To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 16
- compare with another revision
- download diff
- download tarball
- view history from revision 16
- Committer: Teddy Hogeborn
- Date: 2008-07-21 01:50:31 UTC
- Revision ID: teddy@fukt.bsnet.se-20080721015031-ivjiclli2j06hwgs
* Makefile: Include targets for all binaries.
* plugins.d/Makefile: Do nothing but call the parent Makefile.
* server.py: Added copyright statement and information.
(Client.__init__): Added doc string.
(Client.stop): Bug fix: Only log message if stopping for the first
time. Check if the "stop_initiator_tag" and
"checker_initiator_tag" attributes exist before using
them.
(Client.__del__): Call self.stop() instead of doing things here.
(Client.checker_callback): Set self.checker_callback_tag and
self.checker to None unconditionally and
immediately.
(Client.stop_checker): Added some checks to handle multiple calls.
(tcp_handler.handle): Use "self.server.clients" instead of "clients".
(__main__): Moved all code to the "main" function.
(main): New. New option "--address". Instantiate IPv6_TCPServer
with "options.address". Log before starting main loop.
(main.cleanup) Use "clients.pop()" to remove clients from the set as
they are stopped.
* plugins.d/Makefile: Do nothing but call the parent Makefile.
* server.py: Added copyright statement and information.
(Client.__init__): Added doc string.
(Client.stop): Bug fix: Only log message if stopping for the first
time. Check if the "stop_initiator_tag" and
"checker_initiator_tag" attributes exist before using
them.
(Client.__del__): Call self.stop() instead of doing things here.
(Client.checker_callback): Set self.checker_callback_tag and
self.checker to None unconditionally and
immediately.
(Client.stop_checker): Added some checks to handle multiple calls.
(tcp_handler.handle): Use "self.server.clients" instead of "clients".
(__main__): Moved all code to the "main" function.
(main): New. New option "--address". Instantiate IPv6_TCPServer
with "options.address". Log before starting main loop.
(main.cleanup) Use "clients.pop()" to remove clients from the set as
they are stopped.
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- network-hooks.d
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
1
/* -*- coding: utf-8 -*- */
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
1
/* $Id$ */
2
3
/* PLEASE NOTE *
4
* This file demonstrates how to use Avahi's core API, this is
5
* the embeddable mDNS stack for embedded applications.
4
6
*
5
* This program is partly derived from an example program for an Avahi
6
* service browser, downloaded from
7
* <http://avahi.org/browser/examples/core-browse-services.c>. This
8
* includes the following functions: "resolve_callback",
9
* "browse_callback", and parts of "main".
10
*
11
* Everything else is
12
* Copyright © 2008-2012 Teddy Hogeborn
13
* Copyright © 2008-2012 Björn Påhlsson
14
*
15
* This program is free software: you can redistribute it and/or
16
* modify it under the terms of the GNU General Public License as
17
* published by the Free Software Foundation, either version 3 of the
18
* License, or (at your option) any later version.
19
*
20
* This program is distributed in the hope that it will be useful, but
21
* WITHOUT ANY WARRANTY; without even the implied warranty of
22
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
23
* General Public License for more details.
24
*
25
* You should have received a copy of the GNU General Public License
26
* along with this program. If not, see
27
* <http://www.gnu.org/licenses/>.
28
*
29
* Contact the authors at <mandos@recompile.se>.
7
* End user applications should *not* use this API and should use
8
* the D-Bus or C APIs, please see
9
* client-browse-services.c and glib-integration.c
10
*
11
* I repeat, you probably do *not* want to use this example.
30
12
*/
31
13
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
14
/***
15
This file is part of avahi.
16
17
avahi is free software; you can redistribute it and/or modify it
18
under the terms of the GNU Lesser General Public License as
19
published by the Free Software Foundation; either version 2.1 of the
20
License, or (at your option) any later version.
21
22
avahi is distributed in the hope that it will be useful, but WITHOUT
23
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
24
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
25
Public License for more details.
26
27
You should have received a copy of the GNU Lesser General Public
28
License along with avahi; if not, write to the Free Software
29
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
30
USA.
31
***/
32
34
33
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
34
#define _FILE_OFFSET_BITS 64
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open(), S_ISREG */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno,
66
program_invocation_short_name */
67
#include <time.h> /* nanosleep(), time(), sleep() */
68
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
69
SIOCSIFFLAGS, if_indextoname(),
70
if_nametoindex(), IF_NAMESIZE */
71
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
72
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
73
*/
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
75
getuid(), getgid(), seteuid(),
76
setgid(), pause(), _exit() */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
78
#include <iso646.h> /* not, or, and */
79
#include <argp.h> /* struct argp_option, error_t, struct
80
argp_state, struct argp,
81
argp_parse(), ARGP_KEY_ARG,
82
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
83
#include <signal.h> /* sigemptyset(), sigaddset(),
84
sigaction(), SIGTERM, sig_atomic_t,
85
raise() */
86
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
87
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
89
WEXITSTATUS(), WTERMSIG() */
90
#include <grp.h> /* setgroups() */
91
92
#ifdef __linux__
93
#include <sys/klog.h> /* klogctl() */
94
#endif /* __linux__ */
95
96
/* Avahi */
97
/* All Avahi types, constants and functions
98
Avahi*, avahi_*,
99
AVAHI_* */
35
36
#include <stdio.h>
37
#include <assert.h>
38
#include <stdlib.h>
39
#include <time.h>
40
#include <net/if.h> /* if_nametoindex */
41
100
42
#include <avahi-core/core.h>
101
43
#include <avahi-core/lookup.h>
102
44
#include <avahi-core/log.h>
104
46
#include <avahi-common/malloc.h>
105
47
#include <avahi-common/error.h>
106
48
107
/* GnuTLS */
108
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
109
functions:
110
gnutls_*
111
init_gnutls_session(),
112
GNUTLS_* */
113
#include <gnutls/openpgp.h>
114
/* gnutls_certificate_set_openpgp_key_file(),
115
GNUTLS_OPENPGP_FMT_BASE64 */
116
117
/* GPGME */
118
#include <gpgme.h> /* All GPGME types, constants and
119
functions:
120
gpgme_*
121
GPGME_PROTOCOL_OpenPGP,
122
GPG_ERR_NO_* */
123
49
//mandos client part
50
#include <sys/types.h> /* socket(), setsockopt(), inet_pton() */
51
#include <sys/socket.h> /* socket(), setsockopt(), struct sockaddr_in6, struct in6_addr, inet_pton() */
52
#include <gnutls/gnutls.h> /* ALL GNUTLS STUFF */
53
#include <gnutls/openpgp.h> /* gnutls with openpgp stuff */
54
55
#include <unistd.h> /* close() */
56
#include <netinet/in.h>
57
#include <stdbool.h> /* true */
58
#include <string.h> /* memset */
59
#include <arpa/inet.h> /* inet_pton() */
60
#include <iso646.h> /* not */
61
62
// gpgme
63
#include <errno.h> /* perror() */
64
#include <gpgme.h>
65
66
67
#ifndef CERT_ROOT
68
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
69
#endif
70
#define CERTFILE CERT_ROOT "openpgp-client.txt"
71
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
124
72
#define BUFFER_SIZE 256
125
126
#define PATHDIR "/conf/conf.d/mandos"
127
#define SECKEY "seckey.txt"
128
#define PUBKEY "pubkey.txt"
129
#define HOOKDIR "/lib/mandos/network-hooks.d"
130
131
bool debug = false;
132
static const char mandos_protocol_version[] = "1";
133
const char *argp_program_version = "mandos-client " VERSION;
134
const char *argp_program_bug_address = "<mandos@recompile.se>";
135
static const char sys_class_net[] = "/sys/class/net";
136
char *connect_to = NULL;
137
const char *hookdir = HOOKDIR;
138
uid_t uid = 65534;
139
gid_t gid = 65534;
140
141
/* Doubly linked list that need to be circularly linked when used */
142
typedef struct server{
143
const char *ip;
144
uint16_t port;
145
AvahiIfIndex if_index;
146
int af;
147
struct timespec last_seen;
148
struct server *next;
149
struct server *prev;
150
} server;
151
152
/* Used for passing in values through the Avahi callback functions */
73
#define DH_BITS 1024
74
153
75
typedef struct {
154
AvahiSimplePoll *simple_poll;
155
AvahiServer *server;
76
gnutls_session_t session;
156
77
gnutls_certificate_credentials_t cred;
157
unsigned int dh_bits;
158
78
gnutls_dh_params_t dh_params;
159
const char *priority;
79
} encrypted_session;
80
81
82
ssize_t gpg_packet_decrypt (char *packet, size_t packet_size, char **new_packet, char *homedir){
83
gpgme_data_t dh_crypto, dh_plain;
160
84
gpgme_ctx_t ctx;
161
server *current_server;
162
} mandos_context;
163
164
/* global context so signal handler can reach it*/
165
mandos_context mc = { .simple_poll = NULL, .server = NULL,
166
.dh_bits = 1024, .priority = "SECURE256"
167
":!CTYPE-X.509:+CTYPE-OPENPGP",
168
.current_server = NULL };
169
170
sig_atomic_t quit_now = 0;
171
int signal_received = 0;
172
173
/* Function to use when printing errors */
174
void perror_plus(const char *print_text){
175
int e = errno;
176
fprintf(stderr, "Mandos plugin %s: ",
177
program_invocation_short_name);
178
errno = e;
179
perror(print_text);
180
}
181
182
__attribute__((format (gnu_printf, 2, 3)))
183
int fprintf_plus(FILE *stream, const char *format, ...){
184
va_list ap;
185
va_start (ap, format);
186
187
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
188
program_invocation_short_name));
189
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
190
}
191
192
/*
193
* Make additional room in "buffer" for at least BUFFER_SIZE more
194
* bytes. "buffer_capacity" is how much is currently allocated,
195
* "buffer_length" is how much is already used.
196
*/
197
size_t incbuffer(char **buffer, size_t buffer_length,
198
size_t buffer_capacity){
199
if(buffer_length + BUFFER_SIZE > buffer_capacity){
200
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
201
if(buffer == NULL){
202
return 0;
203
}
204
buffer_capacity += BUFFER_SIZE;
205
}
206
return buffer_capacity;
207
}
208
209
/* Add server to set of servers to retry periodically */
210
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
211
int af){
212
int ret;
213
server *new_server = malloc(sizeof(server));
214
if(new_server == NULL){
215
perror_plus("malloc");
216
return false;
217
}
218
*new_server = (server){ .ip = strdup(ip),
219
.port = port,
220
.if_index = if_index,
221
.af = af };
222
if(new_server->ip == NULL){
223
perror_plus("strdup");
224
return false;
225
}
226
/* Special case of first server */
227
if (mc.current_server == NULL){
228
new_server->next = new_server;
229
new_server->prev = new_server;
230
mc.current_server = new_server;
231
/* Place the new server last in the list */
232
} else {
233
new_server->next = mc.current_server;
234
new_server->prev = mc.current_server->prev;
235
new_server->prev->next = new_server;
236
mc.current_server->prev = new_server;
237
}
238
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
239
if(ret == -1){
240
perror_plus("clock_gettime");
241
return false;
242
}
243
return true;
244
}
245
246
/*
247
* Initialize GPGME.
248
*/
249
static bool init_gpgme(const char *seckey, const char *pubkey,
250
const char *tempdir){
251
85
gpgme_error_t rc;
86
ssize_t ret;
87
size_t new_packet_capacity = 0;
88
size_t new_packet_length = 0;
252
89
gpgme_engine_info_t engine_info;
253
254
255
/*
256
* Helper function to insert pub and seckey to the engine keyring.
257
*/
258
bool import_key(const char *filename){
259
int ret;
260
int fd;
261
gpgme_data_t pgp_data;
262
263
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
264
if(fd == -1){
265
perror_plus("open");
266
return false;
267
}
268
269
rc = gpgme_data_new_from_fd(&pgp_data, fd);
270
if(rc != GPG_ERR_NO_ERROR){
271
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
272
gpgme_strsource(rc), gpgme_strerror(rc));
273
return false;
274
}
275
276
rc = gpgme_op_import(mc.ctx, pgp_data);
277
if(rc != GPG_ERR_NO_ERROR){
278
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
279
gpgme_strsource(rc), gpgme_strerror(rc));
280
return false;
281
}
282
283
ret = (int)TEMP_FAILURE_RETRY(close(fd));
284
if(ret == -1){
285
perror_plus("close");
286
}
287
gpgme_data_release(pgp_data);
288
return true;
289
}
290
291
if(debug){
292
fprintf_plus(stderr, "Initializing GPGME\n");
293
}
294
90
295
91
/* Init GPGME */
296
92
gpgme_check_version(NULL);
297
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
298
if(rc != GPG_ERR_NO_ERROR){
299
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
300
gpgme_strsource(rc), gpgme_strerror(rc));
301
return false;
302
}
93
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
303
94
304
/* Set GPGME home directory for the OpenPGP engine only */
305
rc = gpgme_get_engine_info(&engine_info);
306
if(rc != GPG_ERR_NO_ERROR){
307
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
308
gpgme_strsource(rc), gpgme_strerror(rc));
309
return false;
95
/* Set GPGME home directory */
96
rc = gpgme_get_engine_info (&engine_info);
97
if (rc != GPG_ERR_NO_ERROR){
98
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
99
gpgme_strsource(rc), gpgme_strerror(rc));
100
return -1;
310
101
}
311
102
while(engine_info != NULL){
312
103
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
313
104
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
314
engine_info->file_name, tempdir);
105
engine_info->file_name, homedir);
315
106
break;
316
107
}
317
108
engine_info = engine_info->next;
318
109
}
319
110
if(engine_info == NULL){
320
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
321
tempdir);
322
return false;
323
}
324
325
/* Create new GPGME "context" */
326
rc = gpgme_new(&(mc.ctx));
327
if(rc != GPG_ERR_NO_ERROR){
328
fprintf_plus(stderr, "Mandos plugin mandos-client: "
329
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
330
gpgme_strerror(rc));
331
return false;
332
}
333
334
if(not import_key(pubkey) or not import_key(seckey)){
335
return false;
336
}
337
338
return true;
339
}
340
341
/*
342
* Decrypt OpenPGP data.
343
* Returns -1 on error
344
*/
345
static ssize_t pgp_packet_decrypt(const char *cryptotext,
346
size_t crypto_size,
347
char **plaintext){
348
gpgme_data_t dh_crypto, dh_plain;
349
gpgme_error_t rc;
350
ssize_t ret;
351
size_t plaintext_capacity = 0;
352
ssize_t plaintext_length = 0;
353
354
if(debug){
355
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
356
}
357
358
/* Create new GPGME data buffer from memory cryptotext */
359
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
360
0);
361
if(rc != GPG_ERR_NO_ERROR){
362
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
363
gpgme_strsource(rc), gpgme_strerror(rc));
111
fprintf(stderr, "Could not set home dir to %s\n", homedir);
112
return -1;
113
}
114
115
/* Create new GPGME data buffer from packet buffer */
116
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
117
if (rc != GPG_ERR_NO_ERROR){
118
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
119
gpgme_strsource(rc), gpgme_strerror(rc));
364
120
return -1;
365
121
}
366
122
367
123
/* Create new empty GPGME data buffer for the plaintext */
368
124
rc = gpgme_data_new(&dh_plain);
369
if(rc != GPG_ERR_NO_ERROR){
370
fprintf_plus(stderr, "Mandos plugin mandos-client: "
371
"bad gpgme_data_new: %s: %s\n",
372
gpgme_strsource(rc), gpgme_strerror(rc));
373
gpgme_data_release(dh_crypto);
374
return -1;
375
}
376
377
/* Decrypt data from the cryptotext data buffer to the plaintext
378
data buffer */
379
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
380
if(rc != GPG_ERR_NO_ERROR){
381
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
382
gpgme_strsource(rc), gpgme_strerror(rc));
383
plaintext_length = -1;
384
if(debug){
385
gpgme_decrypt_result_t result;
386
result = gpgme_op_decrypt_result(mc.ctx);
387
if(result == NULL){
388
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
389
} else {
390
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
391
result->unsupported_algorithm);
392
fprintf_plus(stderr, "Wrong key usage: %u\n",
393
result->wrong_key_usage);
394
if(result->file_name != NULL){
395
fprintf_plus(stderr, "File name: %s\n", result->file_name);
396
}
397
gpgme_recipient_t recipient;
398
recipient = result->recipients;
399
while(recipient != NULL){
400
fprintf_plus(stderr, "Public key algorithm: %s\n",
401
gpgme_pubkey_algo_name
402
(recipient->pubkey_algo));
403
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
404
fprintf_plus(stderr, "Secret key available: %s\n",
405
recipient->status == GPG_ERR_NO_SECKEY
406
? "No" : "Yes");
407
recipient = recipient->next;
408
}
409
}
410
}
411
goto decrypt_end;
412
}
413
414
if(debug){
415
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
416
}
125
if (rc != GPG_ERR_NO_ERROR){
126
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
127
gpgme_strsource(rc), gpgme_strerror(rc));
128
return -1;
129
}
130
131
/* Create new GPGME "context" */
132
rc = gpgme_new(&ctx);
133
if (rc != GPG_ERR_NO_ERROR){
134
fprintf(stderr, "bad gpgme_new: %s: %s\n",
135
gpgme_strsource(rc), gpgme_strerror(rc));
136
return -1;
137
}
138
139
/* Decrypt data from the FILE pointer to the plaintext data buffer */
140
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
141
if (rc != GPG_ERR_NO_ERROR){
142
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
143
gpgme_strsource(rc), gpgme_strerror(rc));
144
return -1;
145
}
146
147
/* gpgme_decrypt_result_t result; */
148
/* result = gpgme_op_decrypt_result(ctx); */
149
/* fprintf(stderr, "Unsupported algorithm: %s\n", result->unsupported_algorithm); */
150
/* fprintf(stderr, "Wrong key usage: %d\n", result->wrong_key_usage); */
151
/* if(result->file_name != NULL){ */
152
/* fprintf(stderr, "File name: %s\n", result->file_name); */
153
/* } */
154
/* gpgme_recipient_t recipient; */
155
/* recipient = result->recipients; */
156
/* if(recipient){ */
157
/* while(recipient != NULL){ */
158
/* fprintf(stderr, "Public key algorithm: %s\n", */
159
/* gpgme_pubkey_algo_name(recipient->pubkey_algo)); */
160
/* fprintf(stderr, "Key ID: %s\n", recipient->keyid); */
161
/* fprintf(stderr, "Secret key available: %s\n", */
162
/* recipient->status == GPG_ERR_NO_SECKEY ? "No" : "Yes"); */
163
/* recipient = recipient->next; */
164
/* } */
165
/* } */
166
167
/* Delete the GPGME FILE pointer cryptotext data buffer */
168
gpgme_data_release(dh_crypto);
417
169
418
170
/* Seek back to the beginning of the GPGME plaintext data buffer */
419
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
420
perror_plus("gpgme_data_seek");
421
plaintext_length = -1;
422
goto decrypt_end;
423
}
424
425
*plaintext = NULL;
171
gpgme_data_seek(dh_plain, 0, SEEK_SET);
172
173
*new_packet = 0;
426
174
while(true){
427
plaintext_capacity = incbuffer(plaintext,
428
(size_t)plaintext_length,
429
plaintext_capacity);
430
if(plaintext_capacity == 0){
431
perror_plus("incbuffer");
432
plaintext_length = -1;
433
goto decrypt_end;
175
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
176
*new_packet = realloc(*new_packet, new_packet_capacity + BUFFER_SIZE);
177
if (*new_packet == NULL){
178
perror("realloc");
179
return -1;
180
}
181
new_packet_capacity += BUFFER_SIZE;
434
182
}
435
183
436
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
437
BUFFER_SIZE);
184
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length, BUFFER_SIZE);
438
185
/* Print the data, if any */
439
if(ret == 0){
440
/* EOF */
186
if (ret == 0){
187
/* If password is empty, then a incorrect error will be printed */
441
188
break;
442
189
}
443
190
if(ret < 0){
444
perror_plus("gpgme_data_read");
445
plaintext_length = -1;
446
goto decrypt_end;
447
}
448
plaintext_length += ret;
449
}
450
451
if(debug){
452
fprintf_plus(stderr, "Decrypted password is: ");
453
for(ssize_t i = 0; i < plaintext_length; i++){
454
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
455
}
456
fprintf(stderr, "\n");
457
}
458
459
decrypt_end:
460
461
/* Delete the GPGME cryptotext data buffer */
462
gpgme_data_release(dh_crypto);
463
464
/* Delete the GPGME plaintext data buffer */
191
perror("gpgme_data_read");
192
return -1;
193
}
194
new_packet_length += ret;
195
}
196
197
/* Delete the GPGME plaintext data buffer */
465
198
gpgme_data_release(dh_plain);
466
return plaintext_length;
199
return new_packet_length;
467
200
}
468
201
469
static const char * safer_gnutls_strerror(int value){
470
const char *ret = gnutls_strerror(value); /* Spurious warning from
471
-Wunreachable-code */
472
if(ret == NULL)
202
static const char * safer_gnutls_strerror (int value) {
203
const char *ret = gnutls_strerror (value);
204
if (ret == NULL)
473
205
ret = "(unknown)";
474
206
return ret;
475
207
}
476
208
477
/* GnuTLS log function callback */
478
static void debuggnutls(__attribute__((unused)) int level,
479
const char* string){
480
fprintf_plus(stderr, "GnuTLS: %s", string);
209
void debuggnutls(int level, const char* string){
210
fprintf(stderr, "%s", string);
481
211
}
482
212
483
static int init_gnutls_global(const char *pubkeyfilename,
484
const char *seckeyfilename){
213
int initgnutls(encrypted_session *es){
214
const char *err;
485
215
int ret;
486
216
487
if(debug){
488
fprintf_plus(stderr, "Initializing GnuTLS\n");
489
}
490
491
ret = gnutls_global_init();
492
if(ret != GNUTLS_E_SUCCESS){
493
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
494
safer_gnutls_strerror(ret));
495
return -1;
496
}
497
498
if(debug){
499
/* "Use a log level over 10 to enable all debugging options."
500
* - GnuTLS manual
501
*/
502
gnutls_global_set_log_level(11);
503
gnutls_global_set_log_function(debuggnutls);
504
}
505
506
/* OpenPGP credentials */
507
ret = gnutls_certificate_allocate_credentials(&mc.cred);
508
if(ret != GNUTLS_E_SUCCESS){
509
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
510
safer_gnutls_strerror(ret));
511
gnutls_global_deinit();
512
return -1;
513
}
514
515
if(debug){
516
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
517
" secret key %s as GnuTLS credentials\n",
518
pubkeyfilename,
519
seckeyfilename);
520
}
521
217
if ((ret = gnutls_global_init ())
218
!= GNUTLS_E_SUCCESS) {
219
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
220
return -1;
221
}
222
223
/* Uncomment to enable full debuggin on the gnutls library */
224
/* gnutls_global_set_log_level(11); */
225
/* gnutls_global_set_log_function(debuggnutls); */
226
227
228
/* openpgp credentials */
229
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
230
!= GNUTLS_E_SUCCESS) {
231
fprintf (stderr, "memory error: %s\n", safer_gnutls_strerror(ret));
232
return -1;
233
}
234
522
235
ret = gnutls_certificate_set_openpgp_key_file
523
(mc.cred, pubkeyfilename, seckeyfilename,
524
GNUTLS_OPENPGP_FMT_BASE64);
525
if(ret != GNUTLS_E_SUCCESS){
526
fprintf_plus(stderr,
527
"Error[%d] while reading the OpenPGP key pair ('%s',"
528
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
529
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
530
safer_gnutls_strerror(ret));
531
goto globalfail;
532
}
533
534
/* GnuTLS server initialization */
535
ret = gnutls_dh_params_init(&mc.dh_params);
536
if(ret != GNUTLS_E_SUCCESS){
537
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
538
" initialization: %s\n",
539
safer_gnutls_strerror(ret));
540
goto globalfail;
541
}
542
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
543
if(ret != GNUTLS_E_SUCCESS){
544
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
545
safer_gnutls_strerror(ret));
546
goto globalfail;
547
}
548
549
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
550
551
return 0;
552
553
globalfail:
554
555
gnutls_certificate_free_credentials(mc.cred);
556
gnutls_global_deinit();
557
gnutls_dh_params_deinit(mc.dh_params);
558
return -1;
559
}
560
561
static int init_gnutls_session(gnutls_session_t *session){
562
int ret;
563
/* GnuTLS session creation */
564
do {
565
ret = gnutls_init(session, GNUTLS_SERVER);
566
if(quit_now){
567
return -1;
568
}
569
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
570
if(ret != GNUTLS_E_SUCCESS){
571
fprintf_plus(stderr,
572
"Error in GnuTLS session initialization: %s\n",
573
safer_gnutls_strerror(ret));
574
}
575
576
{
577
const char *err;
578
do {
579
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
580
if(quit_now){
581
gnutls_deinit(*session);
582
return -1;
583
}
584
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
585
if(ret != GNUTLS_E_SUCCESS){
586
fprintf_plus(stderr, "Syntax error at: %s\n", err);
587
fprintf_plus(stderr, "GnuTLS error: %s\n",
588
safer_gnutls_strerror(ret));
589
gnutls_deinit(*session);
590
return -1;
591
}
592
}
593
594
do {
595
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
596
mc.cred);
597
if(quit_now){
598
gnutls_deinit(*session);
599
return -1;
600
}
601
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
602
if(ret != GNUTLS_E_SUCCESS){
603
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
604
safer_gnutls_strerror(ret));
605
gnutls_deinit(*session);
606
return -1;
607
}
608
236
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
237
if (ret != GNUTLS_E_SUCCESS) {
238
fprintf
239
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s', '%s')\n",
240
ret, CERTFILE, KEYFILE);
241
fprintf(stdout, "The Error is: %s\n",
242
safer_gnutls_strerror(ret));
243
return -1;
244
}
245
246
//Gnutls server initialization
247
if ((ret = gnutls_dh_params_init (&es->dh_params))
248
!= GNUTLS_E_SUCCESS) {
249
fprintf (stderr, "Error in dh parameter initialization: %s\n",
250
safer_gnutls_strerror(ret));
251
return -1;
252
}
253
254
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
255
!= GNUTLS_E_SUCCESS) {
256
fprintf (stderr, "Error in prime generation: %s\n",
257
safer_gnutls_strerror(ret));
258
return -1;
259
}
260
261
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
262
263
// Gnutls session creation
264
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
265
!= GNUTLS_E_SUCCESS){
266
fprintf(stderr, "Error in gnutls session initialization: %s\n",
267
safer_gnutls_strerror(ret));
268
}
269
270
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
271
!= GNUTLS_E_SUCCESS) {
272
fprintf(stderr, "Syntax error at: %s\n", err);
273
fprintf(stderr, "Gnutls error: %s\n",
274
safer_gnutls_strerror(ret));
275
return -1;
276
}
277
278
if ((ret = gnutls_credentials_set
279
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
280
!= GNUTLS_E_SUCCESS) {
281
fprintf(stderr, "Error setting a credentials set: %s\n",
282
safer_gnutls_strerror(ret));
283
return -1;
284
}
285
609
286
/* ignore client certificate if any. */
610
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
287
gnutls_certificate_server_set_request (es->session, GNUTLS_CERT_IGNORE);
611
288
612
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
289
gnutls_dh_set_prime_bits (es->session, DH_BITS);
613
290
614
291
return 0;
615
292
}
616
293
617
/* Avahi log function callback */
618
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
619
__attribute__((unused)) const char *txt){}
294
void empty_log(AvahiLogLevel level, const char *txt){}
620
295
621
/* Called when a Mandos server is found */
622
static int start_mandos_communication(const char *ip, uint16_t port,
623
AvahiIfIndex if_index,
624
int af){
625
int ret, tcp_sd = -1;
626
ssize_t sret;
627
union {
628
struct sockaddr_in in;
629
struct sockaddr_in6 in6;
630
} to;
296
int start_mandos_communcation(char *ip, uint16_t port){
297
int ret, tcp_sd;
298
struct sockaddr_in6 to;
299
struct in6_addr ip_addr;
300
encrypted_session es;
631
301
char *buffer = NULL;
632
char *decrypted_buffer = NULL;
302
char *decrypted_buffer;
633
303
size_t buffer_length = 0;
634
304
size_t buffer_capacity = 0;
635
size_t written;
636
int retval = -1;
637
gnutls_session_t session;
638
int pf; /* Protocol family */
639
640
errno = 0;
641
642
if(quit_now){
643
errno = EINTR;
644
return -1;
645
}
646
647
switch(af){
648
case AF_INET6:
649
pf = PF_INET6;
650
break;
651
case AF_INET:
652
pf = PF_INET;
653
break;
654
default:
655
fprintf_plus(stderr, "Bad address family: %d\n", af);
656
errno = EINVAL;
657
return -1;
658
}
659
660
ret = init_gnutls_session(&session);
661
if(ret != 0){
662
return -1;
663
}
664
665
if(debug){
666
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
667
PRIu16 "\n", ip, port);
668
}
669
670
tcp_sd = socket(pf, SOCK_STREAM, 0);
671
if(tcp_sd < 0){
672
int e = errno;
673
perror_plus("socket");
674
errno = e;
675
goto mandos_end;
676
}
677
678
if(quit_now){
679
errno = EINTR;
680
goto mandos_end;
681
}
682
683
memset(&to, 0, sizeof(to));
684
if(af == AF_INET6){
685
to.in6.sin6_family = (sa_family_t)af;
686
ret = inet_pton(af, ip, &to.in6.sin6_addr);
687
} else { /* IPv4 */
688
to.in.sin_family = (sa_family_t)af;
689
ret = inet_pton(af, ip, &to.in.sin_addr);
690
}
691
if(ret < 0 ){
692
int e = errno;
693
perror_plus("inet_pton");
694
errno = e;
695
goto mandos_end;
696
}
305
ssize_t decrypted_buffer_size;
306
int retval = 0;
307
308
309
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
310
if(tcp_sd < 0) {
311
perror("socket");
312
return -1;
313
}
314
315
ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, "eth0", 5);
316
if(tcp_sd < 0) {
317
perror("setsockopt bindtodevice");
318
return -1;
319
}
320
321
memset(&to,0,sizeof(to));
322
to.sin6_family = AF_INET6;
323
ret = inet_pton(AF_INET6, ip, &ip_addr);
324
if (ret < 0 ){
325
perror("inet_pton");
326
return -1;
327
}
697
328
if(ret == 0){
698
int e = errno;
699
fprintf_plus(stderr, "Bad address: %s\n", ip);
700
errno = e;
701
goto mandos_end;
702
}
703
if(af == AF_INET6){
704
to.in6.sin6_port = htons(port); /* Spurious warnings from
705
-Wconversion and
706
-Wunreachable-code */
707
708
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
709
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
710
-Wunreachable-code*/
711
if(if_index == AVAHI_IF_UNSPEC){
712
fprintf_plus(stderr, "An IPv6 link-local address is"
713
" incomplete without a network interface\n");
714
errno = EINVAL;
715
goto mandos_end;
716
}
717
/* Set the network interface number as scope */
718
to.in6.sin6_scope_id = (uint32_t)if_index;
719
}
720
} else {
721
to.in.sin_port = htons(port); /* Spurious warnings from
722
-Wconversion and
723
-Wunreachable-code */
724
}
725
726
if(quit_now){
727
errno = EINTR;
728
goto mandos_end;
729
}
730
731
if(debug){
732
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
733
char interface[IF_NAMESIZE];
734
if(if_indextoname((unsigned int)if_index, interface) == NULL){
735
perror_plus("if_indextoname");
736
} else {
737
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
738
"\n", ip, interface, port);
739
}
740
} else {
741
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
742
ip, port);
743
}
744
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
745
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
746
const char *pcret;
747
if(af == AF_INET6){
748
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
749
sizeof(addrstr));
750
} else {
751
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
752
sizeof(addrstr));
753
}
754
if(pcret == NULL){
755
perror_plus("inet_ntop");
756
} else {
757
if(strcmp(addrstr, ip) != 0){
758
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
759
}
760
}
761
}
762
763
if(quit_now){
764
errno = EINTR;
765
goto mandos_end;
766
}
767
768
if(af == AF_INET6){
769
ret = connect(tcp_sd, &to.in6, sizeof(to));
770
} else {
771
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
772
}
773
if(ret < 0){
774
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
775
int e = errno;
776
perror_plus("connect");
777
errno = e;
778
}
779
goto mandos_end;
780
}
781
782
if(quit_now){
783
errno = EINTR;
784
goto mandos_end;
785
}
786
787
const char *out = mandos_protocol_version;
788
written = 0;
789
while(true){
790
size_t out_size = strlen(out);
791
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
792
out_size - written));
793
if(ret == -1){
794
int e = errno;
795
perror_plus("write");
796
errno = e;
797
goto mandos_end;
798
}
799
written += (size_t)ret;
800
if(written < out_size){
801
continue;
802
} else {
803
if(out == mandos_protocol_version){
804
written = 0;
805
out = "\r\n";
806
} else {
807
break;
808
}
809
}
810
811
if(quit_now){
812
errno = EINTR;
813
goto mandos_end;
814
}
815
}
816
817
if(debug){
818
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
819
}
820
821
if(quit_now){
822
errno = EINTR;
823
goto mandos_end;
824
}
825
826
/* This casting via intptr_t is to eliminate warning about casting
827
an int to a pointer type. This is exactly how the GnuTLS Guile
828
function "set-session-transport-fd!" does it. */
829
gnutls_transport_set_ptr(session,
830
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
831
832
if(quit_now){
833
errno = EINTR;
834
goto mandos_end;
835
}
836
837
do {
838
ret = gnutls_handshake(session);
839
if(quit_now){
840
errno = EINTR;
841
goto mandos_end;
842
}
843
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
844
845
if(ret != GNUTLS_E_SUCCESS){
846
if(debug){
847
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
848
gnutls_perror(ret);
849
}
850
errno = EPROTO;
851
goto mandos_end;
852
}
853
854
/* Read OpenPGP packet that contains the wanted password */
855
856
if(debug){
857
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
858
" %s\n", ip);
859
}
860
861
while(true){
862
863
if(quit_now){
864
errno = EINTR;
865
goto mandos_end;
866
}
867
868
buffer_capacity = incbuffer(&buffer, buffer_length,
869
buffer_capacity);
870
if(buffer_capacity == 0){
871
int e = errno;
872
perror_plus("incbuffer");
873
errno = e;
874
goto mandos_end;
875
}
876
877
if(quit_now){
878
errno = EINTR;
879
goto mandos_end;
880
}
881
882
sret = gnutls_record_recv(session, buffer+buffer_length,
883
BUFFER_SIZE);
884
if(sret == 0){
329
fprintf(stderr, "Bad address: %s\n", ip);
330
return -1;
331
}
332
to.sin6_port = htons(port);
333
to.sin6_scope_id = if_nametoindex("eth0");
334
335
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
336
if (ret < 0){
337
perror("connect");
338
return -1;
339
}
340
341
ret = initgnutls (&es);
342
if (ret != 0){
343
retval = -1;
344
return -1;
345
}
346
347
348
gnutls_transport_set_ptr (es.session, (gnutls_transport_ptr_t) tcp_sd);
349
350
ret = gnutls_handshake (es.session);
351
352
if (ret != GNUTLS_E_SUCCESS){
353
fprintf(stderr, "\n*** Handshake failed ***\n");
354
gnutls_perror (ret);
355
retval = -1;
356
goto exit;
357
}
358
359
//retrive password
360
while(true){
361
if (buffer_length + BUFFER_SIZE > buffer_capacity){
362
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
363
if (buffer == NULL){
364
perror("realloc");
365
goto exit;
366
}
367
buffer_capacity += BUFFER_SIZE;
368
}
369
370
ret = gnutls_record_recv
371
(es.session, buffer+buffer_length, BUFFER_SIZE);
372
if (ret == 0){
885
373
break;
886
374
}
887
if(sret < 0){
888
switch(sret){
375
if (ret < 0){
376
switch(ret){
889
377
case GNUTLS_E_INTERRUPTED:
890
378
case GNUTLS_E_AGAIN:
891
379
break;
892
380
case GNUTLS_E_REHANDSHAKE:
893
do {
894
ret = gnutls_handshake(session);
895
896
if(quit_now){
897
errno = EINTR;
898
goto mandos_end;
899
}
900
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
901
if(ret < 0){
902
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
903
"***\n");
904
gnutls_perror(ret);
905
errno = EPROTO;
906
goto mandos_end;
381
ret = gnutls_handshake (es.session);
382
if (ret < 0){
383
fprintf(stderr, "\n*** Handshake failed ***\n");
384
gnutls_perror (ret);
385
retval = -1;
386
goto exit;
907
387
}
908
388
break;
909
389
default:
910
fprintf_plus(stderr, "Unknown error while reading data from"
911
" encrypted session with Mandos server\n");
912
gnutls_bye(session, GNUTLS_SHUT_RDWR);
913
errno = EIO;
914
goto mandos_end;
390
fprintf(stderr, "Unknown error while reading data from encrypted session with mandos server\n");
391
retval = -1;
392
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
393
goto exit;
915
394
}
916
395
} else {
917
buffer_length += (size_t) sret;
918
}
919
}
920
921
if(debug){
922
fprintf_plus(stderr, "Closing TLS session\n");
923
}
924
925
if(quit_now){
926
errno = EINTR;
927
goto mandos_end;
928
}
929
930
do {
931
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
932
if(quit_now){
933
errno = EINTR;
934
goto mandos_end;
935
}
936
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
937
938
if(buffer_length > 0){
939
ssize_t decrypted_buffer_size;
940
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
941
&decrypted_buffer);
942
if(decrypted_buffer_size >= 0){
943
944
written = 0;
945
while(written < (size_t) decrypted_buffer_size){
946
if(quit_now){
947
errno = EINTR;
948
goto mandos_end;
949
}
950
951
ret = (int)fwrite(decrypted_buffer + written, 1,
952
(size_t)decrypted_buffer_size - written,
953
stdout);
954
if(ret == 0 and ferror(stdout)){
955
int e = errno;
956
if(debug){
957
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
958
strerror(errno));
959
}
960
errno = e;
961
goto mandos_end;
962
}
963
written += (size_t)ret;
964
}
965
retval = 0;
966
}
967
}
968
969
/* Shutdown procedure */
970
971
mandos_end:
972
{
973
int e = errno;
974
free(decrypted_buffer);
975
free(buffer);
976
if(tcp_sd >= 0){
977
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
978
}
979
if(ret == -1){
980
if(e == 0){
981
e = errno;
982
}
983
perror_plus("close");
984
}
985
gnutls_deinit(session);
986
errno = e;
987
if(quit_now){
988
errno = EINTR;
396
buffer_length += ret;
397
}
398
}
399
400
if (buffer_length > 0){
401
if ((decrypted_buffer_size = gpg_packet_decrypt(buffer, buffer_length, &decrypted_buffer, CERT_ROOT)) == 0){
989
402
retval = -1;
403
} else {
404
fwrite (decrypted_buffer, 1, decrypted_buffer_size, stdout);
405
free(decrypted_buffer);
990
406
}
991
407
}
408
409
free(buffer);
410
411
//shutdown procedure
412
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
413
exit:
414
close(tcp_sd);
415
gnutls_deinit (es.session);
416
gnutls_certificate_free_credentials (es.cred);
417
gnutls_global_deinit ();
992
418
return retval;
993
419
}
994
420
995
static void resolve_callback(AvahiSServiceResolver *r,
996
AvahiIfIndex interface,
997
AvahiProtocol proto,
998
AvahiResolverEvent event,
999
const char *name,
1000
const char *type,
1001
const char *domain,
1002
const char *host_name,
1003
const AvahiAddress *address,
1004
uint16_t port,
1005
AVAHI_GCC_UNUSED AvahiStringList *txt,
1006
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1007
flags,
1008
AVAHI_GCC_UNUSED void* userdata){
1009
assert(r);
1010
1011
/* Called whenever a service has been resolved successfully or
1012
timed out */
1013
1014
if(quit_now){
1015
return;
1016
}
1017
1018
switch(event){
1019
default:
1020
case AVAHI_RESOLVER_FAILURE:
1021
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1022
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1023
domain,
1024
avahi_strerror(avahi_server_errno(mc.server)));
1025
break;
1026
1027
case AVAHI_RESOLVER_FOUND:
1028
{
1029
char ip[AVAHI_ADDRESS_STR_MAX];
1030
avahi_address_snprint(ip, sizeof(ip), address);
1031
if(debug){
1032
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1033
PRIdMAX ") on port %" PRIu16 "\n", name,
1034
host_name, ip, (intmax_t)interface, port);
1035
}
1036
int ret = start_mandos_communication(ip, port, interface,
1037
avahi_proto_to_af(proto));
1038
if(ret == 0){
1039
avahi_simple_poll_quit(mc.simple_poll);
1040
} else {
1041
if(not add_server(ip, port, interface,
1042
avahi_proto_to_af(proto))){
1043
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1044
" list\n", name);
1045
}
1046
}
1047
}
1048
}
1049
avahi_s_service_resolver_free(r);
1050
}
1051
1052
static void browse_callback(AvahiSServiceBrowser *b,
1053
AvahiIfIndex interface,
1054
AvahiProtocol protocol,
1055
AvahiBrowserEvent event,
1056
const char *name,
1057
const char *type,
1058
const char *domain,
1059
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1060
flags,
1061
AVAHI_GCC_UNUSED void* userdata){
1062
assert(b);
1063
1064
/* Called whenever a new services becomes available on the LAN or
1065
is removed from the LAN */
1066
1067
if(quit_now){
1068
return;
1069
}
1070
1071
switch(event){
1072
default:
1073
case AVAHI_BROWSER_FAILURE:
1074
1075
fprintf_plus(stderr, "(Avahi browser) %s\n",
1076
avahi_strerror(avahi_server_errno(mc.server)));
1077
avahi_simple_poll_quit(mc.simple_poll);
1078
return;
1079
1080
case AVAHI_BROWSER_NEW:
1081
/* We ignore the returned Avahi resolver object. In the callback
1082
function we free it. If the Avahi server is terminated before
1083
the callback function is called the Avahi server will free the
1084
resolver for us. */
1085
1086
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1087
name, type, domain, protocol, 0,
1088
resolve_callback, NULL) == NULL)
1089
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1090
" %s\n", name,
1091
avahi_strerror(avahi_server_errno(mc.server)));
1092
break;
1093
1094
case AVAHI_BROWSER_REMOVE:
1095
break;
1096
1097
case AVAHI_BROWSER_ALL_FOR_NOW:
1098
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1099
if(debug){
1100
fprintf_plus(stderr, "No Mandos server found, still"
1101
" searching...\n");
1102
}
1103
break;
1104
}
1105
}
1106
1107
/* Signal handler that stops main loop after SIGTERM */
1108
static void handle_sigterm(int sig){
1109
if(quit_now){
1110
return;
1111
}
1112
quit_now = 1;
1113
signal_received = sig;
1114
int old_errno = errno;
1115
/* set main loop to exit */
1116
if(mc.simple_poll != NULL){
1117
avahi_simple_poll_quit(mc.simple_poll);
1118
}
1119
errno = old_errno;
1120
}
1121
1122
bool get_flags(const char *ifname, struct ifreq *ifr){
1123
int ret;
1124
1125
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1126
if(s < 0){
1127
perror_plus("socket");
1128
return false;
1129
}
1130
strcpy(ifr->ifr_name, ifname);
1131
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1132
if(ret == -1){
1133
if(debug){
1134
perror_plus("ioctl SIOCGIFFLAGS");
1135
}
1136
return false;
1137
}
1138
return true;
1139
}
1140
1141
bool good_flags(const char *ifname, const struct ifreq *ifr){
1142
1143
/* Reject the loopback device */
1144
if(ifr->ifr_flags & IFF_LOOPBACK){
1145
if(debug){
1146
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1147
ifname);
1148
}
1149
return false;
1150
}
1151
/* Accept point-to-point devices only if connect_to is specified */
1152
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1153
if(debug){
1154
fprintf_plus(stderr, "Accepting point-to-point interface"
1155
" \"%s\"\n", ifname);
1156
}
1157
return true;
1158
}
1159
/* Otherwise, reject non-broadcast-capable devices */
1160
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1161
if(debug){
1162
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1163
" \"%s\"\n", ifname);
1164
}
1165
return false;
1166
}
1167
/* Reject non-ARP interfaces (including dummy interfaces) */
1168
if(ifr->ifr_flags & IFF_NOARP){
1169
if(debug){
1170
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1171
ifname);
1172
}
1173
return false;
1174
}
1175
1176
/* Accept this device */
1177
if(debug){
1178
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1179
}
1180
return true;
1181
}
1182
1183
/*
1184
* This function determines if a directory entry in /sys/class/net
1185
* corresponds to an acceptable network device.
1186
* (This function is passed to scandir(3) as a filter function.)
1187
*/
1188
int good_interface(const struct dirent *if_entry){
1189
if(if_entry->d_name[0] == '.'){
1190
return 0;
1191
}
1192
1193
struct ifreq ifr;
1194
if(not get_flags(if_entry->d_name, &ifr)){
1195
if(debug){
1196
fprintf_plus(stderr, "Failed to get flags for interface "
1197
"\"%s\"\n", if_entry->d_name);
1198
}
1199
return 0;
1200
}
1201
1202
if(not good_flags(if_entry->d_name, &ifr)){
1203
return 0;
1204
}
1205
return 1;
1206
}
1207
1208
/*
1209
* This function determines if a directory entry in /sys/class/net
1210
* corresponds to an acceptable network device which is up.
1211
* (This function is passed to scandir(3) as a filter function.)
1212
*/
1213
int up_interface(const struct dirent *if_entry){
1214
if(if_entry->d_name[0] == '.'){
1215
return 0;
1216
}
1217
1218
struct ifreq ifr;
1219
if(not get_flags(if_entry->d_name, &ifr)){
1220
if(debug){
1221
fprintf_plus(stderr, "Failed to get flags for interface "
1222
"\"%s\"\n", if_entry->d_name);
1223
}
1224
return 0;
1225
}
1226
1227
/* Reject down interfaces */
1228
if(not (ifr.ifr_flags & IFF_UP)){
1229
if(debug){
1230
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1231
if_entry->d_name);
1232
}
1233
return 0;
1234
}
1235
1236
/* Reject non-running interfaces */
1237
if(not (ifr.ifr_flags & IFF_RUNNING)){
1238
if(debug){
1239
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1240
if_entry->d_name);
1241
}
1242
return 0;
1243
}
1244
1245
if(not good_flags(if_entry->d_name, &ifr)){
1246
return 0;
1247
}
1248
return 1;
1249
}
1250
1251
int notdotentries(const struct dirent *direntry){
1252
/* Skip "." and ".." */
1253
if(direntry->d_name[0] == '.'
1254
and (direntry->d_name[1] == '\0'
1255
or (direntry->d_name[1] == '.'
1256
and direntry->d_name[2] == '\0'))){
1257
return 0;
1258
}
1259
return 1;
1260
}
1261
1262
/* Is this directory entry a runnable program? */
1263
int runnable_hook(const struct dirent *direntry){
1264
int ret;
1265
size_t sret;
1266
struct stat st;
1267
1268
if((direntry->d_name)[0] == '\0'){
1269
/* Empty name? */
1270
return 0;
1271
}
1272
1273
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1274
"abcdefghijklmnopqrstuvwxyz"
1275
"0123456789"
1276
"_-");
1277
if((direntry->d_name)[sret] != '\0'){
1278
/* Contains non-allowed characters */
1279
if(debug){
1280
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1281
direntry->d_name);
1282
}
1283
return 0;
1284
}
1285
1286
char *fullname = NULL;
1287
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1288
if(ret < 0){
1289
perror_plus("asprintf");
1290
return 0;
1291
}
1292
1293
ret = stat(fullname, &st);
1294
if(ret == -1){
1295
if(debug){
1296
perror_plus("Could not stat hook");
1297
}
1298
return 0;
1299
}
1300
if(not (S_ISREG(st.st_mode))){
1301
/* Not a regular file */
1302
if(debug){
1303
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1304
direntry->d_name);
1305
}
1306
return 0;
1307
}
1308
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1309
/* Not executable */
1310
if(debug){
1311
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1312
direntry->d_name);
1313
}
1314
return 0;
1315
}
1316
if(debug){
1317
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1318
direntry->d_name);
1319
}
1320
return 1;
1321
}
1322
1323
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1324
int ret;
1325
struct timespec now;
1326
struct timespec waited_time;
1327
intmax_t block_time;
1328
1329
while(true){
1330
if(mc.current_server == NULL){
1331
if (debug){
1332
fprintf_plus(stderr, "Wait until first server is found."
1333
" No timeout!\n");
1334
}
1335
ret = avahi_simple_poll_iterate(s, -1);
1336
} else {
1337
if (debug){
1338
fprintf_plus(stderr, "Check current_server if we should run"
1339
" it, or wait\n");
1340
}
1341
/* the current time */
1342
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1343
if(ret == -1){
1344
perror_plus("clock_gettime");
1345
return -1;
1346
}
1347
/* Calculating in ms how long time between now and server
1348
who we visted longest time ago. Now - last seen. */
1349
waited_time.tv_sec = (now.tv_sec
1350
- mc.current_server->last_seen.tv_sec);
1351
waited_time.tv_nsec = (now.tv_nsec
1352
- mc.current_server->last_seen.tv_nsec);
1353
/* total time is 10s/10,000ms.
1354
Converting to s from ms by dividing by 1,000,
1355
and ns to ms by dividing by 1,000,000. */
1356
block_time = ((retry_interval
1357
- ((intmax_t)waited_time.tv_sec * 1000))
1358
- ((intmax_t)waited_time.tv_nsec / 1000000));
1359
1360
if (debug){
1361
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1362
block_time);
1363
}
1364
1365
if(block_time <= 0){
1366
ret = start_mandos_communication(mc.current_server->ip,
1367
mc.current_server->port,
1368
mc.current_server->if_index,
1369
mc.current_server->af);
1370
if(ret == 0){
1371
avahi_simple_poll_quit(mc.simple_poll);
1372
return 0;
1373
}
1374
ret = clock_gettime(CLOCK_MONOTONIC,
1375
&mc.current_server->last_seen);
1376
if(ret == -1){
1377
perror_plus("clock_gettime");
1378
return -1;
1379
}
1380
mc.current_server = mc.current_server->next;
1381
block_time = 0; /* Call avahi to find new Mandos
1382
servers, but don't block */
1383
}
1384
1385
ret = avahi_simple_poll_iterate(s, (int)block_time);
1386
}
1387
if(ret != 0){
1388
if (ret > 0 or errno != EINTR){
1389
return (ret != 1) ? ret : 0;
1390
}
1391
}
1392
}
1393
}
1394
1395
/* Set effective uid to 0, return errno */
1396
error_t raise_privileges(void){
1397
error_t old_errno = errno;
1398
error_t ret_errno = 0;
1399
if(seteuid(0) == -1){
1400
ret_errno = errno;
1401
perror_plus("seteuid");
1402
}
1403
errno = old_errno;
1404
return ret_errno;
1405
}
1406
1407
/* Set effective and real user ID to 0. Return errno. */
1408
error_t raise_privileges_permanently(void){
1409
error_t old_errno = errno;
1410
error_t ret_errno = raise_privileges();
1411
if(ret_errno != 0){
1412
errno = old_errno;
1413
return ret_errno;
1414
}
1415
if(setuid(0) == -1){
1416
ret_errno = errno;
1417
perror_plus("seteuid");
1418
}
1419
errno = old_errno;
1420
return ret_errno;
1421
}
1422
1423
/* Set effective user ID to unprivileged saved user ID */
1424
error_t lower_privileges(void){
1425
error_t old_errno = errno;
1426
error_t ret_errno = 0;
1427
if(seteuid(uid) == -1){
1428
ret_errno = errno;
1429
perror_plus("seteuid");
1430
}
1431
errno = old_errno;
1432
return ret_errno;
1433
}
1434
1435
bool run_network_hooks(const char *mode, const char *interface,
1436
const float delay){
1437
struct dirent **direntries;
1438
struct dirent *direntry;
1439
int ret;
1440
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1441
alphasort);
1442
if(numhooks == -1){
1443
perror_plus("scandir");
1444
} else {
1445
int devnull = open("/dev/null", O_RDONLY);
1446
for(int i = 0; i < numhooks; i++){
1447
direntry = direntries[i];
1448
char *fullname = NULL;
1449
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1450
if(ret < 0){
1451
perror_plus("asprintf");
1452
continue;
1453
}
1454
if(debug){
1455
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1456
direntry->d_name);
1457
}
1458
pid_t hook_pid = fork();
1459
if(hook_pid == 0){
1460
/* Child */
1461
/* Raise privileges */
1462
raise_privileges_permanently();
1463
/* Set group */
1464
errno = 0;
1465
ret = setgid(0);
1466
if(ret == -1){
1467
perror_plus("setgid");
1468
}
1469
/* Reset supplementary groups */
1470
errno = 0;
1471
ret = setgroups(0, NULL);
1472
if(ret == -1){
1473
perror_plus("setgroups");
1474
}
1475
dup2(devnull, STDIN_FILENO);
1476
close(devnull);
1477
dup2(STDERR_FILENO, STDOUT_FILENO);
1478
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1479
if(ret == -1){
1480
perror_plus("setenv");
1481
_exit(EX_OSERR);
1482
}
1483
ret = setenv("DEVICE", interface, 1);
1484
if(ret == -1){
1485
perror_plus("setenv");
1486
_exit(EX_OSERR);
1487
}
1488
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1489
if(ret == -1){
1490
perror_plus("setenv");
1491
_exit(EX_OSERR);
1492
}
1493
ret = setenv("MODE", mode, 1);
1494
if(ret == -1){
1495
perror_plus("setenv");
1496
_exit(EX_OSERR);
1497
}
1498
char *delaystring;
1499
ret = asprintf(&delaystring, "%f", delay);
1500
if(ret == -1){
1501
perror_plus("asprintf");
1502
_exit(EX_OSERR);
1503
}
1504
ret = setenv("DELAY", delaystring, 1);
1505
if(ret == -1){
1506
free(delaystring);
1507
perror_plus("setenv");
1508
_exit(EX_OSERR);
1509
}
1510
free(delaystring);
1511
if(connect_to != NULL){
1512
ret = setenv("CONNECT", connect_to, 1);
1513
if(ret == -1){
1514
perror_plus("setenv");
1515
_exit(EX_OSERR);
1516
}
1517
}
1518
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1519
perror_plus("execl");
1520
_exit(EXIT_FAILURE);
1521
}
1522
} else {
1523
int status;
1524
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1525
perror_plus("waitpid");
1526
free(fullname);
1527
continue;
1528
}
1529
if(WIFEXITED(status)){
1530
if(WEXITSTATUS(status) != 0){
1531
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1532
" with status %d\n", direntry->d_name,
1533
WEXITSTATUS(status));
1534
free(fullname);
1535
continue;
1536
}
1537
} else if(WIFSIGNALED(status)){
1538
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1539
" signal %d\n", direntry->d_name,
1540
WTERMSIG(status));
1541
free(fullname);
1542
continue;
1543
} else {
1544
fprintf_plus(stderr, "Warning: network hook \"%s\""
1545
" crashed\n", direntry->d_name);
1546
free(fullname);
1547
continue;
1548
}
1549
}
1550
free(fullname);
1551
if(debug){
1552
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1553
direntry->d_name);
1554
}
1555
}
1556
close(devnull);
1557
}
1558
return true;
1559
}
1560
1561
int bring_up_interface(const char *const interface,
1562
const float delay){
1563
int sd = -1;
1564
int old_errno = errno;
1565
int ret_errno = 0;
1566
int ret;
1567
struct ifreq network;
1568
AvahiIfIndex if_index = (AvahiIfIndex)if_nametoindex(interface);
1569
if(if_index == 0){
1570
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1571
errno = old_errno;
1572
return ENXIO;
1573
}
1574
1575
if(quit_now){
1576
errno = old_errno;
1577
return EINTR;
1578
}
1579
1580
/* Re-raise priviliges */
1581
raise_privileges();
1582
1583
#ifdef __linux__
1584
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1585
messages about the network interface to mess up the prompt */
1586
ret = klogctl(8, NULL, 5);
1587
bool restore_loglevel = true;
1588
if(ret == -1){
1589
restore_loglevel = false;
1590
perror_plus("klogctl");
1591
}
1592
#endif /* __linux__ */
1593
1594
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1595
if(sd < 0){
1596
ret_errno = errno;
1597
perror_plus("socket");
1598
#ifdef __linux__
1599
if(restore_loglevel){
1600
ret = klogctl(7, NULL, 0);
1601
if(ret == -1){
1602
perror_plus("klogctl");
1603
}
1604
}
1605
#endif /* __linux__ */
1606
/* Lower privileges */
1607
lower_privileges();
1608
errno = old_errno;
1609
return ret_errno;
1610
}
1611
strcpy(network.ifr_name, interface);
1612
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1613
if(ret == -1){
1614
ret_errno = errno;
1615
perror_plus("ioctl SIOCGIFFLAGS");
1616
#ifdef __linux__
1617
if(restore_loglevel){
1618
ret = klogctl(7, NULL, 0);
1619
if(ret == -1){
1620
perror_plus("klogctl");
1621
}
1622
}
1623
#endif /* __linux__ */
1624
/* Lower privileges */
1625
lower_privileges();
1626
errno = old_errno;
1627
return ret_errno;
1628
}
1629
if((network.ifr_flags & IFF_UP) == 0){
1630
network.ifr_flags |= IFF_UP;
1631
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1632
if(ret == -1){
1633
ret_errno = errno;
1634
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1635
#ifdef __linux__
1636
if(restore_loglevel){
1637
ret = klogctl(7, NULL, 0);
1638
if(ret == -1){
1639
perror_plus("klogctl");
1640
}
1641
}
1642
#endif /* __linux__ */
1643
/* Lower privileges */
1644
lower_privileges();
1645
errno = old_errno;
1646
return ret_errno;
1647
}
1648
}
1649
/* Sleep checking until interface is running.
1650
Check every 0.25s, up to total time of delay */
1651
for(int i=0; i < delay * 4; i++){
1652
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1653
if(ret == -1){
1654
perror_plus("ioctl SIOCGIFFLAGS");
1655
} else if(network.ifr_flags & IFF_RUNNING){
1656
break;
1657
}
1658
struct timespec sleeptime = { .tv_nsec = 250000000 };
1659
ret = nanosleep(&sleeptime, NULL);
1660
if(ret == -1 and errno != EINTR){
1661
perror_plus("nanosleep");
1662
}
1663
}
1664
/* Close the socket */
1665
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1666
if(ret == -1){
1667
perror_plus("close");
1668
}
1669
#ifdef __linux__
1670
if(restore_loglevel){
1671
/* Restores kernel loglevel to default */
1672
ret = klogctl(7, NULL, 0);
1673
if(ret == -1){
1674
perror_plus("klogctl");
1675
}
1676
}
1677
#endif /* __linux__ */
1678
/* Lower privileges */
1679
lower_privileges();
1680
errno = old_errno;
1681
return 0;
1682
}
1683
1684
int main(int argc, char *argv[]){
1685
AvahiSServiceBrowser *sb = NULL;
1686
int error;
1687
int ret;
1688
intmax_t tmpmax;
1689
char *tmp;
1690
int exitcode = EXIT_SUCCESS;
1691
const char *interface = "";
1692
struct ifreq network;
1693
int sd = -1;
1694
bool take_down_interface = false;
1695
char tempdir[] = "/tmp/mandosXXXXXX";
1696
bool tempdir_created = false;
1697
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1698
const char *seckey = PATHDIR "/" SECKEY;
1699
const char *pubkey = PATHDIR "/" PUBKEY;
1700
1701
bool gnutls_initialized = false;
1702
bool gpgme_initialized = false;
1703
float delay = 2.5f;
1704
double retry_interval = 10; /* 10s between trying a server and
1705
retrying the same server again */
1706
1707
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1708
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1709
1710
uid = getuid();
1711
gid = getgid();
1712
1713
/* Lower any group privileges we might have, just to be safe */
1714
errno = 0;
1715
ret = setgid(gid);
1716
if(ret == -1){
1717
perror_plus("setgid");
1718
}
1719
1720
/* Lower user privileges (temporarily) */
1721
errno = 0;
1722
ret = seteuid(uid);
1723
if(ret == -1){
1724
perror_plus("seteuid");
1725
}
1726
1727
if(quit_now){
1728
goto end;
1729
}
1730
1731
{
1732
struct argp_option options[] = {
1733
{ .name = "debug", .key = 128,
1734
.doc = "Debug mode", .group = 3 },
1735
{ .name = "connect", .key = 'c',
1736
.arg = "ADDRESS:PORT",
1737
.doc = "Connect directly to a specific Mandos server",
1738
.group = 1 },
1739
{ .name = "interface", .key = 'i',
1740
.arg = "NAME",
1741
.doc = "Network interface that will be used to search for"
1742
" Mandos servers",
1743
.group = 1 },
1744
{ .name = "seckey", .key = 's',
1745
.arg = "FILE",
1746
.doc = "OpenPGP secret key file base name",
1747
.group = 1 },
1748
{ .name = "pubkey", .key = 'p',
1749
.arg = "FILE",
1750
.doc = "OpenPGP public key file base name",
1751
.group = 2 },
1752
{ .name = "dh-bits", .key = 129,
1753
.arg = "BITS",
1754
.doc = "Bit length of the prime number used in the"
1755
" Diffie-Hellman key exchange",
1756
.group = 2 },
1757
{ .name = "priority", .key = 130,
1758
.arg = "STRING",
1759
.doc = "GnuTLS priority string for the TLS handshake",
1760
.group = 1 },
1761
{ .name = "delay", .key = 131,
1762
.arg = "SECONDS",
1763
.doc = "Maximum delay to wait for interface startup",
1764
.group = 2 },
1765
{ .name = "retry", .key = 132,
1766
.arg = "SECONDS",
1767
.doc = "Retry interval used when denied by the Mandos server",
1768
.group = 2 },
1769
{ .name = "network-hook-dir", .key = 133,
1770
.arg = "DIR",
1771
.doc = "Directory where network hooks are located",
1772
.group = 2 },
1773
/*
1774
* These reproduce what we would get without ARGP_NO_HELP
1775
*/
1776
{ .name = "help", .key = '?',
1777
.doc = "Give this help list", .group = -1 },
1778
{ .name = "usage", .key = -3,
1779
.doc = "Give a short usage message", .group = -1 },
1780
{ .name = "version", .key = 'V',
1781
.doc = "Print program version", .group = -1 },
1782
{ .name = NULL }
1783
};
1784
1785
error_t parse_opt(int key, char *arg,
1786
struct argp_state *state){
1787
errno = 0;
1788
switch(key){
1789
case 128: /* --debug */
1790
debug = true;
1791
break;
1792
case 'c': /* --connect */
1793
connect_to = arg;
1794
break;
1795
case 'i': /* --interface */
1796
interface = arg;
1797
break;
1798
case 's': /* --seckey */
1799
seckey = arg;
1800
break;
1801
case 'p': /* --pubkey */
1802
pubkey = arg;
1803
break;
1804
case 129: /* --dh-bits */
1805
errno = 0;
1806
tmpmax = strtoimax(arg, &tmp, 10);
1807
if(errno != 0 or tmp == arg or *tmp != '\0'
1808
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1809
argp_error(state, "Bad number of DH bits");
1810
}
1811
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1812
break;
1813
case 130: /* --priority */
1814
mc.priority = arg;
1815
break;
1816
case 131: /* --delay */
1817
errno = 0;
1818
delay = strtof(arg, &tmp);
1819
if(errno != 0 or tmp == arg or *tmp != '\0'){
1820
argp_error(state, "Bad delay");
1821
}
1822
case 132: /* --retry */
1823
errno = 0;
1824
retry_interval = strtod(arg, &tmp);
1825
if(errno != 0 or tmp == arg or *tmp != '\0'
1826
or (retry_interval * 1000) > INT_MAX
1827
or retry_interval < 0){
1828
argp_error(state, "Bad retry interval");
1829
}
1830
break;
1831
case 133: /* --network-hook-dir */
1832
hookdir = arg;
1833
break;
1834
/*
1835
* These reproduce what we would get without ARGP_NO_HELP
1836
*/
1837
case '?': /* --help */
1838
argp_state_help(state, state->out_stream,
1839
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1840
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1841
case -3: /* --usage */
1842
argp_state_help(state, state->out_stream,
1843
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1844
case 'V': /* --version */
1845
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1846
exit(argp_err_exit_status);
1847
break;
1848
default:
1849
return ARGP_ERR_UNKNOWN;
1850
}
1851
return errno;
1852
}
1853
1854
struct argp argp = { .options = options, .parser = parse_opt,
1855
.args_doc = "",
1856
.doc = "Mandos client -- Get and decrypt"
1857
" passwords from a Mandos server" };
1858
ret = argp_parse(&argp, argc, argv,
1859
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1860
switch(ret){
1861
case 0:
1862
break;
1863
case ENOMEM:
1864
default:
1865
errno = ret;
1866
perror_plus("argp_parse");
1867
exitcode = EX_OSERR;
1868
goto end;
1869
case EINVAL:
1870
exitcode = EX_USAGE;
1871
goto end;
1872
}
1873
}
1874
1875
{
1876
/* Work around Debian bug #633582:
1877
<http://bugs.debian.org/633582> */
1878
1879
/* Re-raise priviliges */
1880
if(raise_privileges() == 0){
1881
struct stat st;
1882
1883
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1884
int seckey_fd = open(seckey, O_RDONLY);
1885
if(seckey_fd == -1){
1886
perror_plus("open");
1887
} else {
1888
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1889
if(ret == -1){
1890
perror_plus("fstat");
1891
} else {
1892
if(S_ISREG(st.st_mode)
1893
and st.st_uid == 0 and st.st_gid == 0){
1894
ret = fchown(seckey_fd, uid, gid);
1895
if(ret == -1){
1896
perror_plus("fchown");
1897
}
1898
}
1899
}
1900
TEMP_FAILURE_RETRY(close(seckey_fd));
1901
}
1902
}
1903
1904
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1905
int pubkey_fd = open(pubkey, O_RDONLY);
1906
if(pubkey_fd == -1){
1907
perror_plus("open");
1908
} else {
1909
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1910
if(ret == -1){
1911
perror_plus("fstat");
1912
} else {
1913
if(S_ISREG(st.st_mode)
1914
and st.st_uid == 0 and st.st_gid == 0){
1915
ret = fchown(pubkey_fd, uid, gid);
1916
if(ret == -1){
1917
perror_plus("fchown");
1918
}
1919
}
1920
}
1921
TEMP_FAILURE_RETRY(close(pubkey_fd));
1922
}
1923
}
1924
1925
/* Lower privileges */
1926
errno = 0;
1927
ret = seteuid(uid);
1928
if(ret == -1){
1929
perror_plus("seteuid");
1930
}
1931
}
1932
}
1933
1934
/* Run network hooks */
1935
if(not run_network_hooks("start", interface, delay)){
1936
goto end;
1937
}
1938
1939
if(not debug){
421
static AvahiSimplePoll *simple_poll = NULL;
422
static AvahiServer *server = NULL;
423
424
static void resolve_callback(
425
AvahiSServiceResolver *r,
426
AVAHI_GCC_UNUSED AvahiIfIndex interface,
427
AVAHI_GCC_UNUSED AvahiProtocol protocol,
428
AvahiResolverEvent event,
429
const char *name,
430
const char *type,
431
const char *domain,
432
const char *host_name,
433
const AvahiAddress *address,
434
uint16_t port,
435
AvahiStringList *txt,
436
AvahiLookupResultFlags flags,
437
AVAHI_GCC_UNUSED void* userdata) {
438
439
assert(r);
440
441
/* Called whenever a service has been resolved successfully or timed out */
442
443
switch (event) {
444
case AVAHI_RESOLVER_FAILURE:
445
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of type '%s' in domain '%s': %s\n", name, type, domain, avahi_strerror(avahi_server_errno(server)));
446
break;
447
448
case AVAHI_RESOLVER_FOUND: {
449
char ip[AVAHI_ADDRESS_STR_MAX];
450
avahi_address_snprint(ip, sizeof(ip), address);
451
int ret = start_mandos_communcation(ip, port);
452
if (ret == 0){
453
exit(EXIT_SUCCESS);
454
} else {
455
exit(EXIT_FAILURE);
456
}
457
}
458
}
459
avahi_s_service_resolver_free(r);
460
}
461
462
static void browse_callback(
463
AvahiSServiceBrowser *b,
464
AvahiIfIndex interface,
465
AvahiProtocol protocol,
466
AvahiBrowserEvent event,
467
const char *name,
468
const char *type,
469
const char *domain,
470
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
471
void* userdata) {
472
473
AvahiServer *s = userdata;
474
assert(b);
475
476
/* Called whenever a new services becomes available on the LAN or is removed from the LAN */
477
478
switch (event) {
479
480
case AVAHI_BROWSER_FAILURE:
481
482
fprintf(stderr, "(Browser) %s\n", avahi_strerror(avahi_server_errno(server)));
483
avahi_simple_poll_quit(simple_poll);
484
return;
485
486
case AVAHI_BROWSER_NEW:
487
/* We ignore the returned resolver object. In the callback
488
function we free it. If the server is terminated before
489
the callback function is called the server will free
490
the resolver for us. */
491
492
if (!(avahi_s_service_resolver_new(s, interface, protocol, name, type, domain, AVAHI_PROTO_INET6, 0, resolve_callback, s)))
493
fprintf(stderr, "Failed to resolve service '%s': %s\n", name, avahi_strerror(avahi_server_errno(s)));
494
495
break;
496
497
case AVAHI_BROWSER_REMOVE:
498
break;
499
500
case AVAHI_BROWSER_ALL_FOR_NOW:
501
case AVAHI_BROWSER_CACHE_EXHAUSTED:
502
break;
503
}
504
}
505
506
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
507
AvahiServerConfig config;
508
AvahiSServiceBrowser *sb = NULL;
509
int error;
510
int ret = 1;
511
1940
512
avahi_set_log_function(empty_log);
1941
}
1942
1943
if(interface[0] == '\0'){
1944
struct dirent **direntries;
1945
/* First look for interfaces that are up */
1946
ret = scandir(sys_class_net, &direntries, up_interface,
1947
alphasort);
1948
if(ret == 0){
1949
/* No up interfaces, look for any good interfaces */
1950
free(direntries);
1951
ret = scandir(sys_class_net, &direntries, good_interface,
1952
alphasort);
1953
}
1954
if(ret >= 1){
1955
/* Pick the first interface returned */
1956
interface = strdup(direntries[0]->d_name);
1957
if(debug){
1958
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1959
}
1960
if(interface == NULL){
1961
perror_plus("malloc");
1962
free(direntries);
1963
exitcode = EXIT_FAILURE;
1964
goto end;
1965
}
1966
free(direntries);
1967
} else {
1968
free(direntries);
1969
fprintf_plus(stderr, "Could not find a network interface\n");
1970
exitcode = EXIT_FAILURE;
1971
goto end;
1972
}
1973
}
1974
1975
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1976
from the signal handler */
1977
/* Initialize the pseudo-RNG for Avahi */
1978
srand((unsigned int) time(NULL));
1979
mc.simple_poll = avahi_simple_poll_new();
1980
if(mc.simple_poll == NULL){
1981
fprintf_plus(stderr,
1982
"Avahi: Failed to create simple poll object.\n");
1983
exitcode = EX_UNAVAILABLE;
1984
goto end;
1985
}
1986
1987
sigemptyset(&sigterm_action.sa_mask);
1988
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1989
if(ret == -1){
1990
perror_plus("sigaddset");
1991
exitcode = EX_OSERR;
1992
goto end;
1993
}
1994
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1995
if(ret == -1){
1996
perror_plus("sigaddset");
1997
exitcode = EX_OSERR;
1998
goto end;
1999
}
2000
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
2001
if(ret == -1){
2002
perror_plus("sigaddset");
2003
exitcode = EX_OSERR;
2004
goto end;
2005
}
2006
/* Need to check if the handler is SIG_IGN before handling:
2007
| [[info:libc:Initial Signal Actions]] |
2008
| [[info:libc:Basic Signal Handling]] |
2009
*/
2010
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
2011
if(ret == -1){
2012
perror_plus("sigaction");
2013
return EX_OSERR;
2014
}
2015
if(old_sigterm_action.sa_handler != SIG_IGN){
2016
ret = sigaction(SIGINT, &sigterm_action, NULL);
2017
if(ret == -1){
2018
perror_plus("sigaction");
2019
exitcode = EX_OSERR;
2020
goto end;
2021
}
2022
}
2023
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
2024
if(ret == -1){
2025
perror_plus("sigaction");
2026
return EX_OSERR;
2027
}
2028
if(old_sigterm_action.sa_handler != SIG_IGN){
2029
ret = sigaction(SIGHUP, &sigterm_action, NULL);
2030
if(ret == -1){
2031
perror_plus("sigaction");
2032
exitcode = EX_OSERR;
2033
goto end;
2034
}
2035
}
2036
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
2037
if(ret == -1){
2038
perror_plus("sigaction");
2039
return EX_OSERR;
2040
}
2041
if(old_sigterm_action.sa_handler != SIG_IGN){
2042
ret = sigaction(SIGTERM, &sigterm_action, NULL);
2043
if(ret == -1){
2044
perror_plus("sigaction");
2045
exitcode = EX_OSERR;
2046
goto end;
2047
}
2048
}
2049
2050
/* If the interface is down, bring it up */
2051
if((interface[0] != '\0') and (strcmp(interface, "none") != 0)){
2052
ret = bring_up_interface(interface, delay);
2053
if(ret != 0){
2054
errno = ret;
2055
perror_plus("Failed to bring up interface");
2056
}
2057
}
2058
2059
if(quit_now){
2060
goto end;
2061
}
2062
2063
ret = init_gnutls_global(pubkey, seckey);
2064
if(ret == -1){
2065
fprintf_plus(stderr, "init_gnutls_global failed\n");
2066
exitcode = EX_UNAVAILABLE;
2067
goto end;
2068
} else {
2069
gnutls_initialized = true;
2070
}
2071
2072
if(quit_now){
2073
goto end;
2074
}
2075
2076
if(mkdtemp(tempdir) == NULL){
2077
perror_plus("mkdtemp");
2078
goto end;
2079
}
2080
tempdir_created = true;
2081
2082
if(quit_now){
2083
goto end;
2084
}
2085
2086
if(not init_gpgme(pubkey, seckey, tempdir)){
2087
fprintf_plus(stderr, "init_gpgme failed\n");
2088
exitcode = EX_UNAVAILABLE;
2089
goto end;
2090
} else {
2091
gpgme_initialized = true;
2092
}
2093
2094
if(quit_now){
2095
goto end;
2096
}
2097
2098
if(connect_to != NULL){
2099
/* Connect directly, do not use Zeroconf */
2100
/* (Mainly meant for debugging) */
2101
char *address = strrchr(connect_to, ':');
2102
2103
if(address == NULL){
2104
fprintf_plus(stderr, "No colon in address\n");
2105
exitcode = EX_USAGE;
2106
goto end;
2107
}
2108
2109
if(quit_now){
2110
goto end;
2111
}
2112
2113
uint16_t port;
2114
errno = 0;
2115
tmpmax = strtoimax(address+1, &tmp, 10);
2116
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2117
or tmpmax != (uint16_t)tmpmax){
2118
fprintf_plus(stderr, "Bad port number\n");
2119
exitcode = EX_USAGE;
2120
goto end;
2121
}
2122
2123
if(quit_now){
2124
goto end;
2125
}
2126
2127
port = (uint16_t)tmpmax;
2128
*address = '\0';
2129
/* Colon in address indicates IPv6 */
2130
int af;
2131
if(strchr(connect_to, ':') != NULL){
2132
af = AF_INET6;
2133
/* Accept [] around IPv6 address - see RFC 5952 */
2134
if(connect_to[0] == '[' and address[-1] == ']')
2135
{
2136
connect_to++;
2137
address[-1] = '\0';
2138
}
2139
} else {
2140
af = AF_INET;
2141
}
2142
address = connect_to;
2143
2144
if(quit_now){
2145
goto end;
2146
}
2147
2148
while(not quit_now){
2149
ret = start_mandos_communication(address, port, if_index, af);
2150
if(quit_now or ret == 0){
2151
break;
2152
}
2153
if(debug){
2154
fprintf_plus(stderr, "Retrying in %d seconds\n",
2155
(int)retry_interval);
2156
}
2157
sleep((int)retry_interval);
2158
}
2159
2160
if (not quit_now){
2161
exitcode = EXIT_SUCCESS;
2162
}
2163
2164
goto end;
2165
}
2166
2167
if(quit_now){
2168
goto end;
2169
}
2170
2171
{
2172
AvahiServerConfig config;
2173
/* Do not publish any local Zeroconf records */
513
514
/* Initialize the psuedo-RNG */
515
srand(time(NULL));
516
517
/* Allocate main loop object */
518
if (!(simple_poll = avahi_simple_poll_new())) {
519
fprintf(stderr, "Failed to create simple poll object.\n");
520
goto fail;
521
}
522
523
/* Do not publish any local records */
2174
524
avahi_server_config_init(&config);
2175
525
config.publish_hinfo = 0;
2176
526
config.publish_addresses = 0;
2177
527
config.publish_workstation = 0;
2178
528
config.publish_domain = 0;
529
530
/* /\* Set a unicast DNS server for wide area DNS-SD *\/ */
531
/* avahi_address_parse("193.11.177.11", AVAHI_PROTO_UNSPEC, &config.wide_area_servers[0]); */
532
/* config.n_wide_area_servers = 1; */
533
/* config.enable_wide_area = 1; */
2179
534
2180
535
/* Allocate a new server */
2181
mc.server = avahi_server_new(avahi_simple_poll_get
2182
(mc.simple_poll), &config, NULL,
2183
NULL, &error);
2184
2185
/* Free the Avahi configuration data */
536
server = avahi_server_new(avahi_simple_poll_get(simple_poll), &config, NULL, NULL, &error);
537
538
/* Free the configuration data */
2186
539
avahi_server_config_free(&config);
2187
}
2188
2189
/* Check if creating the Avahi server object succeeded */
2190
if(mc.server == NULL){
2191
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2192
avahi_strerror(error));
2193
exitcode = EX_UNAVAILABLE;
2194
goto end;
2195
}
2196
2197
if(quit_now){
2198
goto end;
2199
}
2200
2201
/* Create the Avahi service browser */
2202
sb = avahi_s_service_browser_new(mc.server, if_index,
2203
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2204
NULL, 0, browse_callback, NULL);
2205
if(sb == NULL){
2206
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2207
avahi_strerror(avahi_server_errno(mc.server)));
2208
exitcode = EX_UNAVAILABLE;
2209
goto end;
2210
}
2211
2212
if(quit_now){
2213
goto end;
2214
}
2215
2216
/* Run the main loop */
2217
2218
if(debug){
2219
fprintf_plus(stderr, "Starting Avahi loop search\n");
2220
}
2221
2222
ret = avahi_loop_with_timeout(mc.simple_poll,
2223
(int)(retry_interval * 1000));
2224
if(debug){
2225
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2226
(ret == 0) ? "successfully" : "with error");
2227
}
2228
2229
end:
2230
2231
if(debug){
2232
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2233
}
2234
2235
/* Cleanup things */
2236
if(sb != NULL)
2237
avahi_s_service_browser_free(sb);
2238
2239
if(mc.server != NULL)
2240
avahi_server_free(mc.server);
2241
2242
if(mc.simple_poll != NULL)
2243
avahi_simple_poll_free(mc.simple_poll);
2244
2245
if(gnutls_initialized){
2246
gnutls_certificate_free_credentials(mc.cred);
2247
gnutls_global_deinit();
2248
gnutls_dh_params_deinit(mc.dh_params);
2249
}
2250
2251
if(gpgme_initialized){
2252
gpgme_release(mc.ctx);
2253
}
2254
2255
/* Cleans up the circular linked list of Mandos servers the client
2256
has seen */
2257
if(mc.current_server != NULL){
2258
mc.current_server->prev->next = NULL;
2259
while(mc.current_server != NULL){
2260
server *next = mc.current_server->next;
2261
free(mc.current_server);
2262
mc.current_server = next;
2263
}
2264
}
2265
2266
/* Run network hooks */
2267
run_network_hooks("stop", interface, delay);
2268
2269
/* Re-raise priviliges */
2270
{
2271
raise_privileges();
2272
2273
/* Take down the network interface */
2274
if(take_down_interface and geteuid() == 0){
2275
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2276
if(ret == -1){
2277
perror_plus("ioctl SIOCGIFFLAGS");
2278
} else if(network.ifr_flags & IFF_UP){
2279
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2280
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2281
if(ret == -1){
2282
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2283
}
2284
}
2285
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2286
if(ret == -1){
2287
perror_plus("close");
2288
}
2289
}
2290
}
2291
/* Lower privileges permanently */
2292
errno = 0;
2293
ret = setuid(uid);
2294
if(ret == -1){
2295
perror_plus("setuid");
2296
}
2297
2298
/* Removes the GPGME temp directory and all files inside */
2299
if(tempdir_created){
2300
struct dirent **direntries = NULL;
2301
struct dirent *direntry = NULL;
2302
int numentries = scandir(tempdir, &direntries, notdotentries,
2303
alphasort);
2304
if (numentries > 0){
2305
for(int i = 0; i < numentries; i++){
2306
direntry = direntries[i];
2307
char *fullname = NULL;
2308
ret = asprintf(&fullname, "%s/%s", tempdir,
2309
direntry->d_name);
2310
if(ret < 0){
2311
perror_plus("asprintf");
2312
continue;
2313
}
2314
ret = remove(fullname);
2315
if(ret == -1){
2316
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2317
strerror(errno));
2318
}
2319
free(fullname);
2320
}
2321
}
2322
2323
/* need to clean even if 0 because man page doesn't specify */
2324
free(direntries);
2325
if (numentries == -1){
2326
perror_plus("scandir");
2327
}
2328
ret = rmdir(tempdir);
2329
if(ret == -1 and errno != ENOENT){
2330
perror_plus("rmdir");
2331
}
2332
}
2333
2334
if(quit_now){
2335
sigemptyset(&old_sigterm_action.sa_mask);
2336
old_sigterm_action.sa_handler = SIG_DFL;
2337
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
2338
&old_sigterm_action,
2339
NULL));
2340
if(ret == -1){
2341
perror_plus("sigaction");
2342
}
2343
do {
2344
ret = raise(signal_received);
2345
} while(ret != 0 and errno == EINTR);
2346
if(ret != 0){
2347
perror_plus("raise");
2348
abort();
2349
}
2350
TEMP_FAILURE_RETRY(pause());
2351
}
2352
2353
return exitcode;
540
541
/* Check wether creating the server object succeeded */
542
if (!server) {
543
fprintf(stderr, "Failed to create server: %s\n", avahi_strerror(error));
544
goto fail;
545
}
546
547
/* Create the service browser */
548
if (!(sb = avahi_s_service_browser_new(server, if_nametoindex("eth0"), AVAHI_PROTO_INET6, "_mandos._tcp", NULL, 0, browse_callback, server))) {
549
fprintf(stderr, "Failed to create service browser: %s\n", avahi_strerror(avahi_server_errno(server)));
550
goto fail;
551
}
552
553
/* Run the main loop */
554
avahi_simple_poll_loop(simple_poll);
555
556
ret = 0;
557
558
fail:
559
560
/* Cleanup things */
561
if (sb)
562
avahi_s_service_browser_free(sb);
563
564
if (server)
565
avahi_server_free(server);
566
567
if (simple_poll)
568
avahi_simple_poll_free(simple_poll);
569
570
return ret;
2354
571
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0