To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 24.1.2
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.2
- Committer: Björn Påhlsson
- Date: 2008-07-22 06:26:12 UTC
- mfrom: (26 mandos)
- mto: (237.7.1 mandos) (24.1.154 mandos)
- mto: This revision was merged to the branch mainline in revision 27.
- Revision ID: belorn@braxen-20080722062612-0om9eb3fpsso8xc4
merge
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
3
* Mandos client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
8
8
* includes the following functions: "resolve_callback",
9
9
* "browse_callback", and parts of "main".
10
10
*
11
* Everything else is
12
* Copyright © 2008-2011 Teddy Hogeborn
13
* Copyright © 2008-2011 Björn Påhlsson
11
* Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
12
* Påhlsson.
14
13
*
15
14
* This program is free software: you can redistribute it and/or
16
15
* modify it under the terms of the GNU General Public License as
26
25
* along with this program. If not, see
27
26
* <http://www.gnu.org/licenses/>.
28
27
*
29
* Contact the authors at <mandos@recompile.se>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
30
30
*/
31
31
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
32
#define _FORTIFY_SOURCE 2
33
34
34
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
35
#define _FILE_OFFSET_BITS 64
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open(), S_ISREG */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno,
66
program_invocation_short_name */
67
#include <time.h> /* nanosleep(), time(), sleep() */
68
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
69
SIOCSIFFLAGS, if_indextoname(),
70
if_nametoindex(), IF_NAMESIZE */
71
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
72
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
73
*/
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
75
getuid(), getgid(), seteuid(),
76
setgid(), pause() */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
78
#include <iso646.h> /* not, or, and */
79
#include <argp.h> /* struct argp_option, error_t, struct
80
argp_state, struct argp,
81
argp_parse(), ARGP_KEY_ARG,
82
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
83
#include <signal.h> /* sigemptyset(), sigaddset(),
84
sigaction(), SIGTERM, sig_atomic_t,
85
raise() */
86
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
87
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
88
89
#ifdef __linux__
90
#include <sys/klog.h> /* klogctl() */
91
#endif /* __linux__ */
92
93
/* Avahi */
94
/* All Avahi types, constants and functions
95
Avahi*, avahi_*,
96
AVAHI_* */
36
37
#include <stdio.h>
38
#include <assert.h>
39
#include <stdlib.h>
40
#include <time.h>
41
#include <net/if.h> /* if_nametoindex */
42
97
43
#include <avahi-core/core.h>
98
44
#include <avahi-core/lookup.h>
99
45
#include <avahi-core/log.h>
101
47
#include <avahi-common/malloc.h>
102
48
#include <avahi-common/error.h>
103
49
104
/* GnuTLS */
105
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
106
functions:
107
gnutls_*
108
init_gnutls_session(),
109
GNUTLS_* */
110
#include <gnutls/openpgp.h>
111
/* gnutls_certificate_set_openpgp_key_file(),
112
GNUTLS_OPENPGP_FMT_BASE64 */
113
114
/* GPGME */
115
#include <gpgme.h> /* All GPGME types, constants and
116
functions:
117
gpgme_*
118
GPGME_PROTOCOL_OpenPGP,
119
GPG_ERR_NO_* */
120
50
//mandos client part
51
#include <sys/types.h> /* socket(), inet_pton() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton() */
54
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
55
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
56
57
#include <unistd.h> /* close() */
58
#include <netinet/in.h>
59
#include <stdbool.h> /* true */
60
#include <string.h> /* memset */
61
#include <arpa/inet.h> /* inet_pton() */
62
#include <iso646.h> /* not */
63
64
// gpgme
65
#include <errno.h> /* perror() */
66
#include <gpgme.h>
67
68
// getopt long
69
#include <getopt.h>
70
71
#ifndef CERT_ROOT
72
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
73
#endif
74
#define CERTFILE CERT_ROOT "openpgp-client.txt"
75
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
121
76
#define BUFFER_SIZE 256
122
123
#define PATHDIR "/conf/conf.d/mandos"
124
#define SECKEY "seckey.txt"
125
#define PUBKEY "pubkey.txt"
126
#define HOOKDIR "/lib/mandos/network-hooks.d"
77
#define DH_BITS 1024
127
78
128
79
bool debug = false;
129
static const char mandos_protocol_version[] = "1";
130
const char *argp_program_version = "mandos-client " VERSION;
131
const char *argp_program_bug_address = "<mandos@recompile.se>";
132
static const char sys_class_net[] = "/sys/class/net";
133
char *connect_to = NULL;
134
135
/* Doubly linked list that need to be circularly linked when used */
136
typedef struct server{
137
const char *ip;
138
uint16_t port;
139
AvahiIfIndex if_index;
140
int af;
141
struct timespec last_seen;
142
struct server *next;
143
struct server *prev;
144
} server;
145
146
/* Used for passing in values through the Avahi callback functions */
80
147
81
typedef struct {
148
AvahiSimplePoll *simple_poll;
149
AvahiServer *server;
82
gnutls_session_t session;
150
83
gnutls_certificate_credentials_t cred;
151
unsigned int dh_bits;
152
84
gnutls_dh_params_t dh_params;
153
const char *priority;
85
} encrypted_session;
86
87
88
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
89
char **new_packet, const char *homedir){
90
gpgme_data_t dh_crypto, dh_plain;
154
91
gpgme_ctx_t ctx;
155
server *current_server;
156
} mandos_context;
157
158
/* global context so signal handler can reach it*/
159
mandos_context mc = { .simple_poll = NULL, .server = NULL,
160
.dh_bits = 1024, .priority = "SECURE256"
161
":!CTYPE-X.509:+CTYPE-OPENPGP",
162
.current_server = NULL };
163
164
sig_atomic_t quit_now = 0;
165
int signal_received = 0;
166
167
/* Function to use when printing errors */
168
void perror_plus(const char *print_text){
169
fprintf(stderr, "Mandos plugin %s: ",
170
program_invocation_short_name);
171
perror(print_text);
172
}
173
174
/*
175
* Make additional room in "buffer" for at least BUFFER_SIZE more
176
* bytes. "buffer_capacity" is how much is currently allocated,
177
* "buffer_length" is how much is already used.
178
*/
179
size_t incbuffer(char **buffer, size_t buffer_length,
180
size_t buffer_capacity){
181
if(buffer_length + BUFFER_SIZE > buffer_capacity){
182
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
183
if(buffer == NULL){
184
return 0;
185
}
186
buffer_capacity += BUFFER_SIZE;
187
}
188
return buffer_capacity;
189
}
190
191
/* Add server to set of servers to retry periodically */
192
int add_server(const char *ip, uint16_t port,
193
AvahiIfIndex if_index,
194
int af){
195
int ret;
196
server *new_server = malloc(sizeof(server));
197
if(new_server == NULL){
198
perror_plus("malloc");
199
return -1;
200
}
201
*new_server = (server){ .ip = strdup(ip),
202
.port = port,
203
.if_index = if_index,
204
.af = af };
205
if(new_server->ip == NULL){
206
perror_plus("strdup");
207
return -1;
208
}
209
/* Special case of first server */
210
if (mc.current_server == NULL){
211
new_server->next = new_server;
212
new_server->prev = new_server;
213
mc.current_server = new_server;
214
/* Place the new server last in the list */
215
} else {
216
new_server->next = mc.current_server;
217
new_server->prev = mc.current_server->prev;
218
new_server->prev->next = new_server;
219
mc.current_server->prev = new_server;
220
}
221
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
222
if(ret == -1){
223
perror_plus("clock_gettime");
224
return -1;
225
}
226
return 0;
227
}
228
229
/*
230
* Initialize GPGME.
231
*/
232
static bool init_gpgme(const char *seckey,
233
const char *pubkey, const char *tempdir){
234
92
gpgme_error_t rc;
93
ssize_t ret;
94
ssize_t new_packet_capacity = 0;
95
ssize_t new_packet_length = 0;
235
96
gpgme_engine_info_t engine_info;
236
237
238
/*
239
* Helper function to insert pub and seckey to the engine keyring.
240
*/
241
bool import_key(const char *filename){
242
int ret;
243
int fd;
244
gpgme_data_t pgp_data;
245
246
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
247
if(fd == -1){
248
perror_plus("open");
249
return false;
250
}
251
252
rc = gpgme_data_new_from_fd(&pgp_data, fd);
253
if(rc != GPG_ERR_NO_ERROR){
254
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
255
gpgme_strsource(rc), gpgme_strerror(rc));
256
return false;
257
}
258
259
rc = gpgme_op_import(mc.ctx, pgp_data);
260
if(rc != GPG_ERR_NO_ERROR){
261
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
262
gpgme_strsource(rc), gpgme_strerror(rc));
263
return false;
264
}
265
266
ret = (int)TEMP_FAILURE_RETRY(close(fd));
267
if(ret == -1){
268
perror_plus("close");
269
}
270
gpgme_data_release(pgp_data);
271
return true;
272
}
273
274
if(debug){
275
fprintf(stderr, "Initializing GPGME\n");
97
98
if (debug){
99
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
276
100
}
277
101
278
102
/* Init GPGME */
279
103
gpgme_check_version(NULL);
280
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
281
if(rc != GPG_ERR_NO_ERROR){
282
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
283
gpgme_strsource(rc), gpgme_strerror(rc));
284
return false;
285
}
104
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
286
105
287
/* Set GPGME home directory for the OpenPGP engine only */
288
rc = gpgme_get_engine_info(&engine_info);
289
if(rc != GPG_ERR_NO_ERROR){
106
/* Set GPGME home directory */
107
rc = gpgme_get_engine_info (&engine_info);
108
if (rc != GPG_ERR_NO_ERROR){
290
109
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
291
110
gpgme_strsource(rc), gpgme_strerror(rc));
292
return false;
111
return -1;
293
112
}
294
113
while(engine_info != NULL){
295
114
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
296
115
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
297
engine_info->file_name, tempdir);
116
engine_info->file_name, homedir);
298
117
break;
299
118
}
300
119
engine_info = engine_info->next;
301
120
}
302
121
if(engine_info == NULL){
303
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
304
return false;
305
}
306
307
/* Create new GPGME "context" */
308
rc = gpgme_new(&(mc.ctx));
309
if(rc != GPG_ERR_NO_ERROR){
310
fprintf(stderr, "bad gpgme_new: %s: %s\n",
311
gpgme_strsource(rc), gpgme_strerror(rc));
312
return false;
313
}
314
315
if(not import_key(pubkey) or not import_key(seckey)){
316
return false;
317
}
318
319
return true;
320
}
321
322
/*
323
* Decrypt OpenPGP data.
324
* Returns -1 on error
325
*/
326
static ssize_t pgp_packet_decrypt(const char *cryptotext,
327
size_t crypto_size,
328
char **plaintext){
329
gpgme_data_t dh_crypto, dh_plain;
330
gpgme_error_t rc;
331
ssize_t ret;
332
size_t plaintext_capacity = 0;
333
ssize_t plaintext_length = 0;
334
335
if(debug){
336
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
337
}
338
339
/* Create new GPGME data buffer from memory cryptotext */
340
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
341
0);
342
if(rc != GPG_ERR_NO_ERROR){
122
fprintf(stderr, "Could not set home dir to %s\n", homedir);
123
return -1;
124
}
125
126
/* Create new GPGME data buffer from packet buffer */
127
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
128
if (rc != GPG_ERR_NO_ERROR){
343
129
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
344
130
gpgme_strsource(rc), gpgme_strerror(rc));
345
131
return -1;
347
133
348
134
/* Create new empty GPGME data buffer for the plaintext */
349
135
rc = gpgme_data_new(&dh_plain);
350
if(rc != GPG_ERR_NO_ERROR){
136
if (rc != GPG_ERR_NO_ERROR){
351
137
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
352
138
gpgme_strsource(rc), gpgme_strerror(rc));
353
gpgme_data_release(dh_crypto);
354
return -1;
355
}
356
357
/* Decrypt data from the cryptotext data buffer to the plaintext
358
data buffer */
359
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
360
if(rc != GPG_ERR_NO_ERROR){
139
return -1;
140
}
141
142
/* Create new GPGME "context" */
143
rc = gpgme_new(&ctx);
144
if (rc != GPG_ERR_NO_ERROR){
145
fprintf(stderr, "bad gpgme_new: %s: %s\n",
146
gpgme_strsource(rc), gpgme_strerror(rc));
147
return -1;
148
}
149
150
/* Decrypt data from the FILE pointer to the plaintext data
151
buffer */
152
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
153
if (rc != GPG_ERR_NO_ERROR){
361
154
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
362
155
gpgme_strsource(rc), gpgme_strerror(rc));
363
plaintext_length = -1;
364
if(debug){
365
gpgme_decrypt_result_t result;
366
result = gpgme_op_decrypt_result(mc.ctx);
367
if(result == NULL){
368
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
369
} else {
370
fprintf(stderr, "Unsupported algorithm: %s\n",
371
result->unsupported_algorithm);
372
fprintf(stderr, "Wrong key usage: %u\n",
373
result->wrong_key_usage);
374
if(result->file_name != NULL){
375
fprintf(stderr, "File name: %s\n", result->file_name);
376
}
377
gpgme_recipient_t recipient;
378
recipient = result->recipients;
156
return -1;
157
}
158
159
if(debug){
160
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
161
}
162
163
if (debug){
164
gpgme_decrypt_result_t result;
165
result = gpgme_op_decrypt_result(ctx);
166
if (result == NULL){
167
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
168
} else {
169
fprintf(stderr, "Unsupported algorithm: %s\n",
170
result->unsupported_algorithm);
171
fprintf(stderr, "Wrong key usage: %d\n",
172
result->wrong_key_usage);
173
if(result->file_name != NULL){
174
fprintf(stderr, "File name: %s\n", result->file_name);
175
}
176
gpgme_recipient_t recipient;
177
recipient = result->recipients;
178
if(recipient){
379
179
while(recipient != NULL){
380
180
fprintf(stderr, "Public key algorithm: %s\n",
381
181
gpgme_pubkey_algo_name(recipient->pubkey_algo));
387
187
}
388
188
}
389
189
}
390
goto decrypt_end;
391
190
}
392
191
393
if(debug){
394
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
395
}
192
/* Delete the GPGME FILE pointer cryptotext data buffer */
193
gpgme_data_release(dh_crypto);
396
194
397
195
/* Seek back to the beginning of the GPGME plaintext data buffer */
398
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
399
perror_plus("gpgme_data_seek");
400
plaintext_length = -1;
401
goto decrypt_end;
402
}
403
404
*plaintext = NULL;
196
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
197
198
*new_packet = 0;
405
199
while(true){
406
plaintext_capacity = incbuffer(plaintext,
407
(size_t)plaintext_length,
408
plaintext_capacity);
409
if(plaintext_capacity == 0){
410
perror_plus("incbuffer");
411
plaintext_length = -1;
412
goto decrypt_end;
200
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
201
*new_packet = realloc(*new_packet,
202
(unsigned int)new_packet_capacity
203
+ BUFFER_SIZE);
204
if (*new_packet == NULL){
205
perror("realloc");
206
return -1;
207
}
208
new_packet_capacity += BUFFER_SIZE;
413
209
}
414
210
415
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
211
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
416
212
BUFFER_SIZE);
417
213
/* Print the data, if any */
418
if(ret == 0){
419
/* EOF */
214
if (ret == 0){
420
215
break;
421
216
}
422
217
if(ret < 0){
423
perror_plus("gpgme_data_read");
424
plaintext_length = -1;
425
goto decrypt_end;
426
}
427
plaintext_length += ret;
428
}
429
430
if(debug){
431
fprintf(stderr, "Decrypted password is: ");
432
for(ssize_t i = 0; i < plaintext_length; i++){
433
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
434
}
435
fprintf(stderr, "\n");
436
}
437
438
decrypt_end:
439
440
/* Delete the GPGME cryptotext data buffer */
441
gpgme_data_release(dh_crypto);
218
perror("gpgme_data_read");
219
return -1;
220
}
221
new_packet_length += ret;
222
}
223
224
/* FIXME: check characters before printing to screen so to not print
225
terminal control characters */
226
/* if(debug){ */
227
/* fprintf(stderr, "decrypted password is: "); */
228
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
229
/* fprintf(stderr, "\n"); */
230
/* } */
442
231
443
232
/* Delete the GPGME plaintext data buffer */
444
233
gpgme_data_release(dh_plain);
445
return plaintext_length;
234
return new_packet_length;
446
235
}
447
236
448
static const char * safer_gnutls_strerror(int value){
449
const char *ret = gnutls_strerror(value); /* Spurious warning from
450
-Wunreachable-code */
451
if(ret == NULL)
237
static const char * safer_gnutls_strerror (int value) {
238
const char *ret = gnutls_strerror (value);
239
if (ret == NULL)
452
240
ret = "(unknown)";
453
241
return ret;
454
242
}
455
243
456
/* GnuTLS log function callback */
457
static void debuggnutls(__attribute__((unused)) int level,
458
const char* string){
459
fprintf(stderr, "GnuTLS: %s", string);
244
void debuggnutls(__attribute__((unused)) int level,
245
const char* string){
246
fprintf(stderr, "%s", string);
460
247
}
461
248
462
static int init_gnutls_global(const char *pubkeyfilename,
463
const char *seckeyfilename){
249
int initgnutls(encrypted_session *es){
250
const char *err;
464
251
int ret;
465
252
466
253
if(debug){
467
254
fprintf(stderr, "Initializing GnuTLS\n");
468
255
}
469
256
470
ret = gnutls_global_init();
471
if(ret != GNUTLS_E_SUCCESS){
472
fprintf(stderr, "GnuTLS global_init: %s\n",
473
safer_gnutls_strerror(ret));
257
if ((ret = gnutls_global_init ())
258
!= GNUTLS_E_SUCCESS) {
259
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
474
260
return -1;
475
261
}
476
477
if(debug){
478
/* "Use a log level over 10 to enable all debugging options."
479
* - GnuTLS manual
480
*/
262
263
if (debug){
481
264
gnutls_global_set_log_level(11);
482
265
gnutls_global_set_log_function(debuggnutls);
483
266
}
484
267
485
/* OpenPGP credentials */
486
ret = gnutls_certificate_allocate_credentials(&mc.cred);
487
if(ret != GNUTLS_E_SUCCESS){
488
fprintf(stderr, "GnuTLS memory error: %s\n",
489
safer_gnutls_strerror(ret));
490
gnutls_global_deinit();
268
/* openpgp credentials */
269
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
270
!= GNUTLS_E_SUCCESS) {
271
fprintf (stderr, "memory error: %s\n",
272
safer_gnutls_strerror(ret));
491
273
return -1;
492
274
}
493
275
494
276
if(debug){
495
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
496
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
497
seckeyfilename);
277
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
278
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
279
KEYFILE);
498
280
}
499
281
500
282
ret = gnutls_certificate_set_openpgp_key_file
501
(mc.cred, pubkeyfilename, seckeyfilename,
502
GNUTLS_OPENPGP_FMT_BASE64);
503
if(ret != GNUTLS_E_SUCCESS){
504
fprintf(stderr,
505
"Error[%d] while reading the OpenPGP key pair ('%s',"
506
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
507
fprintf(stderr, "The GnuTLS error is: %s\n",
508
safer_gnutls_strerror(ret));
509
goto globalfail;
510
}
511
512
/* GnuTLS server initialization */
513
ret = gnutls_dh_params_init(&mc.dh_params);
514
if(ret != GNUTLS_E_SUCCESS){
515
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
516
" %s\n", safer_gnutls_strerror(ret));
517
goto globalfail;
518
}
519
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
520
if(ret != GNUTLS_E_SUCCESS){
521
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
522
safer_gnutls_strerror(ret));
523
goto globalfail;
524
}
525
526
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
527
528
return 0;
529
530
globalfail:
531
532
gnutls_certificate_free_credentials(mc.cred);
533
gnutls_global_deinit();
534
gnutls_dh_params_deinit(mc.dh_params);
535
return -1;
536
}
537
538
static int init_gnutls_session(gnutls_session_t *session){
539
int ret;
540
/* GnuTLS session creation */
541
do {
542
ret = gnutls_init(session, GNUTLS_SERVER);
543
if(quit_now){
544
return -1;
545
}
546
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
547
if(ret != GNUTLS_E_SUCCESS){
283
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
284
if (ret != GNUTLS_E_SUCCESS) {
285
fprintf
286
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
287
" '%s')\n",
288
ret, CERTFILE, KEYFILE);
289
fprintf(stdout, "The Error is: %s\n",
290
safer_gnutls_strerror(ret));
291
return -1;
292
}
293
294
//GnuTLS server initialization
295
if ((ret = gnutls_dh_params_init (&es->dh_params))
296
!= GNUTLS_E_SUCCESS) {
297
fprintf (stderr, "Error in dh parameter initialization: %s\n",
298
safer_gnutls_strerror(ret));
299
return -1;
300
}
301
302
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
303
!= GNUTLS_E_SUCCESS) {
304
fprintf (stderr, "Error in prime generation: %s\n",
305
safer_gnutls_strerror(ret));
306
return -1;
307
}
308
309
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
310
311
// GnuTLS session creation
312
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
313
!= GNUTLS_E_SUCCESS){
548
314
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
549
315
safer_gnutls_strerror(ret));
550
316
}
551
317
552
{
553
const char *err;
554
do {
555
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
556
if(quit_now){
557
gnutls_deinit(*session);
558
return -1;
559
}
560
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
561
if(ret != GNUTLS_E_SUCCESS){
562
fprintf(stderr, "Syntax error at: %s\n", err);
563
fprintf(stderr, "GnuTLS error: %s\n",
564
safer_gnutls_strerror(ret));
565
gnutls_deinit(*session);
566
return -1;
567
}
318
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
319
!= GNUTLS_E_SUCCESS) {
320
fprintf(stderr, "Syntax error at: %s\n", err);
321
fprintf(stderr, "GnuTLS error: %s\n",
322
safer_gnutls_strerror(ret));
323
return -1;
568
324
}
569
325
570
do {
571
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
572
mc.cred);
573
if(quit_now){
574
gnutls_deinit(*session);
575
return -1;
576
}
577
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
578
if(ret != GNUTLS_E_SUCCESS){
579
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
326
if ((ret = gnutls_credentials_set
327
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
328
!= GNUTLS_E_SUCCESS) {
329
fprintf(stderr, "Error setting a credentials set: %s\n",
580
330
safer_gnutls_strerror(ret));
581
gnutls_deinit(*session);
582
331
return -1;
583
332
}
584
333
585
334
/* ignore client certificate if any. */
586
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
335
gnutls_certificate_server_set_request (es->session,
336
GNUTLS_CERT_IGNORE);
587
337
588
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
338
gnutls_dh_set_prime_bits (es->session, DH_BITS);
589
339
590
340
return 0;
591
341
}
592
342
593
/* Avahi log function callback */
594
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
595
__attribute__((unused)) const char *txt){}
343
void empty_log(__attribute__((unused)) AvahiLogLevel level,
344
__attribute__((unused)) const char *txt){}
596
345
597
/* Called when a Mandos server is found */
598
static int start_mandos_communication(const char *ip, uint16_t port,
599
AvahiIfIndex if_index,
600
int af){
601
int ret, tcp_sd = -1;
602
ssize_t sret;
603
union {
604
struct sockaddr_in in;
605
struct sockaddr_in6 in6;
606
} to;
346
int start_mandos_communication(const char *ip, uint16_t port,
347
unsigned int if_index){
348
int ret, tcp_sd;
349
struct sockaddr_in6 to;
350
encrypted_session es;
607
351
char *buffer = NULL;
608
char *decrypted_buffer = NULL;
352
char *decrypted_buffer;
609
353
size_t buffer_length = 0;
610
354
size_t buffer_capacity = 0;
611
size_t written;
612
int retval = -1;
613
gnutls_session_t session;
614
int pf; /* Protocol family */
615
616
errno = 0;
617
618
if(quit_now){
619
errno = EINTR;
620
return -1;
621
}
622
623
switch(af){
624
case AF_INET6:
625
pf = PF_INET6;
626
break;
627
case AF_INET:
628
pf = PF_INET;
629
break;
630
default:
631
fprintf(stderr, "Bad address family: %d\n", af);
632
errno = EINVAL;
633
return -1;
634
}
635
636
ret = init_gnutls_session(&session);
637
if(ret != 0){
638
return -1;
639
}
640
641
if(debug){
642
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
643
"\n", ip, port);
644
}
645
646
tcp_sd = socket(pf, SOCK_STREAM, 0);
647
if(tcp_sd < 0){
648
int e = errno;
649
perror_plus("socket");
650
errno = e;
651
goto mandos_end;
652
}
653
654
if(quit_now){
655
errno = EINTR;
656
goto mandos_end;
657
}
658
659
memset(&to, 0, sizeof(to));
660
if(af == AF_INET6){
661
to.in6.sin6_family = (sa_family_t)af;
662
ret = inet_pton(af, ip, &to.in6.sin6_addr);
663
} else { /* IPv4 */
664
to.in.sin_family = (sa_family_t)af;
665
ret = inet_pton(af, ip, &to.in.sin_addr);
666
}
667
if(ret < 0 ){
668
int e = errno;
669
perror_plus("inet_pton");
670
errno = e;
671
goto mandos_end;
672
}
355
ssize_t decrypted_buffer_size;
356
size_t written = 0;
357
int retval = 0;
358
char interface[IF_NAMESIZE];
359
360
if(debug){
361
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
362
}
363
364
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
365
if(tcp_sd < 0) {
366
perror("socket");
367
return -1;
368
}
369
370
if(if_indextoname(if_index, interface) == NULL){
371
if(debug){
372
perror("if_indextoname");
373
}
374
return -1;
375
}
376
377
if(debug){
378
fprintf(stderr, "Binding to interface %s\n", interface);
379
}
380
381
memset(&to,0,sizeof(to)); /* Spurious warning */
382
to.sin6_family = AF_INET6;
383
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
384
if (ret < 0 ){
385
perror("inet_pton");
386
return -1;
387
}
673
388
if(ret == 0){
674
int e = errno;
675
389
fprintf(stderr, "Bad address: %s\n", ip);
676
errno = e;
677
goto mandos_end;
678
}
679
if(af == AF_INET6){
680
to.in6.sin6_port = htons(port); /* Spurious warnings from
681
-Wconversion and
682
-Wunreachable-code */
683
684
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
685
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
686
-Wunreachable-code*/
687
if(if_index == AVAHI_IF_UNSPEC){
688
fprintf(stderr, "An IPv6 link-local address is incomplete"
689
" without a network interface\n");
690
errno = EINVAL;
691
goto mandos_end;
692
}
693
/* Set the network interface number as scope */
694
to.in6.sin6_scope_id = (uint32_t)if_index;
695
}
696
} else {
697
to.in.sin_port = htons(port); /* Spurious warnings from
698
-Wconversion and
699
-Wunreachable-code */
700
}
390
return -1;
391
}
392
to.sin6_port = htons(port); /* Spurious warning */
701
393
702
if(quit_now){
703
errno = EINTR;
704
goto mandos_end;
705
}
394
to.sin6_scope_id = (uint32_t)if_index;
706
395
707
396
if(debug){
708
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
709
char interface[IF_NAMESIZE];
710
if(if_indextoname((unsigned int)if_index, interface) == NULL){
711
perror_plus("if_indextoname");
712
} else {
713
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
714
ip, interface, port);
715
}
716
} else {
717
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
718
port);
719
}
720
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
721
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
722
const char *pcret;
723
if(af == AF_INET6){
724
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
725
sizeof(addrstr));
726
} else {
727
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
728
sizeof(addrstr));
729
}
730
if(pcret == NULL){
731
perror_plus("inet_ntop");
732
} else {
733
if(strcmp(addrstr, ip) != 0){
734
fprintf(stderr, "Canonical address form: %s\n", addrstr);
735
}
736
}
737
}
738
739
if(quit_now){
740
errno = EINTR;
741
goto mandos_end;
742
}
743
744
if(af == AF_INET6){
745
ret = connect(tcp_sd, &to.in6, sizeof(to));
746
} else {
747
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
748
}
749
if(ret < 0){
750
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
751
int e = errno;
752
perror_plus("connect");
753
errno = e;
754
}
755
goto mandos_end;
756
}
757
758
if(quit_now){
759
errno = EINTR;
760
goto mandos_end;
761
}
762
763
const char *out = mandos_protocol_version;
764
written = 0;
765
while(true){
766
size_t out_size = strlen(out);
767
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
768
out_size - written));
769
if(ret == -1){
770
int e = errno;
771
perror_plus("write");
772
errno = e;
773
goto mandos_end;
774
}
775
written += (size_t)ret;
776
if(written < out_size){
777
continue;
778
} else {
779
if(out == mandos_protocol_version){
780
written = 0;
781
out = "\r\n";
782
} else {
783
break;
784
}
785
}
786
787
if(quit_now){
788
errno = EINTR;
789
goto mandos_end;
790
}
791
}
397
fprintf(stderr, "Connection to: %s\n", ip);
398
}
399
400
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
401
if (ret < 0){
402
perror("connect");
403
return -1;
404
}
405
406
ret = initgnutls (&es);
407
if (ret != 0){
408
retval = -1;
409
return -1;
410
}
411
412
gnutls_transport_set_ptr (es.session,
413
(gnutls_transport_ptr_t) tcp_sd);
792
414
793
415
if(debug){
794
416
fprintf(stderr, "Establishing TLS session with %s\n", ip);
795
417
}
796
418
797
if(quit_now){
798
errno = EINTR;
799
goto mandos_end;
800
}
801
802
/* Spurious warning from -Wint-to-pointer-cast */
803
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
804
805
if(quit_now){
806
errno = EINTR;
807
goto mandos_end;
808
}
809
810
do {
811
ret = gnutls_handshake(session);
812
if(quit_now){
813
errno = EINTR;
814
goto mandos_end;
815
}
816
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
817
818
if(ret != GNUTLS_E_SUCCESS){
419
ret = gnutls_handshake (es.session);
420
421
if (ret != GNUTLS_E_SUCCESS){
819
422
if(debug){
820
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
821
gnutls_perror(ret);
423
fprintf(stderr, "\n*** Handshake failed ***\n");
424
gnutls_perror (ret);
822
425
}
823
errno = EPROTO;
824
goto mandos_end;
426
retval = -1;
427
goto exit;
825
428
}
826
429
827
/* Read OpenPGP packet that contains the wanted password */
430
//Retrieve OpenPGP packet that contains the wanted password
828
431
829
432
if(debug){
830
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
433
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
831
434
ip);
832
435
}
833
436
834
437
while(true){
835
836
if(quit_now){
837
errno = EINTR;
838
goto mandos_end;
839
}
840
841
buffer_capacity = incbuffer(&buffer, buffer_length,
842
buffer_capacity);
843
if(buffer_capacity == 0){
844
int e = errno;
845
perror_plus("incbuffer");
846
errno = e;
847
goto mandos_end;
848
}
849
850
if(quit_now){
851
errno = EINTR;
852
goto mandos_end;
853
}
854
855
sret = gnutls_record_recv(session, buffer+buffer_length,
856
BUFFER_SIZE);
857
if(sret == 0){
438
if (buffer_length + BUFFER_SIZE > buffer_capacity){
439
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
440
if (buffer == NULL){
441
perror("realloc");
442
goto exit;
443
}
444
buffer_capacity += BUFFER_SIZE;
445
}
446
447
ret = gnutls_record_recv
448
(es.session, buffer+buffer_length, BUFFER_SIZE);
449
if (ret == 0){
858
450
break;
859
451
}
860
if(sret < 0){
861
switch(sret){
452
if (ret < 0){
453
switch(ret){
862
454
case GNUTLS_E_INTERRUPTED:
863
455
case GNUTLS_E_AGAIN:
864
456
break;
865
457
case GNUTLS_E_REHANDSHAKE:
866
do {
867
ret = gnutls_handshake(session);
868
869
if(quit_now){
870
errno = EINTR;
871
goto mandos_end;
872
}
873
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
874
if(ret < 0){
875
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
876
gnutls_perror(ret);
877
errno = EPROTO;
878
goto mandos_end;
458
ret = gnutls_handshake (es.session);
459
if (ret < 0){
460
fprintf(stderr, "\n*** Handshake failed ***\n");
461
gnutls_perror (ret);
462
retval = -1;
463
goto exit;
879
464
}
880
465
break;
881
466
default:
882
467
fprintf(stderr, "Unknown error while reading data from"
883
" encrypted session with Mandos server\n");
884
gnutls_bye(session, GNUTLS_SHUT_RDWR);
885
errno = EIO;
886
goto mandos_end;
468
" encrypted session with mandos server\n");
469
retval = -1;
470
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
471
goto exit;
887
472
}
888
473
} else {
889
buffer_length += (size_t) sret;
890
}
891
}
892
893
if(debug){
894
fprintf(stderr, "Closing TLS session\n");
895
}
896
897
if(quit_now){
898
errno = EINTR;
899
goto mandos_end;
900
}
901
902
do {
903
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
904
if(quit_now){
905
errno = EINTR;
906
goto mandos_end;
907
}
908
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
909
910
if(buffer_length > 0){
911
ssize_t decrypted_buffer_size;
474
buffer_length += (size_t) ret;
475
}
476
}
477
478
if (buffer_length > 0){
912
479
decrypted_buffer_size = pgp_packet_decrypt(buffer,
913
480
buffer_length,
914
&decrypted_buffer);
915
if(decrypted_buffer_size >= 0){
916
917
written = 0;
918
while(written < (size_t) decrypted_buffer_size){
919
if(quit_now){
920
errno = EINTR;
921
goto mandos_end;
922
}
923
924
ret = (int)fwrite(decrypted_buffer + written, 1,
925
(size_t)decrypted_buffer_size - written,
926
stdout);
481
&decrypted_buffer,
482
CERT_ROOT);
483
if (decrypted_buffer_size >= 0){
484
while(written < decrypted_buffer_size){
485
ret = (int)fwrite (decrypted_buffer + written, 1,
486
(size_t)decrypted_buffer_size - written,
487
stdout);
927
488
if(ret == 0 and ferror(stdout)){
928
int e = errno;
929
489
if(debug){
930
490
fprintf(stderr, "Error writing encrypted data: %s\n",
931
491
strerror(errno));
932
492
}
933
errno = e;
934
goto mandos_end;
493
retval = -1;
494
break;
935
495
}
936
496
written += (size_t)ret;
937
497
}
938
retval = 0;
939
}
940
}
941
942
/* Shutdown procedure */
943
944
mandos_end:
945
{
946
int e = errno;
947
free(decrypted_buffer);
948
free(buffer);
949
if(tcp_sd >= 0){
950
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
951
}
952
if(ret == -1){
953
if(e == 0){
954
e = errno;
955
}
956
perror_plus("close");
957
}
958
gnutls_deinit(session);
959
errno = e;
960
if(quit_now){
961
errno = EINTR;
498
free(decrypted_buffer);
499
} else {
962
500
retval = -1;
963
501
}
964
502
}
503
504
//shutdown procedure
505
506
if(debug){
507
fprintf(stderr, "Closing TLS session\n");
508
}
509
510
free(buffer);
511
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
512
exit:
513
close(tcp_sd);
514
gnutls_deinit (es.session);
515
gnutls_certificate_free_credentials (es.cred);
516
gnutls_global_deinit ();
965
517
return retval;
966
518
}
967
519
968
static void resolve_callback(AvahiSServiceResolver *r,
969
AvahiIfIndex interface,
970
AvahiProtocol proto,
971
AvahiResolverEvent event,
972
const char *name,
973
const char *type,
974
const char *domain,
975
const char *host_name,
976
const AvahiAddress *address,
977
uint16_t port,
978
AVAHI_GCC_UNUSED AvahiStringList *txt,
979
AVAHI_GCC_UNUSED AvahiLookupResultFlags
980
flags,
981
AVAHI_GCC_UNUSED void* userdata){
982
assert(r);
520
static AvahiSimplePoll *simple_poll = NULL;
521
static AvahiServer *server = NULL;
522
523
static void resolve_callback(
524
AvahiSServiceResolver *r,
525
AvahiIfIndex interface,
526
AVAHI_GCC_UNUSED AvahiProtocol protocol,
527
AvahiResolverEvent event,
528
const char *name,
529
const char *type,
530
const char *domain,
531
const char *host_name,
532
const AvahiAddress *address,
533
uint16_t port,
534
AVAHI_GCC_UNUSED AvahiStringList *txt,
535
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
536
AVAHI_GCC_UNUSED void* userdata) {
537
538
assert(r); /* Spurious warning */
983
539
984
540
/* Called whenever a service has been resolved successfully or
985
541
timed out */
986
542
987
if(quit_now){
988
return;
989
}
990
991
switch(event){
543
switch (event) {
992
544
default:
993
545
case AVAHI_RESOLVER_FAILURE:
994
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
995
" of type '%s' in domain '%s': %s\n", name, type, domain,
996
avahi_strerror(avahi_server_errno(mc.server)));
546
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
547
" type '%s' in domain '%s': %s\n", name, type, domain,
548
avahi_strerror(avahi_server_errno(server)));
997
549
break;
998
550
999
551
case AVAHI_RESOLVER_FOUND:
1001
553
char ip[AVAHI_ADDRESS_STR_MAX];
1002
554
avahi_address_snprint(ip, sizeof(ip), address);
1003
555
if(debug){
1004
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
1005
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
1006
ip, (intmax_t)interface, port);
556
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
557
" port %d\n", name, host_name, ip, port);
1007
558
}
1008
int ret = start_mandos_communication(ip, port, interface,
1009
avahi_proto_to_af(proto));
1010
if(ret == 0){
1011
avahi_simple_poll_quit(mc.simple_poll);
1012
} else {
1013
ret = add_server(ip, port, interface,
1014
avahi_proto_to_af(proto));
559
int ret = start_mandos_communication(ip, port,
560
(unsigned int) interface);
561
if (ret == 0){
562
exit(EXIT_SUCCESS);
1015
563
}
1016
564
}
1017
565
}
1018
566
avahi_s_service_resolver_free(r);
1019
567
}
1020
568
1021
static void browse_callback(AvahiSServiceBrowser *b,
1022
AvahiIfIndex interface,
1023
AvahiProtocol protocol,
1024
AvahiBrowserEvent event,
1025
const char *name,
1026
const char *type,
1027
const char *domain,
1028
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1029
flags,
1030
AVAHI_GCC_UNUSED void* userdata){
1031
assert(b);
1032
1033
/* Called whenever a new services becomes available on the LAN or
1034
is removed from the LAN */
1035
1036
if(quit_now){
1037
return;
1038
}
1039
1040
switch(event){
1041
default:
1042
case AVAHI_BROWSER_FAILURE:
1043
1044
fprintf(stderr, "(Avahi browser) %s\n",
1045
avahi_strerror(avahi_server_errno(mc.server)));
1046
avahi_simple_poll_quit(mc.simple_poll);
1047
return;
1048
1049
case AVAHI_BROWSER_NEW:
1050
/* We ignore the returned Avahi resolver object. In the callback
1051
function we free it. If the Avahi server is terminated before
1052
the callback function is called the Avahi server will free the
1053
resolver for us. */
1054
1055
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1056
name, type, domain, protocol, 0,
1057
resolve_callback, NULL) == NULL)
1058
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
1059
name, avahi_strerror(avahi_server_errno(mc.server)));
1060
break;
1061
1062
case AVAHI_BROWSER_REMOVE:
1063
break;
1064
1065
case AVAHI_BROWSER_ALL_FOR_NOW:
1066
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1067
if(debug){
1068
fprintf(stderr, "No Mandos server found, still searching...\n");
1069
}
1070
break;
1071
}
1072
}
1073
1074
/* Signal handler that stops main loop after SIGTERM */
1075
static void handle_sigterm(int sig){
1076
if(quit_now){
1077
return;
1078
}
1079
quit_now = 1;
1080
signal_received = sig;
1081
int old_errno = errno;
1082
/* set main loop to exit */
1083
if(mc.simple_poll != NULL){
1084
avahi_simple_poll_quit(mc.simple_poll);
1085
}
1086
errno = old_errno;
1087
}
1088
1089
bool get_flags(const char *ifname, struct ifreq *ifr){
1090
int ret;
1091
1092
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1093
if(s < 0){
1094
perror_plus("socket");
1095
return false;
1096
}
1097
strcpy(ifr->ifr_name, ifname);
1098
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1099
if(ret == -1){
1100
if(debug){
1101
perror_plus("ioctl SIOCGIFFLAGS");
1102
}
1103
return false;
1104
}
1105
return true;
1106
}
1107
1108
bool good_flags(const char *ifname, const struct ifreq *ifr){
1109
1110
/* Reject the loopback device */
1111
if(ifr->ifr_flags & IFF_LOOPBACK){
1112
if(debug){
1113
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1114
ifname);
1115
}
1116
return false;
1117
}
1118
/* Accept point-to-point devices only if connect_to is specified */
1119
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1120
if(debug){
1121
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1122
ifname);
1123
}
1124
return true;
1125
}
1126
/* Otherwise, reject non-broadcast-capable devices */
1127
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1128
if(debug){
1129
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1130
ifname);
1131
}
1132
return false;
1133
}
1134
/* Reject non-ARP interfaces (including dummy interfaces) */
1135
if(ifr->ifr_flags & IFF_NOARP){
1136
if(debug){
1137
fprintf(stderr, "Rejecting non-ARP interface \"%s\"\n", ifname);
1138
}
1139
return false;
1140
}
1141
1142
/* Accept this device */
1143
if(debug){
1144
fprintf(stderr, "Interface \"%s\" is good\n", ifname);
1145
}
1146
return true;
1147
}
1148
1149
/*
1150
* This function determines if a directory entry in /sys/class/net
1151
* corresponds to an acceptable network device.
1152
* (This function is passed to scandir(3) as a filter function.)
1153
*/
1154
int good_interface(const struct dirent *if_entry){
1155
if(if_entry->d_name[0] == '.'){
1156
return 0;
1157
}
1158
1159
struct ifreq ifr;
1160
if(not get_flags(if_entry->d_name, &ifr)){
1161
if(debug){
1162
fprintf(stderr, "Failed to get flags for interface \"%s\"\n",
1163
if_entry->d_name);
1164
}
1165
return 0;
1166
}
1167
1168
if(not good_flags(if_entry->d_name, &ifr)){
1169
return 0;
1170
}
1171
return 1;
1172
}
1173
1174
/*
1175
* This function determines if a directory entry in /sys/class/net
1176
* corresponds to an acceptable network device which is up.
1177
* (This function is passed to scandir(3) as a filter function.)
1178
*/
1179
int up_interface(const struct dirent *if_entry){
1180
if(if_entry->d_name[0] == '.'){
1181
return 0;
1182
}
1183
1184
struct ifreq ifr;
1185
if(not get_flags(if_entry->d_name, &ifr)){
1186
if(debug){
1187
fprintf(stderr, "Failed to get flags for interface \"%s\"\n",
1188
if_entry->d_name);
1189
}
1190
return 0;
1191
}
1192
1193
/* Reject down interfaces */
1194
if(not (ifr.ifr_flags & IFF_UP)){
1195
if(debug){
1196
fprintf(stderr, "Rejecting down interface \"%s\"\n",
1197
if_entry->d_name);
1198
}
1199
return 0;
1200
}
1201
1202
/* Reject non-running interfaces */
1203
if(not (ifr.ifr_flags & IFF_RUNNING)){
1204
if(debug){
1205
fprintf(stderr, "Rejecting non-running interface \"%s\"\n",
1206
if_entry->d_name);
1207
}
1208
return 0;
1209
}
1210
1211
if(not good_flags(if_entry->d_name, &ifr)){
1212
return 0;
1213
}
1214
return 1;
1215
}
1216
1217
int notdotentries(const struct dirent *direntry){
1218
/* Skip "." and ".." */
1219
if(direntry->d_name[0] == '.'
1220
and (direntry->d_name[1] == '\0'
1221
or (direntry->d_name[1] == '.'
1222
and direntry->d_name[2] == '\0'))){
1223
return 0;
1224
}
1225
return 1;
1226
}
1227
1228
/* Is this directory entry a runnable program? */
1229
int runnable_hook(const struct dirent *direntry){
1230
int ret;
1231
struct stat st;
1232
1233
if((direntry->d_name)[0] == '\0'){
1234
/* Empty name? */
1235
return 0;
1236
}
1237
1238
/* Save pointer to last character */
1239
char *end = strchr(direntry->d_name, '\0')-1;
1240
1241
if(*end == '~'){
1242
/* Backup name~ */
1243
return 0;
1244
}
1245
1246
if(((direntry->d_name)[0] == '#')
1247
and (*end == '#')){
1248
/* Temporary #name# */
1249
return 0;
1250
}
1251
1252
/* XXX more rules here */
1253
1254
ret = stat(direntry->d_name, &st);
1255
if(ret == -1){
1256
if(debug){
1257
perror_plus("Could not stat plugin");
1258
}
1259
return 0;
1260
}
1261
if(not (S_ISREG(st.st_mode))){
1262
/* Not a regular file */
1263
return 0;
1264
}
1265
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1266
/* Not executable */
1267
return 0;
1268
}
1269
return 1;
1270
}
1271
1272
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1273
int ret;
1274
struct timespec now;
1275
struct timespec waited_time;
1276
intmax_t block_time;
1277
1278
while(true){
1279
if(mc.current_server == NULL){
1280
if (debug){
1281
fprintf(stderr,
1282
"Wait until first server is found. No timeout!\n");
1283
}
1284
ret = avahi_simple_poll_iterate(s, -1);
1285
} else {
1286
if (debug){
1287
fprintf(stderr, "Check current_server if we should run it,"
1288
" or wait\n");
1289
}
1290
/* the current time */
1291
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1292
if(ret == -1){
1293
perror_plus("clock_gettime");
1294
return -1;
1295
}
1296
/* Calculating in ms how long time between now and server
1297
who we visted longest time ago. Now - last seen. */
1298
waited_time.tv_sec = (now.tv_sec
1299
- mc.current_server->last_seen.tv_sec);
1300
waited_time.tv_nsec = (now.tv_nsec
1301
- mc.current_server->last_seen.tv_nsec);
1302
/* total time is 10s/10,000ms.
1303
Converting to s from ms by dividing by 1,000,
1304
and ns to ms by dividing by 1,000,000. */
1305
block_time = ((retry_interval
1306
- ((intmax_t)waited_time.tv_sec * 1000))
1307
- ((intmax_t)waited_time.tv_nsec / 1000000));
1308
1309
if (debug){
1310
fprintf(stderr, "Blocking for %" PRIdMAX " ms\n", block_time);
1311
}
1312
1313
if(block_time <= 0){
1314
ret = start_mandos_communication(mc.current_server->ip,
1315
mc.current_server->port,
1316
mc.current_server->if_index,
1317
mc.current_server->af);
1318
if(ret == 0){
1319
avahi_simple_poll_quit(mc.simple_poll);
1320
return 0;
1321
}
1322
ret = clock_gettime(CLOCK_MONOTONIC,
1323
&mc.current_server->last_seen);
1324
if(ret == -1){
1325
perror_plus("clock_gettime");
1326
return -1;
1327
}
1328
mc.current_server = mc.current_server->next;
1329
block_time = 0; /* Call avahi to find new Mandos
1330
servers, but don't block */
1331
}
1332
1333
ret = avahi_simple_poll_iterate(s, (int)block_time);
1334
}
1335
if(ret != 0){
1336
if (ret > 0 or errno != EINTR) {
1337
return (ret != 1) ? ret : 0;
1338
}
1339
}
1340
}
1341
}
1342
1343
int main(int argc, char *argv[]){
1344
AvahiSServiceBrowser *sb = NULL;
1345
int error;
1346
int ret;
1347
intmax_t tmpmax;
1348
char *tmp;
1349
int exitcode = EXIT_SUCCESS;
1350
const char *interface = "";
1351
struct ifreq network;
1352
int sd = -1;
1353
bool take_down_interface = false;
1354
uid_t uid;
1355
gid_t gid;
1356
char tempdir[] = "/tmp/mandosXXXXXX";
1357
bool tempdir_created = false;
1358
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1359
const char *seckey = PATHDIR "/" SECKEY;
1360
const char *pubkey = PATHDIR "/" PUBKEY;
1361
1362
bool gnutls_initialized = false;
1363
bool gpgme_initialized = false;
1364
float delay = 2.5f;
1365
double retry_interval = 10; /* 10s between trying a server and
1366
retrying the same server again */
1367
1368
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1369
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1370
1371
uid = getuid();
1372
gid = getgid();
1373
1374
/* Lower any group privileges we might have, just to be safe */
1375
errno = 0;
1376
ret = setgid(gid);
1377
if(ret == -1){
1378
perror_plus("setgid");
1379
}
1380
1381
/* Lower user privileges (temporarily) */
1382
errno = 0;
1383
ret = seteuid(uid);
1384
if(ret == -1){
1385
perror_plus("seteuid");
1386
}
1387
1388
if(quit_now){
1389
goto end;
1390
}
1391
1392
{
1393
struct argp_option options[] = {
1394
{ .name = "debug", .key = 128,
1395
.doc = "Debug mode", .group = 3 },
1396
{ .name = "connect", .key = 'c',
1397
.arg = "ADDRESS:PORT",
1398
.doc = "Connect directly to a specific Mandos server",
1399
.group = 1 },
1400
{ .name = "interface", .key = 'i',
1401
.arg = "NAME",
1402
.doc = "Network interface that will be used to search for"
1403
" Mandos servers",
1404
.group = 1 },
1405
{ .name = "seckey", .key = 's',
1406
.arg = "FILE",
1407
.doc = "OpenPGP secret key file base name",
1408
.group = 1 },
1409
{ .name = "pubkey", .key = 'p',
1410
.arg = "FILE",
1411
.doc = "OpenPGP public key file base name",
1412
.group = 2 },
1413
{ .name = "dh-bits", .key = 129,
1414
.arg = "BITS",
1415
.doc = "Bit length of the prime number used in the"
1416
" Diffie-Hellman key exchange",
1417
.group = 2 },
1418
{ .name = "priority", .key = 130,
1419
.arg = "STRING",
1420
.doc = "GnuTLS priority string for the TLS handshake",
1421
.group = 1 },
1422
{ .name = "delay", .key = 131,
1423
.arg = "SECONDS",
1424
.doc = "Maximum delay to wait for interface startup",
1425
.group = 2 },
1426
{ .name = "retry", .key = 132,
1427
.arg = "SECONDS",
1428
.doc = "Retry interval used when denied by the mandos server",
1429
.group = 2 },
1430
/*
1431
* These reproduce what we would get without ARGP_NO_HELP
1432
*/
1433
{ .name = "help", .key = '?',
1434
.doc = "Give this help list", .group = -1 },
1435
{ .name = "usage", .key = -3,
1436
.doc = "Give a short usage message", .group = -1 },
1437
{ .name = "version", .key = 'V',
1438
.doc = "Print program version", .group = -1 },
1439
{ .name = NULL }
1440
};
1441
1442
error_t parse_opt(int key, char *arg,
1443
struct argp_state *state){
1444
errno = 0;
1445
switch(key){
1446
case 128: /* --debug */
1447
debug = true;
1448
break;
1449
case 'c': /* --connect */
1450
connect_to = arg;
1451
break;
1452
case 'i': /* --interface */
1453
interface = arg;
1454
break;
1455
case 's': /* --seckey */
1456
seckey = arg;
1457
break;
1458
case 'p': /* --pubkey */
1459
pubkey = arg;
1460
break;
1461
case 129: /* --dh-bits */
1462
errno = 0;
1463
tmpmax = strtoimax(arg, &tmp, 10);
1464
if(errno != 0 or tmp == arg or *tmp != '\0'
1465
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1466
argp_error(state, "Bad number of DH bits");
1467
}
1468
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1469
break;
1470
case 130: /* --priority */
1471
mc.priority = arg;
1472
break;
1473
case 131: /* --delay */
1474
errno = 0;
1475
delay = strtof(arg, &tmp);
1476
if(errno != 0 or tmp == arg or *tmp != '\0'){
1477
argp_error(state, "Bad delay");
1478
}
1479
case 132: /* --retry */
1480
errno = 0;
1481
retry_interval = strtod(arg, &tmp);
1482
if(errno != 0 or tmp == arg or *tmp != '\0'
1483
or (retry_interval * 1000) > INT_MAX
1484
or retry_interval < 0){
1485
argp_error(state, "Bad retry interval");
1486
}
1487
break;
1488
/*
1489
* These reproduce what we would get without ARGP_NO_HELP
1490
*/
1491
case '?': /* --help */
1492
argp_state_help(state, state->out_stream,
1493
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1494
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1495
case -3: /* --usage */
1496
argp_state_help(state, state->out_stream,
1497
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1498
case 'V': /* --version */
1499
fprintf(state->out_stream, "%s\n", argp_program_version);
1500
exit(argp_err_exit_status);
1501
break;
1502
default:
1503
return ARGP_ERR_UNKNOWN;
1504
}
1505
return errno;
1506
}
1507
1508
struct argp argp = { .options = options, .parser = parse_opt,
1509
.args_doc = "",
1510
.doc = "Mandos client -- Get and decrypt"
1511
" passwords from a Mandos server" };
1512
ret = argp_parse(&argp, argc, argv,
1513
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1514
switch(ret){
1515
case 0:
1516
break;
1517
case ENOMEM:
569
static void browse_callback(
570
AvahiSServiceBrowser *b,
571
AvahiIfIndex interface,
572
AvahiProtocol protocol,
573
AvahiBrowserEvent event,
574
const char *name,
575
const char *type,
576
const char *domain,
577
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
578
void* userdata) {
579
580
AvahiServer *s = userdata;
581
assert(b); /* Spurious warning */
582
583
/* Called whenever a new services becomes available on the LAN or
584
is removed from the LAN */
585
586
switch (event) {
1518
587
default:
1519
errno = ret;
1520
perror_plus("argp_parse");
1521
exitcode = EX_OSERR;
1522
goto end;
1523
case EINVAL:
1524
exitcode = EX_USAGE;
1525
goto end;
1526
}
1527
}
1528
1529
{
1530
/* Work around Debian bug #633582:
1531
<http://bugs.debian.org/633582> */
1532
struct stat st;
1533
1534
/* Re-raise priviliges */
1535
errno = 0;
1536
ret = seteuid(0);
1537
if(ret == -1){
1538
perror_plus("seteuid");
1539
}
1540
1541
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1542
int seckey_fd = open(seckey, O_RDONLY);
1543
if(seckey_fd == -1){
1544
perror_plus("open");
1545
} else {
1546
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1547
if(ret == -1){
1548
perror_plus("fstat");
1549
} else {
1550
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1551
ret = fchown(seckey_fd, uid, gid);
1552
if(ret == -1){
1553
perror_plus("fchown");
1554
}
1555
}
1556
}
1557
TEMP_FAILURE_RETRY(close(seckey_fd));
1558
}
1559
}
1560
1561
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1562
int pubkey_fd = open(pubkey, O_RDONLY);
1563
if(pubkey_fd == -1){
1564
perror_plus("open");
1565
} else {
1566
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1567
if(ret == -1){
1568
perror_plus("fstat");
1569
} else {
1570
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1571
ret = fchown(pubkey_fd, uid, gid);
1572
if(ret == -1){
1573
perror_plus("fchown");
1574
}
1575
}
1576
}
1577
TEMP_FAILURE_RETRY(close(pubkey_fd));
1578
}
1579
}
1580
1581
/* Lower privileges */
1582
errno = 0;
1583
ret = seteuid(uid);
1584
if(ret == -1){
1585
perror_plus("seteuid");
1586
}
1587
}
1588
1589
/* Find network hooks and run them */
1590
{
1591
struct dirent **direntries;
1592
struct dirent *direntry;
1593
int numhooks = scandir(HOOKDIR, &direntries, runnable_hook,
1594
alphasort);
1595
int devnull = open("/dev/null", O_RDONLY);
1596
for(int i = 0; i < numhooks; i++){
1597
direntry = direntries[0];
1598
char *fullname = NULL;
1599
ret = asprintf(&fullname, "%s/%s", tempdir,
1600
direntry->d_name);
1601
if(ret < 0){
1602
perror_plus("asprintf");
1603
continue;
1604
}
1605
pid_t hook_pid = fork();
1606
if(hook_pid == 0){
1607
/* Child */
1608
dup2(devnull, STDIN_FILENO);
1609
close(devnull);
1610
dup2(STDERR_FILENO, STDOUT_FILENO);
1611
ret = setenv("DEVICE", interface, 1);
1612
if(ret == -1){
1613
perror_plus("setenv");
1614
exit(1);
1615
}
1616
ret = setenv("VERBOSE", debug ? "1" : "0", 1);
1617
if(ret == -1){
1618
perror_plus("setenv");
1619
exit(1);
1620
}
1621
ret = setenv("MODE", "start", 1);
1622
if(ret == -1){
1623
perror_plus("setenv");
1624
exit(1);
1625
}
1626
char *delaystring;
1627
ret = asprintf(&delaystring, "%f", delay);
1628
if(ret == -1){
1629
perror_plus("asprintf");
1630
exit(1);
1631
}
1632
ret = setenv("DELAY", delaystring, 1);
1633
if(ret == -1){
1634
free(delaystring);
1635
perror_plus("setenv");
1636
exit(1);
1637
}
1638
free(delaystring);
1639
ret = execl(fullname, direntry->d_name, "start", NULL);
1640
perror_plus("execl");
1641
}
1642
free(fullname);
1643
if(quit_now){
1644
goto end;
1645
}
1646
}
1647
close(devnull);
1648
}
1649
1650
if(not debug){
1651
avahi_set_log_function(empty_log);
1652
}
1653
1654
if(interface[0] == '\0'){
1655
struct dirent **direntries;
1656
/* First look for interfaces that are up */
1657
ret = scandir(sys_class_net, &direntries, up_interface,
1658
alphasort);
1659
if(ret == 0){
1660
/* No up interfaces, look for any good interfaces */
1661
free(direntries);
1662
ret = scandir(sys_class_net, &direntries, good_interface,
1663
alphasort);
1664
}
1665
if(ret >= 1){
1666
/* Pick the first interface returned */
1667
interface = strdup(direntries[0]->d_name);
1668
if(debug){
1669
fprintf(stderr, "Using interface \"%s\"\n", interface);
1670
}
1671
if(interface == NULL){
1672
perror_plus("malloc");
1673
free(direntries);
1674
exitcode = EXIT_FAILURE;
1675
goto end;
1676
}
1677
free(direntries);
1678
} else {
1679
free(direntries);
1680
fprintf(stderr, "Could not find a network interface\n");
1681
exitcode = EXIT_FAILURE;
1682
goto end;
1683
}
1684
}
1685
1686
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1687
from the signal handler */
1688
/* Initialize the pseudo-RNG for Avahi */
1689
srand((unsigned int) time(NULL));
1690
mc.simple_poll = avahi_simple_poll_new();
1691
if(mc.simple_poll == NULL){
1692
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1693
exitcode = EX_UNAVAILABLE;
1694
goto end;
1695
}
1696
1697
sigemptyset(&sigterm_action.sa_mask);
1698
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1699
if(ret == -1){
1700
perror_plus("sigaddset");
1701
exitcode = EX_OSERR;
1702
goto end;
1703
}
1704
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1705
if(ret == -1){
1706
perror_plus("sigaddset");
1707
exitcode = EX_OSERR;
1708
goto end;
1709
}
1710
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1711
if(ret == -1){
1712
perror_plus("sigaddset");
1713
exitcode = EX_OSERR;
1714
goto end;
1715
}
1716
/* Need to check if the handler is SIG_IGN before handling:
1717
| [[info:libc:Initial Signal Actions]] |
1718
| [[info:libc:Basic Signal Handling]] |
1719
*/
1720
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1721
if(ret == -1){
1722
perror_plus("sigaction");
1723
return EX_OSERR;
1724
}
1725
if(old_sigterm_action.sa_handler != SIG_IGN){
1726
ret = sigaction(SIGINT, &sigterm_action, NULL);
1727
if(ret == -1){
1728
perror_plus("sigaction");
1729
exitcode = EX_OSERR;
1730
goto end;
1731
}
1732
}
1733
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1734
if(ret == -1){
1735
perror_plus("sigaction");
1736
return EX_OSERR;
1737
}
1738
if(old_sigterm_action.sa_handler != SIG_IGN){
1739
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1740
if(ret == -1){
1741
perror_plus("sigaction");
1742
exitcode = EX_OSERR;
1743
goto end;
1744
}
1745
}
1746
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1747
if(ret == -1){
1748
perror_plus("sigaction");
1749
return EX_OSERR;
1750
}
1751
if(old_sigterm_action.sa_handler != SIG_IGN){
1752
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1753
if(ret == -1){
1754
perror_plus("sigaction");
1755
exitcode = EX_OSERR;
1756
goto end;
1757
}
1758
}
1759
1760
/* If the interface is down, bring it up */
1761
if(strcmp(interface, "none") != 0){
1762
if_index = (AvahiIfIndex) if_nametoindex(interface);
1763
if(if_index == 0){
1764
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1765
exitcode = EX_UNAVAILABLE;
1766
goto end;
1767
}
1768
1769
if(quit_now){
1770
goto end;
1771
}
1772
1773
/* Re-raise priviliges */
1774
errno = 0;
1775
ret = seteuid(0);
1776
if(ret == -1){
1777
perror_plus("seteuid");
1778
}
1779
1780
#ifdef __linux__
1781
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1782
messages about the network interface to mess up the prompt */
1783
ret = klogctl(8, NULL, 5);
1784
bool restore_loglevel = true;
1785
if(ret == -1){
1786
restore_loglevel = false;
1787
perror_plus("klogctl");
1788
}
1789
#endif /* __linux__ */
1790
1791
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1792
if(sd < 0){
1793
perror_plus("socket");
1794
exitcode = EX_OSERR;
1795
#ifdef __linux__
1796
if(restore_loglevel){
1797
ret = klogctl(7, NULL, 0);
1798
if(ret == -1){
1799
perror_plus("klogctl");
1800
}
1801
}
1802
#endif /* __linux__ */
1803
/* Lower privileges */
1804
errno = 0;
1805
ret = seteuid(uid);
1806
if(ret == -1){
1807
perror_plus("seteuid");
1808
}
1809
goto end;
1810
}
1811
strcpy(network.ifr_name, interface);
1812
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1813
if(ret == -1){
1814
perror_plus("ioctl SIOCGIFFLAGS");
1815
#ifdef __linux__
1816
if(restore_loglevel){
1817
ret = klogctl(7, NULL, 0);
1818
if(ret == -1){
1819
perror_plus("klogctl");
1820
}
1821
}
1822
#endif /* __linux__ */
1823
exitcode = EX_OSERR;
1824
/* Lower privileges */
1825
errno = 0;
1826
ret = seteuid(uid);
1827
if(ret == -1){
1828
perror_plus("seteuid");
1829
}
1830
goto end;
1831
}
1832
if((network.ifr_flags & IFF_UP) == 0){
1833
network.ifr_flags |= IFF_UP;
1834
take_down_interface = true;
1835
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1836
if(ret == -1){
1837
take_down_interface = false;
1838
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1839
exitcode = EX_OSERR;
1840
#ifdef __linux__
1841
if(restore_loglevel){
1842
ret = klogctl(7, NULL, 0);
1843
if(ret == -1){
1844
perror_plus("klogctl");
1845
}
1846
}
1847
#endif /* __linux__ */
1848
/* Lower privileges */
1849
errno = 0;
1850
ret = seteuid(uid);
1851
if(ret == -1){
1852
perror_plus("seteuid");
1853
}
1854
goto end;
1855
}
1856
}
1857
/* Sleep checking until interface is running.
1858
Check every 0.25s, up to total time of delay */
1859
for(int i=0; i < delay * 4; i++){
1860
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1861
if(ret == -1){
1862
perror_plus("ioctl SIOCGIFFLAGS");
1863
} else if(network.ifr_flags & IFF_RUNNING){
1864
break;
1865
}
1866
struct timespec sleeptime = { .tv_nsec = 250000000 };
1867
ret = nanosleep(&sleeptime, NULL);
1868
if(ret == -1 and errno != EINTR){
1869
perror_plus("nanosleep");
1870
}
1871
}
1872
if(not take_down_interface){
1873
/* We won't need the socket anymore */
1874
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1875
if(ret == -1){
1876
perror_plus("close");
1877
}
1878
}
1879
#ifdef __linux__
1880
if(restore_loglevel){
1881
/* Restores kernel loglevel to default */
1882
ret = klogctl(7, NULL, 0);
1883
if(ret == -1){
1884
perror_plus("klogctl");
1885
}
1886
}
1887
#endif /* __linux__ */
1888
/* Lower privileges */
1889
errno = 0;
1890
if(take_down_interface){
1891
/* Lower privileges */
1892
ret = seteuid(uid);
1893
if(ret == -1){
1894
perror_plus("seteuid");
1895
}
1896
} else {
1897
/* Lower privileges permanently */
1898
ret = setuid(uid);
1899
if(ret == -1){
1900
perror_plus("setuid");
1901
}
1902
}
1903
}
1904
1905
if(quit_now){
1906
goto end;
1907
}
1908
1909
ret = init_gnutls_global(pubkey, seckey);
1910
if(ret == -1){
1911
fprintf(stderr, "init_gnutls_global failed\n");
1912
exitcode = EX_UNAVAILABLE;
1913
goto end;
1914
} else {
1915
gnutls_initialized = true;
1916
}
1917
1918
if(quit_now){
1919
goto end;
1920
}
1921
1922
if(mkdtemp(tempdir) == NULL){
1923
perror_plus("mkdtemp");
1924
goto end;
1925
}
1926
tempdir_created = true;
1927
1928
if(quit_now){
1929
goto end;
1930
}
1931
1932
if(not init_gpgme(pubkey, seckey, tempdir)){
1933
fprintf(stderr, "init_gpgme failed\n");
1934
exitcode = EX_UNAVAILABLE;
1935
goto end;
1936
} else {
1937
gpgme_initialized = true;
1938
}
1939
1940
if(quit_now){
1941
goto end;
1942
}
1943
1944
if(connect_to != NULL){
1945
/* Connect directly, do not use Zeroconf */
1946
/* (Mainly meant for debugging) */
1947
char *address = strrchr(connect_to, ':');
1948
if(address == NULL){
1949
fprintf(stderr, "No colon in address\n");
1950
exitcode = EX_USAGE;
1951
goto end;
1952
}
1953
1954
if(quit_now){
1955
goto end;
1956
}
1957
1958
uint16_t port;
1959
errno = 0;
1960
tmpmax = strtoimax(address+1, &tmp, 10);
1961
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1962
or tmpmax != (uint16_t)tmpmax){
1963
fprintf(stderr, "Bad port number\n");
1964
exitcode = EX_USAGE;
1965
goto end;
1966
}
1967
1968
if(quit_now){
1969
goto end;
1970
}
1971
1972
port = (uint16_t)tmpmax;
1973
*address = '\0';
1974
/* Colon in address indicates IPv6 */
1975
int af;
1976
if(strchr(connect_to, ':') != NULL){
1977
af = AF_INET6;
1978
/* Accept [] around IPv6 address - see RFC 5952 */
1979
if(connect_to[0] == '[' and address[-1] == ']')
1980
{
1981
connect_to++;
1982
address[-1] = '\0';
1983
}
1984
} else {
1985
af = AF_INET;
1986
}
1987
address = connect_to;
1988
1989
if(quit_now){
1990
goto end;
1991
}
1992
1993
while(not quit_now){
1994
ret = start_mandos_communication(address, port, if_index, af);
1995
if(quit_now or ret == 0){
1996
break;
1997
}
1998
if(debug){
1999
fprintf(stderr, "Retrying in %d seconds\n",
2000
(int)retry_interval);
2001
}
2002
sleep((int)retry_interval);
2003
}
2004
2005
if (not quit_now){
2006
exitcode = EXIT_SUCCESS;
2007
}
2008
2009
goto end;
2010
}
2011
2012
if(quit_now){
2013
goto end;
2014
}
2015
2016
{
588
case AVAHI_BROWSER_FAILURE:
589
590
fprintf(stderr, "(Browser) %s\n",
591
avahi_strerror(avahi_server_errno(server)));
592
avahi_simple_poll_quit(simple_poll);
593
return;
594
595
case AVAHI_BROWSER_NEW:
596
/* We ignore the returned resolver object. In the callback
597
function we free it. If the server is terminated before
598
the callback function is called the server will free
599
the resolver for us. */
600
601
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
602
type, domain,
603
AVAHI_PROTO_INET6, 0,
604
resolve_callback, s)))
605
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
606
avahi_strerror(avahi_server_errno(s)));
607
break;
608
609
case AVAHI_BROWSER_REMOVE:
610
break;
611
612
case AVAHI_BROWSER_ALL_FOR_NOW:
613
case AVAHI_BROWSER_CACHE_EXHAUSTED:
614
break;
615
}
616
}
617
618
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
2017
619
AvahiServerConfig config;
2018
/* Do not publish any local Zeroconf records */
620
AvahiSServiceBrowser *sb = NULL;
621
int error;
622
int ret;
623
int returncode = EXIT_SUCCESS;
624
const char *interface = "eth0";
625
626
while (true){
627
static struct option long_options[] = {
628
{"debug", no_argument, (int *)&debug, 1},
629
{"interface", required_argument, 0, 'i'},
630
{0, 0, 0, 0} };
631
632
int option_index = 0;
633
ret = getopt_long (argc, argv, "i:", long_options,
634
&option_index);
635
636
if (ret == -1){
637
break;
638
}
639
640
switch(ret){
641
case 0:
642
break;
643
case 'i':
644
interface = optarg;
645
break;
646
default:
647
exit(EXIT_FAILURE);
648
}
649
}
650
651
if (not debug){
652
avahi_set_log_function(empty_log);
653
}
654
655
/* Initialize the psuedo-RNG */
656
srand((unsigned int) time(NULL));
657
658
/* Allocate main loop object */
659
if (!(simple_poll = avahi_simple_poll_new())) {
660
fprintf(stderr, "Failed to create simple poll object.\n");
661
662
goto exit;
663
}
664
665
/* Do not publish any local records */
2019
666
avahi_server_config_init(&config);
2020
667
config.publish_hinfo = 0;
2021
668
config.publish_addresses = 0;
2022
669
config.publish_workstation = 0;
2023
670
config.publish_domain = 0;
2024
671
2025
672
/* Allocate a new server */
2026
mc.server = avahi_server_new(avahi_simple_poll_get
2027
(mc.simple_poll), &config, NULL,
2028
NULL, &error);
2029
2030
/* Free the Avahi configuration data */
673
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
674
&config, NULL, NULL, &error);
675
676
/* Free the configuration data */
2031
677
avahi_server_config_free(&config);
2032
}
2033
2034
/* Check if creating the Avahi server object succeeded */
2035
if(mc.server == NULL){
2036
fprintf(stderr, "Failed to create Avahi server: %s\n",
2037
avahi_strerror(error));
2038
exitcode = EX_UNAVAILABLE;
2039
goto end;
2040
}
2041
2042
if(quit_now){
2043
goto end;
2044
}
2045
2046
/* Create the Avahi service browser */
2047
sb = avahi_s_service_browser_new(mc.server, if_index,
2048
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2049
NULL, 0, browse_callback, NULL);
2050
if(sb == NULL){
2051
fprintf(stderr, "Failed to create service browser: %s\n",
2052
avahi_strerror(avahi_server_errno(mc.server)));
2053
exitcode = EX_UNAVAILABLE;
2054
goto end;
2055
}
2056
2057
if(quit_now){
2058
goto end;
2059
}
2060
2061
/* Run the main loop */
2062
2063
if(debug){
2064
fprintf(stderr, "Starting Avahi loop search\n");
2065
}
2066
2067
ret = avahi_loop_with_timeout(mc.simple_poll,
2068
(int)(retry_interval * 1000));
2069
if(debug){
2070
fprintf(stderr, "avahi_loop_with_timeout exited %s\n",
2071
(ret == 0) ? "successfully" : "with error");
2072
}
2073
2074
end:
2075
2076
if(debug){
2077
fprintf(stderr, "%s exiting\n", argv[0]);
2078
}
2079
2080
/* Cleanup things */
2081
if(sb != NULL)
2082
avahi_s_service_browser_free(sb);
2083
2084
if(mc.server != NULL)
2085
avahi_server_free(mc.server);
2086
2087
if(mc.simple_poll != NULL)
2088
avahi_simple_poll_free(mc.simple_poll);
2089
2090
if(gnutls_initialized){
2091
gnutls_certificate_free_credentials(mc.cred);
2092
gnutls_global_deinit();
2093
gnutls_dh_params_deinit(mc.dh_params);
2094
}
2095
2096
if(gpgme_initialized){
2097
gpgme_release(mc.ctx);
2098
}
2099
2100
/* Cleans up the circular linked list of Mandos servers the client
2101
has seen */
2102
if(mc.current_server != NULL){
2103
mc.current_server->prev->next = NULL;
2104
while(mc.current_server != NULL){
2105
server *next = mc.current_server->next;
2106
free(mc.current_server);
2107
mc.current_server = next;
2108
}
2109
}
2110
2111
/* XXX run network hooks "stop" here */
2112
2113
/* Take down the network interface */
2114
if(take_down_interface){
2115
/* Re-raise priviliges */
2116
errno = 0;
2117
ret = seteuid(0);
2118
if(ret == -1){
2119
perror_plus("seteuid");
2120
}
2121
if(geteuid() == 0){
2122
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2123
if(ret == -1){
2124
perror_plus("ioctl SIOCGIFFLAGS");
2125
} else if(network.ifr_flags & IFF_UP) {
2126
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2127
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2128
if(ret == -1){
2129
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2130
}
2131
}
2132
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2133
if(ret == -1){
2134
perror_plus("close");
2135
}
2136
/* Lower privileges permanently */
2137
errno = 0;
2138
ret = setuid(uid);
2139
if(ret == -1){
2140
perror_plus("setuid");
2141
}
2142
}
2143
}
2144
2145
/* Removes the GPGME temp directory and all files inside */
2146
if(tempdir_created){
2147
struct dirent **direntries = NULL;
2148
struct dirent *direntry = NULL;
2149
int numentries = scandir(tempdir, &direntries, notdotentries,
2150
alphasort);
2151
if (numentries > 0){
2152
for(int i = 0; i < numentries; i++){
2153
direntry = direntries[i];
2154
char *fullname = NULL;
2155
ret = asprintf(&fullname, "%s/%s", tempdir,
2156
direntry->d_name);
2157
if(ret < 0){
2158
perror_plus("asprintf");
2159
continue;
2160
}
2161
ret = remove(fullname);
2162
if(ret == -1){
2163
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
2164
strerror(errno));
2165
}
2166
free(fullname);
2167
}
2168
}
2169
2170
/* need to clean even if 0 because man page doesn't specify */
2171
free(direntries);
2172
if (numentries == -1){
2173
perror_plus("scandir");
2174
}
2175
ret = rmdir(tempdir);
2176
if(ret == -1 and errno != ENOENT){
2177
perror_plus("rmdir");
2178
}
2179
}
2180
2181
if(quit_now){
2182
sigemptyset(&old_sigterm_action.sa_mask);
2183
old_sigterm_action.sa_handler = SIG_DFL;
2184
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
2185
&old_sigterm_action,
2186
NULL));
2187
if(ret == -1){
2188
perror_plus("sigaction");
2189
}
2190
do {
2191
ret = raise(signal_received);
2192
} while(ret != 0 and errno == EINTR);
2193
if(ret != 0){
2194
perror_plus("raise");
2195
abort();
2196
}
2197
TEMP_FAILURE_RETRY(pause());
2198
}
2199
2200
return exitcode;
678
679
/* Check if creating the server object succeeded */
680
if (!server) {
681
fprintf(stderr, "Failed to create server: %s\n",
682
avahi_strerror(error));
683
returncode = EXIT_FAILURE;
684
goto exit;
685
}
686
687
/* Create the service browser */
688
sb = avahi_s_service_browser_new(server,
689
(AvahiIfIndex)
690
if_nametoindex(interface),
691
AVAHI_PROTO_INET6,
692
"_mandos._tcp", NULL, 0,
693
browse_callback, server);
694
if (!sb) {
695
fprintf(stderr, "Failed to create service browser: %s\n",
696
avahi_strerror(avahi_server_errno(server)));
697
returncode = EXIT_FAILURE;
698
goto exit;
699
}
700
701
/* Run the main loop */
702
703
if (debug){
704
fprintf(stderr, "Starting avahi loop search\n");
705
}
706
707
avahi_simple_poll_loop(simple_poll);
708
709
exit:
710
711
if (debug){
712
fprintf(stderr, "%s exiting\n", argv[0]);
713
}
714
715
/* Cleanup things */
716
if (sb)
717
avahi_s_service_browser_free(sb);
718
719
if (server)
720
avahi_server_free(server);
721
722
if (simple_poll)
723
avahi_simple_poll_free(simple_poll);
724
725
return returncode;
2201
726
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0