To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 24.1.175
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.175
- Committer: Björn Påhlsson
- Date: 2011-07-25 18:46:19 UTC
- mfrom: (487 trunk)
- mto: This revision was merged to the branch mainline in revision 489.
- Revision ID: belorn@fukt.bsnet.se-20110725184619-l7vfsobr0bh9fc3l
merge
added
removed
plugins.d/mandos-client.c
62
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
63
strtoimax() */
64
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno, program_invocation_short_name */
65
#include <errno.h> /* perror(), errno,
66
program_invocation_short_name */
66
67
#include <time.h> /* nanosleep(), time(), sleep() */
67
68
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
69
SIOCSIFFLAGS, if_indextoname(),
73
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
75
getuid(), getgid(), seteuid(),
75
76
setgid(), pause() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
77
78
#include <iso646.h> /* not, or, and */
78
79
#include <argp.h> /* struct argp_option, error_t, struct
79
80
argp_state, struct argp,
130
131
static const char sys_class_net[] = "/sys/class/net";
131
132
char *connect_to = NULL;
132
133
133
/* Doubly linked list that need to be circular linked when ever used */
134
/* Doubly linked list that need to be circularly linked when used */
134
135
typedef struct server{
135
136
const char *ip;
136
137
uint16_t port;
156
157
/* global context so signal handler can reach it*/
157
158
mandos_context mc = { .simple_poll = NULL, .server = NULL,
158
159
.dh_bits = 1024, .priority = "SECURE256"
159
":!CTYPE-X.509:+CTYPE-OPENPGP", .current_server = NULL };
160
":!CTYPE-X.509:+CTYPE-OPENPGP",
161
.current_server = NULL };
160
162
161
163
sig_atomic_t quit_now = 0;
162
164
int signal_received = 0;
163
165
164
166
/* Function to use when printing errors */
165
167
void perror_plus(const char *print_text){
166
fprintf(stderr, "Mandos plugin %s: ", program_invocation_short_name);
168
fprintf(stderr, "Mandos plugin %s: ",
169
program_invocation_short_name);
167
170
perror(print_text);
168
171
}
169
172
199
202
.af = af };
200
203
if(new_server->ip == NULL){
201
204
perror_plus("strdup");
202
return -1;
205
return -1;
203
206
}
204
/* uniqe case of first server */
207
/* unique case of first server */
205
208
if (mc.current_server == NULL){
206
209
new_server->next = new_server;
207
210
new_server->prev = new_server;
478
481
}
479
482
480
483
/* OpenPGP credentials */
481
gnutls_certificate_allocate_credentials(&mc.cred);
484
ret = gnutls_certificate_allocate_credentials(&mc.cred);
482
485
if(ret != GNUTLS_E_SUCCESS){
483
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
484
from
485
-Wunreachable-code
486
*/
486
fprintf(stderr, "GnuTLS memory error: %s\n",
487
487
safer_gnutls_strerror(ret));
488
488
gnutls_global_deinit();
489
489
return -1;
796
796
errno = EINTR;
797
797
goto mandos_end;
798
798
}
799
800
/* Spurious warnings from -Wint-to-pointer-cast */
799
800
/* Spurious warning from -Wint-to-pointer-cast */
801
801
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
802
802
803
803
if(quit_now){
1069
1069
}
1070
1070
}
1071
1071
1072
/* Signal handler that stops main loop after sigterm has been called */
1072
/* Signal handler that stops main loop after SIGTERM */
1073
1073
static void handle_sigterm(int sig){
1074
1074
if(quit_now){
1075
1075
return;
1110
1110
free(flagname);
1111
1111
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1112
1112
/* read line from flags_fd */
1113
ssize_t to_read = (sizeof(ifreq_flags)*2)+3; /* "0x1003\n" */
1113
ssize_t to_read = 2+(sizeof(ifreq_flags)*2)+1; /* "0x1003\n" */
1114
1114
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1115
1115
flagstring[(size_t)to_read] = '\0';
1116
1116
if(flagstring == NULL){
1209
1209
while(true){
1210
1210
if(mc.current_server == NULL){
1211
1211
if (debug){
1212
fprintf(stderr, "Wait until first server is found. No timeout!\n");
1212
fprintf(stderr,
1213
"Wait until first server is found. No timeout!\n");
1213
1214
}
1214
1215
ret = avahi_simple_poll_iterate(s, -1);
1215
1216
} else {
1216
1217
if (debug){
1217
fprintf(stderr, "Check current_server if we should run it, or wait\n");
1218
fprintf(stderr, "Check current_server if we should run it,"
1219
" or wait\n");
1218
1220
}
1219
1221
/* the current time */
1220
1222
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1224
1226
}
1225
1227
/* Calculating in ms how long time between now and server
1226
1228
who we visted longest time ago. Now - last seen. */
1227
waited_time.tv_sec = now.tv_sec - mc.current_server->last_seen.tv_sec;
1228
waited_time.tv_nsec = now.tv_nsec - mc.current_server->last_seen.tv_nsec;
1229
/* total time is 10s/10000ms. Converting to s to ms by 1000/s, and ns to ms by divind by 1000000. */
1230
block_time = (retry_interval - ((intmax_t)waited_time.tv_sec * 1000)) - ((intmax_t)waited_time.tv_nsec / 1000000);
1229
waited_time.tv_sec = (now.tv_sec
1230
- mc.current_server->last_seen.tv_sec);
1231
waited_time.tv_nsec = (now.tv_nsec
1232
- mc.current_server->last_seen.tv_nsec);
1233
/* total time is 10s/10,000ms.
1234
Converting to s from ms by dividing by 1,000,
1235
and ns to ms by dividing by 1,000,000. */
1236
block_time = ((retry_interval
1237
- ((intmax_t)waited_time.tv_sec * 1000))
1238
- ((intmax_t)waited_time.tv_nsec / 1000000));
1231
1239
1232
1240
if (debug){
1233
fprintf(stderr, "Blocking for %ld ms\n", block_time);
1241
fprintf(stderr, "Blocking for %ld ms\n", block_time);
1234
1242
}
1235
1243
1236
1244
if(block_time <= 0){
1237
1245
ret = start_mandos_communication(mc.current_server->ip,
1238
mc.current_server->port,
1239
mc.current_server->if_index,
1240
mc.current_server->af);
1246
mc.current_server->port,
1247
mc.current_server->if_index,
1248
mc.current_server->af);
1241
1249
if(ret == 0){
1242
1250
avahi_simple_poll_quit(mc.simple_poll);
1243
1251
return 0;
1244
1252
}
1245
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
1253
ret = clock_gettime(CLOCK_MONOTONIC,
1254
&mc.current_server->last_seen);
1246
1255
if(ret == -1){
1247
1256
perror_plus("clock_gettime");
1248
1257
return -1;
1249
1258
}
1250
1259
mc.current_server = mc.current_server->next;
1251
block_time = 0; /* call avahi to find new mandos servers, but dont block */
1260
block_time = 0; /* Call avahi to find new Mandos
1261
servers, but don't block */
1252
1262
}
1253
1263
1254
1264
ret = avahi_simple_poll_iterate(s, (int)block_time);
1283
1293
bool gnutls_initialized = false;
1284
1294
bool gpgme_initialized = false;
1285
1295
float delay = 2.5f;
1286
double retry_interval = 10; /* 10s between retrying a server and checking again*/
1296
double retry_interval = 10; /* 10s between trying a server and
1297
retrying the same server again */
1287
1298
1288
1299
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1289
1300
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1444
1455
goto end;
1445
1456
}
1446
1457
}
1458
1459
{
1460
/* Work around Debian bug #633582:
1461
<http://bugs.debian.org/633582> */
1462
struct stat st;
1463
1464
/* Re-raise priviliges */
1465
errno = 0;
1466
ret = seteuid(0);
1467
if(ret == -1){
1468
perror_plus("seteuid");
1469
}
1470
1471
int seckey_fd = open(PATHDIR "/" SECKEY, O_RDONLY);
1472
if(seckey_fd == -1){
1473
perror_plus("open");
1474
} else {
1475
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1476
if(ret == -1){
1477
perror_plus("fstat");
1478
} else {
1479
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1480
ret = fchown(seckey_fd, uid, gid);
1481
if(ret == -1){
1482
perror_plus("fchown");
1483
}
1484
}
1485
}
1486
TEMP_FAILURE_RETRY(close(seckey_fd));
1487
}
1488
1489
int pubkey_fd = open(PATHDIR "/" PUBKEY, O_RDONLY);
1490
if(pubkey_fd == -1){
1491
perror_plus("open");
1492
} else {
1493
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1494
if(ret == -1){
1495
perror_plus("fstat");
1496
} else {
1497
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1498
ret = fchown(pubkey_fd, uid, gid);
1499
if(ret == -1){
1500
perror_plus("fchown");
1501
}
1502
}
1503
}
1504
TEMP_FAILURE_RETRY(close(pubkey_fd));
1505
}
1506
1507
/* Lower privileges */
1508
errno = 0;
1509
ret = seteuid(uid);
1510
if(ret == -1){
1511
perror_plus("seteuid");
1512
}
1513
}
1447
1514
1448
1515
if(not debug){
1449
1516
avahi_set_log_function(empty_log);
1645
1712
goto end;
1646
1713
}
1647
1714
}
1648
/* sleep checking until interface is running. Check every 0.25s, up to total time of delay */
1715
/* Sleep checking until interface is running.
1716
Check every 0.25s, up to total time of delay */
1649
1717
for(int i=0; i < delay * 4; i++){
1650
1718
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1651
1719
if(ret == -1){
1844
1912
fprintf(stderr, "Starting Avahi loop search\n");
1845
1913
}
1846
1914
1847
ret = avahi_loop_with_timeout(mc.simple_poll, (int)(retry_interval * 1000));
1915
ret = avahi_loop_with_timeout(mc.simple_poll,
1916
(int)(retry_interval * 1000));
1848
1917
if(debug){
1849
1918
fprintf(stderr, "avahi_loop_with_timeout exited %s\n",
1850
1919
(ret == 0) ? "successfully" : "with error");
1876
1945
gpgme_release(mc.ctx);
1877
1946
}
1878
1947
1879
/* cleans up the circular linked list of mandos servers the client has seen */
1948
/* Cleans up the circular linked list of Mandos servers the client
1949
has seen */
1880
1950
if(mc.current_server != NULL){
1881
1951
mc.current_server->prev->next = NULL;
1882
1952
while(mc.current_server != NULL){
1942
2012
}
1943
2013
}
1944
2014
1945
/* need to be cleaned even if ret == 0 because man page dont specify */
2015
/* need to be cleaned even if ret == 0 because man page doesn't
2016
specify */
1946
2017
free(direntries);
1947
2018
if (ret == -1){
1948
2019
perror_plus("scandir");
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0