36
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
38
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror(), sscanf(),
39
stdout, ferror(), remove() */
41
40
#include <stdint.h> /* uint16_t, uint32_t */
42
41
#include <stddef.h> /* NULL, size_t, ssize_t */
43
42
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
45
#include <stdbool.h> /* bool, true */
44
#include <stdbool.h> /* bool, false, true */
46
45
#include <string.h> /* memset(), strcmp(), strlen(),
47
46
strerror(), asprintf(), strcpy() */
48
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/ioctl.h> /* ioctl */
49
48
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
50
49
sockaddr_in6, PF_INET6,
51
SOCK_STREAM, INET6_ADDRSTRLEN,
52
uid_t, gid_t, open(), opendir(),
50
SOCK_STREAM, uid_t, gid_t, open(),
54
52
#include <sys/stat.h> /* open() */
55
53
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
56
struct in6_addr, inet_pton(),
54
inet_pton(), connect() */
58
55
#include <fcntl.h> /* open() */
59
56
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */
58
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
62
60
#include <assert.h> /* assert() */
63
61
#include <errno.h> /* perror(), errno */
64
62
#include <time.h> /* nanosleep(), time() */
65
63
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
66
64
SIOCSIFFLAGS, if_indextoname(),
67
65
if_nametoindex(), IF_NAMESIZE */
68
#include <netinet/in.h>
66
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
67
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
69
69
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
70
70
getuid(), getgid(), setuid(),
72
72
#include <arpa/inet.h> /* inet_pton(), htons */
73
#include <iso646.h> /* not, and, or */
73
#include <iso646.h> /* not, or, and */
74
74
#include <argp.h> /* struct argp_option, error_t, struct
75
75
argp_state, struct argp,
76
76
argp_parse(), ARGP_KEY_ARG,
77
77
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
78
#include <signal.h> /* sigemptyset(), sigaddset(),
79
sigaction(), SIGTERM, sigaction,
79
83
#include <sys/klog.h> /* klogctl() */
84
#endif /* __linux__ */
83
87
/* All Avahi types, constants and functions
130
134
} mandos_context;
136
/* global context so signal handler can reach it*/
137
mandos_context mc = { .simple_poll = NULL, .server = NULL,
138
.dh_bits = 1024, .priority = "SECURE256"
139
":!CTYPE-X.509:+CTYPE-OPENPGP" };
133
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
134
* "buffer_capacity" is how much is currently allocated,
142
* Make additional room in "buffer" for at least BUFFER_SIZE more
143
* bytes. "buffer_capacity" is how much is currently allocated,
135
144
* "buffer_length" is how much is already used.
137
size_t adjustbuffer(char **buffer, size_t buffer_length,
146
size_t incbuffer(char **buffer, size_t buffer_length,
138
147
size_t buffer_capacity){
139
148
if(buffer_length + BUFFER_SIZE > buffer_capacity){
140
149
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
278
286
/* Decrypt data from the cryptotext data buffer to the plaintext
280
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
288
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
281
289
if(rc != GPG_ERR_NO_ERROR){
282
290
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
283
291
gpgme_strsource(rc), gpgme_strerror(rc));
284
292
plaintext_length = -1;
286
294
gpgme_decrypt_result_t result;
287
result = gpgme_op_decrypt_result(mc->ctx);
295
result = gpgme_op_decrypt_result(mc.ctx);
288
296
if(result == NULL){
289
297
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
439
446
/* GnuTLS server initialization */
440
ret = gnutls_dh_params_init(&mc->dh_params);
447
ret = gnutls_dh_params_init(&mc.dh_params);
441
448
if(ret != GNUTLS_E_SUCCESS){
442
449
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
443
450
" %s\n", safer_gnutls_strerror(ret));
446
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
453
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
447
454
if(ret != GNUTLS_E_SUCCESS){
448
455
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
449
456
safer_gnutls_strerror(ret));
453
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
460
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
459
gnutls_certificate_free_credentials(mc->cred);
466
gnutls_certificate_free_credentials(mc.cred);
460
467
gnutls_global_deinit();
461
gnutls_dh_params_deinit(mc->dh_params);
468
gnutls_dh_params_deinit(mc.dh_params);
465
static int init_gnutls_session(mandos_context *mc,
466
gnutls_session_t *session){
472
static int init_gnutls_session(gnutls_session_t *session){
468
474
/* GnuTLS session creation */
469
475
ret = gnutls_init(session, GNUTLS_SERVER);
520
529
ssize_t decrypted_buffer_size;
523
char interface[IF_NAMESIZE];
524
532
gnutls_session_t session;
526
ret = init_gnutls_session(mc, &session);
533
int pf; /* Protocol family */
543
fprintf(stderr, "Bad address family: %d\n", af);
547
ret = init_gnutls_session(&session);
532
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
553
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
536
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
557
tcp_sd = socket(pf, SOCK_STREAM, 0);
538
559
perror("socket");
543
if(if_indextoname((unsigned int)if_index, interface) == NULL){
544
perror("if_indextoname");
547
fprintf(stderr, "Binding to interface %s\n", interface);
550
563
memset(&to, 0, sizeof(to));
551
to.in6.sin6_family = AF_INET6;
552
/* It would be nice to have a way to detect if we were passed an
553
IPv4 address here. Now we assume an IPv6 address. */
554
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
565
to.in6.sin6_family = (uint16_t)af;
566
ret = inet_pton(af, ip, &to.in6.sin6_addr);
568
to.in.sin_family = (sa_family_t)af;
569
ret = inet_pton(af, ip, &to.in.sin_addr);
556
572
perror("inet_pton");
560
576
fprintf(stderr, "Bad address: %s\n", ip);
563
to.in6.sin6_port = htons(port); /* Spurious warnings from
580
to.in6.sin6_port = htons(port); /* Spurious warnings from
582
-Wunreachable-code */
584
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
585
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
587
if(if_index == AVAHI_IF_UNSPEC){
588
fprintf(stderr, "An IPv6 link-local address is incomplete"
589
" without a network interface\n");
592
/* Set the network interface number as scope */
593
to.in6.sin6_scope_id = (uint32_t)if_index;
596
to.in.sin_port = htons(port); /* Spurious warnings from
565
598
-Wunreachable-code */
567
to.in6.sin6_scope_id = (uint32_t)if_index;
570
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
572
char addrstr[INET6_ADDRSTRLEN] = "";
573
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
574
sizeof(addrstr)) == NULL){
602
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
603
char interface[IF_NAMESIZE];
604
if(if_indextoname((unsigned int)if_index, interface) == NULL){
605
perror("if_indextoname");
607
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
608
ip, interface, port);
611
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
614
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
615
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
618
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
621
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
575
625
perror("inet_ntop");
577
627
if(strcmp(addrstr, ip) != 0){
801
854
the callback function is called the Avahi server will free the
802
855
resolver for us. */
804
if(!(avahi_s_service_resolver_new(mc->server, interface,
857
if(!(avahi_s_service_resolver_new(mc.server, interface,
805
858
protocol, name, type, domain,
806
859
AVAHI_PROTO_INET6, 0,
807
resolve_callback, mc)))
860
resolve_callback, NULL)))
808
861
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
809
name, avahi_strerror(avahi_server_errno(mc->server)));
862
name, avahi_strerror(avahi_server_errno(mc.server)));
812
865
case AVAHI_BROWSER_REMOVE:
840
908
const char *seckey = PATHDIR "/" SECKEY;
841
909
const char *pubkey = PATHDIR "/" PUBKEY;
843
mandos_context mc = { .simple_poll = NULL, .server = NULL,
844
.dh_bits = 1024, .priority = "SECURE256"
845
":!CTYPE-X.509:+CTYPE-OPENPGP" };
911
/* Initialize Mandos context */
912
mc = (mandos_context){ .simple_poll = NULL, .server = NULL,
913
.dh_bits = 1024, .priority = "SECURE256"
914
":!CTYPE-X.509:+CTYPE-OPENPGP" };
846
915
bool gnutls_initialized = false;
847
916
bool gpgme_initialized = false;
919
struct sigaction old_sigterm_action;
920
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
851
923
struct argp_option options[] = {
1021
avahi_set_log_function(empty_log);
1024
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1025
from the signal handler */
1026
/* Initialize the pseudo-RNG for Avahi */
1027
srand((unsigned int) time(NULL));
1028
mc.simple_poll = avahi_simple_poll_new();
1029
if(mc.simple_poll == NULL){
1030
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1031
exitcode = EXIT_FAILURE;
1035
sigemptyset(&sigterm_action.sa_mask);
1036
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1038
perror("sigaddset");
1039
exitcode = EXIT_FAILURE;
1042
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1044
perror("sigaddset");
1045
exitcode = EXIT_FAILURE;
1048
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1050
perror("sigaddset");
1051
exitcode = EXIT_FAILURE;
1054
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1056
perror("sigaction");
1057
exitcode = EXIT_FAILURE;
946
1061
/* If the interface is down, bring it up */
1062
if(interface[0] != '\0'){
948
1063
#ifdef __linux__
949
1064
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
950
1065
messages to mess up the prompt */
951
1066
ret = klogctl(8, NULL, 5);
1067
bool restore_loglevel = true;
1069
restore_loglevel = false;
953
1070
perror("klogctl");
1072
#endif /* __linux__ */
957
1074
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
959
1076
perror("socket");
960
1077
exitcode = EXIT_FAILURE;
961
1078
#ifdef __linux__
962
ret = klogctl(7, NULL, 0);
1079
if(restore_loglevel){
1080
ret = klogctl(7, NULL, 0);
1085
#endif /* __linux__ */
969
1088
strcpy(network.ifr_name, interface);