40
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
42
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
47
strtof(), abort() */
48
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* strcmp(), strlen(), strerror(),
50
asprintf(), strncpy() */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
51
#include <sys/ioctl.h> /* ioctl */
52
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
53
sockaddr_in6, PF_INET6,
576
558
safer_gnutls_strerror(ret));
579
/* If a Diffie-Hellman parameters file was given, try to use it */
580
if(dhparamsfilename != NULL){
581
gnutls_datum_t params = { .data = NULL, .size = 0 };
583
int dhpfile = open(dhparamsfilename, O_RDONLY);
586
dhparamsfilename = NULL;
589
size_t params_capacity = 0;
591
params_capacity = incbuffer((char **)¶ms.data,
593
(size_t)params_capacity);
594
if(params_capacity == 0){
595
perror_plus("incbuffer");
598
dhparamsfilename = NULL;
601
ssize_t bytes_read = read(dhpfile,
602
params.data + params.size,
608
/* check bytes_read for failure */
613
dhparamsfilename = NULL;
616
params.size += (unsigned int)bytes_read;
618
if(params.data == NULL){
619
dhparamsfilename = NULL;
621
if(dhparamsfilename == NULL){
624
ret = gnutls_dh_params_import_pkcs3(mc->dh_params, ¶ms,
625
GNUTLS_X509_FMT_PEM);
626
if(ret != GNUTLS_E_SUCCESS){
627
fprintf_plus(stderr, "Failed to parse DH parameters in file"
628
" \"%s\": %s\n", dhparamsfilename,
629
safer_gnutls_strerror(ret));
630
dhparamsfilename = NULL;
634
if(dhparamsfilename == NULL){
635
if(mc->dh_bits == 0){
636
/* Find out the optimal number of DH bits */
637
/* Try to read the private key file */
638
gnutls_datum_t buffer = { .data = NULL, .size = 0 };
640
int secfile = open(seckeyfilename, O_RDONLY);
645
size_t buffer_capacity = 0;
647
buffer_capacity = incbuffer((char **)&buffer.data,
649
(size_t)buffer_capacity);
650
if(buffer_capacity == 0){
651
perror_plus("incbuffer");
656
ssize_t bytes_read = read(secfile,
657
buffer.data + buffer.size,
663
/* check bytes_read for failure */
670
buffer.size += (unsigned int)bytes_read;
674
/* If successful, use buffer to parse private key */
675
gnutls_sec_param_t sec_param = GNUTLS_SEC_PARAM_ULTRA;
676
if(buffer.data != NULL){
678
gnutls_openpgp_privkey_t privkey = NULL;
679
ret = gnutls_openpgp_privkey_init(&privkey);
680
if(ret != GNUTLS_E_SUCCESS){
681
fprintf_plus(stderr, "Error initializing OpenPGP key"
683
safer_gnutls_strerror(ret));
687
ret = gnutls_openpgp_privkey_import
688
(privkey, &buffer, GNUTLS_OPENPGP_FMT_BASE64, "", 0);
689
if(ret != GNUTLS_E_SUCCESS){
690
fprintf_plus(stderr, "Error importing OpenPGP key : %s",
691
safer_gnutls_strerror(ret));
697
/* Use private key to suggest an appropriate
699
sec_param = gnutls_openpgp_privkey_sec_param(privkey);
700
gnutls_openpgp_privkey_deinit(privkey);
702
fprintf_plus(stderr, "This OpenPGP key implies using"
703
" a GnuTLS security parameter \"%s\".\n",
704
safe_string(gnutls_sec_param_get_name
710
if(sec_param == GNUTLS_SEC_PARAM_UNKNOWN){
711
/* Err on the side of caution */
712
sec_param = GNUTLS_SEC_PARAM_ULTRA;
714
fprintf_plus(stderr, "Falling back to security parameter"
716
safe_string(gnutls_sec_param_get_name
721
uret = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, sec_param);
725
fprintf_plus(stderr, "A \"%s\" GnuTLS security parameter"
726
" implies %u DH bits; using that.\n",
727
safe_string(gnutls_sec_param_get_name
732
fprintf_plus(stderr, "Failed to get implied number of DH"
733
" bits for security parameter \"%s\"): %s\n",
734
safe_string(gnutls_sec_param_get_name
736
safer_gnutls_strerror(ret));
740
fprintf_plus(stderr, "DH bits explicitly set to %u\n",
743
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
744
if(ret != GNUTLS_E_SUCCESS){
745
fprintf_plus(stderr, "Error in GnuTLS prime generation (%u"
746
" bits): %s\n", mc->dh_bits,
747
safer_gnutls_strerror(ret));
561
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
562
if(ret != GNUTLS_E_SUCCESS){
563
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
564
safer_gnutls_strerror(ret));
751
568
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
820
639
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
821
640
__attribute__((unused)) const char *txt){}
823
/* Set effective uid to 0, return errno */
824
__attribute__((warn_unused_result))
825
error_t raise_privileges(void){
826
error_t old_errno = errno;
827
error_t ret_errno = 0;
828
if(seteuid(0) == -1){
835
/* Set effective and real user ID to 0. Return errno. */
836
__attribute__((warn_unused_result))
837
error_t raise_privileges_permanently(void){
838
error_t old_errno = errno;
839
error_t ret_errno = raise_privileges();
851
/* Set effective user ID to unprivileged saved user ID */
852
__attribute__((warn_unused_result))
853
error_t lower_privileges(void){
854
error_t old_errno = errno;
855
error_t ret_errno = 0;
856
if(seteuid(uid) == -1){
863
/* Lower privileges permanently */
864
__attribute__((warn_unused_result))
865
error_t lower_privileges_permanently(void){
866
error_t old_errno = errno;
867
error_t ret_errno = 0;
868
if(setuid(uid) == -1){
875
/* Helper function to add_local_route() and delete_local_route() */
876
__attribute__((nonnull, warn_unused_result))
877
static bool add_delete_local_route(const bool add,
879
AvahiIfIndex if_index){
881
char helper[] = "mandos-client-iprouteadddel";
882
char add_arg[] = "add";
883
char delete_arg[] = "delete";
884
char debug_flag[] = "--debug";
885
char *pluginhelperdir = getenv("MANDOSPLUGINHELPERDIR");
886
if(pluginhelperdir == NULL){
888
fprintf_plus(stderr, "MANDOSPLUGINHELPERDIR environment"
889
" variable not set; cannot run helper\n");
894
char interface[IF_NAMESIZE];
895
if(if_indextoname((unsigned int)if_index, interface) == NULL){
896
perror_plus("if_indextoname");
900
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
902
perror_plus("open(\"/dev/null\", O_RDONLY)");
908
/* Raise privileges */
909
errno = raise_privileges_permanently();
911
perror_plus("Failed to raise privileges");
912
/* _exit(EX_NOPERM); */
918
perror_plus("setgid");
921
/* Reset supplementary groups */
923
ret = setgroups(0, NULL);
925
perror_plus("setgroups");
929
ret = dup2(devnull, STDIN_FILENO);
931
perror_plus("dup2(devnull, STDIN_FILENO)");
934
ret = close(devnull);
936
perror_plus("close");
939
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
941
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
944
int helperdir_fd = (int)TEMP_FAILURE_RETRY(open(pluginhelperdir,
949
if(helperdir_fd == -1){
951
_exit(EX_UNAVAILABLE);
953
int helper_fd = (int)TEMP_FAILURE_RETRY(openat(helperdir_fd,
956
perror_plus("openat");
958
_exit(EX_UNAVAILABLE);
962
#pragma GCC diagnostic push
963
#pragma GCC diagnostic ignored "-Wcast-qual"
965
if(fexecve(helper_fd, (char *const [])
966
{ helper, add ? add_arg : delete_arg, (char *)address,
967
interface, debug ? debug_flag : NULL, NULL },
970
#pragma GCC diagnostic pop
972
perror_plus("fexecve");
984
pret = waitpid(pid, &status, 0);
985
if(pret == -1 and errno == EINTR and quit_now){
986
int errno_raising = 0;
987
if((errno = raise_privileges()) != 0){
988
errno_raising = errno;
989
perror_plus("Failed to raise privileges in order to"
990
" kill helper program");
992
if(kill(pid, SIGTERM) == -1){
995
if((errno_raising == 0) and (errno = lower_privileges()) != 0){
996
perror_plus("Failed to lower privileges after killing"
1001
} while(pret == -1 and errno == EINTR);
1003
perror_plus("waitpid");
1006
if(WIFEXITED(status)){
1007
if(WEXITSTATUS(status) != 0){
1008
fprintf_plus(stderr, "Error: iprouteadddel exited"
1009
" with status %d\n", WEXITSTATUS(status));
1014
if(WIFSIGNALED(status)){
1015
fprintf_plus(stderr, "Error: iprouteadddel died by"
1016
" signal %d\n", WTERMSIG(status));
1019
fprintf_plus(stderr, "Error: iprouteadddel crashed\n");
1023
__attribute__((nonnull, warn_unused_result))
1024
static bool add_local_route(const char *address,
1025
AvahiIfIndex if_index){
1027
fprintf_plus(stderr, "Adding route to %s\n", address);
1029
return add_delete_local_route(true, address, if_index);
1032
__attribute__((nonnull, warn_unused_result))
1033
static bool delete_local_route(const char *address,
1034
AvahiIfIndex if_index){
1036
fprintf_plus(stderr, "Removing route to %s\n", address);
1038
return add_delete_local_route(false, address, if_index);
1041
642
/* Called when a Mandos server is found */
1042
643
__attribute__((nonnull, warn_unused_result))
1043
644
static int start_mandos_communication(const char *ip, in_port_t port,
1214
813
goto mandos_end;
1219
ret = connect(tcp_sd, (struct sockaddr *)&to,
1220
sizeof(struct sockaddr_in6));
1222
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
1223
sizeof(struct sockaddr_in));
1226
if(((errno == ENETUNREACH) or (errno == EHOSTUNREACH))
1227
and if_index != AVAHI_IF_UNSPEC
1228
and connect_to == NULL
1229
and not route_added and
1230
((af == AF_INET6 and not
1231
IN6_IS_ADDR_LINKLOCAL(&(((struct sockaddr_in6 *)
1233
or (af == AF_INET and
1234
/* Not a a IPv4LL address */
1235
(ntohl(((struct sockaddr_in *)&to)->sin_addr.s_addr)
1236
& 0xFFFF0000L) != 0xA9FE0000L))){
1237
/* Work around Avahi bug - Avahi does not announce link-local
1238
addresses if it has a global address, so local hosts with
1239
*only* a link-local address (e.g. Mandos clients) cannot
1240
connect to a Mandos server announced by Avahi on a server
1241
host with a global address. Work around this by retrying
1242
with an explicit route added with the server's address.
1244
Avahi bug reference:
1245
http://lists.freedesktop.org/archives/avahi/2010-February/001833.html
1246
https://bugs.debian.org/587961
1249
fprintf_plus(stderr, "Mandos server unreachable, trying"
1253
route_added = add_local_route(ip, if_index);
1259
if(errno != ECONNREFUSED or debug){
1261
perror_plus("connect");
817
ret = connect(tcp_sd, (struct sockaddr *)&to,
818
sizeof(struct sockaddr_in6));
820
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
821
sizeof(struct sockaddr_in));
824
if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
826
perror_plus("connect");
1274
837
const char *out = mandos_protocol_version;
1453
/* Set effective uid to 0, return errno */
1454
__attribute__((warn_unused_result))
1455
error_t raise_privileges(void){
1456
error_t old_errno = errno;
1457
error_t ret_errno = 0;
1458
if(seteuid(0) == -1){
1460
perror_plus("seteuid");
1466
/* Set effective and real user ID to 0. Return errno. */
1467
__attribute__((warn_unused_result))
1468
error_t raise_privileges_permanently(void){
1469
error_t old_errno = errno;
1470
error_t ret_errno = raise_privileges();
1475
if(setuid(0) == -1){
1477
perror_plus("seteuid");
1483
/* Set effective user ID to unprivileged saved user ID */
1484
__attribute__((warn_unused_result))
1485
error_t lower_privileges(void){
1486
error_t old_errno = errno;
1487
error_t ret_errno = 0;
1488
if(seteuid(uid) == -1){
1490
perror_plus("seteuid");
1496
/* Lower privileges permanently */
1497
__attribute__((warn_unused_result))
1498
error_t lower_privileges_permanently(void){
1499
error_t old_errno = errno;
1500
error_t ret_errno = 0;
1501
if(setuid(uid) == -1){
1503
perror_plus("setuid");
1511
* Based on the example in the GNU LibC manual chapter 13.13 "File
1512
* Descriptor Flags".
1513
| [[info:libc:Descriptor%20Flags][File Descriptor Flags]] |
1515
__attribute__((warn_unused_result))
1516
static int set_cloexec_flag(int fd){
1517
int ret = (int)TEMP_FAILURE_RETRY(fcntl(fd, F_GETFD, 0));
1518
/* If reading the flags failed, return error indication now. */
1522
/* Store modified flag word in the descriptor. */
1523
return (int)TEMP_FAILURE_RETRY(fcntl(fd, F_SETFD,
1526
#endif /* not O_CLOEXEC */
1898
1528
__attribute__((nonnull))
1899
1529
void run_network_hooks(const char *mode, const char *interface,
1900
1530
const float delay){
1901
struct dirent **direntries = NULL;
1531
struct dirent **direntries;
1902
1532
if(hookdir_fd == -1){
1903
hookdir_fd = open(hookdir, O_RDONLY | O_DIRECTORY | O_PATH
1533
hookdir_fd = open(hookdir, O_RDONLY |
1536
#else /* not O_CLOEXEC */
1538
#endif /* not O_CLOEXEC */
1905
1540
if(hookdir_fd == -1){
1906
1541
if(errno == ENOENT){
1552
if(set_cloexec_flag(hookdir_fd) < 0){
1553
perror_plus("set_cloexec_flag");
1554
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1555
perror_plus("close");
1561
#endif /* not O_CLOEXEC */
1564
#if __GLIBC_PREREQ(2, 15)
1917
1565
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1918
1566
runnable_hook, alphasort);
1567
#else /* not __GLIBC_PREREQ(2, 15) */
1568
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1570
#endif /* not __GLIBC_PREREQ(2, 15) */
1571
#else /* not __GLIBC__ */
1572
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1574
#endif /* not __GLIBC__ */
1919
1575
if(numhooks == -1){
1920
1576
perror_plus("scandir");
1923
1579
struct dirent *direntry;
1925
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
1927
perror_plus("open(\"/dev/null\", O_RDONLY)");
1581
int devnull = open("/dev/null", O_RDONLY);
1930
1582
for(int i = 0; i < numhooks; i++){
1931
1583
direntry = direntries[i];
3037
2617
/* Removes the GPGME temp directory and all files inside */
3038
2618
if(tempdir != NULL){
3039
2619
struct dirent **direntries = NULL;
3040
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY
3044
if(tempdir_fd == -1){
3045
perror_plus("open");
3047
int numentries = scandirat(tempdir_fd, ".", &direntries,
3048
notdotentries, alphasort);
3049
if(numentries >= 0){
3050
for(int i = 0; i < numentries; i++){
3051
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
3053
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
3054
" \"%s\", 0): %s\n", tempdir,
3055
direntries[i]->d_name, strerror(errno));
3057
free(direntries[i]);
3060
/* need to clean even if 0 because man page doesn't specify */
3062
if(numentries == -1){
3063
perror_plus("scandir");
3065
ret = rmdir(tempdir);
3066
if(ret == -1 and errno != ENOENT){
3067
perror_plus("rmdir");
2620
struct dirent *direntry = NULL;
2621
int numentries = scandir(tempdir, &direntries, notdotentries,
2624
for(int i = 0; i < numentries; i++){
2625
direntry = direntries[i];
2626
char *fullname = NULL;
2627
ret = asprintf(&fullname, "%s/%s", tempdir,
2630
perror_plus("asprintf");
2633
ret = remove(fullname);
2635
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2642
/* need to clean even if 0 because man page doesn't specify */
2644
if(numentries == -1){
2645
perror_plus("scandir");
2647
ret = rmdir(tempdir);
2648
if(ret == -1 and errno != ENOENT){
2649
perror_plus("rmdir");