(root)/mandos/release
» Revision
237.2.1
(compared to revision 237.2.115)
: plugins.d/mandos-client.c
To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 237.2.1
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.1
- Committer: Teddy Hogeborn
- Date: 2008-12-10 01:26:02 UTC
- mfrom: (237.1.2 mandos)
- mto: (24.1.114 mandos) (237.4.2 mandos-pipe-ipc) (299.1.1 release) (300.1.1 release) (301.1.1 release)
- mto: This revision was merged to the branch mainline in revision 238.
- Revision ID: teddy@fukt.bsnet.se-20081210012602-vhz3h75xkj24t340
First version of a somewhat complete D-Bus server interface. Also
change user/group name to "_mandos".
* debian/mandos.postinst: Rename old "mandos" user and group to
"_mandos"; create "_mandos" user and group
if none exist.
* debian/mandos-client.postinst: - '' -
* initramfs-tools-hook: Try "_mandos" before "mandos" as user and
group name.
* mandos (_datetime_to_dbus_struct): New; was previously local.
(Client.started): Renamed to "last_started". All users changed.
(Client.started): New; boolean.
(Client.dbus_object_path): New.
(Client.check_command): Renamed to "checker_command". All users
changed.
(Client.__init__): Set and use "self.dbus_object_path". Set
"self.started".
(Client.start): Update "self.started". Emit "self.PropertyChanged"
signals for both "started" and "last_started".
(Client.stop): Update "self.started". Emit "self.PropertyChanged"
signal for "started".
(Client.checker_callback): Take additional "command" argument. All
callers changed. Emit
"self.PropertyChanged" signal.
(Client.bump_timeout): Emit "self.PropertyChanged" signal for
"last_checked_ok".
(Client.start_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.stop_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.still_valid): Bug fix: use "getattr(self, started, False)"
instead of "self.started" in case this client
object is so new that the "started" attribute
has not been created yet.
(Client.IntervalChanged, Client.CheckerIsRunning, Client.GetChecker,
Client.GetCreated, Client.GetFingerprint, Client.GetHost,
Client.GetInterval, Client.GetName, Client.GetStarted,
Client.GetTimeout, Client.StateChanged, Client.TimeoutChanged):
Removed; all callers changed.
(Client.CheckerCompleted): Add "condition" and "command" arguments.
All callers changed.
(Client.GetAllProperties, Client.PropertyChanged): New.
(Client.StillValid): Renamed to "IsStillValid".
(Client.StartChecker): Changed to its own function to avoid the
return value from "Client.start_checker()".
(Client.Stop): Changed to its own function to avoid the return value
from "Client.stop()".
(main): Try "_mandos" before "mandos" as user and group name.
Removed inner function "remove_from_clients". New inner
class "MandosServer".
change user/group name to "_mandos".
* debian/mandos.postinst: Rename old "mandos" user and group to
"_mandos"; create "_mandos" user and group
if none exist.
* debian/mandos-client.postinst: - '' -
* initramfs-tools-hook: Try "_mandos" before "mandos" as user and
group name.
* mandos (_datetime_to_dbus_struct): New; was previously local.
(Client.started): Renamed to "last_started". All users changed.
(Client.started): New; boolean.
(Client.dbus_object_path): New.
(Client.check_command): Renamed to "checker_command". All users
changed.
(Client.__init__): Set and use "self.dbus_object_path". Set
"self.started".
(Client.start): Update "self.started". Emit "self.PropertyChanged"
signals for both "started" and "last_started".
(Client.stop): Update "self.started". Emit "self.PropertyChanged"
signal for "started".
(Client.checker_callback): Take additional "command" argument. All
callers changed. Emit
"self.PropertyChanged" signal.
(Client.bump_timeout): Emit "self.PropertyChanged" signal for
"last_checked_ok".
(Client.start_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.stop_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.still_valid): Bug fix: use "getattr(self, started, False)"
instead of "self.started" in case this client
object is so new that the "started" attribute
has not been created yet.
(Client.IntervalChanged, Client.CheckerIsRunning, Client.GetChecker,
Client.GetCreated, Client.GetFingerprint, Client.GetHost,
Client.GetInterval, Client.GetName, Client.GetStarted,
Client.GetTimeout, Client.StateChanged, Client.TimeoutChanged):
Removed; all callers changed.
(Client.CheckerCompleted): Add "condition" and "command" arguments.
All callers changed.
(Client.GetAllProperties, Client.PropertyChanged): New.
(Client.StillValid): Renamed to "IsStillValid".
(Client.StartChecker): Changed to its own function to avoid the
return value from "Client.start_checker()".
(Client.Stop): Changed to its own function to avoid the return value
from "Client.stop()".
(main): Try "_mandos" before "mandos" as user and group name.
Removed inner function "remove_from_clients". New inner
class "MandosServer".
- files added:
- debian/mandos-client.config
- files removed:
- debian/watch
- files modified:
- INSTALL
added
removed
plugins.d/mandos-client.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
3
* Mandos client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
12
* Copyright © 2008 Teddy Hogeborn
13
* Copyright © 2008 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
30
30
*/
31
31
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
33
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
34
#define _FILE_OFFSET_BITS 64
38
#endif
39
35
40
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
37
42
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
39
stdout, ferror() */
44
40
#include <stdint.h> /* uint16_t, uint32_t */
45
41
#include <stddef.h> /* NULL, size_t, ssize_t */
46
42
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof() */
48
#include <stdbool.h> /* bool, false, true */
43
srand() */
44
#include <stdbool.h> /* bool, true */
49
45
#include <string.h> /* memset(), strcmp(), strlen(),
50
46
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/ioctl.h> /* ioctl */
52
48
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
49
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
50
SOCK_STREAM, INET6_ADDRSTRLEN,
51
uid_t, gid_t, open(), opendir(), DIR */
56
52
#include <sys/stat.h> /* open() */
57
53
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
54
struct in6_addr, inet_pton(),
55
connect() */
59
56
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
57
#include <dirent.h> /* opendir(), struct dirent, readdir() */
58
#include <inttypes.h> /* PRIu16 */
64
59
#include <assert.h> /* assert() */
65
60
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
61
#include <time.h> /* time() */
67
62
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
63
SIOCSIFFLAGS, if_indextoname(),
69
64
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
65
#include <netinet/in.h>
73
66
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
67
getuid(), getgid(), setuid(),
75
68
setgid() */
76
69
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
70
#include <iso646.h> /* not, and */
78
71
#include <argp.h> /* struct argp_option, error_t, struct
79
72
argp_state, struct argp,
80
73
argp_parse(), ARGP_KEY_ARG,
81
74
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sigaction,
84
sig_atomic_t */
85
86
#ifdef __linux__
87
#include <sys/klog.h> /* klogctl() */
88
#endif /* __linux__ */
89
75
90
76
/* Avahi */
91
77
/* All Avahi types, constants and functions
104
90
gnutls_*
105
91
init_gnutls_session(),
106
92
GNUTLS_* */
107
#include <gnutls/openpgp.h>
108
/* gnutls_certificate_set_openpgp_key_file(),
93
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
109
94
GNUTLS_OPENPGP_FMT_BASE64 */
110
95
111
96
/* GPGME */
137
122
gpgme_ctx_t ctx;
138
123
} mandos_context;
139
124
140
/* global context so signal handler can reach it*/
141
mandos_context mc = { .simple_poll = NULL, .server = NULL,
142
.dh_bits = 1024, .priority = "SECURE256"
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
144
145
125
/*
146
* Make additional room in "buffer" for at least BUFFER_SIZE more
147
* bytes. "buffer_capacity" is how much is currently allocated,
126
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
127
* "buffer_capacity" is how much is currently allocated,
148
128
* "buffer_length" is how much is already used.
149
129
*/
150
size_t incbuffer(char **buffer, size_t buffer_length,
130
size_t adjustbuffer(char **buffer, size_t buffer_length,
151
131
size_t buffer_capacity){
152
if(buffer_length + BUFFER_SIZE > buffer_capacity){
132
if (buffer_length + BUFFER_SIZE > buffer_capacity){
153
133
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
154
if(buffer == NULL){
134
if (buffer == NULL){
155
135
return 0;
156
136
}
157
137
buffer_capacity += BUFFER_SIZE;
162
142
/*
163
143
* Initialize GPGME.
164
144
*/
165
static bool init_gpgme(const char *seckey,
145
static bool init_gpgme(mandos_context *mc, const char *seckey,
166
146
const char *pubkey, const char *tempdir){
167
147
int ret;
168
148
gpgme_error_t rc;
170
150
171
151
172
152
/*
173
* Helper function to insert pub and seckey to the engine keyring.
153
* Helper function to insert pub and seckey to the enigne keyring.
174
154
*/
175
155
bool import_key(const char *filename){
176
156
int fd;
177
157
gpgme_data_t pgp_data;
178
158
179
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
159
fd = TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
180
160
if(fd == -1){
181
161
perror("open");
182
162
return false;
183
163
}
184
164
185
165
rc = gpgme_data_new_from_fd(&pgp_data, fd);
186
if(rc != GPG_ERR_NO_ERROR){
166
if (rc != GPG_ERR_NO_ERROR){
187
167
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
188
168
gpgme_strsource(rc), gpgme_strerror(rc));
189
169
return false;
190
170
}
191
171
192
rc = gpgme_op_import(mc.ctx, pgp_data);
193
if(rc != GPG_ERR_NO_ERROR){
172
rc = gpgme_op_import(mc->ctx, pgp_data);
173
if (rc != GPG_ERR_NO_ERROR){
194
174
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
195
175
gpgme_strsource(rc), gpgme_strerror(rc));
196
176
return false;
197
177
}
198
178
199
ret = (int)TEMP_FAILURE_RETRY(close(fd));
179
ret = TEMP_FAILURE_RETRY(close(fd));
200
180
if(ret == -1){
201
181
perror("close");
202
182
}
204
184
return true;
205
185
}
206
186
207
if(debug){
208
fprintf(stderr, "Initializing GPGME\n");
187
if (debug){
188
fprintf(stderr, "Initialize gpgme\n");
209
189
}
210
190
211
191
/* Init GPGME */
212
192
gpgme_check_version(NULL);
213
193
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
214
if(rc != GPG_ERR_NO_ERROR){
194
if (rc != GPG_ERR_NO_ERROR){
215
195
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
216
196
gpgme_strsource(rc), gpgme_strerror(rc));
217
197
return false;
218
198
}
219
199
220
200
/* Set GPGME home directory for the OpenPGP engine only */
221
rc = gpgme_get_engine_info(&engine_info);
222
if(rc != GPG_ERR_NO_ERROR){
201
rc = gpgme_get_engine_info (&engine_info);
202
if (rc != GPG_ERR_NO_ERROR){
223
203
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
224
204
gpgme_strsource(rc), gpgme_strerror(rc));
225
205
return false;
238
218
}
239
219
240
220
/* Create new GPGME "context" */
241
rc = gpgme_new(&(mc.ctx));
242
if(rc != GPG_ERR_NO_ERROR){
221
rc = gpgme_new(&(mc->ctx));
222
if (rc != GPG_ERR_NO_ERROR){
243
223
fprintf(stderr, "bad gpgme_new: %s: %s\n",
244
224
gpgme_strsource(rc), gpgme_strerror(rc));
245
225
return false;
246
226
}
247
227
248
if(not import_key(pubkey) or not import_key(seckey)){
228
if (not import_key(pubkey) or not import_key(seckey)){
249
229
return false;
250
230
}
251
231
256
236
* Decrypt OpenPGP data.
257
237
* Returns -1 on error
258
238
*/
259
static ssize_t pgp_packet_decrypt(const char *cryptotext,
260
size_t crypto_size,
261
char **plaintext){
239
static ssize_t pgp_packet_decrypt (const mandos_context *mc,
240
const char *cryptotext,
241
size_t crypto_size,
242
char **plaintext){
262
243
gpgme_data_t dh_crypto, dh_plain;
263
244
gpgme_error_t rc;
264
245
ssize_t ret;
265
246
size_t plaintext_capacity = 0;
266
247
ssize_t plaintext_length = 0;
267
248
268
if(debug){
249
if (debug){
269
250
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
270
251
}
271
252
272
253
/* Create new GPGME data buffer from memory cryptotext */
273
254
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
274
255
0);
275
if(rc != GPG_ERR_NO_ERROR){
256
if (rc != GPG_ERR_NO_ERROR){
276
257
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
277
258
gpgme_strsource(rc), gpgme_strerror(rc));
278
259
return -1;
280
261
281
262
/* Create new empty GPGME data buffer for the plaintext */
282
263
rc = gpgme_data_new(&dh_plain);
283
if(rc != GPG_ERR_NO_ERROR){
264
if (rc != GPG_ERR_NO_ERROR){
284
265
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
285
266
gpgme_strsource(rc), gpgme_strerror(rc));
286
267
gpgme_data_release(dh_crypto);
289
270
290
271
/* Decrypt data from the cryptotext data buffer to the plaintext
291
272
data buffer */
292
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
293
if(rc != GPG_ERR_NO_ERROR){
273
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
274
if (rc != GPG_ERR_NO_ERROR){
294
275
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
295
276
gpgme_strsource(rc), gpgme_strerror(rc));
296
277
plaintext_length = -1;
297
if(debug){
278
if (debug){
298
279
gpgme_decrypt_result_t result;
299
result = gpgme_op_decrypt_result(mc.ctx);
300
if(result == NULL){
280
result = gpgme_op_decrypt_result(mc->ctx);
281
if (result == NULL){
301
282
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
302
283
} else {
303
284
fprintf(stderr, "Unsupported algorithm: %s\n",
309
290
}
310
291
gpgme_recipient_t recipient;
311
292
recipient = result->recipients;
312
while(recipient != NULL){
313
fprintf(stderr, "Public key algorithm: %s\n",
314
gpgme_pubkey_algo_name(recipient->pubkey_algo));
315
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
316
fprintf(stderr, "Secret key available: %s\n",
317
recipient->status == GPG_ERR_NO_SECKEY
318
? "No" : "Yes");
319
recipient = recipient->next;
293
if(recipient){
294
while(recipient != NULL){
295
fprintf(stderr, "Public key algorithm: %s\n",
296
gpgme_pubkey_algo_name(recipient->pubkey_algo));
297
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
298
fprintf(stderr, "Secret key available: %s\n",
299
recipient->status == GPG_ERR_NO_SECKEY
300
? "No" : "Yes");
301
recipient = recipient->next;
302
}
320
303
}
321
304
}
322
305
}
328
311
}
329
312
330
313
/* Seek back to the beginning of the GPGME plaintext data buffer */
331
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
314
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
332
315
perror("gpgme_data_seek");
333
316
plaintext_length = -1;
334
317
goto decrypt_end;
336
319
337
320
*plaintext = NULL;
338
321
while(true){
339
plaintext_capacity = incbuffer(plaintext,
322
plaintext_capacity = adjustbuffer(plaintext,
340
323
(size_t)plaintext_length,
341
324
plaintext_capacity);
342
if(plaintext_capacity == 0){
343
perror("incbuffer");
325
if (plaintext_capacity == 0){
326
perror("adjustbuffer");
344
327
plaintext_length = -1;
345
328
goto decrypt_end;
346
329
}
348
331
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
349
332
BUFFER_SIZE);
350
333
/* Print the data, if any */
351
if(ret == 0){
334
if (ret == 0){
352
335
/* EOF */
353
336
break;
354
337
}
378
361
return plaintext_length;
379
362
}
380
363
381
static const char * safer_gnutls_strerror(int value){
382
const char *ret = gnutls_strerror(value); /* Spurious warning from
383
-Wunreachable-code */
384
if(ret == NULL)
364
static const char * safer_gnutls_strerror (int value) {
365
const char *ret = gnutls_strerror (value); /* Spurious warning */
366
if (ret == NULL)
385
367
ret = "(unknown)";
386
368
return ret;
387
369
}
392
374
fprintf(stderr, "GnuTLS: %s", string);
393
375
}
394
376
395
static int init_gnutls_global(const char *pubkeyfilename,
377
static int init_gnutls_global(mandos_context *mc,
378
const char *pubkeyfilename,
396
379
const char *seckeyfilename){
397
380
int ret;
398
381
401
384
}
402
385
403
386
ret = gnutls_global_init();
404
if(ret != GNUTLS_E_SUCCESS){
405
fprintf(stderr, "GnuTLS global_init: %s\n",
406
safer_gnutls_strerror(ret));
387
if (ret != GNUTLS_E_SUCCESS) {
388
fprintf (stderr, "GnuTLS global_init: %s\n",
389
safer_gnutls_strerror(ret));
407
390
return -1;
408
391
}
409
392
410
if(debug){
393
if (debug){
411
394
/* "Use a log level over 10 to enable all debugging options."
412
395
* - GnuTLS manual
413
396
*/
416
399
}
417
400
418
401
/* OpenPGP credentials */
419
gnutls_certificate_allocate_credentials(&mc.cred);
420
if(ret != GNUTLS_E_SUCCESS){
421
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
422
from
423
-Wunreachable-code
424
*/
425
safer_gnutls_strerror(ret));
426
gnutls_global_deinit();
402
gnutls_certificate_allocate_credentials(&mc->cred);
403
if (ret != GNUTLS_E_SUCCESS){
404
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
405
warning */
406
safer_gnutls_strerror(ret));
407
gnutls_global_deinit ();
427
408
return -1;
428
409
}
429
410
434
415
}
435
416
436
417
ret = gnutls_certificate_set_openpgp_key_file
437
(mc.cred, pubkeyfilename, seckeyfilename,
418
(mc->cred, pubkeyfilename, seckeyfilename,
438
419
GNUTLS_OPENPGP_FMT_BASE64);
439
if(ret != GNUTLS_E_SUCCESS){
420
if (ret != GNUTLS_E_SUCCESS) {
440
421
fprintf(stderr,
441
422
"Error[%d] while reading the OpenPGP key pair ('%s',"
442
423
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
446
427
}
447
428
448
429
/* GnuTLS server initialization */
449
ret = gnutls_dh_params_init(&mc.dh_params);
450
if(ret != GNUTLS_E_SUCCESS){
451
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
452
" %s\n", safer_gnutls_strerror(ret));
430
ret = gnutls_dh_params_init(&mc->dh_params);
431
if (ret != GNUTLS_E_SUCCESS) {
432
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
433
" %s\n", safer_gnutls_strerror(ret));
453
434
goto globalfail;
454
435
}
455
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
456
if(ret != GNUTLS_E_SUCCESS){
457
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
458
safer_gnutls_strerror(ret));
436
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
437
if (ret != GNUTLS_E_SUCCESS) {
438
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
439
safer_gnutls_strerror(ret));
459
440
goto globalfail;
460
441
}
461
442
462
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
443
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
463
444
464
445
return 0;
465
446
466
447
globalfail:
467
448
468
gnutls_certificate_free_credentials(mc.cred);
449
gnutls_certificate_free_credentials(mc->cred);
469
450
gnutls_global_deinit();
470
gnutls_dh_params_deinit(mc.dh_params);
451
gnutls_dh_params_deinit(mc->dh_params);
471
452
return -1;
472
453
}
473
454
474
static int init_gnutls_session(gnutls_session_t *session){
455
static int init_gnutls_session(mandos_context *mc,
456
gnutls_session_t *session){
475
457
int ret;
476
458
/* GnuTLS session creation */
477
459
ret = gnutls_init(session, GNUTLS_SERVER);
478
if(ret != GNUTLS_E_SUCCESS){
460
if (ret != GNUTLS_E_SUCCESS){
479
461
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
480
462
safer_gnutls_strerror(ret));
481
463
}
482
464
483
465
{
484
466
const char *err;
485
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
486
if(ret != GNUTLS_E_SUCCESS){
467
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
468
if (ret != GNUTLS_E_SUCCESS) {
487
469
fprintf(stderr, "Syntax error at: %s\n", err);
488
470
fprintf(stderr, "GnuTLS error: %s\n",
489
471
safer_gnutls_strerror(ret));
490
gnutls_deinit(*session);
472
gnutls_deinit (*session);
491
473
return -1;
492
474
}
493
475
}
494
476
495
477
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
496
mc.cred);
497
if(ret != GNUTLS_E_SUCCESS){
478
mc->cred);
479
if (ret != GNUTLS_E_SUCCESS) {
498
480
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
499
481
safer_gnutls_strerror(ret));
500
gnutls_deinit(*session);
482
gnutls_deinit (*session);
501
483
return -1;
502
484
}
503
485
504
486
/* ignore client certificate if any. */
505
gnutls_certificate_server_set_request(*session,
506
GNUTLS_CERT_IGNORE);
487
gnutls_certificate_server_set_request (*session,
488
GNUTLS_CERT_IGNORE);
507
489
508
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
490
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
509
491
510
492
return 0;
511
493
}
517
499
/* Called when a Mandos server is found */
518
500
static int start_mandos_communication(const char *ip, uint16_t port,
519
501
AvahiIfIndex if_index,
520
int af){
502
mandos_context *mc){
521
503
int ret, tcp_sd;
522
ssize_t sret;
523
union {
524
struct sockaddr_in in;
525
struct sockaddr_in6 in6;
526
} to;
504
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
527
505
char *buffer = NULL;
528
506
char *decrypted_buffer;
529
507
size_t buffer_length = 0;
531
509
ssize_t decrypted_buffer_size;
532
510
size_t written;
533
511
int retval = 0;
512
char interface[IF_NAMESIZE];
534
513
gnutls_session_t session;
535
int pf; /* Protocol family */
536
537
switch(af){
538
case AF_INET6:
539
pf = PF_INET6;
540
break;
541
case AF_INET:
542
pf = PF_INET;
543
break;
544
default:
545
fprintf(stderr, "Bad address family: %d\n", af);
546
return -1;
547
}
548
549
ret = init_gnutls_session(&session);
550
if(ret != 0){
514
515
ret = init_gnutls_session (mc, &session);
516
if (ret != 0){
551
517
return -1;
552
518
}
553
519
554
520
if(debug){
555
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
521
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
556
522
"\n", ip, port);
557
523
}
558
524
559
tcp_sd = socket(pf, SOCK_STREAM, 0);
560
if(tcp_sd < 0){
525
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
526
if(tcp_sd < 0) {
561
527
perror("socket");
562
528
return -1;
563
529
}
564
530
531
if(debug){
532
if(if_indextoname((unsigned int)if_index, interface) == NULL){
533
perror("if_indextoname");
534
return -1;
535
}
536
fprintf(stderr, "Binding to interface %s\n", interface);
537
}
538
565
539
memset(&to, 0, sizeof(to));
566
if(af == AF_INET6){
567
to.in6.sin6_family = (sa_family_t)af;
568
ret = inet_pton(af, ip, &to.in6.sin6_addr);
569
} else { /* IPv4 */
570
to.in.sin_family = (sa_family_t)af;
571
ret = inet_pton(af, ip, &to.in.sin_addr);
572
}
573
if(ret < 0 ){
540
to.in6.sin6_family = AF_INET6;
541
/* It would be nice to have a way to detect if we were passed an
542
IPv4 address here. Now we assume an IPv6 address. */
543
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
544
if (ret < 0 ){
574
545
perror("inet_pton");
575
546
return -1;
576
547
}
578
549
fprintf(stderr, "Bad address: %s\n", ip);
579
550
return -1;
580
551
}
581
if(af == AF_INET6){
582
to.in6.sin6_port = htons(port); /* Spurious warnings from
583
-Wconversion and
584
-Wunreachable-code */
585
586
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
587
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
588
-Wunreachable-code*/
589
if(if_index == AVAHI_IF_UNSPEC){
590
fprintf(stderr, "An IPv6 link-local address is incomplete"
591
" without a network interface\n");
592
return -1;
593
}
594
/* Set the network interface number as scope */
595
to.in6.sin6_scope_id = (uint32_t)if_index;
596
}
597
} else {
598
to.in.sin_port = htons(port); /* Spurious warnings from
599
-Wconversion and
600
-Wunreachable-code */
601
}
552
to.in6.sin6_port = htons(port); /* Spurious warning */
553
554
to.in6.sin6_scope_id = (uint32_t)if_index;
602
555
603
556
if(debug){
604
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
605
char interface[IF_NAMESIZE];
606
if(if_indextoname((unsigned int)if_index, interface) == NULL){
607
perror("if_indextoname");
608
} else {
609
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
610
ip, interface, port);
611
}
612
} else {
613
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
614
port);
615
}
616
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
617
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
618
const char *pcret;
619
if(af == AF_INET6){
620
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
621
sizeof(addrstr));
622
} else {
623
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
624
sizeof(addrstr));
625
}
626
if(pcret == NULL){
557
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
558
port);
559
char addrstr[INET6_ADDRSTRLEN] = "";
560
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
561
sizeof(addrstr)) == NULL){
627
562
perror("inet_ntop");
628
563
} else {
629
564
if(strcmp(addrstr, ip) != 0){
632
567
}
633
568
}
634
569
635
if(af == AF_INET6){
636
ret = connect(tcp_sd, &to.in6, sizeof(to));
637
} else {
638
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
639
}
640
if(ret < 0){
570
ret = connect(tcp_sd, &to.in, sizeof(to));
571
if (ret < 0){
641
572
perror("connect");
642
573
return -1;
643
574
}
644
575
645
576
const char *out = mandos_protocol_version;
646
577
written = 0;
647
while(true){
578
while (true){
648
579
size_t out_size = strlen(out);
649
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
580
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
650
581
out_size - written));
651
if(ret == -1){
582
if (ret == -1){
652
583
perror("write");
653
584
retval = -1;
654
585
goto mandos_end;
657
588
if(written < out_size){
658
589
continue;
659
590
} else {
660
if(out == mandos_protocol_version){
591
if (out == mandos_protocol_version){
661
592
written = 0;
662
593
out = "\r\n";
663
594
} else {
670
601
fprintf(stderr, "Establishing TLS session with %s\n", ip);
671
602
}
672
603
673
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
604
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
674
605
675
606
do{
676
ret = gnutls_handshake(session);
607
ret = gnutls_handshake (session);
677
608
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
678
609
679
if(ret != GNUTLS_E_SUCCESS){
610
if (ret != GNUTLS_E_SUCCESS){
680
611
if(debug){
681
612
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
682
gnutls_perror(ret);
613
gnutls_perror (ret);
683
614
}
684
615
retval = -1;
685
616
goto mandos_end;
688
619
/* Read OpenPGP packet that contains the wanted password */
689
620
690
621
if(debug){
691
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
622
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
692
623
ip);
693
624
}
694
625
695
626
while(true){
696
buffer_capacity = incbuffer(&buffer, buffer_length,
627
buffer_capacity = adjustbuffer(&buffer, buffer_length,
697
628
buffer_capacity);
698
if(buffer_capacity == 0){
699
perror("incbuffer");
629
if (buffer_capacity == 0){
630
perror("adjustbuffer");
700
631
retval = -1;
701
632
goto mandos_end;
702
633
}
703
634
704
sret = gnutls_record_recv(session, buffer+buffer_length,
705
BUFFER_SIZE);
706
if(sret == 0){
635
ret = gnutls_record_recv(session, buffer+buffer_length,
636
BUFFER_SIZE);
637
if (ret == 0){
707
638
break;
708
639
}
709
if(sret < 0){
710
switch(sret){
640
if (ret < 0){
641
switch(ret){
711
642
case GNUTLS_E_INTERRUPTED:
712
643
case GNUTLS_E_AGAIN:
713
644
break;
714
645
case GNUTLS_E_REHANDSHAKE:
715
646
do{
716
ret = gnutls_handshake(session);
647
ret = gnutls_handshake (session);
717
648
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
718
if(ret < 0){
649
if (ret < 0){
719
650
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
720
gnutls_perror(ret);
651
gnutls_perror (ret);
721
652
retval = -1;
722
653
goto mandos_end;
723
654
}
726
657
fprintf(stderr, "Unknown error while reading data from"
727
658
" encrypted session with Mandos server\n");
728
659
retval = -1;
729
gnutls_bye(session, GNUTLS_SHUT_RDWR);
660
gnutls_bye (session, GNUTLS_SHUT_RDWR);
730
661
goto mandos_end;
731
662
}
732
663
} else {
733
buffer_length += (size_t) sret;
664
buffer_length += (size_t) ret;
734
665
}
735
666
}
736
667
738
669
fprintf(stderr, "Closing TLS session\n");
739
670
}
740
671
741
gnutls_bye(session, GNUTLS_SHUT_RDWR);
672
gnutls_bye (session, GNUTLS_SHUT_RDWR);
742
673
743
if(buffer_length > 0){
744
decrypted_buffer_size = pgp_packet_decrypt(buffer,
674
if (buffer_length > 0){
675
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
745
676
buffer_length,
746
677
&decrypted_buffer);
747
if(decrypted_buffer_size >= 0){
678
if (decrypted_buffer_size >= 0){
748
679
written = 0;
749
680
while(written < (size_t) decrypted_buffer_size){
750
ret = (int)fwrite(decrypted_buffer + written, 1,
751
(size_t)decrypted_buffer_size - written,
752
stdout);
681
ret = (int)fwrite (decrypted_buffer + written, 1,
682
(size_t)decrypted_buffer_size - written,
683
stdout);
753
684
if(ret == 0 and ferror(stdout)){
754
685
if(debug){
755
686
fprintf(stderr, "Error writing encrypted data: %s\n",
772
703
773
704
mandos_end:
774
705
free(buffer);
775
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
706
ret = TEMP_FAILURE_RETRY(close(tcp_sd));
776
707
if(ret == -1){
777
708
perror("close");
778
709
}
779
gnutls_deinit(session);
710
gnutls_deinit (session);
780
711
return retval;
781
712
}
782
713
783
714
static void resolve_callback(AvahiSServiceResolver *r,
784
715
AvahiIfIndex interface,
785
AvahiProtocol proto,
716
AVAHI_GCC_UNUSED AvahiProtocol protocol,
786
717
AvahiResolverEvent event,
787
718
const char *name,
788
719
const char *type,
793
724
AVAHI_GCC_UNUSED AvahiStringList *txt,
794
725
AVAHI_GCC_UNUSED AvahiLookupResultFlags
795
726
flags,
796
AVAHI_GCC_UNUSED void* userdata){
727
void* userdata) {
728
mandos_context *mc = userdata;
797
729
assert(r);
798
730
799
731
/* Called whenever a service has been resolved successfully or
800
732
timed out */
801
733
802
switch(event){
734
switch (event) {
803
735
default:
804
736
case AVAHI_RESOLVER_FAILURE:
805
737
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
806
738
" of type '%s' in domain '%s': %s\n", name, type, domain,
807
avahi_strerror(avahi_server_errno(mc.server)));
739
avahi_strerror(avahi_server_errno(mc->server)));
808
740
break;
809
741
810
742
case AVAHI_RESOLVER_FOUND:
813
745
avahi_address_snprint(ip, sizeof(ip), address);
814
746
if(debug){
815
747
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
816
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
817
ip, (intmax_t)interface, port);
748
PRIu16 ") on port %d\n", name, host_name, ip,
749
interface, port);
818
750
}
819
int ret = start_mandos_communication(ip, port, interface,
820
avahi_proto_to_af(proto));
821
if(ret == 0){
822
avahi_simple_poll_quit(mc.simple_poll);
751
int ret = start_mandos_communication(ip, port, interface, mc);
752
if (ret == 0){
753
avahi_simple_poll_quit(mc->simple_poll);
823
754
}
824
755
}
825
756
}
826
757
avahi_s_service_resolver_free(r);
827
758
}
828
759
829
static void browse_callback(AvahiSServiceBrowser *b,
830
AvahiIfIndex interface,
831
AvahiProtocol protocol,
832
AvahiBrowserEvent event,
833
const char *name,
834
const char *type,
835
const char *domain,
836
AVAHI_GCC_UNUSED AvahiLookupResultFlags
837
flags,
838
AVAHI_GCC_UNUSED void* userdata){
760
static void browse_callback( AvahiSServiceBrowser *b,
761
AvahiIfIndex interface,
762
AvahiProtocol protocol,
763
AvahiBrowserEvent event,
764
const char *name,
765
const char *type,
766
const char *domain,
767
AVAHI_GCC_UNUSED AvahiLookupResultFlags
768
flags,
769
void* userdata) {
770
mandos_context *mc = userdata;
839
771
assert(b);
840
772
841
773
/* Called whenever a new services becomes available on the LAN or
842
774
is removed from the LAN */
843
775
844
switch(event){
776
switch (event) {
845
777
default:
846
778
case AVAHI_BROWSER_FAILURE:
847
779
848
780
fprintf(stderr, "(Avahi browser) %s\n",
849
avahi_strerror(avahi_server_errno(mc.server)));
850
avahi_simple_poll_quit(mc.simple_poll);
781
avahi_strerror(avahi_server_errno(mc->server)));
782
avahi_simple_poll_quit(mc->simple_poll);
851
783
return;
852
784
853
785
case AVAHI_BROWSER_NEW:
856
788
the callback function is called the Avahi server will free the
857
789
resolver for us. */
858
790
859
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
860
name, type, domain, protocol, 0,
861
resolve_callback, NULL) == NULL)
791
if (!(avahi_s_service_resolver_new(mc->server, interface,
792
protocol, name, type, domain,
793
AVAHI_PROTO_INET6, 0,
794
resolve_callback, mc)))
862
795
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
863
name, avahi_strerror(avahi_server_errno(mc.server)));
796
name, avahi_strerror(avahi_server_errno(mc->server)));
864
797
break;
865
798
866
799
case AVAHI_BROWSER_REMOVE:
875
808
}
876
809
}
877
810
878
sig_atomic_t quit_now = 0;
879
880
/* stop main loop after sigterm has been called */
881
static void handle_sigterm(__attribute__((unused)) int sig){
882
if(quit_now){
883
return;
884
}
885
quit_now = 1;
886
int old_errno = errno;
887
if(mc.simple_poll != NULL){
888
avahi_simple_poll_quit(mc.simple_poll);
889
}
890
errno = old_errno;
891
}
892
893
811
int main(int argc, char *argv[]){
894
AvahiSServiceBrowser *sb = NULL;
895
int error;
896
int ret;
897
intmax_t tmpmax;
898
char *tmp;
899
int exitcode = EXIT_SUCCESS;
900
const char *interface = "eth0";
901
struct ifreq network;
902
int sd = -1;
903
bool interface_taken_up = false;
904
uid_t uid;
905
gid_t gid;
906
char *connect_to = NULL;
907
char tempdir[] = "/tmp/mandosXXXXXX";
908
bool tempdir_created = false;
909
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
910
const char *seckey = PATHDIR "/" SECKEY;
911
const char *pubkey = PATHDIR "/" PUBKEY;
912
913
bool gnutls_initialized = false;
914
bool gpgme_initialized = false;
915
float delay = 2.5f;
916
917
struct sigaction old_sigterm_action;
918
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
919
920
{
921
struct argp_option options[] = {
922
{ .name = "debug", .key = 128,
923
.doc = "Debug mode", .group = 3 },
924
{ .name = "connect", .key = 'c',
925
.arg = "ADDRESS:PORT",
926
.doc = "Connect directly to a specific Mandos server",
927
.group = 1 },
928
{ .name = "interface", .key = 'i',
929
.arg = "NAME",
930
.doc = "Network interface that will be used to search for"
931
" Mandos servers",
932
.group = 1 },
933
{ .name = "seckey", .key = 's',
934
.arg = "FILE",
935
.doc = "OpenPGP secret key file base name",
936
.group = 1 },
937
{ .name = "pubkey", .key = 'p',
938
.arg = "FILE",
939
.doc = "OpenPGP public key file base name",
940
.group = 2 },
941
{ .name = "dh-bits", .key = 129,
942
.arg = "BITS",
943
.doc = "Bit length of the prime number used in the"
944
" Diffie-Hellman key exchange",
945
.group = 2 },
946
{ .name = "priority", .key = 130,
947
.arg = "STRING",
948
.doc = "GnuTLS priority string for the TLS handshake",
949
.group = 1 },
950
{ .name = "delay", .key = 131,
951
.arg = "SECONDS",
952
.doc = "Maximum delay to wait for interface startup",
953
.group = 2 },
954
{ .name = NULL }
955
};
956
957
error_t parse_opt(int key, char *arg,
958
struct argp_state *state){
959
switch(key){
960
case 128: /* --debug */
961
debug = true;
962
break;
963
case 'c': /* --connect */
964
connect_to = arg;
965
break;
966
case 'i': /* --interface */
967
interface = arg;
968
break;
969
case 's': /* --seckey */
970
seckey = arg;
971
break;
972
case 'p': /* --pubkey */
973
pubkey = arg;
974
break;
975
case 129: /* --dh-bits */
976
errno = 0;
977
tmpmax = strtoimax(arg, &tmp, 10);
978
if(errno != 0 or tmp == arg or *tmp != '\0'
979
or tmpmax != (typeof(mc.dh_bits))tmpmax){
980
fprintf(stderr, "Bad number of DH bits\n");
981
exit(EXIT_FAILURE);
982
}
983
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
984
break;
985
case 130: /* --priority */
986
mc.priority = arg;
987
break;
988
case 131: /* --delay */
989
errno = 0;
990
delay = strtof(arg, &tmp);
991
if(errno != 0 or tmp == arg or *tmp != '\0'){
992
fprintf(stderr, "Bad delay\n");
993
exit(EXIT_FAILURE);
994
}
995
break;
996
case ARGP_KEY_ARG:
997
argp_usage(state);
998
case ARGP_KEY_END:
999
break;
1000
default:
1001
return ARGP_ERR_UNKNOWN;
1002
}
1003
return 0;
1004
}
1005
1006
struct argp argp = { .options = options, .parser = parse_opt,
1007
.args_doc = "",
1008
.doc = "Mandos client -- Get and decrypt"
1009
" passwords from a Mandos server" };
1010
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1011
if(ret == ARGP_ERR_UNKNOWN){
1012
fprintf(stderr, "Unknown error while parsing arguments\n");
1013
exitcode = EXIT_FAILURE;
1014
goto end;
1015
}
1016
}
1017
1018
if(not debug){
1019
avahi_set_log_function(empty_log);
1020
}
1021
1022
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1023
from the signal handler */
1024
/* Initialize the pseudo-RNG for Avahi */
1025
srand((unsigned int) time(NULL));
1026
mc.simple_poll = avahi_simple_poll_new();
1027
if(mc.simple_poll == NULL){
1028
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1029
exitcode = EXIT_FAILURE;
1030
goto end;
1031
}
1032
1033
sigemptyset(&sigterm_action.sa_mask);
1034
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1035
if(ret == -1){
1036
perror("sigaddset");
1037
exitcode = EXIT_FAILURE;
1038
goto end;
1039
}
1040
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1041
if(ret == -1){
1042
perror("sigaddset");
1043
exitcode = EXIT_FAILURE;
1044
goto end;
1045
}
1046
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1047
if(ret == -1){
1048
perror("sigaddset");
1049
exitcode = EXIT_FAILURE;
1050
goto end;
1051
}
1052
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1053
if(ret == -1){
1054
perror("sigaction");
1055
exitcode = EXIT_FAILURE;
1056
goto end;
1057
}
1058
1059
/* If the interface is down, bring it up */
1060
if(interface[0] != '\0'){
1061
#ifdef __linux__
1062
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1063
messages to mess up the prompt */
1064
ret = klogctl(8, NULL, 5);
1065
bool restore_loglevel = true;
1066
if(ret == -1){
1067
restore_loglevel = false;
1068
perror("klogctl");
1069
}
1070
#endif /* __linux__ */
1071
1072
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1073
if(sd < 0){
1074
perror("socket");
1075
exitcode = EXIT_FAILURE;
1076
#ifdef __linux__
1077
if(restore_loglevel){
1078
ret = klogctl(7, NULL, 0);
1079
if(ret == -1){
1080
perror("klogctl");
1081
}
1082
}
1083
#endif /* __linux__ */
1084
goto end;
1085
}
1086
strcpy(network.ifr_name, interface);
1087
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1088
if(ret == -1){
1089
perror("ioctl SIOCGIFFLAGS");
1090
#ifdef __linux__
1091
if(restore_loglevel){
1092
ret = klogctl(7, NULL, 0);
1093
if(ret == -1){
1094
perror("klogctl");
1095
}
1096
}
1097
#endif /* __linux__ */
1098
exitcode = EXIT_FAILURE;
1099
goto end;
1100
}
1101
if((network.ifr_flags & IFF_UP) == 0){
1102
network.ifr_flags |= IFF_UP;
1103
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1104
if(ret == -1){
1105
perror("ioctl SIOCSIFFLAGS");
1106
exitcode = EXIT_FAILURE;
1107
#ifdef __linux__
1108
if(restore_loglevel){
1109
ret = klogctl(7, NULL, 0);
1110
if(ret == -1){
1111
perror("klogctl");
812
AvahiSServiceBrowser *sb = NULL;
813
int error;
814
int ret;
815
int exitcode = EXIT_SUCCESS;
816
const char *interface = "eth0";
817
struct ifreq network;
818
int sd;
819
uid_t uid;
820
gid_t gid;
821
char *connect_to = NULL;
822
char tempdir[] = "/tmp/mandosXXXXXX";
823
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
824
const char *seckey = PATHDIR "/" SECKEY;
825
const char *pubkey = PATHDIR "/" PUBKEY;
826
827
mandos_context mc = { .simple_poll = NULL, .server = NULL,
828
.dh_bits = 1024, .priority = "SECURE256"
829
":!CTYPE-X.509:+CTYPE-OPENPGP" };
830
bool gnutls_initalized = false;
831
bool gpgme_initalized = false;
832
833
{
834
struct argp_option options[] = {
835
{ .name = "debug", .key = 128,
836
.doc = "Debug mode", .group = 3 },
837
{ .name = "connect", .key = 'c',
838
.arg = "ADDRESS:PORT",
839
.doc = "Connect directly to a specific Mandos server",
840
.group = 1 },
841
{ .name = "interface", .key = 'i',
842
.arg = "NAME",
843
.doc = "Interface that will be used to search for Mandos"
844
" servers",
845
.group = 1 },
846
{ .name = "seckey", .key = 's',
847
.arg = "FILE",
848
.doc = "OpenPGP secret key file base name",
849
.group = 1 },
850
{ .name = "pubkey", .key = 'p',
851
.arg = "FILE",
852
.doc = "OpenPGP public key file base name",
853
.group = 2 },
854
{ .name = "dh-bits", .key = 129,
855
.arg = "BITS",
856
.doc = "Bit length of the prime number used in the"
857
" Diffie-Hellman key exchange",
858
.group = 2 },
859
{ .name = "priority", .key = 130,
860
.arg = "STRING",
861
.doc = "GnuTLS priority string for the TLS handshake",
862
.group = 1 },
863
{ .name = NULL }
864
};
865
866
error_t parse_opt (int key, char *arg,
867
struct argp_state *state) {
868
/* Get the INPUT argument from `argp_parse', which we know is
869
a pointer to our plugin list pointer. */
870
switch (key) {
871
case 128: /* --debug */
872
debug = true;
873
break;
874
case 'c': /* --connect */
875
connect_to = arg;
876
break;
877
case 'i': /* --interface */
878
interface = arg;
879
break;
880
case 's': /* --seckey */
881
seckey = arg;
882
break;
883
case 'p': /* --pubkey */
884
pubkey = arg;
885
break;
886
case 129: /* --dh-bits */
887
errno = 0;
888
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
889
if (errno){
890
perror("strtol");
891
exit(EXIT_FAILURE);
1112
892
}
893
break;
894
case 130: /* --priority */
895
mc.priority = arg;
896
break;
897
case ARGP_KEY_ARG:
898
argp_usage (state);
899
case ARGP_KEY_END:
900
break;
901
default:
902
return ARGP_ERR_UNKNOWN;
1113
903
}
1114
#endif /* __linux__ */
904
return 0;
905
}
906
907
struct argp argp = { .options = options, .parser = parse_opt,
908
.args_doc = "",
909
.doc = "Mandos client -- Get and decrypt"
910
" passwords from a Mandos server" };
911
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
912
if (ret == ARGP_ERR_UNKNOWN){
913
fprintf(stderr, "Unknown error while parsing arguments\n");
914
exitcode = EXIT_FAILURE;
1115
915
goto end;
1116
916
}
1117
interface_taken_up = true;
1118
917
}
1119
/* sleep checking until interface is running */
1120
for(int i=0; i < delay * 4; i++){
918
919
/* If the interface is down, bring it up */
920
{
921
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
922
if(sd < 0) {
923
perror("socket");
924
exitcode = EXIT_FAILURE;
925
goto end;
926
}
927
strcpy(network.ifr_name, interface);
1121
928
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1122
929
if(ret == -1){
1123
930
perror("ioctl SIOCGIFFLAGS");
1124
} else if(network.ifr_flags & IFF_RUNNING){
1125
break;
1126
}
1127
struct timespec sleeptime = { .tv_nsec = 250000000 };
1128
ret = nanosleep(&sleeptime, NULL);
1129
if(ret == -1 and errno != EINTR){
1130
perror("nanosleep");
1131
}
1132
}
1133
if(not interface_taken_up){
1134
ret = (int)TEMP_FAILURE_RETRY(close(sd));
931
exitcode = EXIT_FAILURE;
932
goto end;
933
}
934
if((network.ifr_flags & IFF_UP) == 0){
935
network.ifr_flags |= IFF_UP;
936
ret = ioctl(sd, SIOCSIFFLAGS, &network);
937
if(ret == -1){
938
perror("ioctl SIOCSIFFLAGS");
939
exitcode = EXIT_FAILURE;
940
goto end;
941
}
942
}
943
ret = TEMP_FAILURE_RETRY(close(sd));
1135
944
if(ret == -1){
1136
945
perror("close");
1137
946
}
1138
947
}
1139
#ifdef __linux__
1140
if(restore_loglevel){
1141
/* Restores kernel loglevel to default */
1142
ret = klogctl(7, NULL, 0);
1143
if(ret == -1){
1144
perror("klogctl");
1145
}
1146
}
1147
#endif /* __linux__ */
1148
}
1149
1150
uid = getuid();
1151
gid = getgid();
1152
1153
errno = 0;
1154
setgid(gid);
1155
if(ret == -1){
1156
perror("setgid");
1157
}
1158
1159
ret = setuid(uid);
1160
if(ret == -1){
1161
perror("setuid");
1162
}
1163
1164
ret = init_gnutls_global(pubkey, seckey);
1165
if(ret == -1){
1166
fprintf(stderr, "init_gnutls_global failed\n");
1167
exitcode = EXIT_FAILURE;
1168
goto end;
1169
} else {
1170
gnutls_initialized = true;
1171
}
1172
1173
if(mkdtemp(tempdir) == NULL){
1174
perror("mkdtemp");
1175
goto end;
1176
}
1177
tempdir_created = true;
1178
1179
if(not init_gpgme(pubkey, seckey, tempdir)){
1180
fprintf(stderr, "init_gpgme failed\n");
1181
exitcode = EXIT_FAILURE;
1182
goto end;
1183
} else {
1184
gpgme_initialized = true;
1185
}
1186
1187
if(interface[0] != '\0'){
948
949
uid = getuid();
950
gid = getgid();
951
952
ret = setuid(uid);
953
if (ret == -1){
954
perror("setuid");
955
}
956
957
setgid(gid);
958
if (ret == -1){
959
perror("setgid");
960
}
961
962
ret = init_gnutls_global(&mc, pubkey, seckey);
963
if (ret == -1){
964
fprintf(stderr, "init_gnutls_global failed\n");
965
exitcode = EXIT_FAILURE;
966
goto end;
967
} else {
968
gnutls_initalized = true;
969
}
970
971
if(mkdtemp(tempdir) == NULL){
972
perror("mkdtemp");
973
tempdir[0] = '\0';
974
goto end;
975
}
976
977
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
978
fprintf(stderr, "gpgme_initalized failed\n");
979
exitcode = EXIT_FAILURE;
980
goto end;
981
} else {
982
gpgme_initalized = true;
983
}
984
1188
985
if_index = (AvahiIfIndex) if_nametoindex(interface);
1189
986
if(if_index == 0){
1190
987
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1191
exitcode = EXIT_FAILURE;
1192
goto end;
1193
}
1194
}
1195
1196
if(connect_to != NULL){
1197
/* Connect directly, do not use Zeroconf */
1198
/* (Mainly meant for debugging) */
1199
char *address = strrchr(connect_to, ':');
1200
if(address == NULL){
1201
fprintf(stderr, "No colon in address\n");
1202
exitcode = EXIT_FAILURE;
1203
goto end;
1204
}
1205
uint16_t port;
1206
errno = 0;
1207
tmpmax = strtoimax(address+1, &tmp, 10);
1208
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1209
or tmpmax != (uint16_t)tmpmax){
1210
fprintf(stderr, "Bad port number\n");
1211
exitcode = EXIT_FAILURE;
1212
goto end;
1213
}
1214
port = (uint16_t)tmpmax;
1215
*address = '\0';
1216
address = connect_to;
1217
/* Colon in address indicates IPv6 */
1218
int af;
1219
if(strchr(address, ':') != NULL){
1220
af = AF_INET6;
1221
} else {
1222
af = AF_INET;
1223
}
1224
ret = start_mandos_communication(address, port, if_index, af);
1225
if(ret < 0){
1226
exitcode = EXIT_FAILURE;
1227
} else {
1228
exitcode = EXIT_SUCCESS;
1229
}
1230
goto end;
1231
}
1232
1233
{
1234
AvahiServerConfig config;
1235
/* Do not publish any local Zeroconf records */
1236
avahi_server_config_init(&config);
1237
config.publish_hinfo = 0;
1238
config.publish_addresses = 0;
1239
config.publish_workstation = 0;
1240
config.publish_domain = 0;
1241
1242
/* Allocate a new server */
1243
mc.server = avahi_server_new(avahi_simple_poll_get
1244
(mc.simple_poll), &config, NULL,
1245
NULL, &error);
1246
1247
/* Free the Avahi configuration data */
1248
avahi_server_config_free(&config);
1249
}
1250
1251
/* Check if creating the Avahi server object succeeded */
1252
if(mc.server == NULL){
1253
fprintf(stderr, "Failed to create Avahi server: %s\n",
1254
avahi_strerror(error));
1255
exitcode = EXIT_FAILURE;
1256
goto end;
1257
}
1258
1259
/* Create the Avahi service browser */
1260
sb = avahi_s_service_browser_new(mc.server, if_index,
1261
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1262
NULL, 0, browse_callback, NULL);
1263
if(sb == NULL){
1264
fprintf(stderr, "Failed to create service browser: %s\n",
1265
avahi_strerror(avahi_server_errno(mc.server)));
1266
exitcode = EXIT_FAILURE;
1267
goto end;
1268
}
1269
1270
/* Run the main loop */
1271
1272
if(debug){
1273
fprintf(stderr, "Starting Avahi loop search\n");
1274
}
1275
1276
avahi_simple_poll_loop(mc.simple_poll);
1277
988
exit(EXIT_FAILURE);
989
}
990
991
if(connect_to != NULL){
992
/* Connect directly, do not use Zeroconf */
993
/* (Mainly meant for debugging) */
994
char *address = strrchr(connect_to, ':');
995
if(address == NULL){
996
fprintf(stderr, "No colon in address\n");
997
exitcode = EXIT_FAILURE;
998
goto end;
999
}
1000
errno = 0;
1001
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
1002
if(errno){
1003
perror("Bad port number");
1004
exitcode = EXIT_FAILURE;
1005
goto end;
1006
}
1007
*address = '\0';
1008
address = connect_to;
1009
ret = start_mandos_communication(address, port, if_index, &mc);
1010
if(ret < 0){
1011
exitcode = EXIT_FAILURE;
1012
} else {
1013
exitcode = EXIT_SUCCESS;
1014
}
1015
goto end;
1016
}
1017
1018
if (not debug){
1019
avahi_set_log_function(empty_log);
1020
}
1021
1022
/* Initialize the pseudo-RNG for Avahi */
1023
srand((unsigned int) time(NULL));
1024
1025
/* Allocate main Avahi loop object */
1026
mc.simple_poll = avahi_simple_poll_new();
1027
if (mc.simple_poll == NULL) {
1028
fprintf(stderr, "Avahi: Failed to create simple poll"
1029
" object.\n");
1030
exitcode = EXIT_FAILURE;
1031
goto end;
1032
}
1033
1034
{
1035
AvahiServerConfig config;
1036
/* Do not publish any local Zeroconf records */
1037
avahi_server_config_init(&config);
1038
config.publish_hinfo = 0;
1039
config.publish_addresses = 0;
1040
config.publish_workstation = 0;
1041
config.publish_domain = 0;
1042
1043
/* Allocate a new server */
1044
mc.server = avahi_server_new(avahi_simple_poll_get
1045
(mc.simple_poll), &config, NULL,
1046
NULL, &error);
1047
1048
/* Free the Avahi configuration data */
1049
avahi_server_config_free(&config);
1050
}
1051
1052
/* Check if creating the Avahi server object succeeded */
1053
if (mc.server == NULL) {
1054
fprintf(stderr, "Failed to create Avahi server: %s\n",
1055
avahi_strerror(error));
1056
exitcode = EXIT_FAILURE;
1057
goto end;
1058
}
1059
1060
/* Create the Avahi service browser */
1061
sb = avahi_s_service_browser_new(mc.server, if_index,
1062
AVAHI_PROTO_INET6,
1063
"_mandos._tcp", NULL, 0,
1064
browse_callback, &mc);
1065
if (sb == NULL) {
1066
fprintf(stderr, "Failed to create service browser: %s\n",
1067
avahi_strerror(avahi_server_errno(mc.server)));
1068
exitcode = EXIT_FAILURE;
1069
goto end;
1070
}
1071
1072
/* Run the main loop */
1073
1074
if (debug){
1075
fprintf(stderr, "Starting Avahi loop search\n");
1076
}
1077
1078
avahi_simple_poll_loop(mc.simple_poll);
1079
1278
1080
end:
1279
1280
if(debug){
1281
fprintf(stderr, "%s exiting\n", argv[0]);
1282
}
1283
1284
/* Cleanup things */
1285
if(sb != NULL)
1286
avahi_s_service_browser_free(sb);
1287
1288
if(mc.server != NULL)
1289
avahi_server_free(mc.server);
1290
1291
if(mc.simple_poll != NULL)
1292
avahi_simple_poll_free(mc.simple_poll);
1293
1294
if(gnutls_initialized){
1295
gnutls_certificate_free_credentials(mc.cred);
1296
gnutls_global_deinit();
1297
gnutls_dh_params_deinit(mc.dh_params);
1298
}
1299
1300
if(gpgme_initialized){
1301
gpgme_release(mc.ctx);
1302
}
1303
1304
/* Take down the network interface */
1305
if(interface_taken_up){
1306
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1307
if(ret == -1){
1308
perror("ioctl SIOCGIFFLAGS");
1309
} else if(network.ifr_flags & IFF_UP) {
1310
network.ifr_flags &= ~IFF_UP; /* clear flag */
1311
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1312
if(ret == -1){
1313
perror("ioctl SIOCSIFFLAGS");
1314
}
1315
}
1316
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1317
if(ret == -1){
1318
perror("close");
1319
}
1320
}
1321
1322
/* Removes the temp directory used by GPGME */
1323
if(tempdir_created){
1324
DIR *d;
1325
struct dirent *direntry;
1326
d = opendir(tempdir);
1327
if(d == NULL){
1328
if(errno != ENOENT){
1081
1082
if (debug){
1083
fprintf(stderr, "%s exiting\n", argv[0]);
1084
}
1085
1086
/* Cleanup things */
1087
if (sb != NULL)
1088
avahi_s_service_browser_free(sb);
1089
1090
if (mc.server != NULL)
1091
avahi_server_free(mc.server);
1092
1093
if (mc.simple_poll != NULL)
1094
avahi_simple_poll_free(mc.simple_poll);
1095
1096
if (gnutls_initalized){
1097
gnutls_certificate_free_credentials(mc.cred);
1098
gnutls_global_deinit ();
1099
gnutls_dh_params_deinit(mc.dh_params);
1100
}
1101
1102
if(gpgme_initalized){
1103
gpgme_release(mc.ctx);
1104
}
1105
1106
/* Removes the temp directory used by GPGME */
1107
if(tempdir[0] != '\0'){
1108
DIR *d;
1109
struct dirent *direntry;
1110
d = opendir(tempdir);
1111
if(d == NULL){
1329
1112
perror("opendir");
1330
}
1331
} else {
1332
while(true){
1333
direntry = readdir(d);
1334
if(direntry == NULL){
1335
break;
1336
}
1337
/* Skip "." and ".." */
1338
if(direntry->d_name[0] == '.'
1339
and (direntry->d_name[1] == '\0'
1340
or (direntry->d_name[1] == '.'
1341
and direntry->d_name[2] == '\0'))){
1342
continue;
1343
}
1344
char *fullname = NULL;
1345
ret = asprintf(&fullname, "%s/%s", tempdir,
1346
direntry->d_name);
1347
if(ret < 0){
1348
perror("asprintf");
1349
continue;
1350
}
1351
ret = remove(fullname);
1352
if(ret == -1){
1353
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1354
strerror(errno));
1355
}
1356
free(fullname);
1357
}
1358
closedir(d);
1359
}
1360
ret = rmdir(tempdir);
1361
if(ret == -1 and errno != ENOENT){
1362
perror("rmdir");
1363
}
1364
}
1365
1366
return exitcode;
1113
} else {
1114
while(true){
1115
direntry = readdir(d);
1116
if(direntry == NULL){
1117
break;
1118
}
1119
if (direntry->d_type == DT_REG){
1120
char *fullname = NULL;
1121
ret = asprintf(&fullname, "%s/%s", tempdir,
1122
direntry->d_name);
1123
if(ret < 0){
1124
perror("asprintf");
1125
continue;
1126
}
1127
ret = unlink(fullname);
1128
if(ret == -1){
1129
fprintf(stderr, "unlink(\"%s\"): %s",
1130
fullname, strerror(errno));
1131
}
1132
free(fullname);
1133
}
1134
}
1135
closedir(d);
1136
}
1137
ret = rmdir(tempdir);
1138
if(ret == -1){
1139
perror("rmdir");
1140
}
1141
}
1142
1143
return exitcode;
1367
1144
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0