32
33
#define _LARGEFILE_SOURCE
33
34
#define _FILE_OFFSET_BITS 64
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */
41
#include <net/if.h> /* if_nametoindex */
42
#include <sys/ioctl.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
43
#include <net/if.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror(), sscanf(),
41
#include <stdint.h> /* uint16_t, uint32_t */
42
#include <stddef.h> /* NULL, size_t, ssize_t */
43
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
45
#include <stdbool.h> /* bool, false, true */
46
#include <string.h> /* memset(), strcmp(), strlen(),
47
strerror(), asprintf(), strcpy() */
48
#include <sys/ioctl.h> /* ioctl */
49
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
50
sockaddr_in6, PF_INET6,
51
SOCK_STREAM, uid_t, gid_t, open(),
53
#include <sys/stat.h> /* open() */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
inet_pton(), connect() */
56
#include <fcntl.h> /* open() */
57
#include <dirent.h> /* opendir(), struct dirent, readdir()
59
#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */
60
#include <assert.h> /* assert() */
61
#include <errno.h> /* perror(), errno */
62
#include <time.h> /* nanosleep(), time() */
63
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
64
SIOCSIFFLAGS, if_indextoname(),
65
if_nametoindex(), IF_NAMESIZE */
66
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
67
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
69
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
70
getuid(), getgid(), setuid(),
72
#include <arpa/inet.h> /* inet_pton(), htons */
73
#include <iso646.h> /* not, or, and */
74
#include <argp.h> /* struct argp_option, error_t, struct
75
argp_state, struct argp,
76
argp_parse(), ARGP_KEY_ARG,
77
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
78
#include <signal.h> /* sigemptyset(), sigaddset(),
79
sigaction(), SIGTERM, sigaction,
83
#include <sys/klog.h> /* klogctl() */
84
#endif /* __linux__ */
87
/* All Avahi types, constants and functions
45
90
#include <avahi-core/core.h>
46
91
#include <avahi-core/lookup.h>
47
92
#include <avahi-core/log.h>
101
153
return buffer_capacity;
104
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
106
const char *homedir){
107
gpgme_data_t dh_crypto, dh_plain;
159
static bool init_gpgme(const char *seckey,
160
const char *pubkey, const char *tempdir){
109
162
gpgme_error_t rc;
111
size_t new_packet_capacity = 0;
112
ssize_t new_packet_length = 0;
113
163
gpgme_engine_info_t engine_info;
116
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
167
* Helper function to insert pub and seckey to the engine keyring.
169
bool import_key(const char *filename){
171
gpgme_data_t pgp_data;
173
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
179
rc = gpgme_data_new_from_fd(&pgp_data, fd);
180
if(rc != GPG_ERR_NO_ERROR){
181
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
182
gpgme_strsource(rc), gpgme_strerror(rc));
186
rc = gpgme_op_import(mc.ctx, pgp_data);
187
if(rc != GPG_ERR_NO_ERROR){
188
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
189
gpgme_strsource(rc), gpgme_strerror(rc));
193
ret = (int)TEMP_FAILURE_RETRY(close(fd));
197
gpgme_data_release(pgp_data);
202
fprintf(stderr, "Initializing GPGME\n");
120
206
gpgme_check_version(NULL);
121
207
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
122
if (rc != GPG_ERR_NO_ERROR){
208
if(rc != GPG_ERR_NO_ERROR){
123
209
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
124
210
gpgme_strsource(rc), gpgme_strerror(rc));
128
/* Set GPGME home directory */
129
rc = gpgme_get_engine_info (&engine_info);
130
if (rc != GPG_ERR_NO_ERROR){
214
/* Set GPGME home directory for the OpenPGP engine only */
215
rc = gpgme_get_engine_info(&engine_info);
216
if(rc != GPG_ERR_NO_ERROR){
131
217
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
132
218
gpgme_strsource(rc), gpgme_strerror(rc));
135
221
while(engine_info != NULL){
136
222
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
137
223
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
138
engine_info->file_name, homedir);
224
engine_info->file_name, tempdir);
141
227
engine_info = engine_info->next;
143
229
if(engine_info == NULL){
144
fprintf(stderr, "Could not set home dir to %s\n", homedir);
148
/* Create new GPGME data buffer from packet buffer */
149
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
150
if (rc != GPG_ERR_NO_ERROR){
230
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
234
/* Create new GPGME "context" */
235
rc = gpgme_new(&(mc.ctx));
236
if(rc != GPG_ERR_NO_ERROR){
237
fprintf(stderr, "bad gpgme_new: %s: %s\n",
238
gpgme_strsource(rc), gpgme_strerror(rc));
242
if(not import_key(pubkey) or not import_key(seckey)){
250
* Decrypt OpenPGP data.
251
* Returns -1 on error
253
static ssize_t pgp_packet_decrypt(const char *cryptotext,
256
gpgme_data_t dh_crypto, dh_plain;
259
size_t plaintext_capacity = 0;
260
ssize_t plaintext_length = 0;
263
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
266
/* Create new GPGME data buffer from memory cryptotext */
267
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
269
if(rc != GPG_ERR_NO_ERROR){
151
270
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
152
271
gpgme_strsource(rc), gpgme_strerror(rc));
156
275
/* Create new empty GPGME data buffer for the plaintext */
157
276
rc = gpgme_data_new(&dh_plain);
158
if (rc != GPG_ERR_NO_ERROR){
277
if(rc != GPG_ERR_NO_ERROR){
159
278
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
160
279
gpgme_strsource(rc), gpgme_strerror(rc));
164
/* Create new GPGME "context" */
165
rc = gpgme_new(&ctx);
166
if (rc != GPG_ERR_NO_ERROR){
167
fprintf(stderr, "bad gpgme_new: %s: %s\n",
168
gpgme_strsource(rc), gpgme_strerror(rc));
172
/* Decrypt data from the FILE pointer to the plaintext data
174
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
175
if (rc != GPG_ERR_NO_ERROR){
280
gpgme_data_release(dh_crypto);
284
/* Decrypt data from the cryptotext data buffer to the plaintext
286
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
287
if(rc != GPG_ERR_NO_ERROR){
176
288
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
177
289
gpgme_strsource(rc), gpgme_strerror(rc));
290
plaintext_length = -1;
292
gpgme_decrypt_result_t result;
293
result = gpgme_op_decrypt_result(mc.ctx);
295
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
297
fprintf(stderr, "Unsupported algorithm: %s\n",
298
result->unsupported_algorithm);
299
fprintf(stderr, "Wrong key usage: %u\n",
300
result->wrong_key_usage);
301
if(result->file_name != NULL){
302
fprintf(stderr, "File name: %s\n", result->file_name);
304
gpgme_recipient_t recipient;
305
recipient = result->recipients;
307
while(recipient != NULL){
308
fprintf(stderr, "Public key algorithm: %s\n",
309
gpgme_pubkey_algo_name(recipient->pubkey_algo));
310
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
311
fprintf(stderr, "Secret key available: %s\n",
312
recipient->status == GPG_ERR_NO_SECKEY
314
recipient = recipient->next;
182
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
186
gpgme_decrypt_result_t result;
187
result = gpgme_op_decrypt_result(ctx);
189
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
191
fprintf(stderr, "Unsupported algorithm: %s\n",
192
result->unsupported_algorithm);
193
fprintf(stderr, "Wrong key usage: %d\n",
194
result->wrong_key_usage);
195
if(result->file_name != NULL){
196
fprintf(stderr, "File name: %s\n", result->file_name);
198
gpgme_recipient_t recipient;
199
recipient = result->recipients;
201
while(recipient != NULL){
202
fprintf(stderr, "Public key algorithm: %s\n",
203
gpgme_pubkey_algo_name(recipient->pubkey_algo));
204
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
205
fprintf(stderr, "Secret key available: %s\n",
206
recipient->status == GPG_ERR_NO_SECKEY
208
recipient = recipient->next;
214
/* Delete the GPGME FILE pointer cryptotext data buffer */
215
gpgme_data_release(dh_crypto);
323
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
217
326
/* Seek back to the beginning of the GPGME plaintext data buffer */
218
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
219
perror("pgpme_data_seek");
327
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
328
perror("gpgme_data_seek");
329
plaintext_length = -1;
224
new_packet_capacity = adjustbuffer(*new_packet, new_packet_length,
225
new_packet_capacity);
226
if (new_packet_capacity == 0){
227
perror("adjustbuffer");
230
new_packet_capacity += BUFFER_SIZE;
335
plaintext_capacity = incbuffer(plaintext,
336
(size_t)plaintext_length,
338
if(plaintext_capacity == 0){
340
plaintext_length = -1;
233
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
344
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
235
346
/* Print the data, if any */
240
352
perror("gpgme_data_read");
243
new_packet_length += ret;
246
/* FIXME: check characters before printing to screen so to not print
247
terminal control characters */
249
/* fprintf(stderr, "decrypted password is: "); */
250
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
251
/* fprintf(stderr, "\n"); */
353
plaintext_length = -1;
356
plaintext_length += ret;
360
fprintf(stderr, "Decrypted password is: ");
361
for(ssize_t i = 0; i < plaintext_length; i++){
362
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
364
fprintf(stderr, "\n");
369
/* Delete the GPGME cryptotext data buffer */
370
gpgme_data_release(dh_crypto);
254
372
/* Delete the GPGME plaintext data buffer */
255
373
gpgme_data_release(dh_plain);
256
return new_packet_length;
374
return plaintext_length;
259
static const char * safer_gnutls_strerror (int value) {
260
const char *ret = gnutls_strerror (value);
377
static const char * safer_gnutls_strerror(int value){
378
const char *ret = gnutls_strerror(value); /* Spurious warning from
379
-Wunreachable-code */
262
381
ret = "(unknown)";
385
/* GnuTLS log function callback */
266
386
static void debuggnutls(__attribute__((unused)) int level,
267
387
const char* string){
268
fprintf(stderr, "%s", string);
388
fprintf(stderr, "GnuTLS: %s", string);
271
static int initgnutls(mandos_context *mc){
391
static int init_gnutls_global(const char *pubkeyfilename,
392
const char *seckeyfilename){
276
396
fprintf(stderr, "Initializing GnuTLS\n");
279
if ((ret = gnutls_global_init ())
280
!= GNUTLS_E_SUCCESS) {
281
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
399
ret = gnutls_global_init();
400
if(ret != GNUTLS_E_SUCCESS){
401
fprintf(stderr, "GnuTLS global_init: %s\n",
402
safer_gnutls_strerror(ret));
407
/* "Use a log level over 10 to enable all debugging options."
286
410
gnutls_global_set_log_level(11);
287
411
gnutls_global_set_log_function(debuggnutls);
290
/* openpgp credentials */
291
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
292
!= GNUTLS_E_SUCCESS) {
293
fprintf (stderr, "memory error: %s\n",
294
safer_gnutls_strerror(ret));
414
/* OpenPGP credentials */
415
gnutls_certificate_allocate_credentials(&mc.cred);
416
if(ret != GNUTLS_E_SUCCESS){
417
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
421
safer_gnutls_strerror(ret));
422
gnutls_global_deinit();
299
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
300
" and keyfile %s as GnuTLS credentials\n", certfile,
427
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
428
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
304
432
ret = gnutls_certificate_set_openpgp_key_file
305
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
306
if (ret != GNUTLS_E_SUCCESS) {
308
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
310
ret, certfile, certkey);
311
fprintf(stdout, "The Error is: %s\n",
312
safer_gnutls_strerror(ret));
316
//GnuTLS server initialization
317
if ((ret = gnutls_dh_params_init (&es->dh_params))
318
!= GNUTLS_E_SUCCESS) {
319
fprintf (stderr, "Error in dh parameter initialization: %s\n",
320
safer_gnutls_strerror(ret));
324
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
325
!= GNUTLS_E_SUCCESS) {
326
fprintf (stderr, "Error in prime generation: %s\n",
327
safer_gnutls_strerror(ret));
331
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
333
// GnuTLS session creation
334
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
335
!= GNUTLS_E_SUCCESS){
433
(mc.cred, pubkeyfilename, seckeyfilename,
434
GNUTLS_OPENPGP_FMT_BASE64);
435
if(ret != GNUTLS_E_SUCCESS){
437
"Error[%d] while reading the OpenPGP key pair ('%s',"
438
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
439
fprintf(stderr, "The GnuTLS error is: %s\n",
440
safer_gnutls_strerror(ret));
444
/* GnuTLS server initialization */
445
ret = gnutls_dh_params_init(&mc.dh_params);
446
if(ret != GNUTLS_E_SUCCESS){
447
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
448
" %s\n", safer_gnutls_strerror(ret));
451
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
452
if(ret != GNUTLS_E_SUCCESS){
453
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
454
safer_gnutls_strerror(ret));
458
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
464
gnutls_certificate_free_credentials(mc.cred);
465
gnutls_global_deinit();
466
gnutls_dh_params_deinit(mc.dh_params);
470
static int init_gnutls_session(gnutls_session_t *session){
472
/* GnuTLS session creation */
473
ret = gnutls_init(session, GNUTLS_SERVER);
474
if(ret != GNUTLS_E_SUCCESS){
336
475
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
337
476
safer_gnutls_strerror(ret));
340
if ((ret = gnutls_priority_set_direct (es->session, mc->priority, &err))
341
!= GNUTLS_E_SUCCESS) {
342
fprintf(stderr, "Syntax error at: %s\n", err);
343
fprintf(stderr, "GnuTLS error: %s\n",
344
safer_gnutls_strerror(ret));
481
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
482
if(ret != GNUTLS_E_SUCCESS){
483
fprintf(stderr, "Syntax error at: %s\n", err);
484
fprintf(stderr, "GnuTLS error: %s\n",
485
safer_gnutls_strerror(ret));
486
gnutls_deinit(*session);
348
if ((ret = gnutls_credentials_set
349
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
350
!= GNUTLS_E_SUCCESS) {
351
fprintf(stderr, "Error setting a credentials set: %s\n",
491
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
493
if(ret != GNUTLS_E_SUCCESS){
494
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
352
495
safer_gnutls_strerror(ret));
496
gnutls_deinit(*session);
356
500
/* ignore client certificate if any. */
357
gnutls_certificate_server_set_request (es->session,
501
gnutls_certificate_server_set_request(*session,
360
gnutls_dh_set_prime_bits (es->session, DH_BITS);
504
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
509
/* Avahi log function callback */
365
510
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
366
511
__attribute__((unused)) const char *txt){}
513
/* Called when a Mandos server is found */
368
514
static int start_mandos_communication(const char *ip, uint16_t port,
369
515
AvahiIfIndex if_index,
372
struct sockaddr_in6 to;
373
encrypted_session es;
520
struct sockaddr_in in;
521
struct sockaddr_in6 in6;
374
523
char *buffer = NULL;
375
524
char *decrypted_buffer;
376
525
size_t buffer_length = 0;
378
527
ssize_t decrypted_buffer_size;
381
char interface[IF_NAMESIZE];
530
gnutls_session_t session;
531
int pf; /* Protocol family */
541
fprintf(stderr, "Bad address family: %d\n", af);
545
ret = init_gnutls_session(&session);
384
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
551
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
388
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
555
tcp_sd = socket(pf, SOCK_STREAM, 0);
390
557
perror("socket");
395
if(if_indextoname((unsigned int)if_index, interface) == NULL){
397
perror("if_indextoname");
402
fprintf(stderr, "Binding to interface %s\n", interface);
405
memset(&to,0,sizeof(to)); /* Spurious warning */
406
to.sin6_family = AF_INET6;
407
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
561
memset(&to, 0, sizeof(to));
563
to.in6.sin6_family = (uint16_t)af;
564
ret = inet_pton(af, ip, &to.in6.sin6_addr);
566
to.in.sin_family = (sa_family_t)af;
567
ret = inet_pton(af, ip, &to.in.sin_addr);
409
570
perror("inet_pton");
413
574
fprintf(stderr, "Bad address: %s\n", ip);
416
to.sin6_port = htons(port); /* Spurious warning */
418
to.sin6_scope_id = (uint32_t)if_index;
578
to.in6.sin6_port = htons(port); /* Spurious warnings from
580
-Wunreachable-code */
582
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
583
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
585
if(if_index == AVAHI_IF_UNSPEC){
586
fprintf(stderr, "An IPv6 link-local address is incomplete"
587
" without a network interface\n");
590
/* Set the network interface number as scope */
591
to.in6.sin6_scope_id = (uint32_t)if_index;
594
to.in.sin_port = htons(port); /* Spurious warnings from
596
-Wunreachable-code */
421
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
422
/* char addrstr[INET6_ADDRSTRLEN]; */
423
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
424
/* sizeof(addrstr)) == NULL){ */
425
/* perror("inet_ntop"); */
427
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
428
/* addrstr, ntohs(to.sin6_port)); */
600
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
601
char interface[IF_NAMESIZE];
602
if(if_indextoname((unsigned int)if_index, interface) == NULL){
603
perror("if_indextoname");
605
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
606
ip, interface, port);
609
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
612
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
613
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
616
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
619
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
625
if(strcmp(addrstr, ip) != 0){
626
fprintf(stderr, "Canonical address form: %s\n", addrstr);
432
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
632
ret = connect(tcp_sd, &to.in6, sizeof(to));
634
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
434
637
perror("connect");
438
char *out = mandos_protocol_version;
641
const char *out = mandos_protocol_version;
441
644
size_t out_size = strlen(out);
442
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
645
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
443
646
out_size - written));
652
written += (size_t)ret;
450
653
if(written < out_size){
453
if (out == mandos_protocol_version){
656
if(out == mandos_protocol_version){
604
808
char ip[AVAHI_ADDRESS_STR_MAX];
605
809
avahi_address_snprint(ip, sizeof(ip), address);
607
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
608
" port %d\n", name, host_name, ip, port);
811
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
812
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
813
ip, (intmax_t)interface, port);
610
int ret = start_mandos_communication(ip, port, interface, mc);
815
int ret = start_mandos_communication(ip, port, interface,
816
avahi_proto_to_af(proto));
818
avahi_simple_poll_quit(mc.simple_poll);
616
822
avahi_s_service_resolver_free(r);
619
static void browse_callback( AvahiSServiceBrowser *b,
620
AvahiIfIndex interface,
621
AvahiProtocol protocol,
622
AvahiBrowserEvent event,
626
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
628
mandos_context *mc = userdata;
629
assert(b); /* Spurious warning */
825
static void browse_callback(AvahiSServiceBrowser *b,
826
AvahiIfIndex interface,
827
AvahiProtocol protocol,
828
AvahiBrowserEvent event,
832
AVAHI_GCC_UNUSED AvahiLookupResultFlags
834
AVAHI_GCC_UNUSED void* userdata){
631
837
/* Called whenever a new services becomes available on the LAN or
632
838
is removed from the LAN */
636
842
case AVAHI_BROWSER_FAILURE:
638
fprintf(stderr, "(Browser) %s\n",
639
avahi_strerror(avahi_server_errno(mc->server)));
640
avahi_simple_poll_quit(mc->simple_poll);
844
fprintf(stderr, "(Avahi browser) %s\n",
845
avahi_strerror(avahi_server_errno(mc.server)));
846
avahi_simple_poll_quit(mc.simple_poll);
643
849
case AVAHI_BROWSER_NEW:
644
/* We ignore the returned resolver object. In the callback
645
function we free it. If the server is terminated before
646
the callback function is called the server will free
647
the resolver for us. */
649
if (!(avahi_s_service_resolver_new(mc->server, interface, protocol, name,
850
/* We ignore the returned Avahi resolver object. In the callback
851
function we free it. If the Avahi server is terminated before
852
the callback function is called the Avahi server will free the
855
if(!(avahi_s_service_resolver_new(mc.server, interface,
856
protocol, name, type, domain,
651
857
AVAHI_PROTO_INET6, 0,
652
resolve_callback, mc)))
653
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
654
avahi_strerror(avahi_server_errno(s)));
858
resolve_callback, NULL)))
859
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
860
name, avahi_strerror(avahi_server_errno(mc.server)));
657
863
case AVAHI_BROWSER_REMOVE:
660
866
case AVAHI_BROWSER_ALL_FOR_NOW:
661
867
case AVAHI_BROWSER_CACHE_EXHAUSTED:
869
fprintf(stderr, "No Mandos server found, still searching...\n");
666
/* Combines file name and path and returns the malloced new
667
string. some sane checks could/should be added */
668
static const char *combinepath(const char *first, const char *second){
669
size_t f_len = strlen(first);
670
size_t s_len = strlen(second);
671
char *tmp = malloc(f_len + s_len + 2);
676
memcpy(tmp, first, f_len);
680
memcpy(tmp + f_len + 1, second, s_len);
682
tmp[f_len + 1 + s_len] = '\0';
875
sig_atomic_t quit_now = 0;
877
static void handle_sigterm(__attribute__((unused)) int sig){
882
int old_errno = errno;
883
if(mc.simple_poll != NULL){
884
avahi_simple_poll_quit(mc.simple_poll);
889
int main(int argc, char *argv[]){
890
AvahiSServiceBrowser *sb = NULL;
895
int exitcode = EXIT_SUCCESS;
896
const char *interface = "eth0";
897
struct ifreq network;
901
char *connect_to = NULL;
902
char tempdir[] = "/tmp/mandosXXXXXX";
903
bool tempdir_created = false;
904
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
905
const char *seckey = PATHDIR "/" SECKEY;
906
const char *pubkey = PATHDIR "/" PUBKEY;
908
/* Initialize Mandos context */
909
mc = (mandos_context){ .simple_poll = NULL, .server = NULL,
910
.dh_bits = 1024, .priority = "SECURE256"
911
":!CTYPE-X.509:+CTYPE-OPENPGP" };
912
bool gnutls_initialized = false;
913
bool gpgme_initialized = false;
687
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
688
AvahiServerConfig config;
689
AvahiSServiceBrowser *sb = NULL;
692
int returncode = EXIT_SUCCESS;
693
const char *interface = "eth0";
694
struct ifreq network;
696
char *connect_to = NULL;
697
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
698
mandos_context mc = { .simple_poll = NULL, .server = NULL,
699
.dh_bits = 2048, .priority = "SECURE256"};
916
struct sigaction old_sigterm_action;
917
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
920
struct argp_option options[] = {
921
{ .name = "debug", .key = 128,
922
.doc = "Debug mode", .group = 3 },
923
{ .name = "connect", .key = 'c',
924
.arg = "ADDRESS:PORT",
925
.doc = "Connect directly to a specific Mandos server",
927
{ .name = "interface", .key = 'i',
929
.doc = "Network interface that will be used to search for"
932
{ .name = "seckey", .key = 's',
934
.doc = "OpenPGP secret key file base name",
936
{ .name = "pubkey", .key = 'p',
938
.doc = "OpenPGP public key file base name",
940
{ .name = "dh-bits", .key = 129,
942
.doc = "Bit length of the prime number used in the"
943
" Diffie-Hellman key exchange",
945
{ .name = "priority", .key = 130,
947
.doc = "GnuTLS priority string for the TLS handshake",
949
{ .name = "delay", .key = 131,
951
.doc = "Maximum delay to wait for interface startup",
702
static struct option long_options[] = {
703
{"debug", no_argument, (int *)&debug, 1},
704
{"connect", required_argument, 0, 'C'},
705
{"interface", required_argument, 0, 'i'},
706
{"certdir", required_argument, 0, 'd'},
707
{"certkey", required_argument, 0, 'c'},
708
{"certfile", required_argument, 0, 'k'},
709
{"dh_bits", required_argument, 0, 'D'},
710
{"priority", required_argument, 0, 'p'},
713
int option_index = 0;
714
ret = getopt_long (argc, argv, "i:", long_options,
743
tmp = strtol(optarg, NULL, 10);
744
if (errno == ERANGE){
752
mc.priority = optarg;
956
error_t parse_opt(int key, char *arg,
957
struct argp_state *state){
959
case 128: /* --debug */
962
case 'c': /* --connect */
965
case 'i': /* --interface */
968
case 's': /* --seckey */
971
case 'p': /* --pubkey */
974
case 129: /* --dh-bits */
975
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
976
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
977
or arg[numchars] != '\0'){
978
fprintf(stderr, "Bad number of DH bits\n");
981
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
983
case 130: /* --priority */
986
case 131: /* --delay */
987
ret = sscanf(arg, "%lf%n", &delay, &numchars);
988
if(ret < 1 or arg[numchars] != '\0'){
989
fprintf(stderr, "Bad delay\n");
759
certfile = combinepath(certdir, certfile);
760
if (certfile == NULL){
761
perror("combinepath");
762
returncode = EXIT_FAILURE;
766
certkey = combinepath(certdir, certkey);
767
if (certkey == NULL){
768
perror("combinepath");
769
returncode = EXIT_FAILURE;
773
if_index = (AvahiIfIndex) if_nametoindex(interface);
775
fprintf(stderr, "No such interface: \"%s\"\n", interface);
779
if(connect_to != NULL){
780
/* Connect directly, do not use Zeroconf */
781
/* (Mainly meant for debugging) */
782
char *address = strrchr(connect_to, ':');
784
fprintf(stderr, "No colon in address\n");
788
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
790
perror("Bad port number");
794
address = connect_to;
795
ret = start_mandos_communication(address, port, if_index);
998
return ARGP_ERR_UNKNOWN;
1003
struct argp argp = { .options = options, .parser = parse_opt,
1005
.doc = "Mandos client -- Get and decrypt"
1006
" passwords from a Mandos server" };
1007
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1008
if(ret == ARGP_ERR_UNKNOWN){
1009
fprintf(stderr, "Unknown error while parsing arguments\n");
1010
exitcode = EXIT_FAILURE;
1015
/* If the interface is down, bring it up */
1016
if(interface[0] != '\0'){
1018
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1019
messages to mess up the prompt */
1020
ret = klogctl(8, NULL, 5);
1021
bool restore_loglevel = true;
1023
restore_loglevel = false;
1026
#endif /* __linux__ */
803
1028
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
805
1030
perror("socket");
806
returncode = EXIT_FAILURE;
1031
exitcode = EXIT_FAILURE;
1033
if(restore_loglevel){
1034
ret = klogctl(7, NULL, 0);
1039
#endif /* __linux__ */
809
strcpy(network.ifr_name, interface);
1042
strcpy(network.ifr_name, interface);
810
1043
ret = ioctl(sd, SIOCGIFFLAGS, &network);
813
1045
perror("ioctl SIOCGIFFLAGS");
814
returncode = EXIT_FAILURE;
1047
if(restore_loglevel){
1048
ret = klogctl(7, NULL, 0);
1053
#endif /* __linux__ */
1054
exitcode = EXIT_FAILURE;
817
1057
if((network.ifr_flags & IFF_UP) == 0){
818
1058
network.ifr_flags |= IFF_UP;
819
1059
ret = ioctl(sd, SIOCSIFFLAGS, &network);
821
1061
perror("ioctl SIOCSIFFLAGS");
822
returncode = EXIT_FAILURE;
829
avahi_set_log_function(empty_log);
832
/* Initialize the psuedo-RNG */
833
srand((unsigned int) time(NULL));
835
/* Allocate main loop object */
836
if (!(mc.simple_poll = avahi_simple_poll_new())) {
837
fprintf(stderr, "Failed to create simple poll object.\n");
838
returncode = EXIT_FAILURE;
842
/* Do not publish any local records */
1062
exitcode = EXIT_FAILURE;
1064
if(restore_loglevel){
1065
ret = klogctl(7, NULL, 0);
1070
#endif /* __linux__ */
1074
/* sleep checking until interface is running */
1075
for(int i=0; i < delay * 4; i++){
1076
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1078
perror("ioctl SIOCGIFFLAGS");
1079
} else if(network.ifr_flags & IFF_RUNNING){
1082
struct timespec sleeptime = { .tv_nsec = 250000000 };
1083
ret = nanosleep(&sleeptime, NULL);
1084
if(ret == -1 and errno != EINTR){
1085
perror("nanosleep");
1088
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1093
if(restore_loglevel){
1094
/* Restores kernel loglevel to default */
1095
ret = klogctl(7, NULL, 0);
1100
#endif /* __linux__ */
1117
ret = init_gnutls_global(pubkey, seckey);
1119
fprintf(stderr, "init_gnutls_global failed\n");
1120
exitcode = EXIT_FAILURE;
1123
gnutls_initialized = true;
1126
if(mkdtemp(tempdir) == NULL){
1130
tempdir_created = true;
1132
if(not init_gpgme(pubkey, seckey, tempdir)){
1133
fprintf(stderr, "init_gpgme failed\n");
1134
exitcode = EXIT_FAILURE;
1137
gpgme_initialized = true;
1140
if(interface[0] != '\0'){
1141
if_index = (AvahiIfIndex) if_nametoindex(interface);
1143
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1144
exitcode = EXIT_FAILURE;
1149
if(connect_to != NULL){
1150
/* Connect directly, do not use Zeroconf */
1151
/* (Mainly meant for debugging) */
1152
char *address = strrchr(connect_to, ':');
1153
if(address == NULL){
1154
fprintf(stderr, "No colon in address\n");
1155
exitcode = EXIT_FAILURE;
1159
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1160
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1161
or address[numchars+1] != '\0'){
1162
fprintf(stderr, "Bad port number\n");
1163
exitcode = EXIT_FAILURE;
1166
port = (uint16_t)tmpmax;
1168
address = connect_to;
1169
/* Colon in address indicates IPv6 */
1171
if(strchr(address, ':') != NULL){
1176
ret = start_mandos_communication(address, port, if_index, af);
1178
exitcode = EXIT_FAILURE;
1180
exitcode = EXIT_SUCCESS;
1186
avahi_set_log_function(empty_log);
1189
/* Initialize the pseudo-RNG for Avahi */
1190
srand((unsigned int) time(NULL));
1192
/* Allocate main Avahi loop object */
1193
mc.simple_poll = avahi_simple_poll_new();
1194
if(mc.simple_poll == NULL){
1195
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1196
exitcode = EXIT_FAILURE;
1201
AvahiServerConfig config;
1202
/* Do not publish any local Zeroconf records */
843
1203
avahi_server_config_init(&config);
844
1204
config.publish_hinfo = 0;
845
1205
config.publish_addresses = 0;
846
1206
config.publish_workstation = 0;
847
1207
config.publish_domain = 0;
849
1209
/* Allocate a new server */
850
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
851
&config, NULL, NULL, &error);
853
/* Free the configuration data */
1210
mc.server = avahi_server_new(avahi_simple_poll_get
1211
(mc.simple_poll), &config, NULL,
1214
/* Free the Avahi configuration data */
854
1215
avahi_server_config_free(&config);
856
/* Check if creating the server object succeeded */
858
fprintf(stderr, "Failed to create server: %s\n",
859
avahi_strerror(error));
860
returncode = EXIT_FAILURE;
864
/* Create the service browser */
865
sb = avahi_s_service_browser_new(mc.server, if_index,
867
"_mandos._tcp", NULL, 0,
868
browse_callback, &mc);
870
fprintf(stderr, "Failed to create service browser: %s\n",
871
avahi_strerror(avahi_server_errno(mc.server)));
872
returncode = EXIT_FAILURE;
876
/* Run the main loop */
879
fprintf(stderr, "Starting avahi loop search\n");
882
avahi_simple_poll_loop(simple_poll);
887
fprintf(stderr, "%s exiting\n", argv[0]);
892
avahi_s_service_browser_free(sb);
895
avahi_server_free(mc.server);
898
avahi_simple_poll_free(simple_poll);
1218
/* Check if creating the Avahi server object succeeded */
1219
if(mc.server == NULL){
1220
fprintf(stderr, "Failed to create Avahi server: %s\n",
1221
avahi_strerror(error));
1222
exitcode = EXIT_FAILURE;
1226
/* Create the Avahi service browser */
1227
sb = avahi_s_service_browser_new(mc.server, if_index,
1228
AVAHI_PROTO_INET6, "_mandos._tcp",
1229
NULL, 0, browse_callback, NULL);
1231
fprintf(stderr, "Failed to create service browser: %s\n",
1232
avahi_strerror(avahi_server_errno(mc.server)));
1233
exitcode = EXIT_FAILURE;
1237
sigemptyset(&sigterm_action.sa_mask);
1238
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1240
perror("sigaddset");
1241
exitcode = EXIT_FAILURE;
1244
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1246
perror("sigaddset");
1247
exitcode = EXIT_FAILURE;
1250
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1252
perror("sigaddset");
1253
exitcode = EXIT_FAILURE;
1256
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1258
perror("sigaction");
1259
exitcode = EXIT_FAILURE;
1263
/* Run the main loop */
1266
fprintf(stderr, "Starting Avahi loop search\n");
1269
avahi_simple_poll_loop(mc.simple_poll);
1274
fprintf(stderr, "%s exiting\n", argv[0]);
1277
/* Cleanup things */
1279
avahi_s_service_browser_free(sb);
1281
if(mc.server != NULL)
1282
avahi_server_free(mc.server);
1284
if(mc.simple_poll != NULL)
1285
avahi_simple_poll_free(mc.simple_poll);
1287
if(gnutls_initialized){
1288
gnutls_certificate_free_credentials(mc.cred);
1289
gnutls_global_deinit();
1290
gnutls_dh_params_deinit(mc.dh_params);
1293
if(gpgme_initialized){
1294
gpgme_release(mc.ctx);
1297
/* Removes the temp directory used by GPGME */
1298
if(tempdir_created){
1300
struct dirent *direntry;
1301
d = opendir(tempdir);
1303
if(errno != ENOENT){
1308
direntry = readdir(d);
1309
if(direntry == NULL){
1312
/* Skip "." and ".." */
1313
if(direntry->d_name[0] == '.'
1314
and (direntry->d_name[1] == '\0'
1315
or (direntry->d_name[1] == '.'
1316
and direntry->d_name[2] == '\0'))){
1319
char *fullname = NULL;
1320
ret = asprintf(&fullname, "%s/%s", tempdir,
1326
ret = remove(fullname);
1328
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1335
ret = rmdir(tempdir);
1336
if(ret == -1 and errno != ENOENT){