To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 741
- compare with another revision
- download diff
- download tarball
- view history from revision 741
- Committer: Teddy Hogeborn
- Date: 2015-01-25 00:02:51 UTC
- Revision ID: teddy@recompile.se-20150125000251-j2bw50gfq9smqyxe
mandos.xml (SEE ALSO): Update links.
Update link to GnuPG home page, change reference from TLS 1.1 to TLS
1.2, and change to latest RFC for using OpenPGP keys with TLS (and use
its correct title).
Update link to GnuPG home page, change reference from TLS 1.1 to TLS
1.2, and change to latest RFC for using OpenPGP keys with TLS (and use
its correct title).
- files added:
- debian/mandos-client.examples
- debian/upstream
- network-hooks.d
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2011 Teddy Hogeborn
13
* Copyright © 2008-2011 Björn Påhlsson
12
* Copyright © 2008-2014 Teddy Hogeborn
13
* Copyright © 2008-2014 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
33
#ifndef _LARGEFILE_SOURCE
34
34
#define _LARGEFILE_SOURCE
35
#endif
35
#endif /* not _LARGEFILE_SOURCE */
36
36
#ifndef _FILE_OFFSET_BITS
37
37
#define _FILE_OFFSET_BITS 64
38
#endif
38
#endif /* not _FILE_OFFSET_BITS */
39
39
40
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
41
42
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
43
stdout, ferror() */
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
47
strtof(), abort() */
55
55
opendir(), DIR */
56
56
#include <sys/stat.h> /* open(), S_ISREG */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
58
inet_pton(), connect(),
59
getnameinfo() */
60
#include <fcntl.h> /* open(), unlinkat() */
60
61
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
62
*/
62
63
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
64
strtoimax() */
64
#include <assert.h> /* assert() */
65
65
#include <errno.h> /* perror(), errno,
66
66
program_invocation_short_name */
67
67
#include <time.h> /* nanosleep(), time(), sleep() */
73
73
*/
74
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
75
75
getuid(), getgid(), seteuid(),
76
setgid(), pause() */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
76
setgid(), pause(), _exit(),
77
unlinkat() */
78
#include <arpa/inet.h> /* inet_pton(), htons() */
78
79
#include <iso646.h> /* not, or, and */
79
80
#include <argp.h> /* struct argp_option, error_t, struct
80
81
argp_state, struct argp,
87
88
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
88
89
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
89
90
WEXITSTATUS(), WTERMSIG() */
91
#include <grp.h> /* setgroups() */
92
#include <argz.h> /* argz_add_sep(), argz_next(),
93
argz_delete(), argz_append(),
94
argz_stringify(), argz_add(),
95
argz_count() */
96
#include <netdb.h> /* getnameinfo(), NI_NUMERICHOST,
97
EAI_SYSTEM, gai_strerror() */
90
98
91
99
#ifdef __linux__
92
100
#include <sys/klog.h> /* klogctl() */
134
142
static const char sys_class_net[] = "/sys/class/net";
135
143
char *connect_to = NULL;
136
144
const char *hookdir = HOOKDIR;
145
int hookdir_fd = -1;
146
uid_t uid = 65534;
147
gid_t gid = 65534;
137
148
138
149
/* Doubly linked list that need to be circularly linked when used */
139
150
typedef struct server{
140
151
const char *ip;
141
uint16_t port;
152
in_port_t port;
142
153
AvahiIfIndex if_index;
143
154
int af;
144
155
struct timespec last_seen;
148
159
149
160
/* Used for passing in values through the Avahi callback functions */
150
161
typedef struct {
151
AvahiSimplePoll *simple_poll;
152
162
AvahiServer *server;
153
163
gnutls_certificate_credentials_t cred;
154
164
unsigned int dh_bits;
156
166
const char *priority;
157
167
gpgme_ctx_t ctx;
158
168
server *current_server;
169
char *interfaces;
170
size_t interfaces_size;
159
171
} mandos_context;
160
172
161
/* global context so signal handler can reach it*/
162
mandos_context mc = { .simple_poll = NULL, .server = NULL,
163
.dh_bits = 1024, .priority = "SECURE256"
164
":!CTYPE-X.509:+CTYPE-OPENPGP",
165
.current_server = NULL };
173
/* global so signal handler can reach it*/
174
AvahiSimplePoll *simple_poll;
166
175
167
176
sig_atomic_t quit_now = 0;
168
177
int signal_received = 0;
169
178
170
179
/* Function to use when printing errors */
171
180
void perror_plus(const char *print_text){
181
int e = errno;
172
182
fprintf(stderr, "Mandos plugin %s: ",
173
183
program_invocation_short_name);
184
errno = e;
174
185
perror(print_text);
175
186
}
176
187
188
__attribute__((format (gnu_printf, 2, 3), nonnull))
189
int fprintf_plus(FILE *stream, const char *format, ...){
190
va_list ap;
191
va_start (ap, format);
192
193
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
194
program_invocation_short_name));
195
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
196
}
197
177
198
/*
178
199
* Make additional room in "buffer" for at least BUFFER_SIZE more
179
200
* bytes. "buffer_capacity" is how much is currently allocated,
180
201
* "buffer_length" is how much is already used.
181
202
*/
203
__attribute__((nonnull, warn_unused_result))
182
204
size_t incbuffer(char **buffer, size_t buffer_length,
183
205
size_t buffer_capacity){
184
206
if(buffer_length + BUFFER_SIZE > buffer_capacity){
185
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
186
if(buffer == NULL){
207
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
208
if(new_buf == NULL){
209
int old_errno = errno;
210
free(*buffer);
211
errno = old_errno;
212
*buffer = NULL;
187
213
return 0;
188
214
}
215
*buffer = new_buf;
189
216
buffer_capacity += BUFFER_SIZE;
190
217
}
191
218
return buffer_capacity;
192
219
}
193
220
194
221
/* Add server to set of servers to retry periodically */
195
int add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
196
int af){
222
__attribute__((nonnull, warn_unused_result))
223
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
224
int af, server **current_server){
197
225
int ret;
198
226
server *new_server = malloc(sizeof(server));
199
227
if(new_server == NULL){
200
228
perror_plus("malloc");
201
return -1;
229
return false;
202
230
}
203
231
*new_server = (server){ .ip = strdup(ip),
204
232
.port = port,
206
234
.af = af };
207
235
if(new_server->ip == NULL){
208
236
perror_plus("strdup");
209
return -1;
237
free(new_server);
238
return false;
239
}
240
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
241
if(ret == -1){
242
perror_plus("clock_gettime");
243
#ifdef __GNUC__
244
#pragma GCC diagnostic push
245
#pragma GCC diagnostic ignored "-Wcast-qual"
246
#endif
247
free((char *)(new_server->ip));
248
#ifdef __GNUC__
249
#pragma GCC diagnostic pop
250
#endif
251
free(new_server);
252
return false;
210
253
}
211
254
/* Special case of first server */
212
if (mc.current_server == NULL){
255
if(*current_server == NULL){
213
256
new_server->next = new_server;
214
257
new_server->prev = new_server;
215
mc.current_server = new_server;
216
/* Place the new server last in the list */
258
*current_server = new_server;
217
259
} else {
218
new_server->next = mc.current_server;
219
new_server->prev = mc.current_server->prev;
260
/* Place the new server last in the list */
261
new_server->next = *current_server;
262
new_server->prev = (*current_server)->prev;
220
263
new_server->prev->next = new_server;
221
mc.current_server->prev = new_server;
222
}
223
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
224
if(ret == -1){
225
perror_plus("clock_gettime");
226
return -1;
227
}
228
return 0;
264
(*current_server)->prev = new_server;
265
}
266
return true;
229
267
}
230
268
231
269
/*
232
270
* Initialize GPGME.
233
271
*/
234
static bool init_gpgme(const char *seckey, const char *pubkey,
235
const char *tempdir){
272
__attribute__((nonnull, warn_unused_result))
273
static bool init_gpgme(const char * const seckey,
274
const char * const pubkey,
275
const char * const tempdir,
276
mandos_context *mc){
236
277
gpgme_error_t rc;
237
278
gpgme_engine_info_t engine_info;
238
279
239
240
280
/*
241
281
* Helper function to insert pub and seckey to the engine keyring.
242
282
*/
243
bool import_key(const char *filename){
283
bool import_key(const char * const filename){
244
284
int ret;
245
285
int fd;
246
286
gpgme_data_t pgp_data;
253
293
254
294
rc = gpgme_data_new_from_fd(&pgp_data, fd);
255
295
if(rc != GPG_ERR_NO_ERROR){
256
fprintf(stderr, "Mandos plugin mandos-client: "
257
"bad gpgme_data_new_from_fd: %s: %s\n",
258
gpgme_strsource(rc), gpgme_strerror(rc));
296
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
297
gpgme_strsource(rc), gpgme_strerror(rc));
259
298
return false;
260
299
}
261
300
262
rc = gpgme_op_import(mc.ctx, pgp_data);
301
rc = gpgme_op_import(mc->ctx, pgp_data);
263
302
if(rc != GPG_ERR_NO_ERROR){
264
fprintf(stderr, "Mandos plugin mandos-client: "
265
"bad gpgme_op_import: %s: %s\n",
266
gpgme_strsource(rc), gpgme_strerror(rc));
303
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
304
gpgme_strsource(rc), gpgme_strerror(rc));
267
305
return false;
268
306
}
269
307
276
314
}
277
315
278
316
if(debug){
279
fprintf(stderr, "Mandos plugin mandos-client: "
280
"Initializing GPGME\n");
317
fprintf_plus(stderr, "Initializing GPGME\n");
281
318
}
282
319
283
320
/* Init GPGME */
284
321
gpgme_check_version(NULL);
285
322
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
286
323
if(rc != GPG_ERR_NO_ERROR){
287
fprintf(stderr, "Mandos plugin mandos-client: "
288
"bad gpgme_engine_check_version: %s: %s\n",
289
gpgme_strsource(rc), gpgme_strerror(rc));
324
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
325
gpgme_strsource(rc), gpgme_strerror(rc));
290
326
return false;
291
327
}
292
328
293
329
/* Set GPGME home directory for the OpenPGP engine only */
294
330
rc = gpgme_get_engine_info(&engine_info);
295
331
if(rc != GPG_ERR_NO_ERROR){
296
fprintf(stderr, "Mandos plugin mandos-client: "
297
"bad gpgme_get_engine_info: %s: %s\n",
298
gpgme_strsource(rc), gpgme_strerror(rc));
332
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
333
gpgme_strsource(rc), gpgme_strerror(rc));
299
334
return false;
300
335
}
301
336
while(engine_info != NULL){
307
342
engine_info = engine_info->next;
308
343
}
309
344
if(engine_info == NULL){
310
fprintf(stderr, "Mandos plugin mandos-client: "
311
"Could not set GPGME home dir to %s\n", tempdir);
345
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
346
tempdir);
312
347
return false;
313
348
}
314
349
315
350
/* Create new GPGME "context" */
316
rc = gpgme_new(&(mc.ctx));
351
rc = gpgme_new(&(mc->ctx));
317
352
if(rc != GPG_ERR_NO_ERROR){
318
fprintf(stderr, "Mandos plugin mandos-client: "
319
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
320
gpgme_strerror(rc));
353
fprintf_plus(stderr, "Mandos plugin mandos-client: "
354
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
355
gpgme_strerror(rc));
321
356
return false;
322
357
}
323
358
332
367
* Decrypt OpenPGP data.
333
368
* Returns -1 on error
334
369
*/
370
__attribute__((nonnull, warn_unused_result))
335
371
static ssize_t pgp_packet_decrypt(const char *cryptotext,
336
372
size_t crypto_size,
337
char **plaintext){
373
char **plaintext,
374
mandos_context *mc){
338
375
gpgme_data_t dh_crypto, dh_plain;
339
376
gpgme_error_t rc;
340
377
ssize_t ret;
342
379
ssize_t plaintext_length = 0;
343
380
344
381
if(debug){
345
fprintf(stderr, "Mandos plugin mandos-client: "
346
"Trying to decrypt OpenPGP data\n");
382
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
347
383
}
348
384
349
385
/* Create new GPGME data buffer from memory cryptotext */
350
386
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
351
387
0);
352
388
if(rc != GPG_ERR_NO_ERROR){
353
fprintf(stderr, "Mandos plugin mandos-client: "
354
"bad gpgme_data_new_from_mem: %s: %s\n",
355
gpgme_strsource(rc), gpgme_strerror(rc));
389
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
390
gpgme_strsource(rc), gpgme_strerror(rc));
356
391
return -1;
357
392
}
358
393
359
394
/* Create new empty GPGME data buffer for the plaintext */
360
395
rc = gpgme_data_new(&dh_plain);
361
396
if(rc != GPG_ERR_NO_ERROR){
362
fprintf(stderr, "Mandos plugin mandos-client: "
363
"bad gpgme_data_new: %s: %s\n",
364
gpgme_strsource(rc), gpgme_strerror(rc));
397
fprintf_plus(stderr, "Mandos plugin mandos-client: "
398
"bad gpgme_data_new: %s: %s\n",
399
gpgme_strsource(rc), gpgme_strerror(rc));
365
400
gpgme_data_release(dh_crypto);
366
401
return -1;
367
402
}
368
403
369
404
/* Decrypt data from the cryptotext data buffer to the plaintext
370
405
data buffer */
371
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
406
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
372
407
if(rc != GPG_ERR_NO_ERROR){
373
fprintf(stderr, "Mandos plugin mandos-client: "
374
"bad gpgme_op_decrypt: %s: %s\n",
375
gpgme_strsource(rc), gpgme_strerror(rc));
408
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
409
gpgme_strsource(rc), gpgme_strerror(rc));
376
410
plaintext_length = -1;
377
411
if(debug){
378
412
gpgme_decrypt_result_t result;
379
result = gpgme_op_decrypt_result(mc.ctx);
413
result = gpgme_op_decrypt_result(mc->ctx);
380
414
if(result == NULL){
381
fprintf(stderr, "Mandos plugin mandos-client: "
382
"gpgme_op_decrypt_result failed\n");
415
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
383
416
} else {
384
fprintf(stderr, "Mandos plugin mandos-client: "
385
"Unsupported algorithm: %s\n",
386
result->unsupported_algorithm);
387
fprintf(stderr, "Mandos plugin mandos-client: "
388
"Wrong key usage: %u\n",
389
result->wrong_key_usage);
417
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
418
result->unsupported_algorithm);
419
fprintf_plus(stderr, "Wrong key usage: %u\n",
420
result->wrong_key_usage);
390
421
if(result->file_name != NULL){
391
fprintf(stderr, "Mandos plugin mandos-client: "
392
"File name: %s\n", result->file_name);
422
fprintf_plus(stderr, "File name: %s\n", result->file_name);
393
423
}
394
424
gpgme_recipient_t recipient;
395
425
recipient = result->recipients;
396
426
while(recipient != NULL){
397
fprintf(stderr, "Mandos plugin mandos-client: "
398
"Public key algorithm: %s\n",
399
gpgme_pubkey_algo_name(recipient->pubkey_algo));
400
fprintf(stderr, "Mandos plugin mandos-client: "
401
"Key ID: %s\n", recipient->keyid);
402
fprintf(stderr, "Mandos plugin mandos-client: "
403
"Secret key available: %s\n",
404
recipient->status == GPG_ERR_NO_SECKEY
405
? "No" : "Yes");
427
fprintf_plus(stderr, "Public key algorithm: %s\n",
428
gpgme_pubkey_algo_name
429
(recipient->pubkey_algo));
430
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
431
fprintf_plus(stderr, "Secret key available: %s\n",
432
recipient->status == GPG_ERR_NO_SECKEY
433
? "No" : "Yes");
406
434
recipient = recipient->next;
407
435
}
408
436
}
411
439
}
412
440
413
441
if(debug){
414
fprintf(stderr, "Mandos plugin mandos-client: "
415
"Decryption of OpenPGP data succeeded\n");
442
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
416
443
}
417
444
418
445
/* Seek back to the beginning of the GPGME plaintext data buffer */
449
476
}
450
477
451
478
if(debug){
452
fprintf(stderr, "Mandos plugin mandos-client: "
453
"Decrypted password is: ");
479
fprintf_plus(stderr, "Decrypted password is: ");
454
480
for(ssize_t i = 0; i < plaintext_length; i++){
455
481
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
456
482
}
467
493
return plaintext_length;
468
494
}
469
495
470
static const char * safer_gnutls_strerror(int value){
471
const char *ret = gnutls_strerror(value); /* Spurious warning from
472
-Wunreachable-code */
496
__attribute__((warn_unused_result))
497
static const char *safer_gnutls_strerror(int value){
498
const char *ret = gnutls_strerror(value);
473
499
if(ret == NULL)
474
500
ret = "(unknown)";
475
501
return ret;
476
502
}
477
503
478
504
/* GnuTLS log function callback */
505
__attribute__((nonnull))
479
506
static void debuggnutls(__attribute__((unused)) int level,
480
507
const char* string){
481
fprintf(stderr, "Mandos plugin mandos-client: GnuTLS: %s", string);
508
fprintf_plus(stderr, "GnuTLS: %s", string);
482
509
}
483
510
511
__attribute__((nonnull, warn_unused_result))
484
512
static int init_gnutls_global(const char *pubkeyfilename,
485
const char *seckeyfilename){
513
const char *seckeyfilename,
514
mandos_context *mc){
486
515
int ret;
487
516
488
517
if(debug){
489
fprintf(stderr, "Mandos plugin mandos-client: "
490
"Initializing GnuTLS\n");
518
fprintf_plus(stderr, "Initializing GnuTLS\n");
491
519
}
492
520
493
521
ret = gnutls_global_init();
494
522
if(ret != GNUTLS_E_SUCCESS){
495
fprintf(stderr, "Mandos plugin mandos-client: "
496
"GnuTLS global_init: %s\n", safer_gnutls_strerror(ret));
523
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
524
safer_gnutls_strerror(ret));
497
525
return -1;
498
526
}
499
527
506
534
}
507
535
508
536
/* OpenPGP credentials */
509
ret = gnutls_certificate_allocate_credentials(&mc.cred);
537
ret = gnutls_certificate_allocate_credentials(&mc->cred);
510
538
if(ret != GNUTLS_E_SUCCESS){
511
fprintf(stderr, "Mandos plugin mandos-client: "
512
"GnuTLS memory error: %s\n", safer_gnutls_strerror(ret));
539
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
540
safer_gnutls_strerror(ret));
513
541
gnutls_global_deinit();
514
542
return -1;
515
543
}
516
544
517
545
if(debug){
518
fprintf(stderr, "Mandos plugin mandos-client: "
519
"Attempting to use OpenPGP public key %s and"
520
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
521
seckeyfilename);
546
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
547
" secret key %s as GnuTLS credentials\n",
548
pubkeyfilename,
549
seckeyfilename);
522
550
}
523
551
524
552
ret = gnutls_certificate_set_openpgp_key_file
525
(mc.cred, pubkeyfilename, seckeyfilename,
553
(mc->cred, pubkeyfilename, seckeyfilename,
526
554
GNUTLS_OPENPGP_FMT_BASE64);
527
555
if(ret != GNUTLS_E_SUCCESS){
528
fprintf(stderr,
529
"Mandos plugin mandos-client: "
530
"Error[%d] while reading the OpenPGP key pair ('%s',"
531
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
532
fprintf(stderr, "Mandos plugin mandos-client: "
533
"The GnuTLS error is: %s\n", safer_gnutls_strerror(ret));
556
fprintf_plus(stderr,
557
"Error[%d] while reading the OpenPGP key pair ('%s',"
558
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
559
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
560
safer_gnutls_strerror(ret));
534
561
goto globalfail;
535
562
}
536
563
537
564
/* GnuTLS server initialization */
538
ret = gnutls_dh_params_init(&mc.dh_params);
565
ret = gnutls_dh_params_init(&mc->dh_params);
539
566
if(ret != GNUTLS_E_SUCCESS){
540
fprintf(stderr, "Mandos plugin mandos-client: "
541
"Error in GnuTLS DH parameter initialization:"
542
" %s\n", safer_gnutls_strerror(ret));
567
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
568
" initialization: %s\n",
569
safer_gnutls_strerror(ret));
543
570
goto globalfail;
544
571
}
545
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
572
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
546
573
if(ret != GNUTLS_E_SUCCESS){
547
fprintf(stderr, "Mandos plugin mandos-client: "
548
"Error in GnuTLS prime generation: %s\n",
549
safer_gnutls_strerror(ret));
574
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
575
safer_gnutls_strerror(ret));
550
576
goto globalfail;
551
577
}
552
578
553
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
579
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
554
580
555
581
return 0;
556
582
557
583
globalfail:
558
584
559
gnutls_certificate_free_credentials(mc.cred);
585
gnutls_certificate_free_credentials(mc->cred);
560
586
gnutls_global_deinit();
561
gnutls_dh_params_deinit(mc.dh_params);
587
gnutls_dh_params_deinit(mc->dh_params);
562
588
return -1;
563
589
}
564
590
565
static int init_gnutls_session(gnutls_session_t *session){
591
__attribute__((nonnull, warn_unused_result))
592
static int init_gnutls_session(gnutls_session_t *session,
593
mandos_context *mc){
566
594
int ret;
567
595
/* GnuTLS session creation */
568
596
do {
572
600
}
573
601
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
574
602
if(ret != GNUTLS_E_SUCCESS){
575
fprintf(stderr, "Mandos plugin mandos-client: "
576
"Error in GnuTLS session initialization: %s\n",
577
safer_gnutls_strerror(ret));
603
fprintf_plus(stderr,
604
"Error in GnuTLS session initialization: %s\n",
605
safer_gnutls_strerror(ret));
578
606
}
579
607
580
608
{
581
609
const char *err;
582
610
do {
583
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
611
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
584
612
if(quit_now){
585
613
gnutls_deinit(*session);
586
614
return -1;
587
615
}
588
616
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
589
617
if(ret != GNUTLS_E_SUCCESS){
590
fprintf(stderr, "Mandos plugin mandos-client: "
591
"Syntax error at: %s\n", err);
592
fprintf(stderr, "Mandos plugin mandos-client: "
593
"GnuTLS error: %s\n", safer_gnutls_strerror(ret));
618
fprintf_plus(stderr, "Syntax error at: %s\n", err);
619
fprintf_plus(stderr, "GnuTLS error: %s\n",
620
safer_gnutls_strerror(ret));
594
621
gnutls_deinit(*session);
595
622
return -1;
596
623
}
598
625
599
626
do {
600
627
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
601
mc.cred);
628
mc->cred);
602
629
if(quit_now){
603
630
gnutls_deinit(*session);
604
631
return -1;
605
632
}
606
633
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
607
634
if(ret != GNUTLS_E_SUCCESS){
608
fprintf(stderr, "Mandos plugin mandos-client: "
609
"Error setting GnuTLS credentials: %s\n",
610
safer_gnutls_strerror(ret));
635
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
636
safer_gnutls_strerror(ret));
611
637
gnutls_deinit(*session);
612
638
return -1;
613
639
}
615
641
/* ignore client certificate if any. */
616
642
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
617
643
618
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
644
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
619
645
620
646
return 0;
621
647
}
625
651
__attribute__((unused)) const char *txt){}
626
652
627
653
/* Called when a Mandos server is found */
628
static int start_mandos_communication(const char *ip, uint16_t port,
654
__attribute__((nonnull, warn_unused_result))
655
static int start_mandos_communication(const char *ip, in_port_t port,
629
656
AvahiIfIndex if_index,
630
int af){
657
int af, mandos_context *mc){
631
658
int ret, tcp_sd = -1;
632
659
ssize_t sret;
633
union {
634
struct sockaddr_in in;
635
struct sockaddr_in6 in6;
636
} to;
660
struct sockaddr_storage to;
637
661
char *buffer = NULL;
638
662
char *decrypted_buffer = NULL;
639
663
size_t buffer_length = 0;
658
682
pf = PF_INET;
659
683
break;
660
684
default:
661
fprintf(stderr, "Mandos plugin mandos-client: "
662
"Bad address family: %d\n", af);
685
fprintf_plus(stderr, "Bad address family: %d\n", af);
663
686
errno = EINVAL;
664
687
return -1;
665
688
}
666
689
667
ret = init_gnutls_session(&session);
690
/* If the interface is specified and we have a list of interfaces */
691
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
692
/* Check if the interface is one of the interfaces we are using */
693
bool match = false;
694
{
695
char *interface = NULL;
696
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
697
interface))){
698
if(if_nametoindex(interface) == (unsigned int)if_index){
699
match = true;
700
break;
701
}
702
}
703
}
704
if(not match){
705
/* This interface does not match any in the list, so we don't
706
connect to the server */
707
if(debug){
708
char interface[IF_NAMESIZE];
709
if(if_indextoname((unsigned int)if_index, interface) == NULL){
710
perror_plus("if_indextoname");
711
} else {
712
fprintf_plus(stderr, "Skipping server on non-used interface"
713
" \"%s\"\n",
714
if_indextoname((unsigned int)if_index,
715
interface));
716
}
717
}
718
return -1;
719
}
720
}
721
722
ret = init_gnutls_session(&session, mc);
668
723
if(ret != 0){
669
724
return -1;
670
725
}
671
726
672
727
if(debug){
673
fprintf(stderr, "Mandos plugin mandos-client: "
674
"Setting up a TCP connection to %s, port %" PRIu16
675
"\n", ip, port);
728
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
729
PRIuMAX "\n", ip, (uintmax_t)port);
676
730
}
677
731
678
732
tcp_sd = socket(pf, SOCK_STREAM, 0);
690
744
691
745
memset(&to, 0, sizeof(to));
692
746
if(af == AF_INET6){
693
to.in6.sin6_family = (sa_family_t)af;
694
ret = inet_pton(af, ip, &to.in6.sin6_addr);
747
((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;
748
ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);
695
749
} else { /* IPv4 */
696
to.in.sin_family = (sa_family_t)af;
697
ret = inet_pton(af, ip, &to.in.sin_addr);
750
((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;
751
ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);
698
752
}
699
753
if(ret < 0 ){
700
754
int e = errno;
704
758
}
705
759
if(ret == 0){
706
760
int e = errno;
707
fprintf(stderr, "Mandos plugin mandos-client: "
708
"Bad address: %s\n", ip);
761
fprintf_plus(stderr, "Bad address: %s\n", ip);
709
762
errno = e;
710
763
goto mandos_end;
711
764
}
712
765
if(af == AF_INET6){
713
to.in6.sin6_port = htons(port); /* Spurious warnings from
714
-Wconversion and
715
-Wunreachable-code */
716
717
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
718
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
719
-Wunreachable-code*/
766
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
767
if(IN6_IS_ADDR_LINKLOCAL
768
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
720
769
if(if_index == AVAHI_IF_UNSPEC){
721
fprintf(stderr, "Mandos plugin mandos-client: "
722
"An IPv6 link-local address is incomplete"
723
" without a network interface\n");
770
fprintf_plus(stderr, "An IPv6 link-local address is"
771
" incomplete without a network interface\n");
724
772
errno = EINVAL;
725
773
goto mandos_end;
726
774
}
727
775
/* Set the network interface number as scope */
728
to.in6.sin6_scope_id = (uint32_t)if_index;
776
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
729
777
}
730
778
} else {
731
to.in.sin_port = htons(port); /* Spurious warnings from
732
-Wconversion and
733
-Wunreachable-code */
779
((struct sockaddr_in *)&to)->sin_port = htons(port);
734
780
}
735
781
736
782
if(quit_now){
744
790
if(if_indextoname((unsigned int)if_index, interface) == NULL){
745
791
perror_plus("if_indextoname");
746
792
} else {
747
fprintf(stderr, "Mandos plugin mandos-client: "
748
"Connection to: %s%%%s, port %" PRIu16 "\n",
749
ip, interface, port);
793
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
794
"\n", ip, interface, (uintmax_t)port);
750
795
}
751
796
} else {
752
fprintf(stderr, "Mandos plugin mandos-client: "
753
"Connection to: %s, port %" PRIu16 "\n", ip, port);
797
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
798
ip, (uintmax_t)port);
754
799
}
755
800
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
756
801
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
757
const char *pcret;
758
802
if(af == AF_INET6){
759
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
760
sizeof(addrstr));
803
ret = getnameinfo((struct sockaddr *)&to,
804
sizeof(struct sockaddr_in6),
805
addrstr, sizeof(addrstr), NULL, 0,
806
NI_NUMERICHOST);
761
807
} else {
762
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
763
sizeof(addrstr));
808
ret = getnameinfo((struct sockaddr *)&to,
809
sizeof(struct sockaddr_in),
810
addrstr, sizeof(addrstr), NULL, 0,
811
NI_NUMERICHOST);
764
812
}
765
if(pcret == NULL){
766
perror_plus("inet_ntop");
767
} else {
768
if(strcmp(addrstr, ip) != 0){
769
fprintf(stderr, "Mandos plugin mandos-client: "
770
"Canonical address form: %s\n", addrstr);
771
}
813
if(ret == EAI_SYSTEM){
814
perror_plus("getnameinfo");
815
} else if(ret != 0) {
816
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
817
} else if(strcmp(addrstr, ip) != 0){
818
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
772
819
}
773
820
}
774
821
778
825
}
779
826
780
827
if(af == AF_INET6){
781
ret = connect(tcp_sd, &to.in6, sizeof(to));
828
ret = connect(tcp_sd, (struct sockaddr *)&to,
829
sizeof(struct sockaddr_in6));
782
830
} else {
783
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
831
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
832
sizeof(struct sockaddr_in));
784
833
}
785
834
if(ret < 0){
786
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
835
if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
787
836
int e = errno;
788
837
perror_plus("connect");
789
838
errno = e;
827
876
}
828
877
829
878
if(debug){
830
fprintf(stderr, "Mandos plugin mandos-client: "
831
"Establishing TLS session with %s\n", ip);
879
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
832
880
}
833
881
834
882
if(quit_now){
836
884
goto mandos_end;
837
885
}
838
886
839
/* Spurious warning from -Wint-to-pointer-cast */
840
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
887
/* This casting via intptr_t is to eliminate warning about casting
888
an int to a pointer type. This is exactly how the GnuTLS Guile
889
function "set-session-transport-fd!" does it. */
890
gnutls_transport_set_ptr(session,
891
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
841
892
842
893
if(quit_now){
843
894
errno = EINTR;
854
905
855
906
if(ret != GNUTLS_E_SUCCESS){
856
907
if(debug){
857
fprintf(stderr, "Mandos plugin mandos-client: "
858
"*** GnuTLS Handshake failed ***\n");
908
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
859
909
gnutls_perror(ret);
860
910
}
861
911
errno = EPROTO;
865
915
/* Read OpenPGP packet that contains the wanted password */
866
916
867
917
if(debug){
868
fprintf(stderr, "Mandos plugin mandos-client: "
869
"Retrieving OpenPGP encrypted password from %s\n", ip);
918
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
919
" %s\n", ip);
870
920
}
871
921
872
922
while(true){
910
960
}
911
961
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
912
962
if(ret < 0){
913
fprintf(stderr, "Mandos plugin mandos-client: "
914
"*** GnuTLS Re-handshake failed ***\n");
963
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
964
"***\n");
915
965
gnutls_perror(ret);
916
966
errno = EPROTO;
917
967
goto mandos_end;
918
968
}
919
969
break;
920
970
default:
921
fprintf(stderr, "Mandos plugin mandos-client: "
922
"Unknown error while reading data from"
923
" encrypted session with Mandos server\n");
971
fprintf_plus(stderr, "Unknown error while reading data from"
972
" encrypted session with Mandos server\n");
924
973
gnutls_bye(session, GNUTLS_SHUT_RDWR);
925
974
errno = EIO;
926
975
goto mandos_end;
931
980
}
932
981
933
982
if(debug){
934
fprintf(stderr, "Mandos plugin mandos-client: "
935
"Closing TLS session\n");
983
fprintf_plus(stderr, "Closing TLS session\n");
936
984
}
937
985
938
986
if(quit_now){
951
999
if(buffer_length > 0){
952
1000
ssize_t decrypted_buffer_size;
953
1001
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
954
&decrypted_buffer);
1002
&decrypted_buffer, mc);
955
1003
if(decrypted_buffer_size >= 0){
956
1004
957
1005
written = 0;
967
1015
if(ret == 0 and ferror(stdout)){
968
1016
int e = errno;
969
1017
if(debug){
970
fprintf(stderr, "Mandos plugin mandos-client: "
971
"Error writing encrypted data: %s\n",
972
strerror(errno));
1018
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
1019
strerror(errno));
973
1020
}
974
1021
errno = e;
975
1022
goto mandos_end;
1006
1053
return retval;
1007
1054
}
1008
1055
1056
__attribute__((nonnull))
1009
1057
static void resolve_callback(AvahiSServiceResolver *r,
1010
1058
AvahiIfIndex interface,
1011
1059
AvahiProtocol proto,
1019
1067
AVAHI_GCC_UNUSED AvahiStringList *txt,
1020
1068
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1021
1069
flags,
1022
AVAHI_GCC_UNUSED void* userdata){
1023
assert(r);
1070
void *mc){
1071
if(r == NULL){
1072
return;
1073
}
1024
1074
1025
1075
/* Called whenever a service has been resolved successfully or
1026
1076
timed out */
1027
1077
1028
1078
if(quit_now){
1079
avahi_s_service_resolver_free(r);
1029
1080
return;
1030
1081
}
1031
1082
1032
1083
switch(event){
1033
1084
default:
1034
1085
case AVAHI_RESOLVER_FAILURE:
1035
fprintf(stderr, "Mandos plugin mandos-client: "
1036
"(Avahi Resolver) Failed to resolve service '%s'"
1037
" of type '%s' in domain '%s': %s\n", name, type, domain,
1038
avahi_strerror(avahi_server_errno(mc.server)));
1086
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1087
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1088
domain,
1089
avahi_strerror(avahi_server_errno
1090
(((mandos_context*)mc)->server)));
1039
1091
break;
1040
1092
1041
1093
case AVAHI_RESOLVER_FOUND:
1043
1095
char ip[AVAHI_ADDRESS_STR_MAX];
1044
1096
avahi_address_snprint(ip, sizeof(ip), address);
1045
1097
if(debug){
1046
fprintf(stderr, "Mandos plugin mandos-client: "
1047
"Mandos server \"%s\" found on %s (%s, %"
1048
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
1049
ip, (intmax_t)interface, port);
1098
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1099
PRIdMAX ") on port %" PRIu16 "\n", name,
1100
host_name, ip, (intmax_t)interface, port);
1050
1101
}
1051
int ret = start_mandos_communication(ip, port, interface,
1052
avahi_proto_to_af(proto));
1102
int ret = start_mandos_communication(ip, (in_port_t)port,
1103
interface,
1104
avahi_proto_to_af(proto),
1105
mc);
1053
1106
if(ret == 0){
1054
avahi_simple_poll_quit(mc.simple_poll);
1107
avahi_simple_poll_quit(simple_poll);
1055
1108
} else {
1056
ret = add_server(ip, port, interface,
1057
avahi_proto_to_af(proto));
1109
if(not add_server(ip, (in_port_t)port, interface,
1110
avahi_proto_to_af(proto),
1111
&((mandos_context*)mc)->current_server)){
1112
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1113
" list\n", name);
1114
}
1058
1115
}
1059
1116
}
1060
1117
}
1070
1127
const char *domain,
1071
1128
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1072
1129
flags,
1073
AVAHI_GCC_UNUSED void* userdata){
1074
assert(b);
1130
void *mc){
1131
if(b == NULL){
1132
return;
1133
}
1075
1134
1076
1135
/* Called whenever a new services becomes available on the LAN or
1077
1136
is removed from the LAN */
1084
1143
default:
1085
1144
case AVAHI_BROWSER_FAILURE:
1086
1145
1087
fprintf(stderr, "Mandos plugin mandos-client: "
1088
"(Avahi browser) %s\n",
1089
avahi_strerror(avahi_server_errno(mc.server)));
1090
avahi_simple_poll_quit(mc.simple_poll);
1146
fprintf_plus(stderr, "(Avahi browser) %s\n",
1147
avahi_strerror(avahi_server_errno
1148
(((mandos_context*)mc)->server)));
1149
avahi_simple_poll_quit(simple_poll);
1091
1150
return;
1092
1151
1093
1152
case AVAHI_BROWSER_NEW:
1096
1155
the callback function is called the Avahi server will free the
1097
1156
resolver for us. */
1098
1157
1099
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1100
name, type, domain, protocol, 0,
1101
resolve_callback, NULL) == NULL)
1102
fprintf(stderr, "Mandos plugin mandos-client: "
1103
"Avahi: Failed to resolve service '%s': %s\n",
1104
name, avahi_strerror(avahi_server_errno(mc.server)));
1158
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1159
interface, protocol, name, type,
1160
domain, protocol, 0,
1161
resolve_callback, mc) == NULL)
1162
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1163
" %s\n", name,
1164
avahi_strerror(avahi_server_errno
1165
(((mandos_context*)mc)->server)));
1105
1166
break;
1106
1167
1107
1168
case AVAHI_BROWSER_REMOVE:
1110
1171
case AVAHI_BROWSER_ALL_FOR_NOW:
1111
1172
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1112
1173
if(debug){
1113
fprintf(stderr, "Mandos plugin mandos-client: "
1114
"No Mandos server found, still searching...\n");
1174
fprintf_plus(stderr, "No Mandos server found, still"
1175
" searching...\n");
1115
1176
}
1116
1177
break;
1117
1178
}
1126
1187
signal_received = sig;
1127
1188
int old_errno = errno;
1128
1189
/* set main loop to exit */
1129
if(mc.simple_poll != NULL){
1130
avahi_simple_poll_quit(mc.simple_poll);
1190
if(simple_poll != NULL){
1191
avahi_simple_poll_quit(simple_poll);
1131
1192
}
1132
1193
errno = old_errno;
1133
1194
}
1134
1195
1196
__attribute__((nonnull, warn_unused_result))
1135
1197
bool get_flags(const char *ifname, struct ifreq *ifr){
1136
1198
int ret;
1199
error_t ret_errno;
1137
1200
1138
1201
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1139
1202
if(s < 0){
1203
ret_errno = errno;
1140
1204
perror_plus("socket");
1205
errno = ret_errno;
1141
1206
return false;
1142
1207
}
1143
1208
strcpy(ifr->ifr_name, ifname);
1144
1209
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1145
1210
if(ret == -1){
1146
1211
if(debug){
1212
ret_errno = errno;
1147
1213
perror_plus("ioctl SIOCGIFFLAGS");
1214
errno = ret_errno;
1148
1215
}
1149
1216
return false;
1150
1217
}
1151
1218
return true;
1152
1219
}
1153
1220
1221
__attribute__((nonnull, warn_unused_result))
1154
1222
bool good_flags(const char *ifname, const struct ifreq *ifr){
1155
1223
1156
1224
/* Reject the loopback device */
1157
1225
if(ifr->ifr_flags & IFF_LOOPBACK){
1158
1226
if(debug){
1159
fprintf(stderr, "Mandos plugin mandos-client: "
1160
"Rejecting loopback interface \"%s\"\n", ifname);
1227
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1228
ifname);
1161
1229
}
1162
1230
return false;
1163
1231
}
1164
1232
/* Accept point-to-point devices only if connect_to is specified */
1165
1233
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1166
1234
if(debug){
1167
fprintf(stderr, "Mandos plugin mandos-client: "
1168
"Accepting point-to-point interface \"%s\"\n", ifname);
1235
fprintf_plus(stderr, "Accepting point-to-point interface"
1236
" \"%s\"\n", ifname);
1169
1237
}
1170
1238
return true;
1171
1239
}
1172
1240
/* Otherwise, reject non-broadcast-capable devices */
1173
1241
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1174
1242
if(debug){
1175
fprintf(stderr, "Mandos plugin mandos-client: "
1176
"Rejecting non-broadcast interface \"%s\"\n", ifname);
1243
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1244
" \"%s\"\n", ifname);
1177
1245
}
1178
1246
return false;
1179
1247
}
1180
1248
/* Reject non-ARP interfaces (including dummy interfaces) */
1181
1249
if(ifr->ifr_flags & IFF_NOARP){
1182
1250
if(debug){
1183
fprintf(stderr, "Mandos plugin mandos-client: "
1184
"Rejecting non-ARP interface \"%s\"\n", ifname);
1251
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1252
ifname);
1185
1253
}
1186
1254
return false;
1187
1255
}
1188
1256
1189
1257
/* Accept this device */
1190
1258
if(debug){
1191
fprintf(stderr, "Mandos plugin mandos-client: "
1192
"Interface \"%s\" is good\n", ifname);
1259
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1193
1260
}
1194
1261
return true;
1195
1262
}
1199
1266
* corresponds to an acceptable network device.
1200
1267
* (This function is passed to scandir(3) as a filter function.)
1201
1268
*/
1269
__attribute__((nonnull, warn_unused_result))
1202
1270
int good_interface(const struct dirent *if_entry){
1203
1271
if(if_entry->d_name[0] == '.'){
1204
1272
return 0;
1207
1275
struct ifreq ifr;
1208
1276
if(not get_flags(if_entry->d_name, &ifr)){
1209
1277
if(debug){
1210
fprintf(stderr, "Mandos plugin mandos-client: "
1211
"Failed to get flags for interface \"%s\"\n",
1212
if_entry->d_name);
1213
}
1214
return 0;
1215
}
1216
1217
if(not good_flags(if_entry->d_name, &ifr)){
1218
return 0;
1219
}
1220
return 1;
1221
}
1222
1223
/*
1224
* This function determines if a directory entry in /sys/class/net
1225
* corresponds to an acceptable network device which is up.
1226
* (This function is passed to scandir(3) as a filter function.)
1227
*/
1228
int up_interface(const struct dirent *if_entry){
1229
if(if_entry->d_name[0] == '.'){
1230
return 0;
1231
}
1232
1233
struct ifreq ifr;
1234
if(not get_flags(if_entry->d_name, &ifr)){
1235
if(debug){
1236
fprintf(stderr, "Mandos plugin mandos-client: "
1237
"Failed to get flags for interface \"%s\"\n",
1238
if_entry->d_name);
1239
}
1240
return 0;
1241
}
1242
1243
/* Reject down interfaces */
1244
if(not (ifr.ifr_flags & IFF_UP)){
1245
if(debug){
1246
fprintf(stderr, "Mandos plugin mandos-client: "
1247
"Rejecting down interface \"%s\"\n",
1248
if_entry->d_name);
1249
}
1250
return 0;
1251
}
1252
1253
/* Reject non-running interfaces */
1254
if(not (ifr.ifr_flags & IFF_RUNNING)){
1255
if(debug){
1256
fprintf(stderr, "Mandos plugin mandos-client: "
1257
"Rejecting non-running interface \"%s\"\n",
1258
if_entry->d_name);
1259
}
1260
return 0;
1261
}
1262
1263
if(not good_flags(if_entry->d_name, &ifr)){
1264
return 0;
1265
}
1266
return 1;
1267
}
1268
1278
fprintf_plus(stderr, "Failed to get flags for interface "
1279
"\"%s\"\n", if_entry->d_name);
1280
}
1281
return 0;
1282
}
1283
1284
if(not good_flags(if_entry->d_name, &ifr)){
1285
return 0;
1286
}
1287
return 1;
1288
}
1289
1290
/*
1291
* This function determines if a network interface is up.
1292
*/
1293
__attribute__((nonnull, warn_unused_result))
1294
bool interface_is_up(const char *interface){
1295
struct ifreq ifr;
1296
if(not get_flags(interface, &ifr)){
1297
if(debug){
1298
fprintf_plus(stderr, "Failed to get flags for interface "
1299
"\"%s\"\n", interface);
1300
}
1301
return false;
1302
}
1303
1304
return (bool)(ifr.ifr_flags & IFF_UP);
1305
}
1306
1307
/*
1308
* This function determines if a network interface is running
1309
*/
1310
__attribute__((nonnull, warn_unused_result))
1311
bool interface_is_running(const char *interface){
1312
struct ifreq ifr;
1313
if(not get_flags(interface, &ifr)){
1314
if(debug){
1315
fprintf_plus(stderr, "Failed to get flags for interface "
1316
"\"%s\"\n", interface);
1317
}
1318
return false;
1319
}
1320
1321
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1322
}
1323
1324
__attribute__((nonnull, pure, warn_unused_result))
1269
1325
int notdotentries(const struct dirent *direntry){
1270
1326
/* Skip "." and ".." */
1271
1327
if(direntry->d_name[0] == '.'
1278
1334
}
1279
1335
1280
1336
/* Is this directory entry a runnable program? */
1337
__attribute__((nonnull, warn_unused_result))
1281
1338
int runnable_hook(const struct dirent *direntry){
1282
1339
int ret;
1283
1340
size_t sret;
1291
1348
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1292
1349
"abcdefghijklmnopqrstuvwxyz"
1293
1350
"0123456789"
1294
"_-");
1351
"_.-");
1295
1352
if((direntry->d_name)[sret] != '\0'){
1296
1353
/* Contains non-allowed characters */
1297
1354
if(debug){
1298
fprintf(stderr, "Mandos plugin mandos-client: "
1299
"Ignoring hook \"%s\" with bad name\n",
1300
direntry->d_name);
1355
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1356
direntry->d_name);
1301
1357
}
1302
1358
return 0;
1303
1359
}
1304
1360
1305
char *fullname = NULL;
1306
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1307
if(ret < 0){
1308
perror_plus("asprintf");
1309
return 0;
1310
}
1311
1312
ret = stat(fullname, &st);
1361
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1313
1362
if(ret == -1){
1314
1363
if(debug){
1315
1364
perror_plus("Could not stat hook");
1319
1368
if(not (S_ISREG(st.st_mode))){
1320
1369
/* Not a regular file */
1321
1370
if(debug){
1322
fprintf(stderr, "Mandos plugin mandos-client: "
1323
"Ignoring hook \"%s\" - not a file\n",
1324
direntry->d_name);
1371
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1372
direntry->d_name);
1325
1373
}
1326
1374
return 0;
1327
1375
}
1328
1376
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1329
1377
/* Not executable */
1330
1378
if(debug){
1331
fprintf(stderr, "Mandos plugin mandos-client: "
1332
"Ignoring hook \"%s\" - not executable\n",
1333
direntry->d_name);
1379
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1380
direntry->d_name);
1334
1381
}
1335
1382
return 0;
1336
1383
}
1384
if(debug){
1385
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1386
direntry->d_name);
1387
}
1337
1388
return 1;
1338
1389
}
1339
1390
1340
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1391
__attribute__((nonnull, warn_unused_result))
1392
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1393
mandos_context *mc){
1341
1394
int ret;
1342
1395
struct timespec now;
1343
1396
struct timespec waited_time;
1344
1397
intmax_t block_time;
1345
1398
1346
1399
while(true){
1347
if(mc.current_server == NULL){
1348
if (debug){
1349
fprintf(stderr, "Mandos plugin mandos-client: "
1350
"Wait until first server is found. No timeout!\n");
1400
if(mc->current_server == NULL){
1401
if(debug){
1402
fprintf_plus(stderr, "Wait until first server is found."
1403
" No timeout!\n");
1351
1404
}
1352
1405
ret = avahi_simple_poll_iterate(s, -1);
1353
1406
} else {
1354
if (debug){
1355
fprintf(stderr, "Mandos plugin mandos-client: "
1356
"Check current_server if we should run it,"
1357
" or wait\n");
1407
if(debug){
1408
fprintf_plus(stderr, "Check current_server if we should run"
1409
" it, or wait\n");
1358
1410
}
1359
1411
/* the current time */
1360
1412
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1365
1417
/* Calculating in ms how long time between now and server
1366
1418
who we visted longest time ago. Now - last seen. */
1367
1419
waited_time.tv_sec = (now.tv_sec
1368
- mc.current_server->last_seen.tv_sec);
1420
- mc->current_server->last_seen.tv_sec);
1369
1421
waited_time.tv_nsec = (now.tv_nsec
1370
- mc.current_server->last_seen.tv_nsec);
1422
- mc->current_server->last_seen.tv_nsec);
1371
1423
/* total time is 10s/10,000ms.
1372
1424
Converting to s from ms by dividing by 1,000,
1373
1425
and ns to ms by dividing by 1,000,000. */
1375
1427
- ((intmax_t)waited_time.tv_sec * 1000))
1376
1428
- ((intmax_t)waited_time.tv_nsec / 1000000));
1377
1429
1378
if (debug){
1379
fprintf(stderr, "Mandos plugin mandos-client: "
1380
"Blocking for %" PRIdMAX " ms\n", block_time);
1430
if(debug){
1431
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1432
block_time);
1381
1433
}
1382
1434
1383
1435
if(block_time <= 0){
1384
ret = start_mandos_communication(mc.current_server->ip,
1385
mc.current_server->port,
1386
mc.current_server->if_index,
1387
mc.current_server->af);
1436
ret = start_mandos_communication(mc->current_server->ip,
1437
mc->current_server->port,
1438
mc->current_server->if_index,
1439
mc->current_server->af, mc);
1388
1440
if(ret == 0){
1389
avahi_simple_poll_quit(mc.simple_poll);
1441
avahi_simple_poll_quit(s);
1390
1442
return 0;
1391
1443
}
1392
1444
ret = clock_gettime(CLOCK_MONOTONIC,
1393
&mc.current_server->last_seen);
1445
&mc->current_server->last_seen);
1394
1446
if(ret == -1){
1395
1447
perror_plus("clock_gettime");
1396
1448
return -1;
1397
1449
}
1398
mc.current_server = mc.current_server->next;
1450
mc->current_server = mc->current_server->next;
1399
1451
block_time = 0; /* Call avahi to find new Mandos
1400
1452
servers, but don't block */
1401
1453
}
1403
1455
ret = avahi_simple_poll_iterate(s, (int)block_time);
1404
1456
}
1405
1457
if(ret != 0){
1406
if (ret > 0 or errno != EINTR){
1458
if(ret > 0 or errno != EINTR){
1407
1459
return (ret != 1) ? ret : 0;
1408
1460
}
1409
1461
}
1410
1462
}
1411
1463
}
1412
1464
1465
/* Set effective uid to 0, return errno */
1466
__attribute__((warn_unused_result))
1467
error_t raise_privileges(void){
1468
error_t old_errno = errno;
1469
error_t ret_errno = 0;
1470
if(seteuid(0) == -1){
1471
ret_errno = errno;
1472
}
1473
errno = old_errno;
1474
return ret_errno;
1475
}
1476
1477
/* Set effective and real user ID to 0. Return errno. */
1478
__attribute__((warn_unused_result))
1479
error_t raise_privileges_permanently(void){
1480
error_t old_errno = errno;
1481
error_t ret_errno = raise_privileges();
1482
if(ret_errno != 0){
1483
errno = old_errno;
1484
return ret_errno;
1485
}
1486
if(setuid(0) == -1){
1487
ret_errno = errno;
1488
}
1489
errno = old_errno;
1490
return ret_errno;
1491
}
1492
1493
/* Set effective user ID to unprivileged saved user ID */
1494
__attribute__((warn_unused_result))
1495
error_t lower_privileges(void){
1496
error_t old_errno = errno;
1497
error_t ret_errno = 0;
1498
if(seteuid(uid) == -1){
1499
ret_errno = errno;
1500
}
1501
errno = old_errno;
1502
return ret_errno;
1503
}
1504
1505
/* Lower privileges permanently */
1506
__attribute__((warn_unused_result))
1507
error_t lower_privileges_permanently(void){
1508
error_t old_errno = errno;
1509
error_t ret_errno = 0;
1510
if(setuid(uid) == -1){
1511
ret_errno = errno;
1512
}
1513
errno = old_errno;
1514
return ret_errno;
1515
}
1516
1517
__attribute__((nonnull))
1518
void run_network_hooks(const char *mode, const char *interface,
1519
const float delay){
1520
struct dirent **direntries = NULL;
1521
if(hookdir_fd == -1){
1522
hookdir_fd = open(hookdir, O_RDONLY);
1523
if(hookdir_fd == -1){
1524
if(errno == ENOENT){
1525
if(debug){
1526
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1527
" found\n", hookdir);
1528
}
1529
} else {
1530
perror_plus("open");
1531
}
1532
return;
1533
}
1534
}
1535
#ifdef __GLIBC__
1536
#if __GLIBC_PREREQ(2, 15)
1537
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1538
runnable_hook, alphasort);
1539
#else /* not __GLIBC_PREREQ(2, 15) */
1540
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1541
alphasort);
1542
#endif /* not __GLIBC_PREREQ(2, 15) */
1543
#else /* not __GLIBC__ */
1544
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1545
alphasort);
1546
#endif /* not __GLIBC__ */
1547
if(numhooks == -1){
1548
perror_plus("scandir");
1549
return;
1550
}
1551
struct dirent *direntry;
1552
int ret;
1553
int devnull = open("/dev/null", O_RDONLY);
1554
for(int i = 0; i < numhooks; i++){
1555
direntry = direntries[i];
1556
if(debug){
1557
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1558
direntry->d_name);
1559
}
1560
pid_t hook_pid = fork();
1561
if(hook_pid == 0){
1562
/* Child */
1563
/* Raise privileges */
1564
errno = raise_privileges_permanently();
1565
if(errno != 0){
1566
perror_plus("Failed to raise privileges");
1567
_exit(EX_NOPERM);
1568
}
1569
/* Set group */
1570
errno = 0;
1571
ret = setgid(0);
1572
if(ret == -1){
1573
perror_plus("setgid");
1574
_exit(EX_NOPERM);
1575
}
1576
/* Reset supplementary groups */
1577
errno = 0;
1578
ret = setgroups(0, NULL);
1579
if(ret == -1){
1580
perror_plus("setgroups");
1581
_exit(EX_NOPERM);
1582
}
1583
ret = dup2(devnull, STDIN_FILENO);
1584
if(ret == -1){
1585
perror_plus("dup2(devnull, STDIN_FILENO)");
1586
_exit(EX_OSERR);
1587
}
1588
ret = close(devnull);
1589
if(ret == -1){
1590
perror_plus("close");
1591
_exit(EX_OSERR);
1592
}
1593
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1594
if(ret == -1){
1595
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1596
_exit(EX_OSERR);
1597
}
1598
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1599
if(ret == -1){
1600
perror_plus("setenv");
1601
_exit(EX_OSERR);
1602
}
1603
ret = setenv("DEVICE", interface, 1);
1604
if(ret == -1){
1605
perror_plus("setenv");
1606
_exit(EX_OSERR);
1607
}
1608
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1609
if(ret == -1){
1610
perror_plus("setenv");
1611
_exit(EX_OSERR);
1612
}
1613
ret = setenv("MODE", mode, 1);
1614
if(ret == -1){
1615
perror_plus("setenv");
1616
_exit(EX_OSERR);
1617
}
1618
char *delaystring;
1619
ret = asprintf(&delaystring, "%f", (double)delay);
1620
if(ret == -1){
1621
perror_plus("asprintf");
1622
_exit(EX_OSERR);
1623
}
1624
ret = setenv("DELAY", delaystring, 1);
1625
if(ret == -1){
1626
free(delaystring);
1627
perror_plus("setenv");
1628
_exit(EX_OSERR);
1629
}
1630
free(delaystring);
1631
if(connect_to != NULL){
1632
ret = setenv("CONNECT", connect_to, 1);
1633
if(ret == -1){
1634
perror_plus("setenv");
1635
_exit(EX_OSERR);
1636
}
1637
}
1638
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1639
if(hook_fd == -1){
1640
perror_plus("openat");
1641
_exit(EXIT_FAILURE);
1642
}
1643
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1644
perror_plus("close");
1645
_exit(EXIT_FAILURE);
1646
}
1647
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1648
environ) == -1){
1649
perror_plus("fexecve");
1650
_exit(EXIT_FAILURE);
1651
}
1652
} else {
1653
if(hook_pid == -1){
1654
perror_plus("fork");
1655
free(direntry);
1656
continue;
1657
}
1658
int status;
1659
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1660
perror_plus("waitpid");
1661
free(direntry);
1662
continue;
1663
}
1664
if(WIFEXITED(status)){
1665
if(WEXITSTATUS(status) != 0){
1666
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1667
" with status %d\n", direntry->d_name,
1668
WEXITSTATUS(status));
1669
free(direntry);
1670
continue;
1671
}
1672
} else if(WIFSIGNALED(status)){
1673
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1674
" signal %d\n", direntry->d_name,
1675
WTERMSIG(status));
1676
free(direntry);
1677
continue;
1678
} else {
1679
fprintf_plus(stderr, "Warning: network hook \"%s\""
1680
" crashed\n", direntry->d_name);
1681
free(direntry);
1682
continue;
1683
}
1684
}
1685
if(debug){
1686
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1687
direntry->d_name);
1688
}
1689
free(direntry);
1690
}
1691
free(direntries);
1692
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1693
perror_plus("close");
1694
} else {
1695
hookdir_fd = -1;
1696
}
1697
close(devnull);
1698
}
1699
1700
__attribute__((nonnull, warn_unused_result))
1701
error_t bring_up_interface(const char *const interface,
1702
const float delay){
1703
error_t old_errno = errno;
1704
int ret;
1705
struct ifreq network;
1706
unsigned int if_index = if_nametoindex(interface);
1707
if(if_index == 0){
1708
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1709
errno = old_errno;
1710
return ENXIO;
1711
}
1712
1713
if(quit_now){
1714
errno = old_errno;
1715
return EINTR;
1716
}
1717
1718
if(not interface_is_up(interface)){
1719
error_t ret_errno = 0, ioctl_errno = 0;
1720
if(not get_flags(interface, &network)){
1721
ret_errno = errno;
1722
fprintf_plus(stderr, "Failed to get flags for interface "
1723
"\"%s\"\n", interface);
1724
errno = old_errno;
1725
return ret_errno;
1726
}
1727
network.ifr_flags |= IFF_UP; /* set flag */
1728
1729
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1730
if(sd == -1){
1731
ret_errno = errno;
1732
perror_plus("socket");
1733
errno = old_errno;
1734
return ret_errno;
1735
}
1736
1737
if(quit_now){
1738
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1739
if(ret == -1){
1740
perror_plus("close");
1741
}
1742
errno = old_errno;
1743
return EINTR;
1744
}
1745
1746
if(debug){
1747
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
1748
interface);
1749
}
1750
1751
/* Raise privileges */
1752
ret_errno = raise_privileges();
1753
if(ret_errno != 0){
1754
errno = ret_errno;
1755
perror_plus("Failed to raise privileges");
1756
}
1757
1758
#ifdef __linux__
1759
int ret_linux;
1760
bool restore_loglevel = false;
1761
if(ret_errno == 0){
1762
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1763
messages about the network interface to mess up the prompt */
1764
ret_linux = klogctl(8, NULL, 5);
1765
if(ret_linux == -1){
1766
perror_plus("klogctl");
1767
} else {
1768
restore_loglevel = true;
1769
}
1770
}
1771
#endif /* __linux__ */
1772
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1773
ioctl_errno = errno;
1774
#ifdef __linux__
1775
if(restore_loglevel){
1776
ret_linux = klogctl(7, NULL, 0);
1777
if(ret_linux == -1){
1778
perror_plus("klogctl");
1779
}
1780
}
1781
#endif /* __linux__ */
1782
1783
/* If raise_privileges() succeeded above */
1784
if(ret_errno == 0){
1785
/* Lower privileges */
1786
ret_errno = lower_privileges();
1787
if(ret_errno != 0){
1788
errno = ret_errno;
1789
perror_plus("Failed to lower privileges");
1790
}
1791
}
1792
1793
/* Close the socket */
1794
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1795
if(ret == -1){
1796
perror_plus("close");
1797
}
1798
1799
if(ret_setflags == -1){
1800
errno = ioctl_errno;
1801
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1802
errno = old_errno;
1803
return ioctl_errno;
1804
}
1805
} else if(debug){
1806
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1807
interface);
1808
}
1809
1810
/* Sleep checking until interface is running.
1811
Check every 0.25s, up to total time of delay */
1812
for(int i=0; i < delay * 4; i++){
1813
if(interface_is_running(interface)){
1814
break;
1815
}
1816
struct timespec sleeptime = { .tv_nsec = 250000000 };
1817
ret = nanosleep(&sleeptime, NULL);
1818
if(ret == -1 and errno != EINTR){
1819
perror_plus("nanosleep");
1820
}
1821
}
1822
1823
errno = old_errno;
1824
return 0;
1825
}
1826
1827
__attribute__((nonnull, warn_unused_result))
1828
error_t take_down_interface(const char *const interface){
1829
error_t old_errno = errno;
1830
struct ifreq network;
1831
unsigned int if_index = if_nametoindex(interface);
1832
if(if_index == 0){
1833
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1834
errno = old_errno;
1835
return ENXIO;
1836
}
1837
if(interface_is_up(interface)){
1838
error_t ret_errno = 0, ioctl_errno = 0;
1839
if(not get_flags(interface, &network) and debug){
1840
ret_errno = errno;
1841
fprintf_plus(stderr, "Failed to get flags for interface "
1842
"\"%s\"\n", interface);
1843
errno = old_errno;
1844
return ret_errno;
1845
}
1846
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1847
1848
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1849
if(sd == -1){
1850
ret_errno = errno;
1851
perror_plus("socket");
1852
errno = old_errno;
1853
return ret_errno;
1854
}
1855
1856
if(debug){
1857
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
1858
interface);
1859
}
1860
1861
/* Raise privileges */
1862
ret_errno = raise_privileges();
1863
if(ret_errno != 0){
1864
errno = ret_errno;
1865
perror_plus("Failed to raise privileges");
1866
}
1867
1868
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1869
ioctl_errno = errno;
1870
1871
/* If raise_privileges() succeeded above */
1872
if(ret_errno == 0){
1873
/* Lower privileges */
1874
ret_errno = lower_privileges();
1875
if(ret_errno != 0){
1876
errno = ret_errno;
1877
perror_plus("Failed to lower privileges");
1878
}
1879
}
1880
1881
/* Close the socket */
1882
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1883
if(ret == -1){
1884
perror_plus("close");
1885
}
1886
1887
if(ret_setflags == -1){
1888
errno = ioctl_errno;
1889
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1890
errno = old_errno;
1891
return ioctl_errno;
1892
}
1893
} else if(debug){
1894
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1895
interface);
1896
}
1897
1898
errno = old_errno;
1899
return 0;
1900
}
1901
1413
1902
int main(int argc, char *argv[]){
1903
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1904
.priority = "SECURE256:!CTYPE-X.509:"
1905
"+CTYPE-OPENPGP", .current_server = NULL,
1906
.interfaces = NULL, .interfaces_size = 0 };
1414
1907
AvahiSServiceBrowser *sb = NULL;
1415
int error;
1908
error_t ret_errno;
1416
1909
int ret;
1417
1910
intmax_t tmpmax;
1418
1911
char *tmp;
1419
1912
int exitcode = EXIT_SUCCESS;
1420
const char *interface = "";
1421
struct ifreq network;
1422
int sd = -1;
1423
bool take_down_interface = false;
1424
uid_t uid;
1425
gid_t gid;
1426
char tempdir[] = "/tmp/mandosXXXXXX";
1427
bool tempdir_created = false;
1913
char *interfaces_to_take_down = NULL;
1914
size_t interfaces_to_take_down_size = 0;
1915
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
1916
char old_tempdir[] = "/tmp/mandosXXXXXX";
1917
char *tempdir = NULL;
1428
1918
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1429
1919
const char *seckey = PATHDIR "/" SECKEY;
1430
1920
const char *pubkey = PATHDIR "/" PUBKEY;
1921
char *interfaces_hooks = NULL;
1431
1922
1432
1923
bool gnutls_initialized = false;
1433
1924
bool gpgme_initialized = false;
1495
1986
.group = 2 },
1496
1987
{ .name = "retry", .key = 132,
1497
1988
.arg = "SECONDS",
1498
.doc = "Retry interval used when denied by the mandos server",
1989
.doc = "Retry interval used when denied by the Mandos server",
1499
1990
.group = 2 },
1500
1991
{ .name = "network-hook-dir", .key = 133,
1501
1992
.arg = "DIR",
1524
2015
connect_to = arg;
1525
2016
break;
1526
2017
case 'i': /* --interface */
1527
interface = arg;
2018
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
2019
arg, (int)',');
2020
if(ret_errno != 0){
2021
argp_error(state, "%s", strerror(ret_errno));
2022
}
1528
2023
break;
1529
2024
case 's': /* --seckey */
1530
2025
seckey = arg;
1573
2068
argp_state_help(state, state->out_stream,
1574
2069
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1575
2070
case 'V': /* --version */
1576
fprintf(state->out_stream, "Mandos plugin mandos-client: ");
1577
fprintf(state->out_stream, "%s\n", argp_program_version);
2071
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1578
2072
exit(argp_err_exit_status);
1579
2073
break;
1580
2074
default:
1607
2101
{
1608
2102
/* Work around Debian bug #633582:
1609
2103
<http://bugs.debian.org/633582> */
1610
struct stat st;
1611
1612
/* Re-raise priviliges */
1613
errno = 0;
1614
ret = seteuid(0);
1615
if(ret == -1){
1616
perror_plus("seteuid");
1617
}
1618
1619
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1620
int seckey_fd = open(seckey, O_RDONLY);
1621
if(seckey_fd == -1){
1622
perror_plus("open");
1623
} else {
1624
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1625
if(ret == -1){
1626
perror_plus("fstat");
1627
} else {
1628
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1629
ret = fchown(seckey_fd, uid, gid);
1630
if(ret == -1){
1631
perror_plus("fchown");
1632
}
1633
}
1634
}
1635
TEMP_FAILURE_RETRY(close(seckey_fd));
1636
}
1637
}
1638
1639
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1640
int pubkey_fd = open(pubkey, O_RDONLY);
1641
if(pubkey_fd == -1){
1642
perror_plus("open");
1643
} else {
1644
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1645
if(ret == -1){
1646
perror_plus("fstat");
1647
} else {
1648
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1649
ret = fchown(pubkey_fd, uid, gid);
1650
if(ret == -1){
1651
perror_plus("fchown");
1652
}
1653
}
1654
}
1655
TEMP_FAILURE_RETRY(close(pubkey_fd));
1656
}
1657
}
1658
1659
/* Lower privileges */
1660
errno = 0;
1661
ret = seteuid(uid);
1662
if(ret == -1){
1663
perror_plus("seteuid");
1664
}
1665
}
1666
1667
/* Find network hooks and run them */
1668
{
1669
struct dirent **direntries;
1670
struct dirent *direntry;
1671
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1672
alphasort);
1673
if(numhooks == -1){
1674
perror_plus("scandir");
2104
2105
/* Re-raise privileges */
2106
ret_errno = raise_privileges();
2107
if(ret_errno != 0){
2108
errno = ret_errno;
2109
perror_plus("Failed to raise privileges");
1675
2110
} else {
1676
int devnull = open("/dev/null", O_RDONLY);
1677
for(int i = 0; i < numhooks; i++){
1678
direntry = direntries[0];
1679
char *fullname = NULL;
1680
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1681
if(ret < 0){
1682
perror_plus("asprintf");
1683
continue;
1684
}
1685
pid_t hook_pid = fork();
1686
if(hook_pid == 0){
1687
/* Child */
1688
dup2(devnull, STDIN_FILENO);
1689
close(devnull);
1690
dup2(STDERR_FILENO, STDOUT_FILENO);
1691
ret = setenv("DEVICE", interface, 1);
1692
if(ret == -1){
1693
perror_plus("setenv");
1694
exit(1);
1695
}
1696
ret = setenv("VERBOSE", debug ? "1" : "0", 1);
1697
if(ret == -1){
1698
perror_plus("setenv");
1699
exit(1);
1700
}
1701
ret = setenv("MODE", "start", 1);
1702
if(ret == -1){
1703
perror_plus("setenv");
1704
exit(1);
1705
}
1706
char *delaystring;
1707
ret = asprintf(&delaystring, "%f", delay);
1708
if(ret == -1){
1709
perror_plus("asprintf");
1710
exit(1);
1711
}
1712
ret = setenv("DELAY", delaystring, 1);
1713
if(ret == -1){
1714
free(delaystring);
1715
perror_plus("setenv");
1716
exit(1);
1717
}
1718
free(delaystring);
1719
ret = execl(fullname, direntry->d_name, "start", NULL);
1720
perror_plus("execl");
1721
} else {
1722
int status;
1723
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1724
perror_plus("waitpid");
1725
free(fullname);
1726
continue;
1727
}
1728
if(WIFEXITED(status)){
1729
if(WEXITSTATUS(status) != 0){
1730
fprintf(stderr, "Mandos plugin mandos-client: "
1731
"Warning: network hook \"%s\" exited"
1732
" with status %d\n", direntry->d_name,
1733
WEXITSTATUS(status));
1734
free(fullname);
1735
continue;
1736
}
1737
} else if(WIFSIGNALED(status)){
1738
fprintf(stderr, "Mandos plugin mandos-client: "
1739
"Warning: network hook \"%s\" died by"
1740
" signal %d\n", direntry->d_name,
1741
WTERMSIG(status));
1742
free(fullname);
1743
continue;
1744
} else {
1745
fprintf(stderr, "Mandos plugin mandos-client: "
1746
"Warning: network hook \"%s\" crashed\n",
1747
direntry->d_name);
1748
free(fullname);
1749
continue;
1750
}
1751
}
1752
free(fullname);
1753
if(quit_now){
1754
goto end;
1755
}
1756
}
1757
close(devnull);
1758
}
2111
struct stat st;
2112
2113
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2114
int seckey_fd = open(seckey, O_RDONLY);
2115
if(seckey_fd == -1){
2116
perror_plus("open");
2117
} else {
2118
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
2119
if(ret == -1){
2120
perror_plus("fstat");
2121
} else {
2122
if(S_ISREG(st.st_mode)
2123
and st.st_uid == 0 and st.st_gid == 0){
2124
ret = fchown(seckey_fd, uid, gid);
2125
if(ret == -1){
2126
perror_plus("fchown");
2127
}
2128
}
2129
}
2130
TEMP_FAILURE_RETRY(close(seckey_fd));
2131
}
2132
}
2133
2134
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
2135
int pubkey_fd = open(pubkey, O_RDONLY);
2136
if(pubkey_fd == -1){
2137
perror_plus("open");
2138
} else {
2139
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
2140
if(ret == -1){
2141
perror_plus("fstat");
2142
} else {
2143
if(S_ISREG(st.st_mode)
2144
and st.st_uid == 0 and st.st_gid == 0){
2145
ret = fchown(pubkey_fd, uid, gid);
2146
if(ret == -1){
2147
perror_plus("fchown");
2148
}
2149
}
2150
}
2151
TEMP_FAILURE_RETRY(close(pubkey_fd));
2152
}
2153
}
2154
2155
/* Lower privileges */
2156
ret_errno = lower_privileges();
2157
if(ret_errno != 0){
2158
errno = ret_errno;
2159
perror_plus("Failed to lower privileges");
2160
}
2161
}
2162
}
2163
2164
/* Remove invalid interface names (except "none") */
2165
{
2166
char *interface = NULL;
2167
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2168
interface))){
2169
if(strcmp(interface, "none") != 0
2170
and if_nametoindex(interface) == 0){
2171
if(interface[0] != '\0'){
2172
fprintf_plus(stderr, "Not using nonexisting interface"
2173
" \"%s\"\n", interface);
2174
}
2175
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2176
interface = NULL;
2177
}
2178
}
2179
}
2180
2181
/* Run network hooks */
2182
{
2183
if(mc.interfaces != NULL){
2184
interfaces_hooks = malloc(mc.interfaces_size);
2185
if(interfaces_hooks == NULL){
2186
perror_plus("malloc");
2187
goto end;
2188
}
2189
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2190
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2191
}
2192
run_network_hooks("start", interfaces_hooks != NULL ?
2193
interfaces_hooks : "", delay);
1759
2194
}
1760
2195
1761
2196
if(not debug){
1762
2197
avahi_set_log_function(empty_log);
1763
2198
}
1764
2199
1765
if(interface[0] == '\0'){
1766
struct dirent **direntries;
1767
/* First look for interfaces that are up */
1768
ret = scandir(sys_class_net, &direntries, up_interface,
1769
alphasort);
1770
if(ret == 0){
1771
/* No up interfaces, look for any good interfaces */
1772
free(direntries);
1773
ret = scandir(sys_class_net, &direntries, good_interface,
1774
alphasort);
1775
}
1776
if(ret >= 1){
1777
/* Pick the first interface returned */
1778
interface = strdup(direntries[0]->d_name);
1779
if(debug){
1780
fprintf(stderr, "Mandos plugin mandos-client: "
1781
"Using interface \"%s\"\n", interface);
1782
}
1783
if(interface == NULL){
1784
perror_plus("malloc");
1785
free(direntries);
1786
exitcode = EXIT_FAILURE;
1787
goto end;
1788
}
1789
free(direntries);
1790
} else {
1791
free(direntries);
1792
fprintf(stderr, "Mandos plugin mandos-client: "
1793
"Could not find a network interface\n");
1794
exitcode = EXIT_FAILURE;
1795
goto end;
1796
}
1797
}
1798
1799
2200
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1800
2201
from the signal handler */
1801
2202
/* Initialize the pseudo-RNG for Avahi */
1802
2203
srand((unsigned int) time(NULL));
1803
mc.simple_poll = avahi_simple_poll_new();
1804
if(mc.simple_poll == NULL){
1805
fprintf(stderr, "Mandos plugin mandos-client: "
1806
"Avahi: Failed to create simple poll object.\n");
2204
simple_poll = avahi_simple_poll_new();
2205
if(simple_poll == NULL){
2206
fprintf_plus(stderr,
2207
"Avahi: Failed to create simple poll object.\n");
1807
2208
exitcode = EX_UNAVAILABLE;
1808
2209
goto end;
1809
2210
}
1871
2272
}
1872
2273
}
1873
2274
1874
/* If the interface is down, bring it up */
1875
if(strcmp(interface, "none") != 0){
1876
if_index = (AvahiIfIndex) if_nametoindex(interface);
1877
if(if_index == 0){
1878
fprintf(stderr, "Mandos plugin mandos-client: "
1879
"No such interface: \"%s\"\n", interface);
1880
exitcode = EX_UNAVAILABLE;
1881
goto end;
1882
}
1883
1884
if(quit_now){
1885
goto end;
1886
}
1887
1888
/* Re-raise priviliges */
1889
errno = 0;
1890
ret = seteuid(0);
1891
if(ret == -1){
1892
perror_plus("seteuid");
1893
}
1894
1895
#ifdef __linux__
1896
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1897
messages about the network interface to mess up the prompt */
1898
ret = klogctl(8, NULL, 5);
1899
bool restore_loglevel = true;
1900
if(ret == -1){
1901
restore_loglevel = false;
1902
perror_plus("klogctl");
1903
}
1904
#endif /* __linux__ */
1905
1906
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1907
if(sd < 0){
1908
perror_plus("socket");
1909
exitcode = EX_OSERR;
1910
#ifdef __linux__
1911
if(restore_loglevel){
1912
ret = klogctl(7, NULL, 0);
1913
if(ret == -1){
1914
perror_plus("klogctl");
1915
}
1916
}
1917
#endif /* __linux__ */
1918
/* Lower privileges */
1919
errno = 0;
1920
ret = seteuid(uid);
1921
if(ret == -1){
1922
perror_plus("seteuid");
1923
}
1924
goto end;
1925
}
1926
strcpy(network.ifr_name, interface);
1927
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1928
if(ret == -1){
1929
perror_plus("ioctl SIOCGIFFLAGS");
1930
#ifdef __linux__
1931
if(restore_loglevel){
1932
ret = klogctl(7, NULL, 0);
1933
if(ret == -1){
1934
perror_plus("klogctl");
1935
}
1936
}
1937
#endif /* __linux__ */
1938
exitcode = EX_OSERR;
1939
/* Lower privileges */
1940
errno = 0;
1941
ret = seteuid(uid);
1942
if(ret == -1){
1943
perror_plus("seteuid");
1944
}
1945
goto end;
1946
}
1947
if((network.ifr_flags & IFF_UP) == 0){
1948
network.ifr_flags |= IFF_UP;
1949
take_down_interface = true;
1950
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1951
if(ret == -1){
1952
take_down_interface = false;
1953
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1954
exitcode = EX_OSERR;
1955
#ifdef __linux__
1956
if(restore_loglevel){
1957
ret = klogctl(7, NULL, 0);
1958
if(ret == -1){
1959
perror_plus("klogctl");
2275
/* If no interfaces were specified, make a list */
2276
if(mc.interfaces == NULL){
2277
struct dirent **direntries = NULL;
2278
/* Look for any good interfaces */
2279
ret = scandir(sys_class_net, &direntries, good_interface,
2280
alphasort);
2281
if(ret >= 1){
2282
/* Add all found interfaces to interfaces list */
2283
for(int i = 0; i < ret; ++i){
2284
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2285
direntries[i]->d_name);
2286
if(ret_errno != 0){
2287
errno = ret_errno;
2288
perror_plus("argz_add");
2289
free(direntries[i]);
2290
continue;
2291
}
2292
if(debug){
2293
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2294
direntries[i]->d_name);
2295
}
2296
free(direntries[i]);
2297
}
2298
free(direntries);
2299
} else {
2300
if(ret == 0){
2301
free(direntries);
2302
}
2303
fprintf_plus(stderr, "Could not find a network interface\n");
2304
exitcode = EXIT_FAILURE;
2305
goto end;
2306
}
2307
}
2308
2309
/* Bring up interfaces which are down, and remove any "none"s */
2310
{
2311
char *interface = NULL;
2312
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2313
interface))){
2314
/* If interface name is "none", stop bringing up interfaces.
2315
Also remove all instances of "none" from the list */
2316
if(strcmp(interface, "none") == 0){
2317
argz_delete(&mc.interfaces, &mc.interfaces_size,
2318
interface);
2319
interface = NULL;
2320
while((interface = argz_next(mc.interfaces,
2321
mc.interfaces_size, interface))){
2322
if(strcmp(interface, "none") == 0){
2323
argz_delete(&mc.interfaces, &mc.interfaces_size,
2324
interface);
2325
interface = NULL;
1960
2326
}
1961
2327
}
1962
#endif /* __linux__ */
1963
/* Lower privileges */
1964
errno = 0;
1965
ret = seteuid(uid);
1966
if(ret == -1){
1967
perror_plus("seteuid");
1968
}
1969
goto end;
1970
}
1971
}
1972
/* Sleep checking until interface is running.
1973
Check every 0.25s, up to total time of delay */
1974
for(int i=0; i < delay * 4; i++){
1975
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1976
if(ret == -1){
1977
perror_plus("ioctl SIOCGIFFLAGS");
1978
} else if(network.ifr_flags & IFF_RUNNING){
1979
2328
break;
1980
2329
}
1981
struct timespec sleeptime = { .tv_nsec = 250000000 };
1982
ret = nanosleep(&sleeptime, NULL);
1983
if(ret == -1 and errno != EINTR){
1984
perror_plus("nanosleep");
1985
}
1986
}
1987
if(not take_down_interface){
1988
/* We won't need the socket anymore */
1989
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1990
if(ret == -1){
1991
perror_plus("close");
1992
}
1993
}
1994
#ifdef __linux__
1995
if(restore_loglevel){
1996
/* Restores kernel loglevel to default */
1997
ret = klogctl(7, NULL, 0);
1998
if(ret == -1){
1999
perror_plus("klogctl");
2000
}
2001
}
2002
#endif /* __linux__ */
2003
/* Lower privileges */
2004
errno = 0;
2005
if(take_down_interface){
2006
/* Lower privileges */
2007
ret = seteuid(uid);
2008
if(ret == -1){
2009
perror_plus("seteuid");
2010
}
2011
} else {
2012
/* Lower privileges permanently */
2013
ret = setuid(uid);
2014
if(ret == -1){
2015
perror_plus("setuid");
2016
}
2017
}
2330
bool interface_was_up = interface_is_up(interface);
2331
errno = bring_up_interface(interface, delay);
2332
if(not interface_was_up){
2333
if(errno != 0){
2334
perror_plus("Failed to bring up interface");
2335
} else {
2336
errno = argz_add(&interfaces_to_take_down,
2337
&interfaces_to_take_down_size,
2338
interface);
2339
if(errno != 0){
2340
perror_plus("argz_add");
2341
}
2342
}
2343
}
2344
}
2345
if(debug and (interfaces_to_take_down == NULL)){
2346
fprintf_plus(stderr, "No interfaces were brought up\n");
2347
}
2348
}
2349
2350
/* If we only got one interface, explicitly use only that one */
2351
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2352
if(debug){
2353
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2354
mc.interfaces);
2355
}
2356
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2018
2357
}
2019
2358
2020
2359
if(quit_now){
2021
2360
goto end;
2022
2361
}
2023
2362
2024
ret = init_gnutls_global(pubkey, seckey);
2363
ret = init_gnutls_global(pubkey, seckey, &mc);
2025
2364
if(ret == -1){
2026
fprintf(stderr, "Mandos plugin mandos-client: "
2027
"init_gnutls_global failed\n");
2365
fprintf_plus(stderr, "init_gnutls_global failed\n");
2028
2366
exitcode = EX_UNAVAILABLE;
2029
2367
goto end;
2030
2368
} else {
2035
2373
goto end;
2036
2374
}
2037
2375
2038
if(mkdtemp(tempdir) == NULL){
2376
/* Try /run/tmp before /tmp */
2377
tempdir = mkdtemp(run_tempdir);
2378
if(tempdir == NULL and errno == ENOENT){
2379
if(debug){
2380
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2381
run_tempdir, old_tempdir);
2382
}
2383
tempdir = mkdtemp(old_tempdir);
2384
}
2385
if(tempdir == NULL){
2039
2386
perror_plus("mkdtemp");
2040
2387
goto end;
2041
2388
}
2042
tempdir_created = true;
2043
2389
2044
2390
if(quit_now){
2045
2391
goto end;
2046
2392
}
2047
2393
2048
if(not init_gpgme(pubkey, seckey, tempdir)){
2049
fprintf(stderr, "Mandos plugin mandos-client: "
2050
"init_gpgme failed\n");
2394
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2395
fprintf_plus(stderr, "init_gpgme failed\n");
2051
2396
exitcode = EX_UNAVAILABLE;
2052
2397
goto end;
2053
2398
} else {
2062
2407
/* Connect directly, do not use Zeroconf */
2063
2408
/* (Mainly meant for debugging) */
2064
2409
char *address = strrchr(connect_to, ':');
2410
2065
2411
if(address == NULL){
2066
fprintf(stderr, "Mandos plugin mandos-client: "
2067
"No colon in address\n");
2412
fprintf_plus(stderr, "No colon in address\n");
2068
2413
exitcode = EX_USAGE;
2069
2414
goto end;
2070
2415
}
2073
2418
goto end;
2074
2419
}
2075
2420
2076
uint16_t port;
2421
in_port_t port;
2077
2422
errno = 0;
2078
2423
tmpmax = strtoimax(address+1, &tmp, 10);
2079
2424
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2080
or tmpmax != (uint16_t)tmpmax){
2081
fprintf(stderr, "Mandos plugin mandos-client: "
2082
"Bad port number\n");
2425
or tmpmax != (in_port_t)tmpmax){
2426
fprintf_plus(stderr, "Bad port number\n");
2083
2427
exitcode = EX_USAGE;
2084
2428
goto end;
2085
2429
}
2086
2430
2087
2431
if(quit_now){
2088
2432
goto end;
2089
2433
}
2090
2434
2091
port = (uint16_t)tmpmax;
2435
port = (in_port_t)tmpmax;
2092
2436
*address = '\0';
2093
2437
/* Colon in address indicates IPv6 */
2094
2438
int af;
2110
2454
}
2111
2455
2112
2456
while(not quit_now){
2113
ret = start_mandos_communication(address, port, if_index, af);
2457
ret = start_mandos_communication(address, port, if_index, af,
2458
&mc);
2114
2459
if(quit_now or ret == 0){
2115
2460
break;
2116
2461
}
2117
2462
if(debug){
2118
fprintf(stderr, "Mandos plugin mandos-client: "
2119
"Retrying in %d seconds\n", (int)retry_interval);
2463
fprintf_plus(stderr, "Retrying in %d seconds\n",
2464
(int)retry_interval);
2120
2465
}
2121
sleep((int)retry_interval);
2466
sleep((unsigned int)retry_interval);
2122
2467
}
2123
2468
2124
if (not quit_now){
2469
if(not quit_now){
2125
2470
exitcode = EXIT_SUCCESS;
2126
2471
}
2127
2472
2142
2487
config.publish_domain = 0;
2143
2488
2144
2489
/* Allocate a new server */
2145
mc.server = avahi_server_new(avahi_simple_poll_get
2146
(mc.simple_poll), &config, NULL,
2147
NULL, &error);
2490
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2491
&config, NULL, NULL, &ret_errno);
2148
2492
2149
2493
/* Free the Avahi configuration data */
2150
2494
avahi_server_config_free(&config);
2152
2496
2153
2497
/* Check if creating the Avahi server object succeeded */
2154
2498
if(mc.server == NULL){
2155
fprintf(stderr, "Mandos plugin mandos-client: "
2156
"Failed to create Avahi server: %s\n",
2157
avahi_strerror(error));
2499
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2500
avahi_strerror(ret_errno));
2158
2501
exitcode = EX_UNAVAILABLE;
2159
2502
goto end;
2160
2503
}
2166
2509
/* Create the Avahi service browser */
2167
2510
sb = avahi_s_service_browser_new(mc.server, if_index,
2168
2511
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2169
NULL, 0, browse_callback, NULL);
2512
NULL, 0, browse_callback,
2513
(void *)&mc);
2170
2514
if(sb == NULL){
2171
fprintf(stderr, "Mandos plugin mandos-client: "
2172
"Failed to create service browser: %s\n",
2173
avahi_strerror(avahi_server_errno(mc.server)));
2515
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2516
avahi_strerror(avahi_server_errno(mc.server)));
2174
2517
exitcode = EX_UNAVAILABLE;
2175
2518
goto end;
2176
2519
}
2182
2525
/* Run the main loop */
2183
2526
2184
2527
if(debug){
2185
fprintf(stderr, "Mandos plugin mandos-client: "
2186
"Starting Avahi loop search\n");
2528
fprintf_plus(stderr, "Starting Avahi loop search\n");
2187
2529
}
2188
2189
ret = avahi_loop_with_timeout(mc.simple_poll,
2190
(int)(retry_interval * 1000));
2530
2531
ret = avahi_loop_with_timeout(simple_poll,
2532
(int)(retry_interval * 1000), &mc);
2191
2533
if(debug){
2192
fprintf(stderr, "Mandos plugin mandos-client: "
2193
"avahi_loop_with_timeout exited %s\n",
2194
(ret == 0) ? "successfully" : "with error");
2534
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2535
(ret == 0) ? "successfully" : "with error");
2195
2536
}
2196
2537
2197
2538
end:
2198
2539
2199
2540
if(debug){
2200
fprintf(stderr, "Mandos plugin mandos-client: "
2201
"%s exiting\n", argv[0]);
2541
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2202
2542
}
2203
2543
2204
2544
/* Cleanup things */
2545
free(mc.interfaces);
2546
2205
2547
if(sb != NULL)
2206
2548
avahi_s_service_browser_free(sb);
2207
2549
2208
2550
if(mc.server != NULL)
2209
2551
avahi_server_free(mc.server);
2210
2552
2211
if(mc.simple_poll != NULL)
2212
avahi_simple_poll_free(mc.simple_poll);
2553
if(simple_poll != NULL)
2554
avahi_simple_poll_free(simple_poll);
2213
2555
2214
2556
if(gnutls_initialized){
2215
2557
gnutls_certificate_free_credentials(mc.cred);
2220
2562
if(gpgme_initialized){
2221
2563
gpgme_release(mc.ctx);
2222
2564
}
2223
2565
2224
2566
/* Cleans up the circular linked list of Mandos servers the client
2225
2567
has seen */
2226
2568
if(mc.current_server != NULL){
2227
2569
mc.current_server->prev->next = NULL;
2228
2570
while(mc.current_server != NULL){
2229
2571
server *next = mc.current_server->next;
2572
#ifdef __GNUC__
2573
#pragma GCC diagnostic push
2574
#pragma GCC diagnostic ignored "-Wcast-qual"
2575
#endif
2576
free((char *)(mc.current_server->ip));
2577
#ifdef __GNUC__
2578
#pragma GCC diagnostic pop
2579
#endif
2230
2580
free(mc.current_server);
2231
2581
mc.current_server = next;
2232
2582
}
2233
2583
}
2234
2584
2235
/* XXX run network hooks "stop" here */
2236
2237
/* Take down the network interface */
2238
if(take_down_interface){
2239
/* Re-raise priviliges */
2240
errno = 0;
2241
ret = seteuid(0);
2242
if(ret == -1){
2243
perror_plus("seteuid");
2585
/* Re-raise privileges */
2586
{
2587
ret_errno = raise_privileges();
2588
if(ret_errno != 0){
2589
errno = ret_errno;
2590
perror_plus("Failed to raise privileges");
2591
} else {
2592
2593
/* Run network hooks */
2594
run_network_hooks("stop", interfaces_hooks != NULL ?
2595
interfaces_hooks : "", delay);
2596
2597
/* Take down the network interfaces which were brought up */
2598
{
2599
char *interface = NULL;
2600
while((interface=argz_next(interfaces_to_take_down,
2601
interfaces_to_take_down_size,
2602
interface))){
2603
ret_errno = take_down_interface(interface);
2604
if(ret_errno != 0){
2605
errno = ret_errno;
2606
perror_plus("Failed to take down interface");
2607
}
2608
}
2609
if(debug and (interfaces_to_take_down == NULL)){
2610
fprintf_plus(stderr, "No interfaces needed to be taken"
2611
" down\n");
2612
}
2613
}
2244
2614
}
2245
if(geteuid() == 0){
2246
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2247
if(ret == -1){
2248
perror_plus("ioctl SIOCGIFFLAGS");
2249
} else if(network.ifr_flags & IFF_UP){
2250
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2251
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2252
if(ret == -1){
2253
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2254
}
2255
}
2256
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2257
if(ret == -1){
2258
perror_plus("close");
2259
}
2260
/* Lower privileges permanently */
2261
errno = 0;
2262
ret = setuid(uid);
2263
if(ret == -1){
2264
perror_plus("setuid");
2265
}
2615
2616
ret_errno = lower_privileges_permanently();
2617
if(ret_errno != 0){
2618
errno = ret_errno;
2619
perror_plus("Failed to lower privileges permanently");
2266
2620
}
2267
2621
}
2268
2622
2623
free(interfaces_to_take_down);
2624
free(interfaces_hooks);
2625
2269
2626
/* Removes the GPGME temp directory and all files inside */
2270
if(tempdir_created){
2627
if(tempdir != NULL){
2271
2628
struct dirent **direntries = NULL;
2272
struct dirent *direntry = NULL;
2273
int numentries = scandir(tempdir, &direntries, notdotentries,
2274
alphasort);
2275
if (numentries > 0){
2276
for(int i = 0; i < numentries; i++){
2277
direntry = direntries[i];
2278
char *fullname = NULL;
2279
ret = asprintf(&fullname, "%s/%s", tempdir,
2280
direntry->d_name);
2281
if(ret < 0){
2282
perror_plus("asprintf");
2283
continue;
2284
}
2285
ret = remove(fullname);
2286
if(ret == -1){
2287
fprintf(stderr, "Mandos plugin mandos-client: "
2288
"remove(\"%s\"): %s\n", fullname, strerror(errno));
2289
}
2290
free(fullname);
2629
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2630
O_NOFOLLOW));
2631
if(tempdir_fd == -1){
2632
perror_plus("open");
2633
} else {
2634
#ifdef __GLIBC__
2635
#if __GLIBC_PREREQ(2, 15)
2636
int numentries = scandirat(tempdir_fd, ".", &direntries,
2637
notdotentries, alphasort);
2638
#else /* not __GLIBC_PREREQ(2, 15) */
2639
int numentries = scandir(tempdir, &direntries, notdotentries,
2640
alphasort);
2641
#endif /* not __GLIBC_PREREQ(2, 15) */
2642
#else /* not __GLIBC__ */
2643
int numentries = scandir(tempdir, &direntries, notdotentries,
2644
alphasort);
2645
#endif /* not __GLIBC__ */
2646
if(numentries >= 0){
2647
for(int i = 0; i < numentries; i++){
2648
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2649
if(ret == -1){
2650
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2651
" \"%s\", 0): %s\n", tempdir,
2652
direntries[i]->d_name, strerror(errno));
2653
}
2654
free(direntries[i]);
2655
}
2656
2657
/* need to clean even if 0 because man page doesn't specify */
2658
free(direntries);
2659
if(numentries == -1){
2660
perror_plus("scandir");
2661
}
2662
ret = rmdir(tempdir);
2663
if(ret == -1 and errno != ENOENT){
2664
perror_plus("rmdir");
2665
}
2291
2666
}
2292
}
2293
2294
/* need to clean even if 0 because man page doesn't specify */
2295
free(direntries);
2296
if (numentries == -1){
2297
perror_plus("scandir");
2298
}
2299
ret = rmdir(tempdir);
2300
if(ret == -1 and errno != ENOENT){
2301
perror_plus("rmdir");
2667
TEMP_FAILURE_RETRY(close(tempdir_fd));
2302
2668
}
2303
2669
}
2304
2670
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0