/mandos/trunk : revision 705

9

* "browse_callback", and parts of "main".

10

*

11

* Everything else is

12

13

12

13

14

*

15

* This program is free software: you can redistribute it and/or

16

* modify it under the terms of the GNU General Public License as

234

.af = af };

235

if(new_server->ip == NULL){

236

perror_plus("strdup");

237

free(new_server);

238

237

return false;

239

238

}

240

239

ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));

241

240

if(ret == -1){

242

241

perror_plus("clock_gettime");

243

#ifdef __GNUC__

244

#pragma GCC diagnostic push

245

#pragma GCC diagnostic ignored "-Wcast-qual"

246

#endif

247

free((char *)(new_server->ip));

248

#ifdef __GNUC__

249

#pragma GCC diagnostic pop

250

#endif

251

free(new_server);

252

242

return false;

253

243

}

254

244

/* Special case of first server */

650

640

static void empty_log(__attribute__((unused)) AvahiLogLevel level,

651

641

__attribute__((unused)) const char *txt){}

652

642

653

/* Set effective uid to 0, return errno */

654

__attribute__((warn_unused_result))

655

error_t raise_privileges(void){

656

error_t old_errno = errno;

657

error_t ret_errno = 0;

658

if(seteuid(0) == -1){

659

ret_errno = errno;

660

}

661

errno = old_errno;

662

return ret_errno;

663

}

664

665

/* Set effective and real user ID to 0. Return errno. */

666

__attribute__((warn_unused_result))

667

error_t raise_privileges_permanently(void){

668

error_t old_errno = errno;

669

error_t ret_errno = raise_privileges();

670

if(ret_errno != 0){

671

errno = old_errno;

672

return ret_errno;

673

}

674

if(setuid(0) == -1){

675

ret_errno = errno;

676

}

677

errno = old_errno;

678

return ret_errno;

679

}

680

681

/* Set effective user ID to unprivileged saved user ID */

682

__attribute__((warn_unused_result))

683

error_t lower_privileges(void){

684

error_t old_errno = errno;

685

error_t ret_errno = 0;

686

if(seteuid(uid) == -1){

687

ret_errno = errno;

688

}

689

errno = old_errno;

690

return ret_errno;

691

}

692

693

/* Lower privileges permanently */

694

__attribute__((warn_unused_result))

695

error_t lower_privileges_permanently(void){

696

error_t old_errno = errno;

697

error_t ret_errno = 0;

698

if(setuid(uid) == -1){

699

ret_errno = errno;

700

}

701

errno = old_errno;

702

return ret_errno;

703

}

704

705

/* Helper function to add_local_route() and delete_local_route() */

706

__attribute__((nonnull, warn_unused_result))

707

static bool add_delete_local_route(const bool add,

708

const char *address,

709

AvahiIfIndex if_index){

710

int ret;

711

char helper[] = "mandos-client-iprouteadddel";

712

char add_arg[] = "add";

713

char delete_arg[] = "delete";

714

char debug_flag[] = "--debug";

715

char *pluginhelperdir = getenv("MANDOSPLUGINHELPERDIR");

716

if(pluginhelperdir == NULL){

717

if(debug){

718

fprintf_plus(stderr, "MANDOSPLUGINHELPERDIR environment"

719

" variable not set; cannot run helper\n");

720

}

721

return false;

722

}

723

724

char interface[IF_NAMESIZE];

725

if(if_indextoname((unsigned int)if_index, interface) == NULL){

726

perror_plus("if_indextoname");

727

return false;

728

}

729

730

int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));

731

if(devnull == -1){

732

perror_plus("open(\"/dev/null\", O_RDONLY)");

733

return false;

734

}

735

pid_t pid = fork();

736

if(pid == 0){

737

/* Child */

738

/* Raise privileges */

739

errno = raise_privileges_permanently();

740

if(errno != 0){

741

perror_plus("Failed to raise privileges");

742

/* _exit(EX_NOPERM); */

743

} else {

744

/* Set group */

745

errno = 0;

746

ret = setgid(0);

747

if(ret == -1){

748

perror_plus("setgid");

749

_exit(EX_NOPERM);

750

}

751

/* Reset supplementary groups */

752

errno = 0;

753

ret = setgroups(0, NULL);

754

if(ret == -1){

755

perror_plus("setgroups");

756

_exit(EX_NOPERM);

757

}

758

}

759

ret = dup2(devnull, STDIN_FILENO);

760

if(ret == -1){

761

perror_plus("dup2(devnull, STDIN_FILENO)");

762

_exit(EX_OSERR);

763

}

764

ret = (int)TEMP_FAILURE_RETRY(close(devnull));

765

if(ret == -1){

766

perror_plus("close");

767

_exit(EX_OSERR);

768

}

769

ret = dup2(STDERR_FILENO, STDOUT_FILENO);

770

if(ret == -1){

771

perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");

772

_exit(EX_OSERR);

773

}

774

int helperdir_fd = (int)TEMP_FAILURE_RETRY(open(pluginhelperdir,

775

O_RDONLY

776

| O_DIRECTORY

777

| O_PATH

778

| O_CLOEXEC));

779

if(helperdir_fd == -1){

780

perror_plus("open");

781

_exit(EX_UNAVAILABLE);

782

}

783

int helper_fd = (int)TEMP_FAILURE_RETRY(openat(helperdir_fd,

784

helper, O_RDONLY));

785

if(helper_fd == -1){

786

perror_plus("openat");

787

_exit(EX_UNAVAILABLE);

788

}

789

TEMP_FAILURE_RETRY(close(helperdir_fd));

790

#ifdef __GNUC__

791

#pragma GCC diagnostic push

792

#pragma GCC diagnostic ignored "-Wcast-qual"

793

#endif

794

if(fexecve(helper_fd, (char *const [])

795

{ helper, add ? add_arg : delete_arg, (char *)address,

796

interface, debug ? debug_flag : NULL, NULL },

797

environ) == -1){

798

#ifdef __GNUC__

799

#pragma GCC diagnostic pop

800

#endif

801

perror_plus("fexecve");

802

_exit(EXIT_FAILURE);

803

}

804

}

805

if(pid == -1){

806

perror_plus("fork");

807

return false;

808

}

809

int status;

810

pid_t pret = -1;

811

errno = 0;

812

do {

813

pret = waitpid(pid, &status, 0);

814

if(pret == -1 and errno == EINTR and quit_now){

815

int errno_raising = 0;

816

if((errno = raise_privileges()) != 0){

817

errno_raising = errno;

818

perror_plus("Failed to raise privileges in order to"

819

" kill helper program");

820

}

821

if(kill(pid, SIGTERM) == -1){

822

perror_plus("kill");

823

}

824

if((errno_raising == 0) and (errno = lower_privileges()) != 0){

825

perror_plus("Failed to lower privileges after killing"

826

" helper program");

827

}

828

return false;

829

}

830

} while(pret == -1 and errno == EINTR);

831

if(pret == -1){

832

perror_plus("waitpid");

833

return false;

834

}

835

if(WIFEXITED(status)){

836

if(WEXITSTATUS(status) != 0){

837

fprintf_plus(stderr, "Error: iprouteadddel exited"

838

" with status %d\n", WEXITSTATUS(status));

839

return false;

840

}

841

return true;

842

}

843

if(WIFSIGNALED(status)){

844

fprintf_plus(stderr, "Error: iprouteadddel died by"

845

" signal %d\n", WTERMSIG(status));

846

return false;

847

}

848

fprintf_plus(stderr, "Error: iprouteadddel crashed\n");

849

return false;

850

}

851

852

__attribute__((nonnull, warn_unused_result))

853

static bool add_local_route(const char *address,

854

AvahiIfIndex if_index){

855

if(debug){

856

fprintf_plus(stderr, "Adding route to %s\n", address);

857

}

858

return add_delete_local_route(true, address, if_index);

859

}

860

861

__attribute__((nonnull, warn_unused_result))

862

static bool delete_local_route(const char *address,

863

AvahiIfIndex if_index){

864

if(debug){

865

fprintf_plus(stderr, "Removing route to %s\n", address);

866

}

867

return add_delete_local_route(false, address, if_index);

868

}

869

870

643

/* Called when a Mandos server is found */

871

644

__attribute__((nonnull, warn_unused_result))

872

645

static int start_mandos_communication(const char *ip, in_port_t port,

883

656

int retval = -1;

884

657

gnutls_session_t session;

885

658

int pf; /* Protocol family */

886

bool route_added = false;

887

659

888

660

errno = 0;

889

661

947

719

PRIuMAX "\n", ip, (uintmax_t)port);

948

720

}

949

721

950

tcp_sd = socket(pf, SOCK_STREAM | SOCK_CLOEXEC, 0);

722

tcp_sd = socket(pf, SOCK_STREAM, 0);

951

723

if(tcp_sd < 0){

952

724

int e = errno;

953

725

perror_plus("socket");

1042

814

goto mandos_end;

1043

815

}

1044

816

1045

while(true){

1046

if(af == AF_INET6){

1047

ret = connect(tcp_sd, (struct sockaddr *)&to,

1048

sizeof(struct sockaddr_in6));

1049

} else {

1050

ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */

1051

sizeof(struct sockaddr_in));

1052

}

1053

if(ret < 0){

1054

if(errno == ENETUNREACH

1055

and if_index != AVAHI_IF_UNSPEC

1056

and connect_to == NULL

1057

and not route_added and

1058

((af == AF_INET6 and not

1059

IN6_IS_ADDR_LINKLOCAL(&(((struct sockaddr_in6 *)

1060

&to)->sin6_addr)))

1061

or (af == AF_INET and

1062

/* Not a a IPv4LL address */

1063

(ntohl(((struct sockaddr_in *)&to)->sin_addr.s_addr)

1064

& 0xFFFF0000L) != 0xA9FE0000L))){

1065

/* Work around Avahi bug - Avahi does not announce link-local

1066

addresses if it has a global address, so local hosts with

1067

*only* a link-local address (e.g. Mandos clients) cannot

1068

connect to a Mandos server announced by Avahi on a server

1069

host with a global address. Work around this by retrying

1070

with an explicit route added with the server's address.

1071

1072

Avahi bug reference:

1073

http://lists.freedesktop.org/archives/avahi/2010-February/001833.html

1074

https://bugs.debian.org/587961

1075

*/

1076

if(debug){

1077

fprintf_plus(stderr, "Mandos server unreachable, trying"

1078

" direct route\n");

1079

}

1080

int e = errno;

1081

route_added = add_local_route(ip, if_index);

1082

if(route_added){

1083

continue;

1084

}

1085

errno = e;

1086

}

1087

if(errno != ECONNREFUSED or debug){

1088

int e = errno;

1089

perror_plus("connect");

1090

errno = e;

1091

}

1092

goto mandos_end;

1093

}

1094

1095

if(quit_now){

1096

errno = EINTR;

1097

goto mandos_end;

1098

}

1099

break;

817

if(af == AF_INET6){

818

ret = connect(tcp_sd, (struct sockaddr *)&to,

819

sizeof(struct sockaddr_in6));

820

} else {

821

ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */

822

sizeof(struct sockaddr_in));

823

}

824

if(ret < 0){

825

if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){

826

int e = errno;

827

perror_plus("connect");

828

errno = e;

829

}

830

goto mandos_end;

831

}

832

833

if(quit_now){

834

errno = EINTR;

835

goto mandos_end;

1100

836

}

1101

837

1102

838

const char *out = mandos_protocol_version;

1285

1021

1286

1022

mandos_end:

1287

1023

{

1288

if(route_added){

1289

if(not delete_local_route(ip, if_index)){

1290

fprintf_plus(stderr, "Failed to delete local route to %s on"

1291

" interface %d", ip, if_index);

1292

}

1293

}

1294

1024

int e = errno;

1295

1025

free(decrypted_buffer);

1296

1026

free(buffer);

1336

1066

timed out */

1337

1067

1338

1068

if(quit_now){

1339

avahi_s_service_resolver_free(r);

1340

1069

return;

1341

1070

}

1342

1071

1722

1451

}

1723

1452

}

1724

1453

1454

/* Set effective uid to 0, return errno */

1455

__attribute__((warn_unused_result))

1456

error_t raise_privileges(void){

1457

error_t old_errno = errno;

1458

error_t ret_errno = 0;

1459

if(seteuid(0) == -1){

1460

ret_errno = errno;

1461

perror_plus("seteuid");

1462

}

1463

errno = old_errno;

1464

return ret_errno;

1465

}

1466

1467

/* Set effective and real user ID to 0. Return errno. */

1468

__attribute__((warn_unused_result))

1469

error_t raise_privileges_permanently(void){

1470

error_t old_errno = errno;

1471

error_t ret_errno = raise_privileges();

1472

if(ret_errno != 0){

1473

errno = old_errno;

1474

return ret_errno;

1475

}

1476

if(setuid(0) == -1){

1477

ret_errno = errno;

1478

perror_plus("seteuid");

1479

}

1480

errno = old_errno;

1481

return ret_errno;

1482

}

1483

1484

/* Set effective user ID to unprivileged saved user ID */

1485

__attribute__((warn_unused_result))

1486

error_t lower_privileges(void){

1487

error_t old_errno = errno;

1488

error_t ret_errno = 0;

1489

if(seteuid(uid) == -1){

1490

ret_errno = errno;

1491

perror_plus("seteuid");

1492

}

1493

errno = old_errno;

1494

return ret_errno;

1495

}

1496

1497

/* Lower privileges permanently */

1498

__attribute__((warn_unused_result))

1499

error_t lower_privileges_permanently(void){

1500

error_t old_errno = errno;

1501

error_t ret_errno = 0;

1502

if(setuid(uid) == -1){

1503

ret_errno = errno;

1504

perror_plus("setuid");

1505

}

1506

errno = old_errno;

1507

return ret_errno;

1508

}

1509

1725

1510

__attribute__((nonnull))

1726

1511

void run_network_hooks(const char *mode, const char *interface,

1727

1512

const float delay){

1728

1513

struct dirent **direntries = NULL;

1729

1514

if(hookdir_fd == -1){

1730

hookdir_fd = open(hookdir, O_RDONLY | O_DIRECTORY | O_PATH

1731

| O_CLOEXEC);

1515

hookdir_fd = open(hookdir, O_RDONLY);

1732

1516

if(hookdir_fd == -1){

1733

1517

if(errno == ENOENT){

1734

1518

if(debug){

1759

1543

}

1760

1544

struct dirent *direntry;

1761

1545

int ret;

1762

int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));

1763

if(devnull == -1){

1764

perror_plus("open(\"/dev/null\", O_RDONLY)");

1765

return;

1766

}

1546

int devnull = open("/dev/null", O_RDONLY);

1767

1547

for(int i = 0; i < numhooks; i++){

1768

1548

direntry = direntries[i];

1769

1549

if(debug){

1774

1554

if(hook_pid == 0){

1775

1555

/* Child */

1776

1556

/* Raise privileges */

1777

errno = raise_privileges_permanently();

1778

if(errno != 0){

1557

if(raise_privileges_permanently() != 0){

1779

1558

perror_plus("Failed to raise privileges");

1780

1559

_exit(EX_NOPERM);

1781

1560

}

1793

1572

perror_plus("setgroups");

1794

1573

_exit(EX_NOPERM);

1795

1574

}

1575

ret = dup2(devnull, STDIN_FILENO);

1576

if(ret == -1){

1577

perror_plus("dup2(devnull, STDIN_FILENO)");

1578

_exit(EX_OSERR);

1579

}

1580

ret = close(devnull);

1581

if(ret == -1){

1582

perror_plus("close");

1583

_exit(EX_OSERR);

1584

}

1585

ret = dup2(STDERR_FILENO, STDOUT_FILENO);

1586

if(ret == -1){

1587

perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");

1588

_exit(EX_OSERR);

1589

}

1796

1590

ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);

1797

1591

if(ret == -1){

1798

1592

perror_plus("setenv");

1833

1627

_exit(EX_OSERR);

1834

1628

}

1835

1629

}

1836

int hook_fd = (int)TEMP_FAILURE_RETRY(openat(hookdir_fd,

1837

direntry->d_name,

1838

O_RDONLY));

1630

int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);

1839

1631

if(hook_fd == -1){

1840

1632

perror_plus("openat");

1841

1633

_exit(EXIT_FAILURE);

1844

1636

perror_plus("close");

1845

1637

_exit(EXIT_FAILURE);

1846

1638

}

1847

ret = dup2(devnull, STDIN_FILENO);

1848

if(ret == -1){

1849

perror_plus("dup2(devnull, STDIN_FILENO)");

1850

_exit(EX_OSERR);

1851

}

1852

ret = (int)TEMP_FAILURE_RETRY(close(devnull));

1853

if(ret == -1){

1854

perror_plus("close");

1855

_exit(EX_OSERR);

1856

}

1857

ret = dup2(STDERR_FILENO, STDOUT_FILENO);

1858

if(ret == -1){

1859

perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");

1860

_exit(EX_OSERR);

1861

}

1862

1639

if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },

1863

1640

environ) == -1){

1864

1641

perror_plus("fexecve");

1865

1642

_exit(EXIT_FAILURE);

1866

1643

}

1867

1644

} else {

1868

if(hook_pid == -1){

1869

perror_plus("fork");

1870

free(direntry);

1871

continue;

1872

}

1873

1645

int status;

1874

1646

if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){

1875

1647

perror_plus("waitpid");

1876

free(direntry);

1877

1648

continue;

1878

1649

}

1879

1650

if(WIFEXITED(status)){

1881

1652

fprintf_plus(stderr, "Warning: network hook \"%s\" exited"

1882

1653

" with status %d\n", direntry->d_name,

1883

1654

WEXITSTATUS(status));

1884

free(direntry);

1885

1655

continue;

1886

1656

}

1887

1657

} else if(WIFSIGNALED(status)){

1888

1658

fprintf_plus(stderr, "Warning: network hook \"%s\" died by"

1889

1659

" signal %d\n", direntry->d_name,

1890

1660

WTERMSIG(status));

1891

free(direntry);

1892

1661

continue;

1893

1662

} else {

1894

1663

fprintf_plus(stderr, "Warning: network hook \"%s\""

1895

1664

" crashed\n", direntry->d_name);

1896

free(direntry);

1897

1665

continue;

1898

1666

}

1899

1667

}

1901

1669

fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",

1902

1670

direntry->d_name);

1903

1671

}

1904

free(direntry);

1905

1672

}

1906

1673

free(direntries);

1907

1674

if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){

1966

1733

/* Raise privileges */

1967

1734

ret_errno = raise_privileges();

1968

1735

if(ret_errno != 0){

1969

errno = ret_errno;

1970

1736

perror_plus("Failed to raise privileges");

1971

1737

}

1972

1738

2076

1842

/* Raise privileges */

2077

1843

ret_errno = raise_privileges();

2078

1844

if(ret_errno != 0){

2079

errno = ret_errno;

2080

1845

perror_plus("Failed to raise privileges");

2081

1846

}

2082

1847

2312

2077

goto end;

2313

2078

}

2314

2079

}

2315

2080

2316

2081

{

2317

2082

/* Work around Debian bug #633582:

2318

2083

<http://bugs.debian.org/633582> */

2345

2110

TEMP_FAILURE_RETRY(close(seckey_fd));

2346

2111

}

2347

2112

}

2348

2113

2349

2114

if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){

2350

2115

int pubkey_fd = open(pubkey, O_RDONLY);

2351

2116

if(pubkey_fd == -1){

2366

2131

TEMP_FAILURE_RETRY(close(pubkey_fd));

2367

2132

}

2368

2133

}

2369

2134

2370

2135

/* Lower privileges */

2371

2136

ret_errno = lower_privileges();

2372

2137

if(ret_errno != 0){

2501

2266

if(ret_errno != 0){

2502

2267

errno = ret_errno;

2503

2268

perror_plus("argz_add");

2504

free(direntries[i]);

2505

2269

continue;

2506

2270

}

2507

2271

if(debug){

2508

2272

fprintf_plus(stderr, "Will use interface \"%s\"\n",

2509

2273

direntries[i]->d_name);

2510

2274

}

2511

free(direntries[i]);

2512

2275

}

2513

2276

free(direntries);

2514

2277

} else {

2784

2547

mc.current_server->prev->next = NULL;

2785

2548

while(mc.current_server != NULL){

2786

2549

server *next = mc.current_server->next;

2787

#ifdef __GNUC__

2788

#pragma GCC diagnostic push

2789

#pragma GCC diagnostic ignored "-Wcast-qual"

2790

#endif

2791

free((char *)(mc.current_server->ip));

2792

#ifdef __GNUC__

2793

#pragma GCC diagnostic pop

2794

#endif

2795

2550

free(mc.current_server);

2796

2551

mc.current_server = next;

2797

2552

}

2801

2556

{

2802

2557

ret_errno = raise_privileges();

2803

2558

if(ret_errno != 0){

2804

errno = ret_errno;

2805

2559

perror_plus("Failed to raise privileges");

2806

2560

} else {

2807

2561

2830

2584

2831

2585

ret_errno = lower_privileges_permanently();

2832

2586

if(ret_errno != 0){

2833

errno = ret_errno;

2834

2587

perror_plus("Failed to lower privileges permanently");

2835

2588

}

2836

2589

}

2841

2594

/* Removes the GPGME temp directory and all files inside */

2842

2595

if(tempdir != NULL){

2843

2596

struct dirent **direntries = NULL;

2844

int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY

2845

| O_NOFOLLOW

2846

| O_DIRECTORY

2847

| O_PATH));

2597

int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |

2598

O_NOFOLLOW));

2848

2599

if(tempdir_fd == -1){

2849

2600

perror_plus("open");

2850

2601

} else {

2868

2619

" \"%s\", 0): %s\n", tempdir,

2869

2620

direntries[i]->d_name, strerror(errno));

2870

2621

}

2871

free(direntries[i]);

2872

2622

}

2873

2623

2874

2624

/* need to clean even if 0 because man page doesn't specify */