256
227
new_server->next = new_server;
257
228
new_server->prev = new_server;
258
229
*current_server = new_server;
230
/* Place the new server last in the list */
260
/* Place the new server last in the list */
261
232
new_server->next = *current_server;
262
233
new_server->prev = (*current_server)->prev;
263
234
new_server->prev->next = new_server;
264
235
(*current_server)->prev = new_server;
237
ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);
239
perror_plus("clock_gettime");
270
246
* Initialize GPGME.
272
__attribute__((nonnull, warn_unused_result))
273
static bool init_gpgme(const char * const seckey,
274
const char * const pubkey,
275
const char * const tempdir,
248
static bool init_gpgme(const char *seckey, const char *pubkey,
249
const char *tempdir, mandos_context *mc){
277
250
gpgme_error_t rc;
278
251
gpgme_engine_info_t engine_info;
281
254
* Helper function to insert pub and seckey to the engine keyring.
283
bool import_key(const char * const filename){
256
bool import_key(const char *filename){
286
259
gpgme_data_t pgp_data;
800
741
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
801
742
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
802
744
if(af == AF_INET6){
803
ret = getnameinfo((struct sockaddr *)&to,
804
sizeof(struct sockaddr_in6),
805
addrstr, sizeof(addrstr), NULL, 0,
745
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
808
ret = getnameinfo((struct sockaddr *)&to,
809
sizeof(struct sockaddr_in),
810
addrstr, sizeof(addrstr), NULL, 0,
748
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
813
if(ret == EAI_SYSTEM){
814
perror_plus("getnameinfo");
815
} else if(ret != 0) {
816
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
817
} else if(strcmp(addrstr, ip) != 0){
818
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
752
perror_plus("inet_ntop");
754
if(strcmp(addrstr, ip) != 0){
755
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
1486
1418
if(setuid(0) == -1){
1487
1419
ret_errno = errno;
1420
perror_plus("seteuid");
1489
1422
errno = old_errno;
1490
1423
return ret_errno;
1493
1426
/* Set effective user ID to unprivileged saved user ID */
1494
__attribute__((warn_unused_result))
1495
1427
error_t lower_privileges(void){
1496
1428
error_t old_errno = errno;
1497
1429
error_t ret_errno = 0;
1498
1430
if(seteuid(uid) == -1){
1499
1431
ret_errno = errno;
1432
perror_plus("seteuid");
1501
1434
errno = old_errno;
1502
1435
return ret_errno;
1505
1438
/* Lower privileges permanently */
1506
__attribute__((warn_unused_result))
1507
1439
error_t lower_privileges_permanently(void){
1508
1440
error_t old_errno = errno;
1509
1441
error_t ret_errno = 0;
1510
1442
if(setuid(uid) == -1){
1511
1443
ret_errno = errno;
1444
perror_plus("setuid");
1513
1446
errno = old_errno;
1514
1447
return ret_errno;
1517
__attribute__((nonnull))
1518
void run_network_hooks(const char *mode, const char *interface,
1450
bool run_network_hooks(const char *mode, const char *interface,
1519
1451
const float delay){
1520
struct dirent **direntries = NULL;
1521
if(hookdir_fd == -1){
1522
hookdir_fd = open(hookdir, O_RDONLY);
1523
if(hookdir_fd == -1){
1524
if(errno == ENOENT){
1526
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1527
" found\n", hookdir);
1530
perror_plus("open");
1536
#if __GLIBC_PREREQ(2, 15)
1537
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1538
runnable_hook, alphasort);
1539
#else /* not __GLIBC_PREREQ(2, 15) */
1540
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1542
#endif /* not __GLIBC_PREREQ(2, 15) */
1543
#else /* not __GLIBC__ */
1544
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1546
#endif /* not __GLIBC__ */
1452
struct dirent **direntries;
1453
struct dirent *direntry;
1455
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1547
1457
if(numhooks == -1){
1548
perror_plus("scandir");
1551
struct dirent *direntry;
1553
int devnull = open("/dev/null", O_RDONLY);
1554
for(int i = 0; i < numhooks; i++){
1555
direntry = direntries[i];
1557
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1458
if(errno == ENOENT){
1460
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1461
" found\n", hookdir);
1464
perror_plus("scandir");
1560
pid_t hook_pid = fork();
1563
/* Raise privileges */
1564
errno = raise_privileges_permanently();
1566
perror_plus("Failed to raise privileges");
1573
perror_plus("setgid");
1576
/* Reset supplementary groups */
1578
ret = setgroups(0, NULL);
1580
perror_plus("setgroups");
1583
ret = dup2(devnull, STDIN_FILENO);
1585
perror_plus("dup2(devnull, STDIN_FILENO)");
1588
ret = close(devnull);
1590
perror_plus("close");
1593
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1595
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1598
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1600
perror_plus("setenv");
1603
ret = setenv("DEVICE", interface, 1);
1605
perror_plus("setenv");
1608
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1610
perror_plus("setenv");
1613
ret = setenv("MODE", mode, 1);
1615
perror_plus("setenv");
1619
ret = asprintf(&delaystring, "%f", (double)delay);
1467
int devnull = open("/dev/null", O_RDONLY);
1468
for(int i = 0; i < numhooks; i++){
1469
direntry = direntries[i];
1470
char *fullname = NULL;
1471
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1621
1473
perror_plus("asprintf");
1624
ret = setenv("DELAY", delaystring, 1);
1477
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1480
pid_t hook_pid = fork();
1483
/* Raise privileges */
1484
raise_privileges_permanently();
1489
perror_plus("setgid");
1491
/* Reset supplementary groups */
1493
ret = setgroups(0, NULL);
1495
perror_plus("setgroups");
1497
dup2(devnull, STDIN_FILENO);
1499
dup2(STDERR_FILENO, STDOUT_FILENO);
1500
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1502
perror_plus("setenv");
1505
ret = setenv("DEVICE", interface, 1);
1507
perror_plus("setenv");
1510
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1512
perror_plus("setenv");
1515
ret = setenv("MODE", mode, 1);
1517
perror_plus("setenv");
1521
ret = asprintf(&delaystring, "%f", delay);
1523
perror_plus("asprintf");
1526
ret = setenv("DELAY", delaystring, 1);
1529
perror_plus("setenv");
1626
1532
free(delaystring);
1627
perror_plus("setenv");
1631
if(connect_to != NULL){
1632
ret = setenv("CONNECT", connect_to, 1);
1634
perror_plus("setenv");
1638
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1640
perror_plus("openat");
1641
_exit(EXIT_FAILURE);
1643
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1644
perror_plus("close");
1645
_exit(EXIT_FAILURE);
1647
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1649
perror_plus("fexecve");
1650
_exit(EXIT_FAILURE);
1654
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1655
perror_plus("waitpid");
1659
if(WIFEXITED(status)){
1660
if(WEXITSTATUS(status) != 0){
1661
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1662
" with status %d\n", direntry->d_name,
1663
WEXITSTATUS(status));
1667
} else if(WIFSIGNALED(status)){
1668
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1669
" signal %d\n", direntry->d_name,
1533
if(connect_to != NULL){
1534
ret = setenv("CONNECT", connect_to, 1);
1536
perror_plus("setenv");
1540
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1541
perror_plus("execl");
1542
_exit(EXIT_FAILURE);
1674
fprintf_plus(stderr, "Warning: network hook \"%s\""
1675
" crashed\n", direntry->d_name);
1681
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1687
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1688
perror_plus("close");
1546
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1547
perror_plus("waitpid");
1551
if(WIFEXITED(status)){
1552
if(WEXITSTATUS(status) != 0){
1553
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1554
" with status %d\n", direntry->d_name,
1555
WEXITSTATUS(status));
1559
} else if(WIFSIGNALED(status)){
1560
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1561
" signal %d\n", direntry->d_name,
1566
fprintf_plus(stderr, "Warning: network hook \"%s\""
1567
" crashed\n", direntry->d_name);
1574
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1695
__attribute__((nonnull, warn_unused_result))
1696
1583
error_t bring_up_interface(const char *const interface,
1697
1584
const float delay){
1698
1586
error_t old_errno = errno;
1587
error_t ret_errno = 0;
1588
int ret, ret_setflags;
1700
1589
struct ifreq network;
1701
1590
unsigned int if_index = if_nametoindex(interface);
1702
1591
if(if_index == 0){
1897
1755
int main(int argc, char *argv[]){
1898
1756
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1899
1757
.priority = "SECURE256:!CTYPE-X.509:"
1900
"+CTYPE-OPENPGP", .current_server = NULL,
1901
.interfaces = NULL, .interfaces_size = 0 };
1758
"+CTYPE-OPENPGP", .current_server = NULL };
1902
1759
AvahiSServiceBrowser *sb = NULL;
1903
1760
error_t ret_errno;
1905
1762
intmax_t tmpmax;
1907
1764
int exitcode = EXIT_SUCCESS;
1765
char *interfaces = NULL;
1766
size_t interfaces_size = 0;
1908
1767
char *interfaces_to_take_down = NULL;
1909
1768
size_t interfaces_to_take_down_size = 0;
1910
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
1911
char old_tempdir[] = "/tmp/mandosXXXXXX";
1912
char *tempdir = NULL;
1769
char tempdir[] = "/tmp/mandosXXXXXX";
1770
bool tempdir_created = false;
1913
1771
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1914
1772
const char *seckey = PATHDIR "/" SECKEY;
1915
1773
const char *pubkey = PATHDIR "/" PUBKEY;
1916
1774
char *interfaces_hooks = NULL;
1775
size_t interfaces_hooks_size = 0;
1918
1777
bool gnutls_initialized = false;
1919
1778
bool gpgme_initialized = false;
2270
2129
/* If no interfaces were specified, make a list */
2271
if(mc.interfaces == NULL){
2272
struct dirent **direntries = NULL;
2130
if(interfaces == NULL){
2131
struct dirent **direntries;
2273
2132
/* Look for any good interfaces */
2274
2133
ret = scandir(sys_class_net, &direntries, good_interface,
2277
2136
/* Add all found interfaces to interfaces list */
2278
2137
for(int i = 0; i < ret; ++i){
2279
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2138
ret_errno = argz_add(&interfaces, &interfaces_size,
2280
2139
direntries[i]->d_name);
2281
2140
if(ret_errno != 0){
2283
2141
perror_plus("argz_add");
2284
free(direntries[i]);
2288
2145
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2289
2146
direntries[i]->d_name);
2291
free(direntries[i]);
2293
2149
free(direntries);
2298
2152
fprintf_plus(stderr, "Could not find a network interface\n");
2299
2153
exitcode = EXIT_FAILURE;
2304
/* Bring up interfaces which are down, and remove any "none"s */
2158
/* If we only got one interface, explicitly use only that one */
2159
if(argz_count(interfaces, interfaces_size) == 1){
2161
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2164
if_index = (AvahiIfIndex)if_nametoindex(interfaces);
2167
/* Bring up interfaces which are down */
2168
if(not (argz_count(interfaces, interfaces_size) == 1
2169
and strcmp(interfaces, "none") == 0)){
2306
2170
char *interface = NULL;
2307
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2171
while((interface = argz_next(interfaces, interfaces_size,
2309
/* If interface name is "none", stop bringing up interfaces.
2310
Also remove all instances of "none" from the list */
2311
if(strcmp(interface, "none") == 0){
2312
argz_delete(&mc.interfaces, &mc.interfaces_size,
2315
while((interface = argz_next(mc.interfaces,
2316
mc.interfaces_size, interface))){
2317
if(strcmp(interface, "none") == 0){
2318
argz_delete(&mc.interfaces, &mc.interfaces_size,
2325
2173
bool interface_was_up = interface_is_up(interface);
2326
errno = bring_up_interface(interface, delay);
2174
ret = bring_up_interface(interface, delay);
2327
2175
if(not interface_was_up){
2329
2178
perror_plus("Failed to bring up interface");
2331
errno = argz_add(&interfaces_to_take_down,
2332
&interfaces_to_take_down_size,
2335
perror_plus("argz_add");
2180
ret_errno = argz_add(&interfaces_to_take_down,
2181
&interfaces_to_take_down_size,
2188
interfaces_size = 0;
2340
2189
if(debug and (interfaces_to_take_down == NULL)){
2341
2190
fprintf_plus(stderr, "No interfaces were brought up\n");
2345
/* If we only got one interface, explicitly use only that one */
2346
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2348
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2351
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2564
2394
mc.current_server->prev->next = NULL;
2565
2395
while(mc.current_server != NULL){
2566
2396
server *next = mc.current_server->next;
2568
#pragma GCC diagnostic push
2569
#pragma GCC diagnostic ignored "-Wcast-qual"
2571
free((char *)(mc.current_server->ip));
2573
#pragma GCC diagnostic pop
2575
2397
free(mc.current_server);
2576
2398
mc.current_server = next;
2580
/* Re-raise privileges */
2402
/* Re-raise priviliges */
2582
ret_errno = raise_privileges();
2585
perror_plus("Failed to raise privileges");
2588
/* Run network hooks */
2589
run_network_hooks("stop", interfaces_hooks != NULL ?
2590
interfaces_hooks : "", delay);
2592
/* Take down the network interfaces which were brought up */
2594
char *interface = NULL;
2595
while((interface=argz_next(interfaces_to_take_down,
2596
interfaces_to_take_down_size,
2598
ret_errno = take_down_interface(interface);
2601
perror_plus("Failed to take down interface");
2604
if(debug and (interfaces_to_take_down == NULL)){
2605
fprintf_plus(stderr, "No interfaces needed to be taken"
2611
ret_errno = lower_privileges_permanently();
2614
perror_plus("Failed to lower privileges permanently");
2406
/* Run network hooks */
2407
run_network_hooks("stop", interfaces_hooks != NULL ?
2408
interfaces_hooks : "", delay);
2410
/* Take down the network interfaces which were brought up */
2412
char *interface = NULL;
2413
while((interface=argz_next(interfaces_to_take_down,
2414
interfaces_to_take_down_size,
2416
ret_errno = take_down_interface(interface);
2419
perror_plus("Failed to take down interface");
2422
if(debug and (interfaces_to_take_down == NULL)){
2423
fprintf_plus(stderr, "No interfaces needed to be taken"
2428
lower_privileges_permanently();
2618
2431
free(interfaces_to_take_down);
2619
2432
free(interfaces_hooks);
2621
2434
/* Removes the GPGME temp directory and all files inside */
2622
if(tempdir != NULL){
2435
if(tempdir_created){
2623
2436
struct dirent **direntries = NULL;
2624
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2626
if(tempdir_fd == -1){
2627
perror_plus("open");
2630
#if __GLIBC_PREREQ(2, 15)
2631
int numentries = scandirat(tempdir_fd, ".", &direntries,
2632
notdotentries, alphasort);
2633
#else /* not __GLIBC_PREREQ(2, 15) */
2634
int numentries = scandir(tempdir, &direntries, notdotentries,
2636
#endif /* not __GLIBC_PREREQ(2, 15) */
2637
#else /* not __GLIBC__ */
2638
int numentries = scandir(tempdir, &direntries, notdotentries,
2640
#endif /* not __GLIBC__ */
2641
if(numentries >= 0){
2642
for(int i = 0; i < numentries; i++){
2643
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2645
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2646
" \"%s\", 0): %s\n", tempdir,
2647
direntries[i]->d_name, strerror(errno));
2649
free(direntries[i]);
2652
/* need to clean even if 0 because man page doesn't specify */
2654
if(numentries == -1){
2655
perror_plus("scandir");
2657
ret = rmdir(tempdir);
2658
if(ret == -1 and errno != ENOENT){
2659
perror_plus("rmdir");
2437
struct dirent *direntry = NULL;
2438
int numentries = scandir(tempdir, &direntries, notdotentries,
2440
if (numentries > 0){
2441
for(int i = 0; i < numentries; i++){
2442
direntry = direntries[i];
2443
char *fullname = NULL;
2444
ret = asprintf(&fullname, "%s/%s", tempdir,
2447
perror_plus("asprintf");
2450
ret = remove(fullname);
2452
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2662
TEMP_FAILURE_RETRY(close(tempdir_fd));
2459
/* need to clean even if 0 because man page doesn't specify */
2461
if (numentries == -1){
2462
perror_plus("scandir");
2464
ret = rmdir(tempdir);
2465
if(ret == -1 and errno != ENOENT){
2466
perror_plus("rmdir");