574
{
579
575
const char *err;
580
576
do {
581
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
577
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
582
578
if(quit_now){
583
579
gnutls_deinit(*session);
584
580
return -1;
595
591
596
592
do {
597
593
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
598
mc->cred);
594
mc.cred);
599
595
if(quit_now){
600
596
gnutls_deinit(*session);
601
597
return -1;
611
607
/* ignore client certificate if any. */
612
608
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
613
609
614
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
610
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
615
611
616
612
return 0;
617
613
}
621
617
__attribute__((unused)) const char *txt){}
622
618
623
619
/* Called when a Mandos server is found */
624
static int start_mandos_communication(const char *ip, in_port_t port,
620
static int start_mandos_communication(const char *ip, uint16_t port,
625
621
AvahiIfIndex if_index,
626
int af, mandos_context *mc){
622
int af){
627
623
int ret, tcp_sd = -1;
628
624
ssize_t sret;
629
625
union {
659
655
return -1;
660
656
}
661
657
662
/* If the interface is specified and we have a list of interfaces */
663
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
664
/* Check if the interface is one of the interfaces we are using */
665
bool match = false;
666
{
667
char *interface = NULL;
668
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
669
interface))){
670
if(if_nametoindex(interface) == (unsigned int)if_index){
671
match = true;
672
break;
673
}
674
}
675
}
676
if(not match){
677
/* This interface does not match any in the list, so we don't
678
connect to the server */
679
if(debug){
680
char interface[IF_NAMESIZE];
681
if(if_indextoname((unsigned int)if_index, interface) == NULL){
682
perror_plus("if_indextoname");
683
} else {
684
fprintf_plus(stderr, "Skipping server on non-used interface"
685
" \"%s\"\n",
686
if_indextoname((unsigned int)if_index,
687
interface));
688
}
689
}
690
return -1;
691
}
692
}
693
694
ret = init_gnutls_session(&session, mc);
658
ret = init_gnutls_session(&session);
695
659
if(ret != 0){
696
660
return -1;
697
661
}
698
662
699
663
if(debug){
700
664
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
701
PRIuMAX "\n", ip, (uintmax_t)port);
665
PRIu16 "\n", ip, port);
702
666
}
703
667
704
668
tcp_sd = socket(pf, SOCK_STREAM, 0);
735
699
goto mandos_end;
736
700
}
737
701
if(af == AF_INET6){
738
to.in6.sin6_port = htons(port);
739
#ifdef __GNUC__
740
#pragma GCC diagnostic push
741
#pragma GCC diagnostic ignored "-Wstrict-aliasing"
742
#endif
702
to.in6.sin6_port = htons(port); /* Spurious warnings from
703
-Wconversion and
704
-Wunreachable-code */
705
743
706
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
744
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower */
745
#ifdef __GNUC__
746
#pragma GCC diagnostic pop
747
#endif
707
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
708
-Wunreachable-code*/
748
709
if(if_index == AVAHI_IF_UNSPEC){
749
710
fprintf_plus(stderr, "An IPv6 link-local address is"
750
711
" incomplete without a network interface\n");
755
716
to.in6.sin6_scope_id = (uint32_t)if_index;
756
717
}
757
718
} else {
758
to.in.sin_port = htons(port);
719
to.in.sin_port = htons(port); /* Spurious warnings from
720
-Wconversion and
721
-Wunreachable-code */
759
722
}
760
723
761
724
if(quit_now){
769
732
if(if_indextoname((unsigned int)if_index, interface) == NULL){
770
733
perror_plus("if_indextoname");
771
734
} else {
772
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
773
"\n", ip, interface, (uintmax_t)port);
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
774
737
}
775
738
} else {
776
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
777
ip, (uintmax_t)port);
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
740
ip, port);
778
741
}
779
742
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
780
743
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
858
821
goto mandos_end;
859
822
}
860
823
861
/* This casting via intptr_t is to eliminate warning about casting
862
an int to a pointer type. This is exactly how the GnuTLS Guile
863
function "set-session-transport-fd!" does it. */
864
gnutls_transport_set_ptr(session,
865
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
824
/* Spurious warning from -Wint-to-pointer-cast */
825
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
866
826
867
827
if(quit_now){
868
828
errno = EINTR;
973
933
if(buffer_length > 0){
974
934
ssize_t decrypted_buffer_size;
975
935
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
976
&decrypted_buffer, mc);
936
&decrypted_buffer);
977
937
if(decrypted_buffer_size >= 0){
978
938
979
939
written = 0;
1040
1000
AVAHI_GCC_UNUSED AvahiStringList *txt,
1041
1001
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1042
1002
flags,
1043
void* mc){
1044
if(r == NULL){
1045
return;
1046
}
1003
AVAHI_GCC_UNUSED void* userdata){
1004
assert(r);
1047
1005
1048
1006
/* Called whenever a service has been resolved successfully or
1049
1007
timed out */
1058
1016
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1059
1017
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1060
1018
domain,
1061
avahi_strerror(avahi_server_errno
1062
(((mandos_context*)mc)->server)));
1019
avahi_strerror(avahi_server_errno(mc.server)));
1063
1020
break;
1064
1021
1065
1022
case AVAHI_RESOLVER_FOUND:
1071
1028
PRIdMAX ") on port %" PRIu16 "\n", name,
1072
1029
host_name, ip, (intmax_t)interface, port);
1073
1030
}
1074
int ret = start_mandos_communication(ip, (in_port_t)port,
1075
interface,
1076
avahi_proto_to_af(proto),
1077
mc);
1031
int ret = start_mandos_communication(ip, port, interface,
1032
avahi_proto_to_af(proto));
1078
1033
if(ret == 0){
1079
avahi_simple_poll_quit(simple_poll);
1034
avahi_simple_poll_quit(mc.simple_poll);
1080
1035
} else {
1081
if(not add_server(ip, (in_port_t)port, interface,
1082
avahi_proto_to_af(proto),
1083
&((mandos_context*)mc)->current_server)){
1036
if(not add_server(ip, port, interface,
1037
avahi_proto_to_af(proto))){
1084
1038
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1085
1039
" list\n", name);
1086
1040
}
1099
1053
const char *domain,
1100
1054
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1101
1055
flags,
1102
void* mc){
1103
if(b == NULL){
1104
return;
1105
}
1056
AVAHI_GCC_UNUSED void* userdata){
1057
assert(b);
1106
1058
1107
1059
/* Called whenever a new services becomes available on the LAN or
1108
1060
is removed from the LAN */
1116
1068
case AVAHI_BROWSER_FAILURE:
1117
1069
1118
1070
fprintf_plus(stderr, "(Avahi browser) %s\n",
1119
avahi_strerror(avahi_server_errno
1120
(((mandos_context*)mc)->server)));
1121
avahi_simple_poll_quit(simple_poll);
1071
avahi_strerror(avahi_server_errno(mc.server)));
1072
avahi_simple_poll_quit(mc.simple_poll);
1122
1073
return;
1123
1074
1124
1075
case AVAHI_BROWSER_NEW:
1127
1078
the callback function is called the Avahi server will free the
1128
1079
resolver for us. */
1129
1080
1130
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1131
interface, protocol, name, type,
1132
domain, protocol, 0,
1133
resolve_callback, mc) == NULL)
1081
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1082
name, type, domain, protocol, 0,
1083
resolve_callback, NULL) == NULL)
1134
1084
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1135
1085
" %s\n", name,
1136
avahi_strerror(avahi_server_errno
1137
(((mandos_context*)mc)->server)));
1086
avahi_strerror(avahi_server_errno(mc.server)));
1138
1087
break;
1139
1088
1140
1089
case AVAHI_BROWSER_REMOVE:
1159
1108
signal_received = sig;
1160
1109
int old_errno = errno;
1161
1110
/* set main loop to exit */
1162
if(simple_poll != NULL){
1163
avahi_simple_poll_quit(simple_poll);
1111
if(mc.simple_poll != NULL){
1112
avahi_simple_poll_quit(mc.simple_poll);
1164
1113
}
1165
1114
errno = old_errno;
1166
1115
}
1167
1116
1168
1117
bool get_flags(const char *ifname, struct ifreq *ifr){
1169
1118
int ret;
1170
error_t ret_errno;
1171
1119
1172
1120
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1173
1121
if(s < 0){
1174
ret_errno = errno;
1175
1122
perror_plus("socket");
1176
errno = ret_errno;
1177
1123
return false;
1178
1124
}
1179
1125
strcpy(ifr->ifr_name, ifname);
1180
1126
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1181
1127
if(ret == -1){
1182
1128
if(debug){
1183
ret_errno = errno;
1184
1129
perror_plus("ioctl SIOCGIFFLAGS");
1185
errno = ret_errno;
1186
1130
}
1187
1131
return false;
1188
1132
}
1257
1201
}
1258
1202
1259
1203
/*
1260
* This function determines if a network interface is up.
1261
*/
1262
bool interface_is_up(const char *interface){
1263
struct ifreq ifr;
1264
if(not get_flags(interface, &ifr)){
1265
if(debug){
1266
fprintf_plus(stderr, "Failed to get flags for interface "
1267
"\"%s\"\n", interface);
1268
}
1269
return false;
1270
}
1271
1272
return (bool)(ifr.ifr_flags & IFF_UP);
1273
}
1274
1275
/*
1276
* This function determines if a network interface is running
1277
*/
1278
bool interface_is_running(const char *interface){
1279
struct ifreq ifr;
1280
if(not get_flags(interface, &ifr)){
1281
if(debug){
1282
fprintf_plus(stderr, "Failed to get flags for interface "
1283
"\"%s\"\n", interface);
1284
}
1285
return false;
1286
}
1287
1288
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1204
* This function determines if a directory entry in /sys/class/net
1205
* corresponds to an acceptable network device which is up.
1206
* (This function is passed to scandir(3) as a filter function.)
1207
*/
1208
int up_interface(const struct dirent *if_entry){
1209
if(if_entry->d_name[0] == '.'){
1210
return 0;
1211
}
1212
1213
struct ifreq ifr;
1214
if(not get_flags(if_entry->d_name, &ifr)){
1215
if(debug){
1216
fprintf_plus(stderr, "Failed to get flags for interface "
1217
"\"%s\"\n", if_entry->d_name);
1218
}
1219
return 0;
1220
}
1221
1222
/* Reject down interfaces */
1223
if(not (ifr.ifr_flags & IFF_UP)){
1224
if(debug){
1225
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1226
if_entry->d_name);
1227
}
1228
return 0;
1229
}
1230
1231
/* Reject non-running interfaces */
1232
if(not (ifr.ifr_flags & IFF_RUNNING)){
1233
if(debug){
1234
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1235
if_entry->d_name);
1236
}
1237
return 0;
1238
}
1239
1240
if(not good_flags(if_entry->d_name, &ifr)){
1241
return 0;
1242
}
1243
return 1;
1289
1244
}
1290
1245
1291
1246
int notdotentries(const struct dirent *direntry){
1360
1315
return 1;
1361
1316
}
1362
1317
1363
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1364
mandos_context *mc){
1318
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1365
1319
int ret;
1366
1320
struct timespec now;
1367
1321
struct timespec waited_time;
1368
1322
intmax_t block_time;
1369
1323
1370
1324
while(true){
1371
if(mc->current_server == NULL){
1325
if(mc.current_server == NULL){
1372
1326
if (debug){
1373
1327
fprintf_plus(stderr, "Wait until first server is found."
1374
1328
" No timeout!\n");
1388
1342
/* Calculating in ms how long time between now and server
1389
1343
who we visted longest time ago. Now - last seen. */
1390
1344
waited_time.tv_sec = (now.tv_sec
1391
- mc->current_server->last_seen.tv_sec);
1345
- mc.current_server->last_seen.tv_sec);
1392
1346
waited_time.tv_nsec = (now.tv_nsec
1393
- mc->current_server->last_seen.tv_nsec);
1347
- mc.current_server->last_seen.tv_nsec);
1394
1348
/* total time is 10s/10,000ms.
1395
1349
Converting to s from ms by dividing by 1,000,
1396
1350
and ns to ms by dividing by 1,000,000. */
1404
1358
}
1405
1359
1406
1360
if(block_time <= 0){
1407
ret = start_mandos_communication(mc->current_server->ip,
1408
mc->current_server->port,
1409
mc->current_server->if_index,
1410
mc->current_server->af, mc);
1361
ret = start_mandos_communication(mc.current_server->ip,
1362
mc.current_server->port,
1363
mc.current_server->if_index,
1364
mc.current_server->af);
1411
1365
if(ret == 0){
1412
avahi_simple_poll_quit(s);
1366
avahi_simple_poll_quit(mc.simple_poll);
1413
1367
return 0;
1414
1368
}
1415
1369
ret = clock_gettime(CLOCK_MONOTONIC,
1416
&mc->current_server->last_seen);
1370
&mc.current_server->last_seen);
1417
1371
if(ret == -1){
1418
1372
perror_plus("clock_gettime");
1419
1373
return -1;
1420
1374
}
1421
mc->current_server = mc->current_server->next;
1375
mc.current_server = mc.current_server->next;
1422
1376
block_time = 0; /* Call avahi to find new Mandos
1423
1377
servers, but don't block */
1424
1378
}
1433
1387
}
1434
1388
}
1435
1389
1436
/* Set effective uid to 0, return errno */
1437
error_t raise_privileges(void){
1438
error_t old_errno = errno;
1439
error_t ret_errno = 0;
1440
if(seteuid(0) == -1){
1441
ret_errno = errno;
1442
perror_plus("seteuid");
1443
}
1444
errno = old_errno;
1445
return ret_errno;
1446
}
1447
1448
/* Set effective and real user ID to 0. Return errno. */
1449
error_t raise_privileges_permanently(void){
1450
error_t old_errno = errno;
1451
error_t ret_errno = raise_privileges();
1452
if(ret_errno != 0){
1453
errno = old_errno;
1454
return ret_errno;
1455
}
1456
if(setuid(0) == -1){
1457
ret_errno = errno;
1458
perror_plus("seteuid");
1459
}
1460
errno = old_errno;
1461
return ret_errno;
1462
}
1463
1464
/* Set effective user ID to unprivileged saved user ID */
1465
error_t lower_privileges(void){
1466
error_t old_errno = errno;
1467
error_t ret_errno = 0;
1468
if(seteuid(uid) == -1){
1469
ret_errno = errno;
1470
perror_plus("seteuid");
1471
}
1472
errno = old_errno;
1473
return ret_errno;
1474
}
1475
1476
/* Lower privileges permanently */
1477
error_t lower_privileges_permanently(void){
1478
error_t old_errno = errno;
1479
error_t ret_errno = 0;
1480
if(setuid(uid) == -1){
1481
ret_errno = errno;
1482
perror_plus("setuid");
1483
}
1484
errno = old_errno;
1485
return ret_errno;
1486
}
1487
1488
1390
bool run_network_hooks(const char *mode, const char *interface,
1489
1391
const float delay){
1490
1392
struct dirent **direntries;
1493
1395
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1494
1396
alphasort);
1495
1397
if(numhooks == -1){
1496
if(errno == ENOENT){
1497
if(debug){
1498
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1499
" found\n", hookdir);
1500
}
1501
} else {
1502
perror_plus("scandir");
1503
}
1398
perror_plus("scandir");
1504
1399
} else {
1505
1400
int devnull = open("/dev/null", O_RDONLY);
1506
1401
for(int i = 0; i < numhooks; i++){
1519
1414
if(hook_pid == 0){
1520
1415
/* Child */
1521
1416
/* Raise privileges */
1522
raise_privileges_permanently();
1417
errno = 0;
1418
ret = seteuid(0);
1419
if(ret == -1){
1420
perror_plus("seteuid");
1421
}
1422
/* Raise privileges even more */
1423
errno = 0;
1424
ret = setuid(0);
1425
if(ret == -1){
1426
perror_plus("setuid");
1427
}
1523
1428
/* Set group */
1524
1429
errno = 0;
1525
1430
ret = setgid(0);
1618
1523
return true;
1619
1524
}
1620
1525
1621
error_t bring_up_interface(const char *const interface,
1622
const float delay){
1623
int sd = -1;
1624
error_t old_errno = errno;
1625
error_t ret_errno = 0;
1626
int ret, ret_setflags;
1627
struct ifreq network;
1628
unsigned int if_index = if_nametoindex(interface);
1629
if(if_index == 0){
1630
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1631
errno = old_errno;
1632
return ENXIO;
1633
}
1634
1635
if(quit_now){
1636
errno = old_errno;
1637
return EINTR;
1638
}
1639
1640
if(not interface_is_up(interface)){
1641
if(not get_flags(interface, &network) and debug){
1642
ret_errno = errno;
1643
fprintf_plus(stderr, "Failed to get flags for interface "
1644
"\"%s\"\n", interface);
1645
return ret_errno;
1646
}
1647
network.ifr_flags |= IFF_UP;
1648
1649
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1650
if(sd < 0){
1651
ret_errno = errno;
1652
perror_plus("socket");
1653
errno = old_errno;
1654
return ret_errno;
1655
}
1656
1657
if(quit_now){
1658
close(sd);
1659
errno = old_errno;
1660
return EINTR;
1661
}
1662
1663
if(debug){
1664
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
1665
interface);
1666
}
1667
1668
/* Raise priviliges */
1669
raise_privileges();
1670
1671
#ifdef __linux__
1672
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1673
messages about the network interface to mess up the prompt */
1674
int ret_linux = klogctl(8, NULL, 5);
1675
bool restore_loglevel = true;
1676
if(ret_linux == -1){
1677
restore_loglevel = false;
1678
perror_plus("klogctl");
1679
}
1680
#endif /* __linux__ */
1681
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1682
ret_errno = errno;
1683
#ifdef __linux__
1684
if(restore_loglevel){
1685
ret_linux = klogctl(7, NULL, 0);
1686
if(ret_linux == -1){
1687
perror_plus("klogctl");
1688
}
1689
}
1690
#endif /* __linux__ */
1691
1692
/* Lower privileges */
1693
lower_privileges();
1694
1695
/* Close the socket */
1696
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1697
if(ret == -1){
1698
perror_plus("close");
1699
}
1700
1701
if(ret_setflags == -1){
1702
errno = ret_errno;
1703
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1704
errno = old_errno;
1705
return ret_errno;
1706
}
1707
} else if(debug){
1708
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1709
interface);
1710
}
1711
1712
/* Sleep checking until interface is running.
1713
Check every 0.25s, up to total time of delay */
1714
for(int i=0; i < delay * 4; i++){
1715
if(interface_is_running(interface)){
1716
break;
1717
}
1718
struct timespec sleeptime = { .tv_nsec = 250000000 };
1719
ret = nanosleep(&sleeptime, NULL);
1720
if(ret == -1 and errno != EINTR){
1721
perror_plus("nanosleep");
1722
}
1723
}
1724
1725
errno = old_errno;
1726
return 0;
1727
}
1728
1729
error_t take_down_interface(const char *const interface){
1730
int sd = -1;
1731
error_t old_errno = errno;
1732
error_t ret_errno = 0;
1733
int ret, ret_setflags;
1734
struct ifreq network;
1735
unsigned int if_index = if_nametoindex(interface);
1736
if(if_index == 0){
1737
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1738
errno = old_errno;
1739
return ENXIO;
1740
}
1741
if(interface_is_up(interface)){
1742
if(not get_flags(interface, &network) and debug){
1743
ret_errno = errno;
1744
fprintf_plus(stderr, "Failed to get flags for interface "
1745
"\"%s\"\n", interface);
1746
return ret_errno;
1747
}
1748
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1749
1750
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1751
if(sd < 0){
1752
ret_errno = errno;
1753
perror_plus("socket");
1754
errno = old_errno;
1755
return ret_errno;
1756
}
1757
1758
if(debug){
1759
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
1760
interface);
1761
}
1762
1763
/* Raise priviliges */
1764
raise_privileges();
1765
1766
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1767
ret_errno = errno;
1768
1769
/* Lower privileges */
1770
lower_privileges();
1771
1772
/* Close the socket */
1773
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1774
if(ret == -1){
1775
perror_plus("close");
1776
}
1777
1778
if(ret_setflags == -1){
1779
errno = ret_errno;
1780
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1781
errno = old_errno;
1782
return ret_errno;
1783
}
1784
} else if(debug){
1785
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1786
interface);
1787
}
1788
1789
errno = old_errno;
1790
return 0;
1791
}
1792
1793
1526
int main(int argc, char *argv[]){
1794
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1795
.priority = "SECURE256:!CTYPE-X.509:"
1796
"+CTYPE-OPENPGP", .current_server = NULL,
1797
.interfaces = NULL, .interfaces_size = 0 };
1798
1527
AvahiSServiceBrowser *sb = NULL;
1799
error_t ret_errno;
1528
int error;
1800
1529
int ret;
1801
1530
intmax_t tmpmax;
1802
1531
char *tmp;
1803
1532
int exitcode = EXIT_SUCCESS;
1804
char *interfaces_to_take_down = NULL;
1805
size_t interfaces_to_take_down_size = 0;
1533
const char *interface = "";
1534
struct ifreq network;
1535
int sd = -1;
1536
bool take_down_interface = false;
1537
uid_t uid;
1538
gid_t gid;
1806
1539
char tempdir[] = "/tmp/mandosXXXXXX";
1807
1540
bool tempdir_created = false;
1808
1541
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1809
1542
const char *seckey = PATHDIR "/" SECKEY;
1810
1543
const char *pubkey = PATHDIR "/" PUBKEY;
1811
char *interfaces_hooks = NULL;
1812
size_t interfaces_hooks_size = 0;
1813
1544
1814
1545
bool gnutls_initialized = false;
1815
1546
bool gpgme_initialized = false;
1906
1637
connect_to = arg;
1907
1638
break;
1908
1639
case 'i': /* --interface */
1909
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
1910
arg, (int)',');
1911
if(ret_errno != 0){
1912
argp_error(state, "%s", strerror(ret_errno));
1913
}
1640
interface = arg;
1914
1641
break;
1915
1642
case 's': /* --seckey */
1916
1643
seckey = arg;
1994
1721
<http://bugs.debian.org/633582> */
1995
1722
1996
1723
/* Re-raise priviliges */
1997
if(raise_privileges() == 0){
1724
errno = 0;
1725
ret = seteuid(0);
1726
if(ret == -1){
1727
perror_plus("seteuid");
1728
} else {
1998
1729
struct stat st;
1999
1730
2000
1731
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2040
1771
}
2041
1772
2042
1773
/* Lower privileges */
2043
lower_privileges();
2044
}
2045
}
2046
2047
/* Remove invalid interface names (except "none") */
2048
{
2049
char *interface = NULL;
2050
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2051
interface))){
2052
if(strcmp(interface, "none") != 0
2053
and if_nametoindex(interface) == 0){
2054
if(interface[0] != '\0'){
2055
fprintf_plus(stderr, "Not using nonexisting interface"
2056
" \"%s\"\n", interface);
2057
}
2058
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2059
interface = NULL;
1774
errno = 0;
1775
ret = seteuid(uid);
1776
if(ret == -1){
1777
perror_plus("seteuid");
2060
1778
}
2061
1779
}
2062
1780
}
2063
1781
2064
1782
/* Run network hooks */
2065
{
2066
if(mc.interfaces != NULL){
2067
interfaces_hooks = malloc(mc.interfaces_size);
2068
if(interfaces_hooks == NULL){
2069
perror_plus("malloc");
2070
goto end;
2071
}
2072
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2073
interfaces_hooks_size = mc.interfaces_size;
2074
argz_stringify(interfaces_hooks, interfaces_hooks_size,
2075
(int)',');
2076
}
2077
if(not run_network_hooks("start", interfaces_hooks != NULL ?
2078
interfaces_hooks : "", delay)){
2079
goto end;
2080
}
1783
if(not run_network_hooks("start", interface, delay)){
1784
goto end;
2081
1785
}
2082
1786
2083
1787
if(not debug){
2084
1788
avahi_set_log_function(empty_log);
2085
1789
}
2086
1790
1791
if(interface[0] == '\0'){
1792
struct dirent **direntries;
1793
/* First look for interfaces that are up */
1794
ret = scandir(sys_class_net, &direntries, up_interface,
1795
alphasort);
1796
if(ret == 0){
1797
/* No up interfaces, look for any good interfaces */
1798
free(direntries);
1799
ret = scandir(sys_class_net, &direntries, good_interface,
1800
alphasort);
1801
}
1802
if(ret >= 1){
1803
/* Pick the first interface returned */
1804
interface = strdup(direntries[0]->d_name);
1805
if(debug){
1806
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1807
}
1808
if(interface == NULL){
1809
perror_plus("malloc");
1810
free(direntries);
1811
exitcode = EXIT_FAILURE;
1812
goto end;
1813
}
1814
free(direntries);
1815
} else {
1816
free(direntries);
1817
fprintf_plus(stderr, "Could not find a network interface\n");
1818
exitcode = EXIT_FAILURE;
1819
goto end;
1820
}
1821
}
1822
2087
1823
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
2088
1824
from the signal handler */
2089
1825
/* Initialize the pseudo-RNG for Avahi */
2090
1826
srand((unsigned int) time(NULL));
2091
simple_poll = avahi_simple_poll_new();
2092
if(simple_poll == NULL){
1827
mc.simple_poll = avahi_simple_poll_new();
1828
if(mc.simple_poll == NULL){
2093
1829
fprintf_plus(stderr,
2094
1830
"Avahi: Failed to create simple poll object.\n");
2095
1831
exitcode = EX_UNAVAILABLE;
2159
1895
}
2160
1896
}
2161
1897
2162
/* If no interfaces were specified, make a list */
2163
if(mc.interfaces == NULL){
2164
struct dirent **direntries;
2165
/* Look for any good interfaces */
2166
ret = scandir(sys_class_net, &direntries, good_interface,
2167
alphasort);
2168
if(ret >= 1){
2169
/* Add all found interfaces to interfaces list */
2170
for(int i = 0; i < ret; ++i){
2171
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2172
direntries[i]->d_name);
2173
if(ret_errno != 0){
2174
perror_plus("argz_add");
2175
continue;
2176
}
2177
if(debug){
2178
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2179
direntries[i]->d_name);
2180
}
2181
}
2182
free(direntries);
2183
} else {
2184
free(direntries);
2185
fprintf_plus(stderr, "Could not find a network interface\n");
2186
exitcode = EXIT_FAILURE;
2187
goto end;
2188
}
2189
}
2190
2191
/* Bring up interfaces which are down, and remove any "none"s */
2192
{
2193
char *interface = NULL;
2194
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2195
interface))){
2196
/* If interface name is "none", stop bringing up interfaces.
2197
Also remove all instances of "none" from the list */
2198
if(strcmp(interface, "none") == 0){
2199
argz_delete(&mc.interfaces, &mc.interfaces_size,
2200
interface);
2201
interface = NULL;
2202
while((interface = argz_next(mc.interfaces,
2203
mc.interfaces_size, interface))){
2204
if(strcmp(interface, "none") == 0){
2205
argz_delete(&mc.interfaces, &mc.interfaces_size,
2206
interface);
2207
interface = NULL;
1898
/* If the interface is down, bring it up */
1899
if(strcmp(interface, "none") != 0){
1900
if_index = (AvahiIfIndex) if_nametoindex(interface);
1901
if(if_index == 0){
1902
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1903
exitcode = EX_UNAVAILABLE;
1904
goto end;
1905
}
1906
1907
if(quit_now){
1908
goto end;
1909
}
1910
1911
/* Re-raise priviliges */
1912
errno = 0;
1913
ret = seteuid(0);
1914
if(ret == -1){
1915
perror_plus("seteuid");
1916
}
1917
1918
#ifdef __linux__
1919
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1920
messages about the network interface to mess up the prompt */
1921
ret = klogctl(8, NULL, 5);
1922
bool restore_loglevel = true;
1923
if(ret == -1){
1924
restore_loglevel = false;
1925
perror_plus("klogctl");
1926
}
1927
#endif /* __linux__ */
1928
1929
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1930
if(sd < 0){
1931
perror_plus("socket");
1932
exitcode = EX_OSERR;
1933
#ifdef __linux__
1934
if(restore_loglevel){
1935
ret = klogctl(7, NULL, 0);
1936
if(ret == -1){
1937
perror_plus("klogctl");
1938
}
1939
}
1940
#endif /* __linux__ */
1941
/* Lower privileges */
1942
errno = 0;
1943
ret = seteuid(uid);
1944
if(ret == -1){
1945
perror_plus("seteuid");
1946
}
1947
goto end;
1948
}
1949
strcpy(network.ifr_name, interface);
1950
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1951
if(ret == -1){
1952
perror_plus("ioctl SIOCGIFFLAGS");
1953
#ifdef __linux__
1954
if(restore_loglevel){
1955
ret = klogctl(7, NULL, 0);
1956
if(ret == -1){
1957
perror_plus("klogctl");
1958
}
1959
}
1960
#endif /* __linux__ */
1961
exitcode = EX_OSERR;
1962
/* Lower privileges */
1963
errno = 0;
1964
ret = seteuid(uid);
1965
if(ret == -1){
1966
perror_plus("seteuid");
1967
}
1968
goto end;
1969
}
1970
if((network.ifr_flags & IFF_UP) == 0){
1971
network.ifr_flags |= IFF_UP;
1972
take_down_interface = true;
1973
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1974
if(ret == -1){
1975
take_down_interface = false;
1976
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1977
exitcode = EX_OSERR;
1978
#ifdef __linux__
1979
if(restore_loglevel){
1980
ret = klogctl(7, NULL, 0);
1981
if(ret == -1){
1982
perror_plus("klogctl");
2208
1983
}
2209
1984
}
1985
#endif /* __linux__ */
1986
/* Lower privileges */
1987
errno = 0;
1988
ret = seteuid(uid);
1989
if(ret == -1){
1990
perror_plus("seteuid");
1991
}
1992
goto end;
1993
}
1994
}
1995
/* Sleep checking until interface is running.
1996
Check every 0.25s, up to total time of delay */
1997
for(int i=0; i < delay * 4; i++){
1998
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1999
if(ret == -1){
2000
perror_plus("ioctl SIOCGIFFLAGS");
2001
} else if(network.ifr_flags & IFF_RUNNING){
2210
2002
break;
2211
2003
}
2212
bool interface_was_up = interface_is_up(interface);
2213
ret = bring_up_interface(interface, delay);
2214
if(not interface_was_up){
2215
if(ret != 0){
2216
errno = ret;
2217
perror_plus("Failed to bring up interface");
2218
} else {
2219
ret_errno = argz_add(&interfaces_to_take_down,
2220
&interfaces_to_take_down_size,
2221
interface);
2222
}
2223
}
2224
}
2225
if(debug and (interfaces_to_take_down == NULL)){
2226
fprintf_plus(stderr, "No interfaces were brought up\n");
2227
}
2228
}
2229
2230
/* If we only got one interface, explicitly use only that one */
2231
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2232
if(debug){
2233
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2234
mc.interfaces);
2235
}
2236
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2004
struct timespec sleeptime = { .tv_nsec = 250000000 };
2005
ret = nanosleep(&sleeptime, NULL);
2006
if(ret == -1 and errno != EINTR){
2007
perror_plus("nanosleep");
2008
}
2009
}
2010
if(not take_down_interface){
2011
/* We won't need the socket anymore */
2012
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2013
if(ret == -1){
2014
perror_plus("close");
2015
}
2016
}
2017
#ifdef __linux__
2018
if(restore_loglevel){
2019
/* Restores kernel loglevel to default */
2020
ret = klogctl(7, NULL, 0);
2021
if(ret == -1){
2022
perror_plus("klogctl");
2023
}
2024
}
2025
#endif /* __linux__ */
2026
/* Lower privileges */
2027
errno = 0;
2028
/* Lower privileges */
2029
ret = seteuid(uid);
2030
if(ret == -1){
2031
perror_plus("seteuid");
2032
}
2237
2033
}
2238
2034
2239
2035
if(quit_now){
2240
2036
goto end;
2241
2037
}
2242
2038
2243
ret = init_gnutls_global(pubkey, seckey, &mc);
2039
ret = init_gnutls_global(pubkey, seckey);
2244
2040
if(ret == -1){
2245
2041
fprintf_plus(stderr, "init_gnutls_global failed\n");
2246
2042
exitcode = EX_UNAVAILABLE;
2263
2059
goto end;
2264
2060
}
2265
2061
2266
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2062
if(not init_gpgme(pubkey, seckey, tempdir)){
2267
2063
fprintf_plus(stderr, "init_gpgme failed\n");
2268
2064
exitcode = EX_UNAVAILABLE;
2269
2065
goto end;
2279
2075
/* Connect directly, do not use Zeroconf */
2280
2076
/* (Mainly meant for debugging) */
2281
2077
char *address = strrchr(connect_to, ':');
2282
2283
2078
if(address == NULL){
2284
2079
fprintf_plus(stderr, "No colon in address\n");
2285
2080
exitcode = EX_USAGE;
2290
2085
goto end;
2291
2086
}
2292
2087
2293
in_port_t port;
2088
uint16_t port;
2294
2089
errno = 0;
2295
2090
tmpmax = strtoimax(address+1, &tmp, 10);
2296
2091
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2297
or tmpmax != (in_port_t)tmpmax){
2092
or tmpmax != (uint16_t)tmpmax){
2298
2093
fprintf_plus(stderr, "Bad port number\n");
2299
2094
exitcode = EX_USAGE;
2300
2095
goto end;
2301
2096
}
2302
2097
2303
2098
if(quit_now){
2304
2099
goto end;
2305
2100
}
2306
2101
2307
port = (in_port_t)tmpmax;
2102
port = (uint16_t)tmpmax;
2308
2103
*address = '\0';
2309
2104
/* Colon in address indicates IPv6 */
2310
2105
int af;
2326
2121
}
2327
2122
2328
2123
while(not quit_now){
2329
ret = start_mandos_communication(address, port, if_index, af,
2330
&mc);
2124
ret = start_mandos_communication(address, port, if_index, af);
2331
2125
if(quit_now or ret == 0){
2332
2126
break;
2333
2127
}
2335
2129
fprintf_plus(stderr, "Retrying in %d seconds\n",
2336
2130
(int)retry_interval);
2337
2131
}
2338
sleep((unsigned int)retry_interval);
2132
sleep((int)retry_interval);
2339
2133
}
2340
2134
2341
2135
if (not quit_now){
2359
2153
config.publish_domain = 0;
2360
2154
2361
2155
/* Allocate a new server */
2362
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2363
&config, NULL, NULL, &ret_errno);
2156
mc.server = avahi_server_new(avahi_simple_poll_get
2157
(mc.simple_poll), &config, NULL,
2158
NULL, &error);
2364
2159
2365
2160
/* Free the Avahi configuration data */
2366
2161
avahi_server_config_free(&config);
2369
2164
/* Check if creating the Avahi server object succeeded */
2370
2165
if(mc.server == NULL){
2371
2166
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2372
avahi_strerror(ret_errno));
2167
avahi_strerror(error));
2373
2168
exitcode = EX_UNAVAILABLE;
2374
2169
goto end;
2375
2170
}
2381
2176
/* Create the Avahi service browser */
2382
2177
sb = avahi_s_service_browser_new(mc.server, if_index,
2383
2178
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2384
NULL, 0, browse_callback,
2385
(void *)&mc);
2179
NULL, 0, browse_callback, NULL);
2386
2180
if(sb == NULL){
2387
2181
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2388
2182
avahi_strerror(avahi_server_errno(mc.server)));
2400
2194
fprintf_plus(stderr, "Starting Avahi loop search\n");
2401
2195
}
2402
2196
2403
ret = avahi_loop_with_timeout(simple_poll,
2404
(int)(retry_interval * 1000), &mc);
2197
ret = avahi_loop_with_timeout(mc.simple_poll,
2198
(int)(retry_interval * 1000));
2405
2199
if(debug){
2406
2200
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2407
2201
(ret == 0) ? "successfully" : "with error");
2414
2208
}
2415
2209
2416
2210
/* Cleanup things */
2417
free(mc.interfaces);
2418
2419
2211
if(sb != NULL)
2420
2212
avahi_s_service_browser_free(sb);
2421
2213
2422
2214
if(mc.server != NULL)
2423
2215
avahi_server_free(mc.server);
2424
2216
2425
if(simple_poll != NULL)
2426
avahi_simple_poll_free(simple_poll);
2217
if(mc.simple_poll != NULL)
2218
avahi_simple_poll_free(mc.simple_poll);
2427
2219
2428
2220
if(gnutls_initialized){
2429
2221
gnutls_certificate_free_credentials(mc.cred);
2446
2238
}
2447
2239
}
2448
2240
2241
/* Run network hooks */
2242
run_network_hooks("stop", interface, delay);
2243
2449
2244
/* Re-raise priviliges */
2450
2245
{
2451
raise_privileges();
2452
2453
/* Run network hooks */
2454
run_network_hooks("stop", interfaces_hooks != NULL ?
2455
interfaces_hooks : "", delay);
2456
2457
/* Take down the network interfaces which were brought up */
2458
{
2459
char *interface = NULL;
2460
while((interface=argz_next(interfaces_to_take_down,
2461
interfaces_to_take_down_size,
2462
interface))){
2463
ret_errno = take_down_interface(interface);
2464
if(ret_errno != 0){
2465
errno = ret_errno;
2466
perror_plus("Failed to take down interface");
2246
errno = 0;
2247
ret = seteuid(0);
2248
if(ret == -1){
2249
perror_plus("seteuid");
2250
}
2251
2252
/* Take down the network interface */
2253
if(take_down_interface and geteuid() == 0){
2254
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2255
if(ret == -1){
2256
perror_plus("ioctl SIOCGIFFLAGS");
2257
} else if(network.ifr_flags & IFF_UP){
2258
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2259
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2260
if(ret == -1){
2261
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2467
2262
}
2468
2263
}
2469
if(debug and (interfaces_to_take_down == NULL)){
2470
fprintf_plus(stderr, "No interfaces needed to be taken"
2471
" down\n");
2264
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2265
if(ret == -1){
2266
perror_plus("close");
2472
2267
}
2473
2268
}
2474
2475
lower_privileges_permanently();
2476
}
2477
2478
free(interfaces_to_take_down);
2479
free(interfaces_hooks);
2269
}
2270
/* Lower privileges permanently */
2271
errno = 0;
2272
ret = setuid(uid);
2273
if(ret == -1){
2274
perror_plus("setuid");
2275
}
2480
2276
2481
2277
/* Removes the GPGME temp directory and all files inside */
2482
2278
if(tempdir_created){
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0