(root)/mandos/release
» Revision
237.2.26
(compared to revision 237.2.211)
: plugins.d/mandos-client.c
To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 237.2.26
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.26
- Committer: Teddy Hogeborn
- Date: 2009-01-12 22:02:33 UTC
- mto: (24.1.123 mandos) (237.4.2 mandos-pipe-ipc) (299.1.1 release) (300.1.1 release) (301.1.1 release)
- mto: This revision was merged to the branch mainline in revision 245.
- Revision ID: teddy@fukt.bsnet.se-20090112220233-lawxo4uvyzb38u1f
* README (The Plugin System): Removed redundant text about options and
files for the plugins, this is now
documented in the manuals for the
plugins.
* plugins.d/mandos-client.c (main): Remove comment which was copied
from another program by mistake.
Use "sscanf" instead of "strtol"
to parse numbers; this uses the
correct type instead of casting.
Don't report errors when removing
temporary directory if directory
is already gone.
files for the plugins, this is now
documented in the manuals for the
plugins.
* plugins.d/mandos-client.c (main): Remove comment which was copied
from another program by mistake.
Use "sscanf" instead of "strtol"
to parse numbers; this uses the
correct type instead of casting.
Don't report errors when removing
temporary directory if directory
is already gone.
- files removed:
- DBUS-API
- files renamed:
- mandos-ctl => mandos-list
- files modified:
- INSTALL
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2010 Teddy Hogeborn
13
* Copyright © 2008-2010 Björn Påhlsson
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
30
30
*/
31
31
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
33
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
34
#define _FILE_OFFSET_BITS 64
38
#endif
39
35
40
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
37
42
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
39
stdout, ferror(), sscanf */
44
40
#include <stdint.h> /* uint16_t, uint32_t */
45
41
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
42
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
43
srand() */
44
#include <stdbool.h> /* bool, true */
49
45
#include <string.h> /* memset(), strcmp(), strlen(),
50
46
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/ioctl.h> /* ioctl */
52
48
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
49
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
50
SOCK_STREAM, INET6_ADDRSTRLEN,
51
uid_t, gid_t, open(), opendir(), DIR */
56
52
#include <sys/stat.h> /* open() */
57
53
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
54
struct in6_addr, inet_pton(),
55
connect() */
59
56
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
57
#include <dirent.h> /* opendir(), struct dirent, readdir() */
58
#include <inttypes.h> /* PRIu16, SCNu16 */
64
59
#include <assert.h> /* assert() */
65
60
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time(), sleep() */
61
#include <time.h> /* time() */
67
62
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
63
SIOCSIFFLAGS, if_indextoname(),
69
64
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
65
#include <netinet/in.h>
73
66
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
67
getuid(), getgid(), setuid(),
68
setgid() */
76
69
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
70
#include <iso646.h> /* not, and, or */
78
71
#include <argp.h> /* struct argp_option, error_t, struct
79
72
argp_state, struct argp,
80
73
argp_parse(), ARGP_KEY_ARG,
81
74
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
86
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
87
88
#ifdef __linux__
89
#include <sys/klog.h> /* klogctl() */
90
#endif /* __linux__ */
91
75
92
76
/* Avahi */
93
77
/* All Avahi types, constants and functions
106
90
gnutls_*
107
91
init_gnutls_session(),
108
92
GNUTLS_* */
109
#include <gnutls/openpgp.h>
110
/* gnutls_certificate_set_openpgp_key_file(),
93
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
111
94
GNUTLS_OPENPGP_FMT_BASE64 */
112
95
113
96
/* GPGME */
127
110
static const char mandos_protocol_version[] = "1";
128
111
const char *argp_program_version = "mandos-client " VERSION;
129
112
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
130
static const char sys_class_net[] = "/sys/class/net";
131
char *connect_to = NULL;
132
113
133
114
/* Used for passing in values through the Avahi callback functions */
134
115
typedef struct {
141
122
gpgme_ctx_t ctx;
142
123
} mandos_context;
143
124
144
/* global context so signal handler can reach it*/
145
mandos_context mc = { .simple_poll = NULL, .server = NULL,
146
.dh_bits = 1024, .priority = "SECURE256"
147
":!CTYPE-X.509:+CTYPE-OPENPGP" };
148
149
sig_atomic_t quit_now = 0;
150
int signal_received = 0;
151
152
125
/*
153
* Make additional room in "buffer" for at least BUFFER_SIZE more
154
* bytes. "buffer_capacity" is how much is currently allocated,
126
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
127
* "buffer_capacity" is how much is currently allocated,
155
128
* "buffer_length" is how much is already used.
156
129
*/
157
size_t incbuffer(char **buffer, size_t buffer_length,
130
size_t adjustbuffer(char **buffer, size_t buffer_length,
158
131
size_t buffer_capacity){
159
if(buffer_length + BUFFER_SIZE > buffer_capacity){
132
if (buffer_length + BUFFER_SIZE > buffer_capacity){
160
133
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
161
if(buffer == NULL){
134
if (buffer == NULL){
162
135
return 0;
163
136
}
164
137
buffer_capacity += BUFFER_SIZE;
169
142
/*
170
143
* Initialize GPGME.
171
144
*/
172
static bool init_gpgme(const char *seckey,
145
static bool init_gpgme(mandos_context *mc, const char *seckey,
173
146
const char *pubkey, const char *tempdir){
147
int ret;
174
148
gpgme_error_t rc;
175
149
gpgme_engine_info_t engine_info;
176
150
177
151
178
152
/*
179
* Helper function to insert pub and seckey to the engine keyring.
153
* Helper function to insert pub and seckey to the enigne keyring.
180
154
*/
181
155
bool import_key(const char *filename){
182
int ret;
183
156
int fd;
184
157
gpgme_data_t pgp_data;
185
158
190
163
}
191
164
192
165
rc = gpgme_data_new_from_fd(&pgp_data, fd);
193
if(rc != GPG_ERR_NO_ERROR){
166
if (rc != GPG_ERR_NO_ERROR){
194
167
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
195
168
gpgme_strsource(rc), gpgme_strerror(rc));
196
169
return false;
197
170
}
198
171
199
rc = gpgme_op_import(mc.ctx, pgp_data);
200
if(rc != GPG_ERR_NO_ERROR){
172
rc = gpgme_op_import(mc->ctx, pgp_data);
173
if (rc != GPG_ERR_NO_ERROR){
201
174
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
202
175
gpgme_strsource(rc), gpgme_strerror(rc));
203
176
return false;
211
184
return true;
212
185
}
213
186
214
if(debug){
215
fprintf(stderr, "Initializing GPGME\n");
187
if (debug){
188
fprintf(stderr, "Initialize gpgme\n");
216
189
}
217
190
218
191
/* Init GPGME */
219
192
gpgme_check_version(NULL);
220
193
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
221
if(rc != GPG_ERR_NO_ERROR){
194
if (rc != GPG_ERR_NO_ERROR){
222
195
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
223
196
gpgme_strsource(rc), gpgme_strerror(rc));
224
197
return false;
225
198
}
226
199
227
200
/* Set GPGME home directory for the OpenPGP engine only */
228
rc = gpgme_get_engine_info(&engine_info);
229
if(rc != GPG_ERR_NO_ERROR){
201
rc = gpgme_get_engine_info (&engine_info);
202
if (rc != GPG_ERR_NO_ERROR){
230
203
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
231
204
gpgme_strsource(rc), gpgme_strerror(rc));
232
205
return false;
245
218
}
246
219
247
220
/* Create new GPGME "context" */
248
rc = gpgme_new(&(mc.ctx));
249
if(rc != GPG_ERR_NO_ERROR){
221
rc = gpgme_new(&(mc->ctx));
222
if (rc != GPG_ERR_NO_ERROR){
250
223
fprintf(stderr, "bad gpgme_new: %s: %s\n",
251
224
gpgme_strsource(rc), gpgme_strerror(rc));
252
225
return false;
253
226
}
254
227
255
if(not import_key(pubkey) or not import_key(seckey)){
228
if (not import_key(pubkey) or not import_key(seckey)){
256
229
return false;
257
230
}
258
231
259
return true;
232
return true;
260
233
}
261
234
262
235
/*
263
236
* Decrypt OpenPGP data.
264
237
* Returns -1 on error
265
238
*/
266
static ssize_t pgp_packet_decrypt(const char *cryptotext,
267
size_t crypto_size,
268
char **plaintext){
239
static ssize_t pgp_packet_decrypt (const mandos_context *mc,
240
const char *cryptotext,
241
size_t crypto_size,
242
char **plaintext){
269
243
gpgme_data_t dh_crypto, dh_plain;
270
244
gpgme_error_t rc;
271
245
ssize_t ret;
272
246
size_t plaintext_capacity = 0;
273
247
ssize_t plaintext_length = 0;
274
248
275
if(debug){
249
if (debug){
276
250
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
277
251
}
278
252
279
253
/* Create new GPGME data buffer from memory cryptotext */
280
254
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
281
255
0);
282
if(rc != GPG_ERR_NO_ERROR){
256
if (rc != GPG_ERR_NO_ERROR){
283
257
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
284
258
gpgme_strsource(rc), gpgme_strerror(rc));
285
259
return -1;
287
261
288
262
/* Create new empty GPGME data buffer for the plaintext */
289
263
rc = gpgme_data_new(&dh_plain);
290
if(rc != GPG_ERR_NO_ERROR){
264
if (rc != GPG_ERR_NO_ERROR){
291
265
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
292
266
gpgme_strsource(rc), gpgme_strerror(rc));
293
267
gpgme_data_release(dh_crypto);
296
270
297
271
/* Decrypt data from the cryptotext data buffer to the plaintext
298
272
data buffer */
299
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
300
if(rc != GPG_ERR_NO_ERROR){
273
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
274
if (rc != GPG_ERR_NO_ERROR){
301
275
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
302
276
gpgme_strsource(rc), gpgme_strerror(rc));
303
277
plaintext_length = -1;
304
if(debug){
278
if (debug){
305
279
gpgme_decrypt_result_t result;
306
result = gpgme_op_decrypt_result(mc.ctx);
307
if(result == NULL){
280
result = gpgme_op_decrypt_result(mc->ctx);
281
if (result == NULL){
308
282
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
309
283
} else {
310
284
fprintf(stderr, "Unsupported algorithm: %s\n",
316
290
}
317
291
gpgme_recipient_t recipient;
318
292
recipient = result->recipients;
319
while(recipient != NULL){
320
fprintf(stderr, "Public key algorithm: %s\n",
321
gpgme_pubkey_algo_name(recipient->pubkey_algo));
322
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
323
fprintf(stderr, "Secret key available: %s\n",
324
recipient->status == GPG_ERR_NO_SECKEY
325
? "No" : "Yes");
326
recipient = recipient->next;
293
if(recipient){
294
while(recipient != NULL){
295
fprintf(stderr, "Public key algorithm: %s\n",
296
gpgme_pubkey_algo_name(recipient->pubkey_algo));
297
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
298
fprintf(stderr, "Secret key available: %s\n",
299
recipient->status == GPG_ERR_NO_SECKEY
300
? "No" : "Yes");
301
recipient = recipient->next;
302
}
327
303
}
328
304
}
329
305
}
335
311
}
336
312
337
313
/* Seek back to the beginning of the GPGME plaintext data buffer */
338
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
314
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
339
315
perror("gpgme_data_seek");
340
316
plaintext_length = -1;
341
317
goto decrypt_end;
343
319
344
320
*plaintext = NULL;
345
321
while(true){
346
plaintext_capacity = incbuffer(plaintext,
322
plaintext_capacity = adjustbuffer(plaintext,
347
323
(size_t)plaintext_length,
348
324
plaintext_capacity);
349
if(plaintext_capacity == 0){
350
perror("incbuffer");
325
if (plaintext_capacity == 0){
326
perror("adjustbuffer");
351
327
plaintext_length = -1;
352
328
goto decrypt_end;
353
329
}
355
331
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
356
332
BUFFER_SIZE);
357
333
/* Print the data, if any */
358
if(ret == 0){
334
if (ret == 0){
359
335
/* EOF */
360
336
break;
361
337
}
385
361
return plaintext_length;
386
362
}
387
363
388
static const char * safer_gnutls_strerror(int value){
389
const char *ret = gnutls_strerror(value); /* Spurious warning from
390
-Wunreachable-code */
391
if(ret == NULL)
364
static const char * safer_gnutls_strerror (int value) {
365
const char *ret = gnutls_strerror (value); /* Spurious warning */
366
if (ret == NULL)
392
367
ret = "(unknown)";
393
368
return ret;
394
369
}
399
374
fprintf(stderr, "GnuTLS: %s", string);
400
375
}
401
376
402
static int init_gnutls_global(const char *pubkeyfilename,
377
static int init_gnutls_global(mandos_context *mc,
378
const char *pubkeyfilename,
403
379
const char *seckeyfilename){
404
380
int ret;
405
381
408
384
}
409
385
410
386
ret = gnutls_global_init();
411
if(ret != GNUTLS_E_SUCCESS){
412
fprintf(stderr, "GnuTLS global_init: %s\n",
413
safer_gnutls_strerror(ret));
387
if (ret != GNUTLS_E_SUCCESS) {
388
fprintf (stderr, "GnuTLS global_init: %s\n",
389
safer_gnutls_strerror(ret));
414
390
return -1;
415
391
}
416
392
417
if(debug){
393
if (debug){
418
394
/* "Use a log level over 10 to enable all debugging options."
419
395
* - GnuTLS manual
420
396
*/
423
399
}
424
400
425
401
/* OpenPGP credentials */
426
gnutls_certificate_allocate_credentials(&mc.cred);
427
if(ret != GNUTLS_E_SUCCESS){
428
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
429
from
430
-Wunreachable-code
431
*/
432
safer_gnutls_strerror(ret));
433
gnutls_global_deinit();
402
gnutls_certificate_allocate_credentials(&mc->cred);
403
if (ret != GNUTLS_E_SUCCESS){
404
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
405
warning */
406
safer_gnutls_strerror(ret));
407
gnutls_global_deinit ();
434
408
return -1;
435
409
}
436
410
441
415
}
442
416
443
417
ret = gnutls_certificate_set_openpgp_key_file
444
(mc.cred, pubkeyfilename, seckeyfilename,
418
(mc->cred, pubkeyfilename, seckeyfilename,
445
419
GNUTLS_OPENPGP_FMT_BASE64);
446
if(ret != GNUTLS_E_SUCCESS){
420
if (ret != GNUTLS_E_SUCCESS) {
447
421
fprintf(stderr,
448
422
"Error[%d] while reading the OpenPGP key pair ('%s',"
449
423
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
453
427
}
454
428
455
429
/* GnuTLS server initialization */
456
ret = gnutls_dh_params_init(&mc.dh_params);
457
if(ret != GNUTLS_E_SUCCESS){
458
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
459
" %s\n", safer_gnutls_strerror(ret));
430
ret = gnutls_dh_params_init(&mc->dh_params);
431
if (ret != GNUTLS_E_SUCCESS) {
432
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
433
" %s\n", safer_gnutls_strerror(ret));
460
434
goto globalfail;
461
435
}
462
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
463
if(ret != GNUTLS_E_SUCCESS){
464
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
465
safer_gnutls_strerror(ret));
436
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
437
if (ret != GNUTLS_E_SUCCESS) {
438
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
439
safer_gnutls_strerror(ret));
466
440
goto globalfail;
467
441
}
468
442
469
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
443
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
470
444
471
445
return 0;
472
446
473
447
globalfail:
474
448
475
gnutls_certificate_free_credentials(mc.cred);
449
gnutls_certificate_free_credentials(mc->cred);
476
450
gnutls_global_deinit();
477
gnutls_dh_params_deinit(mc.dh_params);
451
gnutls_dh_params_deinit(mc->dh_params);
478
452
return -1;
479
453
}
480
454
481
static int init_gnutls_session(gnutls_session_t *session){
455
static int init_gnutls_session(mandos_context *mc,
456
gnutls_session_t *session){
482
457
int ret;
483
458
/* GnuTLS session creation */
484
do {
485
ret = gnutls_init(session, GNUTLS_SERVER);
486
if(quit_now){
487
return -1;
488
}
489
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
490
if(ret != GNUTLS_E_SUCCESS){
459
ret = gnutls_init(session, GNUTLS_SERVER);
460
if (ret != GNUTLS_E_SUCCESS){
491
461
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
492
462
safer_gnutls_strerror(ret));
493
463
}
494
464
495
465
{
496
466
const char *err;
497
do {
498
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
499
if(quit_now){
500
gnutls_deinit(*session);
501
return -1;
502
}
503
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
504
if(ret != GNUTLS_E_SUCCESS){
467
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
468
if (ret != GNUTLS_E_SUCCESS) {
505
469
fprintf(stderr, "Syntax error at: %s\n", err);
506
470
fprintf(stderr, "GnuTLS error: %s\n",
507
471
safer_gnutls_strerror(ret));
508
gnutls_deinit(*session);
472
gnutls_deinit (*session);
509
473
return -1;
510
474
}
511
475
}
512
476
513
do {
514
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
515
mc.cred);
516
if(quit_now){
517
gnutls_deinit(*session);
518
return -1;
519
}
520
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
521
if(ret != GNUTLS_E_SUCCESS){
477
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
478
mc->cred);
479
if (ret != GNUTLS_E_SUCCESS) {
522
480
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
523
481
safer_gnutls_strerror(ret));
524
gnutls_deinit(*session);
482
gnutls_deinit (*session);
525
483
return -1;
526
484
}
527
485
528
486
/* ignore client certificate if any. */
529
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
487
gnutls_certificate_server_set_request (*session,
488
GNUTLS_CERT_IGNORE);
530
489
531
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
490
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
532
491
533
492
return 0;
534
493
}
540
499
/* Called when a Mandos server is found */
541
500
static int start_mandos_communication(const char *ip, uint16_t port,
542
501
AvahiIfIndex if_index,
543
int af){
544
int ret, tcp_sd = -1;
502
mandos_context *mc){
503
int ret, tcp_sd;
545
504
ssize_t sret;
546
union {
547
struct sockaddr_in in;
548
struct sockaddr_in6 in6;
549
} to;
505
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
550
506
char *buffer = NULL;
551
char *decrypted_buffer = NULL;
507
char *decrypted_buffer;
552
508
size_t buffer_length = 0;
553
509
size_t buffer_capacity = 0;
510
ssize_t decrypted_buffer_size;
554
511
size_t written;
555
int retval = -1;
512
int retval = 0;
513
char interface[IF_NAMESIZE];
556
514
gnutls_session_t session;
557
int pf; /* Protocol family */
558
559
errno = 0;
560
561
if(quit_now){
562
errno = EINTR;
563
return -1;
564
}
565
566
switch(af){
567
case AF_INET6:
568
pf = PF_INET6;
569
break;
570
case AF_INET:
571
pf = PF_INET;
572
break;
573
default:
574
fprintf(stderr, "Bad address family: %d\n", af);
575
errno = EINVAL;
576
return -1;
577
}
578
579
ret = init_gnutls_session(&session);
580
if(ret != 0){
515
516
ret = init_gnutls_session (mc, &session);
517
if (ret != 0){
581
518
return -1;
582
519
}
583
520
584
521
if(debug){
585
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
522
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
586
523
"\n", ip, port);
587
524
}
588
525
589
tcp_sd = socket(pf, SOCK_STREAM, 0);
590
if(tcp_sd < 0){
591
int e = errno;
526
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
527
if(tcp_sd < 0) {
592
528
perror("socket");
593
errno = e;
594
goto mandos_end;
529
return -1;
595
530
}
596
531
597
if(quit_now){
598
errno = EINTR;
599
goto mandos_end;
532
if(debug){
533
if(if_indextoname((unsigned int)if_index, interface) == NULL){
534
perror("if_indextoname");
535
return -1;
536
}
537
fprintf(stderr, "Binding to interface %s\n", interface);
600
538
}
601
539
602
540
memset(&to, 0, sizeof(to));
603
if(af == AF_INET6){
604
to.in6.sin6_family = (sa_family_t)af;
605
ret = inet_pton(af, ip, &to.in6.sin6_addr);
606
} else { /* IPv4 */
607
to.in.sin_family = (sa_family_t)af;
608
ret = inet_pton(af, ip, &to.in.sin_addr);
609
}
610
if(ret < 0 ){
611
int e = errno;
541
to.in6.sin6_family = AF_INET6;
542
/* It would be nice to have a way to detect if we were passed an
543
IPv4 address here. Now we assume an IPv6 address. */
544
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
545
if (ret < 0 ){
612
546
perror("inet_pton");
613
errno = e;
614
goto mandos_end;
547
return -1;
615
548
}
616
549
if(ret == 0){
617
int e = errno;
618
550
fprintf(stderr, "Bad address: %s\n", ip);
619
errno = e;
620
goto mandos_end;
621
}
622
if(af == AF_INET6){
623
to.in6.sin6_port = htons(port); /* Spurious warnings from
624
-Wconversion and
625
-Wunreachable-code */
626
627
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
628
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
629
-Wunreachable-code*/
630
if(if_index == AVAHI_IF_UNSPEC){
631
fprintf(stderr, "An IPv6 link-local address is incomplete"
632
" without a network interface\n");
633
errno = EINVAL;
634
goto mandos_end;
635
}
636
/* Set the network interface number as scope */
637
to.in6.sin6_scope_id = (uint32_t)if_index;
638
}
639
} else {
640
to.in.sin_port = htons(port); /* Spurious warnings from
641
-Wconversion and
642
-Wunreachable-code */
643
}
551
return -1;
552
}
553
to.in6.sin6_port = htons(port); /* Spurious warning */
644
554
645
if(quit_now){
646
errno = EINTR;
647
goto mandos_end;
648
}
555
to.in6.sin6_scope_id = (uint32_t)if_index;
649
556
650
557
if(debug){
651
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
652
char interface[IF_NAMESIZE];
653
if(if_indextoname((unsigned int)if_index, interface) == NULL){
654
perror("if_indextoname");
655
} else {
656
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
657
ip, interface, port);
658
}
659
} else {
660
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
661
port);
662
}
663
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
664
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
665
const char *pcret;
666
if(af == AF_INET6){
667
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
668
sizeof(addrstr));
669
} else {
670
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
671
sizeof(addrstr));
672
}
673
if(pcret == NULL){
558
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
559
port);
560
char addrstr[INET6_ADDRSTRLEN] = "";
561
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
562
sizeof(addrstr)) == NULL){
674
563
perror("inet_ntop");
675
564
} else {
676
565
if(strcmp(addrstr, ip) != 0){
679
568
}
680
569
}
681
570
682
if(quit_now){
683
errno = EINTR;
684
goto mandos_end;
685
}
686
687
if(af == AF_INET6){
688
ret = connect(tcp_sd, &to.in6, sizeof(to));
689
} else {
690
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
691
}
692
if(ret < 0){
693
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
694
int e = errno;
695
perror("connect");
696
errno = e;
697
}
698
goto mandos_end;
699
}
700
701
if(quit_now){
702
errno = EINTR;
703
goto mandos_end;
571
ret = connect(tcp_sd, &to.in, sizeof(to));
572
if (ret < 0){
573
perror("connect");
574
return -1;
704
575
}
705
576
706
577
const char *out = mandos_protocol_version;
707
578
written = 0;
708
while(true){
579
while (true){
709
580
size_t out_size = strlen(out);
710
581
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
711
582
out_size - written));
712
if(ret == -1){
713
int e = errno;
583
if (ret == -1){
714
584
perror("write");
715
errno = e;
585
retval = -1;
716
586
goto mandos_end;
717
587
}
718
588
written += (size_t)ret;
719
589
if(written < out_size){
720
590
continue;
721
591
} else {
722
if(out == mandos_protocol_version){
592
if (out == mandos_protocol_version){
723
593
written = 0;
724
594
out = "\r\n";
725
595
} else {
726
596
break;
727
597
}
728
598
}
729
730
if(quit_now){
731
errno = EINTR;
732
goto mandos_end;
733
}
734
599
}
735
600
736
601
if(debug){
737
602
fprintf(stderr, "Establishing TLS session with %s\n", ip);
738
603
}
739
604
740
if(quit_now){
741
errno = EINTR;
742
goto mandos_end;
743
}
744
745
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
746
747
if(quit_now){
748
errno = EINTR;
749
goto mandos_end;
750
}
751
752
do {
753
ret = gnutls_handshake(session);
754
if(quit_now){
755
errno = EINTR;
756
goto mandos_end;
757
}
605
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
606
607
do{
608
ret = gnutls_handshake (session);
758
609
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
759
610
760
if(ret != GNUTLS_E_SUCCESS){
611
if (ret != GNUTLS_E_SUCCESS){
761
612
if(debug){
762
613
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
763
gnutls_perror(ret);
614
gnutls_perror (ret);
764
615
}
765
errno = EPROTO;
616
retval = -1;
766
617
goto mandos_end;
767
618
}
768
619
769
620
/* Read OpenPGP packet that contains the wanted password */
770
621
771
622
if(debug){
772
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
623
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
773
624
ip);
774
625
}
775
626
776
627
while(true){
777
778
if(quit_now){
779
errno = EINTR;
780
goto mandos_end;
781
}
782
783
buffer_capacity = incbuffer(&buffer, buffer_length,
628
buffer_capacity = adjustbuffer(&buffer, buffer_length,
784
629
buffer_capacity);
785
if(buffer_capacity == 0){
786
int e = errno;
787
perror("incbuffer");
788
errno = e;
789
goto mandos_end;
790
}
791
792
if(quit_now){
793
errno = EINTR;
630
if (buffer_capacity == 0){
631
perror("adjustbuffer");
632
retval = -1;
794
633
goto mandos_end;
795
634
}
796
635
797
636
sret = gnutls_record_recv(session, buffer+buffer_length,
798
637
BUFFER_SIZE);
799
if(sret == 0){
638
if (sret == 0){
800
639
break;
801
640
}
802
if(sret < 0){
641
if (sret < 0){
803
642
switch(sret){
804
643
case GNUTLS_E_INTERRUPTED:
805
644
case GNUTLS_E_AGAIN:
806
645
break;
807
646
case GNUTLS_E_REHANDSHAKE:
808
do {
809
ret = gnutls_handshake(session);
810
811
if(quit_now){
812
errno = EINTR;
813
goto mandos_end;
814
}
647
do{
648
ret = gnutls_handshake (session);
815
649
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
816
if(ret < 0){
650
if (ret < 0){
817
651
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
818
gnutls_perror(ret);
819
errno = EPROTO;
652
gnutls_perror (ret);
653
retval = -1;
820
654
goto mandos_end;
821
655
}
822
656
break;
823
657
default:
824
658
fprintf(stderr, "Unknown error while reading data from"
825
659
" encrypted session with Mandos server\n");
826
gnutls_bye(session, GNUTLS_SHUT_RDWR);
827
errno = EIO;
660
retval = -1;
661
gnutls_bye (session, GNUTLS_SHUT_RDWR);
828
662
goto mandos_end;
829
663
}
830
664
} else {
836
670
fprintf(stderr, "Closing TLS session\n");
837
671
}
838
672
839
if(quit_now){
840
errno = EINTR;
841
goto mandos_end;
842
}
843
844
do {
845
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
846
if(quit_now){
847
errno = EINTR;
848
goto mandos_end;
849
}
850
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
851
852
if(buffer_length > 0){
853
ssize_t decrypted_buffer_size;
854
decrypted_buffer_size = pgp_packet_decrypt(buffer,
673
gnutls_bye (session, GNUTLS_SHUT_RDWR);
674
675
if (buffer_length > 0){
676
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
855
677
buffer_length,
856
678
&decrypted_buffer);
857
if(decrypted_buffer_size >= 0){
858
679
if (decrypted_buffer_size >= 0){
859
680
written = 0;
860
681
while(written < (size_t) decrypted_buffer_size){
861
if(quit_now){
862
errno = EINTR;
863
goto mandos_end;
864
}
865
866
ret = (int)fwrite(decrypted_buffer + written, 1,
867
(size_t)decrypted_buffer_size - written,
868
stdout);
682
ret = (int)fwrite (decrypted_buffer + written, 1,
683
(size_t)decrypted_buffer_size - written,
684
stdout);
869
685
if(ret == 0 and ferror(stdout)){
870
int e = errno;
871
686
if(debug){
872
687
fprintf(stderr, "Error writing encrypted data: %s\n",
873
688
strerror(errno));
874
689
}
875
errno = e;
876
goto mandos_end;
690
retval = -1;
691
break;
877
692
}
878
693
written += (size_t)ret;
879
694
}
880
retval = 0;
695
free(decrypted_buffer);
696
} else {
697
retval = -1;
881
698
}
699
} else {
700
retval = -1;
882
701
}
883
702
884
703
/* Shutdown procedure */
885
704
886
705
mandos_end:
887
{
888
int e = errno;
889
free(decrypted_buffer);
890
free(buffer);
891
if(tcp_sd >= 0){
892
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
893
}
894
if(ret == -1){
895
if(e == 0){
896
e = errno;
897
}
898
perror("close");
899
}
900
gnutls_deinit(session);
901
if(quit_now){
902
e = EINTR;
903
retval = -1;
904
}
905
errno = e;
706
free(buffer);
707
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
708
if(ret == -1){
709
perror("close");
906
710
}
711
gnutls_deinit (session);
907
712
return retval;
908
713
}
909
714
910
715
static void resolve_callback(AvahiSServiceResolver *r,
911
716
AvahiIfIndex interface,
912
AvahiProtocol proto,
717
AVAHI_GCC_UNUSED AvahiProtocol protocol,
913
718
AvahiResolverEvent event,
914
719
const char *name,
915
720
const char *type,
920
725
AVAHI_GCC_UNUSED AvahiStringList *txt,
921
726
AVAHI_GCC_UNUSED AvahiLookupResultFlags
922
727
flags,
923
AVAHI_GCC_UNUSED void* userdata){
728
void* userdata) {
729
mandos_context *mc = userdata;
924
730
assert(r);
925
731
926
732
/* Called whenever a service has been resolved successfully or
927
733
timed out */
928
734
929
if(quit_now){
930
return;
931
}
932
933
switch(event){
735
switch (event) {
934
736
default:
935
737
case AVAHI_RESOLVER_FAILURE:
936
738
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
937
739
" of type '%s' in domain '%s': %s\n", name, type, domain,
938
avahi_strerror(avahi_server_errno(mc.server)));
740
avahi_strerror(avahi_server_errno(mc->server)));
939
741
break;
940
742
941
743
case AVAHI_RESOLVER_FOUND:
944
746
avahi_address_snprint(ip, sizeof(ip), address);
945
747
if(debug){
946
748
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
947
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
948
ip, (intmax_t)interface, port);
749
PRIu16 ") on port %d\n", name, host_name, ip,
750
interface, port);
949
751
}
950
int ret = start_mandos_communication(ip, port, interface,
951
avahi_proto_to_af(proto));
952
if(ret == 0){
953
avahi_simple_poll_quit(mc.simple_poll);
752
int ret = start_mandos_communication(ip, port, interface, mc);
753
if (ret == 0){
754
avahi_simple_poll_quit(mc->simple_poll);
954
755
}
955
756
}
956
757
}
957
758
avahi_s_service_resolver_free(r);
958
759
}
959
760
960
static void browse_callback(AvahiSServiceBrowser *b,
961
AvahiIfIndex interface,
962
AvahiProtocol protocol,
963
AvahiBrowserEvent event,
964
const char *name,
965
const char *type,
966
const char *domain,
967
AVAHI_GCC_UNUSED AvahiLookupResultFlags
968
flags,
969
AVAHI_GCC_UNUSED void* userdata){
761
static void browse_callback( AvahiSServiceBrowser *b,
762
AvahiIfIndex interface,
763
AvahiProtocol protocol,
764
AvahiBrowserEvent event,
765
const char *name,
766
const char *type,
767
const char *domain,
768
AVAHI_GCC_UNUSED AvahiLookupResultFlags
769
flags,
770
void* userdata) {
771
mandos_context *mc = userdata;
970
772
assert(b);
971
773
972
774
/* Called whenever a new services becomes available on the LAN or
973
775
is removed from the LAN */
974
776
975
if(quit_now){
976
return;
977
}
978
979
switch(event){
777
switch (event) {
980
778
default:
981
779
case AVAHI_BROWSER_FAILURE:
982
780
983
781
fprintf(stderr, "(Avahi browser) %s\n",
984
avahi_strerror(avahi_server_errno(mc.server)));
985
avahi_simple_poll_quit(mc.simple_poll);
782
avahi_strerror(avahi_server_errno(mc->server)));
783
avahi_simple_poll_quit(mc->simple_poll);
986
784
return;
987
785
988
786
case AVAHI_BROWSER_NEW:
991
789
the callback function is called the Avahi server will free the
992
790
resolver for us. */
993
791
994
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
995
name, type, domain, protocol, 0,
996
resolve_callback, NULL) == NULL)
792
if (!(avahi_s_service_resolver_new(mc->server, interface,
793
protocol, name, type, domain,
794
AVAHI_PROTO_INET6, 0,
795
resolve_callback, mc)))
997
796
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
998
name, avahi_strerror(avahi_server_errno(mc.server)));
797
name, avahi_strerror(avahi_server_errno(mc->server)));
999
798
break;
1000
799
1001
800
case AVAHI_BROWSER_REMOVE:
1010
809
}
1011
810
}
1012
811
1013
/* stop main loop after sigterm has been called */
1014
static void handle_sigterm(int sig){
1015
if(quit_now){
1016
return;
1017
}
1018
quit_now = 1;
1019
signal_received = sig;
1020
int old_errno = errno;
1021
if(mc.simple_poll != NULL){
1022
avahi_simple_poll_quit(mc.simple_poll);
1023
}
1024
errno = old_errno;
1025
}
1026
1027
/*
1028
* This function determines if a directory entry in /sys/class/net
1029
* corresponds to an acceptable network device.
1030
* (This function is passed to scandir(3) as a filter function.)
1031
*/
1032
int good_interface(const struct dirent *if_entry){
1033
ssize_t ssret;
1034
char *flagname = NULL;
1035
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
1036
if_entry->d_name);
1037
if(ret < 0){
1038
perror("asprintf");
1039
return 0;
1040
}
1041
if(if_entry->d_name[0] == '.'){
1042
return 0;
1043
}
1044
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1045
if(flags_fd == -1){
1046
perror("open");
1047
return 0;
1048
}
1049
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1050
/* read line from flags_fd */
1051
ssize_t to_read = (sizeof(ifreq_flags)*2)+3; /* "0x1003\n" */
1052
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1053
flagstring[(size_t)to_read] = '\0';
1054
if(flagstring == NULL){
1055
perror("malloc");
1056
close(flags_fd);
1057
return 0;
1058
}
1059
while(to_read > 0){
1060
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1061
(size_t)to_read));
1062
if(ssret == -1){
1063
perror("read");
1064
free(flagstring);
1065
close(flags_fd);
1066
return 0;
1067
}
1068
to_read -= ssret;
1069
if(ssret == 0){
1070
break;
1071
}
1072
}
1073
close(flags_fd);
1074
intmax_t tmpmax;
1075
char *tmp;
1076
errno = 0;
1077
tmpmax = strtoimax(flagstring, &tmp, 0);
1078
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1079
and not (isspace(*tmp)))
1080
or tmpmax != (ifreq_flags)tmpmax){
1081
if(debug){
1082
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1083
flagstring, if_entry->d_name);
1084
}
1085
free(flagstring);
1086
return 0;
1087
}
1088
free(flagstring);
1089
ifreq_flags flags = (ifreq_flags)tmpmax;
1090
/* Reject the loopback device */
1091
if(flags & IFF_LOOPBACK){
1092
if(debug){
1093
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1094
if_entry->d_name);
1095
}
1096
return 0;
1097
}
1098
/* Accept point-to-point devices only if connect_to is specified */
1099
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1100
if(debug){
1101
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1102
if_entry->d_name);
1103
}
1104
return 1;
1105
}
1106
/* Otherwise, reject non-broadcast-capable devices */
1107
if(not (flags & IFF_BROADCAST)){
1108
if(debug){
1109
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1110
if_entry->d_name);
1111
}
1112
return 0;
1113
}
1114
/* Accept this device */
1115
if(debug){
1116
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1117
if_entry->d_name);
1118
}
1119
return 1;
1120
}
1121
1122
812
int main(int argc, char *argv[]){
1123
AvahiSServiceBrowser *sb = NULL;
1124
int error;
1125
int ret;
1126
intmax_t tmpmax;
1127
char *tmp;
1128
int exitcode = EXIT_SUCCESS;
1129
const char *interface = "";
1130
struct ifreq network;
1131
int sd = -1;
1132
bool take_down_interface = false;
1133
uid_t uid;
1134
gid_t gid;
1135
char tempdir[] = "/tmp/mandosXXXXXX";
1136
bool tempdir_created = false;
1137
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1138
const char *seckey = PATHDIR "/" SECKEY;
1139
const char *pubkey = PATHDIR "/" PUBKEY;
1140
1141
bool gnutls_initialized = false;
1142
bool gpgme_initialized = false;
1143
float delay = 2.5f;
1144
1145
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1146
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1147
1148
uid = getuid();
1149
gid = getgid();
1150
1151
/* Lower any group privileges we might have, just to be safe */
1152
errno = 0;
1153
ret = setgid(gid);
1154
if(ret == -1){
1155
perror("setgid");
1156
}
1157
1158
/* Lower user privileges (temporarily) */
1159
errno = 0;
1160
ret = seteuid(uid);
1161
if(ret == -1){
1162
perror("seteuid");
1163
}
1164
1165
if(quit_now){
1166
goto end;
1167
}
1168
1169
{
1170
struct argp_option options[] = {
1171
{ .name = "debug", .key = 128,
1172
.doc = "Debug mode", .group = 3 },
1173
{ .name = "connect", .key = 'c',
1174
.arg = "ADDRESS:PORT",
1175
.doc = "Connect directly to a specific Mandos server",
1176
.group = 1 },
1177
{ .name = "interface", .key = 'i',
1178
.arg = "NAME",
1179
.doc = "Network interface that will be used to search for"
1180
" Mandos servers",
1181
.group = 1 },
1182
{ .name = "seckey", .key = 's',
1183
.arg = "FILE",
1184
.doc = "OpenPGP secret key file base name",
1185
.group = 1 },
1186
{ .name = "pubkey", .key = 'p',
1187
.arg = "FILE",
1188
.doc = "OpenPGP public key file base name",
1189
.group = 2 },
1190
{ .name = "dh-bits", .key = 129,
1191
.arg = "BITS",
1192
.doc = "Bit length of the prime number used in the"
1193
" Diffie-Hellman key exchange",
1194
.group = 2 },
1195
{ .name = "priority", .key = 130,
1196
.arg = "STRING",
1197
.doc = "GnuTLS priority string for the TLS handshake",
1198
.group = 1 },
1199
{ .name = "delay", .key = 131,
1200
.arg = "SECONDS",
1201
.doc = "Maximum delay to wait for interface startup",
1202
.group = 2 },
1203
/*
1204
* These reproduce what we would get without ARGP_NO_HELP
1205
*/
1206
{ .name = "help", .key = '?',
1207
.doc = "Give this help list", .group = -1 },
1208
{ .name = "usage", .key = -3,
1209
.doc = "Give a short usage message", .group = -1 },
1210
{ .name = "version", .key = 'V',
1211
.doc = "Print program version", .group = -1 },
1212
{ .name = NULL }
1213
};
1214
1215
error_t parse_opt(int key, char *arg,
1216
struct argp_state *state){
1217
errno = 0;
1218
switch(key){
1219
case 128: /* --debug */
1220
debug = true;
1221
break;
1222
case 'c': /* --connect */
1223
connect_to = arg;
1224
break;
1225
case 'i': /* --interface */
1226
interface = arg;
1227
break;
1228
case 's': /* --seckey */
1229
seckey = arg;
1230
break;
1231
case 'p': /* --pubkey */
1232
pubkey = arg;
1233
break;
1234
case 129: /* --dh-bits */
1235
errno = 0;
1236
tmpmax = strtoimax(arg, &tmp, 10);
1237
if(errno != 0 or tmp == arg or *tmp != '\0'
1238
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1239
argp_error(state, "Bad number of DH bits");
1240
}
1241
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1242
break;
1243
case 130: /* --priority */
1244
mc.priority = arg;
1245
break;
1246
case 131: /* --delay */
1247
errno = 0;
1248
delay = strtof(arg, &tmp);
1249
if(errno != 0 or tmp == arg or *tmp != '\0'){
1250
argp_error(state, "Bad delay");
1251
}
1252
break;
1253
/*
1254
* These reproduce what we would get without ARGP_NO_HELP
1255
*/
1256
case '?': /* --help */
1257
argp_state_help(state, state->out_stream,
1258
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1259
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1260
case -3: /* --usage */
1261
argp_state_help(state, state->out_stream,
1262
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1263
case 'V': /* --version */
1264
fprintf(state->out_stream, "%s\n", argp_program_version);
1265
exit(argp_err_exit_status);
1266
break;
1267
default:
1268
return ARGP_ERR_UNKNOWN;
1269
}
1270
return errno;
1271
}
1272
1273
struct argp argp = { .options = options, .parser = parse_opt,
1274
.args_doc = "",
1275
.doc = "Mandos client -- Get and decrypt"
1276
" passwords from a Mandos server" };
1277
ret = argp_parse(&argp, argc, argv,
1278
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1279
switch(ret){
1280
case 0:
1281
break;
1282
case ENOMEM:
1283
default:
1284
errno = ret;
1285
perror("argp_parse");
1286
exitcode = EX_OSERR;
1287
goto end;
1288
case EINVAL:
1289
exitcode = EX_USAGE;
1290
goto end;
1291
}
1292
}
1293
1294
if(not debug){
1295
avahi_set_log_function(empty_log);
1296
}
1297
1298
if(interface[0] == '\0'){
1299
struct dirent **direntries;
1300
ret = scandir(sys_class_net, &direntries, good_interface,
1301
alphasort);
1302
if(ret >= 1){
1303
/* Pick the first good interface */
1304
interface = strdup(direntries[0]->d_name);
1305
if(debug){
1306
fprintf(stderr, "Using interface \"%s\"\n", interface);
1307
}
1308
if(interface == NULL){
1309
perror("malloc");
1310
free(direntries);
1311
exitcode = EXIT_FAILURE;
1312
goto end;
1313
}
1314
free(direntries);
1315
} else {
1316
free(direntries);
1317
fprintf(stderr, "Could not find a network interface\n");
1318
exitcode = EXIT_FAILURE;
1319
goto end;
1320
}
1321
}
1322
1323
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1324
from the signal handler */
1325
/* Initialize the pseudo-RNG for Avahi */
1326
srand((unsigned int) time(NULL));
1327
mc.simple_poll = avahi_simple_poll_new();
1328
if(mc.simple_poll == NULL){
1329
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1330
exitcode = EX_UNAVAILABLE;
1331
goto end;
1332
}
1333
1334
sigemptyset(&sigterm_action.sa_mask);
1335
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1336
if(ret == -1){
1337
perror("sigaddset");
1338
exitcode = EX_OSERR;
1339
goto end;
1340
}
1341
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1342
if(ret == -1){
1343
perror("sigaddset");
1344
exitcode = EX_OSERR;
1345
goto end;
1346
}
1347
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1348
if(ret == -1){
1349
perror("sigaddset");
1350
exitcode = EX_OSERR;
1351
goto end;
1352
}
1353
/* Need to check if the handler is SIG_IGN before handling:
1354
| [[info:libc:Initial Signal Actions]] |
1355
| [[info:libc:Basic Signal Handling]] |
1356
*/
1357
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1358
if(ret == -1){
1359
perror("sigaction");
1360
return EX_OSERR;
1361
}
1362
if(old_sigterm_action.sa_handler != SIG_IGN){
1363
ret = sigaction(SIGINT, &sigterm_action, NULL);
1364
if(ret == -1){
1365
perror("sigaction");
1366
exitcode = EX_OSERR;
1367
goto end;
1368
}
1369
}
1370
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1371
if(ret == -1){
1372
perror("sigaction");
1373
return EX_OSERR;
1374
}
1375
if(old_sigterm_action.sa_handler != SIG_IGN){
1376
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1377
if(ret == -1){
1378
perror("sigaction");
1379
exitcode = EX_OSERR;
1380
goto end;
1381
}
1382
}
1383
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1384
if(ret == -1){
1385
perror("sigaction");
1386
return EX_OSERR;
1387
}
1388
if(old_sigterm_action.sa_handler != SIG_IGN){
1389
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1390
if(ret == -1){
1391
perror("sigaction");
1392
exitcode = EX_OSERR;
1393
goto end;
1394
}
1395
}
1396
1397
/* If the interface is down, bring it up */
1398
if(strcmp(interface, "none") != 0){
813
AvahiSServiceBrowser *sb = NULL;
814
int error;
815
int ret;
816
int exitcode = EXIT_SUCCESS;
817
const char *interface = "eth0";
818
struct ifreq network;
819
int sd;
820
uid_t uid;
821
gid_t gid;
822
char *connect_to = NULL;
823
char tempdir[] = "/tmp/mandosXXXXXX";
824
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
825
const char *seckey = PATHDIR "/" SECKEY;
826
const char *pubkey = PATHDIR "/" PUBKEY;
827
828
mandos_context mc = { .simple_poll = NULL, .server = NULL,
829
.dh_bits = 1024, .priority = "SECURE256"
830
":!CTYPE-X.509:+CTYPE-OPENPGP" };
831
bool gnutls_initalized = false;
832
bool gpgme_initalized = false;
833
834
{
835
struct argp_option options[] = {
836
{ .name = "debug", .key = 128,
837
.doc = "Debug mode", .group = 3 },
838
{ .name = "connect", .key = 'c',
839
.arg = "ADDRESS:PORT",
840
.doc = "Connect directly to a specific Mandos server",
841
.group = 1 },
842
{ .name = "interface", .key = 'i',
843
.arg = "NAME",
844
.doc = "Interface that will be used to search for Mandos"
845
" servers",
846
.group = 1 },
847
{ .name = "seckey", .key = 's',
848
.arg = "FILE",
849
.doc = "OpenPGP secret key file base name",
850
.group = 1 },
851
{ .name = "pubkey", .key = 'p',
852
.arg = "FILE",
853
.doc = "OpenPGP public key file base name",
854
.group = 2 },
855
{ .name = "dh-bits", .key = 129,
856
.arg = "BITS",
857
.doc = "Bit length of the prime number used in the"
858
" Diffie-Hellman key exchange",
859
.group = 2 },
860
{ .name = "priority", .key = 130,
861
.arg = "STRING",
862
.doc = "GnuTLS priority string for the TLS handshake",
863
.group = 1 },
864
{ .name = NULL }
865
};
866
867
error_t parse_opt (int key, char *arg,
868
struct argp_state *state) {
869
switch (key) {
870
case 128: /* --debug */
871
debug = true;
872
break;
873
case 'c': /* --connect */
874
connect_to = arg;
875
break;
876
case 'i': /* --interface */
877
interface = arg;
878
break;
879
case 's': /* --seckey */
880
seckey = arg;
881
break;
882
case 'p': /* --pubkey */
883
pubkey = arg;
884
break;
885
case 129: /* --dh-bits */
886
ret = sscanf(arg, "%u", &mc.dh_bits);
887
if(ret == 0 or mc.dh_bits == 0){
888
fprintf(stderr, "Bad number of DH bits\n");
889
exit(EXIT_FAILURE);
890
}
891
break;
892
case 130: /* --priority */
893
mc.priority = arg;
894
break;
895
case ARGP_KEY_ARG:
896
argp_usage (state);
897
case ARGP_KEY_END:
898
break;
899
default:
900
return ARGP_ERR_UNKNOWN;
901
}
902
return 0;
903
}
904
905
struct argp argp = { .options = options, .parser = parse_opt,
906
.args_doc = "",
907
.doc = "Mandos client -- Get and decrypt"
908
" passwords from a Mandos server" };
909
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
910
if (ret == ARGP_ERR_UNKNOWN){
911
fprintf(stderr, "Unknown error while parsing arguments\n");
912
exitcode = EXIT_FAILURE;
913
goto end;
914
}
915
}
916
917
/* If the interface is down, bring it up */
918
{
919
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
920
if(sd < 0) {
921
perror("socket");
922
exitcode = EXIT_FAILURE;
923
goto end;
924
}
925
strcpy(network.ifr_name, interface);
926
ret = ioctl(sd, SIOCGIFFLAGS, &network);
927
if(ret == -1){
928
perror("ioctl SIOCGIFFLAGS");
929
exitcode = EXIT_FAILURE;
930
goto end;
931
}
932
if((network.ifr_flags & IFF_UP) == 0){
933
network.ifr_flags |= IFF_UP;
934
ret = ioctl(sd, SIOCSIFFLAGS, &network);
935
if(ret == -1){
936
perror("ioctl SIOCSIFFLAGS");
937
exitcode = EXIT_FAILURE;
938
goto end;
939
}
940
}
941
ret = (int)TEMP_FAILURE_RETRY(close(sd));
942
if(ret == -1){
943
perror("close");
944
}
945
}
946
947
uid = getuid();
948
gid = getgid();
949
950
ret = setuid(uid);
951
if (ret == -1){
952
perror("setuid");
953
}
954
955
setgid(gid);
956
if (ret == -1){
957
perror("setgid");
958
}
959
960
ret = init_gnutls_global(&mc, pubkey, seckey);
961
if (ret == -1){
962
fprintf(stderr, "init_gnutls_global failed\n");
963
exitcode = EXIT_FAILURE;
964
goto end;
965
} else {
966
gnutls_initalized = true;
967
}
968
969
if(mkdtemp(tempdir) == NULL){
970
perror("mkdtemp");
971
tempdir[0] = '\0';
972
goto end;
973
}
974
975
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
976
fprintf(stderr, "gpgme_initalized failed\n");
977
exitcode = EXIT_FAILURE;
978
goto end;
979
} else {
980
gpgme_initalized = true;
981
}
982
1399
983
if_index = (AvahiIfIndex) if_nametoindex(interface);
1400
984
if(if_index == 0){
1401
985
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1402
exitcode = EX_UNAVAILABLE;
1403
goto end;
1404
}
1405
1406
if(quit_now){
1407
goto end;
1408
}
1409
1410
/* Re-raise priviliges */
1411
errno = 0;
1412
ret = seteuid(0);
1413
if(ret == -1){
1414
perror("seteuid");
1415
}
1416
1417
#ifdef __linux__
1418
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1419
messages about the network interface to mess up the prompt */
1420
ret = klogctl(8, NULL, 5);
1421
bool restore_loglevel = true;
1422
if(ret == -1){
1423
restore_loglevel = false;
1424
perror("klogctl");
1425
}
1426
#endif /* __linux__ */
1427
1428
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1429
if(sd < 0){
1430
perror("socket");
1431
exitcode = EX_OSERR;
1432
#ifdef __linux__
1433
if(restore_loglevel){
1434
ret = klogctl(7, NULL, 0);
1435
if(ret == -1){
1436
perror("klogctl");
1437
}
1438
}
1439
#endif /* __linux__ */
1440
/* Lower privileges */
1441
errno = 0;
1442
ret = seteuid(uid);
1443
if(ret == -1){
1444
perror("seteuid");
1445
}
1446
goto end;
1447
}
1448
strcpy(network.ifr_name, interface);
1449
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1450
if(ret == -1){
1451
perror("ioctl SIOCGIFFLAGS");
1452
#ifdef __linux__
1453
if(restore_loglevel){
1454
ret = klogctl(7, NULL, 0);
1455
if(ret == -1){
1456
perror("klogctl");
1457
}
1458
}
1459
#endif /* __linux__ */
1460
exitcode = EX_OSERR;
1461
/* Lower privileges */
1462
errno = 0;
1463
ret = seteuid(uid);
1464
if(ret == -1){
1465
perror("seteuid");
1466
}
1467
goto end;
1468
}
1469
if((network.ifr_flags & IFF_UP) == 0){
1470
network.ifr_flags |= IFF_UP;
1471
take_down_interface = true;
1472
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1473
if(ret == -1){
1474
take_down_interface = false;
1475
perror("ioctl SIOCSIFFLAGS +IFF_UP");
1476
exitcode = EX_OSERR;
1477
#ifdef __linux__
1478
if(restore_loglevel){
1479
ret = klogctl(7, NULL, 0);
1480
if(ret == -1){
1481
perror("klogctl");
1482
}
1483
}
1484
#endif /* __linux__ */
1485
/* Lower privileges */
1486
errno = 0;
1487
ret = seteuid(uid);
1488
if(ret == -1){
1489
perror("seteuid");
1490
}
1491
goto end;
1492
}
1493
}
1494
/* sleep checking until interface is running */
1495
for(int i=0; i < delay * 4; i++){
1496
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1497
if(ret == -1){
1498
perror("ioctl SIOCGIFFLAGS");
1499
} else if(network.ifr_flags & IFF_RUNNING){
1500
break;
1501
}
1502
struct timespec sleeptime = { .tv_nsec = 250000000 };
1503
ret = nanosleep(&sleeptime, NULL);
1504
if(ret == -1 and errno != EINTR){
1505
perror("nanosleep");
1506
}
1507
}
1508
if(not take_down_interface){
1509
/* We won't need the socket anymore */
1510
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1511
if(ret == -1){
1512
perror("close");
1513
}
1514
}
1515
#ifdef __linux__
1516
if(restore_loglevel){
1517
/* Restores kernel loglevel to default */
1518
ret = klogctl(7, NULL, 0);
1519
if(ret == -1){
1520
perror("klogctl");
1521
}
1522
}
1523
#endif /* __linux__ */
1524
/* Lower privileges */
1525
errno = 0;
1526
if(take_down_interface){
1527
/* Lower privileges */
1528
ret = seteuid(uid);
1529
if(ret == -1){
1530
perror("seteuid");
1531
}
1532
} else {
1533
/* Lower privileges permanently */
1534
ret = setuid(uid);
1535
if(ret == -1){
1536
perror("setuid");
1537
}
1538
}
1539
}
1540
1541
if(quit_now){
1542
goto end;
1543
}
1544
1545
ret = init_gnutls_global(pubkey, seckey);
1546
if(ret == -1){
1547
fprintf(stderr, "init_gnutls_global failed\n");
1548
exitcode = EX_UNAVAILABLE;
1549
goto end;
1550
} else {
1551
gnutls_initialized = true;
1552
}
1553
1554
if(quit_now){
1555
goto end;
1556
}
1557
1558
tempdir_created = true;
1559
if(mkdtemp(tempdir) == NULL){
1560
tempdir_created = false;
1561
perror("mkdtemp");
1562
goto end;
1563
}
1564
1565
if(quit_now){
1566
goto end;
1567
}
1568
1569
if(not init_gpgme(pubkey, seckey, tempdir)){
1570
fprintf(stderr, "init_gpgme failed\n");
1571
exitcode = EX_UNAVAILABLE;
1572
goto end;
1573
} else {
1574
gpgme_initialized = true;
1575
}
1576
1577
if(quit_now){
1578
goto end;
1579
}
1580
1581
if(connect_to != NULL){
1582
/* Connect directly, do not use Zeroconf */
1583
/* (Mainly meant for debugging) */
1584
char *address = strrchr(connect_to, ':');
1585
if(address == NULL){
1586
fprintf(stderr, "No colon in address\n");
1587
exitcode = EX_USAGE;
1588
goto end;
1589
}
1590
1591
if(quit_now){
1592
goto end;
1593
}
1594
1595
uint16_t port;
1596
errno = 0;
1597
tmpmax = strtoimax(address+1, &tmp, 10);
1598
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1599
or tmpmax != (uint16_t)tmpmax){
1600
fprintf(stderr, "Bad port number\n");
1601
exitcode = EX_USAGE;
1602
goto end;
1603
}
1604
1605
if(quit_now){
1606
goto end;
1607
}
1608
1609
port = (uint16_t)tmpmax;
1610
*address = '\0';
1611
address = connect_to;
1612
/* Colon in address indicates IPv6 */
1613
int af;
1614
if(strchr(address, ':') != NULL){
1615
af = AF_INET6;
1616
} else {
1617
af = AF_INET;
1618
}
1619
1620
if(quit_now){
1621
goto end;
1622
}
1623
1624
while(not quit_now){
1625
ret = start_mandos_communication(address, port, if_index, af);
1626
if(quit_now or ret == 0){
1627
break;
1628
}
1629
sleep(15);
1630
};
1631
1632
if (not quit_now){
1633
exitcode = EXIT_SUCCESS;
1634
}
1635
1636
goto end;
1637
}
1638
1639
if(quit_now){
1640
goto end;
1641
}
1642
1643
{
1644
AvahiServerConfig config;
1645
/* Do not publish any local Zeroconf records */
1646
avahi_server_config_init(&config);
1647
config.publish_hinfo = 0;
1648
config.publish_addresses = 0;
1649
config.publish_workstation = 0;
1650
config.publish_domain = 0;
1651
1652
/* Allocate a new server */
1653
mc.server = avahi_server_new(avahi_simple_poll_get
1654
(mc.simple_poll), &config, NULL,
1655
NULL, &error);
1656
1657
/* Free the Avahi configuration data */
1658
avahi_server_config_free(&config);
1659
}
1660
1661
/* Check if creating the Avahi server object succeeded */
1662
if(mc.server == NULL){
1663
fprintf(stderr, "Failed to create Avahi server: %s\n",
1664
avahi_strerror(error));
1665
exitcode = EX_UNAVAILABLE;
1666
goto end;
1667
}
1668
1669
if(quit_now){
1670
goto end;
1671
}
1672
1673
/* Create the Avahi service browser */
1674
sb = avahi_s_service_browser_new(mc.server, if_index,
1675
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1676
NULL, 0, browse_callback, NULL);
1677
if(sb == NULL){
1678
fprintf(stderr, "Failed to create service browser: %s\n",
1679
avahi_strerror(avahi_server_errno(mc.server)));
1680
exitcode = EX_UNAVAILABLE;
1681
goto end;
1682
}
1683
1684
if(quit_now){
1685
goto end;
1686
}
1687
1688
/* Run the main loop */
1689
1690
if(debug){
1691
fprintf(stderr, "Starting Avahi loop search\n");
1692
}
1693
1694
avahi_simple_poll_loop(mc.simple_poll);
1695
986
exit(EXIT_FAILURE);
987
}
988
989
if(connect_to != NULL){
990
/* Connect directly, do not use Zeroconf */
991
/* (Mainly meant for debugging) */
992
char *address = strrchr(connect_to, ':');
993
if(address == NULL){
994
fprintf(stderr, "No colon in address\n");
995
exitcode = EXIT_FAILURE;
996
goto end;
997
}
998
uint16_t port;
999
ret = sscanf(address+1, "%" SCNu16, &port);
1000
if(ret == 0 or port == 0){
1001
fprintf(stderr, "Bad port number\n");
1002
exitcode = EXIT_FAILURE;
1003
goto end;
1004
}
1005
*address = '\0';
1006
address = connect_to;
1007
ret = start_mandos_communication(address, port, if_index, &mc);
1008
if(ret < 0){
1009
exitcode = EXIT_FAILURE;
1010
} else {
1011
exitcode = EXIT_SUCCESS;
1012
}
1013
goto end;
1014
}
1015
1016
if (not debug){
1017
avahi_set_log_function(empty_log);
1018
}
1019
1020
/* Initialize the pseudo-RNG for Avahi */
1021
srand((unsigned int) time(NULL));
1022
1023
/* Allocate main Avahi loop object */
1024
mc.simple_poll = avahi_simple_poll_new();
1025
if (mc.simple_poll == NULL) {
1026
fprintf(stderr, "Avahi: Failed to create simple poll"
1027
" object.\n");
1028
exitcode = EXIT_FAILURE;
1029
goto end;
1030
}
1031
1032
{
1033
AvahiServerConfig config;
1034
/* Do not publish any local Zeroconf records */
1035
avahi_server_config_init(&config);
1036
config.publish_hinfo = 0;
1037
config.publish_addresses = 0;
1038
config.publish_workstation = 0;
1039
config.publish_domain = 0;
1040
1041
/* Allocate a new server */
1042
mc.server = avahi_server_new(avahi_simple_poll_get
1043
(mc.simple_poll), &config, NULL,
1044
NULL, &error);
1045
1046
/* Free the Avahi configuration data */
1047
avahi_server_config_free(&config);
1048
}
1049
1050
/* Check if creating the Avahi server object succeeded */
1051
if (mc.server == NULL) {
1052
fprintf(stderr, "Failed to create Avahi server: %s\n",
1053
avahi_strerror(error));
1054
exitcode = EXIT_FAILURE;
1055
goto end;
1056
}
1057
1058
/* Create the Avahi service browser */
1059
sb = avahi_s_service_browser_new(mc.server, if_index,
1060
AVAHI_PROTO_INET6,
1061
"_mandos._tcp", NULL, 0,
1062
browse_callback, &mc);
1063
if (sb == NULL) {
1064
fprintf(stderr, "Failed to create service browser: %s\n",
1065
avahi_strerror(avahi_server_errno(mc.server)));
1066
exitcode = EXIT_FAILURE;
1067
goto end;
1068
}
1069
1070
/* Run the main loop */
1071
1072
if (debug){
1073
fprintf(stderr, "Starting Avahi loop search\n");
1074
}
1075
1076
avahi_simple_poll_loop(mc.simple_poll);
1077
1696
1078
end:
1697
1698
if(debug){
1699
fprintf(stderr, "%s exiting\n", argv[0]);
1700
}
1701
1702
/* Cleanup things */
1703
if(sb != NULL)
1704
avahi_s_service_browser_free(sb);
1705
1706
if(mc.server != NULL)
1707
avahi_server_free(mc.server);
1708
1709
if(mc.simple_poll != NULL)
1710
avahi_simple_poll_free(mc.simple_poll);
1711
1712
if(gnutls_initialized){
1713
gnutls_certificate_free_credentials(mc.cred);
1714
gnutls_global_deinit();
1715
gnutls_dh_params_deinit(mc.dh_params);
1716
}
1717
1718
if(gpgme_initialized){
1719
gpgme_release(mc.ctx);
1720
}
1721
1722
/* Take down the network interface */
1723
if(take_down_interface){
1724
/* Re-raise priviliges */
1725
errno = 0;
1726
ret = seteuid(0);
1727
if(ret == -1){
1728
perror("seteuid");
1729
}
1730
if(geteuid() == 0){
1731
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1732
if(ret == -1){
1733
perror("ioctl SIOCGIFFLAGS");
1734
} else if(network.ifr_flags & IFF_UP) {
1735
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1736
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1737
if(ret == -1){
1738
perror("ioctl SIOCSIFFLAGS -IFF_UP");
1739
}
1740
}
1741
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1742
if(ret == -1){
1743
perror("close");
1744
}
1745
/* Lower privileges permanently */
1746
errno = 0;
1747
ret = setuid(uid);
1748
if(ret == -1){
1749
perror("setuid");
1750
}
1751
}
1752
}
1753
1754
/* Removes the temp directory used by GPGME */
1755
if(tempdir_created){
1756
DIR *d;
1757
struct dirent *direntry;
1758
d = opendir(tempdir);
1759
if(d == NULL){
1760
if(errno != ENOENT){
1761
perror("opendir");
1762
}
1763
} else {
1764
while(true){
1765
direntry = readdir(d);
1766
if(direntry == NULL){
1767
break;
1768
}
1769
/* Skip "." and ".." */
1770
if(direntry->d_name[0] == '.'
1771
and (direntry->d_name[1] == '\0'
1772
or (direntry->d_name[1] == '.'
1773
and direntry->d_name[2] == '\0'))){
1774
continue;
1775
}
1776
char *fullname = NULL;
1777
ret = asprintf(&fullname, "%s/%s", tempdir,
1778
direntry->d_name);
1779
if(ret < 0){
1780
perror("asprintf");
1781
continue;
1782
}
1783
ret = remove(fullname);
1784
if(ret == -1){
1785
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1786
strerror(errno));
1787
}
1788
free(fullname);
1789
}
1790
closedir(d);
1791
}
1792
ret = rmdir(tempdir);
1793
if(ret == -1 and errno != ENOENT){
1794
perror("rmdir");
1795
}
1796
}
1797
1798
if(quit_now){
1799
sigemptyset(&old_sigterm_action.sa_mask);
1800
old_sigterm_action.sa_handler = SIG_DFL;
1801
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1802
&old_sigterm_action,
1803
NULL));
1804
if(ret == -1){
1805
perror("sigaction");
1806
}
1807
do {
1808
ret = raise(signal_received);
1809
} while(ret != 0 and errno == EINTR);
1810
if(ret != 0){
1811
perror("raise");
1812
abort();
1813
}
1814
TEMP_FAILURE_RETRY(pause());
1815
}
1816
1817
return exitcode;
1079
1080
if (debug){
1081
fprintf(stderr, "%s exiting\n", argv[0]);
1082
}
1083
1084
/* Cleanup things */
1085
if (sb != NULL)
1086
avahi_s_service_browser_free(sb);
1087
1088
if (mc.server != NULL)
1089
avahi_server_free(mc.server);
1090
1091
if (mc.simple_poll != NULL)
1092
avahi_simple_poll_free(mc.simple_poll);
1093
1094
if (gnutls_initalized){
1095
gnutls_certificate_free_credentials(mc.cred);
1096
gnutls_global_deinit ();
1097
gnutls_dh_params_deinit(mc.dh_params);
1098
}
1099
1100
if(gpgme_initalized){
1101
gpgme_release(mc.ctx);
1102
}
1103
1104
/* Removes the temp directory used by GPGME */
1105
if(tempdir[0] != '\0'){
1106
DIR *d;
1107
struct dirent *direntry;
1108
d = opendir(tempdir);
1109
if(d == NULL){
1110
if(errno != ENOENT){
1111
perror("opendir");
1112
}
1113
} else {
1114
while(true){
1115
direntry = readdir(d);
1116
if(direntry == NULL){
1117
break;
1118
}
1119
if (direntry->d_type == DT_REG){
1120
char *fullname = NULL;
1121
ret = asprintf(&fullname, "%s/%s", tempdir,
1122
direntry->d_name);
1123
if(ret < 0){
1124
perror("asprintf");
1125
continue;
1126
}
1127
ret = unlink(fullname);
1128
if(ret == -1){
1129
fprintf(stderr, "unlink(\"%s\"): %s",
1130
fullname, strerror(errno));
1131
}
1132
free(fullname);
1133
}
1134
}
1135
closedir(d);
1136
}
1137
ret = rmdir(tempdir);
1138
if(ret == -1 and errno != ENOENT){
1139
perror("rmdir");
1140
}
1141
}
1142
1143
return exitcode;
1818
1144
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0