36
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
38
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror(), sscanf(),
39
stdout, ferror(), sscanf */
41
40
#include <stdint.h> /* uint16_t, uint32_t */
42
41
#include <stddef.h> /* NULL, size_t, ssize_t */
43
42
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
45
#include <stdbool.h> /* bool, false, true */
44
#include <stdbool.h> /* bool, true */
46
45
#include <string.h> /* memset(), strcmp(), strlen(),
47
46
strerror(), asprintf(), strcpy() */
48
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/ioctl.h> /* ioctl */
49
48
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
50
49
sockaddr_in6, PF_INET6,
51
SOCK_STREAM, uid_t, gid_t, open(),
50
SOCK_STREAM, INET6_ADDRSTRLEN,
51
uid_t, gid_t, open(), opendir(),
53
53
#include <sys/stat.h> /* open() */
54
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
inet_pton(), connect() */
55
struct in6_addr, inet_pton(),
56
57
#include <fcntl.h> /* open() */
57
58
#include <dirent.h> /* opendir(), struct dirent, readdir()
59
60
#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */
60
61
#include <assert.h> /* assert() */
61
62
#include <errno.h> /* perror(), errno */
62
#include <time.h> /* nanosleep(), time() */
63
#include <time.h> /* time(), nanosleep() */
63
64
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
64
65
SIOCSIFFLAGS, if_indextoname(),
65
66
if_nametoindex(), IF_NAMESIZE */
66
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
67
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
67
#include <netinet/in.h>
69
68
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
70
69
getuid(), getgid(), setuid(),
72
71
#include <arpa/inet.h> /* inet_pton(), htons */
73
#include <iso646.h> /* not, or, and */
72
#include <iso646.h> /* not, and, or */
74
73
#include <argp.h> /* struct argp_option, error_t, struct
75
74
argp_state, struct argp,
76
75
argp_parse(), ARGP_KEY_ARG,
77
76
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
79
77
#include <sys/klog.h> /* klogctl() */
83
80
/* All Avahi types, constants and functions
873
821
int main(int argc, char *argv[]){
874
AvahiSServiceBrowser *sb = NULL;
879
int exitcode = EXIT_SUCCESS;
880
const char *interface = "eth0";
881
struct ifreq network;
885
char *connect_to = NULL;
886
char tempdir[] = "/tmp/mandosXXXXXX";
887
bool tempdir_created = false;
888
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
889
const char *seckey = PATHDIR "/" SECKEY;
890
const char *pubkey = PATHDIR "/" PUBKEY;
892
mandos_context mc = { .simple_poll = NULL, .server = NULL,
893
.dh_bits = 1024, .priority = "SECURE256"
894
":!CTYPE-X.509:+CTYPE-OPENPGP" };
895
bool gnutls_initialized = false;
896
bool gpgme_initialized = false;
900
struct argp_option options[] = {
901
{ .name = "debug", .key = 128,
902
.doc = "Debug mode", .group = 3 },
903
{ .name = "connect", .key = 'c',
904
.arg = "ADDRESS:PORT",
905
.doc = "Connect directly to a specific Mandos server",
907
{ .name = "interface", .key = 'i',
909
.doc = "Network interface that will be used to search for"
912
{ .name = "seckey", .key = 's',
914
.doc = "OpenPGP secret key file base name",
916
{ .name = "pubkey", .key = 'p',
918
.doc = "OpenPGP public key file base name",
920
{ .name = "dh-bits", .key = 129,
922
.doc = "Bit length of the prime number used in the"
923
" Diffie-Hellman key exchange",
925
{ .name = "priority", .key = 130,
927
.doc = "GnuTLS priority string for the TLS handshake",
929
{ .name = "delay", .key = 131,
931
.doc = "Maximum delay to wait for interface startup",
936
error_t parse_opt(int key, char *arg,
937
struct argp_state *state){
939
case 128: /* --debug */
942
case 'c': /* --connect */
945
case 'i': /* --interface */
948
case 's': /* --seckey */
951
case 'p': /* --pubkey */
954
case 129: /* --dh-bits */
955
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
956
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
957
or arg[numchars] != '\0'){
958
fprintf(stderr, "Bad number of DH bits\n");
961
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
963
case 130: /* --priority */
966
case 131: /* --delay */
967
ret = sscanf(arg, "%lf%n", &delay, &numchars);
968
if(ret < 1 or arg[numchars] != '\0'){
969
fprintf(stderr, "Bad delay\n");
978
return ARGP_ERR_UNKNOWN;
983
struct argp argp = { .options = options, .parser = parse_opt,
985
.doc = "Mandos client -- Get and decrypt"
986
" passwords from a Mandos server" };
987
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
988
if(ret == ARGP_ERR_UNKNOWN){
989
fprintf(stderr, "Unknown error while parsing arguments\n");
990
exitcode = EXIT_FAILURE;
995
/* If the interface is down, bring it up */
996
if(interface[0] != '\0'){
998
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
999
messages to mess up the prompt */
1000
ret = klogctl(8, NULL, 5);
1001
bool restore_loglevel = true;
1003
restore_loglevel = false;
1008
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1011
exitcode = EXIT_FAILURE;
1013
if(restore_loglevel){
1014
ret = klogctl(7, NULL, 0);
1022
strcpy(network.ifr_name, interface);
1023
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1025
perror("ioctl SIOCGIFFLAGS");
1027
if(restore_loglevel){
1028
ret = klogctl(7, NULL, 0);
1034
exitcode = EXIT_FAILURE;
1037
if((network.ifr_flags & IFF_UP) == 0){
1038
network.ifr_flags |= IFF_UP;
1039
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1041
perror("ioctl SIOCSIFFLAGS");
1042
exitcode = EXIT_FAILURE;
1044
if(restore_loglevel){
822
AvahiSServiceBrowser *sb = NULL;
827
int exitcode = EXIT_SUCCESS;
828
const char *interface = "eth0";
829
struct ifreq network;
833
char *connect_to = NULL;
834
char tempdir[] = "/tmp/mandosXXXXXX";
835
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
836
const char *seckey = PATHDIR "/" SECKEY;
837
const char *pubkey = PATHDIR "/" PUBKEY;
839
mandos_context mc = { .simple_poll = NULL, .server = NULL,
840
.dh_bits = 1024, .priority = "SECURE256"
841
":!CTYPE-X.509:+CTYPE-OPENPGP" };
842
bool gnutls_initalized = false;
843
bool gpgme_initalized = false;
847
struct argp_option options[] = {
848
{ .name = "debug", .key = 128,
849
.doc = "Debug mode", .group = 3 },
850
{ .name = "connect", .key = 'c',
851
.arg = "ADDRESS:PORT",
852
.doc = "Connect directly to a specific Mandos server",
854
{ .name = "interface", .key = 'i',
856
.doc = "Interface that will be used to search for Mandos"
859
{ .name = "seckey", .key = 's',
861
.doc = "OpenPGP secret key file base name",
863
{ .name = "pubkey", .key = 'p',
865
.doc = "OpenPGP public key file base name",
867
{ .name = "dh-bits", .key = 129,
869
.doc = "Bit length of the prime number used in the"
870
" Diffie-Hellman key exchange",
872
{ .name = "priority", .key = 130,
874
.doc = "GnuTLS priority string for the TLS handshake",
876
{ .name = "delay", .key = 131,
878
.doc = "Maximum delay to wait for interface startup",
883
error_t parse_opt(int key, char *arg,
884
struct argp_state *state) {
886
case 128: /* --debug */
889
case 'c': /* --connect */
892
case 'i': /* --interface */
895
case 's': /* --seckey */
898
case 'p': /* --pubkey */
901
case 129: /* --dh-bits */
902
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
903
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
904
or arg[numchars] != '\0'){
905
fprintf(stderr, "Bad number of DH bits\n");
908
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
910
case 130: /* --priority */
913
case 131: /* --delay */
914
ret = sscanf(arg, "%lf%n", &delay, &numchars);
915
if(ret < 1 or arg[numchars] != '\0'){
916
fprintf(stderr, "Bad delay\n");
925
return ARGP_ERR_UNKNOWN;
930
struct argp argp = { .options = options, .parser = parse_opt,
932
.doc = "Mandos client -- Get and decrypt"
933
" passwords from a Mandos server" };
934
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
935
if(ret == ARGP_ERR_UNKNOWN){
936
fprintf(stderr, "Unknown error while parsing arguments\n");
937
exitcode = EXIT_FAILURE;
942
/* If the interface is down, bring it up */
944
// Lower kernel loglevel to KERN_NOTICE to avoid
945
// KERN_INFO messages to mess up the prompt
946
ret = klogctl(8, NULL, 5);
951
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
954
exitcode = EXIT_FAILURE;
955
ret = klogctl(7, NULL, 0);
961
strcpy(network.ifr_name, interface);
962
ret = ioctl(sd, SIOCGIFFLAGS, &network);
964
perror("ioctl SIOCGIFFLAGS");
965
ret = klogctl(7, NULL, 0);
969
exitcode = EXIT_FAILURE;
972
if((network.ifr_flags & IFF_UP) == 0){
973
network.ifr_flags |= IFF_UP;
974
ret = ioctl(sd, SIOCSIFFLAGS, &network);
976
perror("ioctl SIOCSIFFLAGS");
977
exitcode = EXIT_FAILURE;
1045
978
ret = klogctl(7, NULL, 0);
1047
980
perror("klogctl");
1054
/* sleep checking until interface is running */
1055
for(int i=0; i < delay * 4; i++){
1056
ret = ioctl(sd, SIOCGIFFLAGS, &network);
985
// sleep checking until interface is running
986
for(int i=0; i < delay * 4; i++){
987
ret = ioctl(sd, SIOCGIFFLAGS, &network);
989
perror("ioctl SIOCGIFFLAGS");
990
} else if(network.ifr_flags & IFF_RUNNING){
993
struct timespec sleeptime = { .tv_nsec = 250000000 };
994
nanosleep(&sleeptime, NULL);
996
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1058
perror("ioctl SIOCGIFFLAGS");
1059
} else if(network.ifr_flags & IFF_RUNNING){
1062
struct timespec sleeptime = { .tv_nsec = 250000000 };
1063
ret = nanosleep(&sleeptime, NULL);
1064
if(ret == -1 and errno != EINTR){
1065
perror("nanosleep");
1068
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1073
if(restore_loglevel){
1074
/* Restores kernel loglevel to default */
1000
// Restores kernel loglevel to default
1075
1001
ret = klogctl(7, NULL, 0);
1077
1003
perror("klogctl");
1097
ret = init_gnutls_global(&mc, pubkey, seckey);
1099
fprintf(stderr, "init_gnutls_global failed\n");
1100
exitcode = EXIT_FAILURE;
1103
gnutls_initialized = true;
1106
if(mkdtemp(tempdir) == NULL){
1110
tempdir_created = true;
1112
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
1113
fprintf(stderr, "init_gpgme failed\n");
1114
exitcode = EXIT_FAILURE;
1117
gpgme_initialized = true;
1120
if(interface[0] != '\0'){
1020
ret = init_gnutls_global(&mc, pubkey, seckey);
1022
fprintf(stderr, "init_gnutls_global failed\n");
1023
exitcode = EXIT_FAILURE;
1026
gnutls_initalized = true;
1029
if(mkdtemp(tempdir) == NULL){
1035
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
1036
fprintf(stderr, "gpgme_initalized failed\n");
1037
exitcode = EXIT_FAILURE;
1040
gpgme_initalized = true;
1121
1043
if_index = (AvahiIfIndex) if_nametoindex(interface);
1122
1044
if(if_index == 0){
1123
1045
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1124
exitcode = EXIT_FAILURE;
1129
if(connect_to != NULL){
1130
/* Connect directly, do not use Zeroconf */
1131
/* (Mainly meant for debugging) */
1132
char *address = strrchr(connect_to, ':');
1133
if(address == NULL){
1134
fprintf(stderr, "No colon in address\n");
1135
exitcode = EXIT_FAILURE;
1139
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1140
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1141
or address[numchars+1] != '\0'){
1142
fprintf(stderr, "Bad port number\n");
1143
exitcode = EXIT_FAILURE;
1146
port = (uint16_t)tmpmax;
1148
address = connect_to;
1149
/* Colon in address indicates IPv6 */
1151
if(strchr(address, ':') != NULL){
1156
ret = start_mandos_communication(address, port, if_index, &mc,
1159
exitcode = EXIT_FAILURE;
1161
exitcode = EXIT_SUCCESS;
1167
avahi_set_log_function(empty_log);
1170
/* Initialize the pseudo-RNG for Avahi */
1171
srand((unsigned int) time(NULL));
1173
/* Allocate main Avahi loop object */
1174
mc.simple_poll = avahi_simple_poll_new();
1175
if(mc.simple_poll == NULL){
1176
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1177
exitcode = EXIT_FAILURE;
1182
AvahiServerConfig config;
1183
/* Do not publish any local Zeroconf records */
1184
avahi_server_config_init(&config);
1185
config.publish_hinfo = 0;
1186
config.publish_addresses = 0;
1187
config.publish_workstation = 0;
1188
config.publish_domain = 0;
1190
/* Allocate a new server */
1191
mc.server = avahi_server_new(avahi_simple_poll_get
1192
(mc.simple_poll), &config, NULL,
1195
/* Free the Avahi configuration data */
1196
avahi_server_config_free(&config);
1199
/* Check if creating the Avahi server object succeeded */
1200
if(mc.server == NULL){
1201
fprintf(stderr, "Failed to create Avahi server: %s\n",
1202
avahi_strerror(error));
1203
exitcode = EXIT_FAILURE;
1207
/* Create the Avahi service browser */
1208
sb = avahi_s_service_browser_new(mc.server, if_index,
1209
AVAHI_PROTO_INET6, "_mandos._tcp",
1210
NULL, 0, browse_callback, &mc);
1212
fprintf(stderr, "Failed to create service browser: %s\n",
1213
avahi_strerror(avahi_server_errno(mc.server)));
1214
exitcode = EXIT_FAILURE;
1218
/* Run the main loop */
1221
fprintf(stderr, "Starting Avahi loop search\n");
1224
avahi_simple_poll_loop(mc.simple_poll);
1049
if(connect_to != NULL){
1050
/* Connect directly, do not use Zeroconf */
1051
/* (Mainly meant for debugging) */
1052
char *address = strrchr(connect_to, ':');
1053
if(address == NULL){
1054
fprintf(stderr, "No colon in address\n");
1055
exitcode = EXIT_FAILURE;
1059
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1060
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1061
or address[numchars+1] != '\0'){
1062
fprintf(stderr, "Bad port number\n");
1063
exitcode = EXIT_FAILURE;
1066
port = (uint16_t)tmpmax;
1068
address = connect_to;
1069
ret = start_mandos_communication(address, port, if_index, &mc);
1071
exitcode = EXIT_FAILURE;
1073
exitcode = EXIT_SUCCESS;
1079
avahi_set_log_function(empty_log);
1082
/* Initialize the pseudo-RNG for Avahi */
1083
srand((unsigned int) time(NULL));
1085
/* Allocate main Avahi loop object */
1086
mc.simple_poll = avahi_simple_poll_new();
1087
if(mc.simple_poll == NULL) {
1088
fprintf(stderr, "Avahi: Failed to create simple poll"
1090
exitcode = EXIT_FAILURE;
1095
AvahiServerConfig config;
1096
/* Do not publish any local Zeroconf records */
1097
avahi_server_config_init(&config);
1098
config.publish_hinfo = 0;
1099
config.publish_addresses = 0;
1100
config.publish_workstation = 0;
1101
config.publish_domain = 0;
1103
/* Allocate a new server */
1104
mc.server = avahi_server_new(avahi_simple_poll_get
1105
(mc.simple_poll), &config, NULL,
1108
/* Free the Avahi configuration data */
1109
avahi_server_config_free(&config);
1112
/* Check if creating the Avahi server object succeeded */
1113
if(mc.server == NULL) {
1114
fprintf(stderr, "Failed to create Avahi server: %s\n",
1115
avahi_strerror(error));
1116
exitcode = EXIT_FAILURE;
1120
/* Create the Avahi service browser */
1121
sb = avahi_s_service_browser_new(mc.server, if_index,
1123
"_mandos._tcp", NULL, 0,
1124
browse_callback, &mc);
1126
fprintf(stderr, "Failed to create service browser: %s\n",
1127
avahi_strerror(avahi_server_errno(mc.server)));
1128
exitcode = EXIT_FAILURE;
1132
/* Run the main loop */
1135
fprintf(stderr, "Starting Avahi loop search\n");
1138
avahi_simple_poll_loop(mc.simple_poll);
1229
fprintf(stderr, "%s exiting\n", argv[0]);
1232
/* Cleanup things */
1234
avahi_s_service_browser_free(sb);
1236
if(mc.server != NULL)
1237
avahi_server_free(mc.server);
1239
if(mc.simple_poll != NULL)
1240
avahi_simple_poll_free(mc.simple_poll);
1242
if(gnutls_initialized){
1243
gnutls_certificate_free_credentials(mc.cred);
1244
gnutls_global_deinit();
1245
gnutls_dh_params_deinit(mc.dh_params);
1248
if(gpgme_initialized){
1249
gpgme_release(mc.ctx);
1252
/* Removes the temp directory used by GPGME */
1253
if(tempdir_created){
1255
struct dirent *direntry;
1256
d = opendir(tempdir);
1258
if(errno != ENOENT){
1263
direntry = readdir(d);
1264
if(direntry == NULL){
1267
/* Skip "." and ".." */
1268
if(direntry->d_name[0] == '.'
1269
and (direntry->d_name[1] == '\0'
1270
or (direntry->d_name[1] == '.'
1271
and direntry->d_name[2] == '\0'))){
1274
char *fullname = NULL;
1275
ret = asprintf(&fullname, "%s/%s", tempdir,
1281
ret = remove(fullname);
1283
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1290
ret = rmdir(tempdir);
1291
if(ret == -1 and errno != ENOENT){
1143
fprintf(stderr, "%s exiting\n", argv[0]);
1146
/* Cleanup things */
1148
avahi_s_service_browser_free(sb);
1150
if(mc.server != NULL)
1151
avahi_server_free(mc.server);
1153
if(mc.simple_poll != NULL)
1154
avahi_simple_poll_free(mc.simple_poll);
1156
if(gnutls_initalized){
1157
gnutls_certificate_free_credentials(mc.cred);
1158
gnutls_global_deinit();
1159
gnutls_dh_params_deinit(mc.dh_params);
1162
if(gpgme_initalized){
1163
gpgme_release(mc.ctx);
1166
/* Removes the temp directory used by GPGME */
1167
if(tempdir[0] != '\0'){
1169
struct dirent *direntry;
1170
d = opendir(tempdir);
1172
if(errno != ENOENT){
1177
direntry = readdir(d);
1178
if(direntry == NULL){
1181
if(direntry->d_type == DT_REG){
1182
char *fullname = NULL;
1183
ret = asprintf(&fullname, "%s/%s", tempdir,
1189
ret = unlink(fullname);
1191
fprintf(stderr, "unlink(\"%s\"): %s",
1192
fullname, strerror(errno));
1199
ret = rmdir(tempdir);
1200
if(ret == -1 and errno != ENOENT){