To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 541
- compare with another revision
- download diff
- download tarball
- view history from revision 541
- Committer: Teddy Hogeborn
- Date: 2011-12-31 20:07:11 UTC
- mfrom: (535.1.9 wireless-network-hook)
- Revision ID: teddy@recompile.se-20111231200711-6dli3r8drftem57r
Merge new wireless network hook. Fix bridge network hook to use
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
hardware addresses instead of interface names. Implement and document
new "CONNECT" environment variable for network hooks.
- files removed:
- debian/mandos-client.examples
- debian/upstream
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2014 Teddy Hogeborn
13
* Copyright © 2008-2014 Björn Påhlsson
12
* Copyright © 2008-2011 Teddy Hogeborn
13
* Copyright © 2008-2011 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
33
#ifndef _LARGEFILE_SOURCE
34
34
#define _LARGEFILE_SOURCE
35
#endif /* not _LARGEFILE_SOURCE */
35
#endif
36
36
#ifndef _FILE_OFFSET_BITS
37
37
#define _FILE_OFFSET_BITS 64
38
#endif /* not _FILE_OFFSET_BITS */
38
#endif
39
39
40
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
41
42
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror() */
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
47
strtof(), abort() */
55
55
opendir(), DIR */
56
56
#include <sys/stat.h> /* open(), S_ISREG */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect(),
59
getnameinfo() */
60
#include <fcntl.h> /* open(), unlinkat() */
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
61
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
62
61
*/
63
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
64
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
65
#include <errno.h> /* perror(), errno,
66
66
program_invocation_short_name */
67
67
#include <time.h> /* nanosleep(), time(), sleep() */
73
73
*/
74
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
75
75
getuid(), getgid(), seteuid(),
76
setgid(), pause(), _exit(),
77
unlinkat() */
78
#include <arpa/inet.h> /* inet_pton(), htons() */
76
setgid(), pause(), _exit() */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
79
78
#include <iso646.h> /* not, or, and */
80
79
#include <argp.h> /* struct argp_option, error_t, struct
81
80
argp_state, struct argp,
89
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
90
89
WEXITSTATUS(), WTERMSIG() */
91
90
#include <grp.h> /* setgroups() */
92
#include <argz.h> /* argz_add_sep(), argz_next(),
93
argz_delete(), argz_append(),
94
argz_stringify(), argz_add(),
95
argz_count() */
96
#include <netdb.h> /* getnameinfo(), NI_NUMERICHOST,
97
EAI_SYSTEM, gai_strerror() */
98
91
99
92
#ifdef __linux__
100
93
#include <sys/klog.h> /* klogctl() */
142
135
static const char sys_class_net[] = "/sys/class/net";
143
136
char *connect_to = NULL;
144
137
const char *hookdir = HOOKDIR;
145
int hookdir_fd = -1;
146
uid_t uid = 65534;
147
gid_t gid = 65534;
148
138
149
139
/* Doubly linked list that need to be circularly linked when used */
150
140
typedef struct server{
151
141
const char *ip;
152
in_port_t port;
142
uint16_t port;
153
143
AvahiIfIndex if_index;
154
144
int af;
155
145
struct timespec last_seen;
159
149
160
150
/* Used for passing in values through the Avahi callback functions */
161
151
typedef struct {
152
AvahiSimplePoll *simple_poll;
162
153
AvahiServer *server;
163
154
gnutls_certificate_credentials_t cred;
164
155
unsigned int dh_bits;
166
157
const char *priority;
167
158
gpgme_ctx_t ctx;
168
159
server *current_server;
169
char *interfaces;
170
size_t interfaces_size;
171
160
} mandos_context;
172
161
173
/* global so signal handler can reach it*/
174
AvahiSimplePoll *simple_poll;
162
/* global context so signal handler can reach it*/
163
mandos_context mc = { .simple_poll = NULL, .server = NULL,
164
.dh_bits = 1024, .priority = "SECURE256"
165
":!CTYPE-X.509:+CTYPE-OPENPGP",
166
.current_server = NULL };
175
167
176
168
sig_atomic_t quit_now = 0;
177
169
int signal_received = 0;
185
177
perror(print_text);
186
178
}
187
179
188
__attribute__((format (gnu_printf, 2, 3), nonnull))
180
__attribute__((format (gnu_printf, 2, 3)))
189
181
int fprintf_plus(FILE *stream, const char *format, ...){
190
182
va_list ap;
191
183
va_start (ap, format);
192
184
193
185
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
194
186
program_invocation_short_name));
195
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
187
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
196
188
}
197
189
198
190
/*
200
192
* bytes. "buffer_capacity" is how much is currently allocated,
201
193
* "buffer_length" is how much is already used.
202
194
*/
203
__attribute__((nonnull, warn_unused_result))
204
195
size_t incbuffer(char **buffer, size_t buffer_length,
205
196
size_t buffer_capacity){
206
197
if(buffer_length + BUFFER_SIZE > buffer_capacity){
207
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
208
if(new_buf == NULL){
209
int old_errno = errno;
210
free(*buffer);
211
errno = old_errno;
212
*buffer = NULL;
198
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
199
if(buffer == NULL){
213
200
return 0;
214
201
}
215
*buffer = new_buf;
216
202
buffer_capacity += BUFFER_SIZE;
217
203
}
218
204
return buffer_capacity;
219
205
}
220
206
221
207
/* Add server to set of servers to retry periodically */
222
__attribute__((nonnull, warn_unused_result))
223
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
224
int af, server **current_server){
208
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
209
int af){
225
210
int ret;
226
211
server *new_server = malloc(sizeof(server));
227
212
if(new_server == NULL){
234
219
.af = af };
235
220
if(new_server->ip == NULL){
236
221
perror_plus("strdup");
237
free(new_server);
238
return false;
239
}
240
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
241
if(ret == -1){
242
perror_plus("clock_gettime");
243
free(new_server->ip);
244
free(new_server);
245
222
return false;
246
223
}
247
224
/* Special case of first server */
248
if(*current_server == NULL){
225
if (mc.current_server == NULL){
249
226
new_server->next = new_server;
250
227
new_server->prev = new_server;
251
*current_server = new_server;
228
mc.current_server = new_server;
229
/* Place the new server last in the list */
252
230
} else {
253
/* Place the new server last in the list */
254
new_server->next = *current_server;
255
new_server->prev = (*current_server)->prev;
231
new_server->next = mc.current_server;
232
new_server->prev = mc.current_server->prev;
256
233
new_server->prev->next = new_server;
257
(*current_server)->prev = new_server;
234
mc.current_server->prev = new_server;
235
}
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
237
if(ret == -1){
238
perror_plus("clock_gettime");
239
return false;
258
240
}
259
241
return true;
260
242
}
262
244
/*
263
245
* Initialize GPGME.
264
246
*/
265
__attribute__((nonnull, warn_unused_result))
266
static bool init_gpgme(const char * const seckey,
267
const char * const pubkey,
268
const char * const tempdir,
269
mandos_context *mc){
247
static bool init_gpgme(const char *seckey, const char *pubkey,
248
const char *tempdir){
270
249
gpgme_error_t rc;
271
250
gpgme_engine_info_t engine_info;
272
251
252
273
253
/*
274
254
* Helper function to insert pub and seckey to the engine keyring.
275
255
*/
276
bool import_key(const char * const filename){
256
bool import_key(const char *filename){
277
257
int ret;
278
258
int fd;
279
259
gpgme_data_t pgp_data;
291
271
return false;
292
272
}
293
273
294
rc = gpgme_op_import(mc->ctx, pgp_data);
274
rc = gpgme_op_import(mc.ctx, pgp_data);
295
275
if(rc != GPG_ERR_NO_ERROR){
296
276
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
297
277
gpgme_strsource(rc), gpgme_strerror(rc));
341
321
}
342
322
343
323
/* Create new GPGME "context" */
344
rc = gpgme_new(&(mc->ctx));
324
rc = gpgme_new(&(mc.ctx));
345
325
if(rc != GPG_ERR_NO_ERROR){
346
326
fprintf_plus(stderr, "Mandos plugin mandos-client: "
347
327
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
360
340
* Decrypt OpenPGP data.
361
341
* Returns -1 on error
362
342
*/
363
__attribute__((nonnull, warn_unused_result))
364
343
static ssize_t pgp_packet_decrypt(const char *cryptotext,
365
344
size_t crypto_size,
366
char **plaintext,
367
mandos_context *mc){
345
char **plaintext){
368
346
gpgme_data_t dh_crypto, dh_plain;
369
347
gpgme_error_t rc;
370
348
ssize_t ret;
396
374
397
375
/* Decrypt data from the cryptotext data buffer to the plaintext
398
376
data buffer */
399
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
377
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
400
378
if(rc != GPG_ERR_NO_ERROR){
401
379
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
402
380
gpgme_strsource(rc), gpgme_strerror(rc));
403
381
plaintext_length = -1;
404
382
if(debug){
405
383
gpgme_decrypt_result_t result;
406
result = gpgme_op_decrypt_result(mc->ctx);
384
result = gpgme_op_decrypt_result(mc.ctx);
407
385
if(result == NULL){
408
386
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
409
387
} else {
486
464
return plaintext_length;
487
465
}
488
466
489
__attribute__((warn_unused_result))
490
static const char *safer_gnutls_strerror(int value){
491
const char *ret = gnutls_strerror(value);
467
static const char * safer_gnutls_strerror(int value){
468
const char *ret = gnutls_strerror(value); /* Spurious warning from
469
-Wunreachable-code */
492
470
if(ret == NULL)
493
471
ret = "(unknown)";
494
472
return ret;
495
473
}
496
474
497
475
/* GnuTLS log function callback */
498
__attribute__((nonnull))
499
476
static void debuggnutls(__attribute__((unused)) int level,
500
477
const char* string){
501
478
fprintf_plus(stderr, "GnuTLS: %s", string);
502
479
}
503
480
504
__attribute__((nonnull, warn_unused_result))
505
481
static int init_gnutls_global(const char *pubkeyfilename,
506
const char *seckeyfilename,
507
mandos_context *mc){
482
const char *seckeyfilename){
508
483
int ret;
509
484
510
485
if(debug){
527
502
}
528
503
529
504
/* OpenPGP credentials */
530
ret = gnutls_certificate_allocate_credentials(&mc->cred);
505
ret = gnutls_certificate_allocate_credentials(&mc.cred);
531
506
if(ret != GNUTLS_E_SUCCESS){
532
507
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
533
508
safer_gnutls_strerror(ret));
543
518
}
544
519
545
520
ret = gnutls_certificate_set_openpgp_key_file
546
(mc->cred, pubkeyfilename, seckeyfilename,
521
(mc.cred, pubkeyfilename, seckeyfilename,
547
522
GNUTLS_OPENPGP_FMT_BASE64);
548
523
if(ret != GNUTLS_E_SUCCESS){
549
524
fprintf_plus(stderr,
555
530
}
556
531
557
532
/* GnuTLS server initialization */
558
ret = gnutls_dh_params_init(&mc->dh_params);
533
ret = gnutls_dh_params_init(&mc.dh_params);
559
534
if(ret != GNUTLS_E_SUCCESS){
560
535
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
561
536
" initialization: %s\n",
562
537
safer_gnutls_strerror(ret));
563
538
goto globalfail;
564
539
}
565
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
566
541
if(ret != GNUTLS_E_SUCCESS){
567
542
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
568
543
safer_gnutls_strerror(ret));
569
544
goto globalfail;
570
545
}
571
546
572
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
547
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
573
548
574
549
return 0;
575
550
576
551
globalfail:
577
552
578
gnutls_certificate_free_credentials(mc->cred);
553
gnutls_certificate_free_credentials(mc.cred);
579
554
gnutls_global_deinit();
580
gnutls_dh_params_deinit(mc->dh_params);
555
gnutls_dh_params_deinit(mc.dh_params);
581
556
return -1;
582
557
}
583
558
584
__attribute__((nonnull, warn_unused_result))
585
static int init_gnutls_session(gnutls_session_t *session,
586
mandos_context *mc){
559
static int init_gnutls_session(gnutls_session_t *session){
587
560
int ret;
588
561
/* GnuTLS session creation */
589
562
do {
601
574
{
602
575
const char *err;
603
576
do {
604
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
577
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
605
578
if(quit_now){
606
579
gnutls_deinit(*session);
607
580
return -1;
618
591
619
592
do {
620
593
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
621
mc->cred);
594
mc.cred);
622
595
if(quit_now){
623
596
gnutls_deinit(*session);
624
597
return -1;
634
607
/* ignore client certificate if any. */
635
608
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
636
609
637
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
610
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
638
611
639
612
return 0;
640
613
}
644
617
__attribute__((unused)) const char *txt){}
645
618
646
619
/* Called when a Mandos server is found */
647
__attribute__((nonnull, warn_unused_result))
648
static int start_mandos_communication(const char *ip, in_port_t port,
620
static int start_mandos_communication(const char *ip, uint16_t port,
649
621
AvahiIfIndex if_index,
650
int af, mandos_context *mc){
622
int af){
651
623
int ret, tcp_sd = -1;
652
624
ssize_t sret;
653
struct sockaddr_storage to;
625
union {
626
struct sockaddr_in in;
627
struct sockaddr_in6 in6;
628
} to;
654
629
char *buffer = NULL;
655
630
char *decrypted_buffer = NULL;
656
631
size_t buffer_length = 0;
680
655
return -1;
681
656
}
682
657
683
/* If the interface is specified and we have a list of interfaces */
684
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
685
/* Check if the interface is one of the interfaces we are using */
686
bool match = false;
687
{
688
char *interface = NULL;
689
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
690
interface))){
691
if(if_nametoindex(interface) == (unsigned int)if_index){
692
match = true;
693
break;
694
}
695
}
696
}
697
if(not match){
698
/* This interface does not match any in the list, so we don't
699
connect to the server */
700
if(debug){
701
char interface[IF_NAMESIZE];
702
if(if_indextoname((unsigned int)if_index, interface) == NULL){
703
perror_plus("if_indextoname");
704
} else {
705
fprintf_plus(stderr, "Skipping server on non-used interface"
706
" \"%s\"\n",
707
if_indextoname((unsigned int)if_index,
708
interface));
709
}
710
}
711
return -1;
712
}
713
}
714
715
ret = init_gnutls_session(&session, mc);
658
ret = init_gnutls_session(&session);
716
659
if(ret != 0){
717
660
return -1;
718
661
}
719
662
720
663
if(debug){
721
664
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
722
PRIuMAX "\n", ip, (uintmax_t)port);
665
PRIu16 "\n", ip, port);
723
666
}
724
667
725
668
tcp_sd = socket(pf, SOCK_STREAM, 0);
737
680
738
681
memset(&to, 0, sizeof(to));
739
682
if(af == AF_INET6){
740
((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;
741
ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);
683
to.in6.sin6_family = (sa_family_t)af;
684
ret = inet_pton(af, ip, &to.in6.sin6_addr);
742
685
} else { /* IPv4 */
743
((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;
744
ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);
686
to.in.sin_family = (sa_family_t)af;
687
ret = inet_pton(af, ip, &to.in.sin_addr);
745
688
}
746
689
if(ret < 0 ){
747
690
int e = errno;
756
699
goto mandos_end;
757
700
}
758
701
if(af == AF_INET6){
759
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
760
if(IN6_IS_ADDR_LINKLOCAL
761
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
702
to.in6.sin6_port = htons(port); /* Spurious warnings from
703
-Wconversion and
704
-Wunreachable-code */
705
706
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
707
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
708
-Wunreachable-code*/
762
709
if(if_index == AVAHI_IF_UNSPEC){
763
710
fprintf_plus(stderr, "An IPv6 link-local address is"
764
711
" incomplete without a network interface\n");
766
713
goto mandos_end;
767
714
}
768
715
/* Set the network interface number as scope */
769
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
716
to.in6.sin6_scope_id = (uint32_t)if_index;
770
717
}
771
718
} else {
772
((struct sockaddr_in *)&to)->sin_port = htons(port);
719
to.in.sin_port = htons(port); /* Spurious warnings from
720
-Wconversion and
721
-Wunreachable-code */
773
722
}
774
723
775
724
if(quit_now){
783
732
if(if_indextoname((unsigned int)if_index, interface) == NULL){
784
733
perror_plus("if_indextoname");
785
734
} else {
786
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
787
"\n", ip, interface, (uintmax_t)port);
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
788
737
}
789
738
} else {
790
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
791
ip, (uintmax_t)port);
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
740
ip, port);
792
741
}
793
742
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
794
743
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
744
const char *pcret;
795
745
if(af == AF_INET6){
796
ret = getnameinfo((struct sockaddr *)&to,
797
sizeof(struct sockaddr_in6),
798
addrstr, sizeof(addrstr), NULL, 0,
799
NI_NUMERICHOST);
746
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
747
sizeof(addrstr));
800
748
} else {
801
ret = getnameinfo((struct sockaddr *)&to,
802
sizeof(struct sockaddr_in),
803
addrstr, sizeof(addrstr), NULL, 0,
804
NI_NUMERICHOST);
749
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
750
sizeof(addrstr));
805
751
}
806
if(ret == EAI_SYSTEM){
807
perror_plus("getnameinfo");
808
} else if(ret != 0) {
809
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
810
} else if(strcmp(addrstr, ip) != 0){
811
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
752
if(pcret == NULL){
753
perror_plus("inet_ntop");
754
} else {
755
if(strcmp(addrstr, ip) != 0){
756
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
757
}
812
758
}
813
759
}
814
760
818
764
}
819
765
820
766
if(af == AF_INET6){
821
ret = connect(tcp_sd, (struct sockaddr *)&to,
822
sizeof(struct sockaddr_in6));
767
ret = connect(tcp_sd, &to.in6, sizeof(to));
823
768
} else {
824
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
825
sizeof(struct sockaddr_in));
769
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
826
770
}
827
771
if(ret < 0){
828
if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
772
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
829
773
int e = errno;
830
774
perror_plus("connect");
831
775
errno = e;
877
821
goto mandos_end;
878
822
}
879
823
880
/* This casting via intptr_t is to eliminate warning about casting
881
an int to a pointer type. This is exactly how the GnuTLS Guile
882
function "set-session-transport-fd!" does it. */
883
gnutls_transport_set_ptr(session,
884
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
824
/* Spurious warning from -Wint-to-pointer-cast */
825
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
885
826
886
827
if(quit_now){
887
828
errno = EINTR;
992
933
if(buffer_length > 0){
993
934
ssize_t decrypted_buffer_size;
994
935
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
995
&decrypted_buffer, mc);
936
&decrypted_buffer);
996
937
if(decrypted_buffer_size >= 0){
997
938
998
939
written = 0;
1046
987
return retval;
1047
988
}
1048
989
1049
__attribute__((nonnull))
1050
990
static void resolve_callback(AvahiSServiceResolver *r,
1051
991
AvahiIfIndex interface,
1052
992
AvahiProtocol proto,
1060
1000
AVAHI_GCC_UNUSED AvahiStringList *txt,
1061
1001
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1062
1002
flags,
1063
void *mc){
1064
if(r == NULL){
1065
return;
1066
}
1003
AVAHI_GCC_UNUSED void* userdata){
1004
assert(r);
1067
1005
1068
1006
/* Called whenever a service has been resolved successfully or
1069
1007
timed out */
1078
1016
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1079
1017
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1080
1018
domain,
1081
avahi_strerror(avahi_server_errno
1082
(((mandos_context*)mc)->server)));
1019
avahi_strerror(avahi_server_errno(mc.server)));
1083
1020
break;
1084
1021
1085
1022
case AVAHI_RESOLVER_FOUND:
1091
1028
PRIdMAX ") on port %" PRIu16 "\n", name,
1092
1029
host_name, ip, (intmax_t)interface, port);
1093
1030
}
1094
int ret = start_mandos_communication(ip, (in_port_t)port,
1095
interface,
1096
avahi_proto_to_af(proto),
1097
mc);
1031
int ret = start_mandos_communication(ip, port, interface,
1032
avahi_proto_to_af(proto));
1098
1033
if(ret == 0){
1099
avahi_simple_poll_quit(simple_poll);
1034
avahi_simple_poll_quit(mc.simple_poll);
1100
1035
} else {
1101
if(not add_server(ip, (in_port_t)port, interface,
1102
avahi_proto_to_af(proto),
1103
&((mandos_context*)mc)->current_server)){
1036
if(not add_server(ip, port, interface,
1037
avahi_proto_to_af(proto))){
1104
1038
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1105
1039
" list\n", name);
1106
1040
}
1119
1053
const char *domain,
1120
1054
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1121
1055
flags,
1122
void *mc){
1123
if(b == NULL){
1124
return;
1125
}
1056
AVAHI_GCC_UNUSED void* userdata){
1057
assert(b);
1126
1058
1127
1059
/* Called whenever a new services becomes available on the LAN or
1128
1060
is removed from the LAN */
1136
1068
case AVAHI_BROWSER_FAILURE:
1137
1069
1138
1070
fprintf_plus(stderr, "(Avahi browser) %s\n",
1139
avahi_strerror(avahi_server_errno
1140
(((mandos_context*)mc)->server)));
1141
avahi_simple_poll_quit(simple_poll);
1071
avahi_strerror(avahi_server_errno(mc.server)));
1072
avahi_simple_poll_quit(mc.simple_poll);
1142
1073
return;
1143
1074
1144
1075
case AVAHI_BROWSER_NEW:
1147
1078
the callback function is called the Avahi server will free the
1148
1079
resolver for us. */
1149
1080
1150
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1151
interface, protocol, name, type,
1152
domain, protocol, 0,
1153
resolve_callback, mc) == NULL)
1081
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1082
name, type, domain, protocol, 0,
1083
resolve_callback, NULL) == NULL)
1154
1084
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1155
1085
" %s\n", name,
1156
avahi_strerror(avahi_server_errno
1157
(((mandos_context*)mc)->server)));
1086
avahi_strerror(avahi_server_errno(mc.server)));
1158
1087
break;
1159
1088
1160
1089
case AVAHI_BROWSER_REMOVE:
1179
1108
signal_received = sig;
1180
1109
int old_errno = errno;
1181
1110
/* set main loop to exit */
1182
if(simple_poll != NULL){
1183
avahi_simple_poll_quit(simple_poll);
1111
if(mc.simple_poll != NULL){
1112
avahi_simple_poll_quit(mc.simple_poll);
1184
1113
}
1185
1114
errno = old_errno;
1186
1115
}
1187
1116
1188
__attribute__((nonnull, warn_unused_result))
1189
1117
bool get_flags(const char *ifname, struct ifreq *ifr){
1190
1118
int ret;
1191
error_t ret_errno;
1192
1119
1193
1120
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1194
1121
if(s < 0){
1195
ret_errno = errno;
1196
1122
perror_plus("socket");
1197
errno = ret_errno;
1198
1123
return false;
1199
1124
}
1200
1125
strcpy(ifr->ifr_name, ifname);
1201
1126
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1202
1127
if(ret == -1){
1203
1128
if(debug){
1204
ret_errno = errno;
1205
1129
perror_plus("ioctl SIOCGIFFLAGS");
1206
errno = ret_errno;
1207
1130
}
1208
1131
return false;
1209
1132
}
1210
1133
return true;
1211
1134
}
1212
1135
1213
__attribute__((nonnull, warn_unused_result))
1214
1136
bool good_flags(const char *ifname, const struct ifreq *ifr){
1215
1137
1216
1138
/* Reject the loopback device */
1258
1180
* corresponds to an acceptable network device.
1259
1181
* (This function is passed to scandir(3) as a filter function.)
1260
1182
*/
1261
__attribute__((nonnull, warn_unused_result))
1262
1183
int good_interface(const struct dirent *if_entry){
1263
1184
if(if_entry->d_name[0] == '.'){
1264
1185
return 0;
1280
1201
}
1281
1202
1282
1203
/*
1283
* This function determines if a network interface is up.
1284
*/
1285
__attribute__((nonnull, warn_unused_result))
1286
bool interface_is_up(const char *interface){
1287
struct ifreq ifr;
1288
if(not get_flags(interface, &ifr)){
1289
if(debug){
1290
fprintf_plus(stderr, "Failed to get flags for interface "
1291
"\"%s\"\n", interface);
1292
}
1293
return false;
1294
}
1295
1296
return (bool)(ifr.ifr_flags & IFF_UP);
1297
}
1298
1299
/*
1300
* This function determines if a network interface is running
1301
*/
1302
__attribute__((nonnull, warn_unused_result))
1303
bool interface_is_running(const char *interface){
1304
struct ifreq ifr;
1305
if(not get_flags(interface, &ifr)){
1306
if(debug){
1307
fprintf_plus(stderr, "Failed to get flags for interface "
1308
"\"%s\"\n", interface);
1309
}
1310
return false;
1311
}
1312
1313
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1314
}
1315
1316
__attribute__((nonnull, pure, warn_unused_result))
1204
* This function determines if a directory entry in /sys/class/net
1205
* corresponds to an acceptable network device which is up.
1206
* (This function is passed to scandir(3) as a filter function.)
1207
*/
1208
int up_interface(const struct dirent *if_entry){
1209
if(if_entry->d_name[0] == '.'){
1210
return 0;
1211
}
1212
1213
struct ifreq ifr;
1214
if(not get_flags(if_entry->d_name, &ifr)){
1215
if(debug){
1216
fprintf_plus(stderr, "Failed to get flags for interface "
1217
"\"%s\"\n", if_entry->d_name);
1218
}
1219
return 0;
1220
}
1221
1222
/* Reject down interfaces */
1223
if(not (ifr.ifr_flags & IFF_UP)){
1224
if(debug){
1225
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1226
if_entry->d_name);
1227
}
1228
return 0;
1229
}
1230
1231
/* Reject non-running interfaces */
1232
if(not (ifr.ifr_flags & IFF_RUNNING)){
1233
if(debug){
1234
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1235
if_entry->d_name);
1236
}
1237
return 0;
1238
}
1239
1240
if(not good_flags(if_entry->d_name, &ifr)){
1241
return 0;
1242
}
1243
return 1;
1244
}
1245
1317
1246
int notdotentries(const struct dirent *direntry){
1318
1247
/* Skip "." and ".." */
1319
1248
if(direntry->d_name[0] == '.'
1326
1255
}
1327
1256
1328
1257
/* Is this directory entry a runnable program? */
1329
__attribute__((nonnull, warn_unused_result))
1330
1258
int runnable_hook(const struct dirent *direntry){
1331
1259
int ret;
1332
1260
size_t sret;
1340
1268
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1341
1269
"abcdefghijklmnopqrstuvwxyz"
1342
1270
"0123456789"
1343
"_.-");
1271
"_-");
1344
1272
if((direntry->d_name)[sret] != '\0'){
1345
1273
/* Contains non-allowed characters */
1346
1274
if(debug){
1350
1278
return 0;
1351
1279
}
1352
1280
1353
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1281
char *fullname = NULL;
1282
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1283
if(ret < 0){
1284
perror_plus("asprintf");
1285
return 0;
1286
}
1287
1288
ret = stat(fullname, &st);
1354
1289
if(ret == -1){
1355
1290
if(debug){
1356
1291
perror_plus("Could not stat hook");
1380
1315
return 1;
1381
1316
}
1382
1317
1383
__attribute__((nonnull, warn_unused_result))
1384
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1385
mandos_context *mc){
1318
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1386
1319
int ret;
1387
1320
struct timespec now;
1388
1321
struct timespec waited_time;
1389
1322
intmax_t block_time;
1390
1323
1391
1324
while(true){
1392
if(mc->current_server == NULL){
1393
if(debug){
1325
if(mc.current_server == NULL){
1326
if (debug){
1394
1327
fprintf_plus(stderr, "Wait until first server is found."
1395
1328
" No timeout!\n");
1396
1329
}
1397
1330
ret = avahi_simple_poll_iterate(s, -1);
1398
1331
} else {
1399
if(debug){
1332
if (debug){
1400
1333
fprintf_plus(stderr, "Check current_server if we should run"
1401
1334
" it, or wait\n");
1402
1335
}
1409
1342
/* Calculating in ms how long time between now and server
1410
1343
who we visted longest time ago. Now - last seen. */
1411
1344
waited_time.tv_sec = (now.tv_sec
1412
- mc->current_server->last_seen.tv_sec);
1345
- mc.current_server->last_seen.tv_sec);
1413
1346
waited_time.tv_nsec = (now.tv_nsec
1414
- mc->current_server->last_seen.tv_nsec);
1347
- mc.current_server->last_seen.tv_nsec);
1415
1348
/* total time is 10s/10,000ms.
1416
1349
Converting to s from ms by dividing by 1,000,
1417
1350
and ns to ms by dividing by 1,000,000. */
1419
1352
- ((intmax_t)waited_time.tv_sec * 1000))
1420
1353
- ((intmax_t)waited_time.tv_nsec / 1000000));
1421
1354
1422
if(debug){
1355
if (debug){
1423
1356
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1424
1357
block_time);
1425
1358
}
1426
1359
1427
1360
if(block_time <= 0){
1428
ret = start_mandos_communication(mc->current_server->ip,
1429
mc->current_server->port,
1430
mc->current_server->if_index,
1431
mc->current_server->af, mc);
1361
ret = start_mandos_communication(mc.current_server->ip,
1362
mc.current_server->port,
1363
mc.current_server->if_index,
1364
mc.current_server->af);
1432
1365
if(ret == 0){
1433
avahi_simple_poll_quit(s);
1366
avahi_simple_poll_quit(mc.simple_poll);
1434
1367
return 0;
1435
1368
}
1436
1369
ret = clock_gettime(CLOCK_MONOTONIC,
1437
&mc->current_server->last_seen);
1370
&mc.current_server->last_seen);
1438
1371
if(ret == -1){
1439
1372
perror_plus("clock_gettime");
1440
1373
return -1;
1441
1374
}
1442
mc->current_server = mc->current_server->next;
1375
mc.current_server = mc.current_server->next;
1443
1376
block_time = 0; /* Call avahi to find new Mandos
1444
1377
servers, but don't block */
1445
1378
}
1447
1380
ret = avahi_simple_poll_iterate(s, (int)block_time);
1448
1381
}
1449
1382
if(ret != 0){
1450
if(ret > 0 or errno != EINTR){
1383
if (ret > 0 or errno != EINTR){
1451
1384
return (ret != 1) ? ret : 0;
1452
1385
}
1453
1386
}
1454
1387
}
1455
1388
}
1456
1389
1457
/* Set effective uid to 0, return errno */
1458
__attribute__((warn_unused_result))
1459
error_t raise_privileges(void){
1460
error_t old_errno = errno;
1461
error_t ret_errno = 0;
1462
if(seteuid(0) == -1){
1463
ret_errno = errno;
1464
}
1465
errno = old_errno;
1466
return ret_errno;
1467
}
1468
1469
/* Set effective and real user ID to 0. Return errno. */
1470
__attribute__((warn_unused_result))
1471
error_t raise_privileges_permanently(void){
1472
error_t old_errno = errno;
1473
error_t ret_errno = raise_privileges();
1474
if(ret_errno != 0){
1475
errno = old_errno;
1476
return ret_errno;
1477
}
1478
if(setuid(0) == -1){
1479
ret_errno = errno;
1480
}
1481
errno = old_errno;
1482
return ret_errno;
1483
}
1484
1485
/* Set effective user ID to unprivileged saved user ID */
1486
__attribute__((warn_unused_result))
1487
error_t lower_privileges(void){
1488
error_t old_errno = errno;
1489
error_t ret_errno = 0;
1490
if(seteuid(uid) == -1){
1491
ret_errno = errno;
1492
}
1493
errno = old_errno;
1494
return ret_errno;
1495
}
1496
1497
/* Lower privileges permanently */
1498
__attribute__((warn_unused_result))
1499
error_t lower_privileges_permanently(void){
1500
error_t old_errno = errno;
1501
error_t ret_errno = 0;
1502
if(setuid(uid) == -1){
1503
ret_errno = errno;
1504
}
1505
errno = old_errno;
1506
return ret_errno;
1507
}
1508
1509
__attribute__((nonnull))
1510
void run_network_hooks(const char *mode, const char *interface,
1390
bool run_network_hooks(const char *mode, const char *interface,
1511
1391
const float delay){
1512
struct dirent **direntries = NULL;
1513
if(hookdir_fd == -1){
1514
hookdir_fd = open(hookdir, O_RDONLY);
1515
if(hookdir_fd == -1){
1516
if(errno == ENOENT){
1517
if(debug){
1518
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1519
" found\n", hookdir);
1520
}
1521
} else {
1522
perror_plus("open");
1523
}
1524
return;
1525
}
1526
}
1527
#ifdef __GLIBC__
1528
#if __GLIBC_PREREQ(2, 15)
1529
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1530
runnable_hook, alphasort);
1531
#else /* not __GLIBC_PREREQ(2, 15) */
1532
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1533
alphasort);
1534
#endif /* not __GLIBC_PREREQ(2, 15) */
1535
#else /* not __GLIBC__ */
1536
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1537
alphasort);
1538
#endif /* not __GLIBC__ */
1392
struct dirent **direntries;
1393
struct dirent *direntry;
1394
int ret;
1395
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1396
alphasort);
1539
1397
if(numhooks == -1){
1540
1398
perror_plus("scandir");
1541
return;
1542
}
1543
struct dirent *direntry;
1544
int ret;
1545
int devnull = open("/dev/null", O_RDONLY);
1546
for(int i = 0; i < numhooks; i++){
1547
direntry = direntries[i];
1548
if(debug){
1549
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1550
direntry->d_name);
1551
}
1552
pid_t hook_pid = fork();
1553
if(hook_pid == 0){
1554
/* Child */
1555
/* Raise privileges */
1556
errno = raise_privileges_permanently();
1557
if(errno != 0){
1558
perror_plus("Failed to raise privileges");
1559
_exit(EX_NOPERM);
1560
}
1561
/* Set group */
1562
errno = 0;
1563
ret = setgid(0);
1564
if(ret == -1){
1565
perror_plus("setgid");
1566
_exit(EX_NOPERM);
1567
}
1568
/* Reset supplementary groups */
1569
errno = 0;
1570
ret = setgroups(0, NULL);
1571
if(ret == -1){
1572
perror_plus("setgroups");
1573
_exit(EX_NOPERM);
1574
}
1575
ret = dup2(devnull, STDIN_FILENO);
1576
if(ret == -1){
1577
perror_plus("dup2(devnull, STDIN_FILENO)");
1578
_exit(EX_OSERR);
1579
}
1580
ret = close(devnull);
1581
if(ret == -1){
1582
perror_plus("close");
1583
_exit(EX_OSERR);
1584
}
1585
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1586
if(ret == -1){
1587
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1588
_exit(EX_OSERR);
1589
}
1590
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1591
if(ret == -1){
1592
perror_plus("setenv");
1593
_exit(EX_OSERR);
1594
}
1595
ret = setenv("DEVICE", interface, 1);
1596
if(ret == -1){
1597
perror_plus("setenv");
1598
_exit(EX_OSERR);
1599
}
1600
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1601
if(ret == -1){
1602
perror_plus("setenv");
1603
_exit(EX_OSERR);
1604
}
1605
ret = setenv("MODE", mode, 1);
1606
if(ret == -1){
1607
perror_plus("setenv");
1608
_exit(EX_OSERR);
1609
}
1610
char *delaystring;
1611
ret = asprintf(&delaystring, "%f", (double)delay);
1612
if(ret == -1){
1399
} else {
1400
int devnull = open("/dev/null", O_RDONLY);
1401
for(int i = 0; i < numhooks; i++){
1402
direntry = direntries[i];
1403
char *fullname = NULL;
1404
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1405
if(ret < 0){
1613
1406
perror_plus("asprintf");
1614
_exit(EX_OSERR);
1615
}
1616
ret = setenv("DELAY", delaystring, 1);
1617
if(ret == -1){
1407
continue;
1408
}
1409
if(debug){
1410
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1411
direntry->d_name);
1412
}
1413
pid_t hook_pid = fork();
1414
if(hook_pid == 0){
1415
/* Child */
1416
/* Raise privileges */
1417
errno = 0;
1418
ret = seteuid(0);
1419
if(ret == -1){
1420
perror_plus("seteuid");
1421
}
1422
/* Raise privileges even more */
1423
errno = 0;
1424
ret = setuid(0);
1425
if(ret == -1){
1426
perror_plus("setuid");
1427
}
1428
/* Set group */
1429
errno = 0;
1430
ret = setgid(0);
1431
if(ret == -1){
1432
perror_plus("setgid");
1433
}
1434
/* Reset supplementary groups */
1435
errno = 0;
1436
ret = setgroups(0, NULL);
1437
if(ret == -1){
1438
perror_plus("setgroups");
1439
}
1440
dup2(devnull, STDIN_FILENO);
1441
close(devnull);
1442
dup2(STDERR_FILENO, STDOUT_FILENO);
1443
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1444
if(ret == -1){
1445
perror_plus("setenv");
1446
_exit(EX_OSERR);
1447
}
1448
ret = setenv("DEVICE", interface, 1);
1449
if(ret == -1){
1450
perror_plus("setenv");
1451
_exit(EX_OSERR);
1452
}
1453
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1454
if(ret == -1){
1455
perror_plus("setenv");
1456
_exit(EX_OSERR);
1457
}
1458
ret = setenv("MODE", mode, 1);
1459
if(ret == -1){
1460
perror_plus("setenv");
1461
_exit(EX_OSERR);
1462
}
1463
char *delaystring;
1464
ret = asprintf(&delaystring, "%f", delay);
1465
if(ret == -1){
1466
perror_plus("asprintf");
1467
_exit(EX_OSERR);
1468
}
1469
ret = setenv("DELAY", delaystring, 1);
1470
if(ret == -1){
1471
free(delaystring);
1472
perror_plus("setenv");
1473
_exit(EX_OSERR);
1474
}
1618
1475
free(delaystring);
1619
perror_plus("setenv");
1620
_exit(EX_OSERR);
1621
}
1622
free(delaystring);
1623
if(connect_to != NULL){
1624
ret = setenv("CONNECT", connect_to, 1);
1625
if(ret == -1){
1626
perror_plus("setenv");
1627
_exit(EX_OSERR);
1628
}
1629
}
1630
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1631
if(hook_fd == -1){
1632
perror_plus("openat");
1633
_exit(EXIT_FAILURE);
1634
}
1635
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1636
perror_plus("close");
1637
_exit(EXIT_FAILURE);
1638
}
1639
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1640
environ) == -1){
1641
perror_plus("fexecve");
1642
_exit(EXIT_FAILURE);
1643
}
1644
} else {
1645
int status;
1646
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1647
perror_plus("waitpid");
1648
continue;
1649
}
1650
if(WIFEXITED(status)){
1651
if(WEXITSTATUS(status) != 0){
1652
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1653
" with status %d\n", direntry->d_name,
1654
WEXITSTATUS(status));
1655
continue;
1656
}
1657
} else if(WIFSIGNALED(status)){
1658
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1659
" signal %d\n", direntry->d_name,
1660
WTERMSIG(status));
1661
continue;
1662
} else {
1663
fprintf_plus(stderr, "Warning: network hook \"%s\""
1664
" crashed\n", direntry->d_name);
1665
continue;
1666
}
1667
}
1668
if(debug){
1669
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1670
direntry->d_name);
1671
}
1672
}
1673
free(direntries);
1674
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1675
perror_plus("close");
1676
} else {
1677
hookdir_fd = -1;
1678
}
1679
close(devnull);
1680
}
1681
1682
__attribute__((nonnull, warn_unused_result))
1683
error_t bring_up_interface(const char *const interface,
1684
const float delay){
1685
error_t old_errno = errno;
1686
int ret;
1687
struct ifreq network;
1688
unsigned int if_index = if_nametoindex(interface);
1689
if(if_index == 0){
1690
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1691
errno = old_errno;
1692
return ENXIO;
1693
}
1694
1695
if(quit_now){
1696
errno = old_errno;
1697
return EINTR;
1698
}
1699
1700
if(not interface_is_up(interface)){
1701
error_t ret_errno = 0, ioctl_errno = 0;
1702
if(not get_flags(interface, &network)){
1703
ret_errno = errno;
1704
fprintf_plus(stderr, "Failed to get flags for interface "
1705
"\"%s\"\n", interface);
1706
errno = old_errno;
1707
return ret_errno;
1708
}
1709
network.ifr_flags |= IFF_UP; /* set flag */
1710
1711
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1712
if(sd == -1){
1713
ret_errno = errno;
1714
perror_plus("socket");
1715
errno = old_errno;
1716
return ret_errno;
1717
}
1718
1719
if(quit_now){
1720
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1721
if(ret == -1){
1722
perror_plus("close");
1723
}
1724
errno = old_errno;
1725
return EINTR;
1726
}
1727
1728
if(debug){
1729
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
1730
interface);
1731
}
1732
1733
/* Raise privileges */
1734
ret_errno = raise_privileges();
1735
if(ret_errno != 0){
1736
errno = ret_errno;
1737
perror_plus("Failed to raise privileges");
1738
}
1739
1740
#ifdef __linux__
1741
int ret_linux;
1742
bool restore_loglevel = false;
1743
if(ret_errno == 0){
1744
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1745
messages about the network interface to mess up the prompt */
1746
ret_linux = klogctl(8, NULL, 5);
1747
if(ret_linux == -1){
1748
perror_plus("klogctl");
1749
} else {
1750
restore_loglevel = true;
1751
}
1752
}
1753
#endif /* __linux__ */
1754
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1755
ioctl_errno = errno;
1756
#ifdef __linux__
1757
if(restore_loglevel){
1758
ret_linux = klogctl(7, NULL, 0);
1759
if(ret_linux == -1){
1760
perror_plus("klogctl");
1761
}
1762
}
1763
#endif /* __linux__ */
1764
1765
/* If raise_privileges() succeeded above */
1766
if(ret_errno == 0){
1767
/* Lower privileges */
1768
ret_errno = lower_privileges();
1769
if(ret_errno != 0){
1770
errno = ret_errno;
1771
perror_plus("Failed to lower privileges");
1772
}
1773
}
1774
1775
/* Close the socket */
1776
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1777
if(ret == -1){
1778
perror_plus("close");
1779
}
1780
1781
if(ret_setflags == -1){
1782
errno = ioctl_errno;
1783
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1784
errno = old_errno;
1785
return ioctl_errno;
1786
}
1787
} else if(debug){
1788
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1789
interface);
1790
}
1791
1792
/* Sleep checking until interface is running.
1793
Check every 0.25s, up to total time of delay */
1794
for(int i=0; i < delay * 4; i++){
1795
if(interface_is_running(interface)){
1796
break;
1797
}
1798
struct timespec sleeptime = { .tv_nsec = 250000000 };
1799
ret = nanosleep(&sleeptime, NULL);
1800
if(ret == -1 and errno != EINTR){
1801
perror_plus("nanosleep");
1802
}
1803
}
1804
1805
errno = old_errno;
1806
return 0;
1807
}
1808
1809
__attribute__((nonnull, warn_unused_result))
1810
error_t take_down_interface(const char *const interface){
1811
error_t old_errno = errno;
1812
struct ifreq network;
1813
unsigned int if_index = if_nametoindex(interface);
1814
if(if_index == 0){
1815
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1816
errno = old_errno;
1817
return ENXIO;
1818
}
1819
if(interface_is_up(interface)){
1820
error_t ret_errno = 0, ioctl_errno = 0;
1821
if(not get_flags(interface, &network) and debug){
1822
ret_errno = errno;
1823
fprintf_plus(stderr, "Failed to get flags for interface "
1824
"\"%s\"\n", interface);
1825
errno = old_errno;
1826
return ret_errno;
1827
}
1828
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1829
1830
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1831
if(sd == -1){
1832
ret_errno = errno;
1833
perror_plus("socket");
1834
errno = old_errno;
1835
return ret_errno;
1836
}
1837
1838
if(debug){
1839
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
1840
interface);
1841
}
1842
1843
/* Raise privileges */
1844
ret_errno = raise_privileges();
1845
if(ret_errno != 0){
1846
errno = ret_errno;
1847
perror_plus("Failed to raise privileges");
1848
}
1849
1850
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1851
ioctl_errno = errno;
1852
1853
/* If raise_privileges() succeeded above */
1854
if(ret_errno == 0){
1855
/* Lower privileges */
1856
ret_errno = lower_privileges();
1857
if(ret_errno != 0){
1858
errno = ret_errno;
1859
perror_plus("Failed to lower privileges");
1860
}
1861
}
1862
1863
/* Close the socket */
1864
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1865
if(ret == -1){
1866
perror_plus("close");
1867
}
1868
1869
if(ret_setflags == -1){
1870
errno = ioctl_errno;
1871
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1872
errno = old_errno;
1873
return ioctl_errno;
1874
}
1875
} else if(debug){
1876
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1877
interface);
1878
}
1879
1880
errno = old_errno;
1881
return 0;
1476
if(connect_to != NULL){
1477
ret = setenv("CONNECT", connect_to, 1);
1478
if(ret == -1){
1479
perror_plus("setenv");
1480
_exit(EX_OSERR);
1481
}
1482
}
1483
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1484
perror_plus("execl");
1485
_exit(EXIT_FAILURE);
1486
}
1487
} else {
1488
int status;
1489
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1490
perror_plus("waitpid");
1491
free(fullname);
1492
continue;
1493
}
1494
if(WIFEXITED(status)){
1495
if(WEXITSTATUS(status) != 0){
1496
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1497
" with status %d\n", direntry->d_name,
1498
WEXITSTATUS(status));
1499
free(fullname);
1500
continue;
1501
}
1502
} else if(WIFSIGNALED(status)){
1503
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1504
" signal %d\n", direntry->d_name,
1505
WTERMSIG(status));
1506
free(fullname);
1507
continue;
1508
} else {
1509
fprintf_plus(stderr, "Warning: network hook \"%s\""
1510
" crashed\n", direntry->d_name);
1511
free(fullname);
1512
continue;
1513
}
1514
}
1515
free(fullname);
1516
if(debug){
1517
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1518
direntry->d_name);
1519
}
1520
}
1521
close(devnull);
1522
}
1523
return true;
1882
1524
}
1883
1525
1884
1526
int main(int argc, char *argv[]){
1885
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1886
.priority = "SECURE256:!CTYPE-X.509:"
1887
"+CTYPE-OPENPGP", .current_server = NULL,
1888
.interfaces = NULL, .interfaces_size = 0 };
1889
1527
AvahiSServiceBrowser *sb = NULL;
1890
error_t ret_errno;
1528
int error;
1891
1529
int ret;
1892
1530
intmax_t tmpmax;
1893
1531
char *tmp;
1894
1532
int exitcode = EXIT_SUCCESS;
1895
char *interfaces_to_take_down = NULL;
1896
size_t interfaces_to_take_down_size = 0;
1897
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
1898
char old_tempdir[] = "/tmp/mandosXXXXXX";
1899
char *tempdir = NULL;
1533
const char *interface = "";
1534
struct ifreq network;
1535
int sd = -1;
1536
bool take_down_interface = false;
1537
uid_t uid;
1538
gid_t gid;
1539
char tempdir[] = "/tmp/mandosXXXXXX";
1540
bool tempdir_created = false;
1900
1541
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1901
1542
const char *seckey = PATHDIR "/" SECKEY;
1902
1543
const char *pubkey = PATHDIR "/" PUBKEY;
1903
char *interfaces_hooks = NULL;
1904
1544
1905
1545
bool gnutls_initialized = false;
1906
1546
bool gpgme_initialized = false;
1997
1637
connect_to = arg;
1998
1638
break;
1999
1639
case 'i': /* --interface */
2000
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
2001
arg, (int)',');
2002
if(ret_errno != 0){
2003
argp_error(state, "%s", strerror(ret_errno));
2004
}
1640
interface = arg;
2005
1641
break;
2006
1642
case 's': /* --seckey */
2007
1643
seckey = arg;
2084
1720
/* Work around Debian bug #633582:
2085
1721
<http://bugs.debian.org/633582> */
2086
1722
2087
/* Re-raise privileges */
2088
ret_errno = raise_privileges();
2089
if(ret_errno != 0){
2090
errno = ret_errno;
2091
perror_plus("Failed to raise privileges");
1723
/* Re-raise priviliges */
1724
errno = 0;
1725
ret = seteuid(0);
1726
if(ret == -1){
1727
perror_plus("seteuid");
2092
1728
} else {
2093
1729
struct stat st;
2094
1730
2135
1771
}
2136
1772
2137
1773
/* Lower privileges */
2138
ret_errno = lower_privileges();
2139
if(ret_errno != 0){
2140
errno = ret_errno;
2141
perror_plus("Failed to lower privileges");
2142
}
2143
}
2144
}
2145
2146
/* Remove invalid interface names (except "none") */
2147
{
2148
char *interface = NULL;
2149
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2150
interface))){
2151
if(strcmp(interface, "none") != 0
2152
and if_nametoindex(interface) == 0){
2153
if(interface[0] != '\0'){
2154
fprintf_plus(stderr, "Not using nonexisting interface"
2155
" \"%s\"\n", interface);
2156
}
2157
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2158
interface = NULL;
1774
errno = 0;
1775
ret = seteuid(uid);
1776
if(ret == -1){
1777
perror_plus("seteuid");
2159
1778
}
2160
1779
}
2161
1780
}
2162
1781
2163
1782
/* Run network hooks */
2164
{
2165
if(mc.interfaces != NULL){
2166
interfaces_hooks = malloc(mc.interfaces_size);
2167
if(interfaces_hooks == NULL){
2168
perror_plus("malloc");
2169
goto end;
2170
}
2171
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2172
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2173
}
2174
run_network_hooks("start", interfaces_hooks != NULL ?
2175
interfaces_hooks : "", delay);
1783
if(not run_network_hooks("start", interface, delay)){
1784
goto end;
2176
1785
}
2177
1786
2178
1787
if(not debug){
2179
1788
avahi_set_log_function(empty_log);
2180
1789
}
2181
1790
1791
if(interface[0] == '\0'){
1792
struct dirent **direntries;
1793
/* First look for interfaces that are up */
1794
ret = scandir(sys_class_net, &direntries, up_interface,
1795
alphasort);
1796
if(ret == 0){
1797
/* No up interfaces, look for any good interfaces */
1798
free(direntries);
1799
ret = scandir(sys_class_net, &direntries, good_interface,
1800
alphasort);
1801
}
1802
if(ret >= 1){
1803
/* Pick the first interface returned */
1804
interface = strdup(direntries[0]->d_name);
1805
if(debug){
1806
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1807
}
1808
if(interface == NULL){
1809
perror_plus("malloc");
1810
free(direntries);
1811
exitcode = EXIT_FAILURE;
1812
goto end;
1813
}
1814
free(direntries);
1815
} else {
1816
free(direntries);
1817
fprintf_plus(stderr, "Could not find a network interface\n");
1818
exitcode = EXIT_FAILURE;
1819
goto end;
1820
}
1821
}
1822
2182
1823
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
2183
1824
from the signal handler */
2184
1825
/* Initialize the pseudo-RNG for Avahi */
2185
1826
srand((unsigned int) time(NULL));
2186
simple_poll = avahi_simple_poll_new();
2187
if(simple_poll == NULL){
1827
mc.simple_poll = avahi_simple_poll_new();
1828
if(mc.simple_poll == NULL){
2188
1829
fprintf_plus(stderr,
2189
1830
"Avahi: Failed to create simple poll object.\n");
2190
1831
exitcode = EX_UNAVAILABLE;
2254
1895
}
2255
1896
}
2256
1897
2257
/* If no interfaces were specified, make a list */
2258
if(mc.interfaces == NULL){
2259
struct dirent **direntries = NULL;
2260
/* Look for any good interfaces */
2261
ret = scandir(sys_class_net, &direntries, good_interface,
2262
alphasort);
2263
if(ret >= 1){
2264
/* Add all found interfaces to interfaces list */
2265
for(int i = 0; i < ret; ++i){
2266
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2267
direntries[i]->d_name);
2268
if(ret_errno != 0){
2269
errno = ret_errno;
2270
perror_plus("argz_add");
2271
continue;
2272
}
2273
if(debug){
2274
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2275
direntries[i]->d_name);
2276
}
2277
}
2278
free(direntries);
2279
} else {
2280
if(ret == 0){
2281
free(direntries);
2282
}
2283
fprintf_plus(stderr, "Could not find a network interface\n");
2284
exitcode = EXIT_FAILURE;
2285
goto end;
2286
}
2287
}
2288
2289
/* Bring up interfaces which are down, and remove any "none"s */
2290
{
2291
char *interface = NULL;
2292
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2293
interface))){
2294
/* If interface name is "none", stop bringing up interfaces.
2295
Also remove all instances of "none" from the list */
2296
if(strcmp(interface, "none") == 0){
2297
argz_delete(&mc.interfaces, &mc.interfaces_size,
2298
interface);
2299
interface = NULL;
2300
while((interface = argz_next(mc.interfaces,
2301
mc.interfaces_size, interface))){
2302
if(strcmp(interface, "none") == 0){
2303
argz_delete(&mc.interfaces, &mc.interfaces_size,
2304
interface);
2305
interface = NULL;
1898
/* If the interface is down, bring it up */
1899
if(strcmp(interface, "none") != 0){
1900
if_index = (AvahiIfIndex) if_nametoindex(interface);
1901
if(if_index == 0){
1902
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1903
exitcode = EX_UNAVAILABLE;
1904
goto end;
1905
}
1906
1907
if(quit_now){
1908
goto end;
1909
}
1910
1911
/* Re-raise priviliges */
1912
errno = 0;
1913
ret = seteuid(0);
1914
if(ret == -1){
1915
perror_plus("seteuid");
1916
}
1917
1918
#ifdef __linux__
1919
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1920
messages about the network interface to mess up the prompt */
1921
ret = klogctl(8, NULL, 5);
1922
bool restore_loglevel = true;
1923
if(ret == -1){
1924
restore_loglevel = false;
1925
perror_plus("klogctl");
1926
}
1927
#endif /* __linux__ */
1928
1929
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1930
if(sd < 0){
1931
perror_plus("socket");
1932
exitcode = EX_OSERR;
1933
#ifdef __linux__
1934
if(restore_loglevel){
1935
ret = klogctl(7, NULL, 0);
1936
if(ret == -1){
1937
perror_plus("klogctl");
1938
}
1939
}
1940
#endif /* __linux__ */
1941
/* Lower privileges */
1942
errno = 0;
1943
ret = seteuid(uid);
1944
if(ret == -1){
1945
perror_plus("seteuid");
1946
}
1947
goto end;
1948
}
1949
strcpy(network.ifr_name, interface);
1950
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1951
if(ret == -1){
1952
perror_plus("ioctl SIOCGIFFLAGS");
1953
#ifdef __linux__
1954
if(restore_loglevel){
1955
ret = klogctl(7, NULL, 0);
1956
if(ret == -1){
1957
perror_plus("klogctl");
1958
}
1959
}
1960
#endif /* __linux__ */
1961
exitcode = EX_OSERR;
1962
/* Lower privileges */
1963
errno = 0;
1964
ret = seteuid(uid);
1965
if(ret == -1){
1966
perror_plus("seteuid");
1967
}
1968
goto end;
1969
}
1970
if((network.ifr_flags & IFF_UP) == 0){
1971
network.ifr_flags |= IFF_UP;
1972
take_down_interface = true;
1973
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1974
if(ret == -1){
1975
take_down_interface = false;
1976
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1977
exitcode = EX_OSERR;
1978
#ifdef __linux__
1979
if(restore_loglevel){
1980
ret = klogctl(7, NULL, 0);
1981
if(ret == -1){
1982
perror_plus("klogctl");
2306
1983
}
2307
1984
}
1985
#endif /* __linux__ */
1986
/* Lower privileges */
1987
errno = 0;
1988
ret = seteuid(uid);
1989
if(ret == -1){
1990
perror_plus("seteuid");
1991
}
1992
goto end;
1993
}
1994
}
1995
/* Sleep checking until interface is running.
1996
Check every 0.25s, up to total time of delay */
1997
for(int i=0; i < delay * 4; i++){
1998
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1999
if(ret == -1){
2000
perror_plus("ioctl SIOCGIFFLAGS");
2001
} else if(network.ifr_flags & IFF_RUNNING){
2308
2002
break;
2309
2003
}
2310
bool interface_was_up = interface_is_up(interface);
2311
errno = bring_up_interface(interface, delay);
2312
if(not interface_was_up){
2313
if(errno != 0){
2314
perror_plus("Failed to bring up interface");
2315
} else {
2316
errno = argz_add(&interfaces_to_take_down,
2317
&interfaces_to_take_down_size,
2318
interface);
2319
if(errno != 0){
2320
perror_plus("argz_add");
2321
}
2322
}
2323
}
2324
}
2325
if(debug and (interfaces_to_take_down == NULL)){
2326
fprintf_plus(stderr, "No interfaces were brought up\n");
2327
}
2328
}
2329
2330
/* If we only got one interface, explicitly use only that one */
2331
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2332
if(debug){
2333
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2334
mc.interfaces);
2335
}
2336
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2004
struct timespec sleeptime = { .tv_nsec = 250000000 };
2005
ret = nanosleep(&sleeptime, NULL);
2006
if(ret == -1 and errno != EINTR){
2007
perror_plus("nanosleep");
2008
}
2009
}
2010
if(not take_down_interface){
2011
/* We won't need the socket anymore */
2012
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2013
if(ret == -1){
2014
perror_plus("close");
2015
}
2016
}
2017
#ifdef __linux__
2018
if(restore_loglevel){
2019
/* Restores kernel loglevel to default */
2020
ret = klogctl(7, NULL, 0);
2021
if(ret == -1){
2022
perror_plus("klogctl");
2023
}
2024
}
2025
#endif /* __linux__ */
2026
/* Lower privileges */
2027
errno = 0;
2028
/* Lower privileges */
2029
ret = seteuid(uid);
2030
if(ret == -1){
2031
perror_plus("seteuid");
2032
}
2337
2033
}
2338
2034
2339
2035
if(quit_now){
2340
2036
goto end;
2341
2037
}
2342
2038
2343
ret = init_gnutls_global(pubkey, seckey, &mc);
2039
ret = init_gnutls_global(pubkey, seckey);
2344
2040
if(ret == -1){
2345
2041
fprintf_plus(stderr, "init_gnutls_global failed\n");
2346
2042
exitcode = EX_UNAVAILABLE;
2353
2049
goto end;
2354
2050
}
2355
2051
2356
/* Try /run/tmp before /tmp */
2357
tempdir = mkdtemp(run_tempdir);
2358
if(tempdir == NULL and errno == ENOENT){
2359
if(debug){
2360
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2361
run_tempdir, old_tempdir);
2362
}
2363
tempdir = mkdtemp(old_tempdir);
2364
}
2365
if(tempdir == NULL){
2052
if(mkdtemp(tempdir) == NULL){
2366
2053
perror_plus("mkdtemp");
2367
2054
goto end;
2368
2055
}
2056
tempdir_created = true;
2369
2057
2370
2058
if(quit_now){
2371
2059
goto end;
2372
2060
}
2373
2061
2374
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2062
if(not init_gpgme(pubkey, seckey, tempdir)){
2375
2063
fprintf_plus(stderr, "init_gpgme failed\n");
2376
2064
exitcode = EX_UNAVAILABLE;
2377
2065
goto end;
2387
2075
/* Connect directly, do not use Zeroconf */
2388
2076
/* (Mainly meant for debugging) */
2389
2077
char *address = strrchr(connect_to, ':');
2390
2391
2078
if(address == NULL){
2392
2079
fprintf_plus(stderr, "No colon in address\n");
2393
2080
exitcode = EX_USAGE;
2398
2085
goto end;
2399
2086
}
2400
2087
2401
in_port_t port;
2088
uint16_t port;
2402
2089
errno = 0;
2403
2090
tmpmax = strtoimax(address+1, &tmp, 10);
2404
2091
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2405
or tmpmax != (in_port_t)tmpmax){
2092
or tmpmax != (uint16_t)tmpmax){
2406
2093
fprintf_plus(stderr, "Bad port number\n");
2407
2094
exitcode = EX_USAGE;
2408
2095
goto end;
2409
2096
}
2410
2097
2411
2098
if(quit_now){
2412
2099
goto end;
2413
2100
}
2414
2101
2415
port = (in_port_t)tmpmax;
2102
port = (uint16_t)tmpmax;
2416
2103
*address = '\0';
2417
2104
/* Colon in address indicates IPv6 */
2418
2105
int af;
2434
2121
}
2435
2122
2436
2123
while(not quit_now){
2437
ret = start_mandos_communication(address, port, if_index, af,
2438
&mc);
2124
ret = start_mandos_communication(address, port, if_index, af);
2439
2125
if(quit_now or ret == 0){
2440
2126
break;
2441
2127
}
2443
2129
fprintf_plus(stderr, "Retrying in %d seconds\n",
2444
2130
(int)retry_interval);
2445
2131
}
2446
sleep((unsigned int)retry_interval);
2132
sleep((int)retry_interval);
2447
2133
}
2448
2134
2449
if(not quit_now){
2135
if (not quit_now){
2450
2136
exitcode = EXIT_SUCCESS;
2451
2137
}
2452
2138
2467
2153
config.publish_domain = 0;
2468
2154
2469
2155
/* Allocate a new server */
2470
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2471
&config, NULL, NULL, &ret_errno);
2156
mc.server = avahi_server_new(avahi_simple_poll_get
2157
(mc.simple_poll), &config, NULL,
2158
NULL, &error);
2472
2159
2473
2160
/* Free the Avahi configuration data */
2474
2161
avahi_server_config_free(&config);
2477
2164
/* Check if creating the Avahi server object succeeded */
2478
2165
if(mc.server == NULL){
2479
2166
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2480
avahi_strerror(ret_errno));
2167
avahi_strerror(error));
2481
2168
exitcode = EX_UNAVAILABLE;
2482
2169
goto end;
2483
2170
}
2489
2176
/* Create the Avahi service browser */
2490
2177
sb = avahi_s_service_browser_new(mc.server, if_index,
2491
2178
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2492
NULL, 0, browse_callback,
2493
(void *)&mc);
2179
NULL, 0, browse_callback, NULL);
2494
2180
if(sb == NULL){
2495
2181
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2496
2182
avahi_strerror(avahi_server_errno(mc.server)));
2507
2193
if(debug){
2508
2194
fprintf_plus(stderr, "Starting Avahi loop search\n");
2509
2195
}
2510
2511
ret = avahi_loop_with_timeout(simple_poll,
2512
(int)(retry_interval * 1000), &mc);
2196
2197
ret = avahi_loop_with_timeout(mc.simple_poll,
2198
(int)(retry_interval * 1000));
2513
2199
if(debug){
2514
2200
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2515
2201
(ret == 0) ? "successfully" : "with error");
2522
2208
}
2523
2209
2524
2210
/* Cleanup things */
2525
free(mc.interfaces);
2526
2527
2211
if(sb != NULL)
2528
2212
avahi_s_service_browser_free(sb);
2529
2213
2530
2214
if(mc.server != NULL)
2531
2215
avahi_server_free(mc.server);
2532
2216
2533
if(simple_poll != NULL)
2534
avahi_simple_poll_free(simple_poll);
2217
if(mc.simple_poll != NULL)
2218
avahi_simple_poll_free(mc.simple_poll);
2535
2219
2536
2220
if(gnutls_initialized){
2537
2221
gnutls_certificate_free_credentials(mc.cred);
2554
2238
}
2555
2239
}
2556
2240
2557
/* Re-raise privileges */
2241
/* Run network hooks */
2242
run_network_hooks("stop", interface, delay);
2243
2244
/* Re-raise priviliges */
2558
2245
{
2559
ret_errno = raise_privileges();
2560
if(ret_errno != 0){
2561
errno = ret_errno;
2562
perror_plus("Failed to raise privileges");
2563
} else {
2564
2565
/* Run network hooks */
2566
run_network_hooks("stop", interfaces_hooks != NULL ?
2567
interfaces_hooks : "", delay);
2568
2569
/* Take down the network interfaces which were brought up */
2570
{
2571
char *interface = NULL;
2572
while((interface=argz_next(interfaces_to_take_down,
2573
interfaces_to_take_down_size,
2574
interface))){
2575
ret_errno = take_down_interface(interface);
2576
if(ret_errno != 0){
2577
errno = ret_errno;
2578
perror_plus("Failed to take down interface");
2579
}
2580
}
2581
if(debug and (interfaces_to_take_down == NULL)){
2582
fprintf_plus(stderr, "No interfaces needed to be taken"
2583
" down\n");
2584
}
2585
}
2246
errno = 0;
2247
ret = seteuid(0);
2248
if(ret == -1){
2249
perror_plus("seteuid");
2586
2250
}
2587
2251
2588
ret_errno = lower_privileges_permanently();
2589
if(ret_errno != 0){
2590
errno = ret_errno;
2591
perror_plus("Failed to lower privileges permanently");
2252
/* Take down the network interface */
2253
if(take_down_interface and geteuid() == 0){
2254
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2255
if(ret == -1){
2256
perror_plus("ioctl SIOCGIFFLAGS");
2257
} else if(network.ifr_flags & IFF_UP){
2258
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2259
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2260
if(ret == -1){
2261
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2262
}
2263
}
2264
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2265
if(ret == -1){
2266
perror_plus("close");
2267
}
2592
2268
}
2593
2269
}
2594
2595
free(interfaces_to_take_down);
2596
free(interfaces_hooks);
2270
/* Lower privileges permanently */
2271
errno = 0;
2272
ret = setuid(uid);
2273
if(ret == -1){
2274
perror_plus("setuid");
2275
}
2597
2276
2598
2277
/* Removes the GPGME temp directory and all files inside */
2599
if(tempdir != NULL){
2278
if(tempdir_created){
2600
2279
struct dirent **direntries = NULL;
2601
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2602
O_NOFOLLOW));
2603
if(tempdir_fd == -1){
2604
perror_plus("open");
2605
} else {
2606
#ifdef __GLIBC__
2607
#if __GLIBC_PREREQ(2, 15)
2608
int numentries = scandirat(tempdir_fd, ".", &direntries,
2609
notdotentries, alphasort);
2610
#else /* not __GLIBC_PREREQ(2, 15) */
2611
int numentries = scandir(tempdir, &direntries, notdotentries,
2612
alphasort);
2613
#endif /* not __GLIBC_PREREQ(2, 15) */
2614
#else /* not __GLIBC__ */
2615
int numentries = scandir(tempdir, &direntries, notdotentries,
2616
alphasort);
2617
#endif /* not __GLIBC__ */
2618
if(numentries >= 0){
2619
for(int i = 0; i < numentries; i++){
2620
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2621
if(ret == -1){
2622
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2623
" \"%s\", 0): %s\n", tempdir,
2624
direntries[i]->d_name, strerror(errno));
2625
}
2626
}
2627
2628
/* need to clean even if 0 because man page doesn't specify */
2629
free(direntries);
2630
if(numentries == -1){
2631
perror_plus("scandir");
2632
}
2633
ret = rmdir(tempdir);
2634
if(ret == -1 and errno != ENOENT){
2635
perror_plus("rmdir");
2636
}
2280
struct dirent *direntry = NULL;
2281
int numentries = scandir(tempdir, &direntries, notdotentries,
2282
alphasort);
2283
if (numentries > 0){
2284
for(int i = 0; i < numentries; i++){
2285
direntry = direntries[i];
2286
char *fullname = NULL;
2287
ret = asprintf(&fullname, "%s/%s", tempdir,
2288
direntry->d_name);
2289
if(ret < 0){
2290
perror_plus("asprintf");
2291
continue;
2292
}
2293
ret = remove(fullname);
2294
if(ret == -1){
2295
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2296
strerror(errno));
2297
}
2298
free(fullname);
2637
2299
}
2638
TEMP_FAILURE_RETRY(close(tempdir_fd));
2300
}
2301
2302
/* need to clean even if 0 because man page doesn't specify */
2303
free(direntries);
2304
if (numentries == -1){
2305
perror_plus("scandir");
2306
}
2307
ret = rmdir(tempdir);
2308
if(ret == -1 and errno != ENOENT){
2309
perror_plus("rmdir");
2639
2310
}
2640
2311
}
2641
2312
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0