/mandos/trunk : revision 723.1.1

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/mandos-client.c

Committer: Teddy Hogeborn
Date: 2014-07-25 22:44:20 UTC
mto: This revision was merged to the branch mainline in revision 724.
Revision ID: teddy@recompile.se-20140725224420-4a5ct2ptt0hsc92z

Require Python 2.7.

This is in preparation for the eventual move to Python 3, which will
happen as soon as all Python modules required by Mandos are available.
The mandos-ctl and mandos-monitor programs are already portable
between Python 2.6 and Python 3 without changes; this change will
bring the requirement up to Python 2.7.

* INSTALL (Prerequisites/Libraries/Mandos Server): Document
                                                   requirement of
                                                   Python 2.7; remove
                                                   Python-argparse
                                                   which is in the
                                                   Python 2.7 standard
                                                   library.
* debian/control (Source: mandos/Build-Depends-Indep): Depend on
                                                       exactly the
                                                       python2.7
                                                       package and all
                                                       the Python 2.7
                                                       versions of the
                                                       python modules.
  (Package: mandos/Depends): - '' - but still depend on python (<=2.7)
                            and the generic versions of the Python
                            modules; this is for mandos-ctl and
                            mandos-monitor, both of which are
                            compatible with Python 3, and use
                            #!/usr/bin/python.
* mandos: Use #!/usr/bin/python2.7 instead of #!/usr/bin/python.

Show diffs side-by-side

added added

removed removed

plugins.d/mandos-client.c

* "browse_callback", and parts of "main".

* Everything else is

* This program is free software: you can redistribute it and/or

* modify it under the terms of the GNU General Public License as

#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),

strtof(), abort() */

#include <stdbool.h> /* bool, false, true */

#include <string.h> /* strcmp(), strlen(), strerror(),

asprintf(), strcpy() */

#include <string.h> /* memset(), strcmp(), strlen(),

strerror(), asprintf(), strcpy() */

#include <sys/ioctl.h> /* ioctl */

#include <sys/types.h> /* socket(), inet_pton(), sockaddr,

sockaddr_in6, PF_INET6,

305

return false;

306

}

307

308

ret = close(fd);

308

ret = (int)TEMP_FAILURE_RETRY(close(fd));

309

if(ret == -1){

310

perror_plus("close");

311

}

493

return plaintext_length;

494

}

495

496

__attribute__((warn_unused_result, const))

497

static const char *safe_string(const char *str){

498

if(str == NULL)

499

return "(unknown)";

500

return str;

501

}

502

503

496

__attribute__((warn_unused_result))

504

497

static const char *safer_gnutls_strerror(int value){

505

498

const char *ret = gnutls_strerror(value);

506

return safe_string(ret);

499

if(ret == NULL)

500

ret = "(unknown)";

501

return ret;

507

502

}

508

503

509

504

/* GnuTLS log function callback */

516

511

__attribute__((nonnull, warn_unused_result))

517

512

static int init_gnutls_global(const char *pubkeyfilename,

518

513

const char *seckeyfilename,

519

const char *dhparamsfilename,

520

514

mandos_context *mc){

521

515

int ret;

522

unsigned int uret;

523

516

524

517

if(debug){

525

518

fprintf_plus(stderr, "Initializing GnuTLS\n");

576

569

safer_gnutls_strerror(ret));

577

570

goto globalfail;

578

571

}

579

/* If a Diffie-Hellman parameters file was given, try to use it */

580

if(dhparamsfilename != NULL){

581

gnutls_datum_t params = { .data = NULL, .size = 0 };

582

do {

583

int dhpfile = open(dhparamsfilename, O_RDONLY);

584

if(dhpfile == -1){

585

perror_plus("open");

586

dhparamsfilename = NULL;

587

break;

588

}

589

size_t params_capacity = 0;

590

while(true){

591

params_capacity = incbuffer((char **)&params.data,

592

(size_t)params.size,

593

(size_t)params_capacity);

594

if(params_capacity == 0){

595

perror_plus("incbuffer");

596

free(params.data);

597

params.data = NULL;

598

dhparamsfilename = NULL;

599

break;

600

}

601

ssize_t bytes_read = read(dhpfile,

602

params.data + params.size,

603

BUFFER_SIZE);

604

/* EOF */

605

if(bytes_read == 0){

606

break;

607

}

608

/* check bytes_read for failure */

609

if(bytes_read < 0){

610

perror_plus("read");

611

free(params.data);

612

params.data = NULL;

613

dhparamsfilename = NULL;

614

break;

615

}

616

params.size += (unsigned int)bytes_read;

617

}

618

if(params.data == NULL){

619

dhparamsfilename = NULL;

620

}

621

if(dhparamsfilename == NULL){

622

break;

623

}

624

ret = gnutls_dh_params_import_pkcs3(mc->dh_params, &params,

625

GNUTLS_X509_FMT_PEM);

626

if(ret != GNUTLS_E_SUCCESS){

627

fprintf_plus(stderr, "Failed to parse DH parameters in file"

628

" \"%s\": %s\n", dhparamsfilename,

629

safer_gnutls_strerror(ret));

630

dhparamsfilename = NULL;

631

}

632

} while(false);

633

}

634

if(dhparamsfilename == NULL){

635

if(mc->dh_bits == 0){

636

/* Find out the optimal number of DH bits */

637

/* Try to read the private key file */

638

gnutls_datum_t buffer = { .data = NULL, .size = 0 };

639

do {

640

int secfile = open(seckeyfilename, O_RDONLY);

641

if(secfile == -1){

642

perror_plus("open");

643

break;

644

}

645

size_t buffer_capacity = 0;

646

while(true){

647

buffer_capacity = incbuffer((char **)&buffer.data,

648

(size_t)buffer.size,

649

(size_t)buffer_capacity);

650

if(buffer_capacity == 0){

651

perror_plus("incbuffer");

652

free(buffer.data);

653

buffer.data = NULL;

654

break;

655

}

656

ssize_t bytes_read = read(secfile,

657

buffer.data + buffer.size,

658

BUFFER_SIZE);

659

/* EOF */

660

if(bytes_read == 0){

661

break;

662

}

663

/* check bytes_read for failure */

664

if(bytes_read < 0){

665

perror_plus("read");

666

free(buffer.data);

667

buffer.data = NULL;

668

break;

669

}

670

buffer.size += (unsigned int)bytes_read;

671

}

672

close(secfile);

673

} while(false);

674

/* If successful, use buffer to parse private key */

675

gnutls_sec_param_t sec_param = GNUTLS_SEC_PARAM_ULTRA;

676

if(buffer.data != NULL){

677

{

678

gnutls_openpgp_privkey_t privkey = NULL;

679

ret = gnutls_openpgp_privkey_init(&privkey);

680

if(ret != GNUTLS_E_SUCCESS){

681

fprintf_plus(stderr, "Error initializing OpenPGP key"

682

" structure: %s",

683

safer_gnutls_strerror(ret));

684

free(buffer.data);

685

buffer.data = NULL;

686

} else {

687

ret = gnutls_openpgp_privkey_import

688

(privkey, &buffer, GNUTLS_OPENPGP_FMT_BASE64, "", 0);

689

if(ret != GNUTLS_E_SUCCESS){

690

fprintf_plus(stderr, "Error importing OpenPGP key : %s",

691

safer_gnutls_strerror(ret));

692

privkey = NULL;

693

}

694

free(buffer.data);

695

buffer.data = NULL;

696

if(privkey != NULL){

697

/* Use private key to suggest an appropriate

698

sec_param */

699

sec_param = gnutls_openpgp_privkey_sec_param(privkey);

700

gnutls_openpgp_privkey_deinit(privkey);

701

if(debug){

702

fprintf_plus(stderr, "This OpenPGP key implies using"

703

" a GnuTLS security parameter \"%s\".\n",

704

safe_string(gnutls_sec_param_get_name

705

(sec_param)));

706

}

707

}

708

}

709

}

710

if(sec_param == GNUTLS_SEC_PARAM_UNKNOWN){

711

/* Err on the side of caution */

712

sec_param = GNUTLS_SEC_PARAM_ULTRA;

713

if(debug){

714

fprintf_plus(stderr, "Falling back to security parameter"

715

" \"%s\"\n",

716

safe_string(gnutls_sec_param_get_name

717

(sec_param)));

718

}

719

}

720

}

721

uret = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, sec_param);

722

if(uret != 0){

723

mc->dh_bits = uret;

724

if(debug){

725

fprintf_plus(stderr, "A \"%s\" GnuTLS security parameter"

726

" implies %u DH bits; using that.\n",

727

safe_string(gnutls_sec_param_get_name

728

(sec_param)),

729

mc->dh_bits);

730

}

731

} else {

732

fprintf_plus(stderr, "Failed to get implied number of DH"

733

" bits for security parameter \"%s\"): %s\n",

734

safe_string(gnutls_sec_param_get_name

735

(sec_param)),

736

safer_gnutls_strerror(ret));

737

goto globalfail;

738

}

739

} else if(debug){

740

fprintf_plus(stderr, "DH bits explicitly set to %u\n",

741

mc->dh_bits);

742

}

743

ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);

744

if(ret != GNUTLS_E_SUCCESS){

745

fprintf_plus(stderr, "Error in GnuTLS prime generation (%u"

746

" bits): %s\n", mc->dh_bits,

747

safer_gnutls_strerror(ret));

748

goto globalfail;

749

}

750

}

572

ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);

573

if(ret != GNUTLS_E_SUCCESS){

574

fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",

575

safer_gnutls_strerror(ret));

576

goto globalfail;

577

}

578

751

579

gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);

752

580

753

581

return 0;

813

641

/* ignore client certificate if any. */

814

642

gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);

815

643

644

gnutls_dh_set_prime_bits(*session, mc->dh_bits);

645

816

646

return 0;

817

647

}

818

648

820

650

static void empty_log(__attribute__((unused)) AvahiLogLevel level,

821

651

__attribute__((unused)) const char *txt){}

822

652

823

/* Set effective uid to 0, return errno */

824

__attribute__((warn_unused_result))

825

error_t raise_privileges(void){

826

error_t old_errno = errno;

827

error_t ret_errno = 0;

828

if(seteuid(0) == -1){

829

ret_errno = errno;

830

}

831

errno = old_errno;

832

return ret_errno;

833

}

834

835

/* Set effective and real user ID to 0. Return errno. */

836

__attribute__((warn_unused_result))

837

error_t raise_privileges_permanently(void){

838

error_t old_errno = errno;

839

error_t ret_errno = raise_privileges();

840

if(ret_errno != 0){

841

errno = old_errno;

842

return ret_errno;

843

}

844

if(setuid(0) == -1){

845

ret_errno = errno;

846

}

847

errno = old_errno;

848

return ret_errno;

849

}

850

851

/* Set effective user ID to unprivileged saved user ID */

852

__attribute__((warn_unused_result))

853

error_t lower_privileges(void){

854

error_t old_errno = errno;

855

error_t ret_errno = 0;

856

if(seteuid(uid) == -1){

857

ret_errno = errno;

858

}

859

errno = old_errno;

860

return ret_errno;

861

}

862

863

/* Lower privileges permanently */

864

__attribute__((warn_unused_result))

865

error_t lower_privileges_permanently(void){

866

error_t old_errno = errno;

867

error_t ret_errno = 0;

868

if(setuid(uid) == -1){

869

ret_errno = errno;

870

}

871

errno = old_errno;

872

return ret_errno;

873

}

874

875

/* Helper function to add_local_route() and delete_local_route() */

876

__attribute__((nonnull, warn_unused_result))

877

static bool add_delete_local_route(const bool add,

878

const char *address,

879

AvahiIfIndex if_index){

880

int ret;

881

char helper[] = "mandos-client-iprouteadddel";

882

char add_arg[] = "add";

883

char delete_arg[] = "delete";

884

char debug_flag[] = "--debug";

885

char *pluginhelperdir = getenv("MANDOSPLUGINHELPERDIR");

886

if(pluginhelperdir == NULL){

887

if(debug){

888

fprintf_plus(stderr, "MANDOSPLUGINHELPERDIR environment"

889

" variable not set; cannot run helper\n");

890

}

891

return false;

892

}

893

894

char interface[IF_NAMESIZE];

895

if(if_indextoname((unsigned int)if_index, interface) == NULL){

896

perror_plus("if_indextoname");

897

return false;

898

}

899

900

int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));

901

if(devnull == -1){

902

perror_plus("open(\"/dev/null\", O_RDONLY)");

903

return false;

904

}

905

pid_t pid = fork();

906

if(pid == 0){

907

/* Child */

908

/* Raise privileges */

909

errno = raise_privileges_permanently();

910

if(errno != 0){

911

perror_plus("Failed to raise privileges");

912

/* _exit(EX_NOPERM); */

913

} else {

914

/* Set group */

915

errno = 0;

916

ret = setgid(0);

917

if(ret == -1){

918

perror_plus("setgid");

919

_exit(EX_NOPERM);

920

}

921

/* Reset supplementary groups */

922

errno = 0;

923

ret = setgroups(0, NULL);

924

if(ret == -1){

925

perror_plus("setgroups");

926

_exit(EX_NOPERM);

927

}

928

}

929

ret = dup2(devnull, STDIN_FILENO);

930

if(ret == -1){

931

perror_plus("dup2(devnull, STDIN_FILENO)");

932

_exit(EX_OSERR);

933

}

934

ret = close(devnull);

935

if(ret == -1){

936

perror_plus("close");

937

_exit(EX_OSERR);

938

}

939

ret = dup2(STDERR_FILENO, STDOUT_FILENO);

940

if(ret == -1){

941

perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");

942

_exit(EX_OSERR);

943

}

944

int helperdir_fd = (int)TEMP_FAILURE_RETRY(open(pluginhelperdir,

945

O_RDONLY

946

| O_DIRECTORY

947

| O_PATH

948

| O_CLOEXEC));

949

if(helperdir_fd == -1){

950

perror_plus("open");

951

_exit(EX_UNAVAILABLE);

952

}

953

int helper_fd = (int)TEMP_FAILURE_RETRY(openat(helperdir_fd,

954

helper, O_RDONLY));

955

if(helper_fd == -1){

956

perror_plus("openat");

957

close(helperdir_fd);

958

_exit(EX_UNAVAILABLE);

959

}

960

close(helperdir_fd);

961

#ifdef __GNUC__

962

#pragma GCC diagnostic push

963

#pragma GCC diagnostic ignored "-Wcast-qual"

964

#endif

965

if(fexecve(helper_fd, (char *const [])

966

{ helper, add ? add_arg : delete_arg, (char *)address,

967

interface, debug ? debug_flag : NULL, NULL },

968

environ) == -1){

969

#ifdef __GNUC__

970

#pragma GCC diagnostic pop

971

#endif

972

perror_plus("fexecve");

973

_exit(EXIT_FAILURE);

974

}

975

}

976

if(pid == -1){

977

perror_plus("fork");

978

return false;

979

}

980

int status;

981

pid_t pret = -1;

982

errno = 0;

983

do {

984

pret = waitpid(pid, &status, 0);

985

if(pret == -1 and errno == EINTR and quit_now){

986

int errno_raising = 0;

987

if((errno = raise_privileges()) != 0){

988

errno_raising = errno;

989

perror_plus("Failed to raise privileges in order to"

990

" kill helper program");

991

}

992

if(kill(pid, SIGTERM) == -1){

993

perror_plus("kill");

994

}

995

if((errno_raising == 0) and (errno = lower_privileges()) != 0){

996

perror_plus("Failed to lower privileges after killing"

997

" helper program");

998

}

999

return false;

1000

}

1001

} while(pret == -1 and errno == EINTR);

1002

if(pret == -1){

1003

perror_plus("waitpid");

1004

return false;

1005

}

1006

if(WIFEXITED(status)){

1007

if(WEXITSTATUS(status) != 0){

1008

fprintf_plus(stderr, "Error: iprouteadddel exited"

1009

" with status %d\n", WEXITSTATUS(status));

1010

return false;

1011

}

1012

return true;

1013

}

1014

if(WIFSIGNALED(status)){

1015

fprintf_plus(stderr, "Error: iprouteadddel died by"

1016

" signal %d\n", WTERMSIG(status));

1017

return false;

1018

}

1019

fprintf_plus(stderr, "Error: iprouteadddel crashed\n");

1020

return false;

1021

}

1022

1023

__attribute__((nonnull, warn_unused_result))

1024

static bool add_local_route(const char *address,

1025

AvahiIfIndex if_index){

1026

if(debug){

1027

fprintf_plus(stderr, "Adding route to %s\n", address);

1028

}

1029

return add_delete_local_route(true, address, if_index);

1030

}

1031

1032

__attribute__((nonnull, warn_unused_result))

1033

static bool delete_local_route(const char *address,

1034

AvahiIfIndex if_index){

1035

if(debug){

1036

fprintf_plus(stderr, "Removing route to %s\n", address);

1037

}

1038

return add_delete_local_route(false, address, if_index);

1039

}

1040

1041

653

/* Called when a Mandos server is found */

1042

654

__attribute__((nonnull, warn_unused_result))

1043

655

static int start_mandos_communication(const char *ip, in_port_t port,

1054

666

int retval = -1;

1055

667

gnutls_session_t session;

1056

668

int pf; /* Protocol family */

1057

bool route_added = false;

1058

669

1059

670

errno = 0;

1060

671

1118

729

PRIuMAX "\n", ip, (uintmax_t)port);

1119

730

}

1120

731

1121

tcp_sd = socket(pf, SOCK_STREAM | SOCK_CLOEXEC, 0);

732

tcp_sd = socket(pf, SOCK_STREAM, 0);

1122

733

if(tcp_sd < 0){

1123

734

int e = errno;

1124

735

perror_plus("socket");

1131

742

goto mandos_end;

1132

743

}

1133

744

745

memset(&to, 0, sizeof(to));

1134

746

if(af == AF_INET6){

1135

struct sockaddr_in6 *to6 = (struct sockaddr_in6 *)&to;

1136

*to6 = (struct sockaddr_in6){ .sin6_family = (sa_family_t)af };

1137

ret = inet_pton(af, ip, &to6->sin6_addr);

747

((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;

748

ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);

1138

749

} else { /* IPv4 */

1139

struct sockaddr_in *to4 = (struct sockaddr_in *)&to;

1140

*to4 = (struct sockaddr_in){ .sin_family = (sa_family_t)af };

1141

ret = inet_pton(af, ip, &to4->sin_addr);

750

((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;

751

ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);

1142

752

}

1143

753

if(ret < 0 ){

1144

754

int e = errno;

1214

824

goto mandos_end;

1215

825

}

1216

826

1217

while(true){

1218

if(af == AF_INET6){

1219

ret = connect(tcp_sd, (struct sockaddr *)&to,

1220

sizeof(struct sockaddr_in6));

1221

} else {

1222

ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */

1223

sizeof(struct sockaddr_in));

1224

}

1225

if(ret < 0){

1226

if(errno == ENETUNREACH

1227

and if_index != AVAHI_IF_UNSPEC

1228

and connect_to == NULL

1229

and not route_added and

1230

((af == AF_INET6 and not

1231

IN6_IS_ADDR_LINKLOCAL(&(((struct sockaddr_in6 *)

1232

&to)->sin6_addr)))

1233

or (af == AF_INET and

1234

/* Not a a IPv4LL address */

1235

(ntohl(((struct sockaddr_in *)&to)->sin_addr.s_addr)

1236

& 0xFFFF0000L) != 0xA9FE0000L))){

1237

/* Work around Avahi bug - Avahi does not announce link-local

1238

addresses if it has a global address, so local hosts with

1239

*only* a link-local address (e.g. Mandos clients) cannot

1240

connect to a Mandos server announced by Avahi on a server

1241

host with a global address. Work around this by retrying

1242

with an explicit route added with the server's address.

1243

1244

Avahi bug reference:

1245

http://lists.freedesktop.org/archives/avahi/2010-February/001833.html

1246

https://bugs.debian.org/587961

1247

1248

if(debug){

1249

fprintf_plus(stderr, "Mandos server unreachable, trying"

1250

" direct route\n");

1251

}

1252

int e = errno;

1253

route_added = add_local_route(ip, if_index);

1254

if(route_added){

1255

continue;

1256

}

1257

errno = e;

1258

}

1259

if(errno != ECONNREFUSED or debug){

1260

int e = errno;

1261

perror_plus("connect");

1262

errno = e;

1263

}

1264

goto mandos_end;

1265

}

1266

1267

if(quit_now){

1268

errno = EINTR;

1269

goto mandos_end;

1270

}

1271

break;

827

if(af == AF_INET6){

828

ret = connect(tcp_sd, (struct sockaddr *)&to,

829

sizeof(struct sockaddr_in6));

830

} else {

831

ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */

832

sizeof(struct sockaddr_in));

833

}

834

if(ret < 0){

835

if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){

836

int e = errno;

837

perror_plus("connect");

838

errno = e;

839

}

840

goto mandos_end;

841

}

842

843

if(quit_now){

844

errno = EINTR;

845

goto mandos_end;

1272

846

}

1273

847

1274

848

const char *out = mandos_protocol_version;

1457

1031

1458

1032

mandos_end:

1459

1033

{

1460

if(route_added){

1461

if(not delete_local_route(ip, if_index)){

1462

fprintf_plus(stderr, "Failed to delete local route to %s on"

1463

" interface %d", ip, if_index);

1464

}

1465

}

1466

1034

int e = errno;

1467

1035

free(decrypted_buffer);

1468

1036

free(buffer);

1469

1037

if(tcp_sd >= 0){

1470

ret = close(tcp_sd);

1038

ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));

1471

1039

}

1472

1040

if(ret == -1){

1473

1041

if(e == 0){

1894

1462

}

1895

1463

}

1896

1464

1465

/* Set effective uid to 0, return errno */

1466

__attribute__((warn_unused_result))

1467

error_t raise_privileges(void){

1468

error_t old_errno = errno;

1469

error_t ret_errno = 0;

1470

if(seteuid(0) == -1){

1471

ret_errno = errno;

1472

}

1473

errno = old_errno;

1474

return ret_errno;

1475

}

1476

1477

/* Set effective and real user ID to 0. Return errno. */

1478

__attribute__((warn_unused_result))

1479

error_t raise_privileges_permanently(void){

1480

error_t old_errno = errno;

1481

error_t ret_errno = raise_privileges();

1482

if(ret_errno != 0){

1483

errno = old_errno;

1484

return ret_errno;

1485

}

1486

if(setuid(0) == -1){

1487

ret_errno = errno;

1488

}

1489

errno = old_errno;

1490

return ret_errno;

1491

}

1492

1493

/* Set effective user ID to unprivileged saved user ID */

1494

__attribute__((warn_unused_result))

1495

error_t lower_privileges(void){

1496

error_t old_errno = errno;

1497

error_t ret_errno = 0;

1498

if(seteuid(uid) == -1){

1499

ret_errno = errno;

1500

}

1501

errno = old_errno;

1502

return ret_errno;

1503

}

1504

1505

/* Lower privileges permanently */

1506

__attribute__((warn_unused_result))

1507

error_t lower_privileges_permanently(void){

1508

error_t old_errno = errno;

1509

error_t ret_errno = 0;

1510

if(setuid(uid) == -1){

1511

ret_errno = errno;

1512

}

1513

errno = old_errno;

1514

return ret_errno;

1515

}

1516

1897

1517

__attribute__((nonnull))

1898

1518

void run_network_hooks(const char *mode, const char *interface,

1899

1519

const float delay){

1900

1520

struct dirent **direntries = NULL;

1901

1521

if(hookdir_fd == -1){

1902

hookdir_fd = open(hookdir, O_RDONLY | O_DIRECTORY | O_PATH

1903

| O_CLOEXEC);

1522

hookdir_fd = open(hookdir, O_RDONLY);

1904

1523

if(hookdir_fd == -1){

1905

1524

if(errno == ENOENT){

1906

1525

if(debug){

1931

1550

}

1932

1551

struct dirent *direntry;

1933

1552

int ret;

1934

int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));

1935

if(devnull == -1){

1936

perror_plus("open(\"/dev/null\", O_RDONLY)");

1937

return;

1938

}

1553

int devnull = open("/dev/null", O_RDONLY);

1939

1554

for(int i = 0; i < numhooks; i++){

1940

1555

direntry = direntries[i];

1941

1556

if(debug){

1965

1580

perror_plus("setgroups");

1966

1581

_exit(EX_NOPERM);

1967

1582

}

1583

ret = dup2(devnull, STDIN_FILENO);

1584

if(ret == -1){

1585

perror_plus("dup2(devnull, STDIN_FILENO)");

1586

_exit(EX_OSERR);

1587

}

1588

ret = close(devnull);

1589

if(ret == -1){

1590

perror_plus("close");

1591

_exit(EX_OSERR);

1592

}

1593

ret = dup2(STDERR_FILENO, STDOUT_FILENO);

1594

if(ret == -1){

1595

perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");

1596

_exit(EX_OSERR);

1597

}

1968

1598

ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);

1969

1599

if(ret == -1){

1970

1600

perror_plus("setenv");

2005

1635

_exit(EX_OSERR);

2006

1636

}

2007

1637

}

2008

int hook_fd = (int)TEMP_FAILURE_RETRY(openat(hookdir_fd,

2009

direntry->d_name,

2010

O_RDONLY));

1638

int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);

2011

1639

if(hook_fd == -1){

2012

1640

perror_plus("openat");

2013

1641

_exit(EXIT_FAILURE);

2014

1642

}

2015

if(close(hookdir_fd) == -1){

1643

if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){

2016

1644

perror_plus("close");

2017

1645

_exit(EXIT_FAILURE);

2018

1646

}

2019

ret = dup2(devnull, STDIN_FILENO);

2020

if(ret == -1){

2021

perror_plus("dup2(devnull, STDIN_FILENO)");

2022

_exit(EX_OSERR);

2023

}

2024

ret = close(devnull);

2025

if(ret == -1){

2026

perror_plus("close");

2027

_exit(EX_OSERR);

2028

}

2029

ret = dup2(STDERR_FILENO, STDOUT_FILENO);

2030

if(ret == -1){

2031

perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");

2032

_exit(EX_OSERR);

2033

}

2034

1647

if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },

2035

1648

environ) == -1){

2036

1649

perror_plus("fexecve");

2037

1650

_exit(EXIT_FAILURE);

2038

1651

}

2039

1652

} else {

2040

if(hook_pid == -1){

2041

perror_plus("fork");

2042

free(direntry);

2043

continue;

2044

}

2045

1653

int status;

2046

1654

if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){

2047

1655

perror_plus("waitpid");

2076

1684

free(direntry);

2077

1685

}

2078

1686

free(direntries);

2079

if(close(hookdir_fd) == -1){

1687

if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){

2080

1688

perror_plus("close");

2081

1689

} else {

2082

1690

hookdir_fd = -1;

2122

1730

}

2123

1731

2124

1732

if(quit_now){

2125

ret = close(sd);

1733

ret = (int)TEMP_FAILURE_RETRY(close(sd));

2126

1734

if(ret == -1){

2127

1735

perror_plus("close");

2128

1736

}

2178

1786

}

2179

1787

2180

1788

/* Close the socket */

2181

ret = close(sd);

1789

ret = (int)TEMP_FAILURE_RETRY(close(sd));

2182

1790

if(ret == -1){

2183

1791

perror_plus("close");

2184

1792

}

2266

1874

}

2267

1875

2268

1876

/* Close the socket */

2269

int ret = close(sd);

1877

int ret = (int)TEMP_FAILURE_RETRY(close(sd));

2270

1878

if(ret == -1){

2271

1879

perror_plus("close");

2272

1880

}

2287

1895

}

2288

1896

2289

1897

int main(int argc, char *argv[]){

2290

mandos_context mc = { .server = NULL, .dh_bits = 0,

2291

.priority = "SECURE256:!CTYPE-X.509"

2292

":+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256",

2293

.current_server = NULL, .interfaces = NULL,

2294

.interfaces_size = 0 };

1898

mandos_context mc = { .server = NULL, .dh_bits = 1024,

1899

.priority = "SECURE256:!CTYPE-X.509:"

1900

"+CTYPE-OPENPGP", .current_server = NULL,

1901

.interfaces = NULL, .interfaces_size = 0 };

2295

1902

AvahiSServiceBrowser *sb = NULL;

2296

1903

error_t ret_errno;

2297

1904

int ret;

2306

1913

AvahiIfIndex if_index = AVAHI_IF_UNSPEC;

2307

1914

const char *seckey = PATHDIR "/" SECKEY;

2308

1915

const char *pubkey = PATHDIR "/" PUBKEY;

2309

const char *dh_params_file = NULL;

2310

1916

char *interfaces_hooks = NULL;

2311

1917

2312

1918

bool gnutls_initialized = false;

2365

1971

.doc = "Bit length of the prime number used in the"

2366

1972

" Diffie-Hellman key exchange",

2367

1973

.group = 2 },

2368

{ .name = "dh-params", .key = 134,

2369

.arg = "FILE",

2370

.doc = "PEM-encoded PKCS#3 file with pre-generated parameters"

2371

" for the Diffie-Hellman key exchange",

2372

.group = 2 },

2373

1974

{ .name = "priority", .key = 130,

2374

1975

.arg = "STRING",

2375

1976

.doc = "GnuTLS priority string for the TLS handshake",

2430

2031

}

2431

2032

mc.dh_bits = (typeof(mc.dh_bits))tmpmax;

2432

2033

break;

2433

case 134: /* --dh-params */

2434

dh_params_file = arg;

2435

break;

2436

2034

case 130: /* --priority */

2437

2035

mc.priority = arg;

2438

2036

break;

2494

2092

goto end;

2495

2093

}

2496

2094

}

2497

2095

2498

2096

{

2499

2097

/* Work around Debian bug #633582:

2500

2098

<http://bugs.debian.org/633582> */

2524

2122

}

2525

2123

}

2526

2124

}

2527

close(seckey_fd);

2125

TEMP_FAILURE_RETRY(close(seckey_fd));

2528

2126

}

2529

2127

}

2530

2128

2531

2129

if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){

2532

2130

int pubkey_fd = open(pubkey, O_RDONLY);

2533

2131

if(pubkey_fd == -1){

2545

2143

}

2546

2144

}

2547

2145

}

2548

close(pubkey_fd);

2549

}

2550

}

2551

2552

if(dh_params_file != NULL

2553

and strcmp(dh_params_file, PATHDIR "/dhparams.pem" ) == 0){

2554

int dhparams_fd = open(dh_params_file, O_RDONLY);

2555

if(dhparams_fd == -1){

2556

perror_plus("open");

2557

} else {

2558

ret = (int)TEMP_FAILURE_RETRY(fstat(dhparams_fd, &st));

2559

if(ret == -1){

2560

perror_plus("fstat");

2561

} else {

2562

if(S_ISREG(st.st_mode)

2563

and st.st_uid == 0 and st.st_gid == 0){

2564

ret = fchown(dhparams_fd, uid, gid);

2565

if(ret == -1){

2566

perror_plus("fchown");

2567

}

2568

}

2569

}

2570

close(dhparams_fd);

2571

}

2572

}

2573

2146

TEMP_FAILURE_RETRY(close(pubkey_fd));

2147

}

2148

}

2149

2574

2150

/* Lower privileges */

2575

2151

ret_errno = lower_privileges();

2576

2152

if(ret_errno != 0){

2750

2326

errno = bring_up_interface(interface, delay);

2751

2327

if(not interface_was_up){

2752

2328

if(errno != 0){

2753

fprintf_plus(stderr, "Failed to bring up interface \"%s\":"

2754

" %s\n", interface, strerror(errno));

2329

perror_plus("Failed to bring up interface");

2755

2330

} else {

2756

2331

errno = argz_add(&interfaces_to_take_down,

2757

2332

&interfaces_to_take_down_size,

2780

2355

goto end;

2781

2356

}

2782

2357

2783

ret = init_gnutls_global(pubkey, seckey, dh_params_file, &mc);

2358

ret = init_gnutls_global(pubkey, seckey, &mc);

2784

2359

if(ret == -1){

2785

2360

fprintf_plus(stderr, "init_gnutls_global failed\n");

2786

2361

exitcode = EX_UNAVAILABLE;

3046

2621

/* Removes the GPGME temp directory and all files inside */

3047

2622

if(tempdir != NULL){

3048

2623

struct dirent **direntries = NULL;

3049

int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY

3050

| O_NOFOLLOW

3051

| O_DIRECTORY

3052

| O_PATH));

2624

int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |

2625

O_NOFOLLOW));

3053

2626

if(tempdir_fd == -1){

3054

2627

perror_plus("open");

3055

2628

} else {

3086

2659

perror_plus("rmdir");

3087

2660

}

3088

2661

}

3089

close(tempdir_fd);

2662

TEMP_FAILURE_RETRY(close(tempdir_fd));

3090

2663

}

3091

2664

}

3092

2665

Older »