To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 15
- compare with another revision
- download diff
- download tarball
- view history from revision 15
- Committer: Teddy Hogeborn
- Date: 2008-07-20 06:33:48 UTC
- Revision ID: teddy@fukt.bsnet.se-20080720063348-jscgy5p0itrgvlo8
* mandos-clients.conf ([foo]): Uncommented.
([foo]/secret): New.
([foo]/secfile): Commented out.
([foo]/checker): Changed to "fping -q -- %%(fqdn)s".
([foo]/timeout): New.
* server.py: New modeline for Python and Emacs. Set a logging format.
(Client.__init__): Bug fix: Choose either the value from the options
object or pass the argument through string_to_delta
for both "timeout" and "interval".
(Client.checker_callback): Bug fix: Do not log spurious "Checker for
<foo> failed" messages.
(Client.start_checker): Moved "Starting checker" log message down to
just before actually starting the subprocess.
Do not redirect the subprocesses' stdout to a
pipe.
(peer_certificate, fingerprint): Added docstrings.
(entry_group_state_changed): Call "killme()" instead of
"main_loop.quit()".
(daemon, killme): New functions.
(exitstatus, main_loop_started): New global variables.
(__main__): Removed the "--cert", "--key", "--ca", and "--crl"
options. Removed the sleep command from the default
checker. Add a console logger in debug mode. Call
"killme()" instead of "main_loop.quit()" when there are no
more clients. Call "daemon()" if not in debug mode.
Register "cleanup()" to run at exit. Ignore some
signals. Catch DBusException to detect another running
server and exit cleanly. Exit with "exitstatus".
(cleanup): New function.
([foo]/secret): New.
([foo]/secfile): Commented out.
([foo]/checker): Changed to "fping -q -- %%(fqdn)s".
([foo]/timeout): New.
* server.py: New modeline for Python and Emacs. Set a logging format.
(Client.__init__): Bug fix: Choose either the value from the options
object or pass the argument through string_to_delta
for both "timeout" and "interval".
(Client.checker_callback): Bug fix: Do not log spurious "Checker for
<foo> failed" messages.
(Client.start_checker): Moved "Starting checker" log message down to
just before actually starting the subprocess.
Do not redirect the subprocesses' stdout to a
pipe.
(peer_certificate, fingerprint): Added docstrings.
(entry_group_state_changed): Call "killme()" instead of
"main_loop.quit()".
(daemon, killme): New functions.
(exitstatus, main_loop_started): New global variables.
(__main__): Removed the "--cert", "--key", "--ca", and "--crl"
options. Removed the sleep command from the default
checker. Add a console logger in debug mode. Call
"killme()" instead of "main_loop.quit()" when there are no
more clients. Call "daemon()" if not in debug mode.
Register "cleanup()" to run at exit. Ignore some
signals. Catch DBusException to detect another running
server and exit cleanly. Exit with "exitstatus".
(cleanup): New function.
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
1
/* -*- coding: utf-8 -*- */
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
1
/* $Id$ */
2
3
/* PLEASE NOTE *
4
* This file demonstrates how to use Avahi's core API, this is
5
* the embeddable mDNS stack for embedded applications.
4
6
*
5
* This program is partly derived from an example program for an Avahi
6
* service browser, downloaded from
7
* <http://avahi.org/browser/examples/core-browse-services.c>. This
8
* includes the following functions: "resolve_callback",
9
* "browse_callback", and parts of "main".
10
*
11
* Everything else is
12
* Copyright © 2008-2010 Teddy Hogeborn
13
* Copyright © 2008-2010 Björn Påhlsson
14
*
15
* This program is free software: you can redistribute it and/or
16
* modify it under the terms of the GNU General Public License as
17
* published by the Free Software Foundation, either version 3 of the
18
* License, or (at your option) any later version.
19
*
20
* This program is distributed in the hope that it will be useful, but
21
* WITHOUT ANY WARRANTY; without even the implied warranty of
22
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
23
* General Public License for more details.
24
*
25
* You should have received a copy of the GNU General Public License
26
* along with this program. If not, see
27
* <http://www.gnu.org/licenses/>.
28
*
29
* Contact the authors at <mandos@fukt.bsnet.se>.
7
* End user applications should *not* use this API and should use
8
* the D-Bus or C APIs, please see
9
* client-browse-services.c and glib-integration.c
10
*
11
* I repeat, you probably do *not* want to use this example.
30
12
*/
31
13
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
14
/***
15
This file is part of avahi.
16
17
avahi is free software; you can redistribute it and/or modify it
18
under the terms of the GNU Lesser General Public License as
19
published by the Free Software Foundation; either version 2.1 of the
20
License, or (at your option) any later version.
21
22
avahi is distributed in the hope that it will be useful, but WITHOUT
23
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
24
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
25
Public License for more details.
26
27
You should have received a copy of the GNU Lesser General Public
28
License along with avahi; if not, write to the Free Software
29
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
30
USA.
31
***/
32
34
33
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
34
#define _FILE_OFFSET_BITS 64
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time(), sleep() */
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
86
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
87
88
#ifdef __linux__
89
#include <sys/klog.h> /* klogctl() */
90
#endif /* __linux__ */
91
92
/* Avahi */
93
/* All Avahi types, constants and functions
94
Avahi*, avahi_*,
95
AVAHI_* */
35
36
#include <stdio.h>
37
#include <assert.h>
38
#include <stdlib.h>
39
#include <time.h>
40
#include <net/if.h> /* if_nametoindex */
41
96
42
#include <avahi-core/core.h>
97
43
#include <avahi-core/lookup.h>
98
44
#include <avahi-core/log.h>
100
46
#include <avahi-common/malloc.h>
101
47
#include <avahi-common/error.h>
102
48
103
/* GnuTLS */
104
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
105
functions:
106
gnutls_*
107
init_gnutls_session(),
108
GNUTLS_* */
109
#include <gnutls/openpgp.h>
110
/* gnutls_certificate_set_openpgp_key_file(),
111
GNUTLS_OPENPGP_FMT_BASE64 */
112
113
/* GPGME */
114
#include <gpgme.h> /* All GPGME types, constants and
115
functions:
116
gpgme_*
117
GPGME_PROTOCOL_OpenPGP,
118
GPG_ERR_NO_* */
119
49
//mandos client part
50
#include <sys/types.h> /* socket(), setsockopt(), inet_pton() */
51
#include <sys/socket.h> /* socket(), setsockopt(), struct sockaddr_in6, struct in6_addr, inet_pton() */
52
#include <gnutls/gnutls.h> /* ALL GNUTLS STUFF */
53
#include <gnutls/openpgp.h> /* gnutls with openpgp stuff */
54
55
#include <unistd.h> /* close() */
56
#include <netinet/in.h>
57
#include <stdbool.h> /* true */
58
#include <string.h> /* memset */
59
#include <arpa/inet.h> /* inet_pton() */
60
#include <iso646.h> /* not */
61
62
// gpgme
63
#include <errno.h> /* perror() */
64
#include <gpgme.h>
65
66
67
#ifndef CERT_ROOT
68
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
69
#endif
70
#define CERTFILE CERT_ROOT "openpgp-client.txt"
71
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
120
72
#define BUFFER_SIZE 256
121
122
#define PATHDIR "/conf/conf.d/mandos"
123
#define SECKEY "seckey.txt"
124
#define PUBKEY "pubkey.txt"
125
126
bool debug = false;
127
static const char mandos_protocol_version[] = "1";
128
const char *argp_program_version = "mandos-client " VERSION;
129
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
130
static const char sys_class_net[] = "/sys/class/net";
131
char *connect_to = NULL;
132
133
/* Used for passing in values through the Avahi callback functions */
73
#define DH_BITS 1024
74
134
75
typedef struct {
135
AvahiSimplePoll *simple_poll;
136
AvahiServer *server;
76
gnutls_session_t session;
137
77
gnutls_certificate_credentials_t cred;
138
unsigned int dh_bits;
139
78
gnutls_dh_params_t dh_params;
140
const char *priority;
79
} encrypted_session;
80
81
82
ssize_t gpg_packet_decrypt (char *packet, size_t packet_size, char **new_packet, char *homedir){
83
gpgme_data_t dh_crypto, dh_plain;
141
84
gpgme_ctx_t ctx;
142
} mandos_context;
143
144
/* global context so signal handler can reach it*/
145
mandos_context mc = { .simple_poll = NULL, .server = NULL,
146
.dh_bits = 1024, .priority = "SECURE256"
147
":!CTYPE-X.509:+CTYPE-OPENPGP" };
148
149
sig_atomic_t quit_now = 0;
150
int signal_received = 0;
151
152
/*
153
* Make additional room in "buffer" for at least BUFFER_SIZE more
154
* bytes. "buffer_capacity" is how much is currently allocated,
155
* "buffer_length" is how much is already used.
156
*/
157
size_t incbuffer(char **buffer, size_t buffer_length,
158
size_t buffer_capacity){
159
if(buffer_length + BUFFER_SIZE > buffer_capacity){
160
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
161
if(buffer == NULL){
162
return 0;
163
}
164
buffer_capacity += BUFFER_SIZE;
165
}
166
return buffer_capacity;
167
}
168
169
/*
170
* Initialize GPGME.
171
*/
172
static bool init_gpgme(const char *seckey,
173
const char *pubkey, const char *tempdir){
174
85
gpgme_error_t rc;
86
ssize_t ret;
87
size_t new_packet_capacity = 0;
88
size_t new_packet_length = 0;
175
89
gpgme_engine_info_t engine_info;
176
177
178
/*
179
* Helper function to insert pub and seckey to the engine keyring.
180
*/
181
bool import_key(const char *filename){
182
int ret;
183
int fd;
184
gpgme_data_t pgp_data;
185
186
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
187
if(fd == -1){
188
perror("open");
189
return false;
190
}
191
192
rc = gpgme_data_new_from_fd(&pgp_data, fd);
193
if(rc != GPG_ERR_NO_ERROR){
194
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
195
gpgme_strsource(rc), gpgme_strerror(rc));
196
return false;
197
}
198
199
rc = gpgme_op_import(mc.ctx, pgp_data);
200
if(rc != GPG_ERR_NO_ERROR){
201
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
202
gpgme_strsource(rc), gpgme_strerror(rc));
203
return false;
204
}
205
206
ret = (int)TEMP_FAILURE_RETRY(close(fd));
207
if(ret == -1){
208
perror("close");
209
}
210
gpgme_data_release(pgp_data);
211
return true;
212
}
213
214
if(debug){
215
fprintf(stderr, "Initializing GPGME\n");
216
}
217
90
218
91
/* Init GPGME */
219
92
gpgme_check_version(NULL);
220
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
221
if(rc != GPG_ERR_NO_ERROR){
222
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
223
gpgme_strsource(rc), gpgme_strerror(rc));
224
return false;
225
}
93
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
226
94
227
/* Set GPGME home directory for the OpenPGP engine only */
228
rc = gpgme_get_engine_info(&engine_info);
229
if(rc != GPG_ERR_NO_ERROR){
95
/* Set GPGME home directory */
96
rc = gpgme_get_engine_info (&engine_info);
97
if (rc != GPG_ERR_NO_ERROR){
230
98
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
231
99
gpgme_strsource(rc), gpgme_strerror(rc));
232
return false;
100
return -1;
233
101
}
234
102
while(engine_info != NULL){
235
103
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
236
104
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
237
engine_info->file_name, tempdir);
105
engine_info->file_name, homedir);
238
106
break;
239
107
}
240
108
engine_info = engine_info->next;
241
109
}
242
110
if(engine_info == NULL){
243
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
244
return false;
245
}
246
247
/* Create new GPGME "context" */
248
rc = gpgme_new(&(mc.ctx));
249
if(rc != GPG_ERR_NO_ERROR){
250
fprintf(stderr, "bad gpgme_new: %s: %s\n",
251
gpgme_strsource(rc), gpgme_strerror(rc));
252
return false;
253
}
254
255
if(not import_key(pubkey) or not import_key(seckey)){
256
return false;
257
}
258
259
return true;
260
}
261
262
/*
263
* Decrypt OpenPGP data.
264
* Returns -1 on error
265
*/
266
static ssize_t pgp_packet_decrypt(const char *cryptotext,
267
size_t crypto_size,
268
char **plaintext){
269
gpgme_data_t dh_crypto, dh_plain;
270
gpgme_error_t rc;
271
ssize_t ret;
272
size_t plaintext_capacity = 0;
273
ssize_t plaintext_length = 0;
274
275
if(debug){
276
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
277
}
278
279
/* Create new GPGME data buffer from memory cryptotext */
280
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
281
0);
282
if(rc != GPG_ERR_NO_ERROR){
111
fprintf(stderr, "Could not set home dir to %s\n", homedir);
112
return -1;
113
}
114
115
/* Create new GPGME data buffer from packet buffer */
116
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
117
if (rc != GPG_ERR_NO_ERROR){
283
118
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
284
119
gpgme_strsource(rc), gpgme_strerror(rc));
285
120
return -1;
287
122
288
123
/* Create new empty GPGME data buffer for the plaintext */
289
124
rc = gpgme_data_new(&dh_plain);
290
if(rc != GPG_ERR_NO_ERROR){
125
if (rc != GPG_ERR_NO_ERROR){
291
126
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
292
127
gpgme_strsource(rc), gpgme_strerror(rc));
293
gpgme_data_release(dh_crypto);
294
return -1;
295
}
296
297
/* Decrypt data from the cryptotext data buffer to the plaintext
298
data buffer */
299
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
300
if(rc != GPG_ERR_NO_ERROR){
128
return -1;
129
}
130
131
/* Create new GPGME "context" */
132
rc = gpgme_new(&ctx);
133
if (rc != GPG_ERR_NO_ERROR){
134
fprintf(stderr, "bad gpgme_new: %s: %s\n",
135
gpgme_strsource(rc), gpgme_strerror(rc));
136
return -1;
137
}
138
139
/* Decrypt data from the FILE pointer to the plaintext data buffer */
140
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
141
if (rc != GPG_ERR_NO_ERROR){
301
142
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
302
143
gpgme_strsource(rc), gpgme_strerror(rc));
303
plaintext_length = -1;
304
if(debug){
305
gpgme_decrypt_result_t result;
306
result = gpgme_op_decrypt_result(mc.ctx);
307
if(result == NULL){
308
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
309
} else {
310
fprintf(stderr, "Unsupported algorithm: %s\n",
311
result->unsupported_algorithm);
312
fprintf(stderr, "Wrong key usage: %u\n",
313
result->wrong_key_usage);
314
if(result->file_name != NULL){
315
fprintf(stderr, "File name: %s\n", result->file_name);
316
}
317
gpgme_recipient_t recipient;
318
recipient = result->recipients;
319
while(recipient != NULL){
320
fprintf(stderr, "Public key algorithm: %s\n",
321
gpgme_pubkey_algo_name(recipient->pubkey_algo));
322
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
323
fprintf(stderr, "Secret key available: %s\n",
324
recipient->status == GPG_ERR_NO_SECKEY
325
? "No" : "Yes");
326
recipient = recipient->next;
327
}
328
}
329
}
330
goto decrypt_end;
144
return -1;
331
145
}
332
146
333
if(debug){
334
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
335
}
147
/* gpgme_decrypt_result_t result; */
148
/* result = gpgme_op_decrypt_result(ctx); */
149
/* fprintf(stderr, "Unsupported algorithm: %s\n", result->unsupported_algorithm); */
150
/* fprintf(stderr, "Wrong key usage: %d\n", result->wrong_key_usage); */
151
/* if(result->file_name != NULL){ */
152
/* fprintf(stderr, "File name: %s\n", result->file_name); */
153
/* } */
154
/* gpgme_recipient_t recipient; */
155
/* recipient = result->recipients; */
156
/* if(recipient){ */
157
/* while(recipient != NULL){ */
158
/* fprintf(stderr, "Public key algorithm: %s\n", */
159
/* gpgme_pubkey_algo_name(recipient->pubkey_algo)); */
160
/* fprintf(stderr, "Key ID: %s\n", recipient->keyid); */
161
/* fprintf(stderr, "Secret key available: %s\n", */
162
/* recipient->status == GPG_ERR_NO_SECKEY ? "No" : "Yes"); */
163
/* recipient = recipient->next; */
164
/* } */
165
/* } */
166
167
/* Delete the GPGME FILE pointer cryptotext data buffer */
168
gpgme_data_release(dh_crypto);
336
169
337
170
/* Seek back to the beginning of the GPGME plaintext data buffer */
338
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
339
perror("gpgme_data_seek");
340
plaintext_length = -1;
341
goto decrypt_end;
342
}
343
344
*plaintext = NULL;
171
gpgme_data_seek(dh_plain, 0, SEEK_SET);
172
173
*new_packet = 0;
345
174
while(true){
346
plaintext_capacity = incbuffer(plaintext,
347
(size_t)plaintext_length,
348
plaintext_capacity);
349
if(plaintext_capacity == 0){
350
perror("incbuffer");
351
plaintext_length = -1;
352
goto decrypt_end;
175
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
176
*new_packet = realloc(*new_packet, new_packet_capacity + BUFFER_SIZE);
177
if (*new_packet == NULL){
178
perror("realloc");
179
return -1;
180
}
181
new_packet_capacity += BUFFER_SIZE;
353
182
}
354
183
355
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
356
BUFFER_SIZE);
184
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length, BUFFER_SIZE);
357
185
/* Print the data, if any */
358
if(ret == 0){
359
/* EOF */
186
if (ret == 0){
187
/* If password is empty, then a incorrect error will be printed */
360
188
break;
361
189
}
362
190
if(ret < 0){
363
191
perror("gpgme_data_read");
364
plaintext_length = -1;
365
goto decrypt_end;
366
}
367
plaintext_length += ret;
368
}
369
370
if(debug){
371
fprintf(stderr, "Decrypted password is: ");
372
for(ssize_t i = 0; i < plaintext_length; i++){
373
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
374
}
375
fprintf(stderr, "\n");
376
}
377
378
decrypt_end:
379
380
/* Delete the GPGME cryptotext data buffer */
381
gpgme_data_release(dh_crypto);
382
383
/* Delete the GPGME plaintext data buffer */
192
return -1;
193
}
194
new_packet_length += ret;
195
}
196
197
/* Delete the GPGME plaintext data buffer */
384
198
gpgme_data_release(dh_plain);
385
return plaintext_length;
199
return new_packet_length;
386
200
}
387
201
388
static const char * safer_gnutls_strerror(int value){
389
const char *ret = gnutls_strerror(value); /* Spurious warning from
390
-Wunreachable-code */
391
if(ret == NULL)
202
static const char * safer_gnutls_strerror (int value) {
203
const char *ret = gnutls_strerror (value);
204
if (ret == NULL)
392
205
ret = "(unknown)";
393
206
return ret;
394
207
}
395
208
396
/* GnuTLS log function callback */
397
static void debuggnutls(__attribute__((unused)) int level,
398
const char* string){
399
fprintf(stderr, "GnuTLS: %s", string);
209
void debuggnutls(int level, const char* string){
210
fprintf(stderr, "%s", string);
400
211
}
401
212
402
static int init_gnutls_global(const char *pubkeyfilename,
403
const char *seckeyfilename){
213
int initgnutls(encrypted_session *es){
214
const char *err;
404
215
int ret;
405
216
406
if(debug){
407
fprintf(stderr, "Initializing GnuTLS\n");
408
}
409
410
ret = gnutls_global_init();
411
if(ret != GNUTLS_E_SUCCESS){
412
fprintf(stderr, "GnuTLS global_init: %s\n",
413
safer_gnutls_strerror(ret));
414
return -1;
415
}
416
417
if(debug){
418
/* "Use a log level over 10 to enable all debugging options."
419
* - GnuTLS manual
420
*/
421
gnutls_global_set_log_level(11);
422
gnutls_global_set_log_function(debuggnutls);
423
}
424
425
/* OpenPGP credentials */
426
gnutls_certificate_allocate_credentials(&mc.cred);
427
if(ret != GNUTLS_E_SUCCESS){
428
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
429
from
430
-Wunreachable-code
431
*/
432
safer_gnutls_strerror(ret));
433
gnutls_global_deinit();
434
return -1;
435
}
436
437
if(debug){
438
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
439
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
440
seckeyfilename);
441
}
442
217
if ((ret = gnutls_global_init ())
218
!= GNUTLS_E_SUCCESS) {
219
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
220
return -1;
221
}
222
223
/* Uncomment to enable full debuggin on the gnutls library */
224
/* gnutls_global_set_log_level(11); */
225
/* gnutls_global_set_log_function(debuggnutls); */
226
227
228
/* openpgp credentials */
229
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
230
!= GNUTLS_E_SUCCESS) {
231
fprintf (stderr, "memory error: %s\n", safer_gnutls_strerror(ret));
232
return -1;
233
}
234
443
235
ret = gnutls_certificate_set_openpgp_key_file
444
(mc.cred, pubkeyfilename, seckeyfilename,
445
GNUTLS_OPENPGP_FMT_BASE64);
446
if(ret != GNUTLS_E_SUCCESS){
447
fprintf(stderr,
448
"Error[%d] while reading the OpenPGP key pair ('%s',"
449
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
450
fprintf(stderr, "The GnuTLS error is: %s\n",
451
safer_gnutls_strerror(ret));
452
goto globalfail;
453
}
454
455
/* GnuTLS server initialization */
456
ret = gnutls_dh_params_init(&mc.dh_params);
457
if(ret != GNUTLS_E_SUCCESS){
458
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
459
" %s\n", safer_gnutls_strerror(ret));
460
goto globalfail;
461
}
462
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
463
if(ret != GNUTLS_E_SUCCESS){
464
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
465
safer_gnutls_strerror(ret));
466
goto globalfail;
467
}
468
469
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
470
471
return 0;
472
473
globalfail:
474
475
gnutls_certificate_free_credentials(mc.cred);
476
gnutls_global_deinit();
477
gnutls_dh_params_deinit(mc.dh_params);
478
return -1;
479
}
480
481
static int init_gnutls_session(gnutls_session_t *session){
482
int ret;
483
/* GnuTLS session creation */
484
do {
485
ret = gnutls_init(session, GNUTLS_SERVER);
486
if(quit_now){
487
return -1;
488
}
489
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
490
if(ret != GNUTLS_E_SUCCESS){
491
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
492
safer_gnutls_strerror(ret));
493
}
494
495
{
496
const char *err;
497
do {
498
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
499
if(quit_now){
500
gnutls_deinit(*session);
501
return -1;
502
}
503
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
504
if(ret != GNUTLS_E_SUCCESS){
505
fprintf(stderr, "Syntax error at: %s\n", err);
506
fprintf(stderr, "GnuTLS error: %s\n",
507
safer_gnutls_strerror(ret));
508
gnutls_deinit(*session);
509
return -1;
510
}
511
}
512
513
do {
514
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
515
mc.cred);
516
if(quit_now){
517
gnutls_deinit(*session);
518
return -1;
519
}
520
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
521
if(ret != GNUTLS_E_SUCCESS){
522
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
523
safer_gnutls_strerror(ret));
524
gnutls_deinit(*session);
525
return -1;
526
}
527
236
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
237
if (ret != GNUTLS_E_SUCCESS) {
238
fprintf
239
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s', '%s')\n",
240
ret, CERTFILE, KEYFILE);
241
fprintf(stdout, "The Error is: %s\n",
242
safer_gnutls_strerror(ret));
243
return -1;
244
}
245
246
//Gnutls server initialization
247
if ((ret = gnutls_dh_params_init (&es->dh_params))
248
!= GNUTLS_E_SUCCESS) {
249
fprintf (stderr, "Error in dh parameter initialization: %s\n",
250
safer_gnutls_strerror(ret));
251
return -1;
252
}
253
254
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
255
!= GNUTLS_E_SUCCESS) {
256
fprintf (stderr, "Error in prime generation: %s\n",
257
safer_gnutls_strerror(ret));
258
return -1;
259
}
260
261
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
262
263
// Gnutls session creation
264
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
265
!= GNUTLS_E_SUCCESS){
266
fprintf(stderr, "Error in gnutls session initialization: %s\n",
267
safer_gnutls_strerror(ret));
268
}
269
270
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
271
!= GNUTLS_E_SUCCESS) {
272
fprintf(stderr, "Syntax error at: %s\n", err);
273
fprintf(stderr, "Gnutls error: %s\n",
274
safer_gnutls_strerror(ret));
275
return -1;
276
}
277
278
if ((ret = gnutls_credentials_set
279
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
280
!= GNUTLS_E_SUCCESS) {
281
fprintf(stderr, "Error setting a credentials set: %s\n",
282
safer_gnutls_strerror(ret));
283
return -1;
284
}
285
528
286
/* ignore client certificate if any. */
529
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
287
gnutls_certificate_server_set_request (es->session, GNUTLS_CERT_IGNORE);
530
288
531
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
289
gnutls_dh_set_prime_bits (es->session, DH_BITS);
532
290
533
291
return 0;
534
292
}
535
293
536
/* Avahi log function callback */
537
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
538
__attribute__((unused)) const char *txt){}
294
void empty_log(AvahiLogLevel level, const char *txt){}
539
295
540
/* Called when a Mandos server is found */
541
static int start_mandos_communication(const char *ip, uint16_t port,
542
AvahiIfIndex if_index,
543
int af){
544
int ret, tcp_sd = -1;
545
ssize_t sret;
546
union {
547
struct sockaddr_in in;
548
struct sockaddr_in6 in6;
549
} to;
296
int start_mandos_communcation(char *ip, uint16_t port){
297
int ret, tcp_sd;
298
struct sockaddr_in6 to;
299
struct in6_addr ip_addr;
300
encrypted_session es;
550
301
char *buffer = NULL;
551
char *decrypted_buffer = NULL;
302
char *decrypted_buffer;
552
303
size_t buffer_length = 0;
553
304
size_t buffer_capacity = 0;
554
size_t written;
555
int retval = -1;
556
gnutls_session_t session;
557
int pf; /* Protocol family */
558
559
errno = 0;
560
561
if(quit_now){
562
errno = EINTR;
563
return -1;
564
}
565
566
switch(af){
567
case AF_INET6:
568
pf = PF_INET6;
569
break;
570
case AF_INET:
571
pf = PF_INET;
572
break;
573
default:
574
fprintf(stderr, "Bad address family: %d\n", af);
575
errno = EINVAL;
576
return -1;
577
}
578
579
ret = init_gnutls_session(&session);
580
if(ret != 0){
581
return -1;
582
}
583
584
if(debug){
585
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
586
"\n", ip, port);
587
}
588
589
tcp_sd = socket(pf, SOCK_STREAM, 0);
590
if(tcp_sd < 0){
591
int e = errno;
305
ssize_t decrypted_buffer_size;
306
int retval = 0;
307
308
309
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
310
if(tcp_sd < 0) {
592
311
perror("socket");
593
errno = e;
594
goto mandos_end;
595
}
596
597
if(quit_now){
598
errno = EINTR;
599
goto mandos_end;
600
}
601
602
memset(&to, 0, sizeof(to));
603
if(af == AF_INET6){
604
to.in6.sin6_family = (sa_family_t)af;
605
ret = inet_pton(af, ip, &to.in6.sin6_addr);
606
} else { /* IPv4 */
607
to.in.sin_family = (sa_family_t)af;
608
ret = inet_pton(af, ip, &to.in.sin_addr);
609
}
610
if(ret < 0 ){
611
int e = errno;
312
return -1;
313
}
314
315
ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, "eth0", 5);
316
if(tcp_sd < 0) {
317
perror("setsockopt bindtodevice");
318
return -1;
319
}
320
321
memset(&to,0,sizeof(to));
322
to.sin6_family = AF_INET6;
323
ret = inet_pton(AF_INET6, ip, &ip_addr);
324
if (ret < 0 ){
612
325
perror("inet_pton");
613
errno = e;
614
goto mandos_end;
615
}
326
return -1;
327
}
616
328
if(ret == 0){
617
int e = errno;
618
329
fprintf(stderr, "Bad address: %s\n", ip);
619
errno = e;
620
goto mandos_end;
621
}
622
if(af == AF_INET6){
623
to.in6.sin6_port = htons(port); /* Spurious warnings from
624
-Wconversion and
625
-Wunreachable-code */
626
627
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
628
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
629
-Wunreachable-code*/
630
if(if_index == AVAHI_IF_UNSPEC){
631
fprintf(stderr, "An IPv6 link-local address is incomplete"
632
" without a network interface\n");
633
errno = EINVAL;
634
goto mandos_end;
635
}
636
/* Set the network interface number as scope */
637
to.in6.sin6_scope_id = (uint32_t)if_index;
638
}
639
} else {
640
to.in.sin_port = htons(port); /* Spurious warnings from
641
-Wconversion and
642
-Wunreachable-code */
643
}
644
645
if(quit_now){
646
errno = EINTR;
647
goto mandos_end;
648
}
649
650
if(debug){
651
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
652
char interface[IF_NAMESIZE];
653
if(if_indextoname((unsigned int)if_index, interface) == NULL){
654
perror("if_indextoname");
655
} else {
656
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
657
ip, interface, port);
658
}
659
} else {
660
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
661
port);
662
}
663
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
664
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
665
const char *pcret;
666
if(af == AF_INET6){
667
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
668
sizeof(addrstr));
669
} else {
670
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
671
sizeof(addrstr));
672
}
673
if(pcret == NULL){
674
perror("inet_ntop");
675
} else {
676
if(strcmp(addrstr, ip) != 0){
677
fprintf(stderr, "Canonical address form: %s\n", addrstr);
678
}
679
}
680
}
681
682
if(quit_now){
683
errno = EINTR;
684
goto mandos_end;
685
}
686
687
if(af == AF_INET6){
688
ret = connect(tcp_sd, &to.in6, sizeof(to));
689
} else {
690
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
691
}
692
if(ret < 0){
693
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
694
int e = errno;
695
perror("connect");
696
errno = e;
697
}
698
goto mandos_end;
699
}
700
701
if(quit_now){
702
errno = EINTR;
703
goto mandos_end;
704
}
705
706
const char *out = mandos_protocol_version;
707
written = 0;
708
while(true){
709
size_t out_size = strlen(out);
710
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
711
out_size - written));
712
if(ret == -1){
713
int e = errno;
714
perror("write");
715
errno = e;
716
goto mandos_end;
717
}
718
written += (size_t)ret;
719
if(written < out_size){
720
continue;
721
} else {
722
if(out == mandos_protocol_version){
723
written = 0;
724
out = "\r\n";
725
} else {
726
break;
727
}
728
}
729
730
if(quit_now){
731
errno = EINTR;
732
goto mandos_end;
733
}
734
}
735
736
if(debug){
737
fprintf(stderr, "Establishing TLS session with %s\n", ip);
738
}
739
740
if(quit_now){
741
errno = EINTR;
742
goto mandos_end;
743
}
744
745
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
746
747
if(quit_now){
748
errno = EINTR;
749
goto mandos_end;
750
}
751
752
do {
753
ret = gnutls_handshake(session);
754
if(quit_now){
755
errno = EINTR;
756
goto mandos_end;
757
}
758
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
759
760
if(ret != GNUTLS_E_SUCCESS){
761
if(debug){
762
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
763
gnutls_perror(ret);
764
}
765
errno = EPROTO;
766
goto mandos_end;
767
}
768
769
/* Read OpenPGP packet that contains the wanted password */
770
771
if(debug){
772
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
773
ip);
774
}
775
776
while(true){
777
778
if(quit_now){
779
errno = EINTR;
780
goto mandos_end;
781
}
782
783
buffer_capacity = incbuffer(&buffer, buffer_length,
784
buffer_capacity);
785
if(buffer_capacity == 0){
786
int e = errno;
787
perror("incbuffer");
788
errno = e;
789
goto mandos_end;
790
}
791
792
if(quit_now){
793
errno = EINTR;
794
goto mandos_end;
795
}
796
797
sret = gnutls_record_recv(session, buffer+buffer_length,
798
BUFFER_SIZE);
799
if(sret == 0){
330
return -1;
331
}
332
to.sin6_port = htons(port);
333
to.sin6_scope_id = if_nametoindex("eth0");
334
335
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
336
if (ret < 0){
337
perror("connect");
338
return -1;
339
}
340
341
ret = initgnutls (&es);
342
if (ret != 0){
343
retval = -1;
344
return -1;
345
}
346
347
348
gnutls_transport_set_ptr (es.session, (gnutls_transport_ptr_t) tcp_sd);
349
350
ret = gnutls_handshake (es.session);
351
352
if (ret != GNUTLS_E_SUCCESS){
353
fprintf(stderr, "\n*** Handshake failed ***\n");
354
gnutls_perror (ret);
355
retval = -1;
356
goto exit;
357
}
358
359
//retrive password
360
while(true){
361
if (buffer_length + BUFFER_SIZE > buffer_capacity){
362
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
363
if (buffer == NULL){
364
perror("realloc");
365
goto exit;
366
}
367
buffer_capacity += BUFFER_SIZE;
368
}
369
370
ret = gnutls_record_recv
371
(es.session, buffer+buffer_length, BUFFER_SIZE);
372
if (ret == 0){
800
373
break;
801
374
}
802
if(sret < 0){
803
switch(sret){
375
if (ret < 0){
376
switch(ret){
804
377
case GNUTLS_E_INTERRUPTED:
805
378
case GNUTLS_E_AGAIN:
806
379
break;
807
380
case GNUTLS_E_REHANDSHAKE:
808
do {
809
ret = gnutls_handshake(session);
810
811
if(quit_now){
812
errno = EINTR;
813
goto mandos_end;
814
}
815
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
816
if(ret < 0){
817
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
818
gnutls_perror(ret);
819
errno = EPROTO;
820
goto mandos_end;
381
ret = gnutls_handshake (es.session);
382
if (ret < 0){
383
fprintf(stderr, "\n*** Handshake failed ***\n");
384
gnutls_perror (ret);
385
retval = -1;
386
goto exit;
821
387
}
822
388
break;
823
389
default:
824
fprintf(stderr, "Unknown error while reading data from"
825
" encrypted session with Mandos server\n");
826
gnutls_bye(session, GNUTLS_SHUT_RDWR);
827
errno = EIO;
828
goto mandos_end;
390
fprintf(stderr, "Unknown error while reading data from encrypted session with mandos server\n");
391
retval = -1;
392
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
393
goto exit;
829
394
}
830
395
} else {
831
buffer_length += (size_t) sret;
832
}
833
}
834
835
if(debug){
836
fprintf(stderr, "Closing TLS session\n");
837
}
838
839
if(quit_now){
840
errno = EINTR;
841
goto mandos_end;
842
}
843
844
do {
845
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
846
if(quit_now){
847
errno = EINTR;
848
goto mandos_end;
849
}
850
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
851
852
if(buffer_length > 0){
853
ssize_t decrypted_buffer_size;
854
decrypted_buffer_size = pgp_packet_decrypt(buffer,
855
buffer_length,
856
&decrypted_buffer);
857
if(decrypted_buffer_size >= 0){
858
859
written = 0;
860
while(written < (size_t) decrypted_buffer_size){
861
if(quit_now){
862
errno = EINTR;
863
goto mandos_end;
864
}
865
866
ret = (int)fwrite(decrypted_buffer + written, 1,
867
(size_t)decrypted_buffer_size - written,
868
stdout);
869
if(ret == 0 and ferror(stdout)){
870
int e = errno;
871
if(debug){
872
fprintf(stderr, "Error writing encrypted data: %s\n",
873
strerror(errno));
874
}
875
errno = e;
876
goto mandos_end;
877
}
878
written += (size_t)ret;
879
}
880
retval = 0;
881
}
882
}
883
884
/* Shutdown procedure */
885
886
mandos_end:
887
{
888
int e = errno;
889
free(decrypted_buffer);
890
free(buffer);
891
if(tcp_sd >= 0){
892
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
893
}
894
if(ret == -1){
895
if(e == 0){
896
e = errno;
897
}
898
perror("close");
899
}
900
gnutls_deinit(session);
901
if(quit_now){
902
e = EINTR;
396
buffer_length += ret;
397
}
398
}
399
400
if (buffer_length > 0){
401
if ((decrypted_buffer_size = gpg_packet_decrypt(buffer, buffer_length, &decrypted_buffer, CERT_ROOT)) == 0){
903
402
retval = -1;
403
} else {
404
fwrite (decrypted_buffer, 1, decrypted_buffer_size, stdout);
405
free(decrypted_buffer);
904
406
}
905
errno = e;
906
407
}
408
409
free(buffer);
410
411
//shutdown procedure
412
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
413
exit:
414
close(tcp_sd);
415
gnutls_deinit (es.session);
416
gnutls_certificate_free_credentials (es.cred);
417
gnutls_global_deinit ();
907
418
return retval;
908
419
}
909
420
910
static void resolve_callback(AvahiSServiceResolver *r,
911
AvahiIfIndex interface,
912
AvahiProtocol proto,
913
AvahiResolverEvent event,
914
const char *name,
915
const char *type,
916
const char *domain,
917
const char *host_name,
918
const AvahiAddress *address,
919
uint16_t port,
920
AVAHI_GCC_UNUSED AvahiStringList *txt,
921
AVAHI_GCC_UNUSED AvahiLookupResultFlags
922
flags,
923
AVAHI_GCC_UNUSED void* userdata){
924
assert(r);
925
926
/* Called whenever a service has been resolved successfully or
927
timed out */
928
929
if(quit_now){
930
return;
931
}
932
933
switch(event){
934
default:
935
case AVAHI_RESOLVER_FAILURE:
936
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
937
" of type '%s' in domain '%s': %s\n", name, type, domain,
938
avahi_strerror(avahi_server_errno(mc.server)));
939
break;
940
941
case AVAHI_RESOLVER_FOUND:
942
{
943
char ip[AVAHI_ADDRESS_STR_MAX];
944
avahi_address_snprint(ip, sizeof(ip), address);
945
if(debug){
946
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
947
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
948
ip, (intmax_t)interface, port);
949
}
950
int ret = start_mandos_communication(ip, port, interface,
951
avahi_proto_to_af(proto));
952
if(ret == 0){
953
avahi_simple_poll_quit(mc.simple_poll);
954
}
955
}
956
}
957
avahi_s_service_resolver_free(r);
958
}
959
960
static void browse_callback(AvahiSServiceBrowser *b,
961
AvahiIfIndex interface,
962
AvahiProtocol protocol,
963
AvahiBrowserEvent event,
964
const char *name,
965
const char *type,
966
const char *domain,
967
AVAHI_GCC_UNUSED AvahiLookupResultFlags
968
flags,
969
AVAHI_GCC_UNUSED void* userdata){
970
assert(b);
971
972
/* Called whenever a new services becomes available on the LAN or
973
is removed from the LAN */
974
975
if(quit_now){
976
return;
977
}
978
979
switch(event){
980
default:
981
case AVAHI_BROWSER_FAILURE:
982
983
fprintf(stderr, "(Avahi browser) %s\n",
984
avahi_strerror(avahi_server_errno(mc.server)));
985
avahi_simple_poll_quit(mc.simple_poll);
986
return;
987
988
case AVAHI_BROWSER_NEW:
989
/* We ignore the returned Avahi resolver object. In the callback
990
function we free it. If the Avahi server is terminated before
991
the callback function is called the Avahi server will free the
992
resolver for us. */
993
994
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
995
name, type, domain, protocol, 0,
996
resolve_callback, NULL) == NULL)
997
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
998
name, avahi_strerror(avahi_server_errno(mc.server)));
999
break;
1000
1001
case AVAHI_BROWSER_REMOVE:
1002
break;
1003
1004
case AVAHI_BROWSER_ALL_FOR_NOW:
1005
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1006
if(debug){
1007
fprintf(stderr, "No Mandos server found, still searching...\n");
1008
}
1009
break;
1010
}
1011
}
1012
1013
/* stop main loop after sigterm has been called */
1014
static void handle_sigterm(int sig){
1015
if(quit_now){
1016
return;
1017
}
1018
quit_now = 1;
1019
signal_received = sig;
1020
int old_errno = errno;
1021
if(mc.simple_poll != NULL){
1022
avahi_simple_poll_quit(mc.simple_poll);
1023
}
1024
errno = old_errno;
1025
}
1026
1027
/*
1028
* This function determines if a directory entry in /sys/class/net
1029
* corresponds to an acceptable network device.
1030
* (This function is passed to scandir(3) as a filter function.)
1031
*/
1032
int good_interface(const struct dirent *if_entry){
1033
ssize_t ssret;
1034
char *flagname = NULL;
1035
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
1036
if_entry->d_name);
1037
if(ret < 0){
1038
perror("asprintf");
1039
return 0;
1040
}
1041
if(if_entry->d_name[0] == '.'){
1042
return 0;
1043
}
1044
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1045
if(flags_fd == -1){
1046
perror("open");
1047
return 0;
1048
}
1049
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1050
/* read line from flags_fd */
1051
ssize_t to_read = (sizeof(ifreq_flags)*2)+3; /* "0x1003\n" */
1052
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1053
flagstring[(size_t)to_read] = '\0';
1054
if(flagstring == NULL){
1055
perror("malloc");
1056
close(flags_fd);
1057
return 0;
1058
}
1059
while(to_read > 0){
1060
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1061
(size_t)to_read));
1062
if(ssret == -1){
1063
perror("read");
1064
free(flagstring);
1065
close(flags_fd);
1066
return 0;
1067
}
1068
to_read -= ssret;
1069
if(ssret == 0){
1070
break;
1071
}
1072
}
1073
close(flags_fd);
1074
intmax_t tmpmax;
1075
char *tmp;
1076
errno = 0;
1077
tmpmax = strtoimax(flagstring, &tmp, 0);
1078
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1079
and not (isspace(*tmp)))
1080
or tmpmax != (ifreq_flags)tmpmax){
1081
if(debug){
1082
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1083
flagstring, if_entry->d_name);
1084
}
1085
free(flagstring);
1086
return 0;
1087
}
1088
free(flagstring);
1089
ifreq_flags flags = (ifreq_flags)tmpmax;
1090
/* Reject the loopback device */
1091
if(flags & IFF_LOOPBACK){
1092
if(debug){
1093
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1094
if_entry->d_name);
1095
}
1096
return 0;
1097
}
1098
/* Accept point-to-point devices only if connect_to is specified */
1099
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1100
if(debug){
1101
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1102
if_entry->d_name);
1103
}
1104
return 1;
1105
}
1106
/* Otherwise, reject non-broadcast-capable devices */
1107
if(not (flags & IFF_BROADCAST)){
1108
if(debug){
1109
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1110
if_entry->d_name);
1111
}
1112
return 0;
1113
}
1114
/* Accept this device */
1115
if(debug){
1116
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1117
if_entry->d_name);
1118
}
1119
return 1;
1120
}
1121
1122
int main(int argc, char *argv[]){
1123
AvahiSServiceBrowser *sb = NULL;
1124
int error;
1125
int ret;
1126
intmax_t tmpmax;
1127
char *tmp;
1128
int exitcode = EXIT_SUCCESS;
1129
const char *interface = "";
1130
struct ifreq network;
1131
int sd = -1;
1132
bool take_down_interface = false;
1133
uid_t uid;
1134
gid_t gid;
1135
char tempdir[] = "/tmp/mandosXXXXXX";
1136
bool tempdir_created = false;
1137
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1138
const char *seckey = PATHDIR "/" SECKEY;
1139
const char *pubkey = PATHDIR "/" PUBKEY;
1140
1141
bool gnutls_initialized = false;
1142
bool gpgme_initialized = false;
1143
float delay = 2.5f;
1144
1145
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1146
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1147
1148
uid = getuid();
1149
gid = getgid();
1150
1151
/* Lower any group privileges we might have, just to be safe */
1152
errno = 0;
1153
ret = setgid(gid);
1154
if(ret == -1){
1155
perror("setgid");
1156
}
1157
1158
/* Lower user privileges (temporarily) */
1159
errno = 0;
1160
ret = seteuid(uid);
1161
if(ret == -1){
1162
perror("seteuid");
1163
}
1164
1165
if(quit_now){
1166
goto end;
1167
}
1168
1169
{
1170
struct argp_option options[] = {
1171
{ .name = "debug", .key = 128,
1172
.doc = "Debug mode", .group = 3 },
1173
{ .name = "connect", .key = 'c',
1174
.arg = "ADDRESS:PORT",
1175
.doc = "Connect directly to a specific Mandos server",
1176
.group = 1 },
1177
{ .name = "interface", .key = 'i',
1178
.arg = "NAME",
1179
.doc = "Network interface that will be used to search for"
1180
" Mandos servers",
1181
.group = 1 },
1182
{ .name = "seckey", .key = 's',
1183
.arg = "FILE",
1184
.doc = "OpenPGP secret key file base name",
1185
.group = 1 },
1186
{ .name = "pubkey", .key = 'p',
1187
.arg = "FILE",
1188
.doc = "OpenPGP public key file base name",
1189
.group = 2 },
1190
{ .name = "dh-bits", .key = 129,
1191
.arg = "BITS",
1192
.doc = "Bit length of the prime number used in the"
1193
" Diffie-Hellman key exchange",
1194
.group = 2 },
1195
{ .name = "priority", .key = 130,
1196
.arg = "STRING",
1197
.doc = "GnuTLS priority string for the TLS handshake",
1198
.group = 1 },
1199
{ .name = "delay", .key = 131,
1200
.arg = "SECONDS",
1201
.doc = "Maximum delay to wait for interface startup",
1202
.group = 2 },
1203
/*
1204
* These reproduce what we would get without ARGP_NO_HELP
1205
*/
1206
{ .name = "help", .key = '?',
1207
.doc = "Give this help list", .group = -1 },
1208
{ .name = "usage", .key = -3,
1209
.doc = "Give a short usage message", .group = -1 },
1210
{ .name = "version", .key = 'V',
1211
.doc = "Print program version", .group = -1 },
1212
{ .name = NULL }
1213
};
1214
1215
error_t parse_opt(int key, char *arg,
1216
struct argp_state *state){
1217
errno = 0;
1218
switch(key){
1219
case 128: /* --debug */
1220
debug = true;
1221
break;
1222
case 'c': /* --connect */
1223
connect_to = arg;
1224
break;
1225
case 'i': /* --interface */
1226
interface = arg;
1227
break;
1228
case 's': /* --seckey */
1229
seckey = arg;
1230
break;
1231
case 'p': /* --pubkey */
1232
pubkey = arg;
1233
break;
1234
case 129: /* --dh-bits */
1235
errno = 0;
1236
tmpmax = strtoimax(arg, &tmp, 10);
1237
if(errno != 0 or tmp == arg or *tmp != '\0'
1238
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1239
argp_error(state, "Bad number of DH bits");
1240
}
1241
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1242
break;
1243
case 130: /* --priority */
1244
mc.priority = arg;
1245
break;
1246
case 131: /* --delay */
1247
errno = 0;
1248
delay = strtof(arg, &tmp);
1249
if(errno != 0 or tmp == arg or *tmp != '\0'){
1250
argp_error(state, "Bad delay");
1251
}
1252
break;
1253
/*
1254
* These reproduce what we would get without ARGP_NO_HELP
1255
*/
1256
case '?': /* --help */
1257
argp_state_help(state, state->out_stream,
1258
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1259
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1260
case -3: /* --usage */
1261
argp_state_help(state, state->out_stream,
1262
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1263
case 'V': /* --version */
1264
fprintf(state->out_stream, "%s\n", argp_program_version);
1265
exit(argp_err_exit_status);
1266
break;
1267
default:
1268
return ARGP_ERR_UNKNOWN;
1269
}
1270
return errno;
1271
}
1272
1273
struct argp argp = { .options = options, .parser = parse_opt,
1274
.args_doc = "",
1275
.doc = "Mandos client -- Get and decrypt"
1276
" passwords from a Mandos server" };
1277
ret = argp_parse(&argp, argc, argv,
1278
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1279
switch(ret){
1280
case 0:
1281
break;
1282
case ENOMEM:
1283
default:
1284
errno = ret;
1285
perror("argp_parse");
1286
exitcode = EX_OSERR;
1287
goto end;
1288
case EINVAL:
1289
exitcode = EX_USAGE;
1290
goto end;
1291
}
1292
}
1293
1294
if(not debug){
421
static AvahiSimplePoll *simple_poll = NULL;
422
static AvahiServer *server = NULL;
423
424
static void resolve_callback(
425
AvahiSServiceResolver *r,
426
AVAHI_GCC_UNUSED AvahiIfIndex interface,
427
AVAHI_GCC_UNUSED AvahiProtocol protocol,
428
AvahiResolverEvent event,
429
const char *name,
430
const char *type,
431
const char *domain,
432
const char *host_name,
433
const AvahiAddress *address,
434
uint16_t port,
435
AvahiStringList *txt,
436
AvahiLookupResultFlags flags,
437
AVAHI_GCC_UNUSED void* userdata) {
438
439
assert(r);
440
441
/* Called whenever a service has been resolved successfully or timed out */
442
443
switch (event) {
444
case AVAHI_RESOLVER_FAILURE:
445
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of type '%s' in domain '%s': %s\n", name, type, domain, avahi_strerror(avahi_server_errno(server)));
446
break;
447
448
case AVAHI_RESOLVER_FOUND: {
449
char ip[AVAHI_ADDRESS_STR_MAX];
450
avahi_address_snprint(ip, sizeof(ip), address);
451
int ret = start_mandos_communcation(ip, port);
452
if (ret == 0){
453
exit(EXIT_SUCCESS);
454
} else {
455
exit(EXIT_FAILURE);
456
}
457
}
458
}
459
avahi_s_service_resolver_free(r);
460
}
461
462
static void browse_callback(
463
AvahiSServiceBrowser *b,
464
AvahiIfIndex interface,
465
AvahiProtocol protocol,
466
AvahiBrowserEvent event,
467
const char *name,
468
const char *type,
469
const char *domain,
470
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
471
void* userdata) {
472
473
AvahiServer *s = userdata;
474
assert(b);
475
476
/* Called whenever a new services becomes available on the LAN or is removed from the LAN */
477
478
switch (event) {
479
480
case AVAHI_BROWSER_FAILURE:
481
482
fprintf(stderr, "(Browser) %s\n", avahi_strerror(avahi_server_errno(server)));
483
avahi_simple_poll_quit(simple_poll);
484
return;
485
486
case AVAHI_BROWSER_NEW:
487
/* We ignore the returned resolver object. In the callback
488
function we free it. If the server is terminated before
489
the callback function is called the server will free
490
the resolver for us. */
491
492
if (!(avahi_s_service_resolver_new(s, interface, protocol, name, type, domain, AVAHI_PROTO_INET6, 0, resolve_callback, s)))
493
fprintf(stderr, "Failed to resolve service '%s': %s\n", name, avahi_strerror(avahi_server_errno(s)));
494
495
break;
496
497
case AVAHI_BROWSER_REMOVE:
498
break;
499
500
case AVAHI_BROWSER_ALL_FOR_NOW:
501
case AVAHI_BROWSER_CACHE_EXHAUSTED:
502
break;
503
}
504
}
505
506
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
507
AvahiServerConfig config;
508
AvahiSServiceBrowser *sb = NULL;
509
int error;
510
int ret = 1;
511
1295
512
avahi_set_log_function(empty_log);
1296
}
1297
1298
if(interface[0] == '\0'){
1299
struct dirent **direntries;
1300
ret = scandir(sys_class_net, &direntries, good_interface,
1301
alphasort);
1302
if(ret >= 1){
1303
/* Pick the first good interface */
1304
interface = strdup(direntries[0]->d_name);
1305
if(debug){
1306
fprintf(stderr, "Using interface \"%s\"\n", interface);
1307
}
1308
if(interface == NULL){
1309
perror("malloc");
1310
free(direntries);
1311
exitcode = EXIT_FAILURE;
1312
goto end;
1313
}
1314
free(direntries);
1315
} else {
1316
free(direntries);
1317
fprintf(stderr, "Could not find a network interface\n");
1318
exitcode = EXIT_FAILURE;
1319
goto end;
1320
}
1321
}
1322
1323
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1324
from the signal handler */
1325
/* Initialize the pseudo-RNG for Avahi */
1326
srand((unsigned int) time(NULL));
1327
mc.simple_poll = avahi_simple_poll_new();
1328
if(mc.simple_poll == NULL){
1329
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1330
exitcode = EX_UNAVAILABLE;
1331
goto end;
1332
}
1333
1334
sigemptyset(&sigterm_action.sa_mask);
1335
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1336
if(ret == -1){
1337
perror("sigaddset");
1338
exitcode = EX_OSERR;
1339
goto end;
1340
}
1341
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1342
if(ret == -1){
1343
perror("sigaddset");
1344
exitcode = EX_OSERR;
1345
goto end;
1346
}
1347
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1348
if(ret == -1){
1349
perror("sigaddset");
1350
exitcode = EX_OSERR;
1351
goto end;
1352
}
1353
/* Need to check if the handler is SIG_IGN before handling:
1354
| [[info:libc:Initial Signal Actions]] |
1355
| [[info:libc:Basic Signal Handling]] |
1356
*/
1357
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1358
if(ret == -1){
1359
perror("sigaction");
1360
return EX_OSERR;
1361
}
1362
if(old_sigterm_action.sa_handler != SIG_IGN){
1363
ret = sigaction(SIGINT, &sigterm_action, NULL);
1364
if(ret == -1){
1365
perror("sigaction");
1366
exitcode = EX_OSERR;
1367
goto end;
1368
}
1369
}
1370
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1371
if(ret == -1){
1372
perror("sigaction");
1373
return EX_OSERR;
1374
}
1375
if(old_sigterm_action.sa_handler != SIG_IGN){
1376
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1377
if(ret == -1){
1378
perror("sigaction");
1379
exitcode = EX_OSERR;
1380
goto end;
1381
}
1382
}
1383
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1384
if(ret == -1){
1385
perror("sigaction");
1386
return EX_OSERR;
1387
}
1388
if(old_sigterm_action.sa_handler != SIG_IGN){
1389
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1390
if(ret == -1){
1391
perror("sigaction");
1392
exitcode = EX_OSERR;
1393
goto end;
1394
}
1395
}
1396
1397
/* If the interface is down, bring it up */
1398
if(strcmp(interface, "none") != 0){
1399
if_index = (AvahiIfIndex) if_nametoindex(interface);
1400
if(if_index == 0){
1401
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1402
exitcode = EX_UNAVAILABLE;
1403
goto end;
1404
}
1405
1406
if(quit_now){
1407
goto end;
1408
}
1409
1410
/* Re-raise priviliges */
1411
errno = 0;
1412
ret = seteuid(0);
1413
if(ret == -1){
1414
perror("seteuid");
1415
}
1416
1417
#ifdef __linux__
1418
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1419
messages about the network interface to mess up the prompt */
1420
ret = klogctl(8, NULL, 5);
1421
bool restore_loglevel = true;
1422
if(ret == -1){
1423
restore_loglevel = false;
1424
perror("klogctl");
1425
}
1426
#endif /* __linux__ */
1427
1428
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1429
if(sd < 0){
1430
perror("socket");
1431
exitcode = EX_OSERR;
1432
#ifdef __linux__
1433
if(restore_loglevel){
1434
ret = klogctl(7, NULL, 0);
1435
if(ret == -1){
1436
perror("klogctl");
1437
}
1438
}
1439
#endif /* __linux__ */
1440
/* Lower privileges */
1441
errno = 0;
1442
ret = seteuid(uid);
1443
if(ret == -1){
1444
perror("seteuid");
1445
}
1446
goto end;
1447
}
1448
strcpy(network.ifr_name, interface);
1449
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1450
if(ret == -1){
1451
perror("ioctl SIOCGIFFLAGS");
1452
#ifdef __linux__
1453
if(restore_loglevel){
1454
ret = klogctl(7, NULL, 0);
1455
if(ret == -1){
1456
perror("klogctl");
1457
}
1458
}
1459
#endif /* __linux__ */
1460
exitcode = EX_OSERR;
1461
/* Lower privileges */
1462
errno = 0;
1463
ret = seteuid(uid);
1464
if(ret == -1){
1465
perror("seteuid");
1466
}
1467
goto end;
1468
}
1469
if((network.ifr_flags & IFF_UP) == 0){
1470
network.ifr_flags |= IFF_UP;
1471
take_down_interface = true;
1472
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1473
if(ret == -1){
1474
take_down_interface = false;
1475
perror("ioctl SIOCSIFFLAGS +IFF_UP");
1476
exitcode = EX_OSERR;
1477
#ifdef __linux__
1478
if(restore_loglevel){
1479
ret = klogctl(7, NULL, 0);
1480
if(ret == -1){
1481
perror("klogctl");
1482
}
1483
}
1484
#endif /* __linux__ */
1485
/* Lower privileges */
1486
errno = 0;
1487
ret = seteuid(uid);
1488
if(ret == -1){
1489
perror("seteuid");
1490
}
1491
goto end;
1492
}
1493
}
1494
/* sleep checking until interface is running */
1495
for(int i=0; i < delay * 4; i++){
1496
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1497
if(ret == -1){
1498
perror("ioctl SIOCGIFFLAGS");
1499
} else if(network.ifr_flags & IFF_RUNNING){
1500
break;
1501
}
1502
struct timespec sleeptime = { .tv_nsec = 250000000 };
1503
ret = nanosleep(&sleeptime, NULL);
1504
if(ret == -1 and errno != EINTR){
1505
perror("nanosleep");
1506
}
1507
}
1508
if(not take_down_interface){
1509
/* We won't need the socket anymore */
1510
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1511
if(ret == -1){
1512
perror("close");
1513
}
1514
}
1515
#ifdef __linux__
1516
if(restore_loglevel){
1517
/* Restores kernel loglevel to default */
1518
ret = klogctl(7, NULL, 0);
1519
if(ret == -1){
1520
perror("klogctl");
1521
}
1522
}
1523
#endif /* __linux__ */
1524
/* Lower privileges */
1525
errno = 0;
1526
if(take_down_interface){
1527
/* Lower privileges */
1528
ret = seteuid(uid);
1529
if(ret == -1){
1530
perror("seteuid");
1531
}
1532
} else {
1533
/* Lower privileges permanently */
1534
ret = setuid(uid);
1535
if(ret == -1){
1536
perror("setuid");
1537
}
1538
}
1539
}
1540
1541
if(quit_now){
1542
goto end;
1543
}
1544
1545
ret = init_gnutls_global(pubkey, seckey);
1546
if(ret == -1){
1547
fprintf(stderr, "init_gnutls_global failed\n");
1548
exitcode = EX_UNAVAILABLE;
1549
goto end;
1550
} else {
1551
gnutls_initialized = true;
1552
}
1553
1554
if(quit_now){
1555
goto end;
1556
}
1557
1558
tempdir_created = true;
1559
if(mkdtemp(tempdir) == NULL){
1560
tempdir_created = false;
1561
perror("mkdtemp");
1562
goto end;
1563
}
1564
1565
if(quit_now){
1566
goto end;
1567
}
1568
1569
if(not init_gpgme(pubkey, seckey, tempdir)){
1570
fprintf(stderr, "init_gpgme failed\n");
1571
exitcode = EX_UNAVAILABLE;
1572
goto end;
1573
} else {
1574
gpgme_initialized = true;
1575
}
1576
1577
if(quit_now){
1578
goto end;
1579
}
1580
1581
if(connect_to != NULL){
1582
/* Connect directly, do not use Zeroconf */
1583
/* (Mainly meant for debugging) */
1584
char *address = strrchr(connect_to, ':');
1585
if(address == NULL){
1586
fprintf(stderr, "No colon in address\n");
1587
exitcode = EX_USAGE;
1588
goto end;
1589
}
1590
1591
if(quit_now){
1592
goto end;
1593
}
1594
1595
uint16_t port;
1596
errno = 0;
1597
tmpmax = strtoimax(address+1, &tmp, 10);
1598
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1599
or tmpmax != (uint16_t)tmpmax){
1600
fprintf(stderr, "Bad port number\n");
1601
exitcode = EX_USAGE;
1602
goto end;
1603
}
1604
1605
if(quit_now){
1606
goto end;
1607
}
1608
1609
port = (uint16_t)tmpmax;
1610
*address = '\0';
1611
address = connect_to;
1612
/* Colon in address indicates IPv6 */
1613
int af;
1614
if(strchr(address, ':') != NULL){
1615
af = AF_INET6;
1616
} else {
1617
af = AF_INET;
1618
}
1619
1620
if(quit_now){
1621
goto end;
1622
}
1623
1624
while(not quit_now){
1625
ret = start_mandos_communication(address, port, if_index, af);
1626
if(quit_now or ret == 0){
1627
break;
1628
}
1629
sleep(15);
1630
};
1631
1632
if (not quit_now){
1633
exitcode = EXIT_SUCCESS;
1634
}
1635
1636
goto end;
1637
}
1638
1639
if(quit_now){
1640
goto end;
1641
}
1642
1643
{
1644
AvahiServerConfig config;
1645
/* Do not publish any local Zeroconf records */
513
514
/* Initialize the psuedo-RNG */
515
srand(time(NULL));
516
517
/* Allocate main loop object */
518
if (!(simple_poll = avahi_simple_poll_new())) {
519
fprintf(stderr, "Failed to create simple poll object.\n");
520
goto fail;
521
}
522
523
/* Do not publish any local records */
1646
524
avahi_server_config_init(&config);
1647
525
config.publish_hinfo = 0;
1648
526
config.publish_addresses = 0;
1649
527
config.publish_workstation = 0;
1650
528
config.publish_domain = 0;
529
530
/* /\* Set a unicast DNS server for wide area DNS-SD *\/ */
531
/* avahi_address_parse("193.11.177.11", AVAHI_PROTO_UNSPEC, &config.wide_area_servers[0]); */
532
/* config.n_wide_area_servers = 1; */
533
/* config.enable_wide_area = 1; */
1651
534
1652
535
/* Allocate a new server */
1653
mc.server = avahi_server_new(avahi_simple_poll_get
1654
(mc.simple_poll), &config, NULL,
1655
NULL, &error);
1656
1657
/* Free the Avahi configuration data */
536
server = avahi_server_new(avahi_simple_poll_get(simple_poll), &config, NULL, NULL, &error);
537
538
/* Free the configuration data */
1658
539
avahi_server_config_free(&config);
1659
}
1660
1661
/* Check if creating the Avahi server object succeeded */
1662
if(mc.server == NULL){
1663
fprintf(stderr, "Failed to create Avahi server: %s\n",
1664
avahi_strerror(error));
1665
exitcode = EX_UNAVAILABLE;
1666
goto end;
1667
}
1668
1669
if(quit_now){
1670
goto end;
1671
}
1672
1673
/* Create the Avahi service browser */
1674
sb = avahi_s_service_browser_new(mc.server, if_index,
1675
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1676
NULL, 0, browse_callback, NULL);
1677
if(sb == NULL){
1678
fprintf(stderr, "Failed to create service browser: %s\n",
1679
avahi_strerror(avahi_server_errno(mc.server)));
1680
exitcode = EX_UNAVAILABLE;
1681
goto end;
1682
}
1683
1684
if(quit_now){
1685
goto end;
1686
}
1687
1688
/* Run the main loop */
1689
1690
if(debug){
1691
fprintf(stderr, "Starting Avahi loop search\n");
1692
}
1693
1694
avahi_simple_poll_loop(mc.simple_poll);
1695
1696
end:
1697
1698
if(debug){
1699
fprintf(stderr, "%s exiting\n", argv[0]);
1700
}
1701
1702
/* Cleanup things */
1703
if(sb != NULL)
1704
avahi_s_service_browser_free(sb);
1705
1706
if(mc.server != NULL)
1707
avahi_server_free(mc.server);
1708
1709
if(mc.simple_poll != NULL)
1710
avahi_simple_poll_free(mc.simple_poll);
1711
1712
if(gnutls_initialized){
1713
gnutls_certificate_free_credentials(mc.cred);
1714
gnutls_global_deinit();
1715
gnutls_dh_params_deinit(mc.dh_params);
1716
}
1717
1718
if(gpgme_initialized){
1719
gpgme_release(mc.ctx);
1720
}
1721
1722
/* Take down the network interface */
1723
if(take_down_interface){
1724
/* Re-raise priviliges */
1725
errno = 0;
1726
ret = seteuid(0);
1727
if(ret == -1){
1728
perror("seteuid");
1729
}
1730
if(geteuid() == 0){
1731
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1732
if(ret == -1){
1733
perror("ioctl SIOCGIFFLAGS");
1734
} else if(network.ifr_flags & IFF_UP) {
1735
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1736
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1737
if(ret == -1){
1738
perror("ioctl SIOCSIFFLAGS -IFF_UP");
1739
}
1740
}
1741
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1742
if(ret == -1){
1743
perror("close");
1744
}
1745
/* Lower privileges permanently */
1746
errno = 0;
1747
ret = setuid(uid);
1748
if(ret == -1){
1749
perror("setuid");
1750
}
1751
}
1752
}
1753
1754
/* Removes the temp directory used by GPGME */
1755
if(tempdir_created){
1756
DIR *d;
1757
struct dirent *direntry;
1758
d = opendir(tempdir);
1759
if(d == NULL){
1760
if(errno != ENOENT){
1761
perror("opendir");
1762
}
1763
} else {
1764
while(true){
1765
direntry = readdir(d);
1766
if(direntry == NULL){
1767
break;
1768
}
1769
/* Skip "." and ".." */
1770
if(direntry->d_name[0] == '.'
1771
and (direntry->d_name[1] == '\0'
1772
or (direntry->d_name[1] == '.'
1773
and direntry->d_name[2] == '\0'))){
1774
continue;
1775
}
1776
char *fullname = NULL;
1777
ret = asprintf(&fullname, "%s/%s", tempdir,
1778
direntry->d_name);
1779
if(ret < 0){
1780
perror("asprintf");
1781
continue;
1782
}
1783
ret = remove(fullname);
1784
if(ret == -1){
1785
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1786
strerror(errno));
1787
}
1788
free(fullname);
1789
}
1790
closedir(d);
1791
}
1792
ret = rmdir(tempdir);
1793
if(ret == -1 and errno != ENOENT){
1794
perror("rmdir");
1795
}
1796
}
1797
1798
if(quit_now){
1799
sigemptyset(&old_sigterm_action.sa_mask);
1800
old_sigterm_action.sa_handler = SIG_DFL;
1801
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1802
&old_sigterm_action,
1803
NULL));
1804
if(ret == -1){
1805
perror("sigaction");
1806
}
1807
do {
1808
ret = raise(signal_received);
1809
} while(ret != 0 and errno == EINTR);
1810
if(ret != 0){
1811
perror("raise");
1812
abort();
1813
}
1814
TEMP_FAILURE_RETRY(pause());
1815
}
1816
1817
return exitcode;
540
541
/* Check wether creating the server object succeeded */
542
if (!server) {
543
fprintf(stderr, "Failed to create server: %s\n", avahi_strerror(error));
544
goto fail;
545
}
546
547
/* Create the service browser */
548
if (!(sb = avahi_s_service_browser_new(server, if_nametoindex("eth0"), AVAHI_PROTO_INET6, "_mandos._tcp", NULL, 0, browse_callback, server))) {
549
fprintf(stderr, "Failed to create service browser: %s\n", avahi_strerror(avahi_server_errno(server)));
550
goto fail;
551
}
552
553
/* Run the main loop */
554
avahi_simple_poll_loop(simple_poll);
555
556
ret = 0;
557
558
fail:
559
560
/* Cleanup things */
561
if (sb)
562
avahi_s_service_browser_free(sb);
563
564
if (server)
565
avahi_server_free(server);
566
567
if (simple_poll)
568
avahi_simple_poll_free(simple_poll);
569
570
return ret;
1818
571
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0