To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 777
- compare with another revision
- download diff
- download tarball
- view history from revision 777
- Committer: Teddy Hogeborn
- Date: 2015-07-20 03:03:33 UTC
- Revision ID: teddy@recompile.se-20150720030333-203m2aeblypcsfte
Bug fix for GnuTLS 3: be compatible with old 2048-bit DSA keys.
The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string. This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:
SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256
* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
(/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.
The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string. This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:
SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256
* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
(/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.
- files added:
- debian/mandos-client.examples
- debian/upstream
- network-hooks.d
- plugin-helpers
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2011 Teddy Hogeborn
13
* Copyright © 2008-2011 Björn Påhlsson
12
* Copyright © 2008-2015 Teddy Hogeborn
13
* Copyright © 2008-2015 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
33
#ifndef _LARGEFILE_SOURCE
34
34
#define _LARGEFILE_SOURCE
35
#endif
35
#endif /* not _LARGEFILE_SOURCE */
36
36
#ifndef _FILE_OFFSET_BITS
37
37
#define _FILE_OFFSET_BITS 64
38
#endif
38
#endif /* not _FILE_OFFSET_BITS */
39
39
40
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
41
42
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
43
stdout, ferror() */
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
47
strtof(), abort() */
48
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
49
#include <string.h> /* strcmp(), strlen(), strerror(),
50
asprintf(), strcpy() */
51
51
#include <sys/ioctl.h> /* ioctl */
52
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
53
sockaddr_in6, PF_INET6,
55
55
opendir(), DIR */
56
56
#include <sys/stat.h> /* open(), S_ISREG */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
58
inet_pton(), connect(),
59
getnameinfo() */
60
#include <fcntl.h> /* open(), unlinkat() */
60
61
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
62
*/
62
63
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
64
strtoimax() */
64
#include <assert.h> /* assert() */
65
65
#include <errno.h> /* perror(), errno,
66
66
program_invocation_short_name */
67
67
#include <time.h> /* nanosleep(), time(), sleep() */
73
73
*/
74
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
75
75
getuid(), getgid(), seteuid(),
76
setgid(), pause() */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
76
setgid(), pause(), _exit(),
77
unlinkat() */
78
#include <arpa/inet.h> /* inet_pton(), htons() */
78
79
#include <iso646.h> /* not, or, and */
79
80
#include <argp.h> /* struct argp_option, error_t, struct
80
81
argp_state, struct argp,
87
88
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
88
89
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
89
90
WEXITSTATUS(), WTERMSIG() */
91
#include <grp.h> /* setgroups() */
92
#include <argz.h> /* argz_add_sep(), argz_next(),
93
argz_delete(), argz_append(),
94
argz_stringify(), argz_add(),
95
argz_count() */
96
#include <netdb.h> /* getnameinfo(), NI_NUMERICHOST,
97
EAI_SYSTEM, gai_strerror() */
90
98
91
99
#ifdef __linux__
92
100
#include <sys/klog.h> /* klogctl() */
134
142
static const char sys_class_net[] = "/sys/class/net";
135
143
char *connect_to = NULL;
136
144
const char *hookdir = HOOKDIR;
145
int hookdir_fd = -1;
146
uid_t uid = 65534;
147
gid_t gid = 65534;
137
148
138
149
/* Doubly linked list that need to be circularly linked when used */
139
150
typedef struct server{
140
151
const char *ip;
141
uint16_t port;
152
in_port_t port;
142
153
AvahiIfIndex if_index;
143
154
int af;
144
155
struct timespec last_seen;
148
159
149
160
/* Used for passing in values through the Avahi callback functions */
150
161
typedef struct {
151
AvahiSimplePoll *simple_poll;
152
162
AvahiServer *server;
153
163
gnutls_certificate_credentials_t cred;
154
164
unsigned int dh_bits;
156
166
const char *priority;
157
167
gpgme_ctx_t ctx;
158
168
server *current_server;
169
char *interfaces;
170
size_t interfaces_size;
159
171
} mandos_context;
160
172
161
/* global context so signal handler can reach it*/
162
mandos_context mc = { .simple_poll = NULL, .server = NULL,
163
.dh_bits = 1024, .priority = "SECURE256"
164
":!CTYPE-X.509:+CTYPE-OPENPGP",
165
.current_server = NULL };
173
/* global so signal handler can reach it*/
174
AvahiSimplePoll *simple_poll;
166
175
167
176
sig_atomic_t quit_now = 0;
168
177
int signal_received = 0;
169
178
170
179
/* Function to use when printing errors */
171
180
void perror_plus(const char *print_text){
181
int e = errno;
172
182
fprintf(stderr, "Mandos plugin %s: ",
173
183
program_invocation_short_name);
184
errno = e;
174
185
perror(print_text);
175
186
}
176
187
188
__attribute__((format (gnu_printf, 2, 3), nonnull))
177
189
int fprintf_plus(FILE *stream, const char *format, ...){
178
190
va_list ap;
179
191
va_start (ap, format);
180
192
181
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ", program_invocation_short_name));
182
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
193
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
194
program_invocation_short_name));
195
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
183
196
}
184
197
185
198
/*
187
200
* bytes. "buffer_capacity" is how much is currently allocated,
188
201
* "buffer_length" is how much is already used.
189
202
*/
203
__attribute__((nonnull, warn_unused_result))
190
204
size_t incbuffer(char **buffer, size_t buffer_length,
191
205
size_t buffer_capacity){
192
206
if(buffer_length + BUFFER_SIZE > buffer_capacity){
193
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
194
if(buffer == NULL){
207
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
208
if(new_buf == NULL){
209
int old_errno = errno;
210
free(*buffer);
211
errno = old_errno;
212
*buffer = NULL;
195
213
return 0;
196
214
}
215
*buffer = new_buf;
197
216
buffer_capacity += BUFFER_SIZE;
198
217
}
199
218
return buffer_capacity;
200
219
}
201
220
202
221
/* Add server to set of servers to retry periodically */
203
int add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
204
int af){
222
__attribute__((nonnull, warn_unused_result))
223
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
224
int af, server **current_server){
205
225
int ret;
206
226
server *new_server = malloc(sizeof(server));
207
227
if(new_server == NULL){
208
228
perror_plus("malloc");
209
return -1;
229
return false;
210
230
}
211
231
*new_server = (server){ .ip = strdup(ip),
212
232
.port = port,
214
234
.af = af };
215
235
if(new_server->ip == NULL){
216
236
perror_plus("strdup");
217
return -1;
237
free(new_server);
238
return false;
239
}
240
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
241
if(ret == -1){
242
perror_plus("clock_gettime");
243
#ifdef __GNUC__
244
#pragma GCC diagnostic push
245
#pragma GCC diagnostic ignored "-Wcast-qual"
246
#endif
247
free((char *)(new_server->ip));
248
#ifdef __GNUC__
249
#pragma GCC diagnostic pop
250
#endif
251
free(new_server);
252
return false;
218
253
}
219
254
/* Special case of first server */
220
if (mc.current_server == NULL){
255
if(*current_server == NULL){
221
256
new_server->next = new_server;
222
257
new_server->prev = new_server;
223
mc.current_server = new_server;
224
/* Place the new server last in the list */
258
*current_server = new_server;
225
259
} else {
226
new_server->next = mc.current_server;
227
new_server->prev = mc.current_server->prev;
260
/* Place the new server last in the list */
261
new_server->next = *current_server;
262
new_server->prev = (*current_server)->prev;
228
263
new_server->prev->next = new_server;
229
mc.current_server->prev = new_server;
230
}
231
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
232
if(ret == -1){
233
perror_plus("clock_gettime");
234
return -1;
235
}
236
return 0;
264
(*current_server)->prev = new_server;
265
}
266
return true;
237
267
}
238
268
239
269
/*
240
270
* Initialize GPGME.
241
271
*/
242
static bool init_gpgme(const char *seckey, const char *pubkey,
243
const char *tempdir){
272
__attribute__((nonnull, warn_unused_result))
273
static bool init_gpgme(const char * const seckey,
274
const char * const pubkey,
275
const char * const tempdir,
276
mandos_context *mc){
244
277
gpgme_error_t rc;
245
278
gpgme_engine_info_t engine_info;
246
279
247
248
280
/*
249
281
* Helper function to insert pub and seckey to the engine keyring.
250
282
*/
251
bool import_key(const char *filename){
283
bool import_key(const char * const filename){
252
284
int ret;
253
285
int fd;
254
286
gpgme_data_t pgp_data;
262
294
rc = gpgme_data_new_from_fd(&pgp_data, fd);
263
295
if(rc != GPG_ERR_NO_ERROR){
264
296
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
265
gpgme_strsource(rc), gpgme_strerror(rc));
297
gpgme_strsource(rc), gpgme_strerror(rc));
266
298
return false;
267
299
}
268
300
269
rc = gpgme_op_import(mc.ctx, pgp_data);
301
rc = gpgme_op_import(mc->ctx, pgp_data);
270
302
if(rc != GPG_ERR_NO_ERROR){
271
303
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
272
gpgme_strsource(rc), gpgme_strerror(rc));
304
gpgme_strsource(rc), gpgme_strerror(rc));
273
305
return false;
274
306
}
275
307
276
ret = (int)TEMP_FAILURE_RETRY(close(fd));
308
ret = close(fd);
277
309
if(ret == -1){
278
310
perror_plus("close");
279
311
}
290
322
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
291
323
if(rc != GPG_ERR_NO_ERROR){
292
324
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
293
gpgme_strsource(rc), gpgme_strerror(rc));
325
gpgme_strsource(rc), gpgme_strerror(rc));
294
326
return false;
295
327
}
296
328
298
330
rc = gpgme_get_engine_info(&engine_info);
299
331
if(rc != GPG_ERR_NO_ERROR){
300
332
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
301
gpgme_strsource(rc), gpgme_strerror(rc));
333
gpgme_strsource(rc), gpgme_strerror(rc));
302
334
return false;
303
335
}
304
336
while(engine_info != NULL){
310
342
engine_info = engine_info->next;
311
343
}
312
344
if(engine_info == NULL){
313
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n", tempdir);
345
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
346
tempdir);
314
347
return false;
315
348
}
316
349
317
350
/* Create new GPGME "context" */
318
rc = gpgme_new(&(mc.ctx));
351
rc = gpgme_new(&(mc->ctx));
319
352
if(rc != GPG_ERR_NO_ERROR){
320
353
fprintf_plus(stderr, "Mandos plugin mandos-client: "
321
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
322
gpgme_strerror(rc));
354
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
355
gpgme_strerror(rc));
323
356
return false;
324
357
}
325
358
334
367
* Decrypt OpenPGP data.
335
368
* Returns -1 on error
336
369
*/
370
__attribute__((nonnull, warn_unused_result))
337
371
static ssize_t pgp_packet_decrypt(const char *cryptotext,
338
372
size_t crypto_size,
339
char **plaintext){
373
char **plaintext,
374
mandos_context *mc){
340
375
gpgme_data_t dh_crypto, dh_plain;
341
376
gpgme_error_t rc;
342
377
ssize_t ret;
352
387
0);
353
388
if(rc != GPG_ERR_NO_ERROR){
354
389
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
355
gpgme_strsource(rc), gpgme_strerror(rc));
390
gpgme_strsource(rc), gpgme_strerror(rc));
356
391
return -1;
357
392
}
358
393
360
395
rc = gpgme_data_new(&dh_plain);
361
396
if(rc != GPG_ERR_NO_ERROR){
362
397
fprintf_plus(stderr, "Mandos plugin mandos-client: "
363
"bad gpgme_data_new: %s: %s\n",
364
gpgme_strsource(rc), gpgme_strerror(rc));
398
"bad gpgme_data_new: %s: %s\n",
399
gpgme_strsource(rc), gpgme_strerror(rc));
365
400
gpgme_data_release(dh_crypto);
366
401
return -1;
367
402
}
368
403
369
404
/* Decrypt data from the cryptotext data buffer to the plaintext
370
405
data buffer */
371
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
406
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
372
407
if(rc != GPG_ERR_NO_ERROR){
373
408
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
374
gpgme_strsource(rc), gpgme_strerror(rc));
409
gpgme_strsource(rc), gpgme_strerror(rc));
375
410
plaintext_length = -1;
376
411
if(debug){
377
412
gpgme_decrypt_result_t result;
378
result = gpgme_op_decrypt_result(mc.ctx);
413
result = gpgme_op_decrypt_result(mc->ctx);
379
414
if(result == NULL){
380
415
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
381
416
} else {
382
417
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
383
result->unsupported_algorithm);
418
result->unsupported_algorithm);
384
419
fprintf_plus(stderr, "Wrong key usage: %u\n",
385
result->wrong_key_usage);
420
result->wrong_key_usage);
386
421
if(result->file_name != NULL){
387
422
fprintf_plus(stderr, "File name: %s\n", result->file_name);
388
423
}
390
425
recipient = result->recipients;
391
426
while(recipient != NULL){
392
427
fprintf_plus(stderr, "Public key algorithm: %s\n",
393
gpgme_pubkey_algo_name(recipient->pubkey_algo));
428
gpgme_pubkey_algo_name
429
(recipient->pubkey_algo));
394
430
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
395
431
fprintf_plus(stderr, "Secret key available: %s\n",
396
recipient->status == GPG_ERR_NO_SECKEY
397
? "No" : "Yes");
432
recipient->status == GPG_ERR_NO_SECKEY
433
? "No" : "Yes");
398
434
recipient = recipient->next;
399
435
}
400
436
}
457
493
return plaintext_length;
458
494
}
459
495
460
static const char * safer_gnutls_strerror(int value){
461
const char *ret = gnutls_strerror(value); /* Spurious warning from
462
-Wunreachable-code */
463
if(ret == NULL)
464
ret = "(unknown)";
465
return ret;
496
__attribute__((warn_unused_result, const))
497
static const char *safe_string(const char *str){
498
if(str == NULL)
499
return "(unknown)";
500
return str;
501
}
502
503
__attribute__((warn_unused_result))
504
static const char *safer_gnutls_strerror(int value){
505
const char *ret = gnutls_strerror(value);
506
return safe_string(ret);
466
507
}
467
508
468
509
/* GnuTLS log function callback */
510
__attribute__((nonnull))
469
511
static void debuggnutls(__attribute__((unused)) int level,
470
512
const char* string){
471
513
fprintf_plus(stderr, "GnuTLS: %s", string);
472
514
}
473
515
516
__attribute__((nonnull, warn_unused_result))
474
517
static int init_gnutls_global(const char *pubkeyfilename,
475
const char *seckeyfilename){
518
const char *seckeyfilename,
519
const char *dhparamsfilename,
520
mandos_context *mc){
476
521
int ret;
522
unsigned int uret;
477
523
478
524
if(debug){
479
525
fprintf_plus(stderr, "Initializing GnuTLS\n");
481
527
482
528
ret = gnutls_global_init();
483
529
if(ret != GNUTLS_E_SUCCESS){
484
fprintf_plus(stderr, "GnuTLS global_init: %s\n", safer_gnutls_strerror(ret));
530
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
531
safer_gnutls_strerror(ret));
485
532
return -1;
486
533
}
487
534
494
541
}
495
542
496
543
/* OpenPGP credentials */
497
ret = gnutls_certificate_allocate_credentials(&mc.cred);
544
ret = gnutls_certificate_allocate_credentials(&mc->cred);
498
545
if(ret != GNUTLS_E_SUCCESS){
499
fprintf_plus(stderr, "GnuTLS memory error: %s\n", safer_gnutls_strerror(ret));
546
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
547
safer_gnutls_strerror(ret));
500
548
gnutls_global_deinit();
501
549
return -1;
502
550
}
503
551
504
552
if(debug){
505
553
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
506
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
507
seckeyfilename);
554
" secret key %s as GnuTLS credentials\n",
555
pubkeyfilename,
556
seckeyfilename);
508
557
}
509
558
510
559
ret = gnutls_certificate_set_openpgp_key_file
511
(mc.cred, pubkeyfilename, seckeyfilename,
560
(mc->cred, pubkeyfilename, seckeyfilename,
512
561
GNUTLS_OPENPGP_FMT_BASE64);
513
562
if(ret != GNUTLS_E_SUCCESS){
514
563
fprintf_plus(stderr,
515
564
"Error[%d] while reading the OpenPGP key pair ('%s',"
516
565
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
517
fprintf_plus(stderr, "The GnuTLS error is: %s\n", safer_gnutls_strerror(ret));
566
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
567
safer_gnutls_strerror(ret));
518
568
goto globalfail;
519
569
}
520
570
521
571
/* GnuTLS server initialization */
522
ret = gnutls_dh_params_init(&mc.dh_params);
523
if(ret != GNUTLS_E_SUCCESS){
524
fprintf_plus(stderr, "Error in GnuTLS DH parameter initialization:"
525
" %s\n", safer_gnutls_strerror(ret));
526
goto globalfail;
527
}
528
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
529
if(ret != GNUTLS_E_SUCCESS){
530
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
531
safer_gnutls_strerror(ret));
532
goto globalfail;
533
}
534
535
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
572
ret = gnutls_dh_params_init(&mc->dh_params);
573
if(ret != GNUTLS_E_SUCCESS){
574
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
575
" initialization: %s\n",
576
safer_gnutls_strerror(ret));
577
goto globalfail;
578
}
579
/* If a Diffie-Hellman parameters file was given, try to use it */
580
if(dhparamsfilename != NULL){
581
gnutls_datum_t params = { .data = NULL, .size = 0 };
582
do {
583
int dhpfile = open(dhparamsfilename, O_RDONLY);
584
if(dhpfile == -1){
585
perror_plus("open");
586
dhparamsfilename = NULL;
587
break;
588
}
589
size_t params_capacity = 0;
590
while(true){
591
params_capacity = incbuffer((char **)¶ms.data,
592
(size_t)params.size,
593
(size_t)params_capacity);
594
if(params_capacity == 0){
595
perror_plus("incbuffer");
596
free(params.data);
597
params.data = NULL;
598
dhparamsfilename = NULL;
599
break;
600
}
601
ssize_t bytes_read = read(dhpfile,
602
params.data + params.size,
603
BUFFER_SIZE);
604
/* EOF */
605
if(bytes_read == 0){
606
break;
607
}
608
/* check bytes_read for failure */
609
if(bytes_read < 0){
610
perror_plus("read");
611
free(params.data);
612
params.data = NULL;
613
dhparamsfilename = NULL;
614
break;
615
}
616
params.size += (unsigned int)bytes_read;
617
}
618
if(params.data == NULL){
619
dhparamsfilename = NULL;
620
}
621
if(dhparamsfilename == NULL){
622
break;
623
}
624
ret = gnutls_dh_params_import_pkcs3(mc->dh_params, ¶ms,
625
GNUTLS_X509_FMT_PEM);
626
if(ret != GNUTLS_E_SUCCESS){
627
fprintf_plus(stderr, "Failed to parse DH parameters in file"
628
" \"%s\": %s\n", dhparamsfilename,
629
safer_gnutls_strerror(ret));
630
dhparamsfilename = NULL;
631
}
632
} while(false);
633
}
634
if(dhparamsfilename == NULL){
635
if(mc->dh_bits == 0){
636
/* Find out the optimal number of DH bits */
637
/* Try to read the private key file */
638
gnutls_datum_t buffer = { .data = NULL, .size = 0 };
639
do {
640
int secfile = open(seckeyfilename, O_RDONLY);
641
if(secfile == -1){
642
perror_plus("open");
643
break;
644
}
645
size_t buffer_capacity = 0;
646
while(true){
647
buffer_capacity = incbuffer((char **)&buffer.data,
648
(size_t)buffer.size,
649
(size_t)buffer_capacity);
650
if(buffer_capacity == 0){
651
perror_plus("incbuffer");
652
free(buffer.data);
653
buffer.data = NULL;
654
break;
655
}
656
ssize_t bytes_read = read(secfile,
657
buffer.data + buffer.size,
658
BUFFER_SIZE);
659
/* EOF */
660
if(bytes_read == 0){
661
break;
662
}
663
/* check bytes_read for failure */
664
if(bytes_read < 0){
665
perror_plus("read");
666
free(buffer.data);
667
buffer.data = NULL;
668
break;
669
}
670
buffer.size += (unsigned int)bytes_read;
671
}
672
close(secfile);
673
} while(false);
674
/* If successful, use buffer to parse private key */
675
gnutls_sec_param_t sec_param = GNUTLS_SEC_PARAM_ULTRA;
676
if(buffer.data != NULL){
677
{
678
gnutls_openpgp_privkey_t privkey = NULL;
679
ret = gnutls_openpgp_privkey_init(&privkey);
680
if(ret != GNUTLS_E_SUCCESS){
681
fprintf_plus(stderr, "Error initializing OpenPGP key"
682
" structure: %s",
683
safer_gnutls_strerror(ret));
684
free(buffer.data);
685
buffer.data = NULL;
686
} else {
687
ret = gnutls_openpgp_privkey_import
688
(privkey, &buffer, GNUTLS_OPENPGP_FMT_BASE64, "", 0);
689
if(ret != GNUTLS_E_SUCCESS){
690
fprintf_plus(stderr, "Error importing OpenPGP key : %s",
691
safer_gnutls_strerror(ret));
692
privkey = NULL;
693
}
694
free(buffer.data);
695
buffer.data = NULL;
696
if(privkey != NULL){
697
/* Use private key to suggest an appropriate
698
sec_param */
699
sec_param = gnutls_openpgp_privkey_sec_param(privkey);
700
gnutls_openpgp_privkey_deinit(privkey);
701
if(debug){
702
fprintf_plus(stderr, "This OpenPGP key implies using"
703
" a GnuTLS security parameter \"%s\".\n",
704
safe_string(gnutls_sec_param_get_name
705
(sec_param)));
706
}
707
}
708
}
709
}
710
if(sec_param == GNUTLS_SEC_PARAM_UNKNOWN){
711
/* Err on the side of caution */
712
sec_param = GNUTLS_SEC_PARAM_ULTRA;
713
if(debug){
714
fprintf_plus(stderr, "Falling back to security parameter"
715
" \"%s\"\n",
716
safe_string(gnutls_sec_param_get_name
717
(sec_param)));
718
}
719
}
720
}
721
uret = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, sec_param);
722
if(uret != 0){
723
mc->dh_bits = uret;
724
if(debug){
725
fprintf_plus(stderr, "A \"%s\" GnuTLS security parameter"
726
" implies %u DH bits; using that.\n",
727
safe_string(gnutls_sec_param_get_name
728
(sec_param)),
729
mc->dh_bits);
730
}
731
} else {
732
fprintf_plus(stderr, "Failed to get implied number of DH"
733
" bits for security parameter \"%s\"): %s\n",
734
safe_string(gnutls_sec_param_get_name
735
(sec_param)),
736
safer_gnutls_strerror(ret));
737
goto globalfail;
738
}
739
} else if(debug){
740
fprintf_plus(stderr, "DH bits explicitly set to %u\n",
741
mc->dh_bits);
742
}
743
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
744
if(ret != GNUTLS_E_SUCCESS){
745
fprintf_plus(stderr, "Error in GnuTLS prime generation (%u"
746
" bits): %s\n", mc->dh_bits,
747
safer_gnutls_strerror(ret));
748
goto globalfail;
749
}
750
}
751
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
536
752
537
753
return 0;
538
754
539
755
globalfail:
540
756
541
gnutls_certificate_free_credentials(mc.cred);
757
gnutls_certificate_free_credentials(mc->cred);
542
758
gnutls_global_deinit();
543
gnutls_dh_params_deinit(mc.dh_params);
759
gnutls_dh_params_deinit(mc->dh_params);
544
760
return -1;
545
761
}
546
762
547
static int init_gnutls_session(gnutls_session_t *session){
763
__attribute__((nonnull, warn_unused_result))
764
static int init_gnutls_session(gnutls_session_t *session,
765
mandos_context *mc){
548
766
int ret;
549
767
/* GnuTLS session creation */
550
768
do {
554
772
}
555
773
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
556
774
if(ret != GNUTLS_E_SUCCESS){
557
fprintf_plus(stderr, "Error in GnuTLS session initialization: %s\n",
558
safer_gnutls_strerror(ret));
775
fprintf_plus(stderr,
776
"Error in GnuTLS session initialization: %s\n",
777
safer_gnutls_strerror(ret));
559
778
}
560
779
561
780
{
562
781
const char *err;
563
782
do {
564
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
783
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
565
784
if(quit_now){
566
785
gnutls_deinit(*session);
567
786
return -1;
569
788
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
570
789
if(ret != GNUTLS_E_SUCCESS){
571
790
fprintf_plus(stderr, "Syntax error at: %s\n", err);
572
fprintf_plus(stderr, "GnuTLS error: %s\n", safer_gnutls_strerror(ret));
791
fprintf_plus(stderr, "GnuTLS error: %s\n",
792
safer_gnutls_strerror(ret));
573
793
gnutls_deinit(*session);
574
794
return -1;
575
795
}
577
797
578
798
do {
579
799
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
580
mc.cred);
800
mc->cred);
581
801
if(quit_now){
582
802
gnutls_deinit(*session);
583
803
return -1;
585
805
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
586
806
if(ret != GNUTLS_E_SUCCESS){
587
807
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
588
safer_gnutls_strerror(ret));
808
safer_gnutls_strerror(ret));
589
809
gnutls_deinit(*session);
590
810
return -1;
591
811
}
593
813
/* ignore client certificate if any. */
594
814
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
595
815
596
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
597
598
816
return 0;
599
817
}
600
818
602
820
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
603
821
__attribute__((unused)) const char *txt){}
604
822
823
/* Set effective uid to 0, return errno */
824
__attribute__((warn_unused_result))
825
error_t raise_privileges(void){
826
error_t old_errno = errno;
827
error_t ret_errno = 0;
828
if(seteuid(0) == -1){
829
ret_errno = errno;
830
}
831
errno = old_errno;
832
return ret_errno;
833
}
834
835
/* Set effective and real user ID to 0. Return errno. */
836
__attribute__((warn_unused_result))
837
error_t raise_privileges_permanently(void){
838
error_t old_errno = errno;
839
error_t ret_errno = raise_privileges();
840
if(ret_errno != 0){
841
errno = old_errno;
842
return ret_errno;
843
}
844
if(setuid(0) == -1){
845
ret_errno = errno;
846
}
847
errno = old_errno;
848
return ret_errno;
849
}
850
851
/* Set effective user ID to unprivileged saved user ID */
852
__attribute__((warn_unused_result))
853
error_t lower_privileges(void){
854
error_t old_errno = errno;
855
error_t ret_errno = 0;
856
if(seteuid(uid) == -1){
857
ret_errno = errno;
858
}
859
errno = old_errno;
860
return ret_errno;
861
}
862
863
/* Lower privileges permanently */
864
__attribute__((warn_unused_result))
865
error_t lower_privileges_permanently(void){
866
error_t old_errno = errno;
867
error_t ret_errno = 0;
868
if(setuid(uid) == -1){
869
ret_errno = errno;
870
}
871
errno = old_errno;
872
return ret_errno;
873
}
874
875
/* Helper function to add_local_route() and delete_local_route() */
876
__attribute__((nonnull, warn_unused_result))
877
static bool add_delete_local_route(const bool add,
878
const char *address,
879
AvahiIfIndex if_index){
880
int ret;
881
char helper[] = "mandos-client-iprouteadddel";
882
char add_arg[] = "add";
883
char delete_arg[] = "delete";
884
char debug_flag[] = "--debug";
885
char *pluginhelperdir = getenv("MANDOSPLUGINHELPERDIR");
886
if(pluginhelperdir == NULL){
887
if(debug){
888
fprintf_plus(stderr, "MANDOSPLUGINHELPERDIR environment"
889
" variable not set; cannot run helper\n");
890
}
891
return false;
892
}
893
894
char interface[IF_NAMESIZE];
895
if(if_indextoname((unsigned int)if_index, interface) == NULL){
896
perror_plus("if_indextoname");
897
return false;
898
}
899
900
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
901
if(devnull == -1){
902
perror_plus("open(\"/dev/null\", O_RDONLY)");
903
return false;
904
}
905
pid_t pid = fork();
906
if(pid == 0){
907
/* Child */
908
/* Raise privileges */
909
errno = raise_privileges_permanently();
910
if(errno != 0){
911
perror_plus("Failed to raise privileges");
912
/* _exit(EX_NOPERM); */
913
} else {
914
/* Set group */
915
errno = 0;
916
ret = setgid(0);
917
if(ret == -1){
918
perror_plus("setgid");
919
_exit(EX_NOPERM);
920
}
921
/* Reset supplementary groups */
922
errno = 0;
923
ret = setgroups(0, NULL);
924
if(ret == -1){
925
perror_plus("setgroups");
926
_exit(EX_NOPERM);
927
}
928
}
929
ret = dup2(devnull, STDIN_FILENO);
930
if(ret == -1){
931
perror_plus("dup2(devnull, STDIN_FILENO)");
932
_exit(EX_OSERR);
933
}
934
ret = close(devnull);
935
if(ret == -1){
936
perror_plus("close");
937
_exit(EX_OSERR);
938
}
939
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
940
if(ret == -1){
941
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
942
_exit(EX_OSERR);
943
}
944
int helperdir_fd = (int)TEMP_FAILURE_RETRY(open(pluginhelperdir,
945
O_RDONLY
946
| O_DIRECTORY
947
| O_PATH
948
| O_CLOEXEC));
949
if(helperdir_fd == -1){
950
perror_plus("open");
951
_exit(EX_UNAVAILABLE);
952
}
953
int helper_fd = (int)TEMP_FAILURE_RETRY(openat(helperdir_fd,
954
helper, O_RDONLY));
955
if(helper_fd == -1){
956
perror_plus("openat");
957
close(helperdir_fd);
958
_exit(EX_UNAVAILABLE);
959
}
960
close(helperdir_fd);
961
#ifdef __GNUC__
962
#pragma GCC diagnostic push
963
#pragma GCC diagnostic ignored "-Wcast-qual"
964
#endif
965
if(fexecve(helper_fd, (char *const [])
966
{ helper, add ? add_arg : delete_arg, (char *)address,
967
interface, debug ? debug_flag : NULL, NULL },
968
environ) == -1){
969
#ifdef __GNUC__
970
#pragma GCC diagnostic pop
971
#endif
972
perror_plus("fexecve");
973
_exit(EXIT_FAILURE);
974
}
975
}
976
if(pid == -1){
977
perror_plus("fork");
978
return false;
979
}
980
int status;
981
pid_t pret = -1;
982
errno = 0;
983
do {
984
pret = waitpid(pid, &status, 0);
985
if(pret == -1 and errno == EINTR and quit_now){
986
int errno_raising = 0;
987
if((errno = raise_privileges()) != 0){
988
errno_raising = errno;
989
perror_plus("Failed to raise privileges in order to"
990
" kill helper program");
991
}
992
if(kill(pid, SIGTERM) == -1){
993
perror_plus("kill");
994
}
995
if((errno_raising == 0) and (errno = lower_privileges()) != 0){
996
perror_plus("Failed to lower privileges after killing"
997
" helper program");
998
}
999
return false;
1000
}
1001
} while(pret == -1 and errno == EINTR);
1002
if(pret == -1){
1003
perror_plus("waitpid");
1004
return false;
1005
}
1006
if(WIFEXITED(status)){
1007
if(WEXITSTATUS(status) != 0){
1008
fprintf_plus(stderr, "Error: iprouteadddel exited"
1009
" with status %d\n", WEXITSTATUS(status));
1010
return false;
1011
}
1012
return true;
1013
}
1014
if(WIFSIGNALED(status)){
1015
fprintf_plus(stderr, "Error: iprouteadddel died by"
1016
" signal %d\n", WTERMSIG(status));
1017
return false;
1018
}
1019
fprintf_plus(stderr, "Error: iprouteadddel crashed\n");
1020
return false;
1021
}
1022
1023
__attribute__((nonnull, warn_unused_result))
1024
static bool add_local_route(const char *address,
1025
AvahiIfIndex if_index){
1026
if(debug){
1027
fprintf_plus(stderr, "Adding route to %s\n", address);
1028
}
1029
return add_delete_local_route(true, address, if_index);
1030
}
1031
1032
__attribute__((nonnull, warn_unused_result))
1033
static bool delete_local_route(const char *address,
1034
AvahiIfIndex if_index){
1035
if(debug){
1036
fprintf_plus(stderr, "Removing route to %s\n", address);
1037
}
1038
return add_delete_local_route(false, address, if_index);
1039
}
1040
605
1041
/* Called when a Mandos server is found */
606
static int start_mandos_communication(const char *ip, uint16_t port,
1042
__attribute__((nonnull, warn_unused_result))
1043
static int start_mandos_communication(const char *ip, in_port_t port,
607
1044
AvahiIfIndex if_index,
608
int af){
1045
int af, mandos_context *mc){
609
1046
int ret, tcp_sd = -1;
610
1047
ssize_t sret;
611
union {
612
struct sockaddr_in in;
613
struct sockaddr_in6 in6;
614
} to;
1048
struct sockaddr_storage to;
615
1049
char *buffer = NULL;
616
1050
char *decrypted_buffer = NULL;
617
1051
size_t buffer_length = 0;
620
1054
int retval = -1;
621
1055
gnutls_session_t session;
622
1056
int pf; /* Protocol family */
1057
bool route_added = false;
623
1058
624
1059
errno = 0;
625
1060
641
1076
return -1;
642
1077
}
643
1078
644
ret = init_gnutls_session(&session);
1079
/* If the interface is specified and we have a list of interfaces */
1080
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
1081
/* Check if the interface is one of the interfaces we are using */
1082
bool match = false;
1083
{
1084
char *interface = NULL;
1085
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
1086
interface))){
1087
if(if_nametoindex(interface) == (unsigned int)if_index){
1088
match = true;
1089
break;
1090
}
1091
}
1092
}
1093
if(not match){
1094
/* This interface does not match any in the list, so we don't
1095
connect to the server */
1096
if(debug){
1097
char interface[IF_NAMESIZE];
1098
if(if_indextoname((unsigned int)if_index, interface) == NULL){
1099
perror_plus("if_indextoname");
1100
} else {
1101
fprintf_plus(stderr, "Skipping server on non-used interface"
1102
" \"%s\"\n",
1103
if_indextoname((unsigned int)if_index,
1104
interface));
1105
}
1106
}
1107
return -1;
1108
}
1109
}
1110
1111
ret = init_gnutls_session(&session, mc);
645
1112
if(ret != 0){
646
1113
return -1;
647
1114
}
648
1115
649
1116
if(debug){
650
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %" PRIu16
651
"\n", ip, port);
1117
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
1118
PRIuMAX "\n", ip, (uintmax_t)port);
652
1119
}
653
1120
654
tcp_sd = socket(pf, SOCK_STREAM, 0);
1121
tcp_sd = socket(pf, SOCK_STREAM | SOCK_CLOEXEC, 0);
655
1122
if(tcp_sd < 0){
656
1123
int e = errno;
657
1124
perror_plus("socket");
664
1131
goto mandos_end;
665
1132
}
666
1133
667
memset(&to, 0, sizeof(to));
668
1134
if(af == AF_INET6){
669
to.in6.sin6_family = (sa_family_t)af;
670
ret = inet_pton(af, ip, &to.in6.sin6_addr);
1135
struct sockaddr_in6 *to6 = (struct sockaddr_in6 *)&to;
1136
*to6 = (struct sockaddr_in6){ .sin6_family = (sa_family_t)af };
1137
ret = inet_pton(af, ip, &to6->sin6_addr);
671
1138
} else { /* IPv4 */
672
to.in.sin_family = (sa_family_t)af;
673
ret = inet_pton(af, ip, &to.in.sin_addr);
1139
struct sockaddr_in *to4 = (struct sockaddr_in *)&to;
1140
*to4 = (struct sockaddr_in){ .sin_family = (sa_family_t)af };
1141
ret = inet_pton(af, ip, &to4->sin_addr);
674
1142
}
675
1143
if(ret < 0 ){
676
1144
int e = errno;
685
1153
goto mandos_end;
686
1154
}
687
1155
if(af == AF_INET6){
688
to.in6.sin6_port = htons(port); /* Spurious warnings from
689
-Wconversion and
690
-Wunreachable-code */
691
692
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
693
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
694
-Wunreachable-code*/
1156
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
1157
if(IN6_IS_ADDR_LINKLOCAL
1158
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
695
1159
if(if_index == AVAHI_IF_UNSPEC){
696
fprintf_plus(stderr, "An IPv6 link-local address is incomplete"
697
" without a network interface\n");
1160
fprintf_plus(stderr, "An IPv6 link-local address is"
1161
" incomplete without a network interface\n");
698
1162
errno = EINVAL;
699
1163
goto mandos_end;
700
1164
}
701
1165
/* Set the network interface number as scope */
702
to.in6.sin6_scope_id = (uint32_t)if_index;
1166
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
703
1167
}
704
1168
} else {
705
to.in.sin_port = htons(port); /* Spurious warnings from
706
-Wconversion and
707
-Wunreachable-code */
1169
((struct sockaddr_in *)&to)->sin_port = htons(port);
708
1170
}
709
1171
710
1172
if(quit_now){
718
1180
if(if_indextoname((unsigned int)if_index, interface) == NULL){
719
1181
perror_plus("if_indextoname");
720
1182
} else {
721
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
722
ip, interface, port);
1183
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
1184
"\n", ip, interface, (uintmax_t)port);
723
1185
}
724
1186
} else {
725
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n", ip, port);
1187
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
1188
ip, (uintmax_t)port);
726
1189
}
727
1190
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
728
1191
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
729
const char *pcret;
730
if(af == AF_INET6){
731
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
732
sizeof(addrstr));
733
} else {
734
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
735
sizeof(addrstr));
736
}
737
if(pcret == NULL){
738
perror_plus("inet_ntop");
739
} else {
740
if(strcmp(addrstr, ip) != 0){
741
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
742
}
743
}
744
}
745
746
if(quit_now){
747
errno = EINTR;
748
goto mandos_end;
749
}
750
751
if(af == AF_INET6){
752
ret = connect(tcp_sd, &to.in6, sizeof(to));
753
} else {
754
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
755
}
756
if(ret < 0){
757
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
758
int e = errno;
759
perror_plus("connect");
760
errno = e;
761
}
762
goto mandos_end;
763
}
764
765
if(quit_now){
766
errno = EINTR;
767
goto mandos_end;
1192
if(af == AF_INET6){
1193
ret = getnameinfo((struct sockaddr *)&to,
1194
sizeof(struct sockaddr_in6),
1195
addrstr, sizeof(addrstr), NULL, 0,
1196
NI_NUMERICHOST);
1197
} else {
1198
ret = getnameinfo((struct sockaddr *)&to,
1199
sizeof(struct sockaddr_in),
1200
addrstr, sizeof(addrstr), NULL, 0,
1201
NI_NUMERICHOST);
1202
}
1203
if(ret == EAI_SYSTEM){
1204
perror_plus("getnameinfo");
1205
} else if(ret != 0) {
1206
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
1207
} else if(strcmp(addrstr, ip) != 0){
1208
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
1209
}
1210
}
1211
1212
if(quit_now){
1213
errno = EINTR;
1214
goto mandos_end;
1215
}
1216
1217
while(true){
1218
if(af == AF_INET6){
1219
ret = connect(tcp_sd, (struct sockaddr *)&to,
1220
sizeof(struct sockaddr_in6));
1221
} else {
1222
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
1223
sizeof(struct sockaddr_in));
1224
}
1225
if(ret < 0){
1226
if(errno == ENETUNREACH
1227
and if_index != AVAHI_IF_UNSPEC
1228
and connect_to == NULL
1229
and not route_added and
1230
((af == AF_INET6 and not
1231
IN6_IS_ADDR_LINKLOCAL(&(((struct sockaddr_in6 *)
1232
&to)->sin6_addr)))
1233
or (af == AF_INET and
1234
/* Not a a IPv4LL address */
1235
(ntohl(((struct sockaddr_in *)&to)->sin_addr.s_addr)
1236
& 0xFFFF0000L) != 0xA9FE0000L))){
1237
/* Work around Avahi bug - Avahi does not announce link-local
1238
addresses if it has a global address, so local hosts with
1239
*only* a link-local address (e.g. Mandos clients) cannot
1240
connect to a Mandos server announced by Avahi on a server
1241
host with a global address. Work around this by retrying
1242
with an explicit route added with the server's address.
1243
1244
Avahi bug reference:
1245
http://lists.freedesktop.org/archives/avahi/2010-February/001833.html
1246
https://bugs.debian.org/587961
1247
*/
1248
if(debug){
1249
fprintf_plus(stderr, "Mandos server unreachable, trying"
1250
" direct route\n");
1251
}
1252
int e = errno;
1253
route_added = add_local_route(ip, if_index);
1254
if(route_added){
1255
continue;
1256
}
1257
errno = e;
1258
}
1259
if(errno != ECONNREFUSED or debug){
1260
int e = errno;
1261
perror_plus("connect");
1262
errno = e;
1263
}
1264
goto mandos_end;
1265
}
1266
1267
if(quit_now){
1268
errno = EINTR;
1269
goto mandos_end;
1270
}
1271
break;
768
1272
}
769
1273
770
1274
const char *out = mandos_protocol_version;
806
1310
goto mandos_end;
807
1311
}
808
1312
809
/* Spurious warning from -Wint-to-pointer-cast */
810
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
1313
/* This casting via intptr_t is to eliminate warning about casting
1314
an int to a pointer type. This is exactly how the GnuTLS Guile
1315
function "set-session-transport-fd!" does it. */
1316
gnutls_transport_set_ptr(session,
1317
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
811
1318
812
1319
if(quit_now){
813
1320
errno = EINTR;
834
1341
/* Read OpenPGP packet that contains the wanted password */
835
1342
836
1343
if(debug){
837
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from %s\n", ip);
1344
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
1345
" %s\n", ip);
838
1346
}
839
1347
840
1348
while(true){
878
1386
}
879
1387
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
880
1388
if(ret < 0){
881
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed ***\n");
1389
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
1390
"***\n");
882
1391
gnutls_perror(ret);
883
1392
errno = EPROTO;
884
1393
goto mandos_end;
886
1395
break;
887
1396
default:
888
1397
fprintf_plus(stderr, "Unknown error while reading data from"
889
" encrypted session with Mandos server\n");
1398
" encrypted session with Mandos server\n");
890
1399
gnutls_bye(session, GNUTLS_SHUT_RDWR);
891
1400
errno = EIO;
892
1401
goto mandos_end;
916
1425
if(buffer_length > 0){
917
1426
ssize_t decrypted_buffer_size;
918
1427
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
919
&decrypted_buffer);
1428
&decrypted_buffer, mc);
920
1429
if(decrypted_buffer_size >= 0){
921
1430
922
1431
written = 0;
933
1442
int e = errno;
934
1443
if(debug){
935
1444
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
936
strerror(errno));
1445
strerror(errno));
937
1446
}
938
1447
errno = e;
939
1448
goto mandos_end;
948
1457
949
1458
mandos_end:
950
1459
{
1460
if(route_added){
1461
if(not delete_local_route(ip, if_index)){
1462
fprintf_plus(stderr, "Failed to delete local route to %s on"
1463
" interface %d", ip, if_index);
1464
}
1465
}
951
1466
int e = errno;
952
1467
free(decrypted_buffer);
953
1468
free(buffer);
954
1469
if(tcp_sd >= 0){
955
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
1470
ret = close(tcp_sd);
956
1471
}
957
1472
if(ret == -1){
958
1473
if(e == 0){
970
1485
return retval;
971
1486
}
972
1487
1488
__attribute__((nonnull))
973
1489
static void resolve_callback(AvahiSServiceResolver *r,
974
1490
AvahiIfIndex interface,
975
1491
AvahiProtocol proto,
983
1499
AVAHI_GCC_UNUSED AvahiStringList *txt,
984
1500
AVAHI_GCC_UNUSED AvahiLookupResultFlags
985
1501
flags,
986
AVAHI_GCC_UNUSED void* userdata){
987
assert(r);
1502
void *mc){
1503
if(r == NULL){
1504
return;
1505
}
988
1506
989
1507
/* Called whenever a service has been resolved successfully or
990
1508
timed out */
991
1509
992
1510
if(quit_now){
1511
avahi_s_service_resolver_free(r);
993
1512
return;
994
1513
}
995
1514
996
1515
switch(event){
997
1516
default:
998
1517
case AVAHI_RESOLVER_FAILURE:
999
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
1000
" of type '%s' in domain '%s': %s\n", name, type, domain,
1001
avahi_strerror(avahi_server_errno(mc.server)));
1518
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1519
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1520
domain,
1521
avahi_strerror(avahi_server_errno
1522
(((mandos_context*)mc)->server)));
1002
1523
break;
1003
1524
1004
1525
case AVAHI_RESOLVER_FOUND:
1007
1528
avahi_address_snprint(ip, sizeof(ip), address);
1008
1529
if(debug){
1009
1530
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1010
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
1011
ip, (intmax_t)interface, port);
1531
PRIdMAX ") on port %" PRIu16 "\n", name,
1532
host_name, ip, (intmax_t)interface, port);
1012
1533
}
1013
int ret = start_mandos_communication(ip, port, interface,
1014
avahi_proto_to_af(proto));
1534
int ret = start_mandos_communication(ip, (in_port_t)port,
1535
interface,
1536
avahi_proto_to_af(proto),
1537
mc);
1015
1538
if(ret == 0){
1016
avahi_simple_poll_quit(mc.simple_poll);
1539
avahi_simple_poll_quit(simple_poll);
1017
1540
} else {
1018
ret = add_server(ip, port, interface,
1019
avahi_proto_to_af(proto));
1541
if(not add_server(ip, (in_port_t)port, interface,
1542
avahi_proto_to_af(proto),
1543
&((mandos_context*)mc)->current_server)){
1544
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1545
" list\n", name);
1546
}
1020
1547
}
1021
1548
}
1022
1549
}
1032
1559
const char *domain,
1033
1560
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1034
1561
flags,
1035
AVAHI_GCC_UNUSED void* userdata){
1036
assert(b);
1562
void *mc){
1563
if(b == NULL){
1564
return;
1565
}
1037
1566
1038
1567
/* Called whenever a new services becomes available on the LAN or
1039
1568
is removed from the LAN */
1047
1576
case AVAHI_BROWSER_FAILURE:
1048
1577
1049
1578
fprintf_plus(stderr, "(Avahi browser) %s\n",
1050
avahi_strerror(avahi_server_errno(mc.server)));
1051
avahi_simple_poll_quit(mc.simple_poll);
1579
avahi_strerror(avahi_server_errno
1580
(((mandos_context*)mc)->server)));
1581
avahi_simple_poll_quit(simple_poll);
1052
1582
return;
1053
1583
1054
1584
case AVAHI_BROWSER_NEW:
1057
1587
the callback function is called the Avahi server will free the
1058
1588
resolver for us. */
1059
1589
1060
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1061
name, type, domain, protocol, 0,
1062
resolve_callback, NULL) == NULL)
1063
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s': %s\n",
1064
name, avahi_strerror(avahi_server_errno(mc.server)));
1590
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1591
interface, protocol, name, type,
1592
domain, protocol, 0,
1593
resolve_callback, mc) == NULL)
1594
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1595
" %s\n", name,
1596
avahi_strerror(avahi_server_errno
1597
(((mandos_context*)mc)->server)));
1065
1598
break;
1066
1599
1067
1600
case AVAHI_BROWSER_REMOVE:
1070
1603
case AVAHI_BROWSER_ALL_FOR_NOW:
1071
1604
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1072
1605
if(debug){
1073
fprintf_plus(stderr, "No Mandos server found, still searching...\n");
1606
fprintf_plus(stderr, "No Mandos server found, still"
1607
" searching...\n");
1074
1608
}
1075
1609
break;
1076
1610
}
1085
1619
signal_received = sig;
1086
1620
int old_errno = errno;
1087
1621
/* set main loop to exit */
1088
if(mc.simple_poll != NULL){
1089
avahi_simple_poll_quit(mc.simple_poll);
1622
if(simple_poll != NULL){
1623
avahi_simple_poll_quit(simple_poll);
1090
1624
}
1091
1625
errno = old_errno;
1092
1626
}
1093
1627
1628
__attribute__((nonnull, warn_unused_result))
1094
1629
bool get_flags(const char *ifname, struct ifreq *ifr){
1095
1630
int ret;
1631
error_t ret_errno;
1096
1632
1097
1633
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1098
1634
if(s < 0){
1635
ret_errno = errno;
1099
1636
perror_plus("socket");
1637
errno = ret_errno;
1100
1638
return false;
1101
1639
}
1102
1640
strcpy(ifr->ifr_name, ifname);
1103
1641
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1104
1642
if(ret == -1){
1105
1643
if(debug){
1644
ret_errno = errno;
1106
1645
perror_plus("ioctl SIOCGIFFLAGS");
1646
errno = ret_errno;
1107
1647
}
1108
1648
return false;
1109
1649
}
1110
1650
return true;
1111
1651
}
1112
1652
1653
__attribute__((nonnull, warn_unused_result))
1113
1654
bool good_flags(const char *ifname, const struct ifreq *ifr){
1114
1655
1115
1656
/* Reject the loopback device */
1116
1657
if(ifr->ifr_flags & IFF_LOOPBACK){
1117
1658
if(debug){
1118
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n", ifname);
1659
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1660
ifname);
1119
1661
}
1120
1662
return false;
1121
1663
}
1122
1664
/* Accept point-to-point devices only if connect_to is specified */
1123
1665
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1124
1666
if(debug){
1125
fprintf_plus(stderr, "Accepting point-to-point interface \"%s\"\n", ifname);
1667
fprintf_plus(stderr, "Accepting point-to-point interface"
1668
" \"%s\"\n", ifname);
1126
1669
}
1127
1670
return true;
1128
1671
}
1129
1672
/* Otherwise, reject non-broadcast-capable devices */
1130
1673
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1131
1674
if(debug){
1132
fprintf_plus(stderr, "Rejecting non-broadcast interface \"%s\"\n", ifname);
1675
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1676
" \"%s\"\n", ifname);
1133
1677
}
1134
1678
return false;
1135
1679
}
1136
1680
/* Reject non-ARP interfaces (including dummy interfaces) */
1137
1681
if(ifr->ifr_flags & IFF_NOARP){
1138
1682
if(debug){
1139
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n", ifname);
1683
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1684
ifname);
1140
1685
}
1141
1686
return false;
1142
1687
}
1153
1698
* corresponds to an acceptable network device.
1154
1699
* (This function is passed to scandir(3) as a filter function.)
1155
1700
*/
1701
__attribute__((nonnull, warn_unused_result))
1156
1702
int good_interface(const struct dirent *if_entry){
1157
1703
if(if_entry->d_name[0] == '.'){
1158
1704
return 0;
1161
1707
struct ifreq ifr;
1162
1708
if(not get_flags(if_entry->d_name, &ifr)){
1163
1709
if(debug){
1164
fprintf_plus(stderr, "Failed to get flags for interface \"%s\"\n",
1165
if_entry->d_name);
1166
}
1167
return 0;
1168
}
1169
1170
if(not good_flags(if_entry->d_name, &ifr)){
1171
return 0;
1172
}
1173
return 1;
1174
}
1175
1176
/*
1177
* This function determines if a directory entry in /sys/class/net
1178
* corresponds to an acceptable network device which is up.
1179
* (This function is passed to scandir(3) as a filter function.)
1180
*/
1181
int up_interface(const struct dirent *if_entry){
1182
if(if_entry->d_name[0] == '.'){
1183
return 0;
1184
}
1185
1186
struct ifreq ifr;
1187
if(not get_flags(if_entry->d_name, &ifr)){
1188
if(debug){
1189
fprintf_plus(stderr, "Failed to get flags for interface \"%s\"\n",
1190
if_entry->d_name);
1191
}
1192
return 0;
1193
}
1194
1195
/* Reject down interfaces */
1196
if(not (ifr.ifr_flags & IFF_UP)){
1197
if(debug){
1198
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1199
if_entry->d_name);
1200
}
1201
return 0;
1202
}
1203
1204
/* Reject non-running interfaces */
1205
if(not (ifr.ifr_flags & IFF_RUNNING)){
1206
if(debug){
1207
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1208
if_entry->d_name);
1209
}
1210
return 0;
1211
}
1212
1213
if(not good_flags(if_entry->d_name, &ifr)){
1214
return 0;
1215
}
1216
return 1;
1217
}
1218
1710
fprintf_plus(stderr, "Failed to get flags for interface "
1711
"\"%s\"\n", if_entry->d_name);
1712
}
1713
return 0;
1714
}
1715
1716
if(not good_flags(if_entry->d_name, &ifr)){
1717
return 0;
1718
}
1719
return 1;
1720
}
1721
1722
/*
1723
* This function determines if a network interface is up.
1724
*/
1725
__attribute__((nonnull, warn_unused_result))
1726
bool interface_is_up(const char *interface){
1727
struct ifreq ifr;
1728
if(not get_flags(interface, &ifr)){
1729
if(debug){
1730
fprintf_plus(stderr, "Failed to get flags for interface "
1731
"\"%s\"\n", interface);
1732
}
1733
return false;
1734
}
1735
1736
return (bool)(ifr.ifr_flags & IFF_UP);
1737
}
1738
1739
/*
1740
* This function determines if a network interface is running
1741
*/
1742
__attribute__((nonnull, warn_unused_result))
1743
bool interface_is_running(const char *interface){
1744
struct ifreq ifr;
1745
if(not get_flags(interface, &ifr)){
1746
if(debug){
1747
fprintf_plus(stderr, "Failed to get flags for interface "
1748
"\"%s\"\n", interface);
1749
}
1750
return false;
1751
}
1752
1753
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1754
}
1755
1756
__attribute__((nonnull, pure, warn_unused_result))
1219
1757
int notdotentries(const struct dirent *direntry){
1220
1758
/* Skip "." and ".." */
1221
1759
if(direntry->d_name[0] == '.'
1228
1766
}
1229
1767
1230
1768
/* Is this directory entry a runnable program? */
1769
__attribute__((nonnull, warn_unused_result))
1231
1770
int runnable_hook(const struct dirent *direntry){
1232
1771
int ret;
1233
1772
size_t sret;
1241
1780
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1242
1781
"abcdefghijklmnopqrstuvwxyz"
1243
1782
"0123456789"
1244
"_-");
1783
"_.-");
1245
1784
if((direntry->d_name)[sret] != '\0'){
1246
1785
/* Contains non-allowed characters */
1247
1786
if(debug){
1248
1787
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1249
direntry->d_name);
1788
direntry->d_name);
1250
1789
}
1251
1790
return 0;
1252
1791
}
1253
1792
1254
char *fullname = NULL;
1255
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1256
if(ret < 0){
1257
perror_plus("asprintf");
1258
return 0;
1259
}
1260
1261
ret = stat(fullname, &st);
1793
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1262
1794
if(ret == -1){
1263
1795
if(debug){
1264
1796
perror_plus("Could not stat hook");
1269
1801
/* Not a regular file */
1270
1802
if(debug){
1271
1803
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1272
direntry->d_name);
1804
direntry->d_name);
1273
1805
}
1274
1806
return 0;
1275
1807
}
1277
1809
/* Not executable */
1278
1810
if(debug){
1279
1811
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1280
direntry->d_name);
1812
direntry->d_name);
1281
1813
}
1282
1814
return 0;
1283
1815
}
1816
if(debug){
1817
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1818
direntry->d_name);
1819
}
1284
1820
return 1;
1285
1821
}
1286
1822
1287
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1823
__attribute__((nonnull, warn_unused_result))
1824
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1825
mandos_context *mc){
1288
1826
int ret;
1289
1827
struct timespec now;
1290
1828
struct timespec waited_time;
1291
1829
intmax_t block_time;
1292
1830
1293
1831
while(true){
1294
if(mc.current_server == NULL){
1295
if (debug){
1296
fprintf_plus(stderr, "Wait until first server is found. No timeout!\n");
1832
if(mc->current_server == NULL){
1833
if(debug){
1834
fprintf_plus(stderr, "Wait until first server is found."
1835
" No timeout!\n");
1297
1836
}
1298
1837
ret = avahi_simple_poll_iterate(s, -1);
1299
1838
} else {
1300
if (debug){
1301
fprintf_plus(stderr, "Check current_server if we should run it,"
1302
" or wait\n");
1839
if(debug){
1840
fprintf_plus(stderr, "Check current_server if we should run"
1841
" it, or wait\n");
1303
1842
}
1304
1843
/* the current time */
1305
1844
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1310
1849
/* Calculating in ms how long time between now and server
1311
1850
who we visted longest time ago. Now - last seen. */
1312
1851
waited_time.tv_sec = (now.tv_sec
1313
- mc.current_server->last_seen.tv_sec);
1852
- mc->current_server->last_seen.tv_sec);
1314
1853
waited_time.tv_nsec = (now.tv_nsec
1315
- mc.current_server->last_seen.tv_nsec);
1854
- mc->current_server->last_seen.tv_nsec);
1316
1855
/* total time is 10s/10,000ms.
1317
1856
Converting to s from ms by dividing by 1,000,
1318
1857
and ns to ms by dividing by 1,000,000. */
1320
1859
- ((intmax_t)waited_time.tv_sec * 1000))
1321
1860
- ((intmax_t)waited_time.tv_nsec / 1000000));
1322
1861
1323
if (debug){
1324
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n", block_time);
1862
if(debug){
1863
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1864
block_time);
1325
1865
}
1326
1866
1327
1867
if(block_time <= 0){
1328
ret = start_mandos_communication(mc.current_server->ip,
1329
mc.current_server->port,
1330
mc.current_server->if_index,
1331
mc.current_server->af);
1868
ret = start_mandos_communication(mc->current_server->ip,
1869
mc->current_server->port,
1870
mc->current_server->if_index,
1871
mc->current_server->af, mc);
1332
1872
if(ret == 0){
1333
avahi_simple_poll_quit(mc.simple_poll);
1873
avahi_simple_poll_quit(s);
1334
1874
return 0;
1335
1875
}
1336
1876
ret = clock_gettime(CLOCK_MONOTONIC,
1337
&mc.current_server->last_seen);
1877
&mc->current_server->last_seen);
1338
1878
if(ret == -1){
1339
1879
perror_plus("clock_gettime");
1340
1880
return -1;
1341
1881
}
1342
mc.current_server = mc.current_server->next;
1882
mc->current_server = mc->current_server->next;
1343
1883
block_time = 0; /* Call avahi to find new Mandos
1344
1884
servers, but don't block */
1345
1885
}
1347
1887
ret = avahi_simple_poll_iterate(s, (int)block_time);
1348
1888
}
1349
1889
if(ret != 0){
1350
if (ret > 0 or errno != EINTR){
1890
if(ret > 0 or errno != EINTR){
1351
1891
return (ret != 1) ? ret : 0;
1352
1892
}
1353
1893
}
1354
1894
}
1355
1895
}
1356
1896
1897
__attribute__((nonnull))
1898
void run_network_hooks(const char *mode, const char *interface,
1899
const float delay){
1900
struct dirent **direntries = NULL;
1901
if(hookdir_fd == -1){
1902
hookdir_fd = open(hookdir, O_RDONLY | O_DIRECTORY | O_PATH
1903
| O_CLOEXEC);
1904
if(hookdir_fd == -1){
1905
if(errno == ENOENT){
1906
if(debug){
1907
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1908
" found\n", hookdir);
1909
}
1910
} else {
1911
perror_plus("open");
1912
}
1913
return;
1914
}
1915
}
1916
#ifdef __GLIBC__
1917
#if __GLIBC_PREREQ(2, 15)
1918
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1919
runnable_hook, alphasort);
1920
#else /* not __GLIBC_PREREQ(2, 15) */
1921
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1922
alphasort);
1923
#endif /* not __GLIBC_PREREQ(2, 15) */
1924
#else /* not __GLIBC__ */
1925
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1926
alphasort);
1927
#endif /* not __GLIBC__ */
1928
if(numhooks == -1){
1929
perror_plus("scandir");
1930
return;
1931
}
1932
struct dirent *direntry;
1933
int ret;
1934
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
1935
if(devnull == -1){
1936
perror_plus("open(\"/dev/null\", O_RDONLY)");
1937
return;
1938
}
1939
for(int i = 0; i < numhooks; i++){
1940
direntry = direntries[i];
1941
if(debug){
1942
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1943
direntry->d_name);
1944
}
1945
pid_t hook_pid = fork();
1946
if(hook_pid == 0){
1947
/* Child */
1948
/* Raise privileges */
1949
errno = raise_privileges_permanently();
1950
if(errno != 0){
1951
perror_plus("Failed to raise privileges");
1952
_exit(EX_NOPERM);
1953
}
1954
/* Set group */
1955
errno = 0;
1956
ret = setgid(0);
1957
if(ret == -1){
1958
perror_plus("setgid");
1959
_exit(EX_NOPERM);
1960
}
1961
/* Reset supplementary groups */
1962
errno = 0;
1963
ret = setgroups(0, NULL);
1964
if(ret == -1){
1965
perror_plus("setgroups");
1966
_exit(EX_NOPERM);
1967
}
1968
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1969
if(ret == -1){
1970
perror_plus("setenv");
1971
_exit(EX_OSERR);
1972
}
1973
ret = setenv("DEVICE", interface, 1);
1974
if(ret == -1){
1975
perror_plus("setenv");
1976
_exit(EX_OSERR);
1977
}
1978
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1979
if(ret == -1){
1980
perror_plus("setenv");
1981
_exit(EX_OSERR);
1982
}
1983
ret = setenv("MODE", mode, 1);
1984
if(ret == -1){
1985
perror_plus("setenv");
1986
_exit(EX_OSERR);
1987
}
1988
char *delaystring;
1989
ret = asprintf(&delaystring, "%f", (double)delay);
1990
if(ret == -1){
1991
perror_plus("asprintf");
1992
_exit(EX_OSERR);
1993
}
1994
ret = setenv("DELAY", delaystring, 1);
1995
if(ret == -1){
1996
free(delaystring);
1997
perror_plus("setenv");
1998
_exit(EX_OSERR);
1999
}
2000
free(delaystring);
2001
if(connect_to != NULL){
2002
ret = setenv("CONNECT", connect_to, 1);
2003
if(ret == -1){
2004
perror_plus("setenv");
2005
_exit(EX_OSERR);
2006
}
2007
}
2008
int hook_fd = (int)TEMP_FAILURE_RETRY(openat(hookdir_fd,
2009
direntry->d_name,
2010
O_RDONLY));
2011
if(hook_fd == -1){
2012
perror_plus("openat");
2013
_exit(EXIT_FAILURE);
2014
}
2015
if(close(hookdir_fd) == -1){
2016
perror_plus("close");
2017
_exit(EXIT_FAILURE);
2018
}
2019
ret = dup2(devnull, STDIN_FILENO);
2020
if(ret == -1){
2021
perror_plus("dup2(devnull, STDIN_FILENO)");
2022
_exit(EX_OSERR);
2023
}
2024
ret = close(devnull);
2025
if(ret == -1){
2026
perror_plus("close");
2027
_exit(EX_OSERR);
2028
}
2029
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
2030
if(ret == -1){
2031
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
2032
_exit(EX_OSERR);
2033
}
2034
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
2035
environ) == -1){
2036
perror_plus("fexecve");
2037
_exit(EXIT_FAILURE);
2038
}
2039
} else {
2040
if(hook_pid == -1){
2041
perror_plus("fork");
2042
free(direntry);
2043
continue;
2044
}
2045
int status;
2046
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
2047
perror_plus("waitpid");
2048
free(direntry);
2049
continue;
2050
}
2051
if(WIFEXITED(status)){
2052
if(WEXITSTATUS(status) != 0){
2053
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
2054
" with status %d\n", direntry->d_name,
2055
WEXITSTATUS(status));
2056
free(direntry);
2057
continue;
2058
}
2059
} else if(WIFSIGNALED(status)){
2060
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
2061
" signal %d\n", direntry->d_name,
2062
WTERMSIG(status));
2063
free(direntry);
2064
continue;
2065
} else {
2066
fprintf_plus(stderr, "Warning: network hook \"%s\""
2067
" crashed\n", direntry->d_name);
2068
free(direntry);
2069
continue;
2070
}
2071
}
2072
if(debug){
2073
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
2074
direntry->d_name);
2075
}
2076
free(direntry);
2077
}
2078
free(direntries);
2079
if(close(hookdir_fd) == -1){
2080
perror_plus("close");
2081
} else {
2082
hookdir_fd = -1;
2083
}
2084
close(devnull);
2085
}
2086
2087
__attribute__((nonnull, warn_unused_result))
2088
error_t bring_up_interface(const char *const interface,
2089
const float delay){
2090
error_t old_errno = errno;
2091
int ret;
2092
struct ifreq network;
2093
unsigned int if_index = if_nametoindex(interface);
2094
if(if_index == 0){
2095
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
2096
errno = old_errno;
2097
return ENXIO;
2098
}
2099
2100
if(quit_now){
2101
errno = old_errno;
2102
return EINTR;
2103
}
2104
2105
if(not interface_is_up(interface)){
2106
error_t ret_errno = 0, ioctl_errno = 0;
2107
if(not get_flags(interface, &network)){
2108
ret_errno = errno;
2109
fprintf_plus(stderr, "Failed to get flags for interface "
2110
"\"%s\"\n", interface);
2111
errno = old_errno;
2112
return ret_errno;
2113
}
2114
network.ifr_flags |= IFF_UP; /* set flag */
2115
2116
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
2117
if(sd == -1){
2118
ret_errno = errno;
2119
perror_plus("socket");
2120
errno = old_errno;
2121
return ret_errno;
2122
}
2123
2124
if(quit_now){
2125
ret = close(sd);
2126
if(ret == -1){
2127
perror_plus("close");
2128
}
2129
errno = old_errno;
2130
return EINTR;
2131
}
2132
2133
if(debug){
2134
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
2135
interface);
2136
}
2137
2138
/* Raise privileges */
2139
ret_errno = raise_privileges();
2140
if(ret_errno != 0){
2141
errno = ret_errno;
2142
perror_plus("Failed to raise privileges");
2143
}
2144
2145
#ifdef __linux__
2146
int ret_linux;
2147
bool restore_loglevel = false;
2148
if(ret_errno == 0){
2149
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
2150
messages about the network interface to mess up the prompt */
2151
ret_linux = klogctl(8, NULL, 5);
2152
if(ret_linux == -1){
2153
perror_plus("klogctl");
2154
} else {
2155
restore_loglevel = true;
2156
}
2157
}
2158
#endif /* __linux__ */
2159
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
2160
ioctl_errno = errno;
2161
#ifdef __linux__
2162
if(restore_loglevel){
2163
ret_linux = klogctl(7, NULL, 0);
2164
if(ret_linux == -1){
2165
perror_plus("klogctl");
2166
}
2167
}
2168
#endif /* __linux__ */
2169
2170
/* If raise_privileges() succeeded above */
2171
if(ret_errno == 0){
2172
/* Lower privileges */
2173
ret_errno = lower_privileges();
2174
if(ret_errno != 0){
2175
errno = ret_errno;
2176
perror_plus("Failed to lower privileges");
2177
}
2178
}
2179
2180
/* Close the socket */
2181
ret = close(sd);
2182
if(ret == -1){
2183
perror_plus("close");
2184
}
2185
2186
if(ret_setflags == -1){
2187
errno = ioctl_errno;
2188
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
2189
errno = old_errno;
2190
return ioctl_errno;
2191
}
2192
} else if(debug){
2193
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
2194
interface);
2195
}
2196
2197
/* Sleep checking until interface is running.
2198
Check every 0.25s, up to total time of delay */
2199
for(int i=0; i < delay * 4; i++){
2200
if(interface_is_running(interface)){
2201
break;
2202
}
2203
struct timespec sleeptime = { .tv_nsec = 250000000 };
2204
ret = nanosleep(&sleeptime, NULL);
2205
if(ret == -1 and errno != EINTR){
2206
perror_plus("nanosleep");
2207
}
2208
}
2209
2210
errno = old_errno;
2211
return 0;
2212
}
2213
2214
__attribute__((nonnull, warn_unused_result))
2215
error_t take_down_interface(const char *const interface){
2216
error_t old_errno = errno;
2217
struct ifreq network;
2218
unsigned int if_index = if_nametoindex(interface);
2219
if(if_index == 0){
2220
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
2221
errno = old_errno;
2222
return ENXIO;
2223
}
2224
if(interface_is_up(interface)){
2225
error_t ret_errno = 0, ioctl_errno = 0;
2226
if(not get_flags(interface, &network) and debug){
2227
ret_errno = errno;
2228
fprintf_plus(stderr, "Failed to get flags for interface "
2229
"\"%s\"\n", interface);
2230
errno = old_errno;
2231
return ret_errno;
2232
}
2233
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2234
2235
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
2236
if(sd == -1){
2237
ret_errno = errno;
2238
perror_plus("socket");
2239
errno = old_errno;
2240
return ret_errno;
2241
}
2242
2243
if(debug){
2244
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
2245
interface);
2246
}
2247
2248
/* Raise privileges */
2249
ret_errno = raise_privileges();
2250
if(ret_errno != 0){
2251
errno = ret_errno;
2252
perror_plus("Failed to raise privileges");
2253
}
2254
2255
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
2256
ioctl_errno = errno;
2257
2258
/* If raise_privileges() succeeded above */
2259
if(ret_errno == 0){
2260
/* Lower privileges */
2261
ret_errno = lower_privileges();
2262
if(ret_errno != 0){
2263
errno = ret_errno;
2264
perror_plus("Failed to lower privileges");
2265
}
2266
}
2267
2268
/* Close the socket */
2269
int ret = close(sd);
2270
if(ret == -1){
2271
perror_plus("close");
2272
}
2273
2274
if(ret_setflags == -1){
2275
errno = ioctl_errno;
2276
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2277
errno = old_errno;
2278
return ioctl_errno;
2279
}
2280
} else if(debug){
2281
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
2282
interface);
2283
}
2284
2285
errno = old_errno;
2286
return 0;
2287
}
2288
1357
2289
int main(int argc, char *argv[]){
2290
mandos_context mc = { .server = NULL, .dh_bits = 0,
2291
.priority = "SECURE256:!CTYPE-X.509"
2292
":+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256",
2293
.current_server = NULL, .interfaces = NULL,
2294
.interfaces_size = 0 };
1358
2295
AvahiSServiceBrowser *sb = NULL;
1359
int error;
2296
error_t ret_errno;
1360
2297
int ret;
1361
2298
intmax_t tmpmax;
1362
2299
char *tmp;
1363
2300
int exitcode = EXIT_SUCCESS;
1364
const char *interface = "";
1365
struct ifreq network;
1366
int sd = -1;
1367
bool take_down_interface = false;
1368
uid_t uid;
1369
gid_t gid;
1370
char tempdir[] = "/tmp/mandosXXXXXX";
1371
bool tempdir_created = false;
2301
char *interfaces_to_take_down = NULL;
2302
size_t interfaces_to_take_down_size = 0;
2303
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
2304
char old_tempdir[] = "/tmp/mandosXXXXXX";
2305
char *tempdir = NULL;
1372
2306
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1373
2307
const char *seckey = PATHDIR "/" SECKEY;
1374
2308
const char *pubkey = PATHDIR "/" PUBKEY;
2309
const char *dh_params_file = NULL;
2310
char *interfaces_hooks = NULL;
1375
2311
1376
2312
bool gnutls_initialized = false;
1377
2313
bool gpgme_initialized = false;
1429
2365
.doc = "Bit length of the prime number used in the"
1430
2366
" Diffie-Hellman key exchange",
1431
2367
.group = 2 },
2368
{ .name = "dh-params", .key = 134,
2369
.arg = "FILE",
2370
.doc = "PEM-encoded PKCS#3 file with pre-generated parameters"
2371
" for the Diffie-Hellman key exchange",
2372
.group = 2 },
1432
2373
{ .name = "priority", .key = 130,
1433
2374
.arg = "STRING",
1434
2375
.doc = "GnuTLS priority string for the TLS handshake",
1439
2380
.group = 2 },
1440
2381
{ .name = "retry", .key = 132,
1441
2382
.arg = "SECONDS",
1442
.doc = "Retry interval used when denied by the mandos server",
2383
.doc = "Retry interval used when denied by the Mandos server",
1443
2384
.group = 2 },
1444
2385
{ .name = "network-hook-dir", .key = 133,
1445
2386
.arg = "DIR",
1468
2409
connect_to = arg;
1469
2410
break;
1470
2411
case 'i': /* --interface */
1471
interface = arg;
2412
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
2413
arg, (int)',');
2414
if(ret_errno != 0){
2415
argp_error(state, "%s", strerror(ret_errno));
2416
}
1472
2417
break;
1473
2418
case 's': /* --seckey */
1474
2419
seckey = arg;
1485
2430
}
1486
2431
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1487
2432
break;
2433
case 134: /* --dh-params */
2434
dh_params_file = arg;
2435
break;
1488
2436
case 130: /* --priority */
1489
2437
mc.priority = arg;
1490
2438
break;
1517
2465
argp_state_help(state, state->out_stream,
1518
2466
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1519
2467
case 'V': /* --version */
1520
fprintf_plus(state->out_stream, "Mandos plugin mandos-client: ");
1521
2468
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1522
2469
exit(argp_err_exit_status);
1523
2470
break;
1547
2494
goto end;
1548
2495
}
1549
2496
}
1550
2497
1551
2498
{
1552
2499
/* Work around Debian bug #633582:
1553
2500
<http://bugs.debian.org/633582> */
1554
struct stat st;
1555
1556
/* Re-raise priviliges */
1557
errno = 0;
1558
ret = seteuid(0);
1559
if(ret == -1){
1560
perror_plus("seteuid");
1561
}
1562
1563
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1564
int seckey_fd = open(seckey, O_RDONLY);
1565
if(seckey_fd == -1){
1566
perror_plus("open");
1567
} else {
1568
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1569
if(ret == -1){
1570
perror_plus("fstat");
1571
} else {
1572
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1573
ret = fchown(seckey_fd, uid, gid);
1574
if(ret == -1){
1575
perror_plus("fchown");
1576
}
1577
}
1578
}
1579
TEMP_FAILURE_RETRY(close(seckey_fd));
1580
}
1581
}
1582
1583
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1584
int pubkey_fd = open(pubkey, O_RDONLY);
1585
if(pubkey_fd == -1){
1586
perror_plus("open");
1587
} else {
1588
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1589
if(ret == -1){
1590
perror_plus("fstat");
1591
} else {
1592
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1593
ret = fchown(pubkey_fd, uid, gid);
1594
if(ret == -1){
1595
perror_plus("fchown");
1596
}
1597
}
1598
}
1599
TEMP_FAILURE_RETRY(close(pubkey_fd));
1600
}
1601
}
1602
1603
/* Lower privileges */
1604
errno = 0;
1605
ret = seteuid(uid);
1606
if(ret == -1){
1607
perror_plus("seteuid");
1608
}
1609
}
1610
1611
/* Find network hooks and run them */
1612
{
1613
struct dirent **direntries;
1614
struct dirent *direntry;
1615
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1616
alphasort);
1617
if(numhooks == -1){
1618
perror_plus("scandir");
2501
2502
/* Re-raise privileges */
2503
ret_errno = raise_privileges();
2504
if(ret_errno != 0){
2505
errno = ret_errno;
2506
perror_plus("Failed to raise privileges");
1619
2507
} else {
1620
int devnull = open("/dev/null", O_RDONLY);
1621
for(int i = 0; i < numhooks; i++){
1622
direntry = direntries[0];
1623
char *fullname = NULL;
1624
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1625
if(ret < 0){
1626
perror_plus("asprintf");
1627
continue;
1628
}
1629
pid_t hook_pid = fork();
1630
if(hook_pid == 0){
1631
/* Child */
1632
dup2(devnull, STDIN_FILENO);
1633
close(devnull);
1634
dup2(STDERR_FILENO, STDOUT_FILENO);
1635
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1636
if(ret == -1){
1637
perror_plus("setenv");
1638
exit(1);
1639
}
1640
ret = setenv("DEVICE", interface, 1);
1641
if(ret == -1){
1642
perror_plus("setenv");
1643
exit(1);
1644
}
1645
ret = setenv("VERBOSE", debug ? "1" : "0", 1);
1646
if(ret == -1){
1647
perror_plus("setenv");
1648
exit(1);
1649
}
1650
ret = setenv("MODE", "start", 1);
1651
if(ret == -1){
1652
perror_plus("setenv");
1653
exit(1);
1654
}
1655
char *delaystring;
1656
ret = asprintf(&delaystring, "%f", delay);
1657
if(ret == -1){
1658
perror_plus("asprintf");
1659
exit(1);
1660
}
1661
ret = setenv("DELAY", delaystring, 1);
1662
if(ret == -1){
1663
free(delaystring);
1664
perror_plus("setenv");
1665
exit(1);
1666
}
1667
free(delaystring);
1668
ret = execl(fullname, direntry->d_name, "start", NULL);
1669
perror_plus("execl");
1670
} else {
1671
int status;
1672
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1673
perror_plus("waitpid");
1674
free(fullname);
1675
continue;
1676
}
1677
if(WIFEXITED(status)){
1678
if(WEXITSTATUS(status) != 0){
1679
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1680
" with status %d\n", direntry->d_name,
1681
WEXITSTATUS(status));
1682
free(fullname);
1683
continue;
1684
}
1685
} else if(WIFSIGNALED(status)){
1686
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1687
" signal %d\n", direntry->d_name,
1688
WTERMSIG(status));
1689
free(fullname);
1690
continue;
1691
} else {
1692
fprintf_plus(stderr, "Warning: network hook \"%s\" crashed\n",
1693
direntry->d_name);
1694
free(fullname);
1695
continue;
1696
}
1697
}
1698
free(fullname);
1699
if(quit_now){
1700
goto end;
1701
}
1702
}
1703
close(devnull);
1704
}
2508
struct stat st;
2509
2510
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2511
int seckey_fd = open(seckey, O_RDONLY);
2512
if(seckey_fd == -1){
2513
perror_plus("open");
2514
} else {
2515
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
2516
if(ret == -1){
2517
perror_plus("fstat");
2518
} else {
2519
if(S_ISREG(st.st_mode)
2520
and st.st_uid == 0 and st.st_gid == 0){
2521
ret = fchown(seckey_fd, uid, gid);
2522
if(ret == -1){
2523
perror_plus("fchown");
2524
}
2525
}
2526
}
2527
close(seckey_fd);
2528
}
2529
}
2530
2531
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
2532
int pubkey_fd = open(pubkey, O_RDONLY);
2533
if(pubkey_fd == -1){
2534
perror_plus("open");
2535
} else {
2536
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
2537
if(ret == -1){
2538
perror_plus("fstat");
2539
} else {
2540
if(S_ISREG(st.st_mode)
2541
and st.st_uid == 0 and st.st_gid == 0){
2542
ret = fchown(pubkey_fd, uid, gid);
2543
if(ret == -1){
2544
perror_plus("fchown");
2545
}
2546
}
2547
}
2548
close(pubkey_fd);
2549
}
2550
}
2551
2552
if(dh_params_file != NULL
2553
and strcmp(dh_params_file, PATHDIR "/dhparams.pem" ) == 0){
2554
int dhparams_fd = open(dh_params_file, O_RDONLY);
2555
if(dhparams_fd == -1){
2556
perror_plus("open");
2557
} else {
2558
ret = (int)TEMP_FAILURE_RETRY(fstat(dhparams_fd, &st));
2559
if(ret == -1){
2560
perror_plus("fstat");
2561
} else {
2562
if(S_ISREG(st.st_mode)
2563
and st.st_uid == 0 and st.st_gid == 0){
2564
ret = fchown(dhparams_fd, uid, gid);
2565
if(ret == -1){
2566
perror_plus("fchown");
2567
}
2568
}
2569
}
2570
close(dhparams_fd);
2571
}
2572
}
2573
2574
/* Lower privileges */
2575
ret_errno = lower_privileges();
2576
if(ret_errno != 0){
2577
errno = ret_errno;
2578
perror_plus("Failed to lower privileges");
2579
}
2580
}
2581
}
2582
2583
/* Remove invalid interface names (except "none") */
2584
{
2585
char *interface = NULL;
2586
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2587
interface))){
2588
if(strcmp(interface, "none") != 0
2589
and if_nametoindex(interface) == 0){
2590
if(interface[0] != '\0'){
2591
fprintf_plus(stderr, "Not using nonexisting interface"
2592
" \"%s\"\n", interface);
2593
}
2594
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2595
interface = NULL;
2596
}
2597
}
2598
}
2599
2600
/* Run network hooks */
2601
{
2602
if(mc.interfaces != NULL){
2603
interfaces_hooks = malloc(mc.interfaces_size);
2604
if(interfaces_hooks == NULL){
2605
perror_plus("malloc");
2606
goto end;
2607
}
2608
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2609
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2610
}
2611
run_network_hooks("start", interfaces_hooks != NULL ?
2612
interfaces_hooks : "", delay);
1705
2613
}
1706
2614
1707
2615
if(not debug){
1708
2616
avahi_set_log_function(empty_log);
1709
2617
}
1710
2618
1711
if(interface[0] == '\0'){
1712
struct dirent **direntries;
1713
/* First look for interfaces that are up */
1714
ret = scandir(sys_class_net, &direntries, up_interface,
1715
alphasort);
1716
if(ret == 0){
1717
/* No up interfaces, look for any good interfaces */
1718
free(direntries);
1719
ret = scandir(sys_class_net, &direntries, good_interface,
1720
alphasort);
1721
}
1722
if(ret >= 1){
1723
/* Pick the first interface returned */
1724
interface = strdup(direntries[0]->d_name);
1725
if(debug){
1726
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1727
}
1728
if(interface == NULL){
1729
perror_plus("malloc");
1730
free(direntries);
1731
exitcode = EXIT_FAILURE;
1732
goto end;
1733
}
1734
free(direntries);
1735
} else {
1736
free(direntries);
1737
fprintf_plus(stderr, "Could not find a network interface\n");
1738
exitcode = EXIT_FAILURE;
1739
goto end;
1740
}
1741
}
1742
1743
2619
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1744
2620
from the signal handler */
1745
2621
/* Initialize the pseudo-RNG for Avahi */
1746
2622
srand((unsigned int) time(NULL));
1747
mc.simple_poll = avahi_simple_poll_new();
1748
if(mc.simple_poll == NULL){
1749
fprintf_plus(stderr, "Avahi: Failed to create simple poll object.\n");
2623
simple_poll = avahi_simple_poll_new();
2624
if(simple_poll == NULL){
2625
fprintf_plus(stderr,
2626
"Avahi: Failed to create simple poll object.\n");
1750
2627
exitcode = EX_UNAVAILABLE;
1751
2628
goto end;
1752
2629
}
1814
2691
}
1815
2692
}
1816
2693
1817
/* If the interface is down, bring it up */
1818
if(strcmp(interface, "none") != 0){
1819
if_index = (AvahiIfIndex) if_nametoindex(interface);
1820
if(if_index == 0){
1821
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1822
exitcode = EX_UNAVAILABLE;
1823
goto end;
1824
}
1825
1826
if(quit_now){
1827
goto end;
1828
}
1829
1830
/* Re-raise priviliges */
1831
errno = 0;
1832
ret = seteuid(0);
1833
if(ret == -1){
1834
perror_plus("seteuid");
1835
}
1836
1837
#ifdef __linux__
1838
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1839
messages about the network interface to mess up the prompt */
1840
ret = klogctl(8, NULL, 5);
1841
bool restore_loglevel = true;
1842
if(ret == -1){
1843
restore_loglevel = false;
1844
perror_plus("klogctl");
1845
}
1846
#endif /* __linux__ */
1847
1848
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1849
if(sd < 0){
1850
perror_plus("socket");
1851
exitcode = EX_OSERR;
1852
#ifdef __linux__
1853
if(restore_loglevel){
1854
ret = klogctl(7, NULL, 0);
1855
if(ret == -1){
1856
perror_plus("klogctl");
1857
}
1858
}
1859
#endif /* __linux__ */
1860
/* Lower privileges */
1861
errno = 0;
1862
ret = seteuid(uid);
1863
if(ret == -1){
1864
perror_plus("seteuid");
1865
}
1866
goto end;
1867
}
1868
strcpy(network.ifr_name, interface);
1869
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1870
if(ret == -1){
1871
perror_plus("ioctl SIOCGIFFLAGS");
1872
#ifdef __linux__
1873
if(restore_loglevel){
1874
ret = klogctl(7, NULL, 0);
1875
if(ret == -1){
1876
perror_plus("klogctl");
1877
}
1878
}
1879
#endif /* __linux__ */
1880
exitcode = EX_OSERR;
1881
/* Lower privileges */
1882
errno = 0;
1883
ret = seteuid(uid);
1884
if(ret == -1){
1885
perror_plus("seteuid");
1886
}
1887
goto end;
1888
}
1889
if((network.ifr_flags & IFF_UP) == 0){
1890
network.ifr_flags |= IFF_UP;
1891
take_down_interface = true;
1892
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1893
if(ret == -1){
1894
take_down_interface = false;
1895
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1896
exitcode = EX_OSERR;
1897
#ifdef __linux__
1898
if(restore_loglevel){
1899
ret = klogctl(7, NULL, 0);
1900
if(ret == -1){
1901
perror_plus("klogctl");
2694
/* If no interfaces were specified, make a list */
2695
if(mc.interfaces == NULL){
2696
struct dirent **direntries = NULL;
2697
/* Look for any good interfaces */
2698
ret = scandir(sys_class_net, &direntries, good_interface,
2699
alphasort);
2700
if(ret >= 1){
2701
/* Add all found interfaces to interfaces list */
2702
for(int i = 0; i < ret; ++i){
2703
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2704
direntries[i]->d_name);
2705
if(ret_errno != 0){
2706
errno = ret_errno;
2707
perror_plus("argz_add");
2708
free(direntries[i]);
2709
continue;
2710
}
2711
if(debug){
2712
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2713
direntries[i]->d_name);
2714
}
2715
free(direntries[i]);
2716
}
2717
free(direntries);
2718
} else {
2719
if(ret == 0){
2720
free(direntries);
2721
}
2722
fprintf_plus(stderr, "Could not find a network interface\n");
2723
exitcode = EXIT_FAILURE;
2724
goto end;
2725
}
2726
}
2727
2728
/* Bring up interfaces which are down, and remove any "none"s */
2729
{
2730
char *interface = NULL;
2731
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2732
interface))){
2733
/* If interface name is "none", stop bringing up interfaces.
2734
Also remove all instances of "none" from the list */
2735
if(strcmp(interface, "none") == 0){
2736
argz_delete(&mc.interfaces, &mc.interfaces_size,
2737
interface);
2738
interface = NULL;
2739
while((interface = argz_next(mc.interfaces,
2740
mc.interfaces_size, interface))){
2741
if(strcmp(interface, "none") == 0){
2742
argz_delete(&mc.interfaces, &mc.interfaces_size,
2743
interface);
2744
interface = NULL;
1902
2745
}
1903
2746
}
1904
#endif /* __linux__ */
1905
/* Lower privileges */
1906
errno = 0;
1907
ret = seteuid(uid);
1908
if(ret == -1){
1909
perror_plus("seteuid");
1910
}
1911
goto end;
1912
}
1913
}
1914
/* Sleep checking until interface is running.
1915
Check every 0.25s, up to total time of delay */
1916
for(int i=0; i < delay * 4; i++){
1917
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1918
if(ret == -1){
1919
perror_plus("ioctl SIOCGIFFLAGS");
1920
} else if(network.ifr_flags & IFF_RUNNING){
1921
2747
break;
1922
2748
}
1923
struct timespec sleeptime = { .tv_nsec = 250000000 };
1924
ret = nanosleep(&sleeptime, NULL);
1925
if(ret == -1 and errno != EINTR){
1926
perror_plus("nanosleep");
1927
}
1928
}
1929
if(not take_down_interface){
1930
/* We won't need the socket anymore */
1931
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1932
if(ret == -1){
1933
perror_plus("close");
1934
}
1935
}
1936
#ifdef __linux__
1937
if(restore_loglevel){
1938
/* Restores kernel loglevel to default */
1939
ret = klogctl(7, NULL, 0);
1940
if(ret == -1){
1941
perror_plus("klogctl");
1942
}
1943
}
1944
#endif /* __linux__ */
1945
/* Lower privileges */
1946
errno = 0;
1947
if(take_down_interface){
1948
/* Lower privileges */
1949
ret = seteuid(uid);
1950
if(ret == -1){
1951
perror_plus("seteuid");
1952
}
1953
} else {
1954
/* Lower privileges permanently */
1955
ret = setuid(uid);
1956
if(ret == -1){
1957
perror_plus("setuid");
1958
}
1959
}
2749
bool interface_was_up = interface_is_up(interface);
2750
errno = bring_up_interface(interface, delay);
2751
if(not interface_was_up){
2752
if(errno != 0){
2753
fprintf_plus(stderr, "Failed to bring up interface \"%s\":"
2754
" %s\n", interface, strerror(errno));
2755
} else {
2756
errno = argz_add(&interfaces_to_take_down,
2757
&interfaces_to_take_down_size,
2758
interface);
2759
if(errno != 0){
2760
perror_plus("argz_add");
2761
}
2762
}
2763
}
2764
}
2765
if(debug and (interfaces_to_take_down == NULL)){
2766
fprintf_plus(stderr, "No interfaces were brought up\n");
2767
}
2768
}
2769
2770
/* If we only got one interface, explicitly use only that one */
2771
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2772
if(debug){
2773
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2774
mc.interfaces);
2775
}
2776
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
1960
2777
}
1961
2778
1962
2779
if(quit_now){
1963
2780
goto end;
1964
2781
}
1965
2782
1966
ret = init_gnutls_global(pubkey, seckey);
2783
ret = init_gnutls_global(pubkey, seckey, dh_params_file, &mc);
1967
2784
if(ret == -1){
1968
2785
fprintf_plus(stderr, "init_gnutls_global failed\n");
1969
2786
exitcode = EX_UNAVAILABLE;
1976
2793
goto end;
1977
2794
}
1978
2795
1979
if(mkdtemp(tempdir) == NULL){
2796
/* Try /run/tmp before /tmp */
2797
tempdir = mkdtemp(run_tempdir);
2798
if(tempdir == NULL and errno == ENOENT){
2799
if(debug){
2800
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2801
run_tempdir, old_tempdir);
2802
}
2803
tempdir = mkdtemp(old_tempdir);
2804
}
2805
if(tempdir == NULL){
1980
2806
perror_plus("mkdtemp");
1981
2807
goto end;
1982
2808
}
1983
tempdir_created = true;
1984
2809
1985
2810
if(quit_now){
1986
2811
goto end;
1987
2812
}
1988
2813
1989
if(not init_gpgme(pubkey, seckey, tempdir)){
2814
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
1990
2815
fprintf_plus(stderr, "init_gpgme failed\n");
1991
2816
exitcode = EX_UNAVAILABLE;
1992
2817
goto end;
2002
2827
/* Connect directly, do not use Zeroconf */
2003
2828
/* (Mainly meant for debugging) */
2004
2829
char *address = strrchr(connect_to, ':');
2830
2005
2831
if(address == NULL){
2006
2832
fprintf_plus(stderr, "No colon in address\n");
2007
2833
exitcode = EX_USAGE;
2012
2838
goto end;
2013
2839
}
2014
2840
2015
uint16_t port;
2841
in_port_t port;
2016
2842
errno = 0;
2017
2843
tmpmax = strtoimax(address+1, &tmp, 10);
2018
2844
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2019
or tmpmax != (uint16_t)tmpmax){
2845
or tmpmax != (in_port_t)tmpmax){
2020
2846
fprintf_plus(stderr, "Bad port number\n");
2021
2847
exitcode = EX_USAGE;
2022
2848
goto end;
2023
2849
}
2024
2850
2025
2851
if(quit_now){
2026
2852
goto end;
2027
2853
}
2028
2854
2029
port = (uint16_t)tmpmax;
2855
port = (in_port_t)tmpmax;
2030
2856
*address = '\0';
2031
2857
/* Colon in address indicates IPv6 */
2032
2858
int af;
2048
2874
}
2049
2875
2050
2876
while(not quit_now){
2051
ret = start_mandos_communication(address, port, if_index, af);
2877
ret = start_mandos_communication(address, port, if_index, af,
2878
&mc);
2052
2879
if(quit_now or ret == 0){
2053
2880
break;
2054
2881
}
2055
2882
if(debug){
2056
fprintf_plus(stderr, "Retrying in %d seconds\n", (int)retry_interval);
2883
fprintf_plus(stderr, "Retrying in %d seconds\n",
2884
(int)retry_interval);
2057
2885
}
2058
sleep((int)retry_interval);
2886
sleep((unsigned int)retry_interval);
2059
2887
}
2060
2888
2061
if (not quit_now){
2889
if(not quit_now){
2062
2890
exitcode = EXIT_SUCCESS;
2063
2891
}
2064
2892
2079
2907
config.publish_domain = 0;
2080
2908
2081
2909
/* Allocate a new server */
2082
mc.server = avahi_server_new(avahi_simple_poll_get
2083
(mc.simple_poll), &config, NULL,
2084
NULL, &error);
2910
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2911
&config, NULL, NULL, &ret_errno);
2085
2912
2086
2913
/* Free the Avahi configuration data */
2087
2914
avahi_server_config_free(&config);
2090
2917
/* Check if creating the Avahi server object succeeded */
2091
2918
if(mc.server == NULL){
2092
2919
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2093
avahi_strerror(error));
2920
avahi_strerror(ret_errno));
2094
2921
exitcode = EX_UNAVAILABLE;
2095
2922
goto end;
2096
2923
}
2102
2929
/* Create the Avahi service browser */
2103
2930
sb = avahi_s_service_browser_new(mc.server, if_index,
2104
2931
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2105
NULL, 0, browse_callback, NULL);
2932
NULL, 0, browse_callback,
2933
(void *)&mc);
2106
2934
if(sb == NULL){
2107
2935
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2108
avahi_strerror(avahi_server_errno(mc.server)));
2936
avahi_strerror(avahi_server_errno(mc.server)));
2109
2937
exitcode = EX_UNAVAILABLE;
2110
2938
goto end;
2111
2939
}
2119
2947
if(debug){
2120
2948
fprintf_plus(stderr, "Starting Avahi loop search\n");
2121
2949
}
2122
2123
ret = avahi_loop_with_timeout(mc.simple_poll,
2124
(int)(retry_interval * 1000));
2950
2951
ret = avahi_loop_with_timeout(simple_poll,
2952
(int)(retry_interval * 1000), &mc);
2125
2953
if(debug){
2126
2954
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2127
(ret == 0) ? "successfully" : "with error");
2955
(ret == 0) ? "successfully" : "with error");
2128
2956
}
2129
2957
2130
2958
end:
2134
2962
}
2135
2963
2136
2964
/* Cleanup things */
2965
free(mc.interfaces);
2966
2137
2967
if(sb != NULL)
2138
2968
avahi_s_service_browser_free(sb);
2139
2969
2140
2970
if(mc.server != NULL)
2141
2971
avahi_server_free(mc.server);
2142
2972
2143
if(mc.simple_poll != NULL)
2144
avahi_simple_poll_free(mc.simple_poll);
2973
if(simple_poll != NULL)
2974
avahi_simple_poll_free(simple_poll);
2145
2975
2146
2976
if(gnutls_initialized){
2147
2977
gnutls_certificate_free_credentials(mc.cred);
2152
2982
if(gpgme_initialized){
2153
2983
gpgme_release(mc.ctx);
2154
2984
}
2155
2985
2156
2986
/* Cleans up the circular linked list of Mandos servers the client
2157
2987
has seen */
2158
2988
if(mc.current_server != NULL){
2159
2989
mc.current_server->prev->next = NULL;
2160
2990
while(mc.current_server != NULL){
2161
2991
server *next = mc.current_server->next;
2992
#ifdef __GNUC__
2993
#pragma GCC diagnostic push
2994
#pragma GCC diagnostic ignored "-Wcast-qual"
2995
#endif
2996
free((char *)(mc.current_server->ip));
2997
#ifdef __GNUC__
2998
#pragma GCC diagnostic pop
2999
#endif
2162
3000
free(mc.current_server);
2163
3001
mc.current_server = next;
2164
3002
}
2165
3003
}
2166
3004
2167
/* XXX run network hooks "stop" here */
2168
2169
/* Take down the network interface */
2170
if(take_down_interface){
2171
/* Re-raise priviliges */
2172
errno = 0;
2173
ret = seteuid(0);
2174
if(ret == -1){
2175
perror_plus("seteuid");
3005
/* Re-raise privileges */
3006
{
3007
ret_errno = raise_privileges();
3008
if(ret_errno != 0){
3009
errno = ret_errno;
3010
perror_plus("Failed to raise privileges");
3011
} else {
3012
3013
/* Run network hooks */
3014
run_network_hooks("stop", interfaces_hooks != NULL ?
3015
interfaces_hooks : "", delay);
3016
3017
/* Take down the network interfaces which were brought up */
3018
{
3019
char *interface = NULL;
3020
while((interface=argz_next(interfaces_to_take_down,
3021
interfaces_to_take_down_size,
3022
interface))){
3023
ret_errno = take_down_interface(interface);
3024
if(ret_errno != 0){
3025
errno = ret_errno;
3026
perror_plus("Failed to take down interface");
3027
}
3028
}
3029
if(debug and (interfaces_to_take_down == NULL)){
3030
fprintf_plus(stderr, "No interfaces needed to be taken"
3031
" down\n");
3032
}
3033
}
2176
3034
}
2177
if(geteuid() == 0){
2178
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2179
if(ret == -1){
2180
perror_plus("ioctl SIOCGIFFLAGS");
2181
} else if(network.ifr_flags & IFF_UP){
2182
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2183
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2184
if(ret == -1){
2185
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2186
}
2187
}
2188
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2189
if(ret == -1){
2190
perror_plus("close");
2191
}
2192
/* Lower privileges permanently */
2193
errno = 0;
2194
ret = setuid(uid);
2195
if(ret == -1){
2196
perror_plus("setuid");
2197
}
3035
3036
ret_errno = lower_privileges_permanently();
3037
if(ret_errno != 0){
3038
errno = ret_errno;
3039
perror_plus("Failed to lower privileges permanently");
2198
3040
}
2199
3041
}
2200
3042
3043
free(interfaces_to_take_down);
3044
free(interfaces_hooks);
3045
2201
3046
/* Removes the GPGME temp directory and all files inside */
2202
if(tempdir_created){
3047
if(tempdir != NULL){
2203
3048
struct dirent **direntries = NULL;
2204
struct dirent *direntry = NULL;
2205
int numentries = scandir(tempdir, &direntries, notdotentries,
2206
alphasort);
2207
if (numentries > 0){
2208
for(int i = 0; i < numentries; i++){
2209
direntry = direntries[i];
2210
char *fullname = NULL;
2211
ret = asprintf(&fullname, "%s/%s", tempdir,
2212
direntry->d_name);
2213
if(ret < 0){
2214
perror_plus("asprintf");
2215
continue;
2216
}
2217
ret = remove(fullname);
2218
if(ret == -1){
2219
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname, strerror(errno));
2220
}
2221
free(fullname);
3049
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY
3050
| O_NOFOLLOW
3051
| O_DIRECTORY
3052
| O_PATH));
3053
if(tempdir_fd == -1){
3054
perror_plus("open");
3055
} else {
3056
#ifdef __GLIBC__
3057
#if __GLIBC_PREREQ(2, 15)
3058
int numentries = scandirat(tempdir_fd, ".", &direntries,
3059
notdotentries, alphasort);
3060
#else /* not __GLIBC_PREREQ(2, 15) */
3061
int numentries = scandir(tempdir, &direntries, notdotentries,
3062
alphasort);
3063
#endif /* not __GLIBC_PREREQ(2, 15) */
3064
#else /* not __GLIBC__ */
3065
int numentries = scandir(tempdir, &direntries, notdotentries,
3066
alphasort);
3067
#endif /* not __GLIBC__ */
3068
if(numentries >= 0){
3069
for(int i = 0; i < numentries; i++){
3070
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
3071
if(ret == -1){
3072
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
3073
" \"%s\", 0): %s\n", tempdir,
3074
direntries[i]->d_name, strerror(errno));
3075
}
3076
free(direntries[i]);
3077
}
3078
3079
/* need to clean even if 0 because man page doesn't specify */
3080
free(direntries);
3081
if(numentries == -1){
3082
perror_plus("scandir");
3083
}
3084
ret = rmdir(tempdir);
3085
if(ret == -1 and errno != ENOENT){
3086
perror_plus("rmdir");
3087
}
2222
3088
}
2223
}
2224
2225
/* need to clean even if 0 because man page doesn't specify */
2226
free(direntries);
2227
if (numentries == -1){
2228
perror_plus("scandir");
2229
}
2230
ret = rmdir(tempdir);
2231
if(ret == -1 and errno != ENOENT){
2232
perror_plus("rmdir");
3089
close(tempdir_fd);
2233
3090
}
2234
3091
}
2235
3092
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0