36
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
38
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror(), sscanf */
39
stdout, ferror(), remove() */
40
40
#include <stdint.h> /* uint16_t, uint32_t */
41
41
#include <stddef.h> /* NULL, size_t, ssize_t */
42
42
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
44
#include <stdbool.h> /* bool, true */
44
#include <stdbool.h> /* bool, false, true */
45
45
#include <string.h> /* memset(), strcmp(), strlen(),
46
46
strerror(), asprintf(), strcpy() */
47
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/ioctl.h> /* ioctl */
48
48
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
49
49
sockaddr_in6, PF_INET6,
50
SOCK_STREAM, INET6_ADDRSTRLEN,
51
uid_t, gid_t, open(), opendir(),
50
SOCK_STREAM, uid_t, gid_t, open(),
53
52
#include <sys/stat.h> /* open() */
54
53
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
struct in6_addr, inet_pton(),
54
inet_pton(), connect() */
57
55
#include <fcntl.h> /* open() */
58
56
#include <dirent.h> /* opendir(), struct dirent, readdir()
60
#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */
58
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
61
60
#include <assert.h> /* assert() */
62
61
#include <errno.h> /* perror(), errno */
63
#include <time.h> /* time(), nanosleep() */
62
#include <time.h> /* nanosleep(), time() */
64
63
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
65
64
SIOCSIFFLAGS, if_indextoname(),
66
65
if_nametoindex(), IF_NAMESIZE */
67
#include <netinet/in.h>
66
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
67
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
68
69
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
69
70
getuid(), getgid(), setuid(),
71
72
#include <arpa/inet.h> /* inet_pton(), htons */
72
#include <iso646.h> /* not, and, or */
73
#include <iso646.h> /* not, or, and */
73
74
#include <argp.h> /* struct argp_option, error_t, struct
74
75
argp_state, struct argp,
75
76
argp_parse(), ARGP_KEY_ARG,
76
77
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
78
#include <signal.h> /* sigemptyset(), sigaddset(),
79
sigaction(), SIGTERM, sigaction,
77
83
#include <sys/klog.h> /* klogctl() */
84
#endif /* __linux__ */
80
87
/* All Avahi types, constants and functions
877
sig_atomic_t quit_now = 0;
879
/* stop main loop after sigterm has been called */
880
static void handle_sigterm(__attribute__((unused)) int sig){
885
int old_errno = errno;
886
if(mc.simple_poll != NULL){
887
avahi_simple_poll_quit(mc.simple_poll);
821
892
int main(int argc, char *argv[]){
822
AvahiSServiceBrowser *sb = NULL;
827
int exitcode = EXIT_SUCCESS;
828
const char *interface = "eth0";
829
struct ifreq network;
833
char *connect_to = NULL;
834
char tempdir[] = "/tmp/mandosXXXXXX";
835
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
836
const char *seckey = PATHDIR "/" SECKEY;
837
const char *pubkey = PATHDIR "/" PUBKEY;
839
mandos_context mc = { .simple_poll = NULL, .server = NULL,
840
.dh_bits = 1024, .priority = "SECURE256"
841
":!CTYPE-X.509:+CTYPE-OPENPGP" };
842
bool gnutls_initalized = false;
843
bool gpgme_initalized = false;
847
struct argp_option options[] = {
848
{ .name = "debug", .key = 128,
849
.doc = "Debug mode", .group = 3 },
850
{ .name = "connect", .key = 'c',
851
.arg = "ADDRESS:PORT",
852
.doc = "Connect directly to a specific Mandos server",
854
{ .name = "interface", .key = 'i',
856
.doc = "Interface that will be used to search for Mandos"
859
{ .name = "seckey", .key = 's',
861
.doc = "OpenPGP secret key file base name",
863
{ .name = "pubkey", .key = 'p',
865
.doc = "OpenPGP public key file base name",
867
{ .name = "dh-bits", .key = 129,
869
.doc = "Bit length of the prime number used in the"
870
" Diffie-Hellman key exchange",
872
{ .name = "priority", .key = 130,
874
.doc = "GnuTLS priority string for the TLS handshake",
876
{ .name = "delay", .key = 131,
878
.doc = "Maximum delay to wait for interface startup",
883
error_t parse_opt(int key, char *arg,
884
struct argp_state *state) {
886
case 128: /* --debug */
889
case 'c': /* --connect */
892
case 'i': /* --interface */
895
case 's': /* --seckey */
898
case 'p': /* --pubkey */
901
case 129: /* --dh-bits */
902
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
903
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
904
or arg[numchars] != '\0'){
905
fprintf(stderr, "Bad number of DH bits\n");
908
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
910
case 130: /* --priority */
913
case 131: /* --delay */
914
ret = sscanf(arg, "%lf%n", &delay, &numchars);
915
if(ret < 1 or arg[numchars] != '\0'){
916
fprintf(stderr, "Bad delay\n");
925
return ARGP_ERR_UNKNOWN;
930
struct argp argp = { .options = options, .parser = parse_opt,
932
.doc = "Mandos client -- Get and decrypt"
933
" passwords from a Mandos server" };
934
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
935
if(ret == ARGP_ERR_UNKNOWN){
936
fprintf(stderr, "Unknown error while parsing arguments\n");
937
exitcode = EXIT_FAILURE;
942
/* If the interface is down, bring it up */
944
// Lower kernel loglevel to KERN_NOTICE to avoid
945
// KERN_INFO messages to mess up the prompt
946
ret = klogctl(8, NULL, 5);
951
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
954
exitcode = EXIT_FAILURE;
955
ret = klogctl(7, NULL, 0);
961
strcpy(network.ifr_name, interface);
962
ret = ioctl(sd, SIOCGIFFLAGS, &network);
964
perror("ioctl SIOCGIFFLAGS");
965
ret = klogctl(7, NULL, 0);
969
exitcode = EXIT_FAILURE;
972
if((network.ifr_flags & IFF_UP) == 0){
973
network.ifr_flags |= IFF_UP;
974
ret = ioctl(sd, SIOCSIFFLAGS, &network);
976
perror("ioctl SIOCSIFFLAGS");
977
exitcode = EXIT_FAILURE;
893
AvahiSServiceBrowser *sb = NULL;
898
int exitcode = EXIT_SUCCESS;
899
const char *interface = "eth0";
900
struct ifreq network;
904
char *connect_to = NULL;
905
char tempdir[] = "/tmp/mandosXXXXXX";
906
bool tempdir_created = false;
907
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
908
const char *seckey = PATHDIR "/" SECKEY;
909
const char *pubkey = PATHDIR "/" PUBKEY;
911
/* Initialize Mandos context */
912
mc = (mandos_context){ .simple_poll = NULL, .server = NULL,
913
.dh_bits = 1024, .priority = "SECURE256"
914
":!CTYPE-X.509:+CTYPE-OPENPGP" };
915
bool gnutls_initialized = false;
916
bool gpgme_initialized = false;
919
struct sigaction old_sigterm_action;
920
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
923
struct argp_option options[] = {
924
{ .name = "debug", .key = 128,
925
.doc = "Debug mode", .group = 3 },
926
{ .name = "connect", .key = 'c',
927
.arg = "ADDRESS:PORT",
928
.doc = "Connect directly to a specific Mandos server",
930
{ .name = "interface", .key = 'i',
932
.doc = "Network interface that will be used to search for"
935
{ .name = "seckey", .key = 's',
937
.doc = "OpenPGP secret key file base name",
939
{ .name = "pubkey", .key = 'p',
941
.doc = "OpenPGP public key file base name",
943
{ .name = "dh-bits", .key = 129,
945
.doc = "Bit length of the prime number used in the"
946
" Diffie-Hellman key exchange",
948
{ .name = "priority", .key = 130,
950
.doc = "GnuTLS priority string for the TLS handshake",
952
{ .name = "delay", .key = 131,
954
.doc = "Maximum delay to wait for interface startup",
959
error_t parse_opt(int key, char *arg,
960
struct argp_state *state){
962
case 128: /* --debug */
965
case 'c': /* --connect */
968
case 'i': /* --interface */
971
case 's': /* --seckey */
974
case 'p': /* --pubkey */
977
case 129: /* --dh-bits */
979
tmpmax = strtoimax(arg, &tmp, 10);
980
if(errno != 0 or tmp == arg or *tmp != '\0'
981
or tmpmax != (typeof(mc.dh_bits))tmpmax){
982
fprintf(stderr, "Bad number of DH bits\n");
985
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
987
case 130: /* --priority */
990
case 131: /* --delay */
992
delay = strtof(arg, &tmp);
993
if(errno != 0 or tmp == arg or *tmp != '\0'){
994
fprintf(stderr, "Bad delay\n");
1003
return ARGP_ERR_UNKNOWN;
1008
struct argp argp = { .options = options, .parser = parse_opt,
1010
.doc = "Mandos client -- Get and decrypt"
1011
" passwords from a Mandos server" };
1012
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1013
if(ret == ARGP_ERR_UNKNOWN){
1014
fprintf(stderr, "Unknown error while parsing arguments\n");
1015
exitcode = EXIT_FAILURE;
1021
avahi_set_log_function(empty_log);
1024
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1025
from the signal handler */
1026
/* Initialize the pseudo-RNG for Avahi */
1027
srand((unsigned int) time(NULL));
1028
mc.simple_poll = avahi_simple_poll_new();
1029
if(mc.simple_poll == NULL){
1030
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1031
exitcode = EXIT_FAILURE;
1035
sigemptyset(&sigterm_action.sa_mask);
1036
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1038
perror("sigaddset");
1039
exitcode = EXIT_FAILURE;
1042
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1044
perror("sigaddset");
1045
exitcode = EXIT_FAILURE;
1048
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1050
perror("sigaddset");
1051
exitcode = EXIT_FAILURE;
1054
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1056
perror("sigaction");
1057
exitcode = EXIT_FAILURE;
1061
/* If the interface is down, bring it up */
1062
if(interface[0] != '\0'){
1064
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1065
messages to mess up the prompt */
1066
ret = klogctl(8, NULL, 5);
1067
bool restore_loglevel = true;
1069
restore_loglevel = false;
1072
#endif /* __linux__ */
1074
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1077
exitcode = EXIT_FAILURE;
1079
if(restore_loglevel){
1080
ret = klogctl(7, NULL, 0);
1085
#endif /* __linux__ */
1088
strcpy(network.ifr_name, interface);
1089
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1091
perror("ioctl SIOCGIFFLAGS");
1093
if(restore_loglevel){
1094
ret = klogctl(7, NULL, 0);
1099
#endif /* __linux__ */
1100
exitcode = EXIT_FAILURE;
1103
if((network.ifr_flags & IFF_UP) == 0){
1104
network.ifr_flags |= IFF_UP;
1105
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1107
perror("ioctl SIOCSIFFLAGS");
1108
exitcode = EXIT_FAILURE;
1110
if(restore_loglevel){
978
1111
ret = klogctl(7, NULL, 0);
980
1113
perror("klogctl");
985
// sleep checking until interface is running
986
for(int i=0; i < delay * 4; i++){
987
ret = ioctl(sd, SIOCGIFFLAGS, &network);
989
perror("ioctl SIOCGIFFLAGS");
990
} else if(network.ifr_flags & IFF_RUNNING){
993
struct timespec sleeptime = { .tv_nsec = 250000000 };
994
nanosleep(&sleeptime, NULL);
996
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1116
#endif /* __linux__ */
1120
/* sleep checking until interface is running */
1121
for(int i=0; i < delay * 4; i++){
1122
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1000
// Restores kernel loglevel to default
1124
perror("ioctl SIOCGIFFLAGS");
1125
} else if(network.ifr_flags & IFF_RUNNING){
1128
struct timespec sleeptime = { .tv_nsec = 250000000 };
1129
ret = nanosleep(&sleeptime, NULL);
1130
if(ret == -1 and errno != EINTR){
1131
perror("nanosleep");
1134
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1139
if(restore_loglevel){
1140
/* Restores kernel loglevel to default */
1001
1141
ret = klogctl(7, NULL, 0);
1003
1143
perror("klogctl");
1020
ret = init_gnutls_global(&mc, pubkey, seckey);
1022
fprintf(stderr, "init_gnutls_global failed\n");
1023
exitcode = EXIT_FAILURE;
1026
gnutls_initalized = true;
1029
if(mkdtemp(tempdir) == NULL){
1035
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
1036
fprintf(stderr, "gpgme_initalized failed\n");
1037
exitcode = EXIT_FAILURE;
1040
gpgme_initalized = true;
1146
#endif /* __linux__ */
1163
ret = init_gnutls_global(pubkey, seckey);
1165
fprintf(stderr, "init_gnutls_global failed\n");
1166
exitcode = EXIT_FAILURE;
1169
gnutls_initialized = true;
1172
if(mkdtemp(tempdir) == NULL){
1176
tempdir_created = true;
1178
if(not init_gpgme(pubkey, seckey, tempdir)){
1179
fprintf(stderr, "init_gpgme failed\n");
1180
exitcode = EXIT_FAILURE;
1183
gpgme_initialized = true;
1186
if(interface[0] != '\0'){
1043
1187
if_index = (AvahiIfIndex) if_nametoindex(interface);
1044
1188
if(if_index == 0){
1045
1189
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1049
if(connect_to != NULL){
1050
/* Connect directly, do not use Zeroconf */
1051
/* (Mainly meant for debugging) */
1052
char *address = strrchr(connect_to, ':');
1053
if(address == NULL){
1054
fprintf(stderr, "No colon in address\n");
1055
exitcode = EXIT_FAILURE;
1059
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1060
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1061
or address[numchars+1] != '\0'){
1062
fprintf(stderr, "Bad port number\n");
1063
exitcode = EXIT_FAILURE;
1066
port = (uint16_t)tmpmax;
1068
address = connect_to;
1069
ret = start_mandos_communication(address, port, if_index, &mc);
1071
exitcode = EXIT_FAILURE;
1073
exitcode = EXIT_SUCCESS;
1079
avahi_set_log_function(empty_log);
1082
/* Initialize the pseudo-RNG for Avahi */
1083
srand((unsigned int) time(NULL));
1085
/* Allocate main Avahi loop object */
1086
mc.simple_poll = avahi_simple_poll_new();
1087
if(mc.simple_poll == NULL) {
1088
fprintf(stderr, "Avahi: Failed to create simple poll"
1090
exitcode = EXIT_FAILURE;
1095
AvahiServerConfig config;
1096
/* Do not publish any local Zeroconf records */
1097
avahi_server_config_init(&config);
1098
config.publish_hinfo = 0;
1099
config.publish_addresses = 0;
1100
config.publish_workstation = 0;
1101
config.publish_domain = 0;
1103
/* Allocate a new server */
1104
mc.server = avahi_server_new(avahi_simple_poll_get
1105
(mc.simple_poll), &config, NULL,
1108
/* Free the Avahi configuration data */
1109
avahi_server_config_free(&config);
1112
/* Check if creating the Avahi server object succeeded */
1113
if(mc.server == NULL) {
1114
fprintf(stderr, "Failed to create Avahi server: %s\n",
1115
avahi_strerror(error));
1116
exitcode = EXIT_FAILURE;
1120
/* Create the Avahi service browser */
1121
sb = avahi_s_service_browser_new(mc.server, if_index,
1123
"_mandos._tcp", NULL, 0,
1124
browse_callback, &mc);
1126
fprintf(stderr, "Failed to create service browser: %s\n",
1127
avahi_strerror(avahi_server_errno(mc.server)));
1128
exitcode = EXIT_FAILURE;
1132
/* Run the main loop */
1135
fprintf(stderr, "Starting Avahi loop search\n");
1138
avahi_simple_poll_loop(mc.simple_poll);
1190
exitcode = EXIT_FAILURE;
1195
if(connect_to != NULL){
1196
/* Connect directly, do not use Zeroconf */
1197
/* (Mainly meant for debugging) */
1198
char *address = strrchr(connect_to, ':');
1199
if(address == NULL){
1200
fprintf(stderr, "No colon in address\n");
1201
exitcode = EXIT_FAILURE;
1206
tmpmax = strtoimax(address+1, &tmp, 10);
1207
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1208
or tmpmax != (uint16_t)tmpmax){
1209
fprintf(stderr, "Bad port number\n");
1210
exitcode = EXIT_FAILURE;
1213
port = (uint16_t)tmpmax;
1215
address = connect_to;
1216
/* Colon in address indicates IPv6 */
1218
if(strchr(address, ':') != NULL){
1223
ret = start_mandos_communication(address, port, if_index, af);
1225
exitcode = EXIT_FAILURE;
1227
exitcode = EXIT_SUCCESS;
1233
AvahiServerConfig config;
1234
/* Do not publish any local Zeroconf records */
1235
avahi_server_config_init(&config);
1236
config.publish_hinfo = 0;
1237
config.publish_addresses = 0;
1238
config.publish_workstation = 0;
1239
config.publish_domain = 0;
1241
/* Allocate a new server */
1242
mc.server = avahi_server_new(avahi_simple_poll_get
1243
(mc.simple_poll), &config, NULL,
1246
/* Free the Avahi configuration data */
1247
avahi_server_config_free(&config);
1250
/* Check if creating the Avahi server object succeeded */
1251
if(mc.server == NULL){
1252
fprintf(stderr, "Failed to create Avahi server: %s\n",
1253
avahi_strerror(error));
1254
exitcode = EXIT_FAILURE;
1258
/* Create the Avahi service browser */
1259
sb = avahi_s_service_browser_new(mc.server, if_index,
1260
AVAHI_PROTO_INET6, "_mandos._tcp",
1261
NULL, 0, browse_callback, NULL);
1263
fprintf(stderr, "Failed to create service browser: %s\n",
1264
avahi_strerror(avahi_server_errno(mc.server)));
1265
exitcode = EXIT_FAILURE;
1269
/* Run the main loop */
1272
fprintf(stderr, "Starting Avahi loop search\n");
1275
avahi_simple_poll_loop(mc.simple_poll);
1143
fprintf(stderr, "%s exiting\n", argv[0]);
1146
/* Cleanup things */
1148
avahi_s_service_browser_free(sb);
1150
if(mc.server != NULL)
1151
avahi_server_free(mc.server);
1153
if(mc.simple_poll != NULL)
1154
avahi_simple_poll_free(mc.simple_poll);
1156
if(gnutls_initalized){
1157
gnutls_certificate_free_credentials(mc.cred);
1158
gnutls_global_deinit();
1159
gnutls_dh_params_deinit(mc.dh_params);
1162
if(gpgme_initalized){
1163
gpgme_release(mc.ctx);
1166
/* Removes the temp directory used by GPGME */
1167
if(tempdir[0] != '\0'){
1169
struct dirent *direntry;
1170
d = opendir(tempdir);
1172
if(errno != ENOENT){
1177
direntry = readdir(d);
1178
if(direntry == NULL){
1181
if(direntry->d_type == DT_REG){
1182
char *fullname = NULL;
1183
ret = asprintf(&fullname, "%s/%s", tempdir,
1189
ret = unlink(fullname);
1191
fprintf(stderr, "unlink(\"%s\"): %s",
1192
fullname, strerror(errno));
1199
ret = rmdir(tempdir);
1200
if(ret == -1 and errno != ENOENT){
1280
fprintf(stderr, "%s exiting\n", argv[0]);
1283
/* Cleanup things */
1285
avahi_s_service_browser_free(sb);
1287
if(mc.server != NULL)
1288
avahi_server_free(mc.server);
1290
if(mc.simple_poll != NULL)
1291
avahi_simple_poll_free(mc.simple_poll);
1293
if(gnutls_initialized){
1294
gnutls_certificate_free_credentials(mc.cred);
1295
gnutls_global_deinit();
1296
gnutls_dh_params_deinit(mc.dh_params);
1299
if(gpgme_initialized){
1300
gpgme_release(mc.ctx);
1303
/* Removes the temp directory used by GPGME */
1304
if(tempdir_created){
1306
struct dirent *direntry;
1307
d = opendir(tempdir);
1309
if(errno != ENOENT){
1314
direntry = readdir(d);
1315
if(direntry == NULL){
1318
/* Skip "." and ".." */
1319
if(direntry->d_name[0] == '.'
1320
and (direntry->d_name[1] == '\0'
1321
or (direntry->d_name[1] == '.'
1322
and direntry->d_name[2] == '\0'))){
1325
char *fullname = NULL;
1326
ret = asprintf(&fullname, "%s/%s", tempdir,
1332
ret = remove(fullname);
1334
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1341
ret = rmdir(tempdir);
1342
if(ret == -1 and errno != ENOENT){