/mandos/release : revision 237.2.82

30

*/

31

32

/* Needed by GPGME, specifically gpgme_data_seek() */

33

#ifndef _LARGEFILE_SOURCE

33

34

#define _LARGEFILE_SOURCE

35

#endif

36

#ifndef _FILE_OFFSET_BITS

34

37

#define _FILE_OFFSET_BITS 64

38

#endif

35

39

36

40

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */

37

41

38

42

#include <stdio.h> /* fprintf(), stderr, fwrite(),

39

stdout, ferror(), sscanf(),

40

remove() */

43

stdout, ferror(), remove() */

41

44

#include <stdint.h> /* uint16_t, uint32_t */

42

45

#include <stddef.h> /* NULL, size_t, ssize_t */

43

46

#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,

44

srand() */

45

#include <stdbool.h> /* bool, true */

47

srand(), strtof() */

48

#include <stdbool.h> /* bool, false, true */

46

49

#include <string.h> /* memset(), strcmp(), strlen(),

47

50

strerror(), asprintf(), strcpy() */

48

#include <sys/ioctl.h> /* ioctl */

51

#include <sys/ioctl.h> /* ioctl */

49

52

#include <sys/types.h> /* socket(), inet_pton(), sockaddr,

50

53

sockaddr_in6, PF_INET6,

51

SOCK_STREAM, INET6_ADDRSTRLEN,

52

uid_t, gid_t, open(), opendir(),

53

DIR */

54

SOCK_STREAM, uid_t, gid_t, open(),

55

opendir(), DIR */

54

56

#include <sys/stat.h> /* open() */

55

57

#include <sys/socket.h> /* socket(), struct sockaddr_in6,

56

struct in6_addr, inet_pton(),

57

connect() */

58

inet_pton(), connect() */

58

59

#include <fcntl.h> /* open() */

59

60

#include <dirent.h> /* opendir(), struct dirent, readdir()

60

61

*/

61

#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */

62

#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,

63

strtoimax() */

62

64

#include <assert.h> /* assert() */

63

65

#include <errno.h> /* perror(), errno */

64

66

#include <time.h> /* nanosleep(), time() */

65

67

#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,

66

68

SIOCSIFFLAGS, if_indextoname(),

67

69

if_nametoindex(), IF_NAMESIZE */

68

#include <netinet/in.h>

70

#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,

71

INET_ADDRSTRLEN, INET6_ADDRSTRLEN

72

*/

69

73

#include <unistd.h> /* close(), SEEK_SET, off_t, write(),

70

74

getuid(), getgid(), setuid(),

71

75

setgid() */

72

76

#include <arpa/inet.h> /* inet_pton(), htons */

73

#include <iso646.h> /* not, and, or */

77

#include <iso646.h> /* not, or, and */

74

78

#include <argp.h> /* struct argp_option, error_t, struct

75

79

argp_state, struct argp,

76

80

argp_parse(), ARGP_KEY_ARG,

77

81

ARGP_KEY_END, ARGP_ERR_UNKNOWN */

82

#include <signal.h> /* sigemptyset(), sigaddset(),

83

sigaction(), SIGTERM, sigaction,

84

sig_atomic_t */

85

78

86

#ifdef __linux__

79

87

#include <sys/klog.h> /* klogctl() */

80

#endif

88

#endif /* __linux__ */

81

89

82

90

/* Avahi */

83

91

/* All Avahi types, constants and functions

129

137

gpgme_ctx_t ctx;

130

138

} mandos_context;

131

139

140

/* global context so signal handler can reach it*/

141

mandos_context mc = { .simple_poll = NULL, .server = NULL,

142

.dh_bits = 1024, .priority = "SECURE256"

143

":!CTYPE-X.509:+CTYPE-OPENPGP" };

144

132

145

/*

133

* Make room in "buffer" for at least BUFFER_SIZE additional bytes.

134

* "buffer_capacity" is how much is currently allocated,

146

* Make additional room in "buffer" for at least BUFFER_SIZE more

147

* bytes. "buffer_capacity" is how much is currently allocated,

135

148

* "buffer_length" is how much is already used.

136

149

*/

137

size_t adjustbuffer(char **buffer, size_t buffer_length,

150

size_t incbuffer(char **buffer, size_t buffer_length,

138

151

size_t buffer_capacity){

139

152

if(buffer_length + BUFFER_SIZE > buffer_capacity){

140

153

*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);

149

162

/*

150

163

* Initialize GPGME.

151

164

*/

152

static bool init_gpgme(mandos_context *mc, const char *seckey,

165

static bool init_gpgme(const char *seckey,

153

166

const char *pubkey, const char *tempdir){

154

167

int ret;

155

168

gpgme_error_t rc;

176

189

return false;

177

190

}

178

191

179

rc = gpgme_op_import(mc->ctx, pgp_data);

192

rc = gpgme_op_import(mc.ctx, pgp_data);

180

193

if(rc != GPG_ERR_NO_ERROR){

181

194

fprintf(stderr, "bad gpgme_op_import: %s: %s\n",

182

195

gpgme_strsource(rc), gpgme_strerror(rc));

192

205

}

193

206

194

207

if(debug){

195

fprintf(stderr, "Initialize gpgme\n");

208

fprintf(stderr, "Initializing GPGME\n");

196

209

}

197

210

198

211

/* Init GPGME */

225

238

}

226

239

227

240

/* Create new GPGME "context" */

228

rc = gpgme_new(&(mc->ctx));

241

rc = gpgme_new(&(mc.ctx));

229

242

if(rc != GPG_ERR_NO_ERROR){

230

243

fprintf(stderr, "bad gpgme_new: %s: %s\n",

231

244

gpgme_strsource(rc), gpgme_strerror(rc));

243

256

* Decrypt OpenPGP data.

244

257

* Returns -1 on error

245

258

*/

246

static ssize_t pgp_packet_decrypt(const mandos_context *mc,

247

const char *cryptotext,

259

static ssize_t pgp_packet_decrypt(const char *cryptotext,

248

260

size_t crypto_size,

249

261

char **plaintext){

250

262

gpgme_data_t dh_crypto, dh_plain;

277

289

278

290

/* Decrypt data from the cryptotext data buffer to the plaintext

279

291

data buffer */

280

rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);

292

rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);

281

293

if(rc != GPG_ERR_NO_ERROR){

282

294

fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",

283

295

gpgme_strsource(rc), gpgme_strerror(rc));

284

296

plaintext_length = -1;

285

297

if(debug){

286

298

gpgme_decrypt_result_t result;

287

result = gpgme_op_decrypt_result(mc->ctx);

299

result = gpgme_op_decrypt_result(mc.ctx);

288

300

if(result == NULL){

289

301

fprintf(stderr, "gpgme_op_decrypt_result failed\n");

290

302

} else {

326

338

327

339

*plaintext = NULL;

328

340

while(true){

329

plaintext_capacity = adjustbuffer(plaintext,

341

plaintext_capacity = incbuffer(plaintext,

330

342

(size_t)plaintext_length,

331

343

plaintext_capacity);

332

344

if(plaintext_capacity == 0){

333

perror("adjustbuffer");

345

perror("incbuffer");

334

346

plaintext_length = -1;

335

347

goto decrypt_end;

336

348

}

382

394

fprintf(stderr, "GnuTLS: %s", string);

383

395

}

384

396

385

static int init_gnutls_global(mandos_context *mc,

386

const char *pubkeyfilename,

397

static int init_gnutls_global(const char *pubkeyfilename,

387

398

const char *seckeyfilename){

388

399

int ret;

389

400

407

418

}

408

419

409

420

/* OpenPGP credentials */

410

gnutls_certificate_allocate_credentials(&mc->cred);

421

gnutls_certificate_allocate_credentials(&mc.cred);

411

422

if(ret != GNUTLS_E_SUCCESS){

412

423

fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning

413

* from

414

* -Wunreachable-code

415

*/

424

from

425

-Wunreachable-code

426

*/

416

427

safer_gnutls_strerror(ret));

417

428

gnutls_global_deinit();

418

429

return -1;

425

436

}

426

437

427

438

ret = gnutls_certificate_set_openpgp_key_file

428

(mc->cred, pubkeyfilename, seckeyfilename,

439

(mc.cred, pubkeyfilename, seckeyfilename,

429

440

GNUTLS_OPENPGP_FMT_BASE64);

430

441

if(ret != GNUTLS_E_SUCCESS){

431

442

fprintf(stderr,

437

448

}

438

449

439

450

/* GnuTLS server initialization */

440

ret = gnutls_dh_params_init(&mc->dh_params);

451

ret = gnutls_dh_params_init(&mc.dh_params);

441

452

if(ret != GNUTLS_E_SUCCESS){

442

453

fprintf(stderr, "Error in GnuTLS DH parameter initialization:"

443

454

" %s\n", safer_gnutls_strerror(ret));

444

455

goto globalfail;

445

456

}

446

ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);

457

ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);

447

458

if(ret != GNUTLS_E_SUCCESS){

448

459

fprintf(stderr, "Error in GnuTLS prime generation: %s\n",

449

460

safer_gnutls_strerror(ret));

450

461

goto globalfail;

451

462

}

452

463

453

gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);

464

gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);

454

465

455

466

return 0;

456

467

457

468

globalfail:

458

469

459

gnutls_certificate_free_credentials(mc->cred);

470

gnutls_certificate_free_credentials(mc.cred);

460

471

gnutls_global_deinit();

461

gnutls_dh_params_deinit(mc->dh_params);

472

gnutls_dh_params_deinit(mc.dh_params);

462

473

return -1;

463

474

}

464

475

465

static int init_gnutls_session(mandos_context *mc,

466

gnutls_session_t *session){

476

static int init_gnutls_session(gnutls_session_t *session){

467

477

int ret;

468

478

/* GnuTLS session creation */

469

479

ret = gnutls_init(session, GNUTLS_SERVER);

474

484

475

485

{

476

486

const char *err;

477

ret = gnutls_priority_set_direct(*session, mc->priority, &err);

487

ret = gnutls_priority_set_direct(*session, mc.priority, &err);

478

488

if(ret != GNUTLS_E_SUCCESS){

479

489

fprintf(stderr, "Syntax error at: %s\n", err);

480

490

fprintf(stderr, "GnuTLS error: %s\n",

485

495

}

486

496

487

497

ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,

488

mc->cred);

498

mc.cred);

489

499

if(ret != GNUTLS_E_SUCCESS){

490

500

fprintf(stderr, "Error setting GnuTLS credentials: %s\n",

491

501

safer_gnutls_strerror(ret));

497

507

gnutls_certificate_server_set_request(*session,

498

508

GNUTLS_CERT_IGNORE);

499

509

500

gnutls_dh_set_prime_bits(*session, mc->dh_bits);

510

gnutls_dh_set_prime_bits(*session, mc.dh_bits);

501

511

502

512

return 0;

503

513

}

509

519

/* Called when a Mandos server is found */

510

520

static int start_mandos_communication(const char *ip, uint16_t port,

511

521

AvahiIfIndex if_index,

512

mandos_context *mc){

522

int af){

513

523

int ret, tcp_sd;

514

524

ssize_t sret;

515

union { struct sockaddr in; struct sockaddr_in6 in6; } to;

525

union {

526

struct sockaddr_in in;

527

struct sockaddr_in6 in6;

528

} to;

516

529

char *buffer = NULL;

517

530

char *decrypted_buffer;

518

531

size_t buffer_length = 0;

520

533

ssize_t decrypted_buffer_size;

521

534

size_t written;

522

535

int retval = 0;

523

char interface[IF_NAMESIZE];

524

536

gnutls_session_t session;

525

526

ret = init_gnutls_session(mc, &session);

537

int pf; /* Protocol family */

538

539

switch(af){

540

case AF_INET6:

541

pf = PF_INET6;

542

break;

543

case AF_INET:

544

pf = PF_INET;

545

break;

546

default:

547

fprintf(stderr, "Bad address family: %d\n", af);

548

return -1;

549

}

550

551

ret = init_gnutls_session(&session);

527

552

if(ret != 0){

528

553

return -1;

529

554

}

530

555

531

556

if(debug){

532

fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16

557

fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16

533

558

"\n", ip, port);

534

559

}

535

560

536

tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);

561

tcp_sd = socket(pf, SOCK_STREAM, 0);

537

562

if(tcp_sd < 0){

538

563

perror("socket");

539

564

return -1;

540

565

}

541

566

542

if(debug){

543

if(if_indextoname((unsigned int)if_index, interface) == NULL){

544

perror("if_indextoname");

545

return -1;

546

}

547

fprintf(stderr, "Binding to interface %s\n", interface);

548

}

549

550

567

memset(&to, 0, sizeof(to));

551

to.in6.sin6_family = AF_INET6;

552

/* It would be nice to have a way to detect if we were passed an

553

IPv4 address here. Now we assume an IPv6 address. */

554

ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);

568

if(af == AF_INET6){

569

to.in6.sin6_family = (uint16_t)af;

570

ret = inet_pton(af, ip, &to.in6.sin6_addr);

571

} else { /* IPv4 */

572

to.in.sin_family = (sa_family_t)af;

573

ret = inet_pton(af, ip, &to.in.sin_addr);

574

}

555

575

if(ret < 0 ){

556

576

perror("inet_pton");

557

577

return -1;

560

580

fprintf(stderr, "Bad address: %s\n", ip);

561

581

return -1;

562

582

}

563

to.in6.sin6_port = htons(port); /* Spurious warnings from

583

if(af == AF_INET6){

584

to.in6.sin6_port = htons(port); /* Spurious warnings from

585

-Wconversion and

586

-Wunreachable-code */

587

588

if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */

589

(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and

590

-Wunreachable-code*/

591

if(if_index == AVAHI_IF_UNSPEC){

592

fprintf(stderr, "An IPv6 link-local address is incomplete"

593

" without a network interface\n");

594

return -1;

595

}

596

/* Set the network interface number as scope */

597

to.in6.sin6_scope_id = (uint32_t)if_index;

598

}

599

} else {

600

to.in.sin_port = htons(port); /* Spurious warnings from

564

601

-Wconversion and

565

602

-Wunreachable-code */

566

567

to.in6.sin6_scope_id = (uint32_t)if_index;

603

}

568

604

569

605

if(debug){

570

fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,

571

port);

572

char addrstr[INET6_ADDRSTRLEN] = "";

573

if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,

574

sizeof(addrstr)) == NULL){

606

if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){

607

char interface[IF_NAMESIZE];

608

if(if_indextoname((unsigned int)if_index, interface) == NULL){

609

perror("if_indextoname");

610

} else {

611

fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",

612

ip, interface, port);

613

}

614

} else {

615

fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,

616

port);

617

}

618

char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?

619

INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";

620

const char *pcret;

621

if(af == AF_INET6){

622

pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,

623

sizeof(addrstr));

624

} else {

625

pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,

626

sizeof(addrstr));

627

}

628

if(pcret == NULL){

575

629

perror("inet_ntop");

576

630

} else {

577

631

if(strcmp(addrstr, ip) != 0){

580

634

}

581

635

}

582

636

583

ret = connect(tcp_sd, &to.in, sizeof(to));

637

if(af == AF_INET6){

638

ret = connect(tcp_sd, &to.in6, sizeof(to));

639

} else {

640

ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */

641

}

584

642

if(ret < 0){

585

643

perror("connect");

586

644

return -1;

632

690

/* Read OpenPGP packet that contains the wanted password */

633

691

634

692

if(debug){

635

fprintf(stderr, "Retrieving pgp encrypted password from %s\n",

693

fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",

636

694

ip);

637

695

}

638

696

639

697

while(true){

640

buffer_capacity = adjustbuffer(&buffer, buffer_length,

698

buffer_capacity = incbuffer(&buffer, buffer_length,

641

699

buffer_capacity);

642

700

if(buffer_capacity == 0){

643

perror("adjustbuffer");

701

perror("incbuffer");

644

702

retval = -1;

645

703

goto mandos_end;

646

704

}

685

743

gnutls_bye(session, GNUTLS_SHUT_RDWR);

686

744

687

745

if(buffer_length > 0){

688

decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,

746

decrypted_buffer_size = pgp_packet_decrypt(buffer,

689

747

buffer_length,

690

748

&decrypted_buffer);

691

749

if(decrypted_buffer_size >= 0){

726

784

727

785

static void resolve_callback(AvahiSServiceResolver *r,

728

786

AvahiIfIndex interface,

729

AVAHI_GCC_UNUSED AvahiProtocol protocol,

787

AvahiProtocol proto,

730

788

AvahiResolverEvent event,

731

789

const char *name,

732

790

const char *type,

737

795

AVAHI_GCC_UNUSED AvahiStringList *txt,

738

796

AVAHI_GCC_UNUSED AvahiLookupResultFlags

739

797

flags,

740

void* userdata){

741

mandos_context *mc = userdata;

798

AVAHI_GCC_UNUSED void* userdata){

742

799

assert(r);

743

800

744

801

/* Called whenever a service has been resolved successfully or

749

806

case AVAHI_RESOLVER_FAILURE:

750

807

fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"

751

808

" of type '%s' in domain '%s': %s\n", name, type, domain,

752

avahi_strerror(avahi_server_errno(mc->server)));

809

avahi_strerror(avahi_server_errno(mc.server)));

753

810

break;

754

811

755

812

case AVAHI_RESOLVER_FOUND:

761

818

PRIdMAX ") on port %" PRIu16 "\n", name, host_name,

762

819

ip, (intmax_t)interface, port);

763

820

}

764

int ret = start_mandos_communication(ip, port, interface, mc);

821

int ret = start_mandos_communication(ip, port, interface,

822

avahi_proto_to_af(proto));

765

823

if(ret == 0){

766

avahi_simple_poll_quit(mc->simple_poll);

824

avahi_simple_poll_quit(mc.simple_poll);

767

825

}

768

826

}

769

827

}

779

837

const char *domain,

780

838

AVAHI_GCC_UNUSED AvahiLookupResultFlags

781

839

flags,

782

void* userdata){

783

mandos_context *mc = userdata;

840

AVAHI_GCC_UNUSED void* userdata){

784

841

assert(b);

785

842

786

843

/* Called whenever a new services becomes available on the LAN or

791

848

case AVAHI_BROWSER_FAILURE:

792

849

793

850

fprintf(stderr, "(Avahi browser) %s\n",

794

avahi_strerror(avahi_server_errno(mc->server)));

795

avahi_simple_poll_quit(mc->simple_poll);

851

avahi_strerror(avahi_server_errno(mc.server)));

852

avahi_simple_poll_quit(mc.simple_poll);

796

853

return;

797

854

798

855

case AVAHI_BROWSER_NEW:

801

858

the callback function is called the Avahi server will free the

802

859

resolver for us. */

803

860

804

if(!(avahi_s_service_resolver_new(mc->server, interface,

805

protocol, name, type, domain,

806

AVAHI_PROTO_INET6, 0,

807

resolve_callback, mc)))

861

if(avahi_s_service_resolver_new(mc.server, interface, protocol,

862

name, type, domain, protocol, 0,

863

resolve_callback, NULL) == NULL)

808

864

fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",

809

name, avahi_strerror(avahi_server_errno(mc->server)));

865

name, avahi_strerror(avahi_server_errno(mc.server)));

810

866

break;

811

867

812

868

case AVAHI_BROWSER_REMOVE:

821

877

}

822

878

}

823

879

880

sig_atomic_t quit_now = 0;

881

882

/* stop main loop after sigterm has been called */

883

static void handle_sigterm(__attribute__((unused)) int sig){

884

if(quit_now){

885

return;

886

}

887

quit_now = 1;

888

int old_errno = errno;

889

if(mc.simple_poll != NULL){

890

avahi_simple_poll_quit(mc.simple_poll);

891

}

892

errno = old_errno;

893

}

894

824

895

int main(int argc, char *argv[]){

825

896

AvahiSServiceBrowser *sb = NULL;

826

897

int error;

827

898

int ret;

828

899

intmax_t tmpmax;

829

int numchars;

900

char *tmp;

830

901

int exitcode = EXIT_SUCCESS;

831

902

const char *interface = "eth0";

832

903

struct ifreq network;

840

911

const char *seckey = PATHDIR "/" SECKEY;

841

912

const char *pubkey = PATHDIR "/" PUBKEY;

842

913

843

mandos_context mc = { .simple_poll = NULL, .server = NULL,

844

.dh_bits = 1024, .priority = "SECURE256"

845

":!CTYPE-X.509:+CTYPE-OPENPGP" };

846

914

bool gnutls_initialized = false;

847

915

bool gpgme_initialized = false;

848

double delay = 2.5;

916

float delay = 2.5f;

917

918

struct sigaction old_sigterm_action;

919

struct sigaction sigterm_action = { .sa_handler = handle_sigterm };

849

920

850

921

{

851

922

struct argp_option options[] = {

857

928

.group = 1 },

858

929

{ .name = "interface", .key = 'i',

859

930

.arg = "NAME",

860

.doc = "Interface that will be used to search for Mandos"

861

" servers",

931

.doc = "Network interface that will be used to search for"

932

" Mandos servers",

862

933

.group = 1 },

863

934

{ .name = "seckey", .key = 's',

864

935

.arg = "FILE",

903

974

pubkey = arg;

904

975

break;

905

976

case 129: /* --dh-bits */

906

ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);

907

if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax

908

or arg[numchars] != '\0'){

977

errno = 0;

978

tmpmax = strtoimax(arg, &tmp, 10);

979

if(errno != 0 or tmp == arg or *tmp != '\0'

980

or tmpmax != (typeof(mc.dh_bits))tmpmax){

909

981

fprintf(stderr, "Bad number of DH bits\n");

910

982

exit(EXIT_FAILURE);

911

983

}

915

987

mc.priority = arg;

916

988

break;

917

989

case 131: /* --delay */

918

ret = sscanf(arg, "%lf%n", &delay, &numchars);

919

if(ret < 1 or arg[numchars] != '\0'){

990

errno = 0;

991

delay = strtof(arg, &tmp);

992

if(errno != 0 or tmp == arg or *tmp != '\0'){

920

993

fprintf(stderr, "Bad delay\n");

921

994

exit(EXIT_FAILURE);

922

995

}

943

1016

}

944

1017

}

945

1018

1019

if(not debug){

1020

avahi_set_log_function(empty_log);

1021

}

1022

1023

/* Initialize Avahi early so avahi_simple_poll_quit() can be called

1024

from the signal handler */

1025

/* Initialize the pseudo-RNG for Avahi */

1026

srand((unsigned int) time(NULL));

1027

mc.simple_poll = avahi_simple_poll_new();

1028

if(mc.simple_poll == NULL){

1029

fprintf(stderr, "Avahi: Failed to create simple poll object.\n");

1030

exitcode = EXIT_FAILURE;

1031

goto end;

1032

}

1033

1034

sigemptyset(&sigterm_action.sa_mask);

1035

ret = sigaddset(&sigterm_action.sa_mask, SIGINT);

1036

if(ret == -1){

1037

perror("sigaddset");

1038

exitcode = EXIT_FAILURE;

1039

goto end;

1040

}

1041

ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);

1042

if(ret == -1){

1043

perror("sigaddset");

1044

exitcode = EXIT_FAILURE;

1045

goto end;

1046

}

1047

ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);

1048

if(ret == -1){

1049

perror("sigaddset");

1050

exitcode = EXIT_FAILURE;

1051

goto end;

1052

}

1053

ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);

1054

if(ret == -1){

1055

perror("sigaction");

1056

exitcode = EXIT_FAILURE;

1057

goto end;

1058

}

1059

946

1060

/* If the interface is down, bring it up */

947

{

1061

if(interface[0] != '\0'){

948

1062

#ifdef __linux__

949

1063

/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO

950

1064

messages to mess up the prompt */

951

1065

ret = klogctl(8, NULL, 5);

1066

bool restore_loglevel = true;

952

1067

if(ret == -1){

1068

restore_loglevel = false;

953

1069

perror("klogctl");

954

1070

}

955

#endif

1071

#endif /* __linux__ */

956

1072

957

1073

sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

958

1074

if(sd < 0){

959

1075

perror("socket");

960

1076

exitcode = EXIT_FAILURE;

961

1077

#ifdef __linux__

962

ret = klogctl(7, NULL, 0);

963

if(ret == -1){

964

perror("klogctl");

1078

if(restore_loglevel){

1079

ret = klogctl(7, NULL, 0);

1080

if(ret == -1){

1081

perror("klogctl");

1082

}

965

1083

}

966

#endif

1084

#endif /* __linux__ */

967

1085

goto end;

968

1086

}

969

1087

strcpy(network.ifr_name, interface);

971

1089

if(ret == -1){

972

1090

perror("ioctl SIOCGIFFLAGS");

973

1091

#ifdef __linux__

974

ret = klogctl(7, NULL, 0);

975

if(ret == -1){

976

perror("klogctl");

1092

if(restore_loglevel){

1093

ret = klogctl(7, NULL, 0);

1094

if(ret == -1){

1095

perror("klogctl");

1096

}

977

1097

}

978

#endif

1098

#endif /* __linux__ */

979

1099

exitcode = EXIT_FAILURE;

980

1100

goto end;

981

1101

}

986

1106

perror("ioctl SIOCSIFFLAGS");

987

1107

exitcode = EXIT_FAILURE;

988

1108

#ifdef __linux__

989

ret = klogctl(7, NULL, 0);

990

if(ret == -1){

991

perror("klogctl");

1109

if(restore_loglevel){

1110

ret = klogctl(7, NULL, 0);

1111

if(ret == -1){

1112

perror("klogctl");

1113

}

992

1114

}

993

#endif

1115

#endif /* __linux__ */

994

1116

goto end;

995

1117

}

996

1118

}

1013

1135

perror("close");

1014

1136

}

1015

1137

#ifdef __linux__

1016

/* Restores kernel loglevel to default */

1017

ret = klogctl(7, NULL, 0);

1018

if(ret == -1){

1019

perror("klogctl");

1138

if(restore_loglevel){

1139

/* Restores kernel loglevel to default */

1140

ret = klogctl(7, NULL, 0);

1141

if(ret == -1){

1142

perror("klogctl");

1143

}

1020

1144

}

1021

#endif

1145

#endif /* __linux__ */

1022

1146

}

1023

1147

1024

1148

uid = getuid();

1025

1149

gid = getgid();

1026

1150

1151

errno = 0;

1027

1152

setgid(gid);

1028

1153

if(ret == -1){

1029

1154

perror("setgid");

1034

1159

perror("setuid");

1035

1160

}

1036

1161

1037

ret = init_gnutls_global(&mc, pubkey, seckey);

1162

ret = init_gnutls_global(pubkey, seckey);

1038

1163

if(ret == -1){

1039

1164

fprintf(stderr, "init_gnutls_global failed\n");

1040

1165

exitcode = EXIT_FAILURE;

1049

1174

}

1050

1175

tempdir_created = true;

1051

1176

1052

if(not init_gpgme(&mc, pubkey, seckey, tempdir)){

1177

if(not init_gpgme(pubkey, seckey, tempdir)){

1053

1178

fprintf(stderr, "init_gpgme failed\n");

1054

1179

exitcode = EXIT_FAILURE;

1055

1180

goto end;

1057

1182

gpgme_initialized = true;

1058

1183

}

1059

1184

1060

if_index = (AvahiIfIndex) if_nametoindex(interface);

1061

if(if_index == 0){

1062

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1063

exitcode = EXIT_FAILURE;

1064

goto end;

1185

if(interface[0] != '\0'){

1186

if_index = (AvahiIfIndex) if_nametoindex(interface);

1187

if(if_index == 0){

1188

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1189

exitcode = EXIT_FAILURE;

1190

goto end;

1191

}

1065

1192

}

1066

1193

1067

1194

if(connect_to != NULL){

1074

1201

goto end;

1075

1202

}

1076

1203

uint16_t port;

1077

ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);

1078

if(ret < 1 or tmpmax != (uint16_t)tmpmax

1079

or address[numchars+1] != '\0'){

1204

errno = 0;

1205

tmpmax = strtoimax(address+1, &tmp, 10);

1206

if(errno != 0 or tmp == address+1 or *tmp != '\0'

1207

or tmpmax != (uint16_t)tmpmax){

1080

1208

fprintf(stderr, "Bad port number\n");

1081

1209

exitcode = EXIT_FAILURE;

1082

1210

goto end;

1084

1212

port = (uint16_t)tmpmax;

1085

1213

*address = '\0';

1086

1214

address = connect_to;

1087

ret = start_mandos_communication(address, port, if_index, &mc);

1215

/* Colon in address indicates IPv6 */

1216

int af;

1217

if(strchr(address, ':') != NULL){

1218

af = AF_INET6;

1219

} else {

1220

af = AF_INET;

1221

}

1222

ret = start_mandos_communication(address, port, if_index, af);

1088

1223

if(ret < 0){

1089

1224

exitcode = EXIT_FAILURE;

1090

1225

} else {

1092

1227

}

1093

1228

goto end;

1094

1229

}

1095

1096

if(not debug){

1097

avahi_set_log_function(empty_log);

1098

}

1099

1100

/* Initialize the pseudo-RNG for Avahi */

1101

srand((unsigned int) time(NULL));

1102

1103

/* Allocate main Avahi loop object */

1104

mc.simple_poll = avahi_simple_poll_new();

1105

if(mc.simple_poll == NULL){

1106

fprintf(stderr, "Avahi: Failed to create simple poll object.\n");

1107

exitcode = EXIT_FAILURE;

1108

goto end;

1109

}

1110

1230

1111

1231

{

1112

1232

AvahiServerConfig config;

1113

1233

/* Do not publish any local Zeroconf records */

1136

1256

1137

1257

/* Create the Avahi service browser */

1138

1258

sb = avahi_s_service_browser_new(mc.server, if_index,

1139

AVAHI_PROTO_INET6, "_mandos._tcp",

1140

NULL, 0, browse_callback, &mc);

1259

AVAHI_PROTO_UNSPEC, "_mandos._tcp",

1260

NULL, 0, browse_callback, NULL);

1141

1261

if(sb == NULL){

1142

1262

fprintf(stderr, "Failed to create service browser: %s\n",

1143

1263

avahi_strerror(avahi_server_errno(mc.server)));