62
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
64
#include <assert.h> /* assert() */
65
64
#include <errno.h> /* perror(), errno,
66
65
program_invocation_short_name */
67
66
#include <time.h> /* nanosleep(), time(), sleep() */
163
161
const char *priority;
165
163
server *current_server;
165
size_t interfaces_size;
166
166
} mandos_context;
168
/* global context so signal handler can reach it*/
169
mandos_context mc = { .simple_poll = NULL, .server = NULL,
170
.dh_bits = 1024, .priority = "SECURE256"
171
":!CTYPE-X.509:+CTYPE-OPENPGP",
172
.current_server = NULL };
168
/* global so signal handler can reach it*/
169
AvahiSimplePoll *simple_poll;
174
171
sig_atomic_t quit_now = 0;
175
172
int signal_received = 0;
213
210
/* Add server to set of servers to retry periodically */
214
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
211
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
212
int af, server **current_server){
217
214
server *new_server = malloc(sizeof(server));
218
215
if(new_server == NULL){
230
227
/* Special case of first server */
231
if (mc.current_server == NULL){
228
if(*current_server == NULL){
232
229
new_server->next = new_server;
233
230
new_server->prev = new_server;
234
mc.current_server = new_server;
231
*current_server = new_server;
235
232
/* Place the new server last in the list */
237
new_server->next = mc.current_server;
238
new_server->prev = mc.current_server->prev;
234
new_server->next = *current_server;
235
new_server->prev = (*current_server)->prev;
239
236
new_server->prev->next = new_server;
240
mc.current_server->prev = new_server;
237
(*current_server)->prev = new_server;
242
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
239
ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);
244
241
perror_plus("clock_gettime");
251
248
* Initialize GPGME.
253
250
static bool init_gpgme(const char *seckey, const char *pubkey,
254
const char *tempdir){
251
const char *tempdir, mandos_context *mc){
255
252
gpgme_error_t rc;
256
253
gpgme_engine_info_t engine_info;
260
256
* Helper function to insert pub and seckey to the engine keyring.
280
rc = gpgme_op_import(mc.ctx, pgp_data);
276
rc = gpgme_op_import(mc->ctx, pgp_data);
281
277
if(rc != GPG_ERR_NO_ERROR){
282
278
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
283
279
gpgme_strsource(rc), gpgme_strerror(rc));
329
325
/* Create new GPGME "context" */
330
rc = gpgme_new(&(mc.ctx));
326
rc = gpgme_new(&(mc->ctx));
331
327
if(rc != GPG_ERR_NO_ERROR){
332
328
fprintf_plus(stderr, "Mandos plugin mandos-client: "
333
329
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
381
378
/* Decrypt data from the cryptotext data buffer to the plaintext
383
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
380
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
384
381
if(rc != GPG_ERR_NO_ERROR){
385
382
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
386
383
gpgme_strsource(rc), gpgme_strerror(rc));
387
384
plaintext_length = -1;
389
386
gpgme_decrypt_result_t result;
390
result = gpgme_op_decrypt_result(mc.ctx);
387
result = gpgme_op_decrypt_result(mc->ctx);
391
388
if(result == NULL){
392
389
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
510
507
/* OpenPGP credentials */
511
ret = gnutls_certificate_allocate_credentials(&mc.cred);
508
ret = gnutls_certificate_allocate_credentials(&mc->cred);
512
509
if(ret != GNUTLS_E_SUCCESS){
513
510
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
514
511
safer_gnutls_strerror(ret));
526
523
ret = gnutls_certificate_set_openpgp_key_file
527
(mc.cred, pubkeyfilename, seckeyfilename,
524
(mc->cred, pubkeyfilename, seckeyfilename,
528
525
GNUTLS_OPENPGP_FMT_BASE64);
529
526
if(ret != GNUTLS_E_SUCCESS){
530
527
fprintf_plus(stderr,
538
535
/* GnuTLS server initialization */
539
ret = gnutls_dh_params_init(&mc.dh_params);
536
ret = gnutls_dh_params_init(&mc->dh_params);
540
537
if(ret != GNUTLS_E_SUCCESS){
541
538
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
542
539
" initialization: %s\n",
543
540
safer_gnutls_strerror(ret));
546
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
543
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
547
544
if(ret != GNUTLS_E_SUCCESS){
548
545
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
549
546
safer_gnutls_strerror(ret));
553
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
550
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
559
gnutls_certificate_free_credentials(mc.cred);
556
gnutls_certificate_free_credentials(mc->cred);
560
557
gnutls_global_deinit();
561
gnutls_dh_params_deinit(mc.dh_params);
558
gnutls_dh_params_deinit(mc->dh_params);
565
static int init_gnutls_session(gnutls_session_t *session){
562
static int init_gnutls_session(gnutls_session_t *session,
567
565
/* GnuTLS session creation */
613
611
/* ignore client certificate if any. */
614
612
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
616
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
614
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
623
621
__attribute__((unused)) const char *txt){}
625
623
/* Called when a Mandos server is found */
626
static int start_mandos_communication(const char *ip, uint16_t port,
624
static int start_mandos_communication(const char *ip, in_port_t port,
627
625
AvahiIfIndex if_index,
626
int af, mandos_context *mc){
629
627
int ret, tcp_sd = -1;
664
ret = init_gnutls_session(&session);
662
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
663
/* Check if the interface is one of the interfaces we are using */
666
char *interface = NULL;
667
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
669
if(if_nametoindex(interface) == (unsigned int)if_index){
677
char interface[IF_NAMESIZE];
678
if(if_indextoname((unsigned int)if_index, interface) == NULL){
679
perror_plus("if_indextoname");
681
fprintf_plus(stderr, "Skipping server on non-used interface"
683
if_indextoname((unsigned int)if_index,
691
ret = init_gnutls_session(&session, mc);
670
697
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
671
PRIu16 "\n", ip, port);
698
PRIuMAX "\n", ip, (uintmax_t)port);
674
701
tcp_sd = socket(pf, SOCK_STREAM, 0);
738
762
if(if_indextoname((unsigned int)if_index, interface) == NULL){
739
763
perror_plus("if_indextoname");
741
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
742
"\n", ip, interface, port);
765
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
766
"\n", ip, interface, (uintmax_t)port);
745
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
769
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
770
ip, (uintmax_t)port);
748
772
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
749
773
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
1009
1033
AVAHI_GCC_UNUSED AvahiStringList *txt,
1010
1034
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1012
AVAHI_GCC_UNUSED void* userdata){
1015
1041
/* Called whenever a service has been resolved successfully or
1025
1051
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1026
1052
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1028
avahi_strerror(avahi_server_errno(mc.server)));
1054
avahi_strerror(avahi_server_errno
1055
(((mandos_context*)mc)->server)));
1031
1058
case AVAHI_RESOLVER_FOUND:
1037
1064
PRIdMAX ") on port %" PRIu16 "\n", name,
1038
1065
host_name, ip, (intmax_t)interface, port);
1040
int ret = start_mandos_communication(ip, port, interface,
1041
avahi_proto_to_af(proto));
1067
int ret = start_mandos_communication(ip, (in_port_t)port,
1069
avahi_proto_to_af(proto),
1043
avahi_simple_poll_quit(mc.simple_poll);
1072
avahi_simple_poll_quit(simple_poll);
1045
if(not add_server(ip, port, interface,
1046
avahi_proto_to_af(proto))){
1074
if(not add_server(ip, (in_port_t)port, interface,
1075
avahi_proto_to_af(proto),
1076
&((mandos_context*)mc)->current_server)){
1047
1077
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1048
1078
" list\n", name);
1077
1109
case AVAHI_BROWSER_FAILURE:
1079
1111
fprintf_plus(stderr, "(Avahi browser) %s\n",
1080
avahi_strerror(avahi_server_errno(mc.server)));
1081
avahi_simple_poll_quit(mc.simple_poll);
1112
avahi_strerror(avahi_server_errno
1113
(((mandos_context*)mc)->server)));
1114
avahi_simple_poll_quit(simple_poll);
1084
1117
case AVAHI_BROWSER_NEW:
1087
1120
the callback function is called the Avahi server will free the
1088
1121
resolver for us. */
1090
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1091
name, type, domain, protocol, 0,
1092
resolve_callback, NULL) == NULL)
1123
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1124
interface, protocol, name, type,
1125
domain, protocol, 0,
1126
resolve_callback, mc) == NULL)
1093
1127
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1095
avahi_strerror(avahi_server_errno(mc.server)));
1129
avahi_strerror(avahi_server_errno
1130
(((mandos_context*)mc)->server)));
1098
1133
case AVAHI_BROWSER_REMOVE:
1321
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1356
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1357
mandos_context *mc){
1323
1359
struct timespec now;
1324
1360
struct timespec waited_time;
1325
1361
intmax_t block_time;
1328
if(mc.current_server == NULL){
1364
if(mc->current_server == NULL){
1330
1366
fprintf_plus(stderr, "Wait until first server is found."
1331
1367
" No timeout!\n");
1345
1381
/* Calculating in ms how long time between now and server
1346
1382
who we visted longest time ago. Now - last seen. */
1347
1383
waited_time.tv_sec = (now.tv_sec
1348
- mc.current_server->last_seen.tv_sec);
1384
- mc->current_server->last_seen.tv_sec);
1349
1385
waited_time.tv_nsec = (now.tv_nsec
1350
- mc.current_server->last_seen.tv_nsec);
1386
- mc->current_server->last_seen.tv_nsec);
1351
1387
/* total time is 10s/10,000ms.
1352
1388
Converting to s from ms by dividing by 1,000,
1353
1389
and ns to ms by dividing by 1,000,000. */
1363
1399
if(block_time <= 0){
1364
ret = start_mandos_communication(mc.current_server->ip,
1365
mc.current_server->port,
1366
mc.current_server->if_index,
1367
mc.current_server->af);
1400
ret = start_mandos_communication(mc->current_server->ip,
1401
mc->current_server->port,
1402
mc->current_server->if_index,
1403
mc->current_server->af, mc);
1369
avahi_simple_poll_quit(mc.simple_poll);
1405
avahi_simple_poll_quit(s);
1372
1408
ret = clock_gettime(CLOCK_MONOTONIC,
1373
&mc.current_server->last_seen);
1409
&mc->current_server->last_seen);
1375
1411
perror_plus("clock_gettime");
1378
mc.current_server = mc.current_server->next;
1414
mc->current_server = mc->current_server->next;
1379
1415
block_time = 0; /* Call avahi to find new Mandos
1380
1416
servers, but don't block */
1450
1486
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1452
1488
if(numhooks == -1){
1453
perror_plus("scandir");
1489
if(errno == ENOENT){
1491
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1492
" found\n", hookdir);
1495
perror_plus("scandir");
1455
1498
int devnull = open("/dev/null", O_RDONLY);
1456
1499
for(int i = 0; i < numhooks; i++){
1743
1786
int main(int argc, char *argv[]){
1787
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1788
.priority = "SECURE256:!CTYPE-X.509:"
1789
"+CTYPE-OPENPGP", .current_server = NULL,
1790
.interfaces = NULL, .interfaces_size = 0 };
1744
1791
AvahiSServiceBrowser *sb = NULL;
1745
1792
error_t ret_errno;
1747
1794
intmax_t tmpmax;
1749
1796
int exitcode = EXIT_SUCCESS;
1750
char *interfaces = NULL;
1751
size_t interfaces_size = 0;
1752
1797
char *interfaces_to_take_down = NULL;
1753
1798
size_t interfaces_to_take_down_size = 0;
1754
1799
char tempdir[] = "/tmp/mandosXXXXXX";
1854
1899
connect_to = arg;
1856
1901
case 'i': /* --interface */
1857
ret_errno = argz_add_sep(&interfaces, &interfaces_size, arg,
1902
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
1859
1904
if(ret_errno != 0){
1860
1905
argp_error(state, "%s", strerror(ret_errno));
1990
2035
/* Lower privileges */
1994
perror_plus("seteuid");
1999
/* Remove empty interface names */
2040
/* Remove invalid interface names (except "none") */
2001
2042
char *interface = NULL;
2002
while((interface = argz_next(interfaces, interfaces_size,
2043
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2004
if(if_nametoindex(interface) == 0){
2005
if(interface[0] != '\0' and strcmp(interface, "none") != 0){
2045
if(strcmp(interface, "none") != 0
2046
and if_nametoindex(interface) == 0){
2047
if(interface[0] != '\0'){
2006
2048
fprintf_plus(stderr, "Not using nonexisting interface"
2007
2049
" \"%s\"\n", interface);
2009
argz_delete(&interfaces, &interfaces_size, interface);
2051
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2010
2052
interface = NULL;
2015
2057
/* Run network hooks */
2017
ret_errno = argz_append(&interfaces_hooks, &interfaces_hooks_size,
2018
interfaces, interfaces_size);
2021
perror_plus("argz_append");
2059
if(mc.interfaces != NULL){
2060
interfaces_hooks = malloc(mc.interfaces_size);
2061
if(interfaces_hooks == NULL){
2062
perror_plus("malloc");
2065
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2066
interfaces_hooks_size = mc.interfaces_size;
2067
argz_stringify(interfaces_hooks, interfaces_hooks_size,
2024
argz_stringify(interfaces_hooks, interfaces_hooks_size, (int)',');
2025
if(not run_network_hooks("start", interfaces_hooks, delay)){
2070
if(not run_network_hooks("start", interfaces_hooks != NULL ?
2071
interfaces_hooks : "", delay)){
2035
2081
from the signal handler */
2036
2082
/* Initialize the pseudo-RNG for Avahi */
2037
2083
srand((unsigned int) time(NULL));
2038
mc.simple_poll = avahi_simple_poll_new();
2039
if(mc.simple_poll == NULL){
2084
simple_poll = avahi_simple_poll_new();
2085
if(simple_poll == NULL){
2040
2086
fprintf_plus(stderr,
2041
2087
"Avahi: Failed to create simple poll object.\n");
2042
2088
exitcode = EX_UNAVAILABLE;
2109
2155
/* If no interfaces were specified, make a list */
2110
if(interfaces == NULL){
2156
if(mc.interfaces == NULL){
2111
2157
struct dirent **direntries;
2112
2158
/* Look for any good interfaces */
2113
2159
ret = scandir(sys_class_net, &direntries, good_interface,
2116
2162
/* Add all found interfaces to interfaces list */
2117
2163
for(int i = 0; i < ret; ++i){
2118
ret_errno = argz_add(&interfaces, &interfaces_size,
2164
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2119
2165
direntries[i]->d_name);
2120
2166
if(ret_errno != 0){
2121
2167
perror_plus("argz_add");
2138
/* If we only got one interface, explicitly use only that one */
2139
if(argz_count(interfaces, interfaces_size) == 1){
2141
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2144
if_index = (AvahiIfIndex)if_nametoindex(interfaces);
2147
2184
/* Bring up interfaces which are down */
2148
if(not (argz_count(interfaces, interfaces_size) == 1
2149
and strcmp(interfaces, "none") == 0)){
2150
2186
char *interface = NULL;
2151
while((interface = argz_next(interfaces, interfaces_size,
2187
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2189
/* If interface name is "none", stop bringing up interfaces.
2190
Also remove all instances of "none" from the list */
2191
if(strcmp(interface, "none") == 0){
2192
argz_delete(&mc.interfaces, &mc.interfaces_size,
2195
while((interface = argz_next(mc.interfaces,
2196
mc.interfaces_size, interface))){
2197
if(strcmp(interface, "none") == 0){
2198
argz_delete(&mc.interfaces, &mc.interfaces_size,
2153
2205
bool interface_was_up = interface_is_up(interface);
2154
2206
ret = bring_up_interface(interface, delay);
2155
2207
if(not interface_was_up){
2168
interfaces_size = 0;
2169
2218
if(debug and (interfaces_to_take_down == NULL)){
2170
2219
fprintf_plus(stderr, "No interfaces were brought up\n");
2223
/* If we only got one interface, explicitly use only that one */
2224
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2226
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2229
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2178
ret = init_gnutls_global(pubkey, seckey);
2236
ret = init_gnutls_global(pubkey, seckey, &mc);
2180
2238
fprintf_plus(stderr, "init_gnutls_global failed\n");
2181
2239
exitcode = EX_UNAVAILABLE;
2201
if(not init_gpgme(pubkey, seckey, tempdir)){
2259
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2202
2260
fprintf_plus(stderr, "init_gpgme failed\n");
2203
2261
exitcode = EX_UNAVAILABLE;
2230
2288
tmpmax = strtoimax(address+1, &tmp, 10);
2231
2289
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2232
or tmpmax != (uint16_t)tmpmax){
2290
or tmpmax != (in_port_t)tmpmax){
2233
2291
fprintf_plus(stderr, "Bad port number\n");
2234
2292
exitcode = EX_USAGE;
2242
port = (uint16_t)tmpmax;
2300
port = (in_port_t)tmpmax;
2243
2301
*address = '\0';
2244
2302
/* Colon in address indicates IPv6 */
2263
2321
while(not quit_now){
2264
ret = start_mandos_communication(address, port, if_index, af);
2322
ret = start_mandos_communication(address, port, if_index, af,
2265
2324
if(quit_now or ret == 0){
2293
2352
config.publish_domain = 0;
2295
2354
/* Allocate a new server */
2296
mc.server = avahi_server_new(avahi_simple_poll_get
2297
(mc.simple_poll), &config, NULL,
2355
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2356
&config, NULL, NULL, &ret_errno);
2300
2358
/* Free the Avahi configuration data */
2301
2359
avahi_server_config_free(&config);
2316
2374
/* Create the Avahi service browser */
2317
2375
sb = avahi_s_service_browser_new(mc.server, if_index,
2318
2376
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2319
NULL, 0, browse_callback, NULL);
2377
NULL, 0, browse_callback,
2320
2379
if(sb == NULL){
2321
2380
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2322
2381
avahi_strerror(avahi_server_errno(mc.server)));
2334
2393
fprintf_plus(stderr, "Starting Avahi loop search\n");
2337
ret = avahi_loop_with_timeout(mc.simple_poll,
2338
(int)(retry_interval * 1000));
2396
ret = avahi_loop_with_timeout(simple_poll,
2397
(int)(retry_interval * 1000), &mc);
2340
2399
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2341
2400
(ret == 0) ? "successfully" : "with error");
2350
2409
/* Cleanup things */
2410
free(mc.interfaces);
2352
2413
avahi_s_service_browser_free(sb);
2354
2415
if(mc.server != NULL)
2355
2416
avahi_server_free(mc.server);
2357
if(mc.simple_poll != NULL)
2358
avahi_simple_poll_free(mc.simple_poll);
2418
if(simple_poll != NULL)
2419
avahi_simple_poll_free(simple_poll);
2360
2421
if(gnutls_initialized){
2361
2422
gnutls_certificate_free_credentials(mc.cred);
2383
2444
raise_privileges();
2385
2446
/* Run network hooks */
2386
run_network_hooks("stop", interfaces_hooks, delay);
2447
run_network_hooks("stop", interfaces_hooks != NULL ?
2448
interfaces_hooks : "", delay);
2388
2450
/* Take down the network interfaces which were brought up */