/mandos/trunk : revision 651

55

opendir(), DIR */

56

#include <sys/stat.h> /* open(), S_ISREG */

57

#include <sys/socket.h> /* socket(), struct sockaddr_in6,

58

inet_pton(), connect(),

59

getnameinfo() */

58

inet_pton(), connect() */

60

59

#include <fcntl.h> /* open() */

61

60

#include <dirent.h> /* opendir(), struct dirent, readdir()

62

61

*/

74

73

#include <unistd.h> /* close(), SEEK_SET, off_t, write(),

75

74

getuid(), getgid(), seteuid(),

76

75

setgid(), pause(), _exit() */

77

#include <arpa/inet.h> /* inet_pton(), htons() */

76

#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */

78

77

#include <iso646.h> /* not, or, and */

79

78

#include <argp.h> /* struct argp_option, error_t, struct

80

79

argp_state, struct argp,

92

91

argz_delete(), argz_append(),

93

92

argz_stringify(), argz_add(),

94

93

argz_count() */

95

#include <netdb.h> /* getnameinfo(), NI_NUMERICHOST,

96

EAI_SYSTEM, gai_strerror() */

97

94

98

95

#ifdef __linux__

99

96

#include <sys/klog.h> /* klogctl() */

201

198

size_t incbuffer(char **buffer, size_t buffer_length,

202

199

size_t buffer_capacity){

203

200

if(buffer_length + BUFFER_SIZE > buffer_capacity){

204

char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);

205

if(new_buf == NULL){

206

int old_errno = errno;

207

free(*buffer);

208

errno = old_errno;

209

*buffer = NULL;

201

*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);

202

if(buffer == NULL){

210

203

return 0;

211

204

}

212

*buffer = new_buf;

213

205

buffer_capacity += BUFFER_SIZE;

214

206

}

215

207

return buffer_capacity;

232

224

perror_plus("strdup");

233

225

return false;

234

226

}

235

ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));

236

if(ret == -1){

237

perror_plus("clock_gettime");

238

return false;

239

}

240

227

/* Special case of first server */

241

228

if(*current_server == NULL){

242

229

new_server->next = new_server;

249

236

new_server->prev->next = new_server;

250

237

(*current_server)->prev = new_server;

251

238

}

239

ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);

240

if(ret == -1){

241

perror_plus("clock_gettime");

242

return false;

243

}

252

244

return true;

253

245

}

254

246

634

626

int af, mandos_context *mc){

635

627

int ret, tcp_sd = -1;

636

628

ssize_t sret;

637

struct sockaddr_storage to;

629

union {

630

struct sockaddr_in in;

631

struct sockaddr_in6 in6;

632

} to;

638

633

char *buffer = NULL;

639

634

char *decrypted_buffer = NULL;

640

635

size_t buffer_length = 0;

721

716

722

717

memset(&to, 0, sizeof(to));

723

718

if(af == AF_INET6){

724

((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;

725

ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);

719

to.in6.sin6_family = (sa_family_t)af;

720

ret = inet_pton(af, ip, &to.in6.sin6_addr);

726

721

} else { /* IPv4 */

727

((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;

728

ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);

722

to.in.sin_family = (sa_family_t)af;

723

ret = inet_pton(af, ip, &to.in.sin_addr);

729

724

}

730

725

if(ret < 0 ){

731

726

int e = errno;

740

735

goto mandos_end;

741

736

}

742

737

if(af == AF_INET6){

743

((struct sockaddr_in6 *)&to)->sin6_port = htons(port);

744

if(IN6_IS_ADDR_LINKLOCAL

745

(&((struct sockaddr_in6 *)&to)->sin6_addr)){

738

to.in6.sin6_port = htons(port);

739

#ifdef __GNUC__

740

#pragma GCC diagnostic push

741

#pragma GCC diagnostic ignored "-Wstrict-aliasing"

742

#endif

743

if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */

744

(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower */

745

#ifdef __GNUC__

746

#pragma GCC diagnostic pop

747

#endif

746

748

if(if_index == AVAHI_IF_UNSPEC){

747

749

fprintf_plus(stderr, "An IPv6 link-local address is"

748

750

" incomplete without a network interface\n");

750

752

goto mandos_end;

751

753

}

752

754

/* Set the network interface number as scope */

753

((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;

755

to.in6.sin6_scope_id = (uint32_t)if_index;

754

756

}

755

757

} else {

756

((struct sockaddr_in *)&to)->sin_port = htons(port);

758

to.in.sin_port = htons(port);

757

759

}

758

760

759

761

if(quit_now){

776

778

}

777

779

char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?

778

780

INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";

781

const char *pcret;

779

782

if(af == AF_INET6){

780

ret = getnameinfo((struct sockaddr *)&to,

781

sizeof(struct sockaddr_in6),

782

addrstr, sizeof(addrstr), NULL, 0,

783

NI_NUMERICHOST);

783

pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,

784

sizeof(addrstr));

784

785

} else {

785

ret = getnameinfo((struct sockaddr *)&to,

786

sizeof(struct sockaddr_in),

787

addrstr, sizeof(addrstr), NULL, 0,

788

NI_NUMERICHOST);

786

pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,

787

sizeof(addrstr));

789

788

}

790

if(ret == EAI_SYSTEM){

791

perror_plus("getnameinfo");

792

} else if(ret != 0) {

793

fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));

794

} else if(strcmp(addrstr, ip) != 0){

795

fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);

789

if(pcret == NULL){

790

perror_plus("inet_ntop");

791

} else {

792

if(strcmp(addrstr, ip) != 0){

793

fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);

794

}

796

795

}

797

796

}

798

797

802

801

}

803

802

804

803

if(af == AF_INET6){

805

ret = connect(tcp_sd, (struct sockaddr *)&to,

806

sizeof(struct sockaddr_in6));

804

ret = connect(tcp_sd, &to.in6, sizeof(to));

807

805

} else {

808

ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */

809

sizeof(struct sockaddr_in));

806

ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */

810

807

}

811

808

if(ret < 0){

812

809

if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){

1491

1488

bool run_network_hooks(const char *mode, const char *interface,

1492

1489

const float delay){

1493

1490

struct dirent **direntries;

1491

struct dirent *direntry;

1492

int ret;

1494

1493

int numhooks = scandir(hookdir, &direntries, runnable_hook,

1495

1494

alphasort);

1496

1495

if(numhooks == -1){

1503

1502

perror_plus("scandir");

1504

1503

}

1505

1504

} else {

1506

struct dirent *direntry;

1507

int ret;

1508

1505

int devnull = open("/dev/null", O_RDONLY);

1509

1506

for(int i = 0; i < numhooks; i++){

1510

1507

direntry = direntries[i];

1730

1727

}

1731

1728

1732

1729

error_t take_down_interface(const char *const interface){

1730

int sd = -1;

1733

1731

error_t old_errno = errno;

1732

error_t ret_errno = 0;

1733

int ret, ret_setflags;

1734

struct ifreq network;

1735

unsigned int if_index = if_nametoindex(interface);

1736

if(if_index == 0){

1739

return ENXIO;

1740

}

1741

if(interface_is_up(interface)){

1742

error_t ret_errno = 0;

1743

1742

if(not get_flags(interface, &network) and debug){

1744

1743

ret_errno = errno;

1745

1744

fprintf_plus(stderr, "Failed to get flags for interface "

1748

1747

}

1749

1748

network.ifr_flags &= ~(short)IFF_UP; /* clear flag */

1750

1749

1751

int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

1750

sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

1752

1751

if(sd < 0){

1753

1752

ret_errno = errno;

1754

1753

perror_plus("socket");

1764

1763

/* Raise priviliges */

1765

1764

raise_privileges();

1766

1765

1767

int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);

1766

ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);

1768

1767

ret_errno = errno;

1769

1768

1770

1769

/* Lower privileges */

1771

1770

lower_privileges();

1772

1771

1773

1772

/* Close the socket */

1774

int ret = (int)TEMP_FAILURE_RETRY(close(sd));

1773

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1775

1774

if(ret == -1){

1776

1775

perror_plus("close");

1777

1776

}

1810

1809

const char *seckey = PATHDIR "/" SECKEY;

1811

1810

const char *pubkey = PATHDIR "/" PUBKEY;

1812

1811

char *interfaces_hooks = NULL;

1812

size_t interfaces_hooks_size = 0;

1813

1814

bool gnutls_initialized = false;

1815

bool gpgme_initialized = false;

2070

goto end;

2071

}

2072

memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);

2073

argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');

2073

interfaces_hooks_size = mc.interfaces_size;

2074

argz_stringify(interfaces_hooks, interfaces_hooks_size,

2075

(int)',');

2074

2076

}

2075

2077

if(not run_network_hooks("start", interfaces_hooks != NULL ?

2076

2078

interfaces_hooks : "", delay)){

2169

2171

ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,

2170

2172

direntries[i]->d_name);

2171

2173

if(ret_errno != 0){

2172

errno = ret_errno;

2173

2174

perror_plus("argz_add");

2174

2175

continue;

2175

2176

}

2218

2219

ret_errno = argz_add(&interfaces_to_take_down,

2219

2220

&interfaces_to_take_down_size,

2220

2221

interface);

2221

if(ret_errno != 0){

2222

errno = ret_errno;

2223

perror_plus("argz_add");

2224

}

2225

2222

}

2226

2223

}

2227

2224

}