9
9
* "browse_callback", and parts of "main".
11
11
* Everything else is
12
* Copyright © 2008-2014 Teddy Hogeborn
13
* Copyright © 2008-2014 Björn Påhlsson
12
* Copyright © 2008-2013 Teddy Hogeborn
13
* Copyright © 2008-2013 Björn Påhlsson
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
183
183
perror(print_text);
186
__attribute__((format (gnu_printf, 2, 3), nonnull))
186
__attribute__((format (gnu_printf, 2, 3)))
187
187
int fprintf_plus(FILE *stream, const char *format, ...){
189
189
va_start (ap, format);
198
198
* bytes. "buffer_capacity" is how much is currently allocated,
199
199
* "buffer_length" is how much is already used.
201
__attribute__((nonnull, warn_unused_result))
202
201
size_t incbuffer(char **buffer, size_t buffer_length,
203
202
size_t buffer_capacity){
204
203
if(buffer_length + BUFFER_SIZE > buffer_capacity){
219
218
/* Add server to set of servers to retry periodically */
220
__attribute__((nonnull, warn_unused_result))
221
219
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
222
220
int af, server **current_server){
244
242
new_server->next = new_server;
245
243
new_server->prev = new_server;
246
244
*current_server = new_server;
245
/* Place the new server last in the list */
248
/* Place the new server last in the list */
249
247
new_server->next = *current_server;
250
248
new_server->prev = (*current_server)->prev;
251
249
new_server->prev->next = new_server;
258
256
* Initialize GPGME.
260
__attribute__((nonnull, warn_unused_result))
261
static bool init_gpgme(const char * const seckey,
262
const char * const pubkey,
263
const char * const tempdir,
258
static bool init_gpgme(const char *seckey, const char *pubkey,
259
const char *tempdir, mandos_context *mc){
265
260
gpgme_error_t rc;
266
261
gpgme_engine_info_t engine_info;
269
264
* Helper function to insert pub and seckey to the engine keyring.
271
bool import_key(const char * const filename){
266
bool import_key(const char *filename){
274
269
gpgme_data_t pgp_data;
492
485
/* GnuTLS log function callback */
493
__attribute__((nonnull))
494
486
static void debuggnutls(__attribute__((unused)) int level,
495
487
const char* string){
496
488
fprintf_plus(stderr, "GnuTLS: %s", string);
499
__attribute__((nonnull, warn_unused_result))
500
491
static int init_gnutls_global(const char *pubkeyfilename,
501
492
const char *seckeyfilename,
502
493
mandos_context *mc){
639
629
__attribute__((unused)) const char *txt){}
641
631
/* Called when a Mandos server is found */
642
__attribute__((nonnull, warn_unused_result))
643
632
static int start_mandos_communication(const char *ip, in_port_t port,
644
633
AvahiIfIndex if_index,
645
634
int af, mandos_context *mc){
646
635
int ret, tcp_sd = -1;
648
struct sockaddr_storage to;
638
struct sockaddr_in in;
639
struct sockaddr_in6 in6;
649
641
char *buffer = NULL;
650
642
char *decrypted_buffer = NULL;
651
643
size_t buffer_length = 0;
733
725
memset(&to, 0, sizeof(to));
734
726
if(af == AF_INET6){
735
((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;
736
ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);
727
to.in6.sin6_family = (sa_family_t)af;
728
ret = inet_pton(af, ip, &to.in6.sin6_addr);
737
729
} else { /* IPv4 */
738
((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;
739
ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);
730
to.in.sin_family = (sa_family_t)af;
731
ret = inet_pton(af, ip, &to.in.sin_addr);
753
745
if(af == AF_INET6){
754
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
755
if(IN6_IS_ADDR_LINKLOCAL
756
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
746
to.in6.sin6_port = htons(port);
748
#pragma GCC diagnostic push
749
#pragma GCC diagnostic ignored "-Wstrict-aliasing"
751
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
752
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower */
754
#pragma GCC diagnostic pop
757
756
if(if_index == AVAHI_IF_UNSPEC){
758
757
fprintf_plus(stderr, "An IPv6 link-local address is"
759
758
" incomplete without a network interface\n");
763
762
/* Set the network interface number as scope */
764
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
763
to.in6.sin6_scope_id = (uint32_t)if_index;
767
((struct sockaddr_in *)&to)->sin_port = htons(port);
766
to.in.sin_port = htons(port);
788
787
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
789
788
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
790
789
if(af == AF_INET6){
791
ret = getnameinfo((struct sockaddr *)&to,
792
sizeof(struct sockaddr_in6),
790
ret = getnameinfo((struct sockaddr *)&(to.in6), sizeof(to.in6),
793
791
addrstr, sizeof(addrstr), NULL, 0,
796
ret = getnameinfo((struct sockaddr *)&to,
797
sizeof(struct sockaddr_in),
794
ret = getnameinfo((struct sockaddr *)&(to.in), sizeof(to.in),
798
795
addrstr, sizeof(addrstr), NULL, 0,
815
812
if(af == AF_INET6){
816
ret = connect(tcp_sd, (struct sockaddr *)&to,
817
sizeof(struct sockaddr_in6));
813
ret = connect(tcp_sd, &to.in6, sizeof(to));
819
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
820
sizeof(struct sockaddr_in));
815
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
823
if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
818
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
825
820
perror_plus("connect");
1253
1245
* corresponds to an acceptable network device.
1254
1246
* (This function is passed to scandir(3) as a filter function.)
1256
__attribute__((nonnull, warn_unused_result))
1257
1248
int good_interface(const struct dirent *if_entry){
1258
1249
if(if_entry->d_name[0] == '.'){
1278
1269
* This function determines if a network interface is up.
1280
__attribute__((nonnull, warn_unused_result))
1281
1271
bool interface_is_up(const char *interface){
1282
1272
struct ifreq ifr;
1283
1273
if(not get_flags(interface, &ifr)){
1295
1285
* This function determines if a network interface is running
1297
__attribute__((nonnull, warn_unused_result))
1298
1287
bool interface_is_running(const char *interface){
1299
1288
struct ifreq ifr;
1300
1289
if(not get_flags(interface, &ifr)){
1308
1297
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1311
__attribute__((nonnull, pure, warn_unused_result))
1312
1300
int notdotentries(const struct dirent *direntry){
1313
1301
/* Skip "." and ".." */
1314
1302
if(direntry->d_name[0] == '.'
1394
1380
if(mc->current_server == NULL){
1396
1382
fprintf_plus(stderr, "Wait until first server is found."
1397
1383
" No timeout!\n");
1399
1385
ret = avahi_simple_poll_iterate(s, -1);
1402
1388
fprintf_plus(stderr, "Check current_server if we should run"
1403
1389
" it, or wait\n");
1449
1435
ret = avahi_simple_poll_iterate(s, (int)block_time);
1452
if(ret > 0 or errno != EINTR){
1438
if (ret > 0 or errno != EINTR){
1453
1439
return (ret != 1) ? ret : 0;
1459
1445
/* Set effective uid to 0, return errno */
1460
__attribute__((warn_unused_result))
1461
1446
error_t raise_privileges(void){
1462
1447
error_t old_errno = errno;
1463
1448
error_t ret_errno = 0;
1472
1457
/* Set effective and real user ID to 0. Return errno. */
1473
__attribute__((warn_unused_result))
1474
1458
error_t raise_privileges_permanently(void){
1475
1459
error_t old_errno = errno;
1476
1460
error_t ret_errno = raise_privileges();
1512
1494
return ret_errno;
1515
__attribute__((nonnull))
1516
void run_network_hooks(const char *mode, const char *interface,
1497
bool run_network_hooks(const char *mode, const char *interface,
1517
1498
const float delay){
1518
1499
struct dirent **direntries;
1519
1500
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1547
1528
if(hook_pid == 0){
1549
1530
/* Raise privileges */
1550
if(raise_privileges_permanently() != 0){
1551
perror_plus("Failed to raise privileges");
1531
raise_privileges_permanently();
1554
1532
/* Set group */
1556
1534
ret = setgid(0);
1558
1536
perror_plus("setgid");
1561
1538
/* Reset supplementary groups */
1563
1540
ret = setgroups(0, NULL);
1565
1542
perror_plus("setgroups");
1568
ret = dup2(devnull, STDIN_FILENO);
1570
perror_plus("dup2(devnull, STDIN_FILENO)");
1573
ret = close(devnull);
1575
perror_plus("close");
1578
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1580
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1544
dup2(devnull, STDIN_FILENO);
1546
dup2(STDERR_FILENO, STDOUT_FILENO);
1583
1547
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1585
1549
perror_plus("setenv");
1661
1625
close(devnull);
1665
__attribute__((nonnull, warn_unused_result))
1666
1630
error_t bring_up_interface(const char *const interface,
1667
1631
const float delay){
1668
1633
error_t old_errno = errno;
1634
error_t ret_errno = 0;
1635
int ret, ret_setflags;
1670
1636
struct ifreq network;
1671
1637
unsigned int if_index = if_nametoindex(interface);
1672
1638
if(if_index == 0){
1683
1649
if(not interface_is_up(interface)){
1684
error_t ret_errno = 0, ioctl_errno = 0;
1685
if(not get_flags(interface, &network)){
1650
if(not get_flags(interface, &network) and debug){
1686
1651
ret_errno = errno;
1687
1652
fprintf_plus(stderr, "Failed to get flags for interface "
1688
1653
"\"%s\"\n", interface);
1690
1654
return ret_errno;
1692
network.ifr_flags |= IFF_UP; /* set flag */
1656
network.ifr_flags |= IFF_UP;
1694
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1658
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1696
1660
ret_errno = errno;
1697
1661
perror_plus("socket");
1698
1662
errno = old_errno;
1699
1663
return ret_errno;
1703
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1705
perror_plus("close");
1707
1668
errno = old_errno;
1716
/* Raise privileges */
1717
ret_errno = raise_privileges();
1719
perror_plus("Failed to raise privileges");
1677
/* Raise priviliges */
1722
1680
#ifdef __linux__
1724
bool restore_loglevel = false;
1726
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1727
messages about the network interface to mess up the prompt */
1728
ret_linux = klogctl(8, NULL, 5);
1729
if(ret_linux == -1){
1730
perror_plus("klogctl");
1732
restore_loglevel = true;
1681
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1682
messages about the network interface to mess up the prompt */
1683
int ret_linux = klogctl(8, NULL, 5);
1684
bool restore_loglevel = true;
1685
if(ret_linux == -1){
1686
restore_loglevel = false;
1687
perror_plus("klogctl");
1735
1689
#endif /* __linux__ */
1736
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1737
ioctl_errno = errno;
1690
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1738
1692
#ifdef __linux__
1739
1693
if(restore_loglevel){
1740
1694
ret_linux = klogctl(7, NULL, 0);
1801
1747
if(interface_is_up(interface)){
1802
error_t ret_errno = 0, ioctl_errno = 0;
1748
error_t ret_errno = 0;
1803
1749
if(not get_flags(interface, &network) and debug){
1804
1750
ret_errno = errno;
1805
1751
fprintf_plus(stderr, "Failed to get flags for interface "
1806
1752
"\"%s\"\n", interface);
1808
1753
return ret_errno;
1810
1755
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1812
1757
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1814
1759
ret_errno = errno;
1815
1760
perror_plus("socket");
1816
1761
errno = old_errno;
1825
/* Raise privileges */
1826
ret_errno = raise_privileges();
1828
perror_plus("Failed to raise privileges");
1770
/* Raise priviliges */
1831
1773
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1832
ioctl_errno = errno;
1834
/* If raise_privileges() succeeded above */
1836
/* Lower privileges */
1837
ret_errno = lower_privileges();
1840
perror_plus("Failed to lower privileges");
1776
/* Lower privileges */
1844
1779
/* Close the socket */
1845
1780
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1865
1800
int main(int argc, char *argv[]){
1866
1801
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1867
1802
.priority = "SECURE256:!CTYPE-X.509:"
1868
"+CTYPE-OPENPGP", .current_server = NULL,
1803
"+CTYPE-OPENPGP", .current_server = NULL,
1869
1804
.interfaces = NULL, .interfaces_size = 0 };
1870
1805
AvahiSServiceBrowser *sb = NULL;
1871
1806
error_t ret_errno;
1875
1810
int exitcode = EXIT_SUCCESS;
1876
1811
char *interfaces_to_take_down = NULL;
1877
1812
size_t interfaces_to_take_down_size = 0;
1878
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
1879
char old_tempdir[] = "/tmp/mandosXXXXXX";
1880
char *tempdir = NULL;
1813
char tempdir[] = "/tmp/mandosXXXXXX";
1814
bool tempdir_created = false;
1881
1815
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1882
1816
const char *seckey = PATHDIR "/" SECKEY;
1883
1817
const char *pubkey = PATHDIR "/" PUBKEY;
2065
1999
/* Work around Debian bug #633582:
2066
2000
<http://bugs.debian.org/633582> */
2068
/* Re-raise privileges */
2069
ret_errno = raise_privileges();
2072
perror_plus("Failed to raise privileges");
2002
/* Re-raise priviliges */
2003
if(raise_privileges() == 0){
2074
2004
struct stat st;
2076
2006
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2152
2078
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2153
2079
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2155
run_network_hooks("start", interfaces_hooks != NULL ?
2156
interfaces_hooks : "", delay);
2081
if(not run_network_hooks("start", interfaces_hooks != NULL ?
2082
interfaces_hooks : "", delay)){
2289
2217
bool interface_was_up = interface_is_up(interface);
2290
errno = bring_up_interface(interface, delay);
2218
ret = bring_up_interface(interface, delay);
2291
2219
if(not interface_was_up){
2293
2222
perror_plus("Failed to bring up interface");
2295
errno = argz_add(&interfaces_to_take_down,
2296
&interfaces_to_take_down_size,
2224
ret_errno = argz_add(&interfaces_to_take_down,
2225
&interfaces_to_take_down_size,
2299
2229
perror_plus("argz_add");
2335
/* Try /run/tmp before /tmp */
2336
tempdir = mkdtemp(run_tempdir);
2337
if(tempdir == NULL and errno == ENOENT){
2339
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2340
run_tempdir, old_tempdir);
2342
tempdir = mkdtemp(old_tempdir);
2344
if(tempdir == NULL){
2265
if(mkdtemp(tempdir) == NULL){
2345
2266
perror_plus("mkdtemp");
2269
tempdir_created = true;
2536
/* Re-raise privileges */
2458
/* Re-raise priviliges */
2538
ret_errno = raise_privileges();
2540
perror_plus("Failed to raise privileges");
2543
/* Run network hooks */
2544
run_network_hooks("stop", interfaces_hooks != NULL ?
2545
interfaces_hooks : "", delay);
2547
/* Take down the network interfaces which were brought up */
2549
char *interface = NULL;
2550
while((interface=argz_next(interfaces_to_take_down,
2551
interfaces_to_take_down_size,
2553
ret_errno = take_down_interface(interface);
2556
perror_plus("Failed to take down interface");
2559
if(debug and (interfaces_to_take_down == NULL)){
2560
fprintf_plus(stderr, "No interfaces needed to be taken"
2566
ret_errno = lower_privileges_permanently();
2568
perror_plus("Failed to lower privileges permanently");
2462
/* Run network hooks */
2463
run_network_hooks("stop", interfaces_hooks != NULL ?
2464
interfaces_hooks : "", delay);
2466
/* Take down the network interfaces which were brought up */
2468
char *interface = NULL;
2469
while((interface=argz_next(interfaces_to_take_down,
2470
interfaces_to_take_down_size,
2472
ret_errno = take_down_interface(interface);
2475
perror_plus("Failed to take down interface");
2478
if(debug and (interfaces_to_take_down == NULL)){
2479
fprintf_plus(stderr, "No interfaces needed to be taken"
2484
lower_privileges_permanently();
2572
2487
free(interfaces_to_take_down);
2573
2488
free(interfaces_hooks);
2575
2490
/* Removes the GPGME temp directory and all files inside */
2576
if(tempdir != NULL){
2491
if(tempdir_created){
2577
2492
struct dirent **direntries = NULL;
2578
2493
struct dirent *direntry = NULL;
2579
2494
int numentries = scandir(tempdir, &direntries, notdotentries,
2496
if (numentries > 0){
2582
2497
for(int i = 0; i < numentries; i++){
2583
2498
direntry = direntries[i];
2584
2499
char *fullname = NULL;