To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 749.1.1
- compare with another revision
- download diff
- download tarball
- view history from revision 749.1.1
- Committer: Teddy Hogeborn
- Date: 2015-05-23 20:18:34 UTC
- mto: This revision was merged to the branch mainline in revision 756.
- Revision ID: teddy@recompile.se-20150523201834-e89ex4ito93yni8x
mandos: Use multiprocessing module to run checkers.
For a long time, the Mandos server has occasionally logged the message
"ERROR: Child process vanished". This was never a fatal error, but it
has been annoying and slightly worrying, since a definite cause was
not found. One potential cause could be the "multiprocessing" and
"subprocess" modules conflicting w.r.t. SIGCHLD. To avoid this,
change the running of checkers from using subprocess.Popen
asynchronously to instead first create a multiprocessing.Process()
(which is asynchronous) calling a function, and have that function
then call subprocess.call() (which is synchronous). In this way, the
only thing using any asynchronous subprocesses is the multiprocessing
module.
This makes it necessary to change one small thing in the D-Bus API,
since the subprocesses.call() function does not expose the raw wait(2)
status value.
DBUS-API (CheckerCompleted): Change the second value provided by this
D-Bus signal from the raw wait(2) status
to the actual terminating signal number.
mandos (subprocess_call_pipe): New function to be called by
multiprocessing.Process (starting a
separate process).
(Client.last_checker signal): New attribute for signal which
terminated last checker. Like
last_checker_status, only not accessible
via D-Bus.
(Client.checker_callback): Take new "connection" argument and use it
to get returncode; set last_checker_signal.
Return False so gobject does not call this
callback again.
(Client.start_checker): Start checker using a multiprocessing.Process
instead of a subprocess.Popen.
(ClientDBus.checker_callback): Take new "connection" argument. Call
Client.checker_callback early to have
it set last_checker_status and
last_checker_signal; use those. Change
second value provided to D-Bus signal
CheckerCompleted to use
last_checker_signal if checker was
terminated by signal.
mandos-monitor: Update to reflect DBus API change.
(MandosClientWidget.checker_completed): Take "signal" instead of
"condition" argument. Use it
accordingly. Remove dead code
(os.WCOREDUMP case).
For a long time, the Mandos server has occasionally logged the message
"ERROR: Child process vanished". This was never a fatal error, but it
has been annoying and slightly worrying, since a definite cause was
not found. One potential cause could be the "multiprocessing" and
"subprocess" modules conflicting w.r.t. SIGCHLD. To avoid this,
change the running of checkers from using subprocess.Popen
asynchronously to instead first create a multiprocessing.Process()
(which is asynchronous) calling a function, and have that function
then call subprocess.call() (which is synchronous). In this way, the
only thing using any asynchronous subprocesses is the multiprocessing
module.
This makes it necessary to change one small thing in the D-Bus API,
since the subprocesses.call() function does not expose the raw wait(2)
status value.
DBUS-API (CheckerCompleted): Change the second value provided by this
D-Bus signal from the raw wait(2) status
to the actual terminating signal number.
mandos (subprocess_call_pipe): New function to be called by
multiprocessing.Process (starting a
separate process).
(Client.last_checker signal): New attribute for signal which
terminated last checker. Like
last_checker_status, only not accessible
via D-Bus.
(Client.checker_callback): Take new "connection" argument and use it
to get returncode; set last_checker_signal.
Return False so gobject does not call this
callback again.
(Client.start_checker): Start checker using a multiprocessing.Process
instead of a subprocess.Popen.
(ClientDBus.checker_callback): Take new "connection" argument. Call
Client.checker_callback early to have
it set last_checker_status and
last_checker_signal; use those. Change
second value provided to D-Bus signal
CheckerCompleted to use
last_checker_signal if checker was
terminated by signal.
mandos-monitor: Update to reflect DBus API change.
(MandosClientWidget.checker_completed): Take "signal" instead of
"condition" argument. Use it
accordingly. Remove dead code
(os.WCOREDUMP case).
- files added:
- debian/upstream
- files modified:
- DBUS-API
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2012 Teddy Hogeborn
13
* Copyright © 2008-2012 Björn Påhlsson
12
* Copyright © 2008-2014 Teddy Hogeborn
13
* Copyright © 2008-2014 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
33
#ifndef _LARGEFILE_SOURCE
34
34
#define _LARGEFILE_SOURCE
35
#endif
35
#endif /* not _LARGEFILE_SOURCE */
36
36
#ifndef _FILE_OFFSET_BITS
37
37
#define _FILE_OFFSET_BITS 64
38
#endif
38
#endif /* not _FILE_OFFSET_BITS */
39
39
40
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
41
42
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
43
stdout, ferror() */
44
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
55
55
opendir(), DIR */
56
56
#include <sys/stat.h> /* open(), S_ISREG */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
58
inet_pton(), connect(),
59
getnameinfo() */
60
#include <fcntl.h> /* open(), unlinkat() */
60
61
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
62
*/
62
63
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
72
73
*/
73
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
75
getuid(), getgid(), seteuid(),
75
setgid(), pause(), _exit() */
76
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
76
setgid(), pause(), _exit(),
77
unlinkat() */
78
#include <arpa/inet.h> /* inet_pton(), htons() */
77
79
#include <iso646.h> /* not, or, and */
78
80
#include <argp.h> /* struct argp_option, error_t, struct
79
81
argp_state, struct argp,
91
93
argz_delete(), argz_append(),
92
94
argz_stringify(), argz_add(),
93
95
argz_count() */
96
#include <netdb.h> /* getnameinfo(), NI_NUMERICHOST,
97
EAI_SYSTEM, gai_strerror() */
94
98
95
99
#ifdef __linux__
96
100
#include <sys/klog.h> /* klogctl() */
138
142
static const char sys_class_net[] = "/sys/class/net";
139
143
char *connect_to = NULL;
140
144
const char *hookdir = HOOKDIR;
145
int hookdir_fd = -1;
141
146
uid_t uid = 65534;
142
147
gid_t gid = 65534;
143
148
154
159
155
160
/* Used for passing in values through the Avahi callback functions */
156
161
typedef struct {
157
AvahiSimplePoll *simple_poll;
158
162
AvahiServer *server;
159
163
gnutls_certificate_credentials_t cred;
160
164
unsigned int dh_bits;
162
166
const char *priority;
163
167
gpgme_ctx_t ctx;
164
168
server *current_server;
169
char *interfaces;
170
size_t interfaces_size;
165
171
} mandos_context;
166
172
167
/* global context so signal handler can reach it*/
168
mandos_context mc = { .simple_poll = NULL, .server = NULL,
169
.dh_bits = 1024, .priority = "SECURE256"
170
":!CTYPE-X.509:+CTYPE-OPENPGP",
171
.current_server = NULL };
173
/* global so signal handler can reach it*/
174
AvahiSimplePoll *simple_poll;
172
175
173
176
sig_atomic_t quit_now = 0;
174
177
int signal_received = 0;
182
185
perror(print_text);
183
186
}
184
187
185
__attribute__((format (gnu_printf, 2, 3)))
188
__attribute__((format (gnu_printf, 2, 3), nonnull))
186
189
int fprintf_plus(FILE *stream, const char *format, ...){
187
190
va_list ap;
188
191
va_start (ap, format);
189
192
190
193
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
191
194
program_invocation_short_name));
192
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
195
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
193
196
}
194
197
195
198
/*
197
200
* bytes. "buffer_capacity" is how much is currently allocated,
198
201
* "buffer_length" is how much is already used.
199
202
*/
203
__attribute__((nonnull, warn_unused_result))
200
204
size_t incbuffer(char **buffer, size_t buffer_length,
201
205
size_t buffer_capacity){
202
206
if(buffer_length + BUFFER_SIZE > buffer_capacity){
203
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
204
if(buffer == NULL){
207
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
208
if(new_buf == NULL){
209
int old_errno = errno;
210
free(*buffer);
211
errno = old_errno;
212
*buffer = NULL;
205
213
return 0;
206
214
}
215
*buffer = new_buf;
207
216
buffer_capacity += BUFFER_SIZE;
208
217
}
209
218
return buffer_capacity;
210
219
}
211
220
212
221
/* Add server to set of servers to retry periodically */
222
__attribute__((nonnull, warn_unused_result))
213
223
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
214
int af){
224
int af, server **current_server){
215
225
int ret;
216
226
server *new_server = malloc(sizeof(server));
217
227
if(new_server == NULL){
224
234
.af = af };
225
235
if(new_server->ip == NULL){
226
236
perror_plus("strdup");
237
free(new_server);
238
return false;
239
}
240
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
241
if(ret == -1){
242
perror_plus("clock_gettime");
243
#ifdef __GNUC__
244
#pragma GCC diagnostic push
245
#pragma GCC diagnostic ignored "-Wcast-qual"
246
#endif
247
free((char *)(new_server->ip));
248
#ifdef __GNUC__
249
#pragma GCC diagnostic pop
250
#endif
251
free(new_server);
227
252
return false;
228
253
}
229
254
/* Special case of first server */
230
if (mc.current_server == NULL){
255
if(*current_server == NULL){
231
256
new_server->next = new_server;
232
257
new_server->prev = new_server;
233
mc.current_server = new_server;
234
/* Place the new server last in the list */
258
*current_server = new_server;
235
259
} else {
236
new_server->next = mc.current_server;
237
new_server->prev = mc.current_server->prev;
260
/* Place the new server last in the list */
261
new_server->next = *current_server;
262
new_server->prev = (*current_server)->prev;
238
263
new_server->prev->next = new_server;
239
mc.current_server->prev = new_server;
240
}
241
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
242
if(ret == -1){
243
perror_plus("clock_gettime");
244
return false;
264
(*current_server)->prev = new_server;
245
265
}
246
266
return true;
247
267
}
249
269
/*
250
270
* Initialize GPGME.
251
271
*/
252
static bool init_gpgme(const char *seckey, const char *pubkey,
253
const char *tempdir){
272
__attribute__((nonnull, warn_unused_result))
273
static bool init_gpgme(const char * const seckey,
274
const char * const pubkey,
275
const char * const tempdir,
276
mandos_context *mc){
254
277
gpgme_error_t rc;
255
278
gpgme_engine_info_t engine_info;
256
279
257
258
280
/*
259
281
* Helper function to insert pub and seckey to the engine keyring.
260
282
*/
261
bool import_key(const char *filename){
283
bool import_key(const char * const filename){
262
284
int ret;
263
285
int fd;
264
286
gpgme_data_t pgp_data;
276
298
return false;
277
299
}
278
300
279
rc = gpgme_op_import(mc.ctx, pgp_data);
301
rc = gpgme_op_import(mc->ctx, pgp_data);
280
302
if(rc != GPG_ERR_NO_ERROR){
281
303
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
282
304
gpgme_strsource(rc), gpgme_strerror(rc));
326
348
}
327
349
328
350
/* Create new GPGME "context" */
329
rc = gpgme_new(&(mc.ctx));
351
rc = gpgme_new(&(mc->ctx));
330
352
if(rc != GPG_ERR_NO_ERROR){
331
353
fprintf_plus(stderr, "Mandos plugin mandos-client: "
332
354
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
345
367
* Decrypt OpenPGP data.
346
368
* Returns -1 on error
347
369
*/
370
__attribute__((nonnull, warn_unused_result))
348
371
static ssize_t pgp_packet_decrypt(const char *cryptotext,
349
372
size_t crypto_size,
350
char **plaintext){
373
char **plaintext,
374
mandos_context *mc){
351
375
gpgme_data_t dh_crypto, dh_plain;
352
376
gpgme_error_t rc;
353
377
ssize_t ret;
379
403
380
404
/* Decrypt data from the cryptotext data buffer to the plaintext
381
405
data buffer */
382
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
406
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
383
407
if(rc != GPG_ERR_NO_ERROR){
384
408
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
385
409
gpgme_strsource(rc), gpgme_strerror(rc));
386
410
plaintext_length = -1;
387
411
if(debug){
388
412
gpgme_decrypt_result_t result;
389
result = gpgme_op_decrypt_result(mc.ctx);
413
result = gpgme_op_decrypt_result(mc->ctx);
390
414
if(result == NULL){
391
415
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
392
416
} else {
469
493
return plaintext_length;
470
494
}
471
495
472
static const char * safer_gnutls_strerror(int value){
496
__attribute__((warn_unused_result, const))
497
static const char *safe_string(const char *str){
498
if(str == NULL)
499
return "(unknown)";
500
return str;
501
}
502
503
__attribute__((warn_unused_result))
504
static const char *safer_gnutls_strerror(int value){
473
505
const char *ret = gnutls_strerror(value);
474
if(ret == NULL)
475
ret = "(unknown)";
476
return ret;
506
return safe_string(ret);
477
507
}
478
508
479
509
/* GnuTLS log function callback */
510
__attribute__((nonnull))
480
511
static void debuggnutls(__attribute__((unused)) int level,
481
512
const char* string){
482
513
fprintf_plus(stderr, "GnuTLS: %s", string);
483
514
}
484
515
516
__attribute__((nonnull, warn_unused_result))
485
517
static int init_gnutls_global(const char *pubkeyfilename,
486
const char *seckeyfilename){
518
const char *seckeyfilename,
519
mandos_context *mc){
487
520
int ret;
521
unsigned int uret;
488
522
489
523
if(debug){
490
524
fprintf_plus(stderr, "Initializing GnuTLS\n");
506
540
}
507
541
508
542
/* OpenPGP credentials */
509
ret = gnutls_certificate_allocate_credentials(&mc.cred);
543
ret = gnutls_certificate_allocate_credentials(&mc->cred);
510
544
if(ret != GNUTLS_E_SUCCESS){
511
545
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
512
546
safer_gnutls_strerror(ret));
522
556
}
523
557
524
558
ret = gnutls_certificate_set_openpgp_key_file
525
(mc.cred, pubkeyfilename, seckeyfilename,
559
(mc->cred, pubkeyfilename, seckeyfilename,
526
560
GNUTLS_OPENPGP_FMT_BASE64);
527
561
if(ret != GNUTLS_E_SUCCESS){
528
562
fprintf_plus(stderr,
534
568
}
535
569
536
570
/* GnuTLS server initialization */
537
ret = gnutls_dh_params_init(&mc.dh_params);
571
ret = gnutls_dh_params_init(&mc->dh_params);
538
572
if(ret != GNUTLS_E_SUCCESS){
539
573
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
540
574
" initialization: %s\n",
541
575
safer_gnutls_strerror(ret));
542
576
goto globalfail;
543
577
}
544
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
578
if(mc->dh_bits == 0){
579
/* Find out the optimal number of DH bits */
580
/* Try to read the private key file */
581
gnutls_datum_t buffer = { .data = NULL, .size = 0 };
582
{
583
int secfile = open(seckeyfilename, O_RDONLY);
584
size_t buffer_capacity = 0;
585
while(true){
586
buffer_capacity = incbuffer((char **)&buffer.data,
587
(size_t)buffer.size,
588
(size_t)buffer_capacity);
589
if(buffer_capacity == 0){
590
perror_plus("incbuffer");
591
free(buffer.data);
592
buffer.data = NULL;
593
break;
594
}
595
ssize_t bytes_read = read(secfile, buffer.data + buffer.size,
596
BUFFER_SIZE);
597
/* EOF */
598
if(bytes_read == 0){
599
break;
600
}
601
/* check bytes_read for failure */
602
if(bytes_read < 0){
603
perror_plus("read");
604
free(buffer.data);
605
buffer.data = NULL;
606
break;
607
}
608
buffer.size += (unsigned int)bytes_read;
609
}
610
close(secfile);
611
}
612
/* If successful, use buffer to parse private key */
613
gnutls_sec_param_t sec_param = GNUTLS_SEC_PARAM_ULTRA;
614
if(buffer.data != NULL){
615
{
616
gnutls_openpgp_privkey_t privkey = NULL;
617
ret = gnutls_openpgp_privkey_init(&privkey);
618
if(ret != GNUTLS_E_SUCCESS){
619
fprintf_plus(stderr, "Error initializing OpenPGP key"
620
" structure: %s", safer_gnutls_strerror(ret));
621
free(buffer.data);
622
buffer.data = NULL;
623
} else {
624
ret = gnutls_openpgp_privkey_import(privkey, &buffer,
625
GNUTLS_OPENPGP_FMT_BASE64,
626
"", 0);
627
if(ret != GNUTLS_E_SUCCESS){
628
fprintf_plus(stderr, "Error importing OpenPGP key : %s",
629
safer_gnutls_strerror(ret));
630
privkey = NULL;
631
}
632
free(buffer.data);
633
buffer.data = NULL;
634
if(privkey != NULL){
635
/* Use private key to suggest an appropriate sec_param */
636
sec_param = gnutls_openpgp_privkey_sec_param(privkey);
637
gnutls_openpgp_privkey_deinit(privkey);
638
if(debug){
639
fprintf_plus(stderr, "This OpenPGP key implies using a"
640
" GnuTLS security parameter \"%s\".\n",
641
safe_string(gnutls_sec_param_get_name
642
(sec_param)));
643
}
644
}
645
}
646
}
647
if(sec_param == GNUTLS_SEC_PARAM_UNKNOWN){
648
/* Err on the side of caution */
649
sec_param = GNUTLS_SEC_PARAM_ULTRA;
650
if(debug){
651
fprintf_plus(stderr, "Falling back to security parameter"
652
" \"%s\"\n",
653
safe_string(gnutls_sec_param_get_name
654
(sec_param)));
655
}
656
}
657
}
658
uret = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, sec_param);
659
if(uret != 0){
660
mc->dh_bits = uret;
661
if(debug){
662
fprintf_plus(stderr, "A \"%s\" GnuTLS security parameter"
663
" implies %u DH bits; using that.\n",
664
safe_string(gnutls_sec_param_get_name
665
(sec_param)),
666
mc->dh_bits);
667
}
668
} else {
669
fprintf_plus(stderr, "Failed to get implied number of DH"
670
" bits for security parameter \"%s\"): %s\n",
671
safe_string(gnutls_sec_param_get_name(sec_param)),
672
safer_gnutls_strerror(ret));
673
goto globalfail;
674
}
675
} else if(debug){
676
fprintf_plus(stderr, "DH bits explicitly set to %u\n",
677
mc->dh_bits);
678
}
679
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
545
680
if(ret != GNUTLS_E_SUCCESS){
546
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
547
safer_gnutls_strerror(ret));
681
fprintf_plus(stderr, "Error in GnuTLS prime generation (%u bits):"
682
" %s\n", mc->dh_bits, safer_gnutls_strerror(ret));
548
683
goto globalfail;
549
684
}
550
685
551
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
686
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
552
687
553
688
return 0;
554
689
555
690
globalfail:
556
691
557
gnutls_certificate_free_credentials(mc.cred);
692
gnutls_certificate_free_credentials(mc->cred);
558
693
gnutls_global_deinit();
559
gnutls_dh_params_deinit(mc.dh_params);
694
gnutls_dh_params_deinit(mc->dh_params);
560
695
return -1;
561
696
}
562
697
563
static int init_gnutls_session(gnutls_session_t *session){
698
__attribute__((nonnull, warn_unused_result))
699
static int init_gnutls_session(gnutls_session_t *session,
700
mandos_context *mc){
564
701
int ret;
565
702
/* GnuTLS session creation */
566
703
do {
578
715
{
579
716
const char *err;
580
717
do {
581
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
718
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
582
719
if(quit_now){
583
720
gnutls_deinit(*session);
584
721
return -1;
595
732
596
733
do {
597
734
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
598
mc.cred);
735
mc->cred);
599
736
if(quit_now){
600
737
gnutls_deinit(*session);
601
738
return -1;
611
748
/* ignore client certificate if any. */
612
749
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
613
750
614
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
751
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
615
752
616
753
return 0;
617
754
}
621
758
__attribute__((unused)) const char *txt){}
622
759
623
760
/* Called when a Mandos server is found */
761
__attribute__((nonnull, warn_unused_result))
624
762
static int start_mandos_communication(const char *ip, in_port_t port,
625
763
AvahiIfIndex if_index,
626
int af){
764
int af, mandos_context *mc){
627
765
int ret, tcp_sd = -1;
628
766
ssize_t sret;
629
union {
630
struct sockaddr_in in;
631
struct sockaddr_in6 in6;
632
} to;
767
struct sockaddr_storage to;
633
768
char *buffer = NULL;
634
769
char *decrypted_buffer = NULL;
635
770
size_t buffer_length = 0;
659
794
return -1;
660
795
}
661
796
662
ret = init_gnutls_session(&session);
797
/* If the interface is specified and we have a list of interfaces */
798
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
799
/* Check if the interface is one of the interfaces we are using */
800
bool match = false;
801
{
802
char *interface = NULL;
803
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
804
interface))){
805
if(if_nametoindex(interface) == (unsigned int)if_index){
806
match = true;
807
break;
808
}
809
}
810
}
811
if(not match){
812
/* This interface does not match any in the list, so we don't
813
connect to the server */
814
if(debug){
815
char interface[IF_NAMESIZE];
816
if(if_indextoname((unsigned int)if_index, interface) == NULL){
817
perror_plus("if_indextoname");
818
} else {
819
fprintf_plus(stderr, "Skipping server on non-used interface"
820
" \"%s\"\n",
821
if_indextoname((unsigned int)if_index,
822
interface));
823
}
824
}
825
return -1;
826
}
827
}
828
829
ret = init_gnutls_session(&session, mc);
663
830
if(ret != 0){
664
831
return -1;
665
832
}
684
851
685
852
memset(&to, 0, sizeof(to));
686
853
if(af == AF_INET6){
687
to.in6.sin6_family = (sa_family_t)af;
688
ret = inet_pton(af, ip, &to.in6.sin6_addr);
854
((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;
855
ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);
689
856
} else { /* IPv4 */
690
to.in.sin_family = (sa_family_t)af;
691
ret = inet_pton(af, ip, &to.in.sin_addr);
857
((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;
858
ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);
692
859
}
693
860
if(ret < 0 ){
694
861
int e = errno;
703
870
goto mandos_end;
704
871
}
705
872
if(af == AF_INET6){
706
to.in6.sin6_port = htons(port);
707
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
708
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
709
-Wunreachable-code*/
873
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
874
if(IN6_IS_ADDR_LINKLOCAL
875
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
710
876
if(if_index == AVAHI_IF_UNSPEC){
711
877
fprintf_plus(stderr, "An IPv6 link-local address is"
712
878
" incomplete without a network interface\n");
714
880
goto mandos_end;
715
881
}
716
882
/* Set the network interface number as scope */
717
to.in6.sin6_scope_id = (uint32_t)if_index;
883
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
718
884
}
719
885
} else {
720
to.in.sin_port = htons(port); /* Spurious warnings from
721
-Wconversion and
722
-Wunreachable-code */
886
((struct sockaddr_in *)&to)->sin_port = htons(port);
723
887
}
724
888
725
889
if(quit_now){
742
906
}
743
907
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
744
908
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
745
const char *pcret;
746
909
if(af == AF_INET6){
747
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
748
sizeof(addrstr));
910
ret = getnameinfo((struct sockaddr *)&to,
911
sizeof(struct sockaddr_in6),
912
addrstr, sizeof(addrstr), NULL, 0,
913
NI_NUMERICHOST);
749
914
} else {
750
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
751
sizeof(addrstr));
915
ret = getnameinfo((struct sockaddr *)&to,
916
sizeof(struct sockaddr_in),
917
addrstr, sizeof(addrstr), NULL, 0,
918
NI_NUMERICHOST);
752
919
}
753
if(pcret == NULL){
754
perror_plus("inet_ntop");
755
} else {
756
if(strcmp(addrstr, ip) != 0){
757
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
758
}
920
if(ret == EAI_SYSTEM){
921
perror_plus("getnameinfo");
922
} else if(ret != 0) {
923
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
924
} else if(strcmp(addrstr, ip) != 0){
925
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
759
926
}
760
927
}
761
928
765
932
}
766
933
767
934
if(af == AF_INET6){
768
ret = connect(tcp_sd, &to.in6, sizeof(to));
935
ret = connect(tcp_sd, (struct sockaddr *)&to,
936
sizeof(struct sockaddr_in6));
769
937
} else {
770
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
938
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
939
sizeof(struct sockaddr_in));
771
940
}
772
941
if(ret < 0){
773
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
942
if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
774
943
int e = errno;
775
944
perror_plus("connect");
776
945
errno = e;
937
1106
if(buffer_length > 0){
938
1107
ssize_t decrypted_buffer_size;
939
1108
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
940
&decrypted_buffer);
1109
&decrypted_buffer, mc);
941
1110
if(decrypted_buffer_size >= 0){
942
1111
943
1112
written = 0;
991
1160
return retval;
992
1161
}
993
1162
1163
__attribute__((nonnull))
994
1164
static void resolve_callback(AvahiSServiceResolver *r,
995
1165
AvahiIfIndex interface,
996
1166
AvahiProtocol proto,
1004
1174
AVAHI_GCC_UNUSED AvahiStringList *txt,
1005
1175
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1006
1176
flags,
1007
AVAHI_GCC_UNUSED void* userdata){
1177
void *mc){
1008
1178
if(r == NULL){
1009
1179
return;
1010
1180
}
1013
1183
timed out */
1014
1184
1015
1185
if(quit_now){
1186
avahi_s_service_resolver_free(r);
1016
1187
return;
1017
1188
}
1018
1189
1022
1193
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1023
1194
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1024
1195
domain,
1025
avahi_strerror(avahi_server_errno(mc.server)));
1196
avahi_strerror(avahi_server_errno
1197
(((mandos_context*)mc)->server)));
1026
1198
break;
1027
1199
1028
1200
case AVAHI_RESOLVER_FOUND:
1036
1208
}
1037
1209
int ret = start_mandos_communication(ip, (in_port_t)port,
1038
1210
interface,
1039
avahi_proto_to_af(proto));
1211
avahi_proto_to_af(proto),
1212
mc);
1040
1213
if(ret == 0){
1041
avahi_simple_poll_quit(mc.simple_poll);
1214
avahi_simple_poll_quit(simple_poll);
1042
1215
} else {
1043
1216
if(not add_server(ip, (in_port_t)port, interface,
1044
avahi_proto_to_af(proto))){
1217
avahi_proto_to_af(proto),
1218
&((mandos_context*)mc)->current_server)){
1045
1219
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1046
1220
" list\n", name);
1047
1221
}
1060
1234
const char *domain,
1061
1235
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1062
1236
flags,
1063
AVAHI_GCC_UNUSED void* userdata){
1237
void *mc){
1064
1238
if(b == NULL){
1065
1239
return;
1066
1240
}
1077
1251
case AVAHI_BROWSER_FAILURE:
1078
1252
1079
1253
fprintf_plus(stderr, "(Avahi browser) %s\n",
1080
avahi_strerror(avahi_server_errno(mc.server)));
1081
avahi_simple_poll_quit(mc.simple_poll);
1254
avahi_strerror(avahi_server_errno
1255
(((mandos_context*)mc)->server)));
1256
avahi_simple_poll_quit(simple_poll);
1082
1257
return;
1083
1258
1084
1259
case AVAHI_BROWSER_NEW:
1087
1262
the callback function is called the Avahi server will free the
1088
1263
resolver for us. */
1089
1264
1090
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1091
name, type, domain, protocol, 0,
1092
resolve_callback, NULL) == NULL)
1265
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1266
interface, protocol, name, type,
1267
domain, protocol, 0,
1268
resolve_callback, mc) == NULL)
1093
1269
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1094
1270
" %s\n", name,
1095
avahi_strerror(avahi_server_errno(mc.server)));
1271
avahi_strerror(avahi_server_errno
1272
(((mandos_context*)mc)->server)));
1096
1273
break;
1097
1274
1098
1275
case AVAHI_BROWSER_REMOVE:
1117
1294
signal_received = sig;
1118
1295
int old_errno = errno;
1119
1296
/* set main loop to exit */
1120
if(mc.simple_poll != NULL){
1121
avahi_simple_poll_quit(mc.simple_poll);
1297
if(simple_poll != NULL){
1298
avahi_simple_poll_quit(simple_poll);
1122
1299
}
1123
1300
errno = old_errno;
1124
1301
}
1125
1302
1303
__attribute__((nonnull, warn_unused_result))
1126
1304
bool get_flags(const char *ifname, struct ifreq *ifr){
1127
1305
int ret;
1128
1306
error_t ret_errno;
1147
1325
return true;
1148
1326
}
1149
1327
1328
__attribute__((nonnull, warn_unused_result))
1150
1329
bool good_flags(const char *ifname, const struct ifreq *ifr){
1151
1330
1152
1331
/* Reject the loopback device */
1194
1373
* corresponds to an acceptable network device.
1195
1374
* (This function is passed to scandir(3) as a filter function.)
1196
1375
*/
1376
__attribute__((nonnull, warn_unused_result))
1197
1377
int good_interface(const struct dirent *if_entry){
1198
1378
if(if_entry->d_name[0] == '.'){
1199
1379
return 0;
1217
1397
/*
1218
1398
* This function determines if a network interface is up.
1219
1399
*/
1400
__attribute__((nonnull, warn_unused_result))
1220
1401
bool interface_is_up(const char *interface){
1221
1402
struct ifreq ifr;
1222
1403
if(not get_flags(interface, &ifr)){
1233
1414
/*
1234
1415
* This function determines if a network interface is running
1235
1416
*/
1417
__attribute__((nonnull, warn_unused_result))
1236
1418
bool interface_is_running(const char *interface){
1237
1419
struct ifreq ifr;
1238
1420
if(not get_flags(interface, &ifr)){
1246
1428
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1247
1429
}
1248
1430
1431
__attribute__((nonnull, pure, warn_unused_result))
1249
1432
int notdotentries(const struct dirent *direntry){
1250
1433
/* Skip "." and ".." */
1251
1434
if(direntry->d_name[0] == '.'
1258
1441
}
1259
1442
1260
1443
/* Is this directory entry a runnable program? */
1444
__attribute__((nonnull, warn_unused_result))
1261
1445
int runnable_hook(const struct dirent *direntry){
1262
1446
int ret;
1263
1447
size_t sret;
1271
1455
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1272
1456
"abcdefghijklmnopqrstuvwxyz"
1273
1457
"0123456789"
1274
"_-");
1458
"_.-");
1275
1459
if((direntry->d_name)[sret] != '\0'){
1276
1460
/* Contains non-allowed characters */
1277
1461
if(debug){
1281
1465
return 0;
1282
1466
}
1283
1467
1284
char *fullname = NULL;
1285
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1286
if(ret < 0){
1287
perror_plus("asprintf");
1288
return 0;
1289
}
1290
1291
ret = stat(fullname, &st);
1468
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1292
1469
if(ret == -1){
1293
1470
if(debug){
1294
1471
perror_plus("Could not stat hook");
1318
1495
return 1;
1319
1496
}
1320
1497
1321
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1498
__attribute__((nonnull, warn_unused_result))
1499
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1500
mandos_context *mc){
1322
1501
int ret;
1323
1502
struct timespec now;
1324
1503
struct timespec waited_time;
1325
1504
intmax_t block_time;
1326
1505
1327
1506
while(true){
1328
if(mc.current_server == NULL){
1329
if (debug){
1507
if(mc->current_server == NULL){
1508
if(debug){
1330
1509
fprintf_plus(stderr, "Wait until first server is found."
1331
1510
" No timeout!\n");
1332
1511
}
1333
1512
ret = avahi_simple_poll_iterate(s, -1);
1334
1513
} else {
1335
if (debug){
1514
if(debug){
1336
1515
fprintf_plus(stderr, "Check current_server if we should run"
1337
1516
" it, or wait\n");
1338
1517
}
1345
1524
/* Calculating in ms how long time between now and server
1346
1525
who we visted longest time ago. Now - last seen. */
1347
1526
waited_time.tv_sec = (now.tv_sec
1348
- mc.current_server->last_seen.tv_sec);
1527
- mc->current_server->last_seen.tv_sec);
1349
1528
waited_time.tv_nsec = (now.tv_nsec
1350
- mc.current_server->last_seen.tv_nsec);
1529
- mc->current_server->last_seen.tv_nsec);
1351
1530
/* total time is 10s/10,000ms.
1352
1531
Converting to s from ms by dividing by 1,000,
1353
1532
and ns to ms by dividing by 1,000,000. */
1355
1534
- ((intmax_t)waited_time.tv_sec * 1000))
1356
1535
- ((intmax_t)waited_time.tv_nsec / 1000000));
1357
1536
1358
if (debug){
1537
if(debug){
1359
1538
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1360
1539
block_time);
1361
1540
}
1362
1541
1363
1542
if(block_time <= 0){
1364
ret = start_mandos_communication(mc.current_server->ip,
1365
mc.current_server->port,
1366
mc.current_server->if_index,
1367
mc.current_server->af);
1543
ret = start_mandos_communication(mc->current_server->ip,
1544
mc->current_server->port,
1545
mc->current_server->if_index,
1546
mc->current_server->af, mc);
1368
1547
if(ret == 0){
1369
avahi_simple_poll_quit(mc.simple_poll);
1548
avahi_simple_poll_quit(s);
1370
1549
return 0;
1371
1550
}
1372
1551
ret = clock_gettime(CLOCK_MONOTONIC,
1373
&mc.current_server->last_seen);
1552
&mc->current_server->last_seen);
1374
1553
if(ret == -1){
1375
1554
perror_plus("clock_gettime");
1376
1555
return -1;
1377
1556
}
1378
mc.current_server = mc.current_server->next;
1557
mc->current_server = mc->current_server->next;
1379
1558
block_time = 0; /* Call avahi to find new Mandos
1380
1559
servers, but don't block */
1381
1560
}
1383
1562
ret = avahi_simple_poll_iterate(s, (int)block_time);
1384
1563
}
1385
1564
if(ret != 0){
1386
if (ret > 0 or errno != EINTR){
1565
if(ret > 0 or errno != EINTR){
1387
1566
return (ret != 1) ? ret : 0;
1388
1567
}
1389
1568
}
1391
1570
}
1392
1571
1393
1572
/* Set effective uid to 0, return errno */
1573
__attribute__((warn_unused_result))
1394
1574
error_t raise_privileges(void){
1395
1575
error_t old_errno = errno;
1396
1576
error_t ret_errno = 0;
1397
1577
if(seteuid(0) == -1){
1398
1578
ret_errno = errno;
1399
perror_plus("seteuid");
1400
1579
}
1401
1580
errno = old_errno;
1402
1581
return ret_errno;
1403
1582
}
1404
1583
1405
1584
/* Set effective and real user ID to 0. Return errno. */
1585
__attribute__((warn_unused_result))
1406
1586
error_t raise_privileges_permanently(void){
1407
1587
error_t old_errno = errno;
1408
1588
error_t ret_errno = raise_privileges();
1412
1592
}
1413
1593
if(setuid(0) == -1){
1414
1594
ret_errno = errno;
1415
perror_plus("seteuid");
1416
1595
}
1417
1596
errno = old_errno;
1418
1597
return ret_errno;
1419
1598
}
1420
1599
1421
1600
/* Set effective user ID to unprivileged saved user ID */
1601
__attribute__((warn_unused_result))
1422
1602
error_t lower_privileges(void){
1423
1603
error_t old_errno = errno;
1424
1604
error_t ret_errno = 0;
1425
1605
if(seteuid(uid) == -1){
1426
1606
ret_errno = errno;
1427
perror_plus("seteuid");
1428
1607
}
1429
1608
errno = old_errno;
1430
1609
return ret_errno;
1431
1610
}
1432
1611
1433
1612
/* Lower privileges permanently */
1613
__attribute__((warn_unused_result))
1434
1614
error_t lower_privileges_permanently(void){
1435
1615
error_t old_errno = errno;
1436
1616
error_t ret_errno = 0;
1437
1617
if(setuid(uid) == -1){
1438
1618
ret_errno = errno;
1439
perror_plus("setuid");
1440
1619
}
1441
1620
errno = old_errno;
1442
1621
return ret_errno;
1443
1622
}
1444
1623
1445
bool run_network_hooks(const char *mode, const char *interface,
1624
__attribute__((nonnull))
1625
void run_network_hooks(const char *mode, const char *interface,
1446
1626
const float delay){
1447
struct dirent **direntries;
1627
struct dirent **direntries = NULL;
1628
if(hookdir_fd == -1){
1629
hookdir_fd = open(hookdir, O_RDONLY);
1630
if(hookdir_fd == -1){
1631
if(errno == ENOENT){
1632
if(debug){
1633
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1634
" found\n", hookdir);
1635
}
1636
} else {
1637
perror_plus("open");
1638
}
1639
return;
1640
}
1641
}
1642
#ifdef __GLIBC__
1643
#if __GLIBC_PREREQ(2, 15)
1644
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1645
runnable_hook, alphasort);
1646
#else /* not __GLIBC_PREREQ(2, 15) */
1647
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1648
alphasort);
1649
#endif /* not __GLIBC_PREREQ(2, 15) */
1650
#else /* not __GLIBC__ */
1651
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1652
alphasort);
1653
#endif /* not __GLIBC__ */
1654
if(numhooks == -1){
1655
perror_plus("scandir");
1656
return;
1657
}
1448
1658
struct dirent *direntry;
1449
1659
int ret;
1450
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1451
alphasort);
1452
if(numhooks == -1){
1453
if(errno == ENOENT){
1454
if(debug){
1455
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1456
" found\n", hookdir);
1457
}
1458
} else {
1459
perror_plus("scandir");
1660
int devnull = open("/dev/null", O_RDONLY);
1661
for(int i = 0; i < numhooks; i++){
1662
direntry = direntries[i];
1663
if(debug){
1664
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1665
direntry->d_name);
1460
1666
}
1461
} else {
1462
int devnull = open("/dev/null", O_RDONLY);
1463
for(int i = 0; i < numhooks; i++){
1464
direntry = direntries[i];
1465
char *fullname = NULL;
1466
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1467
if(ret < 0){
1667
pid_t hook_pid = fork();
1668
if(hook_pid == 0){
1669
/* Child */
1670
/* Raise privileges */
1671
errno = raise_privileges_permanently();
1672
if(errno != 0){
1673
perror_plus("Failed to raise privileges");
1674
_exit(EX_NOPERM);
1675
}
1676
/* Set group */
1677
errno = 0;
1678
ret = setgid(0);
1679
if(ret == -1){
1680
perror_plus("setgid");
1681
_exit(EX_NOPERM);
1682
}
1683
/* Reset supplementary groups */
1684
errno = 0;
1685
ret = setgroups(0, NULL);
1686
if(ret == -1){
1687
perror_plus("setgroups");
1688
_exit(EX_NOPERM);
1689
}
1690
ret = dup2(devnull, STDIN_FILENO);
1691
if(ret == -1){
1692
perror_plus("dup2(devnull, STDIN_FILENO)");
1693
_exit(EX_OSERR);
1694
}
1695
ret = close(devnull);
1696
if(ret == -1){
1697
perror_plus("close");
1698
_exit(EX_OSERR);
1699
}
1700
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1701
if(ret == -1){
1702
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1703
_exit(EX_OSERR);
1704
}
1705
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1706
if(ret == -1){
1707
perror_plus("setenv");
1708
_exit(EX_OSERR);
1709
}
1710
ret = setenv("DEVICE", interface, 1);
1711
if(ret == -1){
1712
perror_plus("setenv");
1713
_exit(EX_OSERR);
1714
}
1715
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1716
if(ret == -1){
1717
perror_plus("setenv");
1718
_exit(EX_OSERR);
1719
}
1720
ret = setenv("MODE", mode, 1);
1721
if(ret == -1){
1722
perror_plus("setenv");
1723
_exit(EX_OSERR);
1724
}
1725
char *delaystring;
1726
ret = asprintf(&delaystring, "%f", (double)delay);
1727
if(ret == -1){
1468
1728
perror_plus("asprintf");
1469
continue;
1470
}
1471
if(debug){
1472
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1473
direntry->d_name);
1474
}
1475
pid_t hook_pid = fork();
1476
if(hook_pid == 0){
1477
/* Child */
1478
/* Raise privileges */
1479
raise_privileges_permanently();
1480
/* Set group */
1481
errno = 0;
1482
ret = setgid(0);
1483
if(ret == -1){
1484
perror_plus("setgid");
1485
}
1486
/* Reset supplementary groups */
1487
errno = 0;
1488
ret = setgroups(0, NULL);
1489
if(ret == -1){
1490
perror_plus("setgroups");
1491
}
1492
dup2(devnull, STDIN_FILENO);
1493
close(devnull);
1494
dup2(STDERR_FILENO, STDOUT_FILENO);
1495
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1496
if(ret == -1){
1497
perror_plus("setenv");
1498
_exit(EX_OSERR);
1499
}
1500
ret = setenv("DEVICE", interface, 1);
1501
if(ret == -1){
1502
perror_plus("setenv");
1503
_exit(EX_OSERR);
1504
}
1505
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1506
if(ret == -1){
1507
perror_plus("setenv");
1508
_exit(EX_OSERR);
1509
}
1510
ret = setenv("MODE", mode, 1);
1511
if(ret == -1){
1512
perror_plus("setenv");
1513
_exit(EX_OSERR);
1514
}
1515
char *delaystring;
1516
ret = asprintf(&delaystring, "%f", delay);
1517
if(ret == -1){
1518
perror_plus("asprintf");
1519
_exit(EX_OSERR);
1520
}
1521
ret = setenv("DELAY", delaystring, 1);
1522
if(ret == -1){
1523
free(delaystring);
1524
perror_plus("setenv");
1525
_exit(EX_OSERR);
1526
}
1729
_exit(EX_OSERR);
1730
}
1731
ret = setenv("DELAY", delaystring, 1);
1732
if(ret == -1){
1527
1733
free(delaystring);
1528
if(connect_to != NULL){
1529
ret = setenv("CONNECT", connect_to, 1);
1530
if(ret == -1){
1531
perror_plus("setenv");
1532
_exit(EX_OSERR);
1533
}
1534
}
1535
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1536
perror_plus("execl");
1537
_exit(EXIT_FAILURE);
1538
}
1734
perror_plus("setenv");
1735
_exit(EX_OSERR);
1736
}
1737
free(delaystring);
1738
if(connect_to != NULL){
1739
ret = setenv("CONNECT", connect_to, 1);
1740
if(ret == -1){
1741
perror_plus("setenv");
1742
_exit(EX_OSERR);
1743
}
1744
}
1745
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1746
if(hook_fd == -1){
1747
perror_plus("openat");
1748
_exit(EXIT_FAILURE);
1749
}
1750
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1751
perror_plus("close");
1752
_exit(EXIT_FAILURE);
1753
}
1754
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1755
environ) == -1){
1756
perror_plus("fexecve");
1757
_exit(EXIT_FAILURE);
1758
}
1759
} else {
1760
if(hook_pid == -1){
1761
perror_plus("fork");
1762
free(direntry);
1763
continue;
1764
}
1765
int status;
1766
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1767
perror_plus("waitpid");
1768
free(direntry);
1769
continue;
1770
}
1771
if(WIFEXITED(status)){
1772
if(WEXITSTATUS(status) != 0){
1773
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1774
" with status %d\n", direntry->d_name,
1775
WEXITSTATUS(status));
1776
free(direntry);
1777
continue;
1778
}
1779
} else if(WIFSIGNALED(status)){
1780
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1781
" signal %d\n", direntry->d_name,
1782
WTERMSIG(status));
1783
free(direntry);
1784
continue;
1539
1785
} else {
1540
int status;
1541
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1542
perror_plus("waitpid");
1543
free(fullname);
1544
continue;
1545
}
1546
if(WIFEXITED(status)){
1547
if(WEXITSTATUS(status) != 0){
1548
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1549
" with status %d\n", direntry->d_name,
1550
WEXITSTATUS(status));
1551
free(fullname);
1552
continue;
1553
}
1554
} else if(WIFSIGNALED(status)){
1555
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1556
" signal %d\n", direntry->d_name,
1557
WTERMSIG(status));
1558
free(fullname);
1559
continue;
1560
} else {
1561
fprintf_plus(stderr, "Warning: network hook \"%s\""
1562
" crashed\n", direntry->d_name);
1563
free(fullname);
1564
continue;
1565
}
1566
}
1567
free(fullname);
1568
if(debug){
1569
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1570
direntry->d_name);
1571
}
1572
}
1573
close(devnull);
1574
}
1575
return true;
1786
fprintf_plus(stderr, "Warning: network hook \"%s\""
1787
" crashed\n", direntry->d_name);
1788
free(direntry);
1789
continue;
1790
}
1791
}
1792
if(debug){
1793
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1794
direntry->d_name);
1795
}
1796
free(direntry);
1797
}
1798
free(direntries);
1799
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1800
perror_plus("close");
1801
} else {
1802
hookdir_fd = -1;
1803
}
1804
close(devnull);
1576
1805
}
1577
1806
1807
__attribute__((nonnull, warn_unused_result))
1578
1808
error_t bring_up_interface(const char *const interface,
1579
1809
const float delay){
1580
int sd = -1;
1581
1810
error_t old_errno = errno;
1582
error_t ret_errno = 0;
1583
int ret, ret_setflags;
1811
int ret;
1584
1812
struct ifreq network;
1585
1813
unsigned int if_index = if_nametoindex(interface);
1586
1814
if(if_index == 0){
1595
1823
}
1596
1824
1597
1825
if(not interface_is_up(interface)){
1598
if(not get_flags(interface, &network) and debug){
1826
error_t ret_errno = 0, ioctl_errno = 0;
1827
if(not get_flags(interface, &network)){
1599
1828
ret_errno = errno;
1600
1829
fprintf_plus(stderr, "Failed to get flags for interface "
1601
1830
"\"%s\"\n", interface);
1831
errno = old_errno;
1602
1832
return ret_errno;
1603
1833
}
1604
network.ifr_flags |= IFF_UP;
1834
network.ifr_flags |= IFF_UP; /* set flag */
1605
1835
1606
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1607
if(sd < 0){
1836
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1837
if(sd == -1){
1608
1838
ret_errno = errno;
1609
1839
perror_plus("socket");
1610
1840
errno = old_errno;
1611
1841
return ret_errno;
1612
1842
}
1613
1843
1614
1844
if(quit_now){
1615
close(sd);
1845
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1846
if(ret == -1){
1847
perror_plus("close");
1848
}
1616
1849
errno = old_errno;
1617
1850
return EINTR;
1618
1851
}
1622
1855
interface);
1623
1856
}
1624
1857
1625
/* Raise priviliges */
1626
raise_privileges();
1858
/* Raise privileges */
1859
ret_errno = raise_privileges();
1860
if(ret_errno != 0){
1861
errno = ret_errno;
1862
perror_plus("Failed to raise privileges");
1863
}
1627
1864
1628
1865
#ifdef __linux__
1629
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1630
messages about the network interface to mess up the prompt */
1631
int ret_linux = klogctl(8, NULL, 5);
1632
bool restore_loglevel = true;
1633
if(ret_linux == -1){
1634
restore_loglevel = false;
1635
perror_plus("klogctl");
1866
int ret_linux;
1867
bool restore_loglevel = false;
1868
if(ret_errno == 0){
1869
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1870
messages about the network interface to mess up the prompt */
1871
ret_linux = klogctl(8, NULL, 5);
1872
if(ret_linux == -1){
1873
perror_plus("klogctl");
1874
} else {
1875
restore_loglevel = true;
1876
}
1636
1877
}
1637
1878
#endif /* __linux__ */
1638
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1639
ret_errno = errno;
1879
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1880
ioctl_errno = errno;
1640
1881
#ifdef __linux__
1641
1882
if(restore_loglevel){
1642
1883
ret_linux = klogctl(7, NULL, 0);
1646
1887
}
1647
1888
#endif /* __linux__ */
1648
1889
1649
/* Lower privileges */
1650
lower_privileges();
1890
/* If raise_privileges() succeeded above */
1891
if(ret_errno == 0){
1892
/* Lower privileges */
1893
ret_errno = lower_privileges();
1894
if(ret_errno != 0){
1895
errno = ret_errno;
1896
perror_plus("Failed to lower privileges");
1897
}
1898
}
1651
1899
1652
1900
/* Close the socket */
1653
1901
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1656
1904
}
1657
1905
1658
1906
if(ret_setflags == -1){
1659
errno = ret_errno;
1907
errno = ioctl_errno;
1660
1908
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1661
1909
errno = old_errno;
1662
return ret_errno;
1910
return ioctl_errno;
1663
1911
}
1664
1912
} else if(debug){
1665
1913
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1683
1931
return 0;
1684
1932
}
1685
1933
1934
__attribute__((nonnull, warn_unused_result))
1686
1935
error_t take_down_interface(const char *const interface){
1687
int sd = -1;
1688
1936
error_t old_errno = errno;
1689
error_t ret_errno = 0;
1690
int ret, ret_setflags;
1691
1937
struct ifreq network;
1692
1938
unsigned int if_index = if_nametoindex(interface);
1693
1939
if(if_index == 0){
1696
1942
return ENXIO;
1697
1943
}
1698
1944
if(interface_is_up(interface)){
1945
error_t ret_errno = 0, ioctl_errno = 0;
1699
1946
if(not get_flags(interface, &network) and debug){
1700
1947
ret_errno = errno;
1701
1948
fprintf_plus(stderr, "Failed to get flags for interface "
1702
1949
"\"%s\"\n", interface);
1950
errno = old_errno;
1703
1951
return ret_errno;
1704
1952
}
1705
1953
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1706
1954
1707
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1708
if(sd < 0){
1955
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1956
if(sd == -1){
1709
1957
ret_errno = errno;
1710
1958
perror_plus("socket");
1711
1959
errno = old_errno;
1717
1965
interface);
1718
1966
}
1719
1967
1720
/* Raise priviliges */
1721
raise_privileges();
1722
1723
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1724
ret_errno = errno;
1725
1726
/* Lower privileges */
1727
lower_privileges();
1968
/* Raise privileges */
1969
ret_errno = raise_privileges();
1970
if(ret_errno != 0){
1971
errno = ret_errno;
1972
perror_plus("Failed to raise privileges");
1973
}
1974
1975
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1976
ioctl_errno = errno;
1977
1978
/* If raise_privileges() succeeded above */
1979
if(ret_errno == 0){
1980
/* Lower privileges */
1981
ret_errno = lower_privileges();
1982
if(ret_errno != 0){
1983
errno = ret_errno;
1984
perror_plus("Failed to lower privileges");
1985
}
1986
}
1728
1987
1729
1988
/* Close the socket */
1730
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1989
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1731
1990
if(ret == -1){
1732
1991
perror_plus("close");
1733
1992
}
1734
1993
1735
1994
if(ret_setflags == -1){
1736
errno = ret_errno;
1995
errno = ioctl_errno;
1737
1996
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1738
1997
errno = old_errno;
1739
return ret_errno;
1998
return ioctl_errno;
1740
1999
}
1741
2000
} else if(debug){
1742
2001
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1748
2007
}
1749
2008
1750
2009
int main(int argc, char *argv[]){
2010
mandos_context mc = { .server = NULL, .dh_bits = 0,
2011
.priority = "SECURE256:!CTYPE-X.509:"
2012
"+CTYPE-OPENPGP:!RSA", .current_server = NULL,
2013
.interfaces = NULL, .interfaces_size = 0 };
1751
2014
AvahiSServiceBrowser *sb = NULL;
1752
2015
error_t ret_errno;
1753
2016
int ret;
1754
2017
intmax_t tmpmax;
1755
2018
char *tmp;
1756
2019
int exitcode = EXIT_SUCCESS;
1757
char *interfaces = NULL;
1758
size_t interfaces_size = 0;
1759
2020
char *interfaces_to_take_down = NULL;
1760
2021
size_t interfaces_to_take_down_size = 0;
1761
char tempdir[] = "/tmp/mandosXXXXXX";
1762
bool tempdir_created = false;
2022
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
2023
char old_tempdir[] = "/tmp/mandosXXXXXX";
2024
char *tempdir = NULL;
1763
2025
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1764
2026
const char *seckey = PATHDIR "/" SECKEY;
1765
2027
const char *pubkey = PATHDIR "/" PUBKEY;
1766
2028
char *interfaces_hooks = NULL;
1767
size_t interfaces_hooks_size = 0;
1768
2029
1769
2030
bool gnutls_initialized = false;
1770
2031
bool gpgme_initialized = false;
1861
2122
connect_to = arg;
1862
2123
break;
1863
2124
case 'i': /* --interface */
1864
ret_errno = argz_add_sep(&interfaces, &interfaces_size, arg,
1865
(int)',');
2125
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
2126
arg, (int)',');
1866
2127
if(ret_errno != 0){
1867
2128
argp_error(state, "%s", strerror(ret_errno));
1868
2129
}
1948
2209
/* Work around Debian bug #633582:
1949
2210
<http://bugs.debian.org/633582> */
1950
2211
1951
/* Re-raise priviliges */
1952
if(raise_privileges() == 0){
2212
/* Re-raise privileges */
2213
ret_errno = raise_privileges();
2214
if(ret_errno != 0){
2215
errno = ret_errno;
2216
perror_plus("Failed to raise privileges");
2217
} else {
1953
2218
struct stat st;
1954
2219
1955
2220
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1995
2260
}
1996
2261
1997
2262
/* Lower privileges */
1998
errno = 0;
1999
ret = seteuid(uid);
2000
if(ret == -1){
2001
perror_plus("seteuid");
2263
ret_errno = lower_privileges();
2264
if(ret_errno != 0){
2265
errno = ret_errno;
2266
perror_plus("Failed to lower privileges");
2002
2267
}
2003
2268
}
2004
2269
}
2005
2270
2006
/* Remove empty interface names */
2271
/* Remove invalid interface names (except "none") */
2007
2272
{
2008
2273
char *interface = NULL;
2009
while((interface = argz_next(interfaces, interfaces_size,
2274
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2010
2275
interface))){
2011
if(if_nametoindex(interface) == 0){
2012
if(interface[0] != '\0' and strcmp(interface, "none") != 0){
2276
if(strcmp(interface, "none") != 0
2277
and if_nametoindex(interface) == 0){
2278
if(interface[0] != '\0'){
2013
2279
fprintf_plus(stderr, "Not using nonexisting interface"
2014
2280
" \"%s\"\n", interface);
2015
2281
}
2016
argz_delete(&interfaces, &interfaces_size, interface);
2282
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2017
2283
interface = NULL;
2018
2284
}
2019
2285
}
2021
2287
2022
2288
/* Run network hooks */
2023
2289
{
2024
2025
if(interfaces != NULL){
2026
interfaces_hooks = malloc(interfaces_size);
2290
if(mc.interfaces != NULL){
2291
interfaces_hooks = malloc(mc.interfaces_size);
2027
2292
if(interfaces_hooks == NULL){
2028
2293
perror_plus("malloc");
2029
2294
goto end;
2030
2295
}
2031
memcpy(interfaces_hooks, interfaces, interfaces_size);
2032
interfaces_hooks_size = interfaces_size;
2033
argz_stringify(interfaces_hooks, interfaces_hooks_size,
2034
(int)',');
2035
}
2036
if(not run_network_hooks("start", interfaces_hooks != NULL ?
2037
interfaces_hooks : "", delay)){
2038
goto end;
2039
}
2296
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2297
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2298
}
2299
run_network_hooks("start", interfaces_hooks != NULL ?
2300
interfaces_hooks : "", delay);
2040
2301
}
2041
2302
2042
2303
if(not debug){
2047
2308
from the signal handler */
2048
2309
/* Initialize the pseudo-RNG for Avahi */
2049
2310
srand((unsigned int) time(NULL));
2050
mc.simple_poll = avahi_simple_poll_new();
2051
if(mc.simple_poll == NULL){
2311
simple_poll = avahi_simple_poll_new();
2312
if(simple_poll == NULL){
2052
2313
fprintf_plus(stderr,
2053
2314
"Avahi: Failed to create simple poll object.\n");
2054
2315
exitcode = EX_UNAVAILABLE;
2119
2380
}
2120
2381
2121
2382
/* If no interfaces were specified, make a list */
2122
if(interfaces == NULL){
2123
struct dirent **direntries;
2383
if(mc.interfaces == NULL){
2384
struct dirent **direntries = NULL;
2124
2385
/* Look for any good interfaces */
2125
2386
ret = scandir(sys_class_net, &direntries, good_interface,
2126
2387
alphasort);
2127
2388
if(ret >= 1){
2128
2389
/* Add all found interfaces to interfaces list */
2129
2390
for(int i = 0; i < ret; ++i){
2130
ret_errno = argz_add(&interfaces, &interfaces_size,
2391
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2131
2392
direntries[i]->d_name);
2132
2393
if(ret_errno != 0){
2394
errno = ret_errno;
2133
2395
perror_plus("argz_add");
2396
free(direntries[i]);
2134
2397
continue;
2135
2398
}
2136
2399
if(debug){
2137
2400
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2138
2401
direntries[i]->d_name);
2139
2402
}
2403
free(direntries[i]);
2140
2404
}
2141
2405
free(direntries);
2142
2406
} else {
2143
free(direntries);
2407
if(ret == 0){
2408
free(direntries);
2409
}
2144
2410
fprintf_plus(stderr, "Could not find a network interface\n");
2145
2411
exitcode = EXIT_FAILURE;
2146
2412
goto end;
2147
2413
}
2148
2414
}
2149
2415
2150
/* If we only got one interface, explicitly use only that one */
2151
if(argz_count(interfaces, interfaces_size) == 1){
2152
if(debug){
2153
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2154
interfaces);
2155
}
2156
if_index = (AvahiIfIndex)if_nametoindex(interfaces);
2157
}
2158
2159
/* Bring up interfaces which are down */
2160
if(not (argz_count(interfaces, interfaces_size) == 1
2161
and strcmp(interfaces, "none") == 0)){
2416
/* Bring up interfaces which are down, and remove any "none"s */
2417
{
2162
2418
char *interface = NULL;
2163
while((interface = argz_next(interfaces, interfaces_size,
2419
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2164
2420
interface))){
2421
/* If interface name is "none", stop bringing up interfaces.
2422
Also remove all instances of "none" from the list */
2423
if(strcmp(interface, "none") == 0){
2424
argz_delete(&mc.interfaces, &mc.interfaces_size,
2425
interface);
2426
interface = NULL;
2427
while((interface = argz_next(mc.interfaces,
2428
mc.interfaces_size, interface))){
2429
if(strcmp(interface, "none") == 0){
2430
argz_delete(&mc.interfaces, &mc.interfaces_size,
2431
interface);
2432
interface = NULL;
2433
}
2434
}
2435
break;
2436
}
2165
2437
bool interface_was_up = interface_is_up(interface);
2166
ret = bring_up_interface(interface, delay);
2438
errno = bring_up_interface(interface, delay);
2167
2439
if(not interface_was_up){
2168
if(ret != 0){
2169
errno = ret;
2440
if(errno != 0){
2170
2441
perror_plus("Failed to bring up interface");
2171
2442
} else {
2172
ret_errno = argz_add(&interfaces_to_take_down,
2173
&interfaces_to_take_down_size,
2174
interface);
2443
errno = argz_add(&interfaces_to_take_down,
2444
&interfaces_to_take_down_size,
2445
interface);
2446
if(errno != 0){
2447
perror_plus("argz_add");
2448
}
2175
2449
}
2176
2450
}
2177
2451
}
2178
free(interfaces);
2179
interfaces = NULL;
2180
interfaces_size = 0;
2181
2452
if(debug and (interfaces_to_take_down == NULL)){
2182
2453
fprintf_plus(stderr, "No interfaces were brought up\n");
2183
2454
}
2184
2455
}
2185
2456
2457
/* If we only got one interface, explicitly use only that one */
2458
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2459
if(debug){
2460
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2461
mc.interfaces);
2462
}
2463
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2464
}
2465
2186
2466
if(quit_now){
2187
2467
goto end;
2188
2468
}
2189
2469
2190
ret = init_gnutls_global(pubkey, seckey);
2470
ret = init_gnutls_global(pubkey, seckey, &mc);
2191
2471
if(ret == -1){
2192
2472
fprintf_plus(stderr, "init_gnutls_global failed\n");
2193
2473
exitcode = EX_UNAVAILABLE;
2200
2480
goto end;
2201
2481
}
2202
2482
2203
if(mkdtemp(tempdir) == NULL){
2483
/* Try /run/tmp before /tmp */
2484
tempdir = mkdtemp(run_tempdir);
2485
if(tempdir == NULL and errno == ENOENT){
2486
if(debug){
2487
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2488
run_tempdir, old_tempdir);
2489
}
2490
tempdir = mkdtemp(old_tempdir);
2491
}
2492
if(tempdir == NULL){
2204
2493
perror_plus("mkdtemp");
2205
2494
goto end;
2206
2495
}
2207
tempdir_created = true;
2208
2496
2209
2497
if(quit_now){
2210
2498
goto end;
2211
2499
}
2212
2500
2213
if(not init_gpgme(pubkey, seckey, tempdir)){
2501
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2214
2502
fprintf_plus(stderr, "init_gpgme failed\n");
2215
2503
exitcode = EX_UNAVAILABLE;
2216
2504
goto end;
2246
2534
exitcode = EX_USAGE;
2247
2535
goto end;
2248
2536
}
2249
2537
2250
2538
if(quit_now){
2251
2539
goto end;
2252
2540
}
2273
2561
}
2274
2562
2275
2563
while(not quit_now){
2276
ret = start_mandos_communication(address, port, if_index, af);
2564
ret = start_mandos_communication(address, port, if_index, af,
2565
&mc);
2277
2566
if(quit_now or ret == 0){
2278
2567
break;
2279
2568
}
2281
2570
fprintf_plus(stderr, "Retrying in %d seconds\n",
2282
2571
(int)retry_interval);
2283
2572
}
2284
sleep((int)retry_interval);
2573
sleep((unsigned int)retry_interval);
2285
2574
}
2286
2575
2287
if (not quit_now){
2576
if(not quit_now){
2288
2577
exitcode = EXIT_SUCCESS;
2289
2578
}
2290
2579
2305
2594
config.publish_domain = 0;
2306
2595
2307
2596
/* Allocate a new server */
2308
mc.server = avahi_server_new(avahi_simple_poll_get
2309
(mc.simple_poll), &config, NULL,
2310
NULL, &ret_errno);
2597
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2598
&config, NULL, NULL, &ret_errno);
2311
2599
2312
2600
/* Free the Avahi configuration data */
2313
2601
avahi_server_config_free(&config);
2328
2616
/* Create the Avahi service browser */
2329
2617
sb = avahi_s_service_browser_new(mc.server, if_index,
2330
2618
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2331
NULL, 0, browse_callback, NULL);
2619
NULL, 0, browse_callback,
2620
(void *)&mc);
2332
2621
if(sb == NULL){
2333
2622
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2334
2623
avahi_strerror(avahi_server_errno(mc.server)));
2345
2634
if(debug){
2346
2635
fprintf_plus(stderr, "Starting Avahi loop search\n");
2347
2636
}
2348
2349
ret = avahi_loop_with_timeout(mc.simple_poll,
2350
(int)(retry_interval * 1000));
2637
2638
ret = avahi_loop_with_timeout(simple_poll,
2639
(int)(retry_interval * 1000), &mc);
2351
2640
if(debug){
2352
2641
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2353
2642
(ret == 0) ? "successfully" : "with error");
2360
2649
}
2361
2650
2362
2651
/* Cleanup things */
2652
free(mc.interfaces);
2653
2363
2654
if(sb != NULL)
2364
2655
avahi_s_service_browser_free(sb);
2365
2656
2366
2657
if(mc.server != NULL)
2367
2658
avahi_server_free(mc.server);
2368
2659
2369
if(mc.simple_poll != NULL)
2370
avahi_simple_poll_free(mc.simple_poll);
2660
if(simple_poll != NULL)
2661
avahi_simple_poll_free(simple_poll);
2371
2662
2372
2663
if(gnutls_initialized){
2373
2664
gnutls_certificate_free_credentials(mc.cred);
2385
2676
mc.current_server->prev->next = NULL;
2386
2677
while(mc.current_server != NULL){
2387
2678
server *next = mc.current_server->next;
2679
#ifdef __GNUC__
2680
#pragma GCC diagnostic push
2681
#pragma GCC diagnostic ignored "-Wcast-qual"
2682
#endif
2683
free((char *)(mc.current_server->ip));
2684
#ifdef __GNUC__
2685
#pragma GCC diagnostic pop
2686
#endif
2388
2687
free(mc.current_server);
2389
2688
mc.current_server = next;
2390
2689
}
2391
2690
}
2392
2691
2393
/* Re-raise priviliges */
2692
/* Re-raise privileges */
2394
2693
{
2395
raise_privileges();
2396
2397
/* Run network hooks */
2398
run_network_hooks("stop", interfaces_hooks != NULL ?
2399
interfaces_hooks : "", delay);
2400
2401
/* Take down the network interfaces which were brought up */
2402
{
2403
char *interface = NULL;
2404
while((interface=argz_next(interfaces_to_take_down,
2405
interfaces_to_take_down_size,
2406
interface))){
2407
ret_errno = take_down_interface(interface);
2408
if(ret_errno != 0){
2409
errno = ret_errno;
2410
perror_plus("Failed to take down interface");
2411
}
2412
}
2413
if(debug and (interfaces_to_take_down == NULL)){
2414
fprintf_plus(stderr, "No interfaces needed to be taken"
2415
" down\n");
2416
}
2417
}
2418
2419
lower_privileges_permanently();
2694
ret_errno = raise_privileges();
2695
if(ret_errno != 0){
2696
errno = ret_errno;
2697
perror_plus("Failed to raise privileges");
2698
} else {
2699
2700
/* Run network hooks */
2701
run_network_hooks("stop", interfaces_hooks != NULL ?
2702
interfaces_hooks : "", delay);
2703
2704
/* Take down the network interfaces which were brought up */
2705
{
2706
char *interface = NULL;
2707
while((interface=argz_next(interfaces_to_take_down,
2708
interfaces_to_take_down_size,
2709
interface))){
2710
ret_errno = take_down_interface(interface);
2711
if(ret_errno != 0){
2712
errno = ret_errno;
2713
perror_plus("Failed to take down interface");
2714
}
2715
}
2716
if(debug and (interfaces_to_take_down == NULL)){
2717
fprintf_plus(stderr, "No interfaces needed to be taken"
2718
" down\n");
2719
}
2720
}
2721
}
2722
2723
ret_errno = lower_privileges_permanently();
2724
if(ret_errno != 0){
2725
errno = ret_errno;
2726
perror_plus("Failed to lower privileges permanently");
2727
}
2420
2728
}
2421
2729
2422
2730
free(interfaces_to_take_down);
2423
2731
free(interfaces_hooks);
2424
2732
2425
2733
/* Removes the GPGME temp directory and all files inside */
2426
if(tempdir_created){
2734
if(tempdir != NULL){
2427
2735
struct dirent **direntries = NULL;
2428
struct dirent *direntry = NULL;
2429
int numentries = scandir(tempdir, &direntries, notdotentries,
2430
alphasort);
2431
if (numentries > 0){
2432
for(int i = 0; i < numentries; i++){
2433
direntry = direntries[i];
2434
char *fullname = NULL;
2435
ret = asprintf(&fullname, "%s/%s", tempdir,
2436
direntry->d_name);
2437
if(ret < 0){
2438
perror_plus("asprintf");
2439
continue;
2440
}
2441
ret = remove(fullname);
2442
if(ret == -1){
2443
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2444
strerror(errno));
2445
}
2446
free(fullname);
2736
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2737
O_NOFOLLOW));
2738
if(tempdir_fd == -1){
2739
perror_plus("open");
2740
} else {
2741
#ifdef __GLIBC__
2742
#if __GLIBC_PREREQ(2, 15)
2743
int numentries = scandirat(tempdir_fd, ".", &direntries,
2744
notdotentries, alphasort);
2745
#else /* not __GLIBC_PREREQ(2, 15) */
2746
int numentries = scandir(tempdir, &direntries, notdotentries,
2747
alphasort);
2748
#endif /* not __GLIBC_PREREQ(2, 15) */
2749
#else /* not __GLIBC__ */
2750
int numentries = scandir(tempdir, &direntries, notdotentries,
2751
alphasort);
2752
#endif /* not __GLIBC__ */
2753
if(numentries >= 0){
2754
for(int i = 0; i < numentries; i++){
2755
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2756
if(ret == -1){
2757
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2758
" \"%s\", 0): %s\n", tempdir,
2759
direntries[i]->d_name, strerror(errno));
2760
}
2761
free(direntries[i]);
2762
}
2763
2764
/* need to clean even if 0 because man page doesn't specify */
2765
free(direntries);
2766
if(numentries == -1){
2767
perror_plus("scandir");
2768
}
2769
ret = rmdir(tempdir);
2770
if(ret == -1 and errno != ENOENT){
2771
perror_plus("rmdir");
2772
}
2447
2773
}
2448
}
2449
2450
/* need to clean even if 0 because man page doesn't specify */
2451
free(direntries);
2452
if (numentries == -1){
2453
perror_plus("scandir");
2454
}
2455
ret = rmdir(tempdir);
2456
if(ret == -1 and errno != ENOENT){
2457
perror_plus("rmdir");
2774
TEMP_FAILURE_RETRY(close(tempdir_fd));
2458
2775
}
2459
2776
}
2460
2777
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0