To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 591
- compare with another revision
- download diff
- download tarball
- view history from revision 591
- Committer: Teddy Hogeborn
- Date: 2012-05-26 22:56:38 UTC
- mfrom: (589.1.1 socket-option)
- Revision ID: teddy@recompile.se-20120526225638-4hvqyrvmj0036lfn
Merge "--socket" option for server.
This is suggested by the GNU Coding Standards' Table of Long Options,
and will probably also allow socket activation (e.g. by systemd(8)).
This is suggested by the GNU Coding Standards' Table of Long Options,
and will probably also allow socket activation (e.g. by systemd(8)).
- files removed:
- debian/mandos-client.examples
- debian/upstream
- files modified:
- INSTALL
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2014 Teddy Hogeborn
13
* Copyright © 2008-2014 Björn Påhlsson
12
* Copyright © 2008-2012 Teddy Hogeborn
13
* Copyright © 2008-2012 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
33
#ifndef _LARGEFILE_SOURCE
34
34
#define _LARGEFILE_SOURCE
35
#endif /* not _LARGEFILE_SOURCE */
35
#endif
36
36
#ifndef _FILE_OFFSET_BITS
37
37
#define _FILE_OFFSET_BITS 64
38
#endif /* not _FILE_OFFSET_BITS */
38
#endif
39
39
40
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
41
42
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror() */
43
stdout, ferror(), remove() */
44
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
55
55
opendir(), DIR */
56
56
#include <sys/stat.h> /* open(), S_ISREG */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect(),
59
getnameinfo() */
60
#include <fcntl.h> /* open(), unlinkat() */
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
61
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
62
61
*/
63
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
64
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
65
#include <errno.h> /* perror(), errno,
66
66
program_invocation_short_name */
67
67
#include <time.h> /* nanosleep(), time(), sleep() */
73
73
*/
74
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
75
75
getuid(), getgid(), seteuid(),
76
setgid(), pause(), _exit(),
77
unlinkat() */
78
#include <arpa/inet.h> /* inet_pton(), htons() */
76
setgid(), pause(), _exit() */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
79
78
#include <iso646.h> /* not, or, and */
80
79
#include <argp.h> /* struct argp_option, error_t, struct
81
80
argp_state, struct argp,
89
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
90
89
WEXITSTATUS(), WTERMSIG() */
91
90
#include <grp.h> /* setgroups() */
92
#include <argz.h> /* argz_add_sep(), argz_next(),
93
argz_delete(), argz_append(),
94
argz_stringify(), argz_add(),
95
argz_count() */
96
#include <netdb.h> /* getnameinfo(), NI_NUMERICHOST,
97
EAI_SYSTEM, gai_strerror() */
98
91
99
92
#ifdef __linux__
100
93
#include <sys/klog.h> /* klogctl() */
142
135
static const char sys_class_net[] = "/sys/class/net";
143
136
char *connect_to = NULL;
144
137
const char *hookdir = HOOKDIR;
145
int hookdir_fd = -1;
146
uid_t uid = 65534;
147
gid_t gid = 65534;
148
138
149
139
/* Doubly linked list that need to be circularly linked when used */
150
140
typedef struct server{
151
141
const char *ip;
152
in_port_t port;
142
uint16_t port;
153
143
AvahiIfIndex if_index;
154
144
int af;
155
145
struct timespec last_seen;
159
149
160
150
/* Used for passing in values through the Avahi callback functions */
161
151
typedef struct {
152
AvahiSimplePoll *simple_poll;
162
153
AvahiServer *server;
163
154
gnutls_certificate_credentials_t cred;
164
155
unsigned int dh_bits;
166
157
const char *priority;
167
158
gpgme_ctx_t ctx;
168
159
server *current_server;
169
char *interfaces;
170
size_t interfaces_size;
171
160
} mandos_context;
172
161
173
/* global so signal handler can reach it*/
174
AvahiSimplePoll *simple_poll;
162
/* global context so signal handler can reach it*/
163
mandos_context mc = { .simple_poll = NULL, .server = NULL,
164
.dh_bits = 1024, .priority = "SECURE256"
165
":!CTYPE-X.509:+CTYPE-OPENPGP",
166
.current_server = NULL };
175
167
176
168
sig_atomic_t quit_now = 0;
177
169
int signal_received = 0;
185
177
perror(print_text);
186
178
}
187
179
188
__attribute__((format (gnu_printf, 2, 3), nonnull))
180
__attribute__((format (gnu_printf, 2, 3)))
189
181
int fprintf_plus(FILE *stream, const char *format, ...){
190
182
va_list ap;
191
183
va_start (ap, format);
192
184
193
185
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
194
186
program_invocation_short_name));
195
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
187
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
196
188
}
197
189
198
190
/*
200
192
* bytes. "buffer_capacity" is how much is currently allocated,
201
193
* "buffer_length" is how much is already used.
202
194
*/
203
__attribute__((nonnull, warn_unused_result))
204
195
size_t incbuffer(char **buffer, size_t buffer_length,
205
196
size_t buffer_capacity){
206
197
if(buffer_length + BUFFER_SIZE > buffer_capacity){
207
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
208
if(new_buf == NULL){
209
int old_errno = errno;
210
free(*buffer);
211
errno = old_errno;
212
*buffer = NULL;
198
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
199
if(buffer == NULL){
213
200
return 0;
214
201
}
215
*buffer = new_buf;
216
202
buffer_capacity += BUFFER_SIZE;
217
203
}
218
204
return buffer_capacity;
219
205
}
220
206
221
207
/* Add server to set of servers to retry periodically */
222
__attribute__((nonnull, warn_unused_result))
223
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
224
int af, server **current_server){
208
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
209
int af){
225
210
int ret;
226
211
server *new_server = malloc(sizeof(server));
227
212
if(new_server == NULL){
234
219
.af = af };
235
220
if(new_server->ip == NULL){
236
221
perror_plus("strdup");
237
free(new_server);
238
return false;
239
}
240
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
241
if(ret == -1){
242
perror_plus("clock_gettime");
243
free(new_server->ip);
244
free(new_server);
245
222
return false;
246
223
}
247
224
/* Special case of first server */
248
if(*current_server == NULL){
225
if (mc.current_server == NULL){
249
226
new_server->next = new_server;
250
227
new_server->prev = new_server;
251
*current_server = new_server;
228
mc.current_server = new_server;
229
/* Place the new server last in the list */
252
230
} else {
253
/* Place the new server last in the list */
254
new_server->next = *current_server;
255
new_server->prev = (*current_server)->prev;
231
new_server->next = mc.current_server;
232
new_server->prev = mc.current_server->prev;
256
233
new_server->prev->next = new_server;
257
(*current_server)->prev = new_server;
234
mc.current_server->prev = new_server;
235
}
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
237
if(ret == -1){
238
perror_plus("clock_gettime");
239
return false;
258
240
}
259
241
return true;
260
242
}
262
244
/*
263
245
* Initialize GPGME.
264
246
*/
265
__attribute__((nonnull, warn_unused_result))
266
static bool init_gpgme(const char * const seckey,
267
const char * const pubkey,
268
const char * const tempdir,
269
mandos_context *mc){
247
static bool init_gpgme(const char *seckey, const char *pubkey,
248
const char *tempdir){
270
249
gpgme_error_t rc;
271
250
gpgme_engine_info_t engine_info;
272
251
252
273
253
/*
274
254
* Helper function to insert pub and seckey to the engine keyring.
275
255
*/
276
bool import_key(const char * const filename){
256
bool import_key(const char *filename){
277
257
int ret;
278
258
int fd;
279
259
gpgme_data_t pgp_data;
291
271
return false;
292
272
}
293
273
294
rc = gpgme_op_import(mc->ctx, pgp_data);
274
rc = gpgme_op_import(mc.ctx, pgp_data);
295
275
if(rc != GPG_ERR_NO_ERROR){
296
276
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
297
277
gpgme_strsource(rc), gpgme_strerror(rc));
341
321
}
342
322
343
323
/* Create new GPGME "context" */
344
rc = gpgme_new(&(mc->ctx));
324
rc = gpgme_new(&(mc.ctx));
345
325
if(rc != GPG_ERR_NO_ERROR){
346
326
fprintf_plus(stderr, "Mandos plugin mandos-client: "
347
327
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
360
340
* Decrypt OpenPGP data.
361
341
* Returns -1 on error
362
342
*/
363
__attribute__((nonnull, warn_unused_result))
364
343
static ssize_t pgp_packet_decrypt(const char *cryptotext,
365
344
size_t crypto_size,
366
char **plaintext,
367
mandos_context *mc){
345
char **plaintext){
368
346
gpgme_data_t dh_crypto, dh_plain;
369
347
gpgme_error_t rc;
370
348
ssize_t ret;
396
374
397
375
/* Decrypt data from the cryptotext data buffer to the plaintext
398
376
data buffer */
399
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
377
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
400
378
if(rc != GPG_ERR_NO_ERROR){
401
379
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
402
380
gpgme_strsource(rc), gpgme_strerror(rc));
403
381
plaintext_length = -1;
404
382
if(debug){
405
383
gpgme_decrypt_result_t result;
406
result = gpgme_op_decrypt_result(mc->ctx);
384
result = gpgme_op_decrypt_result(mc.ctx);
407
385
if(result == NULL){
408
386
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
409
387
} else {
486
464
return plaintext_length;
487
465
}
488
466
489
__attribute__((warn_unused_result))
490
static const char *safer_gnutls_strerror(int value){
491
const char *ret = gnutls_strerror(value);
467
static const char * safer_gnutls_strerror(int value){
468
const char *ret = gnutls_strerror(value); /* Spurious warning from
469
-Wunreachable-code */
492
470
if(ret == NULL)
493
471
ret = "(unknown)";
494
472
return ret;
495
473
}
496
474
497
475
/* GnuTLS log function callback */
498
__attribute__((nonnull))
499
476
static void debuggnutls(__attribute__((unused)) int level,
500
477
const char* string){
501
478
fprintf_plus(stderr, "GnuTLS: %s", string);
502
479
}
503
480
504
__attribute__((nonnull, warn_unused_result))
505
481
static int init_gnutls_global(const char *pubkeyfilename,
506
const char *seckeyfilename,
507
mandos_context *mc){
482
const char *seckeyfilename){
508
483
int ret;
509
484
510
485
if(debug){
527
502
}
528
503
529
504
/* OpenPGP credentials */
530
ret = gnutls_certificate_allocate_credentials(&mc->cred);
505
ret = gnutls_certificate_allocate_credentials(&mc.cred);
531
506
if(ret != GNUTLS_E_SUCCESS){
532
507
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
533
508
safer_gnutls_strerror(ret));
543
518
}
544
519
545
520
ret = gnutls_certificate_set_openpgp_key_file
546
(mc->cred, pubkeyfilename, seckeyfilename,
521
(mc.cred, pubkeyfilename, seckeyfilename,
547
522
GNUTLS_OPENPGP_FMT_BASE64);
548
523
if(ret != GNUTLS_E_SUCCESS){
549
524
fprintf_plus(stderr,
555
530
}
556
531
557
532
/* GnuTLS server initialization */
558
ret = gnutls_dh_params_init(&mc->dh_params);
533
ret = gnutls_dh_params_init(&mc.dh_params);
559
534
if(ret != GNUTLS_E_SUCCESS){
560
535
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
561
536
" initialization: %s\n",
562
537
safer_gnutls_strerror(ret));
563
538
goto globalfail;
564
539
}
565
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
566
541
if(ret != GNUTLS_E_SUCCESS){
567
542
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
568
543
safer_gnutls_strerror(ret));
569
544
goto globalfail;
570
545
}
571
546
572
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
547
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
573
548
574
549
return 0;
575
550
576
551
globalfail:
577
552
578
gnutls_certificate_free_credentials(mc->cred);
553
gnutls_certificate_free_credentials(mc.cred);
579
554
gnutls_global_deinit();
580
gnutls_dh_params_deinit(mc->dh_params);
555
gnutls_dh_params_deinit(mc.dh_params);
581
556
return -1;
582
557
}
583
558
584
__attribute__((nonnull, warn_unused_result))
585
static int init_gnutls_session(gnutls_session_t *session,
586
mandos_context *mc){
559
static int init_gnutls_session(gnutls_session_t *session){
587
560
int ret;
588
561
/* GnuTLS session creation */
589
562
do {
601
574
{
602
575
const char *err;
603
576
do {
604
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
577
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
605
578
if(quit_now){
606
579
gnutls_deinit(*session);
607
580
return -1;
618
591
619
592
do {
620
593
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
621
mc->cred);
594
mc.cred);
622
595
if(quit_now){
623
596
gnutls_deinit(*session);
624
597
return -1;
634
607
/* ignore client certificate if any. */
635
608
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
636
609
637
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
610
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
638
611
639
612
return 0;
640
613
}
644
617
__attribute__((unused)) const char *txt){}
645
618
646
619
/* Called when a Mandos server is found */
647
__attribute__((nonnull, warn_unused_result))
648
static int start_mandos_communication(const char *ip, in_port_t port,
620
static int start_mandos_communication(const char *ip, uint16_t port,
649
621
AvahiIfIndex if_index,
650
int af, mandos_context *mc){
622
int af){
651
623
int ret, tcp_sd = -1;
652
624
ssize_t sret;
653
struct sockaddr_storage to;
625
union {
626
struct sockaddr_in in;
627
struct sockaddr_in6 in6;
628
} to;
654
629
char *buffer = NULL;
655
630
char *decrypted_buffer = NULL;
656
631
size_t buffer_length = 0;
680
655
return -1;
681
656
}
682
657
683
/* If the interface is specified and we have a list of interfaces */
684
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
685
/* Check if the interface is one of the interfaces we are using */
686
bool match = false;
687
{
688
char *interface = NULL;
689
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
690
interface))){
691
if(if_nametoindex(interface) == (unsigned int)if_index){
692
match = true;
693
break;
694
}
695
}
696
}
697
if(not match){
698
/* This interface does not match any in the list, so we don't
699
connect to the server */
700
if(debug){
701
char interface[IF_NAMESIZE];
702
if(if_indextoname((unsigned int)if_index, interface) == NULL){
703
perror_plus("if_indextoname");
704
} else {
705
fprintf_plus(stderr, "Skipping server on non-used interface"
706
" \"%s\"\n",
707
if_indextoname((unsigned int)if_index,
708
interface));
709
}
710
}
711
return -1;
712
}
713
}
714
715
ret = init_gnutls_session(&session, mc);
658
ret = init_gnutls_session(&session);
716
659
if(ret != 0){
717
660
return -1;
718
661
}
719
662
720
663
if(debug){
721
664
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
722
PRIuMAX "\n", ip, (uintmax_t)port);
665
PRIu16 "\n", ip, port);
723
666
}
724
667
725
668
tcp_sd = socket(pf, SOCK_STREAM, 0);
737
680
738
681
memset(&to, 0, sizeof(to));
739
682
if(af == AF_INET6){
740
((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;
741
ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);
683
to.in6.sin6_family = (sa_family_t)af;
684
ret = inet_pton(af, ip, &to.in6.sin6_addr);
742
685
} else { /* IPv4 */
743
((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;
744
ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);
686
to.in.sin_family = (sa_family_t)af;
687
ret = inet_pton(af, ip, &to.in.sin_addr);
745
688
}
746
689
if(ret < 0 ){
747
690
int e = errno;
756
699
goto mandos_end;
757
700
}
758
701
if(af == AF_INET6){
759
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
760
if(IN6_IS_ADDR_LINKLOCAL
761
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
702
to.in6.sin6_port = htons(port); /* Spurious warnings from
703
-Wconversion and
704
-Wunreachable-code */
705
706
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
707
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
708
-Wunreachable-code*/
762
709
if(if_index == AVAHI_IF_UNSPEC){
763
710
fprintf_plus(stderr, "An IPv6 link-local address is"
764
711
" incomplete without a network interface\n");
766
713
goto mandos_end;
767
714
}
768
715
/* Set the network interface number as scope */
769
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
716
to.in6.sin6_scope_id = (uint32_t)if_index;
770
717
}
771
718
} else {
772
((struct sockaddr_in *)&to)->sin_port = htons(port);
719
to.in.sin_port = htons(port); /* Spurious warnings from
720
-Wconversion and
721
-Wunreachable-code */
773
722
}
774
723
775
724
if(quit_now){
783
732
if(if_indextoname((unsigned int)if_index, interface) == NULL){
784
733
perror_plus("if_indextoname");
785
734
} else {
786
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
787
"\n", ip, interface, (uintmax_t)port);
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
788
737
}
789
738
} else {
790
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
791
ip, (uintmax_t)port);
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
740
ip, port);
792
741
}
793
742
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
794
743
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
744
const char *pcret;
795
745
if(af == AF_INET6){
796
ret = getnameinfo((struct sockaddr *)&to,
797
sizeof(struct sockaddr_in6),
798
addrstr, sizeof(addrstr), NULL, 0,
799
NI_NUMERICHOST);
746
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
747
sizeof(addrstr));
800
748
} else {
801
ret = getnameinfo((struct sockaddr *)&to,
802
sizeof(struct sockaddr_in),
803
addrstr, sizeof(addrstr), NULL, 0,
804
NI_NUMERICHOST);
749
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
750
sizeof(addrstr));
805
751
}
806
if(ret == EAI_SYSTEM){
807
perror_plus("getnameinfo");
808
} else if(ret != 0) {
809
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
810
} else if(strcmp(addrstr, ip) != 0){
811
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
752
if(pcret == NULL){
753
perror_plus("inet_ntop");
754
} else {
755
if(strcmp(addrstr, ip) != 0){
756
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
757
}
812
758
}
813
759
}
814
760
818
764
}
819
765
820
766
if(af == AF_INET6){
821
ret = connect(tcp_sd, (struct sockaddr *)&to,
822
sizeof(struct sockaddr_in6));
767
ret = connect(tcp_sd, &to.in6, sizeof(to));
823
768
} else {
824
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
825
sizeof(struct sockaddr_in));
769
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
826
770
}
827
771
if(ret < 0){
828
if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
772
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
829
773
int e = errno;
830
774
perror_plus("connect");
831
775
errno = e;
992
936
if(buffer_length > 0){
993
937
ssize_t decrypted_buffer_size;
994
938
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
995
&decrypted_buffer, mc);
939
&decrypted_buffer);
996
940
if(decrypted_buffer_size >= 0){
997
941
998
942
written = 0;
1046
990
return retval;
1047
991
}
1048
992
1049
__attribute__((nonnull))
1050
993
static void resolve_callback(AvahiSServiceResolver *r,
1051
994
AvahiIfIndex interface,
1052
995
AvahiProtocol proto,
1060
1003
AVAHI_GCC_UNUSED AvahiStringList *txt,
1061
1004
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1062
1005
flags,
1063
void *mc){
1064
if(r == NULL){
1065
return;
1066
}
1006
AVAHI_GCC_UNUSED void* userdata){
1007
assert(r);
1067
1008
1068
1009
/* Called whenever a service has been resolved successfully or
1069
1010
timed out */
1078
1019
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1079
1020
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1080
1021
domain,
1081
avahi_strerror(avahi_server_errno
1082
(((mandos_context*)mc)->server)));
1022
avahi_strerror(avahi_server_errno(mc.server)));
1083
1023
break;
1084
1024
1085
1025
case AVAHI_RESOLVER_FOUND:
1091
1031
PRIdMAX ") on port %" PRIu16 "\n", name,
1092
1032
host_name, ip, (intmax_t)interface, port);
1093
1033
}
1094
int ret = start_mandos_communication(ip, (in_port_t)port,
1095
interface,
1096
avahi_proto_to_af(proto),
1097
mc);
1034
int ret = start_mandos_communication(ip, port, interface,
1035
avahi_proto_to_af(proto));
1098
1036
if(ret == 0){
1099
avahi_simple_poll_quit(simple_poll);
1037
avahi_simple_poll_quit(mc.simple_poll);
1100
1038
} else {
1101
if(not add_server(ip, (in_port_t)port, interface,
1102
avahi_proto_to_af(proto),
1103
&((mandos_context*)mc)->current_server)){
1039
if(not add_server(ip, port, interface,
1040
avahi_proto_to_af(proto))){
1104
1041
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1105
1042
" list\n", name);
1106
1043
}
1119
1056
const char *domain,
1120
1057
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1121
1058
flags,
1122
void *mc){
1123
if(b == NULL){
1124
return;
1125
}
1059
AVAHI_GCC_UNUSED void* userdata){
1060
assert(b);
1126
1061
1127
1062
/* Called whenever a new services becomes available on the LAN or
1128
1063
is removed from the LAN */
1136
1071
case AVAHI_BROWSER_FAILURE:
1137
1072
1138
1073
fprintf_plus(stderr, "(Avahi browser) %s\n",
1139
avahi_strerror(avahi_server_errno
1140
(((mandos_context*)mc)->server)));
1141
avahi_simple_poll_quit(simple_poll);
1074
avahi_strerror(avahi_server_errno(mc.server)));
1075
avahi_simple_poll_quit(mc.simple_poll);
1142
1076
return;
1143
1077
1144
1078
case AVAHI_BROWSER_NEW:
1147
1081
the callback function is called the Avahi server will free the
1148
1082
resolver for us. */
1149
1083
1150
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1151
interface, protocol, name, type,
1152
domain, protocol, 0,
1153
resolve_callback, mc) == NULL)
1084
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1085
name, type, domain, protocol, 0,
1086
resolve_callback, NULL) == NULL)
1154
1087
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1155
1088
" %s\n", name,
1156
avahi_strerror(avahi_server_errno
1157
(((mandos_context*)mc)->server)));
1089
avahi_strerror(avahi_server_errno(mc.server)));
1158
1090
break;
1159
1091
1160
1092
case AVAHI_BROWSER_REMOVE:
1179
1111
signal_received = sig;
1180
1112
int old_errno = errno;
1181
1113
/* set main loop to exit */
1182
if(simple_poll != NULL){
1183
avahi_simple_poll_quit(simple_poll);
1114
if(mc.simple_poll != NULL){
1115
avahi_simple_poll_quit(mc.simple_poll);
1184
1116
}
1185
1117
errno = old_errno;
1186
1118
}
1187
1119
1188
__attribute__((nonnull, warn_unused_result))
1189
1120
bool get_flags(const char *ifname, struct ifreq *ifr){
1190
1121
int ret;
1191
error_t ret_errno;
1192
1122
1193
1123
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1194
1124
if(s < 0){
1195
ret_errno = errno;
1196
1125
perror_plus("socket");
1197
errno = ret_errno;
1198
1126
return false;
1199
1127
}
1200
1128
strcpy(ifr->ifr_name, ifname);
1201
1129
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1202
1130
if(ret == -1){
1203
1131
if(debug){
1204
ret_errno = errno;
1205
1132
perror_plus("ioctl SIOCGIFFLAGS");
1206
errno = ret_errno;
1207
1133
}
1208
1134
return false;
1209
1135
}
1210
1136
return true;
1211
1137
}
1212
1138
1213
__attribute__((nonnull, warn_unused_result))
1214
1139
bool good_flags(const char *ifname, const struct ifreq *ifr){
1215
1140
1216
1141
/* Reject the loopback device */
1258
1183
* corresponds to an acceptable network device.
1259
1184
* (This function is passed to scandir(3) as a filter function.)
1260
1185
*/
1261
__attribute__((nonnull, warn_unused_result))
1262
1186
int good_interface(const struct dirent *if_entry){
1263
1187
if(if_entry->d_name[0] == '.'){
1264
1188
return 0;
1280
1204
}
1281
1205
1282
1206
/*
1283
* This function determines if a network interface is up.
1284
*/
1285
__attribute__((nonnull, warn_unused_result))
1286
bool interface_is_up(const char *interface){
1287
struct ifreq ifr;
1288
if(not get_flags(interface, &ifr)){
1289
if(debug){
1290
fprintf_plus(stderr, "Failed to get flags for interface "
1291
"\"%s\"\n", interface);
1292
}
1293
return false;
1294
}
1295
1296
return (bool)(ifr.ifr_flags & IFF_UP);
1297
}
1298
1299
/*
1300
* This function determines if a network interface is running
1301
*/
1302
__attribute__((nonnull, warn_unused_result))
1303
bool interface_is_running(const char *interface){
1304
struct ifreq ifr;
1305
if(not get_flags(interface, &ifr)){
1306
if(debug){
1307
fprintf_plus(stderr, "Failed to get flags for interface "
1308
"\"%s\"\n", interface);
1309
}
1310
return false;
1311
}
1312
1313
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1314
}
1315
1316
__attribute__((nonnull, pure, warn_unused_result))
1207
* This function determines if a directory entry in /sys/class/net
1208
* corresponds to an acceptable network device which is up.
1209
* (This function is passed to scandir(3) as a filter function.)
1210
*/
1211
int up_interface(const struct dirent *if_entry){
1212
if(if_entry->d_name[0] == '.'){
1213
return 0;
1214
}
1215
1216
struct ifreq ifr;
1217
if(not get_flags(if_entry->d_name, &ifr)){
1218
if(debug){
1219
fprintf_plus(stderr, "Failed to get flags for interface "
1220
"\"%s\"\n", if_entry->d_name);
1221
}
1222
return 0;
1223
}
1224
1225
/* Reject down interfaces */
1226
if(not (ifr.ifr_flags & IFF_UP)){
1227
if(debug){
1228
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1229
if_entry->d_name);
1230
}
1231
return 0;
1232
}
1233
1234
/* Reject non-running interfaces */
1235
if(not (ifr.ifr_flags & IFF_RUNNING)){
1236
if(debug){
1237
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1238
if_entry->d_name);
1239
}
1240
return 0;
1241
}
1242
1243
if(not good_flags(if_entry->d_name, &ifr)){
1244
return 0;
1245
}
1246
return 1;
1247
}
1248
1317
1249
int notdotentries(const struct dirent *direntry){
1318
1250
/* Skip "." and ".." */
1319
1251
if(direntry->d_name[0] == '.'
1326
1258
}
1327
1259
1328
1260
/* Is this directory entry a runnable program? */
1329
__attribute__((nonnull, warn_unused_result))
1330
1261
int runnable_hook(const struct dirent *direntry){
1331
1262
int ret;
1332
1263
size_t sret;
1340
1271
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1341
1272
"abcdefghijklmnopqrstuvwxyz"
1342
1273
"0123456789"
1343
"_.-");
1274
"_-");
1344
1275
if((direntry->d_name)[sret] != '\0'){
1345
1276
/* Contains non-allowed characters */
1346
1277
if(debug){
1350
1281
return 0;
1351
1282
}
1352
1283
1353
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1284
char *fullname = NULL;
1285
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1286
if(ret < 0){
1287
perror_plus("asprintf");
1288
return 0;
1289
}
1290
1291
ret = stat(fullname, &st);
1354
1292
if(ret == -1){
1355
1293
if(debug){
1356
1294
perror_plus("Could not stat hook");
1380
1318
return 1;
1381
1319
}
1382
1320
1383
__attribute__((nonnull, warn_unused_result))
1384
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1385
mandos_context *mc){
1321
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1386
1322
int ret;
1387
1323
struct timespec now;
1388
1324
struct timespec waited_time;
1389
1325
intmax_t block_time;
1390
1326
1391
1327
while(true){
1392
if(mc->current_server == NULL){
1393
if(debug){
1328
if(mc.current_server == NULL){
1329
if (debug){
1394
1330
fprintf_plus(stderr, "Wait until first server is found."
1395
1331
" No timeout!\n");
1396
1332
}
1397
1333
ret = avahi_simple_poll_iterate(s, -1);
1398
1334
} else {
1399
if(debug){
1335
if (debug){
1400
1336
fprintf_plus(stderr, "Check current_server if we should run"
1401
1337
" it, or wait\n");
1402
1338
}
1409
1345
/* Calculating in ms how long time between now and server
1410
1346
who we visted longest time ago. Now - last seen. */
1411
1347
waited_time.tv_sec = (now.tv_sec
1412
- mc->current_server->last_seen.tv_sec);
1348
- mc.current_server->last_seen.tv_sec);
1413
1349
waited_time.tv_nsec = (now.tv_nsec
1414
- mc->current_server->last_seen.tv_nsec);
1350
- mc.current_server->last_seen.tv_nsec);
1415
1351
/* total time is 10s/10,000ms.
1416
1352
Converting to s from ms by dividing by 1,000,
1417
1353
and ns to ms by dividing by 1,000,000. */
1419
1355
- ((intmax_t)waited_time.tv_sec * 1000))
1420
1356
- ((intmax_t)waited_time.tv_nsec / 1000000));
1421
1357
1422
if(debug){
1358
if (debug){
1423
1359
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1424
1360
block_time);
1425
1361
}
1426
1362
1427
1363
if(block_time <= 0){
1428
ret = start_mandos_communication(mc->current_server->ip,
1429
mc->current_server->port,
1430
mc->current_server->if_index,
1431
mc->current_server->af, mc);
1364
ret = start_mandos_communication(mc.current_server->ip,
1365
mc.current_server->port,
1366
mc.current_server->if_index,
1367
mc.current_server->af);
1432
1368
if(ret == 0){
1433
avahi_simple_poll_quit(s);
1369
avahi_simple_poll_quit(mc.simple_poll);
1434
1370
return 0;
1435
1371
}
1436
1372
ret = clock_gettime(CLOCK_MONOTONIC,
1437
&mc->current_server->last_seen);
1373
&mc.current_server->last_seen);
1438
1374
if(ret == -1){
1439
1375
perror_plus("clock_gettime");
1440
1376
return -1;
1441
1377
}
1442
mc->current_server = mc->current_server->next;
1378
mc.current_server = mc.current_server->next;
1443
1379
block_time = 0; /* Call avahi to find new Mandos
1444
1380
servers, but don't block */
1445
1381
}
1447
1383
ret = avahi_simple_poll_iterate(s, (int)block_time);
1448
1384
}
1449
1385
if(ret != 0){
1450
if(ret > 0 or errno != EINTR){
1386
if (ret > 0 or errno != EINTR){
1451
1387
return (ret != 1) ? ret : 0;
1452
1388
}
1453
1389
}
1454
1390
}
1455
1391
}
1456
1392
1457
/* Set effective uid to 0, return errno */
1458
__attribute__((warn_unused_result))
1459
error_t raise_privileges(void){
1460
error_t old_errno = errno;
1461
error_t ret_errno = 0;
1462
if(seteuid(0) == -1){
1463
ret_errno = errno;
1464
}
1465
errno = old_errno;
1466
return ret_errno;
1467
}
1468
1469
/* Set effective and real user ID to 0. Return errno. */
1470
__attribute__((warn_unused_result))
1471
error_t raise_privileges_permanently(void){
1472
error_t old_errno = errno;
1473
error_t ret_errno = raise_privileges();
1474
if(ret_errno != 0){
1475
errno = old_errno;
1476
return ret_errno;
1477
}
1478
if(setuid(0) == -1){
1479
ret_errno = errno;
1480
}
1481
errno = old_errno;
1482
return ret_errno;
1483
}
1484
1485
/* Set effective user ID to unprivileged saved user ID */
1486
__attribute__((warn_unused_result))
1487
error_t lower_privileges(void){
1488
error_t old_errno = errno;
1489
error_t ret_errno = 0;
1490
if(seteuid(uid) == -1){
1491
ret_errno = errno;
1492
}
1493
errno = old_errno;
1494
return ret_errno;
1495
}
1496
1497
/* Lower privileges permanently */
1498
__attribute__((warn_unused_result))
1499
error_t lower_privileges_permanently(void){
1500
error_t old_errno = errno;
1501
error_t ret_errno = 0;
1502
if(setuid(uid) == -1){
1503
ret_errno = errno;
1504
}
1505
errno = old_errno;
1506
return ret_errno;
1507
}
1508
1509
__attribute__((nonnull))
1510
void run_network_hooks(const char *mode, const char *interface,
1393
bool run_network_hooks(const char *mode, const char *interface,
1511
1394
const float delay){
1512
struct dirent **direntries = NULL;
1513
if(hookdir_fd == -1){
1514
hookdir_fd = open(hookdir, O_RDONLY);
1515
if(hookdir_fd == -1){
1516
if(errno == ENOENT){
1517
if(debug){
1518
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1519
" found\n", hookdir);
1520
}
1521
} else {
1522
perror_plus("open");
1523
}
1524
return;
1525
}
1526
}
1527
#ifdef __GLIBC__
1528
#if __GLIBC_PREREQ(2, 15)
1529
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1530
runnable_hook, alphasort);
1531
#else /* not __GLIBC_PREREQ(2, 15) */
1532
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1533
alphasort);
1534
#endif /* not __GLIBC_PREREQ(2, 15) */
1535
#else /* not __GLIBC__ */
1536
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1537
alphasort);
1538
#endif /* not __GLIBC__ */
1395
struct dirent **direntries;
1396
struct dirent *direntry;
1397
int ret;
1398
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1399
alphasort);
1539
1400
if(numhooks == -1){
1540
1401
perror_plus("scandir");
1541
return;
1542
}
1543
struct dirent *direntry;
1544
int ret;
1545
int devnull = open("/dev/null", O_RDONLY);
1546
for(int i = 0; i < numhooks; i++){
1547
direntry = direntries[i];
1548
if(debug){
1549
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1550
direntry->d_name);
1551
}
1552
pid_t hook_pid = fork();
1553
if(hook_pid == 0){
1554
/* Child */
1555
/* Raise privileges */
1556
errno = raise_privileges_permanently();
1557
if(errno != 0){
1558
perror_plus("Failed to raise privileges");
1559
_exit(EX_NOPERM);
1560
}
1561
/* Set group */
1562
errno = 0;
1563
ret = setgid(0);
1564
if(ret == -1){
1565
perror_plus("setgid");
1566
_exit(EX_NOPERM);
1567
}
1568
/* Reset supplementary groups */
1569
errno = 0;
1570
ret = setgroups(0, NULL);
1571
if(ret == -1){
1572
perror_plus("setgroups");
1573
_exit(EX_NOPERM);
1574
}
1575
ret = dup2(devnull, STDIN_FILENO);
1576
if(ret == -1){
1577
perror_plus("dup2(devnull, STDIN_FILENO)");
1578
_exit(EX_OSERR);
1579
}
1580
ret = close(devnull);
1581
if(ret == -1){
1582
perror_plus("close");
1583
_exit(EX_OSERR);
1584
}
1585
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1586
if(ret == -1){
1587
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1588
_exit(EX_OSERR);
1589
}
1590
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1591
if(ret == -1){
1592
perror_plus("setenv");
1593
_exit(EX_OSERR);
1594
}
1595
ret = setenv("DEVICE", interface, 1);
1596
if(ret == -1){
1597
perror_plus("setenv");
1598
_exit(EX_OSERR);
1599
}
1600
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1601
if(ret == -1){
1602
perror_plus("setenv");
1603
_exit(EX_OSERR);
1604
}
1605
ret = setenv("MODE", mode, 1);
1606
if(ret == -1){
1607
perror_plus("setenv");
1608
_exit(EX_OSERR);
1609
}
1610
char *delaystring;
1611
ret = asprintf(&delaystring, "%f", (double)delay);
1612
if(ret == -1){
1402
} else {
1403
int devnull = open("/dev/null", O_RDONLY);
1404
for(int i = 0; i < numhooks; i++){
1405
direntry = direntries[i];
1406
char *fullname = NULL;
1407
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1408
if(ret < 0){
1613
1409
perror_plus("asprintf");
1614
_exit(EX_OSERR);
1615
}
1616
ret = setenv("DELAY", delaystring, 1);
1617
if(ret == -1){
1410
continue;
1411
}
1412
if(debug){
1413
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1414
direntry->d_name);
1415
}
1416
pid_t hook_pid = fork();
1417
if(hook_pid == 0){
1418
/* Child */
1419
/* Raise privileges */
1420
errno = 0;
1421
ret = seteuid(0);
1422
if(ret == -1){
1423
perror_plus("seteuid");
1424
}
1425
/* Raise privileges even more */
1426
errno = 0;
1427
ret = setuid(0);
1428
if(ret == -1){
1429
perror_plus("setuid");
1430
}
1431
/* Set group */
1432
errno = 0;
1433
ret = setgid(0);
1434
if(ret == -1){
1435
perror_plus("setgid");
1436
}
1437
/* Reset supplementary groups */
1438
errno = 0;
1439
ret = setgroups(0, NULL);
1440
if(ret == -1){
1441
perror_plus("setgroups");
1442
}
1443
dup2(devnull, STDIN_FILENO);
1444
close(devnull);
1445
dup2(STDERR_FILENO, STDOUT_FILENO);
1446
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1447
if(ret == -1){
1448
perror_plus("setenv");
1449
_exit(EX_OSERR);
1450
}
1451
ret = setenv("DEVICE", interface, 1);
1452
if(ret == -1){
1453
perror_plus("setenv");
1454
_exit(EX_OSERR);
1455
}
1456
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1457
if(ret == -1){
1458
perror_plus("setenv");
1459
_exit(EX_OSERR);
1460
}
1461
ret = setenv("MODE", mode, 1);
1462
if(ret == -1){
1463
perror_plus("setenv");
1464
_exit(EX_OSERR);
1465
}
1466
char *delaystring;
1467
ret = asprintf(&delaystring, "%f", delay);
1468
if(ret == -1){
1469
perror_plus("asprintf");
1470
_exit(EX_OSERR);
1471
}
1472
ret = setenv("DELAY", delaystring, 1);
1473
if(ret == -1){
1474
free(delaystring);
1475
perror_plus("setenv");
1476
_exit(EX_OSERR);
1477
}
1618
1478
free(delaystring);
1619
perror_plus("setenv");
1620
_exit(EX_OSERR);
1621
}
1622
free(delaystring);
1623
if(connect_to != NULL){
1624
ret = setenv("CONNECT", connect_to, 1);
1625
if(ret == -1){
1626
perror_plus("setenv");
1627
_exit(EX_OSERR);
1628
}
1629
}
1630
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1631
if(hook_fd == -1){
1632
perror_plus("openat");
1633
_exit(EXIT_FAILURE);
1634
}
1635
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1636
perror_plus("close");
1637
_exit(EXIT_FAILURE);
1638
}
1639
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1640
environ) == -1){
1641
perror_plus("fexecve");
1642
_exit(EXIT_FAILURE);
1643
}
1644
} else {
1645
int status;
1646
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1647
perror_plus("waitpid");
1648
continue;
1649
}
1650
if(WIFEXITED(status)){
1651
if(WEXITSTATUS(status) != 0){
1652
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1653
" with status %d\n", direntry->d_name,
1654
WEXITSTATUS(status));
1655
continue;
1656
}
1657
} else if(WIFSIGNALED(status)){
1658
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1659
" signal %d\n", direntry->d_name,
1660
WTERMSIG(status));
1661
continue;
1662
} else {
1663
fprintf_plus(stderr, "Warning: network hook \"%s\""
1664
" crashed\n", direntry->d_name);
1665
continue;
1666
}
1667
}
1668
if(debug){
1669
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1670
direntry->d_name);
1671
}
1672
}
1673
free(direntries);
1674
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1675
perror_plus("close");
1676
} else {
1677
hookdir_fd = -1;
1678
}
1679
close(devnull);
1680
}
1681
1682
__attribute__((nonnull, warn_unused_result))
1683
error_t bring_up_interface(const char *const interface,
1684
const float delay){
1685
error_t old_errno = errno;
1686
int ret;
1687
struct ifreq network;
1688
unsigned int if_index = if_nametoindex(interface);
1689
if(if_index == 0){
1690
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1691
errno = old_errno;
1692
return ENXIO;
1693
}
1694
1695
if(quit_now){
1696
errno = old_errno;
1697
return EINTR;
1698
}
1699
1700
if(not interface_is_up(interface)){
1701
error_t ret_errno = 0, ioctl_errno = 0;
1702
if(not get_flags(interface, &network)){
1703
ret_errno = errno;
1704
fprintf_plus(stderr, "Failed to get flags for interface "
1705
"\"%s\"\n", interface);
1706
errno = old_errno;
1707
return ret_errno;
1708
}
1709
network.ifr_flags |= IFF_UP; /* set flag */
1710
1711
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1712
if(sd == -1){
1713
ret_errno = errno;
1714
perror_plus("socket");
1715
errno = old_errno;
1716
return ret_errno;
1717
}
1718
1719
if(quit_now){
1720
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1721
if(ret == -1){
1722
perror_plus("close");
1723
}
1724
errno = old_errno;
1725
return EINTR;
1726
}
1727
1728
if(debug){
1729
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
1730
interface);
1731
}
1732
1733
/* Raise privileges */
1734
ret_errno = raise_privileges();
1735
if(ret_errno != 0){
1736
errno = ret_errno;
1737
perror_plus("Failed to raise privileges");
1738
}
1739
1740
#ifdef __linux__
1741
int ret_linux;
1742
bool restore_loglevel = false;
1743
if(ret_errno == 0){
1744
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1745
messages about the network interface to mess up the prompt */
1746
ret_linux = klogctl(8, NULL, 5);
1747
if(ret_linux == -1){
1748
perror_plus("klogctl");
1749
} else {
1750
restore_loglevel = true;
1751
}
1752
}
1753
#endif /* __linux__ */
1754
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1755
ioctl_errno = errno;
1756
#ifdef __linux__
1757
if(restore_loglevel){
1758
ret_linux = klogctl(7, NULL, 0);
1759
if(ret_linux == -1){
1760
perror_plus("klogctl");
1761
}
1762
}
1763
#endif /* __linux__ */
1764
1765
/* If raise_privileges() succeeded above */
1766
if(ret_errno == 0){
1767
/* Lower privileges */
1768
ret_errno = lower_privileges();
1769
if(ret_errno != 0){
1770
errno = ret_errno;
1771
perror_plus("Failed to lower privileges");
1772
}
1773
}
1774
1775
/* Close the socket */
1776
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1777
if(ret == -1){
1778
perror_plus("close");
1779
}
1780
1781
if(ret_setflags == -1){
1782
errno = ioctl_errno;
1783
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1784
errno = old_errno;
1785
return ioctl_errno;
1786
}
1787
} else if(debug){
1788
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1789
interface);
1790
}
1791
1792
/* Sleep checking until interface is running.
1793
Check every 0.25s, up to total time of delay */
1794
for(int i=0; i < delay * 4; i++){
1795
if(interface_is_running(interface)){
1796
break;
1797
}
1798
struct timespec sleeptime = { .tv_nsec = 250000000 };
1799
ret = nanosleep(&sleeptime, NULL);
1800
if(ret == -1 and errno != EINTR){
1801
perror_plus("nanosleep");
1802
}
1803
}
1804
1805
errno = old_errno;
1806
return 0;
1807
}
1808
1809
__attribute__((nonnull, warn_unused_result))
1810
error_t take_down_interface(const char *const interface){
1811
error_t old_errno = errno;
1812
struct ifreq network;
1813
unsigned int if_index = if_nametoindex(interface);
1814
if(if_index == 0){
1815
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1816
errno = old_errno;
1817
return ENXIO;
1818
}
1819
if(interface_is_up(interface)){
1820
error_t ret_errno = 0, ioctl_errno = 0;
1821
if(not get_flags(interface, &network) and debug){
1822
ret_errno = errno;
1823
fprintf_plus(stderr, "Failed to get flags for interface "
1824
"\"%s\"\n", interface);
1825
errno = old_errno;
1826
return ret_errno;
1827
}
1828
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1829
1830
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1831
if(sd == -1){
1832
ret_errno = errno;
1833
perror_plus("socket");
1834
errno = old_errno;
1835
return ret_errno;
1836
}
1837
1838
if(debug){
1839
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
1840
interface);
1841
}
1842
1843
/* Raise privileges */
1844
ret_errno = raise_privileges();
1845
if(ret_errno != 0){
1846
errno = ret_errno;
1847
perror_plus("Failed to raise privileges");
1848
}
1849
1850
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1851
ioctl_errno = errno;
1852
1853
/* If raise_privileges() succeeded above */
1854
if(ret_errno == 0){
1855
/* Lower privileges */
1856
ret_errno = lower_privileges();
1857
if(ret_errno != 0){
1858
errno = ret_errno;
1859
perror_plus("Failed to lower privileges");
1860
}
1861
}
1862
1863
/* Close the socket */
1864
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1865
if(ret == -1){
1866
perror_plus("close");
1867
}
1868
1869
if(ret_setflags == -1){
1870
errno = ioctl_errno;
1871
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1872
errno = old_errno;
1873
return ioctl_errno;
1874
}
1875
} else if(debug){
1876
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1877
interface);
1878
}
1879
1880
errno = old_errno;
1881
return 0;
1479
if(connect_to != NULL){
1480
ret = setenv("CONNECT", connect_to, 1);
1481
if(ret == -1){
1482
perror_plus("setenv");
1483
_exit(EX_OSERR);
1484
}
1485
}
1486
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1487
perror_plus("execl");
1488
_exit(EXIT_FAILURE);
1489
}
1490
} else {
1491
int status;
1492
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1493
perror_plus("waitpid");
1494
free(fullname);
1495
continue;
1496
}
1497
if(WIFEXITED(status)){
1498
if(WEXITSTATUS(status) != 0){
1499
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1500
" with status %d\n", direntry->d_name,
1501
WEXITSTATUS(status));
1502
free(fullname);
1503
continue;
1504
}
1505
} else if(WIFSIGNALED(status)){
1506
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1507
" signal %d\n", direntry->d_name,
1508
WTERMSIG(status));
1509
free(fullname);
1510
continue;
1511
} else {
1512
fprintf_plus(stderr, "Warning: network hook \"%s\""
1513
" crashed\n", direntry->d_name);
1514
free(fullname);
1515
continue;
1516
}
1517
}
1518
free(fullname);
1519
if(debug){
1520
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1521
direntry->d_name);
1522
}
1523
}
1524
close(devnull);
1525
}
1526
return true;
1882
1527
}
1883
1528
1884
1529
int main(int argc, char *argv[]){
1885
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1886
.priority = "SECURE256:!CTYPE-X.509:"
1887
"+CTYPE-OPENPGP", .current_server = NULL,
1888
.interfaces = NULL, .interfaces_size = 0 };
1889
1530
AvahiSServiceBrowser *sb = NULL;
1890
error_t ret_errno;
1531
int error;
1891
1532
int ret;
1892
1533
intmax_t tmpmax;
1893
1534
char *tmp;
1894
1535
int exitcode = EXIT_SUCCESS;
1895
char *interfaces_to_take_down = NULL;
1896
size_t interfaces_to_take_down_size = 0;
1897
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
1898
char old_tempdir[] = "/tmp/mandosXXXXXX";
1899
char *tempdir = NULL;
1536
const char *interface = "";
1537
struct ifreq network;
1538
int sd = -1;
1539
bool take_down_interface = false;
1540
uid_t uid;
1541
gid_t gid;
1542
char tempdir[] = "/tmp/mandosXXXXXX";
1543
bool tempdir_created = false;
1900
1544
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1901
1545
const char *seckey = PATHDIR "/" SECKEY;
1902
1546
const char *pubkey = PATHDIR "/" PUBKEY;
1903
char *interfaces_hooks = NULL;
1904
1547
1905
1548
bool gnutls_initialized = false;
1906
1549
bool gpgme_initialized = false;
1997
1640
connect_to = arg;
1998
1641
break;
1999
1642
case 'i': /* --interface */
2000
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
2001
arg, (int)',');
2002
if(ret_errno != 0){
2003
argp_error(state, "%s", strerror(ret_errno));
2004
}
1643
interface = arg;
2005
1644
break;
2006
1645
case 's': /* --seckey */
2007
1646
seckey = arg;
2084
1723
/* Work around Debian bug #633582:
2085
1724
<http://bugs.debian.org/633582> */
2086
1725
2087
/* Re-raise privileges */
2088
ret_errno = raise_privileges();
2089
if(ret_errno != 0){
2090
errno = ret_errno;
2091
perror_plus("Failed to raise privileges");
1726
/* Re-raise priviliges */
1727
errno = 0;
1728
ret = seteuid(0);
1729
if(ret == -1){
1730
perror_plus("seteuid");
2092
1731
} else {
2093
1732
struct stat st;
2094
1733
2135
1774
}
2136
1775
2137
1776
/* Lower privileges */
2138
ret_errno = lower_privileges();
2139
if(ret_errno != 0){
2140
errno = ret_errno;
2141
perror_plus("Failed to lower privileges");
2142
}
2143
}
2144
}
2145
2146
/* Remove invalid interface names (except "none") */
2147
{
2148
char *interface = NULL;
2149
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2150
interface))){
2151
if(strcmp(interface, "none") != 0
2152
and if_nametoindex(interface) == 0){
2153
if(interface[0] != '\0'){
2154
fprintf_plus(stderr, "Not using nonexisting interface"
2155
" \"%s\"\n", interface);
2156
}
2157
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2158
interface = NULL;
1777
errno = 0;
1778
ret = seteuid(uid);
1779
if(ret == -1){
1780
perror_plus("seteuid");
2159
1781
}
2160
1782
}
2161
1783
}
2162
1784
2163
1785
/* Run network hooks */
2164
{
2165
if(mc.interfaces != NULL){
2166
interfaces_hooks = malloc(mc.interfaces_size);
2167
if(interfaces_hooks == NULL){
2168
perror_plus("malloc");
2169
goto end;
2170
}
2171
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2172
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2173
}
2174
run_network_hooks("start", interfaces_hooks != NULL ?
2175
interfaces_hooks : "", delay);
1786
if(not run_network_hooks("start", interface, delay)){
1787
goto end;
2176
1788
}
2177
1789
2178
1790
if(not debug){
2179
1791
avahi_set_log_function(empty_log);
2180
1792
}
2181
1793
1794
if(interface[0] == '\0'){
1795
struct dirent **direntries;
1796
/* First look for interfaces that are up */
1797
ret = scandir(sys_class_net, &direntries, up_interface,
1798
alphasort);
1799
if(ret == 0){
1800
/* No up interfaces, look for any good interfaces */
1801
free(direntries);
1802
ret = scandir(sys_class_net, &direntries, good_interface,
1803
alphasort);
1804
}
1805
if(ret >= 1){
1806
/* Pick the first interface returned */
1807
interface = strdup(direntries[0]->d_name);
1808
if(debug){
1809
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1810
}
1811
if(interface == NULL){
1812
perror_plus("malloc");
1813
free(direntries);
1814
exitcode = EXIT_FAILURE;
1815
goto end;
1816
}
1817
free(direntries);
1818
} else {
1819
free(direntries);
1820
fprintf_plus(stderr, "Could not find a network interface\n");
1821
exitcode = EXIT_FAILURE;
1822
goto end;
1823
}
1824
}
1825
2182
1826
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
2183
1827
from the signal handler */
2184
1828
/* Initialize the pseudo-RNG for Avahi */
2185
1829
srand((unsigned int) time(NULL));
2186
simple_poll = avahi_simple_poll_new();
2187
if(simple_poll == NULL){
1830
mc.simple_poll = avahi_simple_poll_new();
1831
if(mc.simple_poll == NULL){
2188
1832
fprintf_plus(stderr,
2189
1833
"Avahi: Failed to create simple poll object.\n");
2190
1834
exitcode = EX_UNAVAILABLE;
2254
1898
}
2255
1899
}
2256
1900
2257
/* If no interfaces were specified, make a list */
2258
if(mc.interfaces == NULL){
2259
struct dirent **direntries = NULL;
2260
/* Look for any good interfaces */
2261
ret = scandir(sys_class_net, &direntries, good_interface,
2262
alphasort);
2263
if(ret >= 1){
2264
/* Add all found interfaces to interfaces list */
2265
for(int i = 0; i < ret; ++i){
2266
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2267
direntries[i]->d_name);
2268
if(ret_errno != 0){
2269
errno = ret_errno;
2270
perror_plus("argz_add");
2271
continue;
2272
}
2273
if(debug){
2274
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2275
direntries[i]->d_name);
2276
}
2277
}
2278
free(direntries);
2279
} else {
2280
if(ret == 0){
2281
free(direntries);
2282
}
2283
fprintf_plus(stderr, "Could not find a network interface\n");
2284
exitcode = EXIT_FAILURE;
2285
goto end;
2286
}
2287
}
2288
2289
/* Bring up interfaces which are down, and remove any "none"s */
2290
{
2291
char *interface = NULL;
2292
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2293
interface))){
2294
/* If interface name is "none", stop bringing up interfaces.
2295
Also remove all instances of "none" from the list */
2296
if(strcmp(interface, "none") == 0){
2297
argz_delete(&mc.interfaces, &mc.interfaces_size,
2298
interface);
2299
interface = NULL;
2300
while((interface = argz_next(mc.interfaces,
2301
mc.interfaces_size, interface))){
2302
if(strcmp(interface, "none") == 0){
2303
argz_delete(&mc.interfaces, &mc.interfaces_size,
2304
interface);
2305
interface = NULL;
1901
/* If the interface is down, bring it up */
1902
if(strcmp(interface, "none") != 0){
1903
if_index = (AvahiIfIndex) if_nametoindex(interface);
1904
if(if_index == 0){
1905
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1906
exitcode = EX_UNAVAILABLE;
1907
goto end;
1908
}
1909
1910
if(quit_now){
1911
goto end;
1912
}
1913
1914
/* Re-raise priviliges */
1915
errno = 0;
1916
ret = seteuid(0);
1917
if(ret == -1){
1918
perror_plus("seteuid");
1919
}
1920
1921
#ifdef __linux__
1922
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1923
messages about the network interface to mess up the prompt */
1924
ret = klogctl(8, NULL, 5);
1925
bool restore_loglevel = true;
1926
if(ret == -1){
1927
restore_loglevel = false;
1928
perror_plus("klogctl");
1929
}
1930
#endif /* __linux__ */
1931
1932
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1933
if(sd < 0){
1934
perror_plus("socket");
1935
exitcode = EX_OSERR;
1936
#ifdef __linux__
1937
if(restore_loglevel){
1938
ret = klogctl(7, NULL, 0);
1939
if(ret == -1){
1940
perror_plus("klogctl");
1941
}
1942
}
1943
#endif /* __linux__ */
1944
/* Lower privileges */
1945
errno = 0;
1946
ret = seteuid(uid);
1947
if(ret == -1){
1948
perror_plus("seteuid");
1949
}
1950
goto end;
1951
}
1952
strcpy(network.ifr_name, interface);
1953
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1954
if(ret == -1){
1955
perror_plus("ioctl SIOCGIFFLAGS");
1956
#ifdef __linux__
1957
if(restore_loglevel){
1958
ret = klogctl(7, NULL, 0);
1959
if(ret == -1){
1960
perror_plus("klogctl");
1961
}
1962
}
1963
#endif /* __linux__ */
1964
exitcode = EX_OSERR;
1965
/* Lower privileges */
1966
errno = 0;
1967
ret = seteuid(uid);
1968
if(ret == -1){
1969
perror_plus("seteuid");
1970
}
1971
goto end;
1972
}
1973
if((network.ifr_flags & IFF_UP) == 0){
1974
network.ifr_flags |= IFF_UP;
1975
take_down_interface = true;
1976
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1977
if(ret == -1){
1978
take_down_interface = false;
1979
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1980
exitcode = EX_OSERR;
1981
#ifdef __linux__
1982
if(restore_loglevel){
1983
ret = klogctl(7, NULL, 0);
1984
if(ret == -1){
1985
perror_plus("klogctl");
2306
1986
}
2307
1987
}
1988
#endif /* __linux__ */
1989
/* Lower privileges */
1990
errno = 0;
1991
ret = seteuid(uid);
1992
if(ret == -1){
1993
perror_plus("seteuid");
1994
}
1995
goto end;
1996
}
1997
}
1998
/* Sleep checking until interface is running.
1999
Check every 0.25s, up to total time of delay */
2000
for(int i=0; i < delay * 4; i++){
2001
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2002
if(ret == -1){
2003
perror_plus("ioctl SIOCGIFFLAGS");
2004
} else if(network.ifr_flags & IFF_RUNNING){
2308
2005
break;
2309
2006
}
2310
bool interface_was_up = interface_is_up(interface);
2311
errno = bring_up_interface(interface, delay);
2312
if(not interface_was_up){
2313
if(errno != 0){
2314
perror_plus("Failed to bring up interface");
2315
} else {
2316
errno = argz_add(&interfaces_to_take_down,
2317
&interfaces_to_take_down_size,
2318
interface);
2319
if(errno != 0){
2320
perror_plus("argz_add");
2321
}
2322
}
2323
}
2324
}
2325
if(debug and (interfaces_to_take_down == NULL)){
2326
fprintf_plus(stderr, "No interfaces were brought up\n");
2327
}
2328
}
2329
2330
/* If we only got one interface, explicitly use only that one */
2331
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2332
if(debug){
2333
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2334
mc.interfaces);
2335
}
2336
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2007
struct timespec sleeptime = { .tv_nsec = 250000000 };
2008
ret = nanosleep(&sleeptime, NULL);
2009
if(ret == -1 and errno != EINTR){
2010
perror_plus("nanosleep");
2011
}
2012
}
2013
if(not take_down_interface){
2014
/* We won't need the socket anymore */
2015
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2016
if(ret == -1){
2017
perror_plus("close");
2018
}
2019
}
2020
#ifdef __linux__
2021
if(restore_loglevel){
2022
/* Restores kernel loglevel to default */
2023
ret = klogctl(7, NULL, 0);
2024
if(ret == -1){
2025
perror_plus("klogctl");
2026
}
2027
}
2028
#endif /* __linux__ */
2029
/* Lower privileges */
2030
errno = 0;
2031
/* Lower privileges */
2032
ret = seteuid(uid);
2033
if(ret == -1){
2034
perror_plus("seteuid");
2035
}
2337
2036
}
2338
2037
2339
2038
if(quit_now){
2340
2039
goto end;
2341
2040
}
2342
2041
2343
ret = init_gnutls_global(pubkey, seckey, &mc);
2042
ret = init_gnutls_global(pubkey, seckey);
2344
2043
if(ret == -1){
2345
2044
fprintf_plus(stderr, "init_gnutls_global failed\n");
2346
2045
exitcode = EX_UNAVAILABLE;
2353
2052
goto end;
2354
2053
}
2355
2054
2356
/* Try /run/tmp before /tmp */
2357
tempdir = mkdtemp(run_tempdir);
2358
if(tempdir == NULL and errno == ENOENT){
2359
if(debug){
2360
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2361
run_tempdir, old_tempdir);
2362
}
2363
tempdir = mkdtemp(old_tempdir);
2364
}
2365
if(tempdir == NULL){
2055
if(mkdtemp(tempdir) == NULL){
2366
2056
perror_plus("mkdtemp");
2367
2057
goto end;
2368
2058
}
2059
tempdir_created = true;
2369
2060
2370
2061
if(quit_now){
2371
2062
goto end;
2372
2063
}
2373
2064
2374
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2065
if(not init_gpgme(pubkey, seckey, tempdir)){
2375
2066
fprintf_plus(stderr, "init_gpgme failed\n");
2376
2067
exitcode = EX_UNAVAILABLE;
2377
2068
goto end;
2387
2078
/* Connect directly, do not use Zeroconf */
2388
2079
/* (Mainly meant for debugging) */
2389
2080
char *address = strrchr(connect_to, ':');
2390
2391
2081
if(address == NULL){
2392
2082
fprintf_plus(stderr, "No colon in address\n");
2393
2083
exitcode = EX_USAGE;
2398
2088
goto end;
2399
2089
}
2400
2090
2401
in_port_t port;
2091
uint16_t port;
2402
2092
errno = 0;
2403
2093
tmpmax = strtoimax(address+1, &tmp, 10);
2404
2094
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2405
or tmpmax != (in_port_t)tmpmax){
2095
or tmpmax != (uint16_t)tmpmax){
2406
2096
fprintf_plus(stderr, "Bad port number\n");
2407
2097
exitcode = EX_USAGE;
2408
2098
goto end;
2409
2099
}
2410
2100
2411
2101
if(quit_now){
2412
2102
goto end;
2413
2103
}
2414
2104
2415
port = (in_port_t)tmpmax;
2105
port = (uint16_t)tmpmax;
2416
2106
*address = '\0';
2417
2107
/* Colon in address indicates IPv6 */
2418
2108
int af;
2434
2124
}
2435
2125
2436
2126
while(not quit_now){
2437
ret = start_mandos_communication(address, port, if_index, af,
2438
&mc);
2127
ret = start_mandos_communication(address, port, if_index, af);
2439
2128
if(quit_now or ret == 0){
2440
2129
break;
2441
2130
}
2443
2132
fprintf_plus(stderr, "Retrying in %d seconds\n",
2444
2133
(int)retry_interval);
2445
2134
}
2446
sleep((unsigned int)retry_interval);
2135
sleep((int)retry_interval);
2447
2136
}
2448
2137
2449
if(not quit_now){
2138
if (not quit_now){
2450
2139
exitcode = EXIT_SUCCESS;
2451
2140
}
2452
2141
2467
2156
config.publish_domain = 0;
2468
2157
2469
2158
/* Allocate a new server */
2470
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2471
&config, NULL, NULL, &ret_errno);
2159
mc.server = avahi_server_new(avahi_simple_poll_get
2160
(mc.simple_poll), &config, NULL,
2161
NULL, &error);
2472
2162
2473
2163
/* Free the Avahi configuration data */
2474
2164
avahi_server_config_free(&config);
2477
2167
/* Check if creating the Avahi server object succeeded */
2478
2168
if(mc.server == NULL){
2479
2169
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2480
avahi_strerror(ret_errno));
2170
avahi_strerror(error));
2481
2171
exitcode = EX_UNAVAILABLE;
2482
2172
goto end;
2483
2173
}
2489
2179
/* Create the Avahi service browser */
2490
2180
sb = avahi_s_service_browser_new(mc.server, if_index,
2491
2181
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2492
NULL, 0, browse_callback,
2493
(void *)&mc);
2182
NULL, 0, browse_callback, NULL);
2494
2183
if(sb == NULL){
2495
2184
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2496
2185
avahi_strerror(avahi_server_errno(mc.server)));
2507
2196
if(debug){
2508
2197
fprintf_plus(stderr, "Starting Avahi loop search\n");
2509
2198
}
2510
2511
ret = avahi_loop_with_timeout(simple_poll,
2512
(int)(retry_interval * 1000), &mc);
2199
2200
ret = avahi_loop_with_timeout(mc.simple_poll,
2201
(int)(retry_interval * 1000));
2513
2202
if(debug){
2514
2203
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2515
2204
(ret == 0) ? "successfully" : "with error");
2522
2211
}
2523
2212
2524
2213
/* Cleanup things */
2525
free(mc.interfaces);
2526
2527
2214
if(sb != NULL)
2528
2215
avahi_s_service_browser_free(sb);
2529
2216
2530
2217
if(mc.server != NULL)
2531
2218
avahi_server_free(mc.server);
2532
2219
2533
if(simple_poll != NULL)
2534
avahi_simple_poll_free(simple_poll);
2220
if(mc.simple_poll != NULL)
2221
avahi_simple_poll_free(mc.simple_poll);
2535
2222
2536
2223
if(gnutls_initialized){
2537
2224
gnutls_certificate_free_credentials(mc.cred);
2554
2241
}
2555
2242
}
2556
2243
2557
/* Re-raise privileges */
2244
/* Run network hooks */
2245
run_network_hooks("stop", interface, delay);
2246
2247
/* Re-raise priviliges */
2558
2248
{
2559
ret_errno = raise_privileges();
2560
if(ret_errno != 0){
2561
errno = ret_errno;
2562
perror_plus("Failed to raise privileges");
2563
} else {
2564
2565
/* Run network hooks */
2566
run_network_hooks("stop", interfaces_hooks != NULL ?
2567
interfaces_hooks : "", delay);
2568
2569
/* Take down the network interfaces which were brought up */
2570
{
2571
char *interface = NULL;
2572
while((interface=argz_next(interfaces_to_take_down,
2573
interfaces_to_take_down_size,
2574
interface))){
2575
ret_errno = take_down_interface(interface);
2576
if(ret_errno != 0){
2577
errno = ret_errno;
2578
perror_plus("Failed to take down interface");
2579
}
2580
}
2581
if(debug and (interfaces_to_take_down == NULL)){
2582
fprintf_plus(stderr, "No interfaces needed to be taken"
2583
" down\n");
2584
}
2585
}
2249
errno = 0;
2250
ret = seteuid(0);
2251
if(ret == -1){
2252
perror_plus("seteuid");
2586
2253
}
2587
2254
2588
ret_errno = lower_privileges_permanently();
2589
if(ret_errno != 0){
2590
errno = ret_errno;
2591
perror_plus("Failed to lower privileges permanently");
2255
/* Take down the network interface */
2256
if(take_down_interface and geteuid() == 0){
2257
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2258
if(ret == -1){
2259
perror_plus("ioctl SIOCGIFFLAGS");
2260
} else if(network.ifr_flags & IFF_UP){
2261
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2262
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2263
if(ret == -1){
2264
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2265
}
2266
}
2267
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2268
if(ret == -1){
2269
perror_plus("close");
2270
}
2592
2271
}
2593
2272
}
2594
2595
free(interfaces_to_take_down);
2596
free(interfaces_hooks);
2273
/* Lower privileges permanently */
2274
errno = 0;
2275
ret = setuid(uid);
2276
if(ret == -1){
2277
perror_plus("setuid");
2278
}
2597
2279
2598
2280
/* Removes the GPGME temp directory and all files inside */
2599
if(tempdir != NULL){
2281
if(tempdir_created){
2600
2282
struct dirent **direntries = NULL;
2601
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2602
O_NOFOLLOW));
2603
if(tempdir_fd == -1){
2604
perror_plus("open");
2605
} else {
2606
#ifdef __GLIBC__
2607
#if __GLIBC_PREREQ(2, 15)
2608
int numentries = scandirat(tempdir_fd, ".", &direntries,
2609
notdotentries, alphasort);
2610
#else /* not __GLIBC_PREREQ(2, 15) */
2611
int numentries = scandir(tempdir, &direntries, notdotentries,
2612
alphasort);
2613
#endif /* not __GLIBC_PREREQ(2, 15) */
2614
#else /* not __GLIBC__ */
2615
int numentries = scandir(tempdir, &direntries, notdotentries,
2616
alphasort);
2617
#endif /* not __GLIBC__ */
2618
if(numentries >= 0){
2619
for(int i = 0; i < numentries; i++){
2620
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2621
if(ret == -1){
2622
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2623
" \"%s\", 0): %s\n", tempdir,
2624
direntries[i]->d_name, strerror(errno));
2625
}
2626
}
2627
2628
/* need to clean even if 0 because man page doesn't specify */
2629
free(direntries);
2630
if(numentries == -1){
2631
perror_plus("scandir");
2632
}
2633
ret = rmdir(tempdir);
2634
if(ret == -1 and errno != ENOENT){
2635
perror_plus("rmdir");
2636
}
2283
struct dirent *direntry = NULL;
2284
int numentries = scandir(tempdir, &direntries, notdotentries,
2285
alphasort);
2286
if (numentries > 0){
2287
for(int i = 0; i < numentries; i++){
2288
direntry = direntries[i];
2289
char *fullname = NULL;
2290
ret = asprintf(&fullname, "%s/%s", tempdir,
2291
direntry->d_name);
2292
if(ret < 0){
2293
perror_plus("asprintf");
2294
continue;
2295
}
2296
ret = remove(fullname);
2297
if(ret == -1){
2298
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2299
strerror(errno));
2300
}
2301
free(fullname);
2637
2302
}
2638
TEMP_FAILURE_RETRY(close(tempdir_fd));
2303
}
2304
2305
/* need to clean even if 0 because man page doesn't specify */
2306
free(direntries);
2307
if (numentries == -1){
2308
perror_plus("scandir");
2309
}
2310
ret = rmdir(tempdir);
2311
if(ret == -1 and errno != ENOENT){
2312
perror_plus("rmdir");
2639
2313
}
2640
2314
}
2641
2315
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0