(root)/mandos/release
» Revision
237.2.26
(compared to revision 237.2.71)
: plugins.d/mandos-client.c
To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 237.2.26
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.26
- Committer: Teddy Hogeborn
- Date: 2009-01-12 22:02:33 UTC
- mto: (24.1.123 mandos) (237.4.2 mandos-pipe-ipc) (299.1.1 release) (300.1.1 release) (301.1.1 release)
- mto: This revision was merged to the branch mainline in revision 245.
- Revision ID: teddy@fukt.bsnet.se-20090112220233-lawxo4uvyzb38u1f
* README (The Plugin System): Removed redundant text about options and
files for the plugins, this is now
documented in the manuals for the
plugins.
* plugins.d/mandos-client.c (main): Remove comment which was copied
from another program by mistake.
Use "sscanf" instead of "strtol"
to parse numbers; this uses the
correct type instead of casting.
Don't report errors when removing
temporary directory if directory
is already gone.
files for the plugins, this is now
documented in the manuals for the
plugins.
* plugins.d/mandos-client.c (main): Remove comment which was copied
from another program by mistake.
Use "sscanf" instead of "strtol"
to parse numbers; this uses the
correct type instead of casting.
Don't report errors when removing
temporary directory if directory
is already gone.
- files removed:
- debian/watch
- files renamed:
- mandos-ctl => mandos-list
- files modified:
- INSTALL
added
removed
plugins.d/mandos-client.c
36
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
37
37
38
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror(), sscanf(),
40
remove() */
39
stdout, ferror(), sscanf */
41
40
#include <stdint.h> /* uint16_t, uint32_t */
42
41
#include <stddef.h> /* NULL, size_t, ssize_t */
43
42
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
44
43
srand() */
45
#include <stdbool.h> /* bool, false, true */
44
#include <stdbool.h> /* bool, true */
46
45
#include <string.h> /* memset(), strcmp(), strlen(),
47
46
strerror(), asprintf(), strcpy() */
48
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/ioctl.h> /* ioctl */
49
48
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
50
49
sockaddr_in6, PF_INET6,
51
SOCK_STREAM, uid_t, gid_t, open(),
52
opendir(), DIR */
50
SOCK_STREAM, INET6_ADDRSTRLEN,
51
uid_t, gid_t, open(), opendir(), DIR */
53
52
#include <sys/stat.h> /* open() */
54
53
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
inet_pton(), connect() */
54
struct in6_addr, inet_pton(),
55
connect() */
56
56
#include <fcntl.h> /* open() */
57
#include <dirent.h> /* opendir(), struct dirent, readdir()
58
*/
59
#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */
57
#include <dirent.h> /* opendir(), struct dirent, readdir() */
58
#include <inttypes.h> /* PRIu16, SCNu16 */
60
59
#include <assert.h> /* assert() */
61
60
#include <errno.h> /* perror(), errno */
62
#include <time.h> /* nanosleep(), time() */
61
#include <time.h> /* time() */
63
62
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
64
63
SIOCSIFFLAGS, if_indextoname(),
65
64
if_nametoindex(), IF_NAMESIZE */
66
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
67
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
68
*/
65
#include <netinet/in.h>
69
66
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
70
67
getuid(), getgid(), setuid(),
71
68
setgid() */
72
69
#include <arpa/inet.h> /* inet_pton(), htons */
73
#include <iso646.h> /* not, or, and */
70
#include <iso646.h> /* not, and, or */
74
71
#include <argp.h> /* struct argp_option, error_t, struct
75
72
argp_state, struct argp,
76
73
argp_parse(), ARGP_KEY_ARG,
77
74
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
78
#include <signal.h> /* sigemptyset(), sigaddset(),
79
sigaction(), SIGTERM, sigaction,
80
sig_atomic_t */
81
82
#ifdef __linux__
83
#include <sys/klog.h> /* klogctl() */
84
#endif /* __linux__ */
85
75
86
76
/* Avahi */
87
77
/* All Avahi types, constants and functions
100
90
gnutls_*
101
91
init_gnutls_session(),
102
92
GNUTLS_* */
103
#include <gnutls/openpgp.h>
104
/* gnutls_certificate_set_openpgp_key_file(),
93
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
105
94
GNUTLS_OPENPGP_FMT_BASE64 */
106
95
107
96
/* GPGME */
133
122
gpgme_ctx_t ctx;
134
123
} mandos_context;
135
124
136
/* global context so signal handler can reach it*/
137
mandos_context mc;
138
139
125
/*
140
* Make additional room in "buffer" for at least BUFFER_SIZE more
141
* bytes. "buffer_capacity" is how much is currently allocated,
126
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
127
* "buffer_capacity" is how much is currently allocated,
142
128
* "buffer_length" is how much is already used.
143
129
*/
144
size_t incbuffer(char **buffer, size_t buffer_length,
130
size_t adjustbuffer(char **buffer, size_t buffer_length,
145
131
size_t buffer_capacity){
146
if(buffer_length + BUFFER_SIZE > buffer_capacity){
132
if (buffer_length + BUFFER_SIZE > buffer_capacity){
147
133
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
148
if(buffer == NULL){
134
if (buffer == NULL){
149
135
return 0;
150
136
}
151
137
buffer_capacity += BUFFER_SIZE;
156
142
/*
157
143
* Initialize GPGME.
158
144
*/
159
static bool init_gpgme(const char *seckey,
145
static bool init_gpgme(mandos_context *mc, const char *seckey,
160
146
const char *pubkey, const char *tempdir){
161
147
int ret;
162
148
gpgme_error_t rc;
164
150
165
151
166
152
/*
167
* Helper function to insert pub and seckey to the engine keyring.
153
* Helper function to insert pub and seckey to the enigne keyring.
168
154
*/
169
155
bool import_key(const char *filename){
170
156
int fd;
177
163
}
178
164
179
165
rc = gpgme_data_new_from_fd(&pgp_data, fd);
180
if(rc != GPG_ERR_NO_ERROR){
166
if (rc != GPG_ERR_NO_ERROR){
181
167
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
182
168
gpgme_strsource(rc), gpgme_strerror(rc));
183
169
return false;
184
170
}
185
171
186
rc = gpgme_op_import(mc.ctx, pgp_data);
187
if(rc != GPG_ERR_NO_ERROR){
172
rc = gpgme_op_import(mc->ctx, pgp_data);
173
if (rc != GPG_ERR_NO_ERROR){
188
174
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
189
175
gpgme_strsource(rc), gpgme_strerror(rc));
190
176
return false;
198
184
return true;
199
185
}
200
186
201
if(debug){
202
fprintf(stderr, "Initializing GPGME\n");
187
if (debug){
188
fprintf(stderr, "Initialize gpgme\n");
203
189
}
204
190
205
191
/* Init GPGME */
206
192
gpgme_check_version(NULL);
207
193
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
208
if(rc != GPG_ERR_NO_ERROR){
194
if (rc != GPG_ERR_NO_ERROR){
209
195
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
210
196
gpgme_strsource(rc), gpgme_strerror(rc));
211
197
return false;
212
198
}
213
199
214
200
/* Set GPGME home directory for the OpenPGP engine only */
215
rc = gpgme_get_engine_info(&engine_info);
216
if(rc != GPG_ERR_NO_ERROR){
201
rc = gpgme_get_engine_info (&engine_info);
202
if (rc != GPG_ERR_NO_ERROR){
217
203
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
218
204
gpgme_strsource(rc), gpgme_strerror(rc));
219
205
return false;
232
218
}
233
219
234
220
/* Create new GPGME "context" */
235
rc = gpgme_new(&(mc.ctx));
236
if(rc != GPG_ERR_NO_ERROR){
221
rc = gpgme_new(&(mc->ctx));
222
if (rc != GPG_ERR_NO_ERROR){
237
223
fprintf(stderr, "bad gpgme_new: %s: %s\n",
238
224
gpgme_strsource(rc), gpgme_strerror(rc));
239
225
return false;
240
226
}
241
227
242
if(not import_key(pubkey) or not import_key(seckey)){
228
if (not import_key(pubkey) or not import_key(seckey)){
243
229
return false;
244
230
}
245
231
250
236
* Decrypt OpenPGP data.
251
237
* Returns -1 on error
252
238
*/
253
static ssize_t pgp_packet_decrypt(const char *cryptotext,
254
size_t crypto_size,
255
char **plaintext){
239
static ssize_t pgp_packet_decrypt (const mandos_context *mc,
240
const char *cryptotext,
241
size_t crypto_size,
242
char **plaintext){
256
243
gpgme_data_t dh_crypto, dh_plain;
257
244
gpgme_error_t rc;
258
245
ssize_t ret;
259
246
size_t plaintext_capacity = 0;
260
247
ssize_t plaintext_length = 0;
261
248
262
if(debug){
249
if (debug){
263
250
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
264
251
}
265
252
266
253
/* Create new GPGME data buffer from memory cryptotext */
267
254
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
268
255
0);
269
if(rc != GPG_ERR_NO_ERROR){
256
if (rc != GPG_ERR_NO_ERROR){
270
257
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
271
258
gpgme_strsource(rc), gpgme_strerror(rc));
272
259
return -1;
274
261
275
262
/* Create new empty GPGME data buffer for the plaintext */
276
263
rc = gpgme_data_new(&dh_plain);
277
if(rc != GPG_ERR_NO_ERROR){
264
if (rc != GPG_ERR_NO_ERROR){
278
265
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
279
266
gpgme_strsource(rc), gpgme_strerror(rc));
280
267
gpgme_data_release(dh_crypto);
283
270
284
271
/* Decrypt data from the cryptotext data buffer to the plaintext
285
272
data buffer */
286
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
287
if(rc != GPG_ERR_NO_ERROR){
273
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
274
if (rc != GPG_ERR_NO_ERROR){
288
275
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
289
276
gpgme_strsource(rc), gpgme_strerror(rc));
290
277
plaintext_length = -1;
291
if(debug){
278
if (debug){
292
279
gpgme_decrypt_result_t result;
293
result = gpgme_op_decrypt_result(mc.ctx);
294
if(result == NULL){
280
result = gpgme_op_decrypt_result(mc->ctx);
281
if (result == NULL){
295
282
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
296
283
} else {
297
284
fprintf(stderr, "Unsupported algorithm: %s\n",
324
311
}
325
312
326
313
/* Seek back to the beginning of the GPGME plaintext data buffer */
327
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
314
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
328
315
perror("gpgme_data_seek");
329
316
plaintext_length = -1;
330
317
goto decrypt_end;
332
319
333
320
*plaintext = NULL;
334
321
while(true){
335
plaintext_capacity = incbuffer(plaintext,
322
plaintext_capacity = adjustbuffer(plaintext,
336
323
(size_t)plaintext_length,
337
324
plaintext_capacity);
338
if(plaintext_capacity == 0){
339
perror("incbuffer");
325
if (plaintext_capacity == 0){
326
perror("adjustbuffer");
340
327
plaintext_length = -1;
341
328
goto decrypt_end;
342
329
}
344
331
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
345
332
BUFFER_SIZE);
346
333
/* Print the data, if any */
347
if(ret == 0){
334
if (ret == 0){
348
335
/* EOF */
349
336
break;
350
337
}
374
361
return plaintext_length;
375
362
}
376
363
377
static const char * safer_gnutls_strerror(int value){
378
const char *ret = gnutls_strerror(value); /* Spurious warning from
379
-Wunreachable-code */
380
if(ret == NULL)
364
static const char * safer_gnutls_strerror (int value) {
365
const char *ret = gnutls_strerror (value); /* Spurious warning */
366
if (ret == NULL)
381
367
ret = "(unknown)";
382
368
return ret;
383
369
}
388
374
fprintf(stderr, "GnuTLS: %s", string);
389
375
}
390
376
391
static int init_gnutls_global(const char *pubkeyfilename,
377
static int init_gnutls_global(mandos_context *mc,
378
const char *pubkeyfilename,
392
379
const char *seckeyfilename){
393
380
int ret;
394
381
397
384
}
398
385
399
386
ret = gnutls_global_init();
400
if(ret != GNUTLS_E_SUCCESS){
401
fprintf(stderr, "GnuTLS global_init: %s\n",
402
safer_gnutls_strerror(ret));
387
if (ret != GNUTLS_E_SUCCESS) {
388
fprintf (stderr, "GnuTLS global_init: %s\n",
389
safer_gnutls_strerror(ret));
403
390
return -1;
404
391
}
405
392
406
if(debug){
393
if (debug){
407
394
/* "Use a log level over 10 to enable all debugging options."
408
395
* - GnuTLS manual
409
396
*/
412
399
}
413
400
414
401
/* OpenPGP credentials */
415
gnutls_certificate_allocate_credentials(&mc.cred);
416
if(ret != GNUTLS_E_SUCCESS){
417
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
418
from
419
-Wunreachable-code
420
*/
421
safer_gnutls_strerror(ret));
422
gnutls_global_deinit();
402
gnutls_certificate_allocate_credentials(&mc->cred);
403
if (ret != GNUTLS_E_SUCCESS){
404
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
405
warning */
406
safer_gnutls_strerror(ret));
407
gnutls_global_deinit ();
423
408
return -1;
424
409
}
425
410
430
415
}
431
416
432
417
ret = gnutls_certificate_set_openpgp_key_file
433
(mc.cred, pubkeyfilename, seckeyfilename,
418
(mc->cred, pubkeyfilename, seckeyfilename,
434
419
GNUTLS_OPENPGP_FMT_BASE64);
435
if(ret != GNUTLS_E_SUCCESS){
420
if (ret != GNUTLS_E_SUCCESS) {
436
421
fprintf(stderr,
437
422
"Error[%d] while reading the OpenPGP key pair ('%s',"
438
423
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
442
427
}
443
428
444
429
/* GnuTLS server initialization */
445
ret = gnutls_dh_params_init(&mc.dh_params);
446
if(ret != GNUTLS_E_SUCCESS){
447
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
448
" %s\n", safer_gnutls_strerror(ret));
430
ret = gnutls_dh_params_init(&mc->dh_params);
431
if (ret != GNUTLS_E_SUCCESS) {
432
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
433
" %s\n", safer_gnutls_strerror(ret));
449
434
goto globalfail;
450
435
}
451
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
452
if(ret != GNUTLS_E_SUCCESS){
453
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
454
safer_gnutls_strerror(ret));
436
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
437
if (ret != GNUTLS_E_SUCCESS) {
438
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
439
safer_gnutls_strerror(ret));
455
440
goto globalfail;
456
441
}
457
442
458
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
443
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
459
444
460
445
return 0;
461
446
462
447
globalfail:
463
448
464
gnutls_certificate_free_credentials(mc.cred);
449
gnutls_certificate_free_credentials(mc->cred);
465
450
gnutls_global_deinit();
466
gnutls_dh_params_deinit(mc.dh_params);
451
gnutls_dh_params_deinit(mc->dh_params);
467
452
return -1;
468
453
}
469
454
470
static int init_gnutls_session(gnutls_session_t *session){
455
static int init_gnutls_session(mandos_context *mc,
456
gnutls_session_t *session){
471
457
int ret;
472
458
/* GnuTLS session creation */
473
459
ret = gnutls_init(session, GNUTLS_SERVER);
474
if(ret != GNUTLS_E_SUCCESS){
460
if (ret != GNUTLS_E_SUCCESS){
475
461
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
476
462
safer_gnutls_strerror(ret));
477
463
}
478
464
479
465
{
480
466
const char *err;
481
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
482
if(ret != GNUTLS_E_SUCCESS){
467
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
468
if (ret != GNUTLS_E_SUCCESS) {
483
469
fprintf(stderr, "Syntax error at: %s\n", err);
484
470
fprintf(stderr, "GnuTLS error: %s\n",
485
471
safer_gnutls_strerror(ret));
486
gnutls_deinit(*session);
472
gnutls_deinit (*session);
487
473
return -1;
488
474
}
489
475
}
490
476
491
477
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
492
mc.cred);
493
if(ret != GNUTLS_E_SUCCESS){
478
mc->cred);
479
if (ret != GNUTLS_E_SUCCESS) {
494
480
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
495
481
safer_gnutls_strerror(ret));
496
gnutls_deinit(*session);
482
gnutls_deinit (*session);
497
483
return -1;
498
484
}
499
485
500
486
/* ignore client certificate if any. */
501
gnutls_certificate_server_set_request(*session,
502
GNUTLS_CERT_IGNORE);
487
gnutls_certificate_server_set_request (*session,
488
GNUTLS_CERT_IGNORE);
503
489
504
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
490
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
505
491
506
492
return 0;
507
493
}
513
499
/* Called when a Mandos server is found */
514
500
static int start_mandos_communication(const char *ip, uint16_t port,
515
501
AvahiIfIndex if_index,
516
int af){
502
mandos_context *mc){
517
503
int ret, tcp_sd;
518
504
ssize_t sret;
519
union {
520
struct sockaddr_in in;
521
struct sockaddr_in6 in6;
522
} to;
505
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
523
506
char *buffer = NULL;
524
507
char *decrypted_buffer;
525
508
size_t buffer_length = 0;
527
510
ssize_t decrypted_buffer_size;
528
511
size_t written;
529
512
int retval = 0;
513
char interface[IF_NAMESIZE];
530
514
gnutls_session_t session;
531
int pf; /* Protocol family */
532
533
switch(af){
534
case AF_INET6:
535
pf = PF_INET6;
536
break;
537
case AF_INET:
538
pf = PF_INET;
539
break;
540
default:
541
fprintf(stderr, "Bad address family: %d\n", af);
542
return -1;
543
}
544
545
ret = init_gnutls_session(&session);
546
if(ret != 0){
515
516
ret = init_gnutls_session (mc, &session);
517
if (ret != 0){
547
518
return -1;
548
519
}
549
520
550
521
if(debug){
551
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
522
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
552
523
"\n", ip, port);
553
524
}
554
525
555
tcp_sd = socket(pf, SOCK_STREAM, 0);
556
if(tcp_sd < 0){
526
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
527
if(tcp_sd < 0) {
557
528
perror("socket");
558
529
return -1;
559
530
}
560
531
532
if(debug){
533
if(if_indextoname((unsigned int)if_index, interface) == NULL){
534
perror("if_indextoname");
535
return -1;
536
}
537
fprintf(stderr, "Binding to interface %s\n", interface);
538
}
539
561
540
memset(&to, 0, sizeof(to));
562
if(af == AF_INET6){
563
to.in6.sin6_family = (uint16_t)af;
564
ret = inet_pton(af, ip, &to.in6.sin6_addr);
565
} else { /* IPv4 */
566
to.in.sin_family = (sa_family_t)af;
567
ret = inet_pton(af, ip, &to.in.sin_addr);
568
}
569
if(ret < 0 ){
541
to.in6.sin6_family = AF_INET6;
542
/* It would be nice to have a way to detect if we were passed an
543
IPv4 address here. Now we assume an IPv6 address. */
544
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
545
if (ret < 0 ){
570
546
perror("inet_pton");
571
547
return -1;
572
548
}
574
550
fprintf(stderr, "Bad address: %s\n", ip);
575
551
return -1;
576
552
}
577
if(af == AF_INET6){
578
to.in6.sin6_port = htons(port); /* Spurious warnings from
579
-Wconversion and
580
-Wunreachable-code */
581
582
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
583
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
584
-Wunreachable-code*/
585
if(if_index == AVAHI_IF_UNSPEC){
586
fprintf(stderr, "An IPv6 link-local address is incomplete"
587
" without a network interface\n");
588
return -1;
589
}
590
/* Set the network interface number as scope */
591
to.in6.sin6_scope_id = (uint32_t)if_index;
592
}
593
} else {
594
to.in.sin_port = htons(port); /* Spurious warnings from
595
-Wconversion and
596
-Wunreachable-code */
597
}
553
to.in6.sin6_port = htons(port); /* Spurious warning */
554
555
to.in6.sin6_scope_id = (uint32_t)if_index;
598
556
599
557
if(debug){
600
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
601
char interface[IF_NAMESIZE];
602
if(if_indextoname((unsigned int)if_index, interface) == NULL){
603
perror("if_indextoname");
604
} else {
605
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
606
ip, interface, port);
607
}
608
} else {
609
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
610
port);
611
}
612
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
613
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
614
const char *pcret;
615
if(af == AF_INET6){
616
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
617
sizeof(addrstr));
618
} else {
619
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
620
sizeof(addrstr));
621
}
622
if(pcret == NULL){
558
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
559
port);
560
char addrstr[INET6_ADDRSTRLEN] = "";
561
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
562
sizeof(addrstr)) == NULL){
623
563
perror("inet_ntop");
624
564
} else {
625
565
if(strcmp(addrstr, ip) != 0){
628
568
}
629
569
}
630
570
631
if(af == AF_INET6){
632
ret = connect(tcp_sd, &to.in6, sizeof(to));
633
} else {
634
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
635
}
636
if(ret < 0){
571
ret = connect(tcp_sd, &to.in, sizeof(to));
572
if (ret < 0){
637
573
perror("connect");
638
574
return -1;
639
575
}
640
576
641
577
const char *out = mandos_protocol_version;
642
578
written = 0;
643
while(true){
579
while (true){
644
580
size_t out_size = strlen(out);
645
581
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
646
582
out_size - written));
647
if(ret == -1){
583
if (ret == -1){
648
584
perror("write");
649
585
retval = -1;
650
586
goto mandos_end;
653
589
if(written < out_size){
654
590
continue;
655
591
} else {
656
if(out == mandos_protocol_version){
592
if (out == mandos_protocol_version){
657
593
written = 0;
658
594
out = "\r\n";
659
595
} else {
666
602
fprintf(stderr, "Establishing TLS session with %s\n", ip);
667
603
}
668
604
669
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
605
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
670
606
671
607
do{
672
ret = gnutls_handshake(session);
608
ret = gnutls_handshake (session);
673
609
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
674
610
675
if(ret != GNUTLS_E_SUCCESS){
611
if (ret != GNUTLS_E_SUCCESS){
676
612
if(debug){
677
613
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
678
gnutls_perror(ret);
614
gnutls_perror (ret);
679
615
}
680
616
retval = -1;
681
617
goto mandos_end;
684
620
/* Read OpenPGP packet that contains the wanted password */
685
621
686
622
if(debug){
687
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
623
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
688
624
ip);
689
625
}
690
626
691
627
while(true){
692
buffer_capacity = incbuffer(&buffer, buffer_length,
628
buffer_capacity = adjustbuffer(&buffer, buffer_length,
693
629
buffer_capacity);
694
if(buffer_capacity == 0){
695
perror("incbuffer");
630
if (buffer_capacity == 0){
631
perror("adjustbuffer");
696
632
retval = -1;
697
633
goto mandos_end;
698
634
}
699
635
700
636
sret = gnutls_record_recv(session, buffer+buffer_length,
701
637
BUFFER_SIZE);
702
if(sret == 0){
638
if (sret == 0){
703
639
break;
704
640
}
705
if(sret < 0){
641
if (sret < 0){
706
642
switch(sret){
707
643
case GNUTLS_E_INTERRUPTED:
708
644
case GNUTLS_E_AGAIN:
709
645
break;
710
646
case GNUTLS_E_REHANDSHAKE:
711
647
do{
712
ret = gnutls_handshake(session);
648
ret = gnutls_handshake (session);
713
649
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
714
if(ret < 0){
650
if (ret < 0){
715
651
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
716
gnutls_perror(ret);
652
gnutls_perror (ret);
717
653
retval = -1;
718
654
goto mandos_end;
719
655
}
722
658
fprintf(stderr, "Unknown error while reading data from"
723
659
" encrypted session with Mandos server\n");
724
660
retval = -1;
725
gnutls_bye(session, GNUTLS_SHUT_RDWR);
661
gnutls_bye (session, GNUTLS_SHUT_RDWR);
726
662
goto mandos_end;
727
663
}
728
664
} else {
734
670
fprintf(stderr, "Closing TLS session\n");
735
671
}
736
672
737
gnutls_bye(session, GNUTLS_SHUT_RDWR);
673
gnutls_bye (session, GNUTLS_SHUT_RDWR);
738
674
739
if(buffer_length > 0){
740
decrypted_buffer_size = pgp_packet_decrypt(buffer,
675
if (buffer_length > 0){
676
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
741
677
buffer_length,
742
678
&decrypted_buffer);
743
if(decrypted_buffer_size >= 0){
679
if (decrypted_buffer_size >= 0){
744
680
written = 0;
745
681
while(written < (size_t) decrypted_buffer_size){
746
ret = (int)fwrite(decrypted_buffer + written, 1,
747
(size_t)decrypted_buffer_size - written,
748
stdout);
682
ret = (int)fwrite (decrypted_buffer + written, 1,
683
(size_t)decrypted_buffer_size - written,
684
stdout);
749
685
if(ret == 0 and ferror(stdout)){
750
686
if(debug){
751
687
fprintf(stderr, "Error writing encrypted data: %s\n",
772
708
if(ret == -1){
773
709
perror("close");
774
710
}
775
gnutls_deinit(session);
711
gnutls_deinit (session);
776
712
return retval;
777
713
}
778
714
779
715
static void resolve_callback(AvahiSServiceResolver *r,
780
716
AvahiIfIndex interface,
781
AvahiProtocol proto,
717
AVAHI_GCC_UNUSED AvahiProtocol protocol,
782
718
AvahiResolverEvent event,
783
719
const char *name,
784
720
const char *type,
789
725
AVAHI_GCC_UNUSED AvahiStringList *txt,
790
726
AVAHI_GCC_UNUSED AvahiLookupResultFlags
791
727
flags,
792
AVAHI_GCC_UNUSED void* userdata){
728
void* userdata) {
729
mandos_context *mc = userdata;
793
730
assert(r);
794
731
795
732
/* Called whenever a service has been resolved successfully or
796
733
timed out */
797
734
798
switch(event){
735
switch (event) {
799
736
default:
800
737
case AVAHI_RESOLVER_FAILURE:
801
738
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
802
739
" of type '%s' in domain '%s': %s\n", name, type, domain,
803
avahi_strerror(avahi_server_errno(mc.server)));
740
avahi_strerror(avahi_server_errno(mc->server)));
804
741
break;
805
742
806
743
case AVAHI_RESOLVER_FOUND:
809
746
avahi_address_snprint(ip, sizeof(ip), address);
810
747
if(debug){
811
748
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
812
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
813
ip, (intmax_t)interface, port);
749
PRIu16 ") on port %d\n", name, host_name, ip,
750
interface, port);
814
751
}
815
int ret = start_mandos_communication(ip, port, interface,
816
avahi_proto_to_af(proto));
817
if(ret == 0){
818
avahi_simple_poll_quit(mc.simple_poll);
752
int ret = start_mandos_communication(ip, port, interface, mc);
753
if (ret == 0){
754
avahi_simple_poll_quit(mc->simple_poll);
819
755
}
820
756
}
821
757
}
822
758
avahi_s_service_resolver_free(r);
823
759
}
824
760
825
static void browse_callback(AvahiSServiceBrowser *b,
826
AvahiIfIndex interface,
827
AvahiProtocol protocol,
828
AvahiBrowserEvent event,
829
const char *name,
830
const char *type,
831
const char *domain,
832
AVAHI_GCC_UNUSED AvahiLookupResultFlags
833
flags,
834
AVAHI_GCC_UNUSED void* userdata){
761
static void browse_callback( AvahiSServiceBrowser *b,
762
AvahiIfIndex interface,
763
AvahiProtocol protocol,
764
AvahiBrowserEvent event,
765
const char *name,
766
const char *type,
767
const char *domain,
768
AVAHI_GCC_UNUSED AvahiLookupResultFlags
769
flags,
770
void* userdata) {
771
mandos_context *mc = userdata;
835
772
assert(b);
836
773
837
774
/* Called whenever a new services becomes available on the LAN or
838
775
is removed from the LAN */
839
776
840
switch(event){
777
switch (event) {
841
778
default:
842
779
case AVAHI_BROWSER_FAILURE:
843
780
844
781
fprintf(stderr, "(Avahi browser) %s\n",
845
avahi_strerror(avahi_server_errno(mc.server)));
846
avahi_simple_poll_quit(mc.simple_poll);
782
avahi_strerror(avahi_server_errno(mc->server)));
783
avahi_simple_poll_quit(mc->simple_poll);
847
784
return;
848
785
849
786
case AVAHI_BROWSER_NEW:
852
789
the callback function is called the Avahi server will free the
853
790
resolver for us. */
854
791
855
if(!(avahi_s_service_resolver_new(mc.server, interface,
792
if (!(avahi_s_service_resolver_new(mc->server, interface,
856
793
protocol, name, type, domain,
857
794
AVAHI_PROTO_INET6, 0,
858
resolve_callback, NULL)))
795
resolve_callback, mc)))
859
796
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
860
name, avahi_strerror(avahi_server_errno(mc.server)));
797
name, avahi_strerror(avahi_server_errno(mc->server)));
861
798
break;
862
799
863
800
case AVAHI_BROWSER_REMOVE:
872
809
}
873
810
}
874
811
875
sig_atomic_t quit_now = 0;
876
877
static void handle_sigterm(__attribute__((unused)) int sig){
878
if(quit_now){
879
return;
880
}
881
quit_now = 1;
882
int old_errno = errno;
883
if(mc.simple_poll != NULL){
884
avahi_simple_poll_quit(mc.simple_poll);
885
}
886
errno = old_errno;
887
}
888
889
812
int main(int argc, char *argv[]){
890
AvahiSServiceBrowser *sb = NULL;
891
int error;
892
int ret;
893
intmax_t tmpmax;
894
int numchars;
895
int exitcode = EXIT_SUCCESS;
896
const char *interface = "eth0";
897
struct ifreq network;
898
int sd;
899
uid_t uid;
900
gid_t gid;
901
char *connect_to = NULL;
902
char tempdir[] = "/tmp/mandosXXXXXX";
903
bool tempdir_created = false;
904
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
905
const char *seckey = PATHDIR "/" SECKEY;
906
const char *pubkey = PATHDIR "/" PUBKEY;
907
908
/* Initialize Mandos context */
909
mc = (mandos_context){ .simple_poll = NULL, .server = NULL,
910
.dh_bits = 1024, .priority = "SECURE256"
911
":!CTYPE-X.509:+CTYPE-OPENPGP" };
912
bool gnutls_initialized = false;
913
bool gpgme_initialized = false;
914
double delay = 2.5;
915
916
struct sigaction old_sigterm_action;
917
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
918
919
{
920
struct argp_option options[] = {
921
{ .name = "debug", .key = 128,
922
.doc = "Debug mode", .group = 3 },
923
{ .name = "connect", .key = 'c',
924
.arg = "ADDRESS:PORT",
925
.doc = "Connect directly to a specific Mandos server",
926
.group = 1 },
927
{ .name = "interface", .key = 'i',
928
.arg = "NAME",
929
.doc = "Network interface that will be used to search for"
930
" Mandos servers",
931
.group = 1 },
932
{ .name = "seckey", .key = 's',
933
.arg = "FILE",
934
.doc = "OpenPGP secret key file base name",
935
.group = 1 },
936
{ .name = "pubkey", .key = 'p',
937
.arg = "FILE",
938
.doc = "OpenPGP public key file base name",
939
.group = 2 },
940
{ .name = "dh-bits", .key = 129,
941
.arg = "BITS",
942
.doc = "Bit length of the prime number used in the"
943
" Diffie-Hellman key exchange",
944
.group = 2 },
945
{ .name = "priority", .key = 130,
946
.arg = "STRING",
947
.doc = "GnuTLS priority string for the TLS handshake",
948
.group = 1 },
949
{ .name = "delay", .key = 131,
950
.arg = "SECONDS",
951
.doc = "Maximum delay to wait for interface startup",
952
.group = 2 },
953
{ .name = NULL }
954
};
955
956
error_t parse_opt(int key, char *arg,
957
struct argp_state *state){
958
switch(key){
959
case 128: /* --debug */
960
debug = true;
961
break;
962
case 'c': /* --connect */
963
connect_to = arg;
964
break;
965
case 'i': /* --interface */
966
interface = arg;
967
break;
968
case 's': /* --seckey */
969
seckey = arg;
970
break;
971
case 'p': /* --pubkey */
972
pubkey = arg;
973
break;
974
case 129: /* --dh-bits */
975
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
976
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
977
or arg[numchars] != '\0'){
978
fprintf(stderr, "Bad number of DH bits\n");
979
exit(EXIT_FAILURE);
980
}
981
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
982
break;
983
case 130: /* --priority */
984
mc.priority = arg;
985
break;
986
case 131: /* --delay */
987
ret = sscanf(arg, "%lf%n", &delay, &numchars);
988
if(ret < 1 or arg[numchars] != '\0'){
989
fprintf(stderr, "Bad delay\n");
990
exit(EXIT_FAILURE);
991
}
992
break;
993
case ARGP_KEY_ARG:
994
argp_usage(state);
995
case ARGP_KEY_END:
996
break;
997
default:
998
return ARGP_ERR_UNKNOWN;
999
}
1000
return 0;
1001
}
1002
1003
struct argp argp = { .options = options, .parser = parse_opt,
1004
.args_doc = "",
1005
.doc = "Mandos client -- Get and decrypt"
1006
" passwords from a Mandos server" };
1007
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1008
if(ret == ARGP_ERR_UNKNOWN){
1009
fprintf(stderr, "Unknown error while parsing arguments\n");
1010
exitcode = EXIT_FAILURE;
1011
goto end;
1012
}
1013
}
1014
1015
/* If the interface is down, bring it up */
1016
if(interface[0] != '\0'){
1017
#ifdef __linux__
1018
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1019
messages to mess up the prompt */
1020
ret = klogctl(8, NULL, 5);
1021
bool restore_loglevel = true;
1022
if(ret == -1){
1023
restore_loglevel = false;
1024
perror("klogctl");
1025
}
1026
#endif /* __linux__ */
1027
1028
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1029
if(sd < 0){
1030
perror("socket");
1031
exitcode = EXIT_FAILURE;
1032
#ifdef __linux__
1033
if(restore_loglevel){
1034
ret = klogctl(7, NULL, 0);
1035
if(ret == -1){
1036
perror("klogctl");
1037
}
1038
}
1039
#endif /* __linux__ */
1040
goto end;
1041
}
1042
strcpy(network.ifr_name, interface);
1043
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1044
if(ret == -1){
1045
perror("ioctl SIOCGIFFLAGS");
1046
#ifdef __linux__
1047
if(restore_loglevel){
1048
ret = klogctl(7, NULL, 0);
1049
if(ret == -1){
1050
perror("klogctl");
1051
}
1052
}
1053
#endif /* __linux__ */
1054
exitcode = EXIT_FAILURE;
1055
goto end;
1056
}
1057
if((network.ifr_flags & IFF_UP) == 0){
1058
network.ifr_flags |= IFF_UP;
1059
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1060
if(ret == -1){
1061
perror("ioctl SIOCSIFFLAGS");
1062
exitcode = EXIT_FAILURE;
1063
#ifdef __linux__
1064
if(restore_loglevel){
1065
ret = klogctl(7, NULL, 0);
1066
if(ret == -1){
1067
perror("klogctl");
813
AvahiSServiceBrowser *sb = NULL;
814
int error;
815
int ret;
816
int exitcode = EXIT_SUCCESS;
817
const char *interface = "eth0";
818
struct ifreq network;
819
int sd;
820
uid_t uid;
821
gid_t gid;
822
char *connect_to = NULL;
823
char tempdir[] = "/tmp/mandosXXXXXX";
824
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
825
const char *seckey = PATHDIR "/" SECKEY;
826
const char *pubkey = PATHDIR "/" PUBKEY;
827
828
mandos_context mc = { .simple_poll = NULL, .server = NULL,
829
.dh_bits = 1024, .priority = "SECURE256"
830
":!CTYPE-X.509:+CTYPE-OPENPGP" };
831
bool gnutls_initalized = false;
832
bool gpgme_initalized = false;
833
834
{
835
struct argp_option options[] = {
836
{ .name = "debug", .key = 128,
837
.doc = "Debug mode", .group = 3 },
838
{ .name = "connect", .key = 'c',
839
.arg = "ADDRESS:PORT",
840
.doc = "Connect directly to a specific Mandos server",
841
.group = 1 },
842
{ .name = "interface", .key = 'i',
843
.arg = "NAME",
844
.doc = "Interface that will be used to search for Mandos"
845
" servers",
846
.group = 1 },
847
{ .name = "seckey", .key = 's',
848
.arg = "FILE",
849
.doc = "OpenPGP secret key file base name",
850
.group = 1 },
851
{ .name = "pubkey", .key = 'p',
852
.arg = "FILE",
853
.doc = "OpenPGP public key file base name",
854
.group = 2 },
855
{ .name = "dh-bits", .key = 129,
856
.arg = "BITS",
857
.doc = "Bit length of the prime number used in the"
858
" Diffie-Hellman key exchange",
859
.group = 2 },
860
{ .name = "priority", .key = 130,
861
.arg = "STRING",
862
.doc = "GnuTLS priority string for the TLS handshake",
863
.group = 1 },
864
{ .name = NULL }
865
};
866
867
error_t parse_opt (int key, char *arg,
868
struct argp_state *state) {
869
switch (key) {
870
case 128: /* --debug */
871
debug = true;
872
break;
873
case 'c': /* --connect */
874
connect_to = arg;
875
break;
876
case 'i': /* --interface */
877
interface = arg;
878
break;
879
case 's': /* --seckey */
880
seckey = arg;
881
break;
882
case 'p': /* --pubkey */
883
pubkey = arg;
884
break;
885
case 129: /* --dh-bits */
886
ret = sscanf(arg, "%u", &mc.dh_bits);
887
if(ret == 0 or mc.dh_bits == 0){
888
fprintf(stderr, "Bad number of DH bits\n");
889
exit(EXIT_FAILURE);
1068
890
}
891
break;
892
case 130: /* --priority */
893
mc.priority = arg;
894
break;
895
case ARGP_KEY_ARG:
896
argp_usage (state);
897
case ARGP_KEY_END:
898
break;
899
default:
900
return ARGP_ERR_UNKNOWN;
1069
901
}
1070
#endif /* __linux__ */
902
return 0;
903
}
904
905
struct argp argp = { .options = options, .parser = parse_opt,
906
.args_doc = "",
907
.doc = "Mandos client -- Get and decrypt"
908
" passwords from a Mandos server" };
909
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
910
if (ret == ARGP_ERR_UNKNOWN){
911
fprintf(stderr, "Unknown error while parsing arguments\n");
912
exitcode = EXIT_FAILURE;
1071
913
goto end;
1072
914
}
1073
915
}
1074
/* sleep checking until interface is running */
1075
for(int i=0; i < delay * 4; i++){
916
917
/* If the interface is down, bring it up */
918
{
919
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
920
if(sd < 0) {
921
perror("socket");
922
exitcode = EXIT_FAILURE;
923
goto end;
924
}
925
strcpy(network.ifr_name, interface);
1076
926
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1077
927
if(ret == -1){
1078
928
perror("ioctl SIOCGIFFLAGS");
1079
} else if(network.ifr_flags & IFF_RUNNING){
1080
break;
1081
}
1082
struct timespec sleeptime = { .tv_nsec = 250000000 };
1083
ret = nanosleep(&sleeptime, NULL);
1084
if(ret == -1 and errno != EINTR){
1085
perror("nanosleep");
1086
}
1087
}
1088
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1089
if(ret == -1){
1090
perror("close");
1091
}
1092
#ifdef __linux__
1093
if(restore_loglevel){
1094
/* Restores kernel loglevel to default */
1095
ret = klogctl(7, NULL, 0);
929
exitcode = EXIT_FAILURE;
930
goto end;
931
}
932
if((network.ifr_flags & IFF_UP) == 0){
933
network.ifr_flags |= IFF_UP;
934
ret = ioctl(sd, SIOCSIFFLAGS, &network);
935
if(ret == -1){
936
perror("ioctl SIOCSIFFLAGS");
937
exitcode = EXIT_FAILURE;
938
goto end;
939
}
940
}
941
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1096
942
if(ret == -1){
1097
perror("klogctl");
943
perror("close");
1098
944
}
1099
945
}
1100
#endif /* __linux__ */
1101
}
1102
1103
uid = getuid();
1104
gid = getgid();
1105
1106
errno = 0;
1107
setgid(gid);
1108
if(ret == -1){
1109
perror("setgid");
1110
}
1111
1112
ret = setuid(uid);
1113
if(ret == -1){
1114
perror("setuid");
1115
}
1116
1117
ret = init_gnutls_global(pubkey, seckey);
1118
if(ret == -1){
1119
fprintf(stderr, "init_gnutls_global failed\n");
1120
exitcode = EXIT_FAILURE;
1121
goto end;
1122
} else {
1123
gnutls_initialized = true;
1124
}
1125
1126
if(mkdtemp(tempdir) == NULL){
1127
perror("mkdtemp");
1128
goto end;
1129
}
1130
tempdir_created = true;
1131
1132
if(not init_gpgme(pubkey, seckey, tempdir)){
1133
fprintf(stderr, "init_gpgme failed\n");
1134
exitcode = EXIT_FAILURE;
1135
goto end;
1136
} else {
1137
gpgme_initialized = true;
1138
}
1139
1140
if(interface[0] != '\0'){
946
947
uid = getuid();
948
gid = getgid();
949
950
ret = setuid(uid);
951
if (ret == -1){
952
perror("setuid");
953
}
954
955
setgid(gid);
956
if (ret == -1){
957
perror("setgid");
958
}
959
960
ret = init_gnutls_global(&mc, pubkey, seckey);
961
if (ret == -1){
962
fprintf(stderr, "init_gnutls_global failed\n");
963
exitcode = EXIT_FAILURE;
964
goto end;
965
} else {
966
gnutls_initalized = true;
967
}
968
969
if(mkdtemp(tempdir) == NULL){
970
perror("mkdtemp");
971
tempdir[0] = '\0';
972
goto end;
973
}
974
975
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
976
fprintf(stderr, "gpgme_initalized failed\n");
977
exitcode = EXIT_FAILURE;
978
goto end;
979
} else {
980
gpgme_initalized = true;
981
}
982
1141
983
if_index = (AvahiIfIndex) if_nametoindex(interface);
1142
984
if(if_index == 0){
1143
985
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1144
exitcode = EXIT_FAILURE;
1145
goto end;
1146
}
1147
}
1148
1149
if(connect_to != NULL){
1150
/* Connect directly, do not use Zeroconf */
1151
/* (Mainly meant for debugging) */
1152
char *address = strrchr(connect_to, ':');
1153
if(address == NULL){
1154
fprintf(stderr, "No colon in address\n");
1155
exitcode = EXIT_FAILURE;
1156
goto end;
1157
}
1158
uint16_t port;
1159
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1160
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1161
or address[numchars+1] != '\0'){
1162
fprintf(stderr, "Bad port number\n");
1163
exitcode = EXIT_FAILURE;
1164
goto end;
1165
}
1166
port = (uint16_t)tmpmax;
1167
*address = '\0';
1168
address = connect_to;
1169
/* Colon in address indicates IPv6 */
1170
int af;
1171
if(strchr(address, ':') != NULL){
1172
af = AF_INET6;
1173
} else {
1174
af = AF_INET;
1175
}
1176
ret = start_mandos_communication(address, port, if_index, af);
1177
if(ret < 0){
1178
exitcode = EXIT_FAILURE;
1179
} else {
1180
exitcode = EXIT_SUCCESS;
1181
}
1182
goto end;
1183
}
1184
1185
if(not debug){
1186
avahi_set_log_function(empty_log);
1187
}
1188
1189
/* Initialize the pseudo-RNG for Avahi */
1190
srand((unsigned int) time(NULL));
1191
1192
/* Allocate main Avahi loop object */
1193
mc.simple_poll = avahi_simple_poll_new();
1194
if(mc.simple_poll == NULL){
1195
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1196
exitcode = EXIT_FAILURE;
1197
goto end;
1198
}
1199
1200
{
1201
AvahiServerConfig config;
1202
/* Do not publish any local Zeroconf records */
1203
avahi_server_config_init(&config);
1204
config.publish_hinfo = 0;
1205
config.publish_addresses = 0;
1206
config.publish_workstation = 0;
1207
config.publish_domain = 0;
1208
1209
/* Allocate a new server */
1210
mc.server = avahi_server_new(avahi_simple_poll_get
1211
(mc.simple_poll), &config, NULL,
1212
NULL, &error);
1213
1214
/* Free the Avahi configuration data */
1215
avahi_server_config_free(&config);
1216
}
1217
1218
/* Check if creating the Avahi server object succeeded */
1219
if(mc.server == NULL){
1220
fprintf(stderr, "Failed to create Avahi server: %s\n",
1221
avahi_strerror(error));
1222
exitcode = EXIT_FAILURE;
1223
goto end;
1224
}
1225
1226
/* Create the Avahi service browser */
1227
sb = avahi_s_service_browser_new(mc.server, if_index,
1228
AVAHI_PROTO_INET6, "_mandos._tcp",
1229
NULL, 0, browse_callback, NULL);
1230
if(sb == NULL){
1231
fprintf(stderr, "Failed to create service browser: %s\n",
1232
avahi_strerror(avahi_server_errno(mc.server)));
1233
exitcode = EXIT_FAILURE;
1234
goto end;
1235
}
1236
1237
sigemptyset(&sigterm_action.sa_mask);
1238
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1239
if(ret == -1){
1240
perror("sigaddset");
1241
exitcode = EXIT_FAILURE;
1242
goto end;
1243
}
1244
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1245
if(ret == -1){
1246
perror("sigaddset");
1247
exitcode = EXIT_FAILURE;
1248
goto end;
1249
}
1250
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1251
if(ret == -1){
1252
perror("sigaddset");
1253
exitcode = EXIT_FAILURE;
1254
goto end;
1255
}
1256
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1257
if(ret == -1){
1258
perror("sigaction");
1259
exitcode = EXIT_FAILURE;
1260
goto end;
1261
}
1262
1263
/* Run the main loop */
1264
1265
if(debug){
1266
fprintf(stderr, "Starting Avahi loop search\n");
1267
}
1268
1269
avahi_simple_poll_loop(mc.simple_poll);
1270
986
exit(EXIT_FAILURE);
987
}
988
989
if(connect_to != NULL){
990
/* Connect directly, do not use Zeroconf */
991
/* (Mainly meant for debugging) */
992
char *address = strrchr(connect_to, ':');
993
if(address == NULL){
994
fprintf(stderr, "No colon in address\n");
995
exitcode = EXIT_FAILURE;
996
goto end;
997
}
998
uint16_t port;
999
ret = sscanf(address+1, "%" SCNu16, &port);
1000
if(ret == 0 or port == 0){
1001
fprintf(stderr, "Bad port number\n");
1002
exitcode = EXIT_FAILURE;
1003
goto end;
1004
}
1005
*address = '\0';
1006
address = connect_to;
1007
ret = start_mandos_communication(address, port, if_index, &mc);
1008
if(ret < 0){
1009
exitcode = EXIT_FAILURE;
1010
} else {
1011
exitcode = EXIT_SUCCESS;
1012
}
1013
goto end;
1014
}
1015
1016
if (not debug){
1017
avahi_set_log_function(empty_log);
1018
}
1019
1020
/* Initialize the pseudo-RNG for Avahi */
1021
srand((unsigned int) time(NULL));
1022
1023
/* Allocate main Avahi loop object */
1024
mc.simple_poll = avahi_simple_poll_new();
1025
if (mc.simple_poll == NULL) {
1026
fprintf(stderr, "Avahi: Failed to create simple poll"
1027
" object.\n");
1028
exitcode = EXIT_FAILURE;
1029
goto end;
1030
}
1031
1032
{
1033
AvahiServerConfig config;
1034
/* Do not publish any local Zeroconf records */
1035
avahi_server_config_init(&config);
1036
config.publish_hinfo = 0;
1037
config.publish_addresses = 0;
1038
config.publish_workstation = 0;
1039
config.publish_domain = 0;
1040
1041
/* Allocate a new server */
1042
mc.server = avahi_server_new(avahi_simple_poll_get
1043
(mc.simple_poll), &config, NULL,
1044
NULL, &error);
1045
1046
/* Free the Avahi configuration data */
1047
avahi_server_config_free(&config);
1048
}
1049
1050
/* Check if creating the Avahi server object succeeded */
1051
if (mc.server == NULL) {
1052
fprintf(stderr, "Failed to create Avahi server: %s\n",
1053
avahi_strerror(error));
1054
exitcode = EXIT_FAILURE;
1055
goto end;
1056
}
1057
1058
/* Create the Avahi service browser */
1059
sb = avahi_s_service_browser_new(mc.server, if_index,
1060
AVAHI_PROTO_INET6,
1061
"_mandos._tcp", NULL, 0,
1062
browse_callback, &mc);
1063
if (sb == NULL) {
1064
fprintf(stderr, "Failed to create service browser: %s\n",
1065
avahi_strerror(avahi_server_errno(mc.server)));
1066
exitcode = EXIT_FAILURE;
1067
goto end;
1068
}
1069
1070
/* Run the main loop */
1071
1072
if (debug){
1073
fprintf(stderr, "Starting Avahi loop search\n");
1074
}
1075
1076
avahi_simple_poll_loop(mc.simple_poll);
1077
1271
1078
end:
1272
1273
if(debug){
1274
fprintf(stderr, "%s exiting\n", argv[0]);
1275
}
1276
1277
/* Cleanup things */
1278
if(sb != NULL)
1279
avahi_s_service_browser_free(sb);
1280
1281
if(mc.server != NULL)
1282
avahi_server_free(mc.server);
1283
1284
if(mc.simple_poll != NULL)
1285
avahi_simple_poll_free(mc.simple_poll);
1286
1287
if(gnutls_initialized){
1288
gnutls_certificate_free_credentials(mc.cred);
1289
gnutls_global_deinit();
1290
gnutls_dh_params_deinit(mc.dh_params);
1291
}
1292
1293
if(gpgme_initialized){
1294
gpgme_release(mc.ctx);
1295
}
1296
1297
/* Removes the temp directory used by GPGME */
1298
if(tempdir_created){
1299
DIR *d;
1300
struct dirent *direntry;
1301
d = opendir(tempdir);
1302
if(d == NULL){
1303
if(errno != ENOENT){
1304
perror("opendir");
1305
}
1306
} else {
1307
while(true){
1308
direntry = readdir(d);
1309
if(direntry == NULL){
1310
break;
1311
}
1312
/* Skip "." and ".." */
1313
if(direntry->d_name[0] == '.'
1314
and (direntry->d_name[1] == '\0'
1315
or (direntry->d_name[1] == '.'
1316
and direntry->d_name[2] == '\0'))){
1317
continue;
1318
}
1319
char *fullname = NULL;
1320
ret = asprintf(&fullname, "%s/%s", tempdir,
1321
direntry->d_name);
1322
if(ret < 0){
1323
perror("asprintf");
1324
continue;
1325
}
1326
ret = remove(fullname);
1327
if(ret == -1){
1328
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1329
strerror(errno));
1330
}
1331
free(fullname);
1332
}
1333
closedir(d);
1334
}
1335
ret = rmdir(tempdir);
1336
if(ret == -1 and errno != ENOENT){
1337
perror("rmdir");
1338
}
1339
}
1340
1341
return exitcode;
1079
1080
if (debug){
1081
fprintf(stderr, "%s exiting\n", argv[0]);
1082
}
1083
1084
/* Cleanup things */
1085
if (sb != NULL)
1086
avahi_s_service_browser_free(sb);
1087
1088
if (mc.server != NULL)
1089
avahi_server_free(mc.server);
1090
1091
if (mc.simple_poll != NULL)
1092
avahi_simple_poll_free(mc.simple_poll);
1093
1094
if (gnutls_initalized){
1095
gnutls_certificate_free_credentials(mc.cred);
1096
gnutls_global_deinit ();
1097
gnutls_dh_params_deinit(mc.dh_params);
1098
}
1099
1100
if(gpgme_initalized){
1101
gpgme_release(mc.ctx);
1102
}
1103
1104
/* Removes the temp directory used by GPGME */
1105
if(tempdir[0] != '\0'){
1106
DIR *d;
1107
struct dirent *direntry;
1108
d = opendir(tempdir);
1109
if(d == NULL){
1110
if(errno != ENOENT){
1111
perror("opendir");
1112
}
1113
} else {
1114
while(true){
1115
direntry = readdir(d);
1116
if(direntry == NULL){
1117
break;
1118
}
1119
if (direntry->d_type == DT_REG){
1120
char *fullname = NULL;
1121
ret = asprintf(&fullname, "%s/%s", tempdir,
1122
direntry->d_name);
1123
if(ret < 0){
1124
perror("asprintf");
1125
continue;
1126
}
1127
ret = unlink(fullname);
1128
if(ret == -1){
1129
fprintf(stderr, "unlink(\"%s\"): %s",
1130
fullname, strerror(errno));
1131
}
1132
free(fullname);
1133
}
1134
}
1135
closedir(d);
1136
}
1137
ret = rmdir(tempdir);
1138
if(ret == -1 and errno != ENOENT){
1139
perror("rmdir");
1140
}
1141
}
1142
1143
return exitcode;
1342
1144
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0