/mandos/release

/*  -*- coding: utf-8 -*- */

/*

 * Mandos-client - get and decrypt data from a Mandos server

 *

 * This program is partly derived from an example program for an Avahi

 * service browser, downloaded from

 * <http://avahi.org/browser/examples/core-browse-services.c>.  This

 * includes the following functions: "resolve_callback",

 * "browse_callback", and parts of "main".

 * 

 * Everything else is

 * Copyright © 2008-2018 Teddy Hogeborn

 * Copyright © 2008-2018 Björn Påhlsson

 * 

 * This file is part of Mandos.

 * 

 * Mandos is free software: you can redistribute it and/or modify it

 * under the terms of the GNU General Public License as published by

 * the Free Software Foundation, either version 3 of the License, or

 * (at your option) any later version.

 * 

 * Mandos is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * General Public License for more details.

 * 

 * You should have received a copy of the GNU General Public License

 * along with Mandos.  If not, see <http://www.gnu.org/licenses/>.

 * 

 * Contact the authors at <mandos@recompile.se>.

 */

/* Needed by GPGME, specifically gpgme_data_seek() */

#ifndef _LARGEFILE_SOURCE

#define _LARGEFILE_SOURCE

#endif	/* not _LARGEFILE_SOURCE */

#ifndef _FILE_OFFSET_BITS

#define _FILE_OFFSET_BITS 64

#endif	/* not _FILE_OFFSET_BITS */

#define _GNU_SOURCE		/* TEMP_FAILURE_RETRY(), asprintf() */

#include <stdio.h>		/* fprintf(), stderr, fwrite(),

				   stdout, ferror() */

#include <stdint.h> 		/* uint16_t, uint32_t, intptr_t */

#include <stddef.h>		/* NULL, size_t, ssize_t */

#include <stdlib.h> 		/* free(), EXIT_SUCCESS, srand(),

				   strtof(), abort() */

#include <stdbool.h>		/* bool, false, true */

#include <string.h>		/* strcmp(), strlen(), strerror(),

				   asprintf(), strncpy(), strsignal()

				*/

#include <sys/ioctl.h>		/* ioctl */

#include <sys/types.h>		/* socket(), inet_pton(), sockaddr,

				   sockaddr_in6, PF_INET6,

				   SOCK_STREAM, uid_t, gid_t, open(),

				   opendir(), DIR */

#include <sys/stat.h>		/* open(), S_ISREG */

#include <sys/socket.h>		/* socket(), struct sockaddr_in6,

				   inet_pton(), connect(),

				   getnameinfo() */

#include <fcntl.h>		/* open(), unlinkat(), AT_REMOVEDIR */

#include <dirent.h>		/* opendir(), struct dirent, readdir()

				 */

#include <inttypes.h>		/* PRIu16, PRIdMAX, intmax_t,

				   strtoimax() */

#include <errno.h>		/* perror(), errno, EINTR, EINVAL,

				   EAI_SYSTEM, ENETUNREACH,

				   EHOSTUNREACH, ECONNREFUSED, EPROTO,

				   EIO, ENOENT, ENXIO, ENOMEM, EISDIR,

				   ENOTEMPTY,

				   program_invocation_short_name */

#include <time.h>		/* nanosleep(), time(), sleep() */

#include <net/if.h>		/* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,

				   SIOCSIFFLAGS, if_indextoname(),

				   if_nametoindex(), IF_NAMESIZE */

#include <netinet/in.h>		/* IN6_IS_ADDR_LINKLOCAL,

				   INET_ADDRSTRLEN, INET6_ADDRSTRLEN

				*/

#include <unistd.h>		/* close(), SEEK_SET, off_t, write(),

				   getuid(), getgid(), seteuid(),

				   setgid(), pause(), _exit(),

				   unlinkat() */

#include <arpa/inet.h>		/* inet_pton(), htons() */

#include <iso646.h>		/* not, or, and */

#include <argp.h>		/* struct argp_option, error_t, struct

				   argp_state, struct argp,

				   argp_parse(), ARGP_KEY_ARG,

				   ARGP_KEY_END, ARGP_ERR_UNKNOWN */

#include <signal.h>		/* sigemptyset(), sigaddset(),

				   sigaction(), SIGTERM, sig_atomic_t,

				   raise() */

#include <sysexits.h>		/* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,

				   EX_NOHOST, EX_IOERR, EX_PROTOCOL */

#include <sys/wait.h>		/* waitpid(), WIFEXITED(),

				   WEXITSTATUS(), WTERMSIG() */

#include <grp.h>		/* setgroups() */

#include <argz.h>		/* argz_add_sep(), argz_next(),

				   argz_delete(), argz_append(),

				   argz_stringify(), argz_add(),

				   argz_count() */

#include <netdb.h>		/* getnameinfo(), NI_NUMERICHOST,

				   EAI_SYSTEM, gai_strerror() */

#ifdef __linux__

#include <sys/klog.h> 		/* klogctl() */

#endif	/* __linux__ */

/* Avahi */

/* All Avahi types, constants and functions

 Avahi*, avahi_*,

 AVAHI_* */

#include <avahi-core/core.h>

#include <avahi-core/lookup.h>

#include <avahi-core/log.h>

#include <avahi-common/simple-watch.h>

#include <avahi-common/malloc.h>

#include <avahi-common/error.h>

/* GnuTLS */

#include <gnutls/gnutls.h>	/* All GnuTLS types, constants and

				   functions:

				   gnutls_*

				   init_gnutls_session(),

				   GNUTLS_* */

#include <gnutls/openpgp.h>

			 /* gnutls_certificate_set_openpgp_key_file(),

			    GNUTLS_OPENPGP_FMT_BASE64 */

/* GPGME */

#include <gpgme.h> 		/* All GPGME types, constants and

				   functions:

				   gpgme_*

				   GPGME_PROTOCOL_OpenPGP,

				   GPG_ERR_NO_* */

#define BUFFER_SIZE 256

#define PATHDIR "/conf/conf.d/mandos"

#define SECKEY "seckey.txt"

#define PUBKEY "pubkey.txt"

#define HOOKDIR "/lib/mandos/network-hooks.d"

bool debug = false;

static const char mandos_protocol_version[] = "1";

const char *argp_program_version = "mandos-client " VERSION;

const char *argp_program_bug_address = "<mandos@recompile.se>";

static const char sys_class_net[] = "/sys/class/net";

char *connect_to = NULL;

const char *hookdir = HOOKDIR;

int hookdir_fd = -1;

uid_t uid = 65534;

gid_t gid = 65534;

/* Doubly linked list that need to be circularly linked when used */

typedef struct server{

  const char *ip;

  in_port_t port;

  AvahiIfIndex if_index;

  int af;

  struct timespec last_seen;

  struct server *next;

  struct server *prev;

} server;

/* Used for passing in values through the Avahi callback functions */

typedef struct {

  AvahiServer *server;

  gnutls_certificate_credentials_t cred;

  unsigned int dh_bits;

  gnutls_dh_params_t dh_params;

  const char *priority;

  gpgme_ctx_t ctx;

  server *current_server;

  char *interfaces;

  size_t interfaces_size;

} mandos_context;

/* global so signal handler can reach it*/

AvahiSimplePoll *simple_poll;

sig_atomic_t quit_now = 0;

int signal_received = 0;

/* Function to use when printing errors */

void perror_plus(const char *print_text){

  int e = errno;

  fprintf(stderr, "Mandos plugin %s: ",

	  program_invocation_short_name);

  errno = e;

  perror(print_text);

}

__attribute__((format (gnu_printf, 2, 3), nonnull))

int fprintf_plus(FILE *stream, const char *format, ...){

  va_list ap;

  va_start (ap, format);

  TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",

			     program_invocation_short_name));

  return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));

}

/*

 * Make additional room in "buffer" for at least BUFFER_SIZE more

 * bytes. "buffer_capacity" is how much is currently allocated,

 * "buffer_length" is how much is already used.

 */

__attribute__((nonnull, warn_unused_result))

size_t incbuffer(char **buffer, size_t buffer_length,

		 size_t buffer_capacity){

  if(buffer_length + BUFFER_SIZE > buffer_capacity){

    char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);

    if(new_buf == NULL){

      int old_errno = errno;

      free(*buffer);

      errno = old_errno;

      *buffer = NULL;

      return 0;

    }

    *buffer = new_buf;

    buffer_capacity += BUFFER_SIZE;

  }

  return buffer_capacity;

}

/* Add server to set of servers to retry periodically */

__attribute__((nonnull, warn_unused_result))

bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,

		int af, server **current_server){

  int ret;

  server *new_server = malloc(sizeof(server));

  if(new_server == NULL){

    perror_plus("malloc");

    return false;

  }

  *new_server = (server){ .ip = strdup(ip),

			  .port = port,

			  .if_index = if_index,

			  .af = af };

  if(new_server->ip == NULL){

    perror_plus("strdup");

    free(new_server);

    return false;

  }

  ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));

  if(ret == -1){

    perror_plus("clock_gettime");

#ifdef __GNUC__

#pragma GCC diagnostic push

#pragma GCC diagnostic ignored "-Wcast-qual"

#endif

    free((char *)(new_server->ip));

#ifdef __GNUC__

#pragma GCC diagnostic pop

#endif

    free(new_server);

    return false;

  }

  /* Special case of first server */

  if(*current_server == NULL){

    new_server->next = new_server;

    new_server->prev = new_server;

    *current_server = new_server;

  } else {

    /* Place the new server last in the list */

    new_server->next = *current_server;

    new_server->prev = (*current_server)->prev;

    new_server->prev->next = new_server;

    (*current_server)->prev = new_server;

  }

  return true;

}

/* Set effective uid to 0, return errno */

__attribute__((warn_unused_result))

int raise_privileges(void){

  int old_errno = errno;

  int ret = 0;

  if(seteuid(0) == -1){

    ret = errno;

  }

  errno = old_errno;

  return ret;

}

/* Set effective and real user ID to 0.  Return errno. */

__attribute__((warn_unused_result))

int raise_privileges_permanently(void){

  int old_errno = errno;

  int ret = raise_privileges();

  if(ret != 0){

    errno = old_errno;

    return ret;

  }

  if(setuid(0) == -1){

    ret = errno;

  }

  errno = old_errno;

  return ret;

}

/* Set effective user ID to unprivileged saved user ID */

__attribute__((warn_unused_result))

int lower_privileges(void){

  int old_errno = errno;

  int ret = 0;

  if(seteuid(uid) == -1){

    ret = errno;

  }

  errno = old_errno;

  return ret;

}

/* Lower privileges permanently */

__attribute__((warn_unused_result))

int lower_privileges_permanently(void){

  int old_errno = errno;

  int ret = 0;

  if(setuid(uid) == -1){

    ret = errno;

  }

  errno = old_errno;

  return ret;

}

/* 

 * Initialize GPGME.

 */

__attribute__((nonnull, warn_unused_result))

static bool init_gpgme(const char * const seckey,

		       const char * const pubkey,

		       const char * const tempdir,

		       mandos_context *mc){

  gpgme_error_t rc;

  gpgme_engine_info_t engine_info;

  /*

   * Helper function to insert pub and seckey to the engine keyring.

   */

  bool import_key(const char * const filename){

    int ret;

    int fd;

    gpgme_data_t pgp_data;

    fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));

    if(fd == -1){

      perror_plus("open");

      return false;

    }

    /* Workaround for systems without a real-time clock; see also

       Debian bug #894495: <https://bugs.debian.org/894495> */

    do {

      {

	time_t currtime = time(NULL);

	if(currtime != (time_t)-1){

	  struct tm tm;

	  if(gmtime_r(&currtime, &tm) == NULL) {

	    perror_plus("gmtime_r");

	    break;

	  }

	  if(tm.tm_year != 70 or tm.tm_mon != 0){

	    break;

	  }

	  if(debug){

	    fprintf_plus(stderr, "System clock is January 1970");

	  }

	} else {

	  if(debug){

	    fprintf_plus(stderr, "System clock is invalid");

	  }

	}

      }

      struct stat keystat;

      ret = fstat(fd, &keystat);

      if(ret != 0){

	perror_plus("fstat");

	break;

      }

      ret = raise_privileges();

      if(ret != 0){

	errno = ret;

	perror_plus("Failed to raise privileges");

	break;

      }

      if(debug){

	fprintf_plus(stderr,

		     "Setting system clock to key file mtime");

      }

      time_t keytime = keystat.st_mtim.tv_sec;

      if(stime(&keytime) != 0){

	perror_plus("stime");

      }

      ret = lower_privileges();

      if(ret != 0){

	errno = ret;

	perror_plus("Failed to lower privileges");

      }

    } while(false);

    rc = gpgme_data_new_from_fd(&pgp_data, fd);

    if(rc != GPG_ERR_NO_ERROR){

      fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",

		   gpgme_strsource(rc), gpgme_strerror(rc));

      return false;

    }

    rc = gpgme_op_import(mc->ctx, pgp_data);

    if(rc != GPG_ERR_NO_ERROR){

      fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",

		   gpgme_strsource(rc), gpgme_strerror(rc));

      return false;

    }

    {

      gpgme_import_result_t import_result

	= gpgme_op_import_result(mc->ctx);

      if((import_result->imported < 1

	  or import_result->not_imported > 0)

	 and import_result->unchanged == 0){

	fprintf_plus(stderr, "bad gpgme_op_import_results:\n");

	fprintf_plus(stderr,

		     "The total number of considered keys: %d\n",

		     import_result->considered);

	fprintf_plus(stderr,

		     "The number of keys without user ID: %d\n",

		     import_result->no_user_id);

	fprintf_plus(stderr,

		     "The total number of imported keys: %d\n",

		     import_result->imported);

	fprintf_plus(stderr, "The number of imported RSA keys: %d\n",

		     import_result->imported_rsa);

	fprintf_plus(stderr, "The number of unchanged keys: %d\n",

		     import_result->unchanged);

	fprintf_plus(stderr, "The number of new user IDs: %d\n",

		     import_result->new_user_ids);

	fprintf_plus(stderr, "The number of new sub keys: %d\n",

		     import_result->new_sub_keys);

	fprintf_plus(stderr, "The number of new signatures: %d\n",

		     import_result->new_signatures);

	fprintf_plus(stderr, "The number of new revocations: %d\n",

		     import_result->new_revocations);

	fprintf_plus(stderr,

		     "The total number of secret keys read: %d\n",

		     import_result->secret_read);

	fprintf_plus(stderr,

		     "The number of imported secret keys: %d\n",

		     import_result->secret_imported);

	fprintf_plus(stderr,

		     "The number of unchanged secret keys: %d\n",

		     import_result->secret_unchanged);

	fprintf_plus(stderr, "The number of keys not imported: %d\n",

		     import_result->not_imported);

	for(gpgme_import_status_t import_status

	      = import_result->imports;

	    import_status != NULL;

	    import_status = import_status->next){

	  fprintf_plus(stderr, "Import status for key: %s\n",

		       import_status->fpr);

	  if(import_status->result != GPG_ERR_NO_ERROR){

	    fprintf_plus(stderr, "Import result: %s: %s\n",

			 gpgme_strsource(import_status->result),

			 gpgme_strerror(import_status->result));

	  }

	  fprintf_plus(stderr, "Key status:\n");

	  fprintf_plus(stderr,

		       import_status->status & GPGME_IMPORT_NEW

		       ? "The key was new.\n"

		       : "The key was not new.\n");

	  fprintf_plus(stderr,

		       import_status->status & GPGME_IMPORT_UID

		       ? "The key contained new user IDs.\n"

		       : "The key did not contain new user IDs.\n");

	  fprintf_plus(stderr,

		       import_status->status & GPGME_IMPORT_SIG

		       ? "The key contained new signatures.\n"

		       : "The key did not contain new signatures.\n");

	  fprintf_plus(stderr,

		       import_status->status & GPGME_IMPORT_SUBKEY

		       ? "The key contained new sub keys.\n"

		       : "The key did not contain new sub keys.\n");

	  fprintf_plus(stderr,

		       import_status->status & GPGME_IMPORT_SECRET

		       ? "The key contained a secret key.\n"

		       : "The key did not contain a secret key.\n");

	}

	return false;

      }

    }

    ret = close(fd);

    if(ret == -1){

      perror_plus("close");

    }

    gpgme_data_release(pgp_data);

    return true;

  }

  if(debug){

    fprintf_plus(stderr, "Initializing GPGME\n");

  }

  /* Init GPGME */

  gpgme_check_version(NULL);

  rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);

  if(rc != GPG_ERR_NO_ERROR){

    fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",

		 gpgme_strsource(rc), gpgme_strerror(rc));

    return false;

  }

  /* Set GPGME home directory for the OpenPGP engine only */

  rc = gpgme_get_engine_info(&engine_info);

  if(rc != GPG_ERR_NO_ERROR){

    fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",

		 gpgme_strsource(rc), gpgme_strerror(rc));

    return false;

  }

  while(engine_info != NULL){

    if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){

      gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,

			    engine_info->file_name, tempdir);

      break;

    }

    engine_info = engine_info->next;

  }

  if(engine_info == NULL){

    fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",

		 tempdir);

    return false;

  }

  /* Create new GPGME "context" */

  rc = gpgme_new(&(mc->ctx));

  if(rc != GPG_ERR_NO_ERROR){

    fprintf_plus(stderr, "bad gpgme_new: %s: %s\n",

		 gpgme_strsource(rc), gpgme_strerror(rc));

    return false;

  }

  if(not import_key(pubkey) or not import_key(seckey)){

    return false;

  }

  return true;

}

/* 

 * Decrypt OpenPGP data.

 * Returns -1 on error

 */

__attribute__((nonnull, warn_unused_result))

static ssize_t pgp_packet_decrypt(const char *cryptotext,

				  size_t crypto_size,

				  char **plaintext,

				  mandos_context *mc){

  gpgme_data_t dh_crypto, dh_plain;

  gpgme_error_t rc;

  ssize_t ret;

  size_t plaintext_capacity = 0;

  ssize_t plaintext_length = 0;

  if(debug){

    fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");

  }

  /* Create new GPGME data buffer from memory cryptotext */

  rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,

			       0);

  if(rc != GPG_ERR_NO_ERROR){

    fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",

		 gpgme_strsource(rc), gpgme_strerror(rc));

    return -1;

  }

  /* Create new empty GPGME data buffer for the plaintext */

  rc = gpgme_data_new(&dh_plain);

  if(rc != GPG_ERR_NO_ERROR){

    fprintf_plus(stderr, "bad gpgme_data_new: %s: %s\n",

		 gpgme_strsource(rc), gpgme_strerror(rc));

    gpgme_data_release(dh_crypto);

    return -1;

  }

  /* Decrypt data from the cryptotext data buffer to the plaintext

     data buffer */

  rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);

  if(rc != GPG_ERR_NO_ERROR){

    fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",

		 gpgme_strsource(rc), gpgme_strerror(rc));

    plaintext_length = -1;