(root)/mandos/release
» Revision
237.2.153
(compared to revision 237.2.163)
: plugins.d/mandos-client.c
To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 237.2.153
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.153
- Committer: Teddy Hogeborn
- Date: 2009-10-18 16:09:05 UTC
- mto: (24.1.146 mandos) (237.12.2 mandos-persistent) (299.1.1 release) (300.1.1 release) (301.1.1 release)
- mto: This revision was merged to the branch mainline in revision 270.
- Revision ID: teddy@fukt.bsnet.se-20091018160905-ep07o5cwedsegz9x
* plugins.d/askpass-fifo.c: Do close(STDOUT_FILENO) before exiting to
check its return code. Use exit codes
from <sysexits.h>.
* plugins.d/splashy.c: Use exit codes from <sysexits.h> in the fork to
exec the "splashy_update" command.
check its return code. Use exit codes
from <sysexits.h>.
* plugins.d/splashy.c: Use exit codes from <sysexits.h> in the fork to
exec the "splashy_update" command.
added
removed
plugins.d/mandos-client.c
43
43
stdout, ferror(), remove() */
44
44
#include <stdint.h> /* uint16_t, uint32_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
strtof(), abort() */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof(), abort() */
48
48
#include <stdbool.h> /* bool, false, true */
49
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
50
strerror(), asprintf(), strcpy() */
82
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
83
sigaction(), SIGTERM, sig_atomic_t,
84
84
raise() */
85
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
86
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
87
85
88
86
#ifdef __linux__
89
87
#include <sys/klog.h> /* klogctl() */
554
552
gnutls_session_t session;
555
553
int pf; /* Protocol family */
556
554
557
errno = 0;
558
559
555
if(quit_now){
560
errno = EINTR;
561
556
return -1;
562
557
}
563
558
570
565
break;
571
566
default:
572
567
fprintf(stderr, "Bad address family: %d\n", af);
573
errno = EINVAL;
574
568
return -1;
575
569
}
576
570
586
580
587
581
tcp_sd = socket(pf, SOCK_STREAM, 0);
588
582
if(tcp_sd < 0){
589
int e = errno;
590
583
perror("socket");
591
errno = e;
592
584
goto mandos_end;
593
585
}
594
586
595
587
if(quit_now){
596
errno = EINTR;
597
588
goto mandos_end;
598
589
}
599
590
606
597
ret = inet_pton(af, ip, &to.in.sin_addr);
607
598
}
608
599
if(ret < 0 ){
609
int e = errno;
610
600
perror("inet_pton");
611
errno = e;
612
601
goto mandos_end;
613
602
}
614
603
if(ret == 0){
615
int e = errno;
616
604
fprintf(stderr, "Bad address: %s\n", ip);
617
errno = e;
618
605
goto mandos_end;
619
606
}
620
607
if(af == AF_INET6){
628
615
if(if_index == AVAHI_IF_UNSPEC){
629
616
fprintf(stderr, "An IPv6 link-local address is incomplete"
630
617
" without a network interface\n");
631
errno = EINVAL;
632
618
goto mandos_end;
633
619
}
634
620
/* Set the network interface number as scope */
641
627
}
642
628
643
629
if(quit_now){
644
errno = EINTR;
645
630
goto mandos_end;
646
631
}
647
632
678
663
}
679
664
680
665
if(quit_now){
681
errno = EINTR;
682
666
goto mandos_end;
683
667
}
684
668
688
672
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
689
673
}
690
674
if(ret < 0){
691
int e = errno;
692
675
perror("connect");
693
errno = e;
694
676
goto mandos_end;
695
677
}
696
678
697
679
if(quit_now){
698
errno = EINTR;
699
680
goto mandos_end;
700
681
}
701
682
706
687
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
707
688
out_size - written));
708
689
if(ret == -1){
709
int e = errno;
710
690
perror("write");
711
errno = e;
712
691
goto mandos_end;
713
692
}
714
693
written += (size_t)ret;
724
703
}
725
704
726
705
if(quit_now){
727
errno = EINTR;
728
706
goto mandos_end;
729
707
}
730
708
}
734
712
}
735
713
736
714
if(quit_now){
737
errno = EINTR;
738
715
goto mandos_end;
739
716
}
740
717
741
718
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
742
719
743
720
if(quit_now){
744
errno = EINTR;
745
721
goto mandos_end;
746
722
}
747
723
748
724
do {
749
725
ret = gnutls_handshake(session);
750
726
if(quit_now){
751
errno = EINTR;
752
727
goto mandos_end;
753
728
}
754
729
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
758
733
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
759
734
gnutls_perror(ret);
760
735
}
761
errno = EPROTO;
762
736
goto mandos_end;
763
737
}
764
738
772
746
while(true){
773
747
774
748
if(quit_now){
775
errno = EINTR;
776
749
goto mandos_end;
777
750
}
778
751
779
752
buffer_capacity = incbuffer(&buffer, buffer_length,
780
753
buffer_capacity);
781
754
if(buffer_capacity == 0){
782
int e = errno;
783
755
perror("incbuffer");
784
errno = e;
785
756
goto mandos_end;
786
757
}
787
758
788
759
if(quit_now){
789
errno = EINTR;
790
760
goto mandos_end;
791
761
}
792
762
805
775
ret = gnutls_handshake(session);
806
776
807
777
if(quit_now){
808
errno = EINTR;
809
778
goto mandos_end;
810
779
}
811
780
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
812
781
if(ret < 0){
813
782
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
814
783
gnutls_perror(ret);
815
errno = EPROTO;
816
784
goto mandos_end;
817
785
}
818
786
break;
820
788
fprintf(stderr, "Unknown error while reading data from"
821
789
" encrypted session with Mandos server\n");
822
790
gnutls_bye(session, GNUTLS_SHUT_RDWR);
823
errno = EIO;
824
791
goto mandos_end;
825
792
}
826
793
} else {
833
800
}
834
801
835
802
if(quit_now){
836
errno = EINTR;
837
803
goto mandos_end;
838
804
}
839
805
840
806
do {
841
807
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
842
808
if(quit_now){
843
errno = EINTR;
844
809
goto mandos_end;
845
810
}
846
811
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
855
820
written = 0;
856
821
while(written < (size_t) decrypted_buffer_size){
857
822
if(quit_now){
858
errno = EINTR;
859
823
goto mandos_end;
860
824
}
861
825
863
827
(size_t)decrypted_buffer_size - written,
864
828
stdout);
865
829
if(ret == 0 and ferror(stdout)){
866
int e = errno;
867
830
if(debug){
868
831
fprintf(stderr, "Error writing encrypted data: %s\n",
869
832
strerror(errno));
870
833
}
871
errno = e;
872
834
goto mandos_end;
873
835
}
874
836
written += (size_t)ret;
880
842
/* Shutdown procedure */
881
843
882
844
mandos_end:
883
{
884
int e = errno;
885
free(decrypted_buffer);
886
free(buffer);
887
if(tcp_sd >= 0){
888
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
889
}
890
if(ret == -1){
891
if(e == 0){
892
e = errno;
893
}
894
perror("close");
895
}
896
gnutls_deinit(session);
897
if(quit_now){
898
e = EINTR;
899
retval = -1;
900
}
901
errno = e;
845
free(decrypted_buffer);
846
free(buffer);
847
if(tcp_sd >= 0){
848
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
849
}
850
if(ret == -1){
851
perror("close");
852
}
853
gnutls_deinit(session);
854
if(quit_now){
855
retval = -1;
902
856
}
903
857
return retval;
904
858
}
1102
1056
.arg = "SECONDS",
1103
1057
.doc = "Maximum delay to wait for interface startup",
1104
1058
.group = 2 },
1105
/*
1106
* These reproduce what we would get without ARGP_NO_HELP
1107
*/
1108
{ .name = "help", .key = '?',
1109
.doc = "Give this help list", .group = -1 },
1110
{ .name = "usage", .key = -3,
1111
.doc = "Give a short usage message", .group = -1 },
1112
{ .name = "version", .key = 'V',
1113
.doc = "Print program version", .group = -1 },
1114
1059
{ .name = NULL }
1115
1060
};
1116
1061
1117
1062
error_t parse_opt(int key, char *arg,
1118
1063
struct argp_state *state){
1119
errno = 0;
1120
1064
switch(key){
1121
1065
case 128: /* --debug */
1122
1066
debug = true;
1138
1082
tmpmax = strtoimax(arg, &tmp, 10);
1139
1083
if(errno != 0 or tmp == arg or *tmp != '\0'
1140
1084
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1141
argp_error(state, "Bad number of DH bits");
1085
fprintf(stderr, "Bad number of DH bits\n");
1086
exit(EXIT_FAILURE);
1142
1087
}
1143
1088
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1144
1089
break;
1149
1094
errno = 0;
1150
1095
delay = strtof(arg, &tmp);
1151
1096
if(errno != 0 or tmp == arg or *tmp != '\0'){
1152
argp_error(state, "Bad delay");
1097
fprintf(stderr, "Bad delay\n");
1098
exit(EXIT_FAILURE);
1153
1099
}
1154
1100
break;
1155
/*
1156
* These reproduce what we would get without ARGP_NO_HELP
1157
*/
1158
case '?': /* --help */
1159
argp_state_help(state, state->out_stream,
1160
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1161
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1162
case -3: /* --usage */
1163
argp_state_help(state, state->out_stream,
1164
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1165
case 'V': /* --version */
1166
fprintf(state->out_stream, "%s\n", argp_program_version);
1167
exit(argp_err_exit_status);
1101
case ARGP_KEY_ARG:
1102
argp_usage(state);
1103
case ARGP_KEY_END:
1168
1104
break;
1169
1105
default:
1170
1106
return ARGP_ERR_UNKNOWN;
1171
1107
}
1172
return errno;
1108
return 0;
1173
1109
}
1174
1110
1175
1111
struct argp argp = { .options = options, .parser = parse_opt,
1176
1112
.args_doc = "",
1177
1113
.doc = "Mandos client -- Get and decrypt"
1178
1114
" passwords from a Mandos server" };
1179
ret = argp_parse(&argp, argc, argv,
1180
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1181
switch(ret){
1182
case 0:
1183
break;
1184
case ENOMEM:
1185
default:
1186
errno = ret;
1187
perror("argp_parse");
1188
exitcode = EX_OSERR;
1189
goto end;
1190
case EINVAL:
1191
exitcode = EX_USAGE;
1115
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1116
if(ret == ARGP_ERR_UNKNOWN){
1117
fprintf(stderr, "Unknown error while parsing arguments\n");
1118
exitcode = EXIT_FAILURE;
1192
1119
goto end;
1193
1120
}
1194
1121
}
1204
1131
mc.simple_poll = avahi_simple_poll_new();
1205
1132
if(mc.simple_poll == NULL){
1206
1133
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1207
exitcode = EX_UNAVAILABLE;
1134
exitcode = EXIT_FAILURE;
1208
1135
goto end;
1209
1136
}
1210
1137
1212
1139
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1213
1140
if(ret == -1){
1214
1141
perror("sigaddset");
1215
exitcode = EX_OSERR;
1142
exitcode = EXIT_FAILURE;
1216
1143
goto end;
1217
1144
}
1218
1145
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1219
1146
if(ret == -1){
1220
1147
perror("sigaddset");
1221
exitcode = EX_OSERR;
1148
exitcode = EXIT_FAILURE;
1222
1149
goto end;
1223
1150
}
1224
1151
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1225
1152
if(ret == -1){
1226
1153
perror("sigaddset");
1227
exitcode = EX_OSERR;
1154
exitcode = EXIT_FAILURE;
1228
1155
goto end;
1229
1156
}
1230
1157
/* Need to check if the handler is SIG_IGN before handling:
1234
1161
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1235
1162
if(ret == -1){
1236
1163
perror("sigaction");
1237
return EX_OSERR;
1164
return EXIT_FAILURE;
1238
1165
}
1239
1166
if(old_sigterm_action.sa_handler != SIG_IGN){
1240
1167
ret = sigaction(SIGINT, &sigterm_action, NULL);
1241
1168
if(ret == -1){
1242
1169
perror("sigaction");
1243
exitcode = EX_OSERR;
1170
exitcode = EXIT_FAILURE;
1244
1171
goto end;
1245
1172
}
1246
1173
}
1247
1174
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1248
1175
if(ret == -1){
1249
1176
perror("sigaction");
1250
return EX_OSERR;
1177
return EXIT_FAILURE;
1251
1178
}
1252
1179
if(old_sigterm_action.sa_handler != SIG_IGN){
1253
1180
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1254
1181
if(ret == -1){
1255
1182
perror("sigaction");
1256
exitcode = EX_OSERR;
1183
exitcode = EXIT_FAILURE;
1257
1184
goto end;
1258
1185
}
1259
1186
}
1260
1187
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1261
1188
if(ret == -1){
1262
1189
perror("sigaction");
1263
return EX_OSERR;
1190
return EXIT_FAILURE;
1264
1191
}
1265
1192
if(old_sigterm_action.sa_handler != SIG_IGN){
1266
1193
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1267
1194
if(ret == -1){
1268
1195
perror("sigaction");
1269
exitcode = EX_OSERR;
1196
exitcode = EXIT_FAILURE;
1270
1197
goto end;
1271
1198
}
1272
1199
}
1276
1203
if_index = (AvahiIfIndex) if_nametoindex(interface);
1277
1204
if(if_index == 0){
1278
1205
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1279
exitcode = EX_UNAVAILABLE;
1206
exitcode = EXIT_FAILURE;
1280
1207
goto end;
1281
1208
}
1282
1209
1293
1220
1294
1221
#ifdef __linux__
1295
1222
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1296
messages about the network interface to mess up the prompt */
1223
messages to mess up the prompt */
1297
1224
ret = klogctl(8, NULL, 5);
1298
1225
bool restore_loglevel = true;
1299
1226
if(ret == -1){
1305
1232
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1306
1233
if(sd < 0){
1307
1234
perror("socket");
1308
exitcode = EX_OSERR;
1235
exitcode = EXIT_FAILURE;
1309
1236
#ifdef __linux__
1310
1237
if(restore_loglevel){
1311
1238
ret = klogctl(7, NULL, 0);
1334
1261
}
1335
1262
}
1336
1263
#endif /* __linux__ */
1337
exitcode = EX_OSERR;
1264
exitcode = EXIT_FAILURE;
1338
1265
/* Lower privileges */
1339
1266
errno = 0;
1340
1267
ret = seteuid(uid);
1350
1277
if(ret == -1){
1351
1278
take_down_interface = false;
1352
1279
perror("ioctl SIOCSIFFLAGS");
1353
exitcode = EX_OSERR;
1280
exitcode = EXIT_FAILURE;
1354
1281
#ifdef __linux__
1355
1282
if(restore_loglevel){
1356
1283
ret = klogctl(7, NULL, 0);
1422
1349
ret = init_gnutls_global(pubkey, seckey);
1423
1350
if(ret == -1){
1424
1351
fprintf(stderr, "init_gnutls_global failed\n");
1425
exitcode = EX_UNAVAILABLE;
1352
exitcode = EXIT_FAILURE;
1426
1353
goto end;
1427
1354
} else {
1428
1355
gnutls_initialized = true;
1445
1372
1446
1373
if(not init_gpgme(pubkey, seckey, tempdir)){
1447
1374
fprintf(stderr, "init_gpgme failed\n");
1448
exitcode = EX_UNAVAILABLE;
1375
exitcode = EXIT_FAILURE;
1449
1376
goto end;
1450
1377
} else {
1451
1378
gpgme_initialized = true;
1461
1388
char *address = strrchr(connect_to, ':');
1462
1389
if(address == NULL){
1463
1390
fprintf(stderr, "No colon in address\n");
1464
exitcode = EX_USAGE;
1391
exitcode = EXIT_FAILURE;
1465
1392
goto end;
1466
1393
}
1467
1394
1475
1402
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1476
1403
or tmpmax != (uint16_t)tmpmax){
1477
1404
fprintf(stderr, "Bad port number\n");
1478
exitcode = EX_USAGE;
1405
exitcode = EXIT_FAILURE;
1479
1406
goto end;
1480
1407
}
1481
1408
1500
1427
1501
1428
ret = start_mandos_communication(address, port, if_index, af);
1502
1429
if(ret < 0){
1503
switch(errno){
1504
case ENETUNREACH:
1505
case EHOSTDOWN:
1506
case EHOSTUNREACH:
1507
exitcode = EX_NOHOST;
1508
break;
1509
case EINVAL:
1510
exitcode = EX_USAGE;
1511
break;
1512
case EIO:
1513
exitcode = EX_IOERR;
1514
break;
1515
case EPROTO:
1516
exitcode = EX_PROTOCOL;
1517
break;
1518
default:
1519
exitcode = EX_OSERR;
1520
break;
1521
}
1430
exitcode = EXIT_FAILURE;
1522
1431
} else {
1523
1432
exitcode = EXIT_SUCCESS;
1524
1433
}
1551
1460
if(mc.server == NULL){
1552
1461
fprintf(stderr, "Failed to create Avahi server: %s\n",
1553
1462
avahi_strerror(error));
1554
exitcode = EX_UNAVAILABLE;
1463
exitcode = EXIT_FAILURE;
1555
1464
goto end;
1556
1465
}
1557
1466
1566
1475
if(sb == NULL){
1567
1476
fprintf(stderr, "Failed to create service browser: %s\n",
1568
1477
avahi_strerror(avahi_server_errno(mc.server)));
1569
exitcode = EX_UNAVAILABLE;
1478
exitcode = EXIT_FAILURE;
1570
1479
goto end;
1571
1480
}
1572
1481
1621
1530
if(ret == -1){
1622
1531
perror("ioctl SIOCGIFFLAGS");
1623
1532
} else if(network.ifr_flags & IFF_UP) {
1624
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1533
network.ifr_flags &= ~IFF_UP; /* clear flag */
1625
1534
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1626
1535
if(ret == -1){
1627
1536
perror("ioctl SIOCSIFFLAGS");
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0