32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
33
34
#define _LARGEFILE_SOURCE
36
#ifndef _FILE_OFFSET_BITS
34
37
#define _FILE_OFFSET_BITS 64
36
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
38
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror(), sscanf(),
43
stdout, ferror(), remove() */
41
44
#include <stdint.h> /* uint16_t, uint32_t */
42
45
#include <stddef.h> /* NULL, size_t, ssize_t */
43
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
45
48
#include <stdbool.h> /* bool, false, true */
46
49
#include <string.h> /* memset(), strcmp(), strlen(),
47
50
strerror(), asprintf(), strcpy() */
56
59
#include <fcntl.h> /* open() */
57
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
59
#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
60
64
#include <assert.h> /* assert() */
61
65
#include <errno.h> /* perror(), errno */
62
66
#include <time.h> /* nanosleep(), time() */
76
80
argp_parse(), ARGP_KEY_ARG,
77
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
78
82
#include <signal.h> /* sigemptyset(), sigaddset(),
79
sigaction(), SIGTERM, sigaction,
83
sigaction(), SIGTERM, sig_atomic_t,
83
87
#include <sys/klog.h> /* klogctl() */
306
310
gpgme_recipient_t recipient;
307
311
recipient = result->recipients;
309
while(recipient != NULL){
310
fprintf(stderr, "Public key algorithm: %s\n",
311
gpgme_pubkey_algo_name(recipient->pubkey_algo));
312
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
313
fprintf(stderr, "Secret key available: %s\n",
314
recipient->status == GPG_ERR_NO_SECKEY
316
recipient = recipient->next;
312
while(recipient != NULL){
313
fprintf(stderr, "Public key algorithm: %s\n",
314
gpgme_pubkey_algo_name(recipient->pubkey_algo));
315
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
316
fprintf(stderr, "Secret key available: %s\n",
317
recipient->status == GPG_ERR_NO_SECKEY
319
recipient = recipient->next;
512
514
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
513
515
__attribute__((unused)) const char *txt){}
517
sig_atomic_t quit_now = 0;
518
int signal_received = 0;
515
520
/* Called when a Mandos server is found */
516
521
static int start_mandos_communication(const char *ip, uint16_t port,
517
522
AvahiIfIndex if_index,
524
int ret, tcp_sd = -1;
522
527
struct sockaddr_in in;
557
566
tcp_sd = socket(pf, SOCK_STREAM, 0);
559
568
perror("socket");
563
577
memset(&to, 0, sizeof(to));
564
578
if(af == AF_INET6){
565
to.in6.sin6_family = (uint16_t)af;
579
to.in6.sin6_family = (sa_family_t)af;
566
580
ret = inet_pton(af, ip, &to.in6.sin6_addr);
567
581
} else { /* IPv4 */
568
582
to.in.sin_family = (sa_family_t)af;
587
603
if(if_index == AVAHI_IF_UNSPEC){
588
604
fprintf(stderr, "An IPv6 link-local address is incomplete"
589
605
" without a network interface\n");
592
609
/* Set the network interface number as scope */
593
610
to.in6.sin6_scope_id = (uint32_t)if_index;
668
702
fprintf(stderr, "Establishing TLS session with %s\n", ip);
671
709
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
674
716
ret = gnutls_handshake(session);
675
720
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
677
722
if(ret != GNUTLS_E_SUCCESS){
712
766
case GNUTLS_E_REHANDSHAKE:
714
768
ret = gnutls_handshake(session);
715
773
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
717
775
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
736
794
fprintf(stderr, "Closing TLS session\n");
739
801
gnutls_bye(session, GNUTLS_SHUT_RDWR);
741
807
if(buffer_length > 0){
742
808
decrypted_buffer_size = pgp_packet_decrypt(buffer,
745
811
if(decrypted_buffer_size >= 0){
747
813
while(written < (size_t) decrypted_buffer_size){
748
818
ret = (int)fwrite(decrypted_buffer + written, 1,
749
819
(size_t)decrypted_buffer_size - written,
854
937
the callback function is called the Avahi server will free the
855
938
resolver for us. */
857
if(!(avahi_s_service_resolver_new(mc.server, interface,
858
protocol, name, type, domain,
859
AVAHI_PROTO_INET6, 0,
860
resolve_callback, NULL)))
940
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
941
name, type, domain, protocol, 0,
942
resolve_callback, NULL) == NULL)
861
943
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
862
944
name, avahi_strerror(avahi_server_errno(mc.server)));
877
sig_atomic_t quit_now = 0;
879
959
/* stop main loop after sigterm has been called */
880
static void handle_sigterm(__attribute__((unused)) int sig){
960
static void handle_sigterm(int sig){
965
signal_received = sig;
885
966
int old_errno = errno;
886
967
if(mc.simple_poll != NULL){
887
968
avahi_simple_poll_quit(mc.simple_poll);
908
990
const char *seckey = PATHDIR "/" SECKEY;
909
991
const char *pubkey = PATHDIR "/" PUBKEY;
911
/* Initialize Mandos context */
912
mc = (mandos_context){ .simple_poll = NULL, .server = NULL,
913
.dh_bits = 1024, .priority = "SECURE256"
914
":!CTYPE-X.509:+CTYPE-OPENPGP" };
915
993
bool gnutls_initialized = false;
916
994
bool gpgme_initialized = false;
919
997
struct sigaction old_sigterm_action;
920
998
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
977
1055
case 129: /* --dh-bits */
978
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
979
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
980
or arg[numchars] != '\0'){
1057
tmpmax = strtoimax(arg, &tmp, 10);
1058
if(errno != 0 or tmp == arg or *tmp != '\0'
1059
or tmpmax != (typeof(mc.dh_bits))tmpmax){
981
1060
fprintf(stderr, "Bad number of DH bits\n");
982
1061
exit(EXIT_FAILURE);
987
1066
mc.priority = arg;
989
1068
case 131: /* --delay */
990
ret = sscanf(arg, "%lf%n", &delay, &numchars);
991
if(ret < 1 or arg[numchars] != '\0'){
1070
delay = strtof(arg, &tmp);
1071
if(errno != 0 or tmp == arg or *tmp != '\0'){
992
1072
fprintf(stderr, "Bad delay\n");
993
1073
exit(EXIT_FAILURE);
1049
1129
exitcode = EXIT_FAILURE;
1052
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1054
perror("sigaction");
1055
exitcode = EXIT_FAILURE;
1132
/* Need to check if the handler is SIG_IGN before handling:
1133
| [[info:libc:Initial Signal Actions]] |
1134
| [[info:libc:Basic Signal Handling]] |
1136
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1138
perror("sigaction");
1139
return EXIT_FAILURE;
1141
if(old_sigterm_action.sa_handler != SIG_IGN){
1142
ret = sigaction(SIGINT, &sigterm_action, NULL);
1144
perror("sigaction");
1145
exitcode = EXIT_FAILURE;
1149
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1151
perror("sigaction");
1152
return EXIT_FAILURE;
1154
if(old_sigterm_action.sa_handler != SIG_IGN){
1155
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1157
perror("sigaction");
1158
exitcode = EXIT_FAILURE;
1162
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1164
perror("sigaction");
1165
return EXIT_FAILURE;
1167
if(old_sigterm_action.sa_handler != SIG_IGN){
1168
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1170
perror("sigaction");
1171
exitcode = EXIT_FAILURE;
1059
1176
/* If the interface is down, bring it up */
1060
1177
if(interface[0] != '\0'){
1178
if_index = (AvahiIfIndex) if_nametoindex(interface);
1180
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1181
exitcode = EXIT_FAILURE;
1061
1189
#ifdef __linux__
1062
1190
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1063
1191
messages to mess up the prompt */
1101
1229
if((network.ifr_flags & IFF_UP) == 0){
1102
1230
network.ifr_flags |= IFF_UP;
1231
take_down_interface = true;
1103
1232
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1234
take_down_interface = false;
1105
1235
perror("ioctl SIOCSIFFLAGS");
1106
1236
exitcode = EXIT_FAILURE;
1107
1237
#ifdef __linux__
1167
1308
gnutls_initialized = true;
1315
tempdir_created = true;
1170
1316
if(mkdtemp(tempdir) == NULL){
1317
tempdir_created = false;
1171
1318
perror("mkdtemp");
1174
tempdir_created = true;
1176
1326
if(not init_gpgme(pubkey, seckey, tempdir)){
1177
1327
fprintf(stderr, "init_gpgme failed\n");
1181
1331
gpgme_initialized = true;
1184
if(interface[0] != '\0'){
1185
if_index = (AvahiIfIndex) if_nametoindex(interface);
1187
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1188
exitcode = EXIT_FAILURE;
1193
1338
if(connect_to != NULL){
1199
1344
exitcode = EXIT_FAILURE;
1203
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1204
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1205
or address[numchars+1] != '\0'){
1354
tmpmax = strtoimax(address+1, &tmp, 10);
1355
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1356
or tmpmax != (uint16_t)tmpmax){
1206
1357
fprintf(stderr, "Bad port number\n");
1207
1358
exitcode = EXIT_FAILURE;
1210
1366
port = (uint16_t)tmpmax;
1211
1367
*address = '\0';
1212
1368
address = connect_to;
1255
1424
/* Create the Avahi service browser */
1256
1425
sb = avahi_s_service_browser_new(mc.server, if_index,
1257
AVAHI_PROTO_INET6, "_mandos._tcp",
1426
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1258
1427
NULL, 0, browse_callback, NULL);
1259
1428
if(sb == NULL){
1260
1429
fprintf(stderr, "Failed to create service browser: %s\n",
1297
1470
gpgme_release(mc.ctx);
1473
/* Take down the network interface */
1474
if(take_down_interface){
1475
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1477
perror("ioctl SIOCGIFFLAGS");
1478
} else if(network.ifr_flags & IFF_UP) {
1479
network.ifr_flags &= ~IFF_UP; /* clear flag */
1480
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1482
perror("ioctl SIOCSIFFLAGS");
1485
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1300
1491
/* Removes the temp directory used by GPGME */
1301
1492
if(tempdir_created){