(root)/mandos/release
» Revision
237.7.785
(compared to revision 237.7.437)
: plugins.d/mandos-client.c
To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 237.7.785
- compare with another revision
- download diff
- download tarball
- view history from revision 237.7.785
- Committer: Teddy Hogeborn
- Date: 2021-02-03 23:10:42 UTC
- mto: This revision was merged to the branch mainline in revision 406.
- Revision ID: teddy@recompile.se-20210203231042-2z3egrvpo1zt7nej
mandos-ctl: Fix bad test for command.Remove and related minor issues
The test for command.Remove removes all clients from the spy server,
and then loops over all clients, looking for the corresponding Remove
command as recorded by the spy server. But since since there aren't
any clients left after they were removed, no assertions are made, and
the test therefore does nothing. Fix this.
In tests for command.Approve and command.Deny, add checks that clients
were not somehow removed by the command (in which case, likewise, no
assertions are made).
Add related checks to TestPropertySetterCmd.runTest; i.e. test that a
sequence is not empty before looping over it and making assertions.
* mandos-ctl (TestBaseCommands.test_Remove): Save a copy of the
original "clients" dict, and loop over those instead. Add assertion
that all clients were indeed removed. Also fix the code which looks
for the Remove command, which now needs to actually work.
(TestBaseCommands.test_Approve, TestBaseCommands.test_Deny): Add
assertion that there are still clients before looping over them.
(TestPropertySetterCmd.runTest): Add assertion that the list of
values to get is not empty before looping over them. Also add check
that there are still clients before looping over clients.
The test for command.Remove removes all clients from the spy server,
and then loops over all clients, looking for the corresponding Remove
command as recorded by the spy server. But since since there aren't
any clients left after they were removed, no assertions are made, and
the test therefore does nothing. Fix this.
In tests for command.Approve and command.Deny, add checks that clients
were not somehow removed by the command (in which case, likewise, no
assertions are made).
Add related checks to TestPropertySetterCmd.runTest; i.e. test that a
sequence is not empty before looping over it and making assertions.
* mandos-ctl (TestBaseCommands.test_Remove): Save a copy of the
original "clients" dict, and loop over those instead. Add assertion
that all clients were indeed removed. Also fix the code which looks
for the Remove command, which now needs to actually work.
(TestBaseCommands.test_Approve, TestBaseCommands.test_Deny): Add
assertion that there are still clients before looping over them.
(TestPropertySetterCmd.runTest): Add assertion that the list of
values to get is not empty before looping over them. Also add check
that there are still clients before looping over clients.
- files added:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2016 Teddy Hogeborn
13
* Copyright © 2008-2016 Björn Påhlsson
14
*
15
* This program is free software: you can redistribute it and/or
16
* modify it under the terms of the GNU General Public License as
17
* published by the Free Software Foundation, either version 3 of the
18
* License, or (at your option) any later version.
19
*
20
* This program is distributed in the hope that it will be useful, but
12
* Copyright © 2008-2021 Teddy Hogeborn
13
* Copyright © 2008-2021 Björn Påhlsson
14
*
15
* This file is part of Mandos.
16
*
17
* Mandos is free software: you can redistribute it and/or modify it
18
* under the terms of the GNU General Public License as published by
19
* the Free Software Foundation, either version 3 of the License, or
20
* (at your option) any later version.
21
*
22
* Mandos is distributed in the hope that it will be useful, but
21
23
* WITHOUT ANY WARRANTY; without even the implied warranty of
22
24
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
23
25
* General Public License for more details.
24
26
*
25
27
* You should have received a copy of the GNU General Public License
26
* along with this program. If not, see
27
* <http://www.gnu.org/licenses/>.
28
* along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
29
*
29
30
* Contact the authors at <mandos@recompile.se>.
30
31
*/
37
38
#define _FILE_OFFSET_BITS 64
38
39
#endif /* not _FILE_OFFSET_BITS */
39
40
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror() */
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
strtof(), abort() */
41
#define _GNU_SOURCE /* program_invocation_short_name,
42
TEMP_FAILURE_RETRY(), O_CLOEXEC,
43
scandirat(), asprintf() */
48
44
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* strcmp(), strlen(), strerror(),
50
asprintf(), strncpy(), strsignal()
51
*/
52
#include <sys/ioctl.h> /* ioctl */
53
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
54
sockaddr_in6, PF_INET6,
55
SOCK_STREAM, uid_t, gid_t, open(),
56
opendir(), DIR */
57
#include <sys/stat.h> /* open(), S_ISREG */
58
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
59
inet_pton(), connect(),
60
getnameinfo() */
61
#include <fcntl.h> /* open(), unlinkat(), AT_REMOVEDIR */
62
#include <dirent.h> /* opendir(), struct dirent, readdir()
63
*/
64
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
65
strtoimax() */
66
#include <errno.h> /* perror(), errno, EINTR, EINVAL,
67
EAI_SYSTEM, ENETUNREACH,
45
#include <argp.h> /* argp_program_version,
46
argp_program_bug_address,
47
struct argp_option,
48
struct argp_state, argp_error(),
49
argp_state_help,
50
ARGP_HELP_STD_HELP,
51
ARGP_HELP_EXIT_ERR,
52
ARGP_HELP_EXIT_OK, ARGP_HELP_USAGE,
53
argp_err_exit_status,
54
ARGP_ERR_UNKNOWN, struct argp,
55
argp_parse(), ARGP_IN_ORDER,
56
ARGP_NO_HELP */
57
#include <stddef.h> /* NULL, size_t */
58
#include <sys/types.h> /* uid_t, gid_t, sig_atomic_t,
59
seteuid(), setuid(), pid_t,
60
setgid(), getuid(), getgid() */
61
#include <unistd.h> /* uid_t, gid_t, TEMP_FAILURE_RETRY(),
62
seteuid(), setuid(), close(),
63
ssize_t, read(), fork(), setgid(),
64
_exit(), dup2(), STDIN_FILENO,
65
STDERR_FILENO, STDOUT_FILENO,
66
fexecve(), write(), getuid(),
67
getgid(), fchown(), symlink(),
68
sleep(), unlinkat(), pause() */
69
#include <netinet/in.h> /* in_port_t, struct sockaddr_in6,
70
sa_family_t, struct sockaddr_in,
71
htons(), IN6_IS_ADDR_LINKLOCAL,
72
INET_ADDRSTRLEN, INET6_ADDRSTRLEN,
73
ntohl(), IPPROTO_IP */
74
#include <time.h> /* struct timespec, clock_gettime(),
75
CLOCK_MONOTONIC, time_t, struct tm,
76
gmtime_r(), clock_settime(),
77
CLOCK_REALTIME, nanosleep() */
78
#include <errno.h> /* errno,
79
program_invocation_short_name,
80
EINTR, EINVAL, ENETUNREACH,
68
81
EHOSTUNREACH, ECONNREFUSED, EPROTO,
69
EIO, ENOENT, ENXIO, ENOMEM, EISDIR,
70
ENOTEMPTY,
71
program_invocation_short_name */
72
#include <time.h> /* nanosleep(), time(), sleep() */
73
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
74
SIOCSIFFLAGS, if_indextoname(),
75
if_nametoindex(), IF_NAMESIZE */
76
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
77
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
78
*/
79
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
80
getuid(), getgid(), seteuid(),
81
setgid(), pause(), _exit(),
82
unlinkat() */
83
#include <arpa/inet.h> /* inet_pton(), htons() */
84
#include <iso646.h> /* not, or, and */
85
#include <argp.h> /* struct argp_option, error_t, struct
86
argp_state, struct argp,
87
argp_parse(), ARGP_KEY_ARG,
88
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
89
#include <signal.h> /* sigemptyset(), sigaddset(),
90
sigaction(), SIGTERM, sig_atomic_t,
91
raise() */
92
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
93
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
82
EIO, ENOENT, ENXIO, error_t,
83
ENOMEM, EISDIR, ENOTEMPTY */
84
#include <stdio.h> /* fprintf(), stderr, perror(), FILE,
85
vfprintf(), off_t, SEEK_SET,
86
stdout, fwrite(), ferror(),
87
fflush(), asprintf() */
88
#include <stdarg.h> /* va_list, va_start(), vfprintf() */
89
#include <stdlib.h> /* realloc(), free(), malloc(),
90
getenv(), EXIT_FAILURE, setenv(),
91
EXIT_SUCCESS, strtof(), strtod(),
92
srand(), mkdtemp(), abort() */
93
#include <string.h> /* strdup(), strcmp(), strlen(),
94
strerror(), strncpy(), strspn(),
95
memcpy(), strrchr(), strchr(),
96
strsignal() */
97
#include <fcntl.h> /* open(), O_RDONLY, O_DIRECTORY,
98
O_PATH, O_CLOEXEC, openat(),
99
O_NOFOLLOW, AT_REMOVEDIR */
100
#include <iso646.h> /* or, and, not */
101
#include <sys/stat.h> /* struct stat, fstat(), fstatat(),
102
S_ISREG(), S_IXUSR, S_IXGRP,
103
S_IXOTH, lstat() */
104
#include <net/if.h> /* IF_NAMESIZE, if_indextoname(),
105
if_nametoindex(), SIOCGIFFLAGS,
106
IFF_LOOPBACK, IFF_POINTOPOINT,
107
IFF_BROADCAST, IFF_NOARP, IFF_UP,
108
IFF_RUNNING, SIOCSIFFLAGS */
109
#include <sysexits.h> /* EX_NOPERM, EX_OSERR,
110
EX_UNAVAILABLE, EX_USAGE */
111
#include <grp.h> /* setgroups() */
94
112
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
95
WEXITSTATUS(), WTERMSIG() */
96
#include <grp.h> /* setgroups() */
97
#include <argz.h> /* argz_add_sep(), argz_next(),
98
argz_delete(), argz_append(),
99
argz_stringify(), argz_add(),
100
argz_count() */
113
WEXITSTATUS(), WIFSIGNALED(),
114
WTERMSIG() */
115
#include <signal.h> /* kill(), SIGTERM, struct sigaction,
116
SIG_DFL, sigemptyset(),
117
sigaddset(), SIGINT, SIGHUP,
118
SIG_IGN, raise() */
119
#include <sys/socket.h> /* struct sockaddr_storage, AF_INET6,
120
PF_INET6, AF_INET, PF_INET,
121
socket(), SOCK_STREAM,
122
SOCK_CLOEXEC, struct sockaddr,
123
connect(), SOCK_DGRAM */
124
#include <argz.h> /* argz_next(), argz_add_sep(),
125
argz_delete(), argz_stringify(),
126
argz_add(), argz_count() */
127
#include <inttypes.h> /* PRIuMAX, uintmax_t, uint32_t,
128
PRIdMAX, PRIu16, intmax_t,
129
strtoimax() */
130
#include <arpa/inet.h> /* inet_pton() */
131
#include <stdint.h> /* uint32_t, intptr_t, uint16_t */
101
132
#include <netdb.h> /* getnameinfo(), NI_NUMERICHOST,
102
133
EAI_SYSTEM, gai_strerror() */
134
#include <sys/ioctl.h> /* ioctl() */
135
#include <dirent.h> /* struct dirent, scandirat(),
136
alphasort(), scandir() */
137
#include <limits.h> /* INT_MAX */
103
138
104
139
#ifdef __linux__
105
140
#include <sys/klog.h> /* klogctl() */
118
153
119
154
/* GnuTLS */
120
155
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
121
functions:
122
gnutls_*
123
init_gnutls_session(),
124
GNUTLS_* */
156
functions: gnutls_*, GNUTLS_* */
157
#if GNUTLS_VERSION_NUMBER < 0x030600
125
158
#include <gnutls/openpgp.h>
126
159
/* gnutls_certificate_set_openpgp_key_file(),
127
160
GNUTLS_OPENPGP_FMT_BASE64 */
161
#elif GNUTLS_VERSION_NUMBER >= 0x030606
162
#include <gnutls/x509.h> /* GNUTLS_PKCS_PLAIN,
163
GNUTLS_PKCS_NULL_PASSWORD */
164
#endif
128
165
129
166
/* GPGME */
130
167
#include <gpgme.h> /* All GPGME types, constants and
131
168
functions:
132
gpgme_*
133
GPGME_PROTOCOL_OpenPGP,
134
GPG_ERR_NO_* */
169
gpgme_*, GPG_ERR_NO_*,
170
GPGME_IMPORT_*
171
GPGME_PROTOCOL_OpenPGP */
135
172
136
173
#define BUFFER_SIZE 256
137
174
138
175
#define PATHDIR "/conf/conf.d/mandos"
139
176
#define SECKEY "seckey.txt"
140
177
#define PUBKEY "pubkey.txt"
178
#define TLS_PRIVKEY "tls-privkey.pem"
179
#define TLS_PUBKEY "tls-pubkey.pem"
141
180
#define HOOKDIR "/lib/mandos/network-hooks.d"
142
181
143
182
bool debug = false;
271
310
return true;
272
311
}
273
312
313
/* Set effective uid to 0, return errno */
314
__attribute__((warn_unused_result))
315
int raise_privileges(void){
316
int old_errno = errno;
317
int ret = 0;
318
if(seteuid(0) == -1){
319
ret = errno;
320
}
321
errno = old_errno;
322
return ret;
323
}
324
325
/* Set effective and real user ID to 0. Return errno. */
326
__attribute__((warn_unused_result))
327
int raise_privileges_permanently(void){
328
int old_errno = errno;
329
int ret = raise_privileges();
330
if(ret != 0){
331
errno = old_errno;
332
return ret;
333
}
334
if(setuid(0) == -1){
335
ret = errno;
336
}
337
errno = old_errno;
338
return ret;
339
}
340
341
/* Set effective user ID to unprivileged saved user ID */
342
__attribute__((warn_unused_result))
343
int lower_privileges(void){
344
int old_errno = errno;
345
int ret = 0;
346
if(seteuid(uid) == -1){
347
ret = errno;
348
}
349
errno = old_errno;
350
return ret;
351
}
352
353
/* Lower privileges permanently */
354
__attribute__((warn_unused_result))
355
int lower_privileges_permanently(void){
356
int old_errno = errno;
357
int ret = 0;
358
if(setuid(uid) == -1){
359
ret = errno;
360
}
361
errno = old_errno;
362
return ret;
363
}
364
274
365
/*
275
366
* Initialize GPGME.
276
367
*/
296
387
return false;
297
388
}
298
389
390
/* Workaround for systems without a real-time clock; see also
391
Debian bug #894495: <https://bugs.debian.org/894495> */
392
do {
393
{
394
time_t currtime = time(NULL);
395
if(currtime != (time_t)-1){
396
struct tm tm;
397
if(gmtime_r(&currtime, &tm) == NULL) {
398
perror_plus("gmtime_r");
399
break;
400
}
401
if(tm.tm_year != 70 or tm.tm_mon != 0){
402
break;
403
}
404
if(debug){
405
fprintf_plus(stderr, "System clock is January 1970");
406
}
407
} else {
408
if(debug){
409
fprintf_plus(stderr, "System clock is invalid");
410
}
411
}
412
}
413
struct stat keystat;
414
ret = fstat(fd, &keystat);
415
if(ret != 0){
416
perror_plus("fstat");
417
break;
418
}
419
ret = raise_privileges();
420
if(ret != 0){
421
errno = ret;
422
perror_plus("Failed to raise privileges");
423
break;
424
}
425
if(debug){
426
fprintf_plus(stderr,
427
"Setting system clock to key file mtime");
428
}
429
if(clock_settime(CLOCK_REALTIME, &keystat.st_mtim) != 0){
430
perror_plus("clock_settime");
431
}
432
ret = lower_privileges();
433
if(ret != 0){
434
errno = ret;
435
perror_plus("Failed to lower privileges");
436
}
437
} while(false);
438
299
439
rc = gpgme_data_new_from_fd(&pgp_data, fd);
300
440
if(rc != GPG_ERR_NO_ERROR){
301
441
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
309
449
gpgme_strsource(rc), gpgme_strerror(rc));
310
450
return false;
311
451
}
452
{
453
gpgme_import_result_t import_result
454
= gpgme_op_import_result(mc->ctx);
455
if((import_result->imported < 1
456
or import_result->not_imported > 0)
457
and import_result->unchanged == 0){
458
fprintf_plus(stderr, "bad gpgme_op_import_results:\n");
459
fprintf_plus(stderr,
460
"The total number of considered keys: %d\n",
461
import_result->considered);
462
fprintf_plus(stderr,
463
"The number of keys without user ID: %d\n",
464
import_result->no_user_id);
465
fprintf_plus(stderr,
466
"The total number of imported keys: %d\n",
467
import_result->imported);
468
fprintf_plus(stderr, "The number of imported RSA keys: %d\n",
469
import_result->imported_rsa);
470
fprintf_plus(stderr, "The number of unchanged keys: %d\n",
471
import_result->unchanged);
472
fprintf_plus(stderr, "The number of new user IDs: %d\n",
473
import_result->new_user_ids);
474
fprintf_plus(stderr, "The number of new sub keys: %d\n",
475
import_result->new_sub_keys);
476
fprintf_plus(stderr, "The number of new signatures: %d\n",
477
import_result->new_signatures);
478
fprintf_plus(stderr, "The number of new revocations: %d\n",
479
import_result->new_revocations);
480
fprintf_plus(stderr,
481
"The total number of secret keys read: %d\n",
482
import_result->secret_read);
483
fprintf_plus(stderr,
484
"The number of imported secret keys: %d\n",
485
import_result->secret_imported);
486
fprintf_plus(stderr,
487
"The number of unchanged secret keys: %d\n",
488
import_result->secret_unchanged);
489
fprintf_plus(stderr, "The number of keys not imported: %d\n",
490
import_result->not_imported);
491
for(gpgme_import_status_t import_status
492
= import_result->imports;
493
import_status != NULL;
494
import_status = import_status->next){
495
fprintf_plus(stderr, "Import status for key: %s\n",
496
import_status->fpr);
497
if(import_status->result != GPG_ERR_NO_ERROR){
498
fprintf_plus(stderr, "Import result: %s: %s\n",
499
gpgme_strsource(import_status->result),
500
gpgme_strerror(import_status->result));
501
}
502
fprintf_plus(stderr, "Key status:\n");
503
fprintf_plus(stderr,
504
import_status->status & GPGME_IMPORT_NEW
505
? "The key was new.\n"
506
: "The key was not new.\n");
507
fprintf_plus(stderr,
508
import_status->status & GPGME_IMPORT_UID
509
? "The key contained new user IDs.\n"
510
: "The key did not contain new user IDs.\n");
511
fprintf_plus(stderr,
512
import_status->status & GPGME_IMPORT_SIG
513
? "The key contained new signatures.\n"
514
: "The key did not contain new signatures.\n");
515
fprintf_plus(stderr,
516
import_status->status & GPGME_IMPORT_SUBKEY
517
? "The key contained new sub keys.\n"
518
: "The key did not contain new sub keys.\n");
519
fprintf_plus(stderr,
520
import_status->status & GPGME_IMPORT_SECRET
521
? "The key contained a secret key.\n"
522
: "The key did not contain a secret key.\n");
523
}
524
return false;
525
}
526
}
312
527
313
528
ret = close(fd);
314
529
if(ret == -1){
355
570
/* Create new GPGME "context" */
356
571
rc = gpgme_new(&(mc->ctx));
357
572
if(rc != GPG_ERR_NO_ERROR){
358
fprintf_plus(stderr, "Mandos plugin mandos-client: "
359
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
360
gpgme_strerror(rc));
573
fprintf_plus(stderr, "bad gpgme_new: %s: %s\n",
574
gpgme_strsource(rc), gpgme_strerror(rc));
361
575
return false;
362
576
}
363
577
399
613
/* Create new empty GPGME data buffer for the plaintext */
400
614
rc = gpgme_data_new(&dh_plain);
401
615
if(rc != GPG_ERR_NO_ERROR){
402
fprintf_plus(stderr, "Mandos plugin mandos-client: "
403
"bad gpgme_data_new: %s: %s\n",
616
fprintf_plus(stderr, "bad gpgme_data_new: %s: %s\n",
404
617
gpgme_strsource(rc), gpgme_strerror(rc));
405
618
gpgme_data_release(dh_crypto);
406
619
return -1;
419
632
if(result == NULL){
420
633
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
421
634
} else {
422
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
423
result->unsupported_algorithm);
424
fprintf_plus(stderr, "Wrong key usage: %u\n",
425
result->wrong_key_usage);
635
if(result->unsupported_algorithm != NULL) {
636
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
637
result->unsupported_algorithm);
638
}
639
fprintf_plus(stderr, "Wrong key usage: %s\n",
640
result->wrong_key_usage ? "Yes" : "No");
426
641
if(result->file_name != NULL){
427
642
fprintf_plus(stderr, "File name: %s\n", result->file_name);
428
643
}
429
gpgme_recipient_t recipient;
430
recipient = result->recipients;
431
while(recipient != NULL){
644
645
for(gpgme_recipient_t r = result->recipients; r != NULL;
646
r = r->next){
432
647
fprintf_plus(stderr, "Public key algorithm: %s\n",
433
gpgme_pubkey_algo_name
434
(recipient->pubkey_algo));
435
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
648
gpgme_pubkey_algo_name(r->pubkey_algo));
649
fprintf_plus(stderr, "Key ID: %s\n", r->keyid);
436
650
fprintf_plus(stderr, "Secret key available: %s\n",
437
recipient->status == GPG_ERR_NO_SECKEY
438
? "No" : "Yes");
439
recipient = recipient->next;
651
r->status == GPG_ERR_NO_SECKEY ? "No" : "Yes");
440
652
}
441
653
}
442
654
}
524
736
const char *dhparamsfilename,
525
737
mandos_context *mc){
526
738
int ret;
527
unsigned int uret;
528
739
529
740
if(debug){
530
741
fprintf_plus(stderr, "Initializing GnuTLS\n");
547
758
}
548
759
549
760
if(debug){
550
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
551
" secret key %s as GnuTLS credentials\n",
761
fprintf_plus(stderr, "Attempting to use public key %s and"
762
" private key %s as GnuTLS credentials\n",
552
763
pubkeyfilename,
553
764
seckeyfilename);
554
765
}
555
766
767
#if GNUTLS_VERSION_NUMBER >= 0x030606
768
ret = gnutls_certificate_set_rawpk_key_file
769
(mc->cred, pubkeyfilename, seckeyfilename,
770
GNUTLS_X509_FMT_PEM, /* format */
771
NULL, /* pass */
772
/* key_usage */
773
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
774
NULL, /* names */
775
0, /* names_length */
776
/* privkey_flags */
777
GNUTLS_PKCS_PLAIN | GNUTLS_PKCS_NULL_PASSWORD,
778
0); /* pkcs11_flags */
779
#elif GNUTLS_VERSION_NUMBER < 0x030600
556
780
ret = gnutls_certificate_set_openpgp_key_file
557
781
(mc->cred, pubkeyfilename, seckeyfilename,
558
782
GNUTLS_OPENPGP_FMT_BASE64);
783
#else
784
#error "Needs GnuTLS 3.6.6 or later, or before 3.6.0"
785
#endif
559
786
if(ret != GNUTLS_E_SUCCESS){
560
787
fprintf_plus(stderr,
561
"Error[%d] while reading the OpenPGP key pair ('%s',"
788
"Error[%d] while reading the key pair ('%s',"
562
789
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
563
790
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
564
791
safer_gnutls_strerror(ret));
612
839
}
613
840
params.size += (unsigned int)bytes_read;
614
841
}
842
ret = close(dhpfile);
843
if(ret == -1){
844
perror_plus("close");
845
}
615
846
if(params.data == NULL){
616
847
dhparamsfilename = NULL;
617
848
}
631
862
}
632
863
if(dhparamsfilename == NULL){
633
864
if(mc->dh_bits == 0){
865
#if GNUTLS_VERSION_NUMBER < 0x030600
634
866
/* Find out the optimal number of DH bits */
635
867
/* Try to read the private key file */
636
868
gnutls_datum_t buffer = { .data = NULL, .size = 0 };
716
948
}
717
949
}
718
950
}
719
uret = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, sec_param);
951
unsigned int uret = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, sec_param);
720
952
if(uret != 0){
721
953
mc->dh_bits = uret;
722
954
if(debug){
734
966
safer_gnutls_strerror(ret));
735
967
goto globalfail;
736
968
}
737
} else if(debug){
738
fprintf_plus(stderr, "DH bits explicitly set to %u\n",
739
mc->dh_bits);
740
}
741
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
742
if(ret != GNUTLS_E_SUCCESS){
743
fprintf_plus(stderr, "Error in GnuTLS prime generation (%u"
744
" bits): %s\n", mc->dh_bits,
745
safer_gnutls_strerror(ret));
746
goto globalfail;
969
#endif
970
} else { /* dh_bits != 0 */
971
if(debug){
972
fprintf_plus(stderr, "DH bits explicitly set to %u\n",
973
mc->dh_bits);
974
}
975
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
976
if(ret != GNUTLS_E_SUCCESS){
977
fprintf_plus(stderr, "Error in GnuTLS prime generation (%u"
978
" bits): %s\n", mc->dh_bits,
979
safer_gnutls_strerror(ret));
980
goto globalfail;
981
}
982
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
747
983
}
748
984
}
749
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
750
985
751
986
return 0;
752
987
763
998
int ret;
764
999
/* GnuTLS session creation */
765
1000
do {
766
ret = gnutls_init(session, GNUTLS_SERVER);
1001
ret = gnutls_init(session, (GNUTLS_SERVER
1002
#if GNUTLS_VERSION_NUMBER >= 0x030506
1003
| GNUTLS_NO_TICKETS
1004
#endif
1005
#if GNUTLS_VERSION_NUMBER >= 0x030606
1006
| GNUTLS_ENABLE_RAWPK
1007
#endif
1008
));
767
1009
if(quit_now){
768
1010
return -1;
769
1011
}
817
1059
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
818
1060
__attribute__((unused)) const char *txt){}
819
1061
820
/* Set effective uid to 0, return errno */
821
__attribute__((warn_unused_result))
822
int raise_privileges(void){
823
int old_errno = errno;
824
int ret = 0;
825
if(seteuid(0) == -1){
826
ret = errno;
827
}
828
errno = old_errno;
829
return ret;
830
}
831
832
/* Set effective and real user ID to 0. Return errno. */
833
__attribute__((warn_unused_result))
834
int raise_privileges_permanently(void){
835
int old_errno = errno;
836
int ret = raise_privileges();
837
if(ret != 0){
838
errno = old_errno;
839
return ret;
840
}
841
if(setuid(0) == -1){
842
ret = errno;
843
}
844
errno = old_errno;
845
return ret;
846
}
847
848
/* Set effective user ID to unprivileged saved user ID */
849
__attribute__((warn_unused_result))
850
int lower_privileges(void){
851
int old_errno = errno;
852
int ret = 0;
853
if(seteuid(uid) == -1){
854
ret = errno;
855
}
856
errno = old_errno;
857
return ret;
858
}
859
860
/* Lower privileges permanently */
861
__attribute__((warn_unused_result))
862
int lower_privileges_permanently(void){
863
int old_errno = errno;
864
int ret = 0;
865
if(setuid(uid) == -1){
866
ret = errno;
867
}
868
errno = old_errno;
869
return ret;
870
}
871
872
1062
/* Helper function to add_local_route() and delete_local_route() */
873
1063
__attribute__((nonnull, warn_unused_result))
874
1064
static bool add_delete_local_route(const bool add,
913
1103
ret = setgid(0);
914
1104
if(ret == -1){
915
1105
perror_plus("setgid");
1106
close(devnull);
916
1107
_exit(EX_NOPERM);
917
1108
}
918
1109
/* Reset supplementary groups */
920
1111
ret = setgroups(0, NULL);
921
1112
if(ret == -1){
922
1113
perror_plus("setgroups");
1114
close(devnull);
923
1115
_exit(EX_NOPERM);
924
1116
}
925
1117
}
926
1118
ret = dup2(devnull, STDIN_FILENO);
927
1119
if(ret == -1){
928
1120
perror_plus("dup2(devnull, STDIN_FILENO)");
1121
close(devnull);
929
1122
_exit(EX_OSERR);
930
1123
}
931
1124
ret = close(devnull);
932
1125
if(ret == -1){
933
1126
perror_plus("close");
934
_exit(EX_OSERR);
935
1127
}
936
1128
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
937
1129
if(ret == -1){
972
1164
}
973
1165
if(pid == -1){
974
1166
perror_plus("fork");
1167
close(devnull);
975
1168
return false;
976
1169
}
1170
ret = close(devnull);
1171
if(ret == -1){
1172
perror_plus("close");
1173
}
977
1174
int status;
978
1175
pid_t pret = -1;
979
1176
errno = 0;
1079
1276
bool match = false;
1080
1277
{
1081
1278
char *interface = NULL;
1082
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
1083
interface))){
1279
while((interface = argz_next(mc->interfaces,
1280
mc->interfaces_size,
1281
interface))){
1084
1282
if(if_nametoindex(interface) == (unsigned int)if_index){
1085
1283
match = true;
1086
1284
break;
1493
1691
return retval;
1494
1692
}
1495
1693
1496
__attribute__((nonnull))
1497
1694
static void resolve_callback(AvahiSServiceResolver *r,
1498
1695
AvahiIfIndex interface,
1499
1696
AvahiProtocol proto,
1654
1851
perror_plus("ioctl SIOCGIFFLAGS");
1655
1852
errno = old_errno;
1656
1853
}
1854
if((close(s) == -1) and debug){
1855
old_errno = errno;
1856
perror_plus("close");
1857
errno = old_errno;
1858
}
1657
1859
return false;
1658
1860
}
1861
if((close(s) == -1) and debug){
1862
old_errno = errno;
1863
perror_plus("close");
1864
errno = old_errno;
1865
}
1659
1866
return true;
1660
1867
}
1661
1868
1922
2129
return;
1923
2130
}
1924
2131
}
2132
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
2133
if(devnull == -1){
2134
perror_plus("open(\"/dev/null\", O_RDONLY)");
2135
return;
2136
}
1925
2137
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1926
2138
runnable_hook, alphasort);
1927
2139
if(numhooks == -1){
1928
2140
perror_plus("scandir");
2141
close(devnull);
1929
2142
return;
1930
2143
}
1931
2144
struct dirent *direntry;
1932
2145
int ret;
1933
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
1934
if(devnull == -1){
1935
perror_plus("open(\"/dev/null\", O_RDONLY)");
1936
return;
1937
}
1938
2146
for(int i = 0; i < numhooks; i++){
1939
2147
direntry = direntries[i];
1940
2148
if(debug){
2196
2404
2197
2405
/* Sleep checking until interface is running.
2198
2406
Check every 0.25s, up to total time of delay */
2199
for(int i=0; i < delay * 4; i++){
2407
for(int i = 0; i < delay * 4; i++){
2200
2408
if(interface_is_running(interface)){
2201
2409
break;
2202
2410
}
2289
2497
2290
2498
int main(int argc, char *argv[]){
2291
2499
mandos_context mc = { .server = NULL, .dh_bits = 0,
2500
#if GNUTLS_VERSION_NUMBER >= 0x030606
2501
.priority = "SECURE128:!CTYPE-X.509"
2502
":+CTYPE-RAWPK:!RSA:!VERS-ALL:+VERS-TLS1.3"
2503
":%PROFILE_ULTRA",
2504
#elif GNUTLS_VERSION_NUMBER < 0x030600
2292
2505
.priority = "SECURE256:!CTYPE-X.509"
2293
2506
":+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256",
2507
#else
2508
#error "Needs GnuTLS 3.6.6 or later, or before 3.6.0"
2509
#endif
2294
2510
.current_server = NULL, .interfaces = NULL,
2295
2511
.interfaces_size = 0 };
2296
2512
AvahiSServiceBrowser *sb = NULL;
2307
2523
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
2308
2524
const char *seckey = PATHDIR "/" SECKEY;
2309
2525
const char *pubkey = PATHDIR "/" PUBKEY;
2526
#if GNUTLS_VERSION_NUMBER >= 0x030606
2527
const char *tls_privkey = PATHDIR "/" TLS_PRIVKEY;
2528
const char *tls_pubkey = PATHDIR "/" TLS_PUBKEY;
2529
#endif
2310
2530
const char *dh_params_file = NULL;
2311
2531
char *interfaces_hooks = NULL;
2312
2532
2360
2580
{ .name = "pubkey", .key = 'p',
2361
2581
.arg = "FILE",
2362
2582
.doc = "OpenPGP public key file base name",
2363
.group = 2 },
2583
.group = 1 },
2584
{ .name = "tls-privkey", .key = 't',
2585
.arg = "FILE",
2586
#if GNUTLS_VERSION_NUMBER >= 0x030606
2587
.doc = "TLS private key file base name",
2588
#else
2589
.doc = "Dummy; ignored (requires GnuTLS 3.6.6)",
2590
#endif
2591
.group = 1 },
2592
{ .name = "tls-pubkey", .key = 'T',
2593
.arg = "FILE",
2594
#if GNUTLS_VERSION_NUMBER >= 0x030606
2595
.doc = "TLS public key file base name",
2596
#else
2597
.doc = "Dummy; ignored (requires GnuTLS 3.6.6)",
2598
#endif
2599
.group = 1 },
2364
2600
{ .name = "dh-bits", .key = 129,
2365
2601
.arg = "BITS",
2366
2602
.doc = "Bit length of the prime number used in the"
2422
2658
case 'p': /* --pubkey */
2423
2659
pubkey = arg;
2424
2660
break;
2661
case 't': /* --tls-privkey */
2662
#if GNUTLS_VERSION_NUMBER >= 0x030606
2663
tls_privkey = arg;
2664
#endif
2665
break;
2666
case 'T': /* --tls-pubkey */
2667
#if GNUTLS_VERSION_NUMBER >= 0x030606
2668
tls_pubkey = arg;
2669
#endif
2670
break;
2425
2671
case 129: /* --dh-bits */
2426
2672
errno = 0;
2427
2673
tmpmax = strtoimax(arg, &tmp, 10);
2462
2708
argp_state_help(state, state->out_stream,
2463
2709
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
2464
2710
& ~(unsigned int)ARGP_HELP_EXIT_OK);
2711
__builtin_unreachable();
2465
2712
case -3: /* --usage */
2466
2713
argp_state_help(state, state->out_stream,
2467
2714
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
2715
__builtin_unreachable();
2468
2716
case 'V': /* --version */
2469
2717
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
2470
2718
exit(argp_err_exit_status);
2497
2745
}
2498
2746
2499
2747
{
2500
/* Work around Debian bug #633582:
2501
<https://bugs.debian.org/633582> */
2502
2503
2748
/* Re-raise privileges */
2504
2749
ret = raise_privileges();
2505
2750
if(ret != 0){
2508
2753
} else {
2509
2754
struct stat st;
2510
2755
2756
/* Work around Debian bug #633582:
2757
<https://bugs.debian.org/633582> */
2758
2511
2759
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2512
2760
int seckey_fd = open(seckey, O_RDONLY);
2513
2761
if(seckey_fd == -1){
2572
2820
}
2573
2821
}
2574
2822
2823
/* Work around Debian bug #981302
2824
<https://bugs.debian.org/981302> */
2825
if(lstat("/dev/fd", &st) != 0 and errno == ENOENT){
2826
ret = symlink("/proc/self/fd", "/dev/fd");
2827
if(ret == -1){
2828
perror_plus("Failed to create /dev/fd symlink");
2829
}
2830
}
2831
2575
2832
/* Lower privileges */
2576
2833
ret = lower_privileges();
2577
2834
if(ret != 0){
2781
3038
goto end;
2782
3039
}
2783
3040
3041
#if GNUTLS_VERSION_NUMBER >= 0x030606
3042
ret = init_gnutls_global(tls_pubkey, tls_privkey, dh_params_file, &mc);
3043
#elif GNUTLS_VERSION_NUMBER < 0x030600
2784
3044
ret = init_gnutls_global(pubkey, seckey, dh_params_file, &mc);
3045
#else
3046
#error "Needs GnuTLS 3.6.6 or later, or before 3.6.0"
3047
#endif
2785
3048
if(ret == -1){
2786
3049
fprintf_plus(stderr, "init_gnutls_global failed\n");
2787
3050
exitcode = EX_UNAVAILABLE;
3023
3286
/* Take down the network interfaces which were brought up */
3024
3287
{
3025
3288
char *interface = NULL;
3026
while((interface=argz_next(interfaces_to_take_down,
3027
interfaces_to_take_down_size,
3028
interface))){
3289
while((interface = argz_next(interfaces_to_take_down,
3290
interfaces_to_take_down_size,
3291
interface))){
3029
3292
ret = take_down_interface(interface);
3030
3293
if(ret != 0){
3031
3294
errno = ret;
3060
3323
| O_PATH));
3061
3324
if(dir_fd == -1){
3062
3325
perror_plus("open");
3326
return;
3063
3327
}
3064
3328
int numentries = scandirat(dir_fd, ".", &direntries,
3065
3329
notdotentries, alphasort);
3082
3346
clean_dir_at(dir_fd, direntries[i]->d_name, level+1);
3083
3347
dret = 0;
3084
3348
}
3085
if(dret == -1){
3349
if((dret == -1) and (errno != ENOENT)){
3086
3350
fprintf_plus(stderr, "unlink(\"%s/%s\"): %s\n", dirname,
3087
3351
direntries[i]->d_name, strerror(errno));
3088
3352
}
3092
3356
3093
3357
/* need to clean even if 0 because man page doesn't specify */
3094
3358
free(direntries);
3095
if(numentries == -1){
3096
perror_plus("scandirat");
3097
}
3098
3359
dret = unlinkat(base, dirname, AT_REMOVEDIR);
3099
3360
if(dret == -1 and errno != ENOENT){
3100
3361
perror_plus("rmdir");
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0