47
111
#include <avahi-common/malloc.h>
48
112
#include <avahi-common/error.h>
51
#include <sys/types.h> /* socket(), inet_pton() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton() */
54
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
55
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
57
#include <unistd.h> /* close() */
58
#include <netinet/in.h>
59
#include <stdbool.h> /* true */
60
#include <string.h> /* memset */
61
#include <arpa/inet.h> /* inet_pton() */
62
#include <iso646.h> /* not */
65
#include <errno.h> /* perror() */
115
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
118
init_gnutls_session(),
120
#include <gnutls/openpgp.h>
121
/* gnutls_certificate_set_openpgp_key_file(),
122
GNUTLS_OPENPGP_FMT_BASE64 */
125
#include <gpgme.h> /* All GPGME types, constants and
128
GPGME_PROTOCOL_OpenPGP,
71
131
#define BUFFER_SIZE 256
74
static const char *certdir = "/conf/conf.d/mandos";
75
static const char *certfile = "openpgp-client.txt";
76
static const char *certkey = "openpgp-client-key.txt";
133
#define PATHDIR "/conf/conf.d/mandos"
134
#define SECKEY "seckey.txt"
135
#define PUBKEY "pubkey.txt"
136
#define HOOKDIR "/lib/mandos/network-hooks.d"
78
138
bool debug = false;
139
static const char mandos_protocol_version[] = "1";
140
const char *argp_program_version = "mandos-client " VERSION;
141
const char *argp_program_bug_address = "<mandos@recompile.se>";
142
static const char sys_class_net[] = "/sys/class/net";
143
char *connect_to = NULL;
144
const char *hookdir = HOOKDIR;
149
/* Doubly linked list that need to be circularly linked when used */
150
typedef struct server{
153
AvahiIfIndex if_index;
155
struct timespec last_seen;
160
/* Used for passing in values through the Avahi callback functions */
81
gnutls_session_t session;
82
163
gnutls_certificate_credentials_t cred;
164
unsigned int dh_bits;
83
165
gnutls_dh_params_t dh_params;
87
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
90
gpgme_data_t dh_crypto, dh_plain;
166
const char *priority;
168
server *current_server;
170
size_t interfaces_size;
173
/* global so signal handler can reach it*/
174
AvahiSimplePoll *simple_poll;
176
sig_atomic_t quit_now = 0;
177
int signal_received = 0;
179
/* Function to use when printing errors */
180
void perror_plus(const char *print_text){
182
fprintf(stderr, "Mandos plugin %s: ",
183
program_invocation_short_name);
188
__attribute__((format (gnu_printf, 2, 3), nonnull))
189
int fprintf_plus(FILE *stream, const char *format, ...){
191
va_start (ap, format);
193
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
194
program_invocation_short_name));
195
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
199
* Make additional room in "buffer" for at least BUFFER_SIZE more
200
* bytes. "buffer_capacity" is how much is currently allocated,
201
* "buffer_length" is how much is already used.
203
__attribute__((nonnull, warn_unused_result))
204
size_t incbuffer(char **buffer, size_t buffer_length,
205
size_t buffer_capacity){
206
if(buffer_length + BUFFER_SIZE > buffer_capacity){
207
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
209
int old_errno = errno;
216
buffer_capacity += BUFFER_SIZE;
218
return buffer_capacity;
221
/* Add server to set of servers to retry periodically */
222
__attribute__((nonnull, warn_unused_result))
223
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
224
int af, server **current_server){
226
server *new_server = malloc(sizeof(server));
227
if(new_server == NULL){
228
perror_plus("malloc");
231
*new_server = (server){ .ip = strdup(ip),
233
.if_index = if_index,
235
if(new_server->ip == NULL){
236
perror_plus("strdup");
239
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
241
perror_plus("clock_gettime");
244
/* Special case of first server */
245
if(*current_server == NULL){
246
new_server->next = new_server;
247
new_server->prev = new_server;
248
*current_server = new_server;
250
/* Place the new server last in the list */
251
new_server->next = *current_server;
252
new_server->prev = (*current_server)->prev;
253
new_server->prev->next = new_server;
254
(*current_server)->prev = new_server;
262
__attribute__((nonnull, warn_unused_result))
263
static bool init_gpgme(const char * const seckey,
264
const char * const pubkey,
265
const char * const tempdir,
94
ssize_t new_packet_capacity = 0;
95
ssize_t new_packet_length = 0;
96
268
gpgme_engine_info_t engine_info;
99
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
271
* Helper function to insert pub and seckey to the engine keyring.
273
bool import_key(const char * const filename){
276
gpgme_data_t pgp_data;
278
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
284
rc = gpgme_data_new_from_fd(&pgp_data, fd);
285
if(rc != GPG_ERR_NO_ERROR){
286
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
287
gpgme_strsource(rc), gpgme_strerror(rc));
291
rc = gpgme_op_import(mc->ctx, pgp_data);
292
if(rc != GPG_ERR_NO_ERROR){
293
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
294
gpgme_strsource(rc), gpgme_strerror(rc));
298
ret = (int)TEMP_FAILURE_RETRY(close(fd));
300
perror_plus("close");
302
gpgme_data_release(pgp_data);
307
fprintf_plus(stderr, "Initializing GPGME\n");
103
311
gpgme_check_version(NULL);
104
312
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
105
if (rc != GPG_ERR_NO_ERROR){
106
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
107
gpgme_strsource(rc), gpgme_strerror(rc));
313
if(rc != GPG_ERR_NO_ERROR){
314
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
315
gpgme_strsource(rc), gpgme_strerror(rc));
111
/* Set GPGME home directory */
112
rc = gpgme_get_engine_info (&engine_info);
113
if (rc != GPG_ERR_NO_ERROR){
114
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
115
gpgme_strsource(rc), gpgme_strerror(rc));
319
/* Set GPGME home directory for the OpenPGP engine only */
320
rc = gpgme_get_engine_info(&engine_info);
321
if(rc != GPG_ERR_NO_ERROR){
322
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
323
gpgme_strsource(rc), gpgme_strerror(rc));
118
326
while(engine_info != NULL){
119
327
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
120
328
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
121
engine_info->file_name, homedir);
329
engine_info->file_name, tempdir);
124
332
engine_info = engine_info->next;
126
334
if(engine_info == NULL){
127
fprintf(stderr, "Could not set home dir to %s\n", homedir);
131
/* Create new GPGME data buffer from packet buffer */
132
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
133
if (rc != GPG_ERR_NO_ERROR){
134
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
135
gpgme_strsource(rc), gpgme_strerror(rc));
335
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
340
/* Create new GPGME "context" */
341
rc = gpgme_new(&(mc->ctx));
342
if(rc != GPG_ERR_NO_ERROR){
343
fprintf_plus(stderr, "Mandos plugin mandos-client: "
344
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
349
if(not import_key(pubkey) or not import_key(seckey)){
357
* Decrypt OpenPGP data.
358
* Returns -1 on error
360
__attribute__((nonnull, warn_unused_result))
361
static ssize_t pgp_packet_decrypt(const char *cryptotext,
365
gpgme_data_t dh_crypto, dh_plain;
368
size_t plaintext_capacity = 0;
369
ssize_t plaintext_length = 0;
372
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
375
/* Create new GPGME data buffer from memory cryptotext */
376
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
378
if(rc != GPG_ERR_NO_ERROR){
379
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
380
gpgme_strsource(rc), gpgme_strerror(rc));
139
384
/* Create new empty GPGME data buffer for the plaintext */
140
385
rc = gpgme_data_new(&dh_plain);
141
if (rc != GPG_ERR_NO_ERROR){
142
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
143
gpgme_strsource(rc), gpgme_strerror(rc));
147
/* Create new GPGME "context" */
148
rc = gpgme_new(&ctx);
149
if (rc != GPG_ERR_NO_ERROR){
150
fprintf(stderr, "bad gpgme_new: %s: %s\n",
151
gpgme_strsource(rc), gpgme_strerror(rc));
155
/* Decrypt data from the FILE pointer to the plaintext data
157
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
158
if (rc != GPG_ERR_NO_ERROR){
159
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
160
gpgme_strsource(rc), gpgme_strerror(rc));
165
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
169
gpgme_decrypt_result_t result;
170
result = gpgme_op_decrypt_result(ctx);
172
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
174
fprintf(stderr, "Unsupported algorithm: %s\n",
175
result->unsupported_algorithm);
176
fprintf(stderr, "Wrong key usage: %d\n",
177
result->wrong_key_usage);
178
if(result->file_name != NULL){
179
fprintf(stderr, "File name: %s\n", result->file_name);
181
gpgme_recipient_t recipient;
182
recipient = result->recipients;
386
if(rc != GPG_ERR_NO_ERROR){
387
fprintf_plus(stderr, "Mandos plugin mandos-client: "
388
"bad gpgme_data_new: %s: %s\n",
389
gpgme_strsource(rc), gpgme_strerror(rc));
390
gpgme_data_release(dh_crypto);
394
/* Decrypt data from the cryptotext data buffer to the plaintext
396
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
397
if(rc != GPG_ERR_NO_ERROR){
398
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
399
gpgme_strsource(rc), gpgme_strerror(rc));
400
plaintext_length = -1;
402
gpgme_decrypt_result_t result;
403
result = gpgme_op_decrypt_result(mc->ctx);
405
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
407
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
408
result->unsupported_algorithm);
409
fprintf_plus(stderr, "Wrong key usage: %u\n",
410
result->wrong_key_usage);
411
if(result->file_name != NULL){
412
fprintf_plus(stderr, "File name: %s\n", result->file_name);
414
gpgme_recipient_t recipient;
415
recipient = result->recipients;
184
416
while(recipient != NULL){
185
fprintf(stderr, "Public key algorithm: %s\n",
186
gpgme_pubkey_algo_name(recipient->pubkey_algo));
187
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
188
fprintf(stderr, "Secret key available: %s\n",
189
recipient->status == GPG_ERR_NO_SECKEY
417
fprintf_plus(stderr, "Public key algorithm: %s\n",
418
gpgme_pubkey_algo_name
419
(recipient->pubkey_algo));
420
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
421
fprintf_plus(stderr, "Secret key available: %s\n",
422
recipient->status == GPG_ERR_NO_SECKEY
191
424
recipient = recipient->next;
197
/* Delete the GPGME FILE pointer cryptotext data buffer */
198
gpgme_data_release(dh_crypto);
432
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
200
435
/* Seek back to the beginning of the GPGME plaintext data buffer */
201
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
202
perror("pgpme_data_seek");
436
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
437
perror_plus("gpgme_data_seek");
438
plaintext_length = -1;
207
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
208
*new_packet = realloc(*new_packet,
209
(unsigned int)new_packet_capacity
211
if (*new_packet == NULL){
215
new_packet_capacity += BUFFER_SIZE;
444
plaintext_capacity = incbuffer(plaintext,
445
(size_t)plaintext_length,
447
if(plaintext_capacity == 0){
448
perror_plus("incbuffer");
449
plaintext_length = -1;
218
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
453
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
220
455
/* Print the data, if any */
225
perror("gpgme_data_read");
228
new_packet_length += ret;
231
/* FIXME: check characters before printing to screen so to not print
232
terminal control characters */
234
/* fprintf(stderr, "decrypted password is: "); */
235
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
236
/* fprintf(stderr, "\n"); */
461
perror_plus("gpgme_data_read");
462
plaintext_length = -1;
465
plaintext_length += ret;
469
fprintf_plus(stderr, "Decrypted password is: ");
470
for(ssize_t i = 0; i < plaintext_length; i++){
471
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
473
fprintf(stderr, "\n");
478
/* Delete the GPGME cryptotext data buffer */
479
gpgme_data_release(dh_crypto);
239
481
/* Delete the GPGME plaintext data buffer */
240
482
gpgme_data_release(dh_plain);
241
return new_packet_length;
483
return plaintext_length;
244
static const char * safer_gnutls_strerror (int value) {
245
const char *ret = gnutls_strerror (value);
486
__attribute__((warn_unused_result))
487
static const char *safer_gnutls_strerror(int value){
488
const char *ret = gnutls_strerror(value);
247
490
ret = "(unknown)";
494
/* GnuTLS log function callback */
495
__attribute__((nonnull))
251
496
static void debuggnutls(__attribute__((unused)) int level,
252
497
const char* string){
253
fprintf(stderr, "%s", string);
498
fprintf_plus(stderr, "GnuTLS: %s", string);
256
static int initgnutls(encrypted_session *es){
501
__attribute__((nonnull, warn_unused_result))
502
static int init_gnutls_global(const char *pubkeyfilename,
503
const char *seckeyfilename,
261
fprintf(stderr, "Initializing GnuTLS\n");
508
fprintf_plus(stderr, "Initializing GnuTLS\n");
264
if ((ret = gnutls_global_init ())
265
!= GNUTLS_E_SUCCESS) {
266
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
511
ret = gnutls_global_init();
512
if(ret != GNUTLS_E_SUCCESS){
513
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
514
safer_gnutls_strerror(ret));
519
/* "Use a log level over 10 to enable all debugging options."
271
522
gnutls_global_set_log_level(11);
272
523
gnutls_global_set_log_function(debuggnutls);
275
/* openpgp credentials */
276
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
277
!= GNUTLS_E_SUCCESS) {
278
fprintf (stderr, "memory error: %s\n",
279
safer_gnutls_strerror(ret));
526
/* OpenPGP credentials */
527
ret = gnutls_certificate_allocate_credentials(&mc->cred);
528
if(ret != GNUTLS_E_SUCCESS){
529
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
530
safer_gnutls_strerror(ret));
531
gnutls_global_deinit();
284
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
285
" and keyfile %s as GnuTLS credentials\n", certfile,
536
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
537
" secret key %s as GnuTLS credentials\n",
289
542
ret = gnutls_certificate_set_openpgp_key_file
290
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
291
if (ret != GNUTLS_E_SUCCESS) {
293
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
295
ret, certfile, certkey);
296
fprintf(stdout, "The Error is: %s\n",
297
safer_gnutls_strerror(ret));
301
//GnuTLS server initialization
302
if ((ret = gnutls_dh_params_init (&es->dh_params))
303
!= GNUTLS_E_SUCCESS) {
304
fprintf (stderr, "Error in dh parameter initialization: %s\n",
305
safer_gnutls_strerror(ret));
309
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
310
!= GNUTLS_E_SUCCESS) {
311
fprintf (stderr, "Error in prime generation: %s\n",
312
safer_gnutls_strerror(ret));
316
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
318
// GnuTLS session creation
319
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
320
!= GNUTLS_E_SUCCESS){
321
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
322
safer_gnutls_strerror(ret));
325
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
326
!= GNUTLS_E_SUCCESS) {
327
fprintf(stderr, "Syntax error at: %s\n", err);
328
fprintf(stderr, "GnuTLS error: %s\n",
329
safer_gnutls_strerror(ret));
333
if ((ret = gnutls_credentials_set
334
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
335
!= GNUTLS_E_SUCCESS) {
336
fprintf(stderr, "Error setting a credentials set: %s\n",
337
safer_gnutls_strerror(ret));
543
(mc->cred, pubkeyfilename, seckeyfilename,
544
GNUTLS_OPENPGP_FMT_BASE64);
545
if(ret != GNUTLS_E_SUCCESS){
547
"Error[%d] while reading the OpenPGP key pair ('%s',"
548
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
549
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
550
safer_gnutls_strerror(ret));
554
/* GnuTLS server initialization */
555
ret = gnutls_dh_params_init(&mc->dh_params);
556
if(ret != GNUTLS_E_SUCCESS){
557
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
558
" initialization: %s\n",
559
safer_gnutls_strerror(ret));
562
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
563
if(ret != GNUTLS_E_SUCCESS){
564
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
565
safer_gnutls_strerror(ret));
569
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
575
gnutls_certificate_free_credentials(mc->cred);
576
gnutls_global_deinit();
577
gnutls_dh_params_deinit(mc->dh_params);
581
__attribute__((nonnull, warn_unused_result))
582
static int init_gnutls_session(gnutls_session_t *session,
585
/* GnuTLS session creation */
587
ret = gnutls_init(session, GNUTLS_SERVER);
591
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
592
if(ret != GNUTLS_E_SUCCESS){
594
"Error in GnuTLS session initialization: %s\n",
595
safer_gnutls_strerror(ret));
601
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
603
gnutls_deinit(*session);
606
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
607
if(ret != GNUTLS_E_SUCCESS){
608
fprintf_plus(stderr, "Syntax error at: %s\n", err);
609
fprintf_plus(stderr, "GnuTLS error: %s\n",
610
safer_gnutls_strerror(ret));
611
gnutls_deinit(*session);
617
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
620
gnutls_deinit(*session);
623
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
624
if(ret != GNUTLS_E_SUCCESS){
625
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
626
safer_gnutls_strerror(ret));
627
gnutls_deinit(*session);
341
631
/* ignore client certificate if any. */
342
gnutls_certificate_server_set_request (es->session,
632
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
345
gnutls_dh_set_prime_bits (es->session, DH_BITS);
634
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
639
/* Avahi log function callback */
350
640
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
351
641
__attribute__((unused)) const char *txt){}
353
static int start_mandos_communication(const char *ip, uint16_t port,
354
AvahiIfIndex if_index){
356
struct sockaddr_in6 to;
357
encrypted_session es;
643
/* Called when a Mandos server is found */
644
__attribute__((nonnull, warn_unused_result))
645
static int start_mandos_communication(const char *ip, in_port_t port,
646
AvahiIfIndex if_index,
647
int af, mandos_context *mc){
648
int ret, tcp_sd = -1;
650
struct sockaddr_storage to;
358
651
char *buffer = NULL;
359
char *decrypted_buffer;
652
char *decrypted_buffer = NULL;
360
653
size_t buffer_length = 0;
361
654
size_t buffer_capacity = 0;
362
ssize_t decrypted_buffer_size;
365
char interface[IF_NAMESIZE];
368
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
372
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
379
if(if_indextoname((unsigned int)if_index, interface) == NULL){
657
gnutls_session_t session;
658
int pf; /* Protocol family */
675
fprintf_plus(stderr, "Bad address family: %d\n", af);
680
/* If the interface is specified and we have a list of interfaces */
681
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
682
/* Check if the interface is one of the interfaces we are using */
685
char *interface = NULL;
686
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
688
if(if_nametoindex(interface) == (unsigned int)if_index){
695
/* This interface does not match any in the list, so we don't
696
connect to the server */
381
perror("if_indextoname");
698
char interface[IF_NAMESIZE];
699
if(if_indextoname((unsigned int)if_index, interface) == NULL){
700
perror_plus("if_indextoname");
702
fprintf_plus(stderr, "Skipping server on non-used interface"
704
if_indextoname((unsigned int)if_index,
386
fprintf(stderr, "Binding to interface %s\n", interface);
389
memset(&to,0,sizeof(to)); /* Spurious warning */
390
to.sin6_family = AF_INET6;
391
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
712
ret = init_gnutls_session(&session, mc);
718
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
719
PRIuMAX "\n", ip, (uintmax_t)port);
722
tcp_sd = socket(pf, SOCK_STREAM, 0);
725
perror_plus("socket");
735
memset(&to, 0, sizeof(to));
737
((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;
738
ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);
740
((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;
741
ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);
745
perror_plus("inet_pton");
397
fprintf(stderr, "Bad address: %s\n", ip);
400
to.sin6_port = htons(port); /* Spurious warning */
402
to.sin6_scope_id = (uint32_t)if_index;
405
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
406
/* char addrstr[INET6_ADDRSTRLEN]; */
407
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
408
/* sizeof(addrstr)) == NULL){ */
409
/* perror("inet_ntop"); */
411
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
412
/* addrstr, ntohs(to.sin6_port)); */
416
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
422
ret = initgnutls (&es);
428
gnutls_transport_set_ptr (es.session,
429
(gnutls_transport_ptr_t) tcp_sd);
432
fprintf(stderr, "Establishing TLS session with %s\n", ip);
435
ret = gnutls_handshake (es.session);
437
if (ret != GNUTLS_E_SUCCESS){
751
fprintf_plus(stderr, "Bad address: %s\n", ip);
756
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
757
if(IN6_IS_ADDR_LINKLOCAL
758
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
759
if(if_index == AVAHI_IF_UNSPEC){
760
fprintf_plus(stderr, "An IPv6 link-local address is"
761
" incomplete without a network interface\n");
765
/* Set the network interface number as scope */
766
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
769
((struct sockaddr_in *)&to)->sin_port = htons(port);
778
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
779
char interface[IF_NAMESIZE];
780
if(if_indextoname((unsigned int)if_index, interface) == NULL){
781
perror_plus("if_indextoname");
783
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
784
"\n", ip, interface, (uintmax_t)port);
787
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
788
ip, (uintmax_t)port);
790
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
791
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
793
ret = getnameinfo((struct sockaddr *)&to,
794
sizeof(struct sockaddr_in6),
795
addrstr, sizeof(addrstr), NULL, 0,
798
ret = getnameinfo((struct sockaddr *)&to,
799
sizeof(struct sockaddr_in),
800
addrstr, sizeof(addrstr), NULL, 0,
803
if(ret == EAI_SYSTEM){
804
perror_plus("getnameinfo");
805
} else if(ret != 0) {
806
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
807
} else if(strcmp(addrstr, ip) != 0){
808
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
818
ret = connect(tcp_sd, (struct sockaddr *)&to,
819
sizeof(struct sockaddr_in6));
821
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
822
sizeof(struct sockaddr_in));
825
if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
827
perror_plus("connect");
838
const char *out = mandos_protocol_version;
841
size_t out_size = strlen(out);
842
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
843
out_size - written));
846
perror_plus("write");
850
written += (size_t)ret;
851
if(written < out_size){
854
if(out == mandos_protocol_version){
869
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
877
/* This casting via intptr_t is to eliminate warning about casting
878
an int to a pointer type. This is exactly how the GnuTLS Guile
879
function "set-session-transport-fd!" does it. */
880
gnutls_transport_set_ptr(session,
881
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
889
ret = gnutls_handshake(session);
894
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
896
if(ret != GNUTLS_E_SUCCESS){
439
fprintf(stderr, "\n*** Handshake failed ***\n");
898
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
446
//Retrieve OpenPGP packet that contains the wanted password
905
/* Read OpenPGP packet that contains the wanted password */
449
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
908
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
454
if (buffer_length + BUFFER_SIZE > buffer_capacity){
455
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
460
buffer_capacity += BUFFER_SIZE;
463
ret = gnutls_record_recv
464
(es.session, buffer+buffer_length, BUFFER_SIZE);
919
buffer_capacity = incbuffer(&buffer, buffer_length,
921
if(buffer_capacity == 0){
923
perror_plus("incbuffer");
933
sret = gnutls_record_recv(session, buffer+buffer_length,
470
940
case GNUTLS_E_INTERRUPTED:
471
941
case GNUTLS_E_AGAIN:
473
943
case GNUTLS_E_REHANDSHAKE:
474
ret = gnutls_handshake (es.session);
476
fprintf(stderr, "\n*** Handshake failed ***\n");
945
ret = gnutls_handshake(session);
951
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
953
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
483
fprintf(stderr, "Unknown error while reading data from"
484
" encrypted session with mandos server\n");
486
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
961
fprintf_plus(stderr, "Unknown error while reading data from"
962
" encrypted session with Mandos server\n");
963
gnutls_bye(session, GNUTLS_SHUT_RDWR);
490
buffer_length += (size_t) ret;
494
if (buffer_length > 0){
495
decrypted_buffer_size = pgp_packet_decrypt(buffer,
499
if (decrypted_buffer_size >= 0){
968
buffer_length += (size_t) sret;
973
fprintf_plus(stderr, "Closing TLS session\n");
982
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
987
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
989
if(buffer_length > 0){
990
ssize_t decrypted_buffer_size;
991
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
992
&decrypted_buffer, mc);
993
if(decrypted_buffer_size >= 0){
500
996
while(written < (size_t) decrypted_buffer_size){
501
ret = (int)fwrite (decrypted_buffer + written, 1,
502
(size_t)decrypted_buffer_size - written,
1002
ret = (int)fwrite(decrypted_buffer + written, 1,
1003
(size_t)decrypted_buffer_size - written,
504
1005
if(ret == 0 and ferror(stdout)){
506
fprintf(stderr, "Error writing encrypted data: %s\n",
1008
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
512
1014
written += (size_t)ret;
514
free(decrypted_buffer);
1020
/* Shutdown procedure */
1025
free(decrypted_buffer);
1028
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
1034
perror_plus("close");
1036
gnutls_deinit(session);
523
fprintf(stderr, "Closing TLS session\n");
527
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
530
gnutls_deinit (es.session);
531
gnutls_certificate_free_credentials (es.cred);
532
gnutls_global_deinit ();
536
static AvahiSimplePoll *simple_poll = NULL;
537
static AvahiServer *server = NULL;
539
static void resolve_callback(
540
AvahiSServiceResolver *r,
541
AvahiIfIndex interface,
542
AVAHI_GCC_UNUSED AvahiProtocol protocol,
543
AvahiResolverEvent event,
547
const char *host_name,
548
const AvahiAddress *address,
550
AVAHI_GCC_UNUSED AvahiStringList *txt,
551
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
552
AVAHI_GCC_UNUSED void* userdata) {
554
assert(r); /* Spurious warning */
1046
__attribute__((nonnull))
1047
static void resolve_callback(AvahiSServiceResolver *r,
1048
AvahiIfIndex interface,
1049
AvahiProtocol proto,
1050
AvahiResolverEvent event,
1054
const char *host_name,
1055
const AvahiAddress *address,
1057
AVAHI_GCC_UNUSED AvahiStringList *txt,
1058
AVAHI_GCC_UNUSED AvahiLookupResultFlags
556
1065
/* Called whenever a service has been resolved successfully or
561
1074
case AVAHI_RESOLVER_FAILURE:
562
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
563
" type '%s' in domain '%s': %s\n", name, type, domain,
564
avahi_strerror(avahi_server_errno(server)));
1075
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1076
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1078
avahi_strerror(avahi_server_errno
1079
(((mandos_context*)mc)->server)));
567
1082
case AVAHI_RESOLVER_FOUND:
569
1084
char ip[AVAHI_ADDRESS_STR_MAX];
570
1085
avahi_address_snprint(ip, sizeof(ip), address);
572
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
573
" port %d\n", name, host_name, ip, port);
1087
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1088
PRIdMAX ") on port %" PRIu16 "\n", name,
1089
host_name, ip, (intmax_t)interface, port);
575
int ret = start_mandos_communication(ip, port, interface);
1091
int ret = start_mandos_communication(ip, (in_port_t)port,
1093
avahi_proto_to_af(proto),
1096
avahi_simple_poll_quit(simple_poll);
1098
if(not add_server(ip, (in_port_t)port, interface,
1099
avahi_proto_to_af(proto),
1100
&((mandos_context*)mc)->current_server)){
1101
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
581
1107
avahi_s_service_resolver_free(r);
584
static void browse_callback(
585
AvahiSServiceBrowser *b,
586
AvahiIfIndex interface,
587
AvahiProtocol protocol,
588
AvahiBrowserEvent event,
592
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
595
AvahiServer *s = userdata;
596
assert(b); /* Spurious warning */
598
/* Called whenever a new services becomes available on the LAN or
599
is removed from the LAN */
1110
static void browse_callback(AvahiSServiceBrowser *b,
1111
AvahiIfIndex interface,
1112
AvahiProtocol protocol,
1113
AvahiBrowserEvent event,
1117
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1124
/* Called whenever a new services becomes available on the LAN or
1125
is removed from the LAN */
1133
case AVAHI_BROWSER_FAILURE:
1135
fprintf_plus(stderr, "(Avahi browser) %s\n",
1136
avahi_strerror(avahi_server_errno
1137
(((mandos_context*)mc)->server)));
1138
avahi_simple_poll_quit(simple_poll);
1141
case AVAHI_BROWSER_NEW:
1142
/* We ignore the returned Avahi resolver object. In the callback
1143
function we free it. If the Avahi server is terminated before
1144
the callback function is called the Avahi server will free the
1147
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1148
interface, protocol, name, type,
1149
domain, protocol, 0,
1150
resolve_callback, mc) == NULL)
1151
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1153
avahi_strerror(avahi_server_errno
1154
(((mandos_context*)mc)->server)));
1157
case AVAHI_BROWSER_REMOVE:
1160
case AVAHI_BROWSER_ALL_FOR_NOW:
1161
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1163
fprintf_plus(stderr, "No Mandos server found, still"
1170
/* Signal handler that stops main loop after SIGTERM */
1171
static void handle_sigterm(int sig){
1176
signal_received = sig;
1177
int old_errno = errno;
1178
/* set main loop to exit */
1179
if(simple_poll != NULL){
1180
avahi_simple_poll_quit(simple_poll);
1185
__attribute__((nonnull, warn_unused_result))
1186
bool get_flags(const char *ifname, struct ifreq *ifr){
1190
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1193
perror_plus("socket");
1197
strcpy(ifr->ifr_name, ifname);
1198
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1202
perror_plus("ioctl SIOCGIFFLAGS");
1210
__attribute__((nonnull, warn_unused_result))
1211
bool good_flags(const char *ifname, const struct ifreq *ifr){
1213
/* Reject the loopback device */
1214
if(ifr->ifr_flags & IFF_LOOPBACK){
1216
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1221
/* Accept point-to-point devices only if connect_to is specified */
1222
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1224
fprintf_plus(stderr, "Accepting point-to-point interface"
1225
" \"%s\"\n", ifname);
1229
/* Otherwise, reject non-broadcast-capable devices */
1230
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1232
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1233
" \"%s\"\n", ifname);
1237
/* Reject non-ARP interfaces (including dummy interfaces) */
1238
if(ifr->ifr_flags & IFF_NOARP){
1240
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1246
/* Accept this device */
1248
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1254
* This function determines if a directory entry in /sys/class/net
1255
* corresponds to an acceptable network device.
1256
* (This function is passed to scandir(3) as a filter function.)
1258
__attribute__((nonnull, warn_unused_result))
1259
int good_interface(const struct dirent *if_entry){
1260
if(if_entry->d_name[0] == '.'){
1265
if(not get_flags(if_entry->d_name, &ifr)){
1267
fprintf_plus(stderr, "Failed to get flags for interface "
1268
"\"%s\"\n", if_entry->d_name);
1273
if(not good_flags(if_entry->d_name, &ifr)){
1280
* This function determines if a network interface is up.
1282
__attribute__((nonnull, warn_unused_result))
1283
bool interface_is_up(const char *interface){
1285
if(not get_flags(interface, &ifr)){
1287
fprintf_plus(stderr, "Failed to get flags for interface "
1288
"\"%s\"\n", interface);
1293
return (bool)(ifr.ifr_flags & IFF_UP);
1297
* This function determines if a network interface is running
1299
__attribute__((nonnull, warn_unused_result))
1300
bool interface_is_running(const char *interface){
1302
if(not get_flags(interface, &ifr)){
1304
fprintf_plus(stderr, "Failed to get flags for interface "
1305
"\"%s\"\n", interface);
1310
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1313
__attribute__((nonnull, pure, warn_unused_result))
1314
int notdotentries(const struct dirent *direntry){
1315
/* Skip "." and ".." */
1316
if(direntry->d_name[0] == '.'
1317
and (direntry->d_name[1] == '\0'
1318
or (direntry->d_name[1] == '.'
1319
and direntry->d_name[2] == '\0'))){
1325
/* Is this directory entry a runnable program? */
1326
__attribute__((nonnull, warn_unused_result))
1327
int runnable_hook(const struct dirent *direntry){
1332
if((direntry->d_name)[0] == '\0'){
1337
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1338
"abcdefghijklmnopqrstuvwxyz"
1341
if((direntry->d_name)[sret] != '\0'){
1342
/* Contains non-allowed characters */
1344
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1350
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1353
perror_plus("Could not stat hook");
1357
if(not (S_ISREG(st.st_mode))){
1358
/* Not a regular file */
1360
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1365
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1366
/* Not executable */
1368
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1374
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1380
__attribute__((nonnull, warn_unused_result))
1381
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1382
mandos_context *mc){
1384
struct timespec now;
1385
struct timespec waited_time;
1386
intmax_t block_time;
1389
if(mc->current_server == NULL){
1391
fprintf_plus(stderr, "Wait until first server is found."
1394
ret = avahi_simple_poll_iterate(s, -1);
1397
fprintf_plus(stderr, "Check current_server if we should run"
1400
/* the current time */
1401
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1403
perror_plus("clock_gettime");
1406
/* Calculating in ms how long time between now and server
1407
who we visted longest time ago. Now - last seen. */
1408
waited_time.tv_sec = (now.tv_sec
1409
- mc->current_server->last_seen.tv_sec);
1410
waited_time.tv_nsec = (now.tv_nsec
1411
- mc->current_server->last_seen.tv_nsec);
1412
/* total time is 10s/10,000ms.
1413
Converting to s from ms by dividing by 1,000,
1414
and ns to ms by dividing by 1,000,000. */
1415
block_time = ((retry_interval
1416
- ((intmax_t)waited_time.tv_sec * 1000))
1417
- ((intmax_t)waited_time.tv_nsec / 1000000));
1420
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1424
if(block_time <= 0){
1425
ret = start_mandos_communication(mc->current_server->ip,
1426
mc->current_server->port,
1427
mc->current_server->if_index,
1428
mc->current_server->af, mc);
1430
avahi_simple_poll_quit(s);
1433
ret = clock_gettime(CLOCK_MONOTONIC,
1434
&mc->current_server->last_seen);
1436
perror_plus("clock_gettime");
1439
mc->current_server = mc->current_server->next;
1440
block_time = 0; /* Call avahi to find new Mandos
1441
servers, but don't block */
1444
ret = avahi_simple_poll_iterate(s, (int)block_time);
1447
if(ret > 0 or errno != EINTR){
1448
return (ret != 1) ? ret : 0;
1454
/* Set effective uid to 0, return errno */
1455
__attribute__((warn_unused_result))
1456
error_t raise_privileges(void){
1457
error_t old_errno = errno;
1458
error_t ret_errno = 0;
1459
if(seteuid(0) == -1){
1466
/* Set effective and real user ID to 0. Return errno. */
1467
__attribute__((warn_unused_result))
1468
error_t raise_privileges_permanently(void){
1469
error_t old_errno = errno;
1470
error_t ret_errno = raise_privileges();
1475
if(setuid(0) == -1){
1482
/* Set effective user ID to unprivileged saved user ID */
1483
__attribute__((warn_unused_result))
1484
error_t lower_privileges(void){
1485
error_t old_errno = errno;
1486
error_t ret_errno = 0;
1487
if(seteuid(uid) == -1){
1494
/* Lower privileges permanently */
1495
__attribute__((warn_unused_result))
1496
error_t lower_privileges_permanently(void){
1497
error_t old_errno = errno;
1498
error_t ret_errno = 0;
1499
if(setuid(uid) == -1){
1506
__attribute__((nonnull))
1507
void run_network_hooks(const char *mode, const char *interface,
1509
struct dirent **direntries = NULL;
1510
if(hookdir_fd == -1){
1511
hookdir_fd = open(hookdir, O_RDONLY);
1512
if(hookdir_fd == -1){
1513
if(errno == ENOENT){
1515
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1516
" found\n", hookdir);
1519
perror_plus("open");
1525
#if __GLIBC_PREREQ(2, 15)
1526
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1527
runnable_hook, alphasort);
1528
#else /* not __GLIBC_PREREQ(2, 15) */
1529
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1531
#endif /* not __GLIBC_PREREQ(2, 15) */
1532
#else /* not __GLIBC__ */
1533
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1535
#endif /* not __GLIBC__ */
1537
perror_plus("scandir");
1540
struct dirent *direntry;
1542
int devnull = open("/dev/null", O_RDONLY);
1543
for(int i = 0; i < numhooks; i++){
1544
direntry = direntries[i];
1546
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1549
pid_t hook_pid = fork();
1552
/* Raise privileges */
1553
errno = raise_privileges_permanently();
1555
perror_plus("Failed to raise privileges");
1562
perror_plus("setgid");
1565
/* Reset supplementary groups */
1567
ret = setgroups(0, NULL);
1569
perror_plus("setgroups");
1572
ret = dup2(devnull, STDIN_FILENO);
1574
perror_plus("dup2(devnull, STDIN_FILENO)");
1577
ret = close(devnull);
1579
perror_plus("close");
1582
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1584
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1587
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1589
perror_plus("setenv");
1592
ret = setenv("DEVICE", interface, 1);
1594
perror_plus("setenv");
1597
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1599
perror_plus("setenv");
1602
ret = setenv("MODE", mode, 1);
1604
perror_plus("setenv");
1608
ret = asprintf(&delaystring, "%f", (double)delay);
1610
perror_plus("asprintf");
1613
ret = setenv("DELAY", delaystring, 1);
1616
perror_plus("setenv");
1620
if(connect_to != NULL){
1621
ret = setenv("CONNECT", connect_to, 1);
1623
perror_plus("setenv");
1627
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1629
perror_plus("openat");
1630
_exit(EXIT_FAILURE);
1632
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1633
perror_plus("close");
1634
_exit(EXIT_FAILURE);
1636
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1638
perror_plus("fexecve");
1639
_exit(EXIT_FAILURE);
1643
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1644
perror_plus("waitpid");
1647
if(WIFEXITED(status)){
1648
if(WEXITSTATUS(status) != 0){
1649
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1650
" with status %d\n", direntry->d_name,
1651
WEXITSTATUS(status));
1654
} else if(WIFSIGNALED(status)){
1655
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1656
" signal %d\n", direntry->d_name,
1660
fprintf_plus(stderr, "Warning: network hook \"%s\""
1661
" crashed\n", direntry->d_name);
1666
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1671
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1672
perror_plus("close");
1679
__attribute__((nonnull, warn_unused_result))
1680
error_t bring_up_interface(const char *const interface,
1682
error_t old_errno = errno;
1684
struct ifreq network;
1685
unsigned int if_index = if_nametoindex(interface);
1687
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1697
if(not interface_is_up(interface)){
1698
error_t ret_errno = 0, ioctl_errno = 0;
1699
if(not get_flags(interface, &network)){
1701
fprintf_plus(stderr, "Failed to get flags for interface "
1702
"\"%s\"\n", interface);
1706
network.ifr_flags |= IFF_UP; /* set flag */
1708
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1711
perror_plus("socket");
1717
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1719
perror_plus("close");
1726
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
1730
/* Raise privileges */
1731
ret_errno = raise_privileges();
1734
perror_plus("Failed to raise privileges");
1739
bool restore_loglevel = false;
1741
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1742
messages about the network interface to mess up the prompt */
1743
ret_linux = klogctl(8, NULL, 5);
1744
if(ret_linux == -1){
1745
perror_plus("klogctl");
1747
restore_loglevel = true;
1750
#endif /* __linux__ */
1751
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1752
ioctl_errno = errno;
1754
if(restore_loglevel){
1755
ret_linux = klogctl(7, NULL, 0);
1756
if(ret_linux == -1){
1757
perror_plus("klogctl");
1760
#endif /* __linux__ */
1762
/* If raise_privileges() succeeded above */
1764
/* Lower privileges */
1765
ret_errno = lower_privileges();
1768
perror_plus("Failed to lower privileges");
1772
/* Close the socket */
1773
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1775
perror_plus("close");
1778
if(ret_setflags == -1){
1779
errno = ioctl_errno;
1780
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1785
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1789
/* Sleep checking until interface is running.
1790
Check every 0.25s, up to total time of delay */
1791
for(int i=0; i < delay * 4; i++){
1792
if(interface_is_running(interface)){
1795
struct timespec sleeptime = { .tv_nsec = 250000000 };
1796
ret = nanosleep(&sleeptime, NULL);
1797
if(ret == -1 and errno != EINTR){
1798
perror_plus("nanosleep");
1806
__attribute__((nonnull, warn_unused_result))
1807
error_t take_down_interface(const char *const interface){
1808
error_t old_errno = errno;
1809
struct ifreq network;
1810
unsigned int if_index = if_nametoindex(interface);
1812
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1816
if(interface_is_up(interface)){
1817
error_t ret_errno = 0, ioctl_errno = 0;
1818
if(not get_flags(interface, &network) and debug){
1820
fprintf_plus(stderr, "Failed to get flags for interface "
1821
"\"%s\"\n", interface);
1825
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1827
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1830
perror_plus("socket");
1836
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
1840
/* Raise privileges */
1841
ret_errno = raise_privileges();
1844
perror_plus("Failed to raise privileges");
1847
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1848
ioctl_errno = errno;
1850
/* If raise_privileges() succeeded above */
1852
/* Lower privileges */
1853
ret_errno = lower_privileges();
1856
perror_plus("Failed to lower privileges");
1860
/* Close the socket */
1861
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1863
perror_plus("close");
1866
if(ret_setflags == -1){
1867
errno = ioctl_errno;
1868
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1873
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1881
int main(int argc, char *argv[]){
1882
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1883
.priority = "SECURE256:!CTYPE-X.509:"
1884
"+CTYPE-OPENPGP", .current_server = NULL,
1885
.interfaces = NULL, .interfaces_size = 0 };
1886
AvahiSServiceBrowser *sb = NULL;
1891
int exitcode = EXIT_SUCCESS;
1892
char *interfaces_to_take_down = NULL;
1893
size_t interfaces_to_take_down_size = 0;
1894
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
1895
char old_tempdir[] = "/tmp/mandosXXXXXX";
1896
char *tempdir = NULL;
1897
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1898
const char *seckey = PATHDIR "/" SECKEY;
1899
const char *pubkey = PATHDIR "/" PUBKEY;
1900
char *interfaces_hooks = NULL;
1902
bool gnutls_initialized = false;
1903
bool gpgme_initialized = false;
1905
double retry_interval = 10; /* 10s between trying a server and
1906
retrying the same server again */
1908
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1909
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1914
/* Lower any group privileges we might have, just to be safe */
1918
perror_plus("setgid");
1921
/* Lower user privileges (temporarily) */
1925
perror_plus("seteuid");
1933
struct argp_option options[] = {
1934
{ .name = "debug", .key = 128,
1935
.doc = "Debug mode", .group = 3 },
1936
{ .name = "connect", .key = 'c',
1937
.arg = "ADDRESS:PORT",
1938
.doc = "Connect directly to a specific Mandos server",
1940
{ .name = "interface", .key = 'i',
1942
.doc = "Network interface that will be used to search for"
1945
{ .name = "seckey", .key = 's',
1947
.doc = "OpenPGP secret key file base name",
1949
{ .name = "pubkey", .key = 'p',
1951
.doc = "OpenPGP public key file base name",
1953
{ .name = "dh-bits", .key = 129,
1955
.doc = "Bit length of the prime number used in the"
1956
" Diffie-Hellman key exchange",
1958
{ .name = "priority", .key = 130,
1960
.doc = "GnuTLS priority string for the TLS handshake",
1962
{ .name = "delay", .key = 131,
1964
.doc = "Maximum delay to wait for interface startup",
1966
{ .name = "retry", .key = 132,
1968
.doc = "Retry interval used when denied by the Mandos server",
1970
{ .name = "network-hook-dir", .key = 133,
1972
.doc = "Directory where network hooks are located",
1975
* These reproduce what we would get without ARGP_NO_HELP
1977
{ .name = "help", .key = '?',
1978
.doc = "Give this help list", .group = -1 },
1979
{ .name = "usage", .key = -3,
1980
.doc = "Give a short usage message", .group = -1 },
1981
{ .name = "version", .key = 'V',
1982
.doc = "Print program version", .group = -1 },
1986
error_t parse_opt(int key, char *arg,
1987
struct argp_state *state){
1990
case 128: /* --debug */
1993
case 'c': /* --connect */
1996
case 'i': /* --interface */
1997
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
2000
argp_error(state, "%s", strerror(ret_errno));
2003
case 's': /* --seckey */
2006
case 'p': /* --pubkey */
2009
case 129: /* --dh-bits */
2011
tmpmax = strtoimax(arg, &tmp, 10);
2012
if(errno != 0 or tmp == arg or *tmp != '\0'
2013
or tmpmax != (typeof(mc.dh_bits))tmpmax){
2014
argp_error(state, "Bad number of DH bits");
2016
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
2018
case 130: /* --priority */
2021
case 131: /* --delay */
2023
delay = strtof(arg, &tmp);
2024
if(errno != 0 or tmp == arg or *tmp != '\0'){
2025
argp_error(state, "Bad delay");
2027
case 132: /* --retry */
2029
retry_interval = strtod(arg, &tmp);
2030
if(errno != 0 or tmp == arg or *tmp != '\0'
2031
or (retry_interval * 1000) > INT_MAX
2032
or retry_interval < 0){
2033
argp_error(state, "Bad retry interval");
2036
case 133: /* --network-hook-dir */
2040
* These reproduce what we would get without ARGP_NO_HELP
2042
case '?': /* --help */
2043
argp_state_help(state, state->out_stream,
2044
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
2045
& ~(unsigned int)ARGP_HELP_EXIT_OK);
2046
case -3: /* --usage */
2047
argp_state_help(state, state->out_stream,
2048
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
2049
case 'V': /* --version */
2050
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
2051
exit(argp_err_exit_status);
2054
return ARGP_ERR_UNKNOWN;
2059
struct argp argp = { .options = options, .parser = parse_opt,
2061
.doc = "Mandos client -- Get and decrypt"
2062
" passwords from a Mandos server" };
2063
ret = argp_parse(&argp, argc, argv,
2064
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
603
case AVAHI_BROWSER_FAILURE:
605
fprintf(stderr, "(Browser) %s\n",
606
avahi_strerror(avahi_server_errno(server)));
607
avahi_simple_poll_quit(simple_poll);
610
case AVAHI_BROWSER_NEW:
611
/* We ignore the returned resolver object. In the callback
612
function we free it. If the server is terminated before
613
the callback function is called the server will free
614
the resolver for us. */
616
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
618
AVAHI_PROTO_INET6, 0,
619
resolve_callback, s)))
620
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
621
avahi_strerror(avahi_server_errno(s)));
624
case AVAHI_BROWSER_REMOVE:
627
case AVAHI_BROWSER_ALL_FOR_NOW:
628
case AVAHI_BROWSER_CACHE_EXHAUSTED:
633
/* Combines file name and path and returns the malloced new
634
string. some sane checks could/should be added */
635
static const char *combinepath(const char *first, const char *second){
636
size_t f_len = strlen(first);
637
size_t s_len = strlen(second);
638
char *tmp = malloc(f_len + s_len + 2);
643
memcpy(tmp, first, f_len);
647
memcpy(tmp + f_len + 1, second, s_len);
649
tmp[f_len + 1 + s_len] = '\0';
654
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
2071
perror_plus("argp_parse");
2072
exitcode = EX_OSERR;
2075
exitcode = EX_USAGE;
2081
/* Work around Debian bug #633582:
2082
<http://bugs.debian.org/633582> */
2084
/* Re-raise privileges */
2085
ret_errno = raise_privileges();
2088
perror_plus("Failed to raise privileges");
2092
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2093
int seckey_fd = open(seckey, O_RDONLY);
2094
if(seckey_fd == -1){
2095
perror_plus("open");
2097
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
2099
perror_plus("fstat");
2101
if(S_ISREG(st.st_mode)
2102
and st.st_uid == 0 and st.st_gid == 0){
2103
ret = fchown(seckey_fd, uid, gid);
2105
perror_plus("fchown");
2109
TEMP_FAILURE_RETRY(close(seckey_fd));
2113
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
2114
int pubkey_fd = open(pubkey, O_RDONLY);
2115
if(pubkey_fd == -1){
2116
perror_plus("open");
2118
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
2120
perror_plus("fstat");
2122
if(S_ISREG(st.st_mode)
2123
and st.st_uid == 0 and st.st_gid == 0){
2124
ret = fchown(pubkey_fd, uid, gid);
2126
perror_plus("fchown");
2130
TEMP_FAILURE_RETRY(close(pubkey_fd));
2134
/* Lower privileges */
2135
ret_errno = lower_privileges();
2138
perror_plus("Failed to lower privileges");
2143
/* Remove invalid interface names (except "none") */
2145
char *interface = NULL;
2146
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2148
if(strcmp(interface, "none") != 0
2149
and if_nametoindex(interface) == 0){
2150
if(interface[0] != '\0'){
2151
fprintf_plus(stderr, "Not using nonexisting interface"
2152
" \"%s\"\n", interface);
2154
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2160
/* Run network hooks */
2162
if(mc.interfaces != NULL){
2163
interfaces_hooks = malloc(mc.interfaces_size);
2164
if(interfaces_hooks == NULL){
2165
perror_plus("malloc");
2168
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2169
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2171
run_network_hooks("start", interfaces_hooks != NULL ?
2172
interfaces_hooks : "", delay);
2176
avahi_set_log_function(empty_log);
2179
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
2180
from the signal handler */
2181
/* Initialize the pseudo-RNG for Avahi */
2182
srand((unsigned int) time(NULL));
2183
simple_poll = avahi_simple_poll_new();
2184
if(simple_poll == NULL){
2185
fprintf_plus(stderr,
2186
"Avahi: Failed to create simple poll object.\n");
2187
exitcode = EX_UNAVAILABLE;
2191
sigemptyset(&sigterm_action.sa_mask);
2192
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
2194
perror_plus("sigaddset");
2195
exitcode = EX_OSERR;
2198
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
2200
perror_plus("sigaddset");
2201
exitcode = EX_OSERR;
2204
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
2206
perror_plus("sigaddset");
2207
exitcode = EX_OSERR;
2210
/* Need to check if the handler is SIG_IGN before handling:
2211
| [[info:libc:Initial Signal Actions]] |
2212
| [[info:libc:Basic Signal Handling]] |
2214
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
2216
perror_plus("sigaction");
2219
if(old_sigterm_action.sa_handler != SIG_IGN){
2220
ret = sigaction(SIGINT, &sigterm_action, NULL);
2222
perror_plus("sigaction");
2223
exitcode = EX_OSERR;
2227
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
2229
perror_plus("sigaction");
2232
if(old_sigterm_action.sa_handler != SIG_IGN){
2233
ret = sigaction(SIGHUP, &sigterm_action, NULL);
2235
perror_plus("sigaction");
2236
exitcode = EX_OSERR;
2240
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
2242
perror_plus("sigaction");
2245
if(old_sigterm_action.sa_handler != SIG_IGN){
2246
ret = sigaction(SIGTERM, &sigterm_action, NULL);
2248
perror_plus("sigaction");
2249
exitcode = EX_OSERR;
2254
/* If no interfaces were specified, make a list */
2255
if(mc.interfaces == NULL){
2256
struct dirent **direntries = NULL;
2257
/* Look for any good interfaces */
2258
ret = scandir(sys_class_net, &direntries, good_interface,
2261
/* Add all found interfaces to interfaces list */
2262
for(int i = 0; i < ret; ++i){
2263
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2264
direntries[i]->d_name);
2267
perror_plus("argz_add");
2271
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2272
direntries[i]->d_name);
2280
fprintf_plus(stderr, "Could not find a network interface\n");
2281
exitcode = EXIT_FAILURE;
2286
/* Bring up interfaces which are down, and remove any "none"s */
2288
char *interface = NULL;
2289
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2291
/* If interface name is "none", stop bringing up interfaces.
2292
Also remove all instances of "none" from the list */
2293
if(strcmp(interface, "none") == 0){
2294
argz_delete(&mc.interfaces, &mc.interfaces_size,
2297
while((interface = argz_next(mc.interfaces,
2298
mc.interfaces_size, interface))){
2299
if(strcmp(interface, "none") == 0){
2300
argz_delete(&mc.interfaces, &mc.interfaces_size,
2307
bool interface_was_up = interface_is_up(interface);
2308
errno = bring_up_interface(interface, delay);
2309
if(not interface_was_up){
2311
perror_plus("Failed to bring up interface");
2313
errno = argz_add(&interfaces_to_take_down,
2314
&interfaces_to_take_down_size,
2317
perror_plus("argz_add");
2322
if(debug and (interfaces_to_take_down == NULL)){
2323
fprintf_plus(stderr, "No interfaces were brought up\n");
2327
/* If we only got one interface, explicitly use only that one */
2328
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2330
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2333
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2340
ret = init_gnutls_global(pubkey, seckey, &mc);
2342
fprintf_plus(stderr, "init_gnutls_global failed\n");
2343
exitcode = EX_UNAVAILABLE;
2346
gnutls_initialized = true;
2353
/* Try /run/tmp before /tmp */
2354
tempdir = mkdtemp(run_tempdir);
2355
if(tempdir == NULL and errno == ENOENT){
2357
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2358
run_tempdir, old_tempdir);
2360
tempdir = mkdtemp(old_tempdir);
2362
if(tempdir == NULL){
2363
perror_plus("mkdtemp");
2371
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2372
fprintf_plus(stderr, "init_gpgme failed\n");
2373
exitcode = EX_UNAVAILABLE;
2376
gpgme_initialized = true;
2383
if(connect_to != NULL){
2384
/* Connect directly, do not use Zeroconf */
2385
/* (Mainly meant for debugging) */
2386
char *address = strrchr(connect_to, ':');
2388
if(address == NULL){
2389
fprintf_plus(stderr, "No colon in address\n");
2390
exitcode = EX_USAGE;
2400
tmpmax = strtoimax(address+1, &tmp, 10);
2401
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2402
or tmpmax != (in_port_t)tmpmax){
2403
fprintf_plus(stderr, "Bad port number\n");
2404
exitcode = EX_USAGE;
2412
port = (in_port_t)tmpmax;
2414
/* Colon in address indicates IPv6 */
2416
if(strchr(connect_to, ':') != NULL){
2418
/* Accept [] around IPv6 address - see RFC 5952 */
2419
if(connect_to[0] == '[' and address[-1] == ']')
2427
address = connect_to;
2433
while(not quit_now){
2434
ret = start_mandos_communication(address, port, if_index, af,
2436
if(quit_now or ret == 0){
2440
fprintf_plus(stderr, "Retrying in %d seconds\n",
2441
(int)retry_interval);
2443
sleep((unsigned int)retry_interval);
2447
exitcode = EXIT_SUCCESS;
655
2458
AvahiServerConfig config;
656
AvahiSServiceBrowser *sb = NULL;
659
int returncode = EXIT_SUCCESS;
660
const char *interface = "eth0";
661
struct ifreq network;
663
char *connect_to = NULL;
664
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
667
static struct option long_options[] = {
668
{"debug", no_argument, (int *)&debug, 1},
669
{"connect", required_argument, 0, 'C'},
670
{"interface", required_argument, 0, 'i'},
671
{"certdir", required_argument, 0, 'd'},
672
{"certkey", required_argument, 0, 'c'},
673
{"certfile", required_argument, 0, 'k'},
676
int option_index = 0;
677
ret = getopt_long (argc, argv, "i:", long_options,
707
certfile = combinepath(certdir, certfile);
708
if (certfile == NULL){
709
perror("combinepath");
710
returncode = EXIT_FAILURE;
714
certkey = combinepath(certdir, certkey);
715
if (certkey == NULL){
716
perror("combinepath");
717
returncode = EXIT_FAILURE;
721
if_index = (AvahiIfIndex) if_nametoindex(interface);
723
fprintf(stderr, "No such interface: \"%s\"\n", interface);
727
if(connect_to != NULL){
728
/* Connect directly, do not use Zeroconf */
729
/* (Mainly meant for debugging) */
730
char *address = strrchr(connect_to, ':');
732
fprintf(stderr, "No colon in address\n");
736
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
738
perror("Bad port number");
742
address = connect_to;
743
ret = start_mandos_communication(address, port, if_index);
751
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
754
returncode = EXIT_FAILURE;
757
strcpy(network.ifr_name, interface);
758
ret = ioctl(sd, SIOCGIFFLAGS, &network);
761
perror("ioctl SIOCGIFFLAGS");
762
returncode = EXIT_FAILURE;
765
if((network.ifr_flags & IFF_UP) == 0){
766
network.ifr_flags |= IFF_UP;
767
ret = ioctl(sd, SIOCSIFFLAGS, &network);
769
perror("ioctl SIOCSIFFLAGS");
770
returncode = EXIT_FAILURE;
777
avahi_set_log_function(empty_log);
780
/* Initialize the psuedo-RNG */
781
srand((unsigned int) time(NULL));
783
/* Allocate main loop object */
784
if (!(simple_poll = avahi_simple_poll_new())) {
785
fprintf(stderr, "Failed to create simple poll object.\n");
786
returncode = EXIT_FAILURE;
790
/* Do not publish any local records */
2459
/* Do not publish any local Zeroconf records */
791
2460
avahi_server_config_init(&config);
792
2461
config.publish_hinfo = 0;
793
2462
config.publish_addresses = 0;
794
2463
config.publish_workstation = 0;
795
2464
config.publish_domain = 0;
797
2466
/* Allocate a new server */
798
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
799
&config, NULL, NULL, &error);
801
/* Free the configuration data */
2467
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2468
&config, NULL, NULL, &ret_errno);
2470
/* Free the Avahi configuration data */
802
2471
avahi_server_config_free(&config);
804
/* Check if creating the server object succeeded */
806
fprintf(stderr, "Failed to create server: %s\n",
807
avahi_strerror(error));
808
returncode = EXIT_FAILURE;
812
/* Create the service browser */
813
sb = avahi_s_service_browser_new(server, if_index,
815
"_mandos._tcp", NULL, 0,
816
browse_callback, server);
818
fprintf(stderr, "Failed to create service browser: %s\n",
819
avahi_strerror(avahi_server_errno(server)));
820
returncode = EXIT_FAILURE;
824
/* Run the main loop */
827
fprintf(stderr, "Starting avahi loop search\n");
830
avahi_simple_poll_loop(simple_poll);
835
fprintf(stderr, "%s exiting\n", argv[0]);
840
avahi_s_service_browser_free(sb);
843
avahi_server_free(server);
846
avahi_simple_poll_free(simple_poll);
2474
/* Check if creating the Avahi server object succeeded */
2475
if(mc.server == NULL){
2476
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2477
avahi_strerror(ret_errno));
2478
exitcode = EX_UNAVAILABLE;
2486
/* Create the Avahi service browser */
2487
sb = avahi_s_service_browser_new(mc.server, if_index,
2488
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2489
NULL, 0, browse_callback,
2492
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2493
avahi_strerror(avahi_server_errno(mc.server)));
2494
exitcode = EX_UNAVAILABLE;
2502
/* Run the main loop */
2505
fprintf_plus(stderr, "Starting Avahi loop search\n");
2508
ret = avahi_loop_with_timeout(simple_poll,
2509
(int)(retry_interval * 1000), &mc);
2511
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2512
(ret == 0) ? "successfully" : "with error");
2518
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2521
/* Cleanup things */
2522
free(mc.interfaces);
2525
avahi_s_service_browser_free(sb);
2527
if(mc.server != NULL)
2528
avahi_server_free(mc.server);
2530
if(simple_poll != NULL)
2531
avahi_simple_poll_free(simple_poll);
2533
if(gnutls_initialized){
2534
gnutls_certificate_free_credentials(mc.cred);
2535
gnutls_global_deinit();
2536
gnutls_dh_params_deinit(mc.dh_params);
2539
if(gpgme_initialized){
2540
gpgme_release(mc.ctx);
2543
/* Cleans up the circular linked list of Mandos servers the client
2545
if(mc.current_server != NULL){
2546
mc.current_server->prev->next = NULL;
2547
while(mc.current_server != NULL){
2548
server *next = mc.current_server->next;
2549
free(mc.current_server);
2550
mc.current_server = next;
2554
/* Re-raise privileges */
2556
ret_errno = raise_privileges();
2559
perror_plus("Failed to raise privileges");
2562
/* Run network hooks */
2563
run_network_hooks("stop", interfaces_hooks != NULL ?
2564
interfaces_hooks : "", delay);
2566
/* Take down the network interfaces which were brought up */
2568
char *interface = NULL;
2569
while((interface=argz_next(interfaces_to_take_down,
2570
interfaces_to_take_down_size,
2572
ret_errno = take_down_interface(interface);
2575
perror_plus("Failed to take down interface");
2578
if(debug and (interfaces_to_take_down == NULL)){
2579
fprintf_plus(stderr, "No interfaces needed to be taken"
2585
ret_errno = lower_privileges_permanently();
2588
perror_plus("Failed to lower privileges permanently");
2592
free(interfaces_to_take_down);
2593
free(interfaces_hooks);
2595
/* Removes the GPGME temp directory and all files inside */
2596
if(tempdir != NULL){
2597
struct dirent **direntries = NULL;
2598
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2600
if(tempdir_fd == -1){
2601
perror_plus("open");
2604
#if __GLIBC_PREREQ(2, 15)
2605
int numentries = scandirat(tempdir_fd, ".", &direntries,
2606
notdotentries, alphasort);
2607
#else /* not __GLIBC_PREREQ(2, 15) */
2608
int numentries = scandir(tempdir, &direntries, notdotentries,
2610
#endif /* not __GLIBC_PREREQ(2, 15) */
2611
#else /* not __GLIBC__ */
2612
int numentries = scandir(tempdir, &direntries, notdotentries,
2614
#endif /* not __GLIBC__ */
2615
if(numentries >= 0){
2616
for(int i = 0; i < numentries; i++){
2617
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2619
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2620
" \"%s\", 0): %s\n", tempdir,
2621
direntries[i]->d_name, strerror(errno));
2625
/* need to clean even if 0 because man page doesn't specify */
2627
if(numentries == -1){
2628
perror_plus("scandir");
2630
ret = rmdir(tempdir);
2631
if(ret == -1 and errno != ENOENT){
2632
perror_plus("rmdir");
2635
TEMP_FAILURE_RETRY(close(tempdir_fd));
2640
sigemptyset(&old_sigterm_action.sa_mask);
2641
old_sigterm_action.sa_handler = SIG_DFL;
2642
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
2643
&old_sigterm_action,
2646
perror_plus("sigaction");
2649
ret = raise(signal_received);
2650
} while(ret != 0 and errno == EINTR);
2652
perror_plus("raise");
2655
TEMP_FAILURE_RETRY(pause());