To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 24.1.5
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.5
- Committer: Björn Påhlsson
- Date: 2008-07-31 16:20:47 UTC
- mto: (237.7.1 mandos) (24.1.154 mandos)
- mto: This revision was merged to the branch mainline in revision 30.
- Revision ID: belorn@braxen-20080731162047-lahe2b2prwjw8b2l
plugbasedclient:
Added support to disable plugins
Added support to change plugin directory
mandosclient.c
Fixed some funtion calls that lacked error handling
small bugfix
Added support to disable plugins
Added support to change plugin directory
mandosclient.c
Fixed some funtion calls that lacked error handling
small bugfix
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
3
* Mandos client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
8
8
* includes the following functions: "resolve_callback",
9
9
* "browse_callback", and parts of "main".
10
10
*
11
* Everything else is
12
* Copyright © 2008-2011 Teddy Hogeborn
13
* Copyright © 2008-2011 Björn Påhlsson
11
* Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
12
* Påhlsson.
14
13
*
15
14
* This program is free software: you can redistribute it and/or
16
15
* modify it under the terms of the GNU General Public License as
26
25
* along with this program. If not, see
27
26
* <http://www.gnu.org/licenses/>.
28
27
*
29
* Contact the authors at <mandos@recompile.se>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
30
30
*/
31
31
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
32
#define _FORTIFY_SOURCE 2
33
34
34
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
35
#define _FILE_OFFSET_BITS 64
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno,
66
program_invocation_short_name */
67
#include <time.h> /* nanosleep(), time(), sleep() */
68
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
69
SIOCSIFFLAGS, if_indextoname(),
70
if_nametoindex(), IF_NAMESIZE */
71
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
72
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
73
*/
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
75
getuid(), getgid(), seteuid(),
76
setgid(), pause() */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
78
#include <iso646.h> /* not, or, and */
79
#include <argp.h> /* struct argp_option, error_t, struct
80
argp_state, struct argp,
81
argp_parse(), ARGP_KEY_ARG,
82
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
83
#include <signal.h> /* sigemptyset(), sigaddset(),
84
sigaction(), SIGTERM, sig_atomic_t,
85
raise() */
86
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
87
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
88
89
#ifdef __linux__
90
#include <sys/klog.h> /* klogctl() */
91
#endif /* __linux__ */
92
93
/* Avahi */
94
/* All Avahi types, constants and functions
95
Avahi*, avahi_*,
96
AVAHI_* */
36
37
#include <stdio.h>
38
#include <assert.h>
39
#include <stdlib.h>
40
#include <time.h>
41
#include <net/if.h> /* if_nametoindex */
42
97
43
#include <avahi-core/core.h>
98
44
#include <avahi-core/lookup.h>
99
45
#include <avahi-core/log.h>
101
47
#include <avahi-common/malloc.h>
102
48
#include <avahi-common/error.h>
103
49
104
/* GnuTLS */
105
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
106
functions:
107
gnutls_*
108
init_gnutls_session(),
109
GNUTLS_* */
110
#include <gnutls/openpgp.h>
111
/* gnutls_certificate_set_openpgp_key_file(),
112
GNUTLS_OPENPGP_FMT_BASE64 */
113
114
/* GPGME */
115
#include <gpgme.h> /* All GPGME types, constants and
116
functions:
117
gpgme_*
118
GPGME_PROTOCOL_OpenPGP,
119
GPG_ERR_NO_* */
50
//mandos client part
51
#include <sys/types.h> /* socket(), inet_pton() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton() */
54
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
55
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
56
57
#include <unistd.h> /* close() */
58
#include <netinet/in.h>
59
#include <stdbool.h> /* true */
60
#include <string.h> /* memset */
61
#include <arpa/inet.h> /* inet_pton() */
62
#include <iso646.h> /* not */
63
64
// gpgme
65
#include <errno.h> /* perror() */
66
#include <gpgme.h>
67
68
// getopt long
69
#include <getopt.h>
120
70
121
71
#define BUFFER_SIZE 256
72
#define DH_BITS 1024
122
73
123
#define PATHDIR "/conf/conf.d/mandos"
124
#define SECKEY "seckey.txt"
125
#define PUBKEY "pubkey.txt"
74
const char *certdir = "/conf/conf.d/cryptkeyreq/";
75
const char *certfile = "openpgp-client.txt";
76
const char *certkey = "openpgp-client-key.txt";
126
77
127
78
bool debug = false;
128
static const char mandos_protocol_version[] = "1";
129
const char *argp_program_version = "mandos-client " VERSION;
130
const char *argp_program_bug_address = "<mandos@recompile.se>";
131
static const char sys_class_net[] = "/sys/class/net";
132
char *connect_to = NULL;
133
134
/* Doubly linked list that need to be circularly linked when used */
135
typedef struct server{
136
const char *ip;
137
uint16_t port;
138
AvahiIfIndex if_index;
139
int af;
140
struct timespec last_seen;
141
struct server *next;
142
struct server *prev;
143
} server;
144
145
/* Used for passing in values through the Avahi callback functions */
79
146
80
typedef struct {
147
AvahiSimplePoll *simple_poll;
148
AvahiServer *server;
81
gnutls_session_t session;
149
82
gnutls_certificate_credentials_t cred;
150
unsigned int dh_bits;
151
83
gnutls_dh_params_t dh_params;
152
const char *priority;
84
} encrypted_session;
85
86
87
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet, const char *homedir){
89
gpgme_data_t dh_crypto, dh_plain;
153
90
gpgme_ctx_t ctx;
154
server *current_server;
155
} mandos_context;
156
157
/* global context so signal handler can reach it*/
158
mandos_context mc = { .simple_poll = NULL, .server = NULL,
159
.dh_bits = 1024, .priority = "SECURE256"
160
":!CTYPE-X.509:+CTYPE-OPENPGP",
161
.current_server = NULL };
162
163
sig_atomic_t quit_now = 0;
164
int signal_received = 0;
165
166
/* Function to use when printing errors */
167
void perror_plus(const char *print_text){
168
fprintf(stderr, "Mandos plugin %s: ",
169
program_invocation_short_name);
170
perror(print_text);
171
}
172
173
/*
174
* Make additional room in "buffer" for at least BUFFER_SIZE more
175
* bytes. "buffer_capacity" is how much is currently allocated,
176
* "buffer_length" is how much is already used.
177
*/
178
size_t incbuffer(char **buffer, size_t buffer_length,
179
size_t buffer_capacity){
180
if(buffer_length + BUFFER_SIZE > buffer_capacity){
181
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
182
if(buffer == NULL){
183
return 0;
184
}
185
buffer_capacity += BUFFER_SIZE;
186
}
187
return buffer_capacity;
188
}
189
190
/* Add server to set of servers to retry periodically */
191
int add_server(const char *ip, uint16_t port,
192
AvahiIfIndex if_index,
193
int af){
194
int ret;
195
server *new_server = malloc(sizeof(server));
196
if(new_server == NULL){
197
perror_plus("malloc");
198
return -1;
199
}
200
*new_server = (server){ .ip = strdup(ip),
201
.port = port,
202
.if_index = if_index,
203
.af = af };
204
if(new_server->ip == NULL){
205
perror_plus("strdup");
206
return -1;
207
}
208
/* Special case of first server */
209
if (mc.current_server == NULL){
210
new_server->next = new_server;
211
new_server->prev = new_server;
212
mc.current_server = new_server;
213
/* Place the new server last in the list */
214
} else {
215
new_server->next = mc.current_server;
216
new_server->prev = mc.current_server->prev;
217
new_server->prev->next = new_server;
218
mc.current_server->prev = new_server;
219
}
220
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
221
if(ret == -1){
222
perror_plus("clock_gettime");
223
return -1;
224
}
225
return 0;
226
}
227
228
/*
229
* Initialize GPGME.
230
*/
231
static bool init_gpgme(const char *seckey,
232
const char *pubkey, const char *tempdir){
233
91
gpgme_error_t rc;
92
ssize_t ret;
93
ssize_t new_packet_capacity = 0;
94
ssize_t new_packet_length = 0;
234
95
gpgme_engine_info_t engine_info;
235
236
237
/*
238
* Helper function to insert pub and seckey to the engine keyring.
239
*/
240
bool import_key(const char *filename){
241
int ret;
242
int fd;
243
gpgme_data_t pgp_data;
244
245
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
246
if(fd == -1){
247
perror_plus("open");
248
return false;
249
}
250
251
rc = gpgme_data_new_from_fd(&pgp_data, fd);
252
if(rc != GPG_ERR_NO_ERROR){
253
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
254
gpgme_strsource(rc), gpgme_strerror(rc));
255
return false;
256
}
257
258
rc = gpgme_op_import(mc.ctx, pgp_data);
259
if(rc != GPG_ERR_NO_ERROR){
260
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
261
gpgme_strsource(rc), gpgme_strerror(rc));
262
return false;
263
}
264
265
ret = (int)TEMP_FAILURE_RETRY(close(fd));
266
if(ret == -1){
267
perror_plus("close");
268
}
269
gpgme_data_release(pgp_data);
270
return true;
271
}
272
273
if(debug){
274
fprintf(stderr, "Initializing GPGME\n");
96
97
if (debug){
98
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
275
99
}
276
100
277
101
/* Init GPGME */
278
102
gpgme_check_version(NULL);
279
103
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
280
if(rc != GPG_ERR_NO_ERROR){
104
if (rc != GPG_ERR_NO_ERROR){
281
105
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
282
106
gpgme_strsource(rc), gpgme_strerror(rc));
283
return false;
107
return -1;
284
108
}
285
109
286
/* Set GPGME home directory for the OpenPGP engine only */
287
rc = gpgme_get_engine_info(&engine_info);
288
if(rc != GPG_ERR_NO_ERROR){
110
/* Set GPGME home directory */
111
rc = gpgme_get_engine_info (&engine_info);
112
if (rc != GPG_ERR_NO_ERROR){
289
113
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
290
114
gpgme_strsource(rc), gpgme_strerror(rc));
291
return false;
115
return -1;
292
116
}
293
117
while(engine_info != NULL){
294
118
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
295
119
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
296
engine_info->file_name, tempdir);
120
engine_info->file_name, homedir);
297
121
break;
298
122
}
299
123
engine_info = engine_info->next;
300
124
}
301
125
if(engine_info == NULL){
302
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
303
return false;
304
}
305
306
/* Create new GPGME "context" */
307
rc = gpgme_new(&(mc.ctx));
308
if(rc != GPG_ERR_NO_ERROR){
309
fprintf(stderr, "bad gpgme_new: %s: %s\n",
310
gpgme_strsource(rc), gpgme_strerror(rc));
311
return false;
312
}
313
314
if(not import_key(pubkey) or not import_key(seckey)){
315
return false;
316
}
317
318
return true;
319
}
320
321
/*
322
* Decrypt OpenPGP data.
323
* Returns -1 on error
324
*/
325
static ssize_t pgp_packet_decrypt(const char *cryptotext,
326
size_t crypto_size,
327
char **plaintext){
328
gpgme_data_t dh_crypto, dh_plain;
329
gpgme_error_t rc;
330
ssize_t ret;
331
size_t plaintext_capacity = 0;
332
ssize_t plaintext_length = 0;
333
334
if(debug){
335
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
336
}
337
338
/* Create new GPGME data buffer from memory cryptotext */
339
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
340
0);
341
if(rc != GPG_ERR_NO_ERROR){
126
fprintf(stderr, "Could not set home dir to %s\n", homedir);
127
return -1;
128
}
129
130
/* Create new GPGME data buffer from packet buffer */
131
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
132
if (rc != GPG_ERR_NO_ERROR){
342
133
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
343
134
gpgme_strsource(rc), gpgme_strerror(rc));
344
135
return -1;
346
137
347
138
/* Create new empty GPGME data buffer for the plaintext */
348
139
rc = gpgme_data_new(&dh_plain);
349
if(rc != GPG_ERR_NO_ERROR){
140
if (rc != GPG_ERR_NO_ERROR){
350
141
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
351
142
gpgme_strsource(rc), gpgme_strerror(rc));
352
gpgme_data_release(dh_crypto);
353
return -1;
354
}
355
356
/* Decrypt data from the cryptotext data buffer to the plaintext
357
data buffer */
358
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
359
if(rc != GPG_ERR_NO_ERROR){
143
return -1;
144
}
145
146
/* Create new GPGME "context" */
147
rc = gpgme_new(&ctx);
148
if (rc != GPG_ERR_NO_ERROR){
149
fprintf(stderr, "bad gpgme_new: %s: %s\n",
150
gpgme_strsource(rc), gpgme_strerror(rc));
151
return -1;
152
}
153
154
/* Decrypt data from the FILE pointer to the plaintext data
155
buffer */
156
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
157
if (rc != GPG_ERR_NO_ERROR){
360
158
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
361
159
gpgme_strsource(rc), gpgme_strerror(rc));
362
plaintext_length = -1;
363
if(debug){
364
gpgme_decrypt_result_t result;
365
result = gpgme_op_decrypt_result(mc.ctx);
366
if(result == NULL){
367
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
368
} else {
369
fprintf(stderr, "Unsupported algorithm: %s\n",
370
result->unsupported_algorithm);
371
fprintf(stderr, "Wrong key usage: %u\n",
372
result->wrong_key_usage);
373
if(result->file_name != NULL){
374
fprintf(stderr, "File name: %s\n", result->file_name);
375
}
376
gpgme_recipient_t recipient;
377
recipient = result->recipients;
160
return -1;
161
}
162
163
if(debug){
164
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
165
}
166
167
if (debug){
168
gpgme_decrypt_result_t result;
169
result = gpgme_op_decrypt_result(ctx);
170
if (result == NULL){
171
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
172
} else {
173
fprintf(stderr, "Unsupported algorithm: %s\n",
174
result->unsupported_algorithm);
175
fprintf(stderr, "Wrong key usage: %d\n",
176
result->wrong_key_usage);
177
if(result->file_name != NULL){
178
fprintf(stderr, "File name: %s\n", result->file_name);
179
}
180
gpgme_recipient_t recipient;
181
recipient = result->recipients;
182
if(recipient){
378
183
while(recipient != NULL){
379
184
fprintf(stderr, "Public key algorithm: %s\n",
380
185
gpgme_pubkey_algo_name(recipient->pubkey_algo));
386
191
}
387
192
}
388
193
}
389
goto decrypt_end;
390
194
}
391
195
392
if(debug){
393
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
394
}
196
/* Delete the GPGME FILE pointer cryptotext data buffer */
197
gpgme_data_release(dh_crypto);
395
198
396
199
/* Seek back to the beginning of the GPGME plaintext data buffer */
397
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
398
perror_plus("gpgme_data_seek");
399
plaintext_length = -1;
400
goto decrypt_end;
200
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
201
perror("pgpme_data_seek");
401
202
}
402
203
403
*plaintext = NULL;
204
*new_packet = 0;
404
205
while(true){
405
plaintext_capacity = incbuffer(plaintext,
406
(size_t)plaintext_length,
407
plaintext_capacity);
408
if(plaintext_capacity == 0){
409
perror_plus("incbuffer");
410
plaintext_length = -1;
411
goto decrypt_end;
206
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
207
*new_packet = realloc(*new_packet,
208
(unsigned int)new_packet_capacity
209
+ BUFFER_SIZE);
210
if (*new_packet == NULL){
211
perror("realloc");
212
return -1;
213
}
214
new_packet_capacity += BUFFER_SIZE;
412
215
}
413
216
414
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
217
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
415
218
BUFFER_SIZE);
416
219
/* Print the data, if any */
417
if(ret == 0){
418
/* EOF */
220
if (ret == 0){
419
221
break;
420
222
}
421
223
if(ret < 0){
422
perror_plus("gpgme_data_read");
423
plaintext_length = -1;
424
goto decrypt_end;
425
}
426
plaintext_length += ret;
427
}
428
429
if(debug){
430
fprintf(stderr, "Decrypted password is: ");
431
for(ssize_t i = 0; i < plaintext_length; i++){
432
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
433
}
434
fprintf(stderr, "\n");
435
}
436
437
decrypt_end:
438
439
/* Delete the GPGME cryptotext data buffer */
440
gpgme_data_release(dh_crypto);
224
perror("gpgme_data_read");
225
return -1;
226
}
227
new_packet_length += ret;
228
}
229
230
/* FIXME: check characters before printing to screen so to not print
231
terminal control characters */
232
/* if(debug){ */
233
/* fprintf(stderr, "decrypted password is: "); */
234
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
235
/* fprintf(stderr, "\n"); */
236
/* } */
441
237
442
238
/* Delete the GPGME plaintext data buffer */
443
239
gpgme_data_release(dh_plain);
444
return plaintext_length;
240
return new_packet_length;
445
241
}
446
242
447
static const char * safer_gnutls_strerror(int value){
448
const char *ret = gnutls_strerror(value); /* Spurious warning from
449
-Wunreachable-code */
450
if(ret == NULL)
243
static const char * safer_gnutls_strerror (int value) {
244
const char *ret = gnutls_strerror (value);
245
if (ret == NULL)
451
246
ret = "(unknown)";
452
247
return ret;
453
248
}
454
249
455
/* GnuTLS log function callback */
456
static void debuggnutls(__attribute__((unused)) int level,
457
const char* string){
458
fprintf(stderr, "GnuTLS: %s", string);
250
void debuggnutls(__attribute__((unused)) int level,
251
const char* string){
252
fprintf(stderr, "%s", string);
459
253
}
460
254
461
static int init_gnutls_global(const char *pubkeyfilename,
462
const char *seckeyfilename){
255
int initgnutls(encrypted_session *es){
256
const char *err;
463
257
int ret;
464
258
465
259
if(debug){
466
260
fprintf(stderr, "Initializing GnuTLS\n");
467
261
}
468
469
ret = gnutls_global_init();
470
if(ret != GNUTLS_E_SUCCESS){
471
fprintf(stderr, "GnuTLS global_init: %s\n",
472
safer_gnutls_strerror(ret));
262
263
if ((ret = gnutls_global_init ())
264
!= GNUTLS_E_SUCCESS) {
265
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
473
266
return -1;
474
267
}
475
476
if(debug){
477
/* "Use a log level over 10 to enable all debugging options."
478
* - GnuTLS manual
479
*/
268
269
if (debug){
480
270
gnutls_global_set_log_level(11);
481
271
gnutls_global_set_log_function(debuggnutls);
482
272
}
483
273
484
/* OpenPGP credentials */
485
ret = gnutls_certificate_allocate_credentials(&mc.cred);
486
if(ret != GNUTLS_E_SUCCESS){
487
fprintf(stderr, "GnuTLS memory error: %s\n",
488
safer_gnutls_strerror(ret));
489
gnutls_global_deinit();
274
/* openpgp credentials */
275
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
276
!= GNUTLS_E_SUCCESS) {
277
fprintf (stderr, "memory error: %s\n",
278
safer_gnutls_strerror(ret));
490
279
return -1;
491
280
}
492
281
493
282
if(debug){
494
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
495
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
496
seckeyfilename);
283
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
284
" and keyfile %s as GnuTLS credentials\n", certfile,
285
certkey);
497
286
}
498
287
499
288
ret = gnutls_certificate_set_openpgp_key_file
500
(mc.cred, pubkeyfilename, seckeyfilename,
501
GNUTLS_OPENPGP_FMT_BASE64);
502
if(ret != GNUTLS_E_SUCCESS){
503
fprintf(stderr,
504
"Error[%d] while reading the OpenPGP key pair ('%s',"
505
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
506
fprintf(stderr, "The GnuTLS error is: %s\n",
507
safer_gnutls_strerror(ret));
508
goto globalfail;
509
}
510
511
/* GnuTLS server initialization */
512
ret = gnutls_dh_params_init(&mc.dh_params);
513
if(ret != GNUTLS_E_SUCCESS){
514
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
515
" %s\n", safer_gnutls_strerror(ret));
516
goto globalfail;
517
}
518
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
519
if(ret != GNUTLS_E_SUCCESS){
520
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
521
safer_gnutls_strerror(ret));
522
goto globalfail;
523
}
524
525
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
526
527
return 0;
528
529
globalfail:
530
531
gnutls_certificate_free_credentials(mc.cred);
532
gnutls_global_deinit();
533
gnutls_dh_params_deinit(mc.dh_params);
534
return -1;
535
}
536
537
static int init_gnutls_session(gnutls_session_t *session){
538
int ret;
539
/* GnuTLS session creation */
540
do {
541
ret = gnutls_init(session, GNUTLS_SERVER);
542
if(quit_now){
543
return -1;
544
}
545
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
546
if(ret != GNUTLS_E_SUCCESS){
289
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
290
if (ret != GNUTLS_E_SUCCESS) {
291
fprintf
292
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
293
" '%s')\n",
294
ret, certfile, certkey);
295
fprintf(stdout, "The Error is: %s\n",
296
safer_gnutls_strerror(ret));
297
return -1;
298
}
299
300
//GnuTLS server initialization
301
if ((ret = gnutls_dh_params_init (&es->dh_params))
302
!= GNUTLS_E_SUCCESS) {
303
fprintf (stderr, "Error in dh parameter initialization: %s\n",
304
safer_gnutls_strerror(ret));
305
return -1;
306
}
307
308
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
309
!= GNUTLS_E_SUCCESS) {
310
fprintf (stderr, "Error in prime generation: %s\n",
311
safer_gnutls_strerror(ret));
312
return -1;
313
}
314
315
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
316
317
// GnuTLS session creation
318
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
319
!= GNUTLS_E_SUCCESS){
547
320
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
548
321
safer_gnutls_strerror(ret));
549
322
}
550
323
551
{
552
const char *err;
553
do {
554
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
555
if(quit_now){
556
gnutls_deinit(*session);
557
return -1;
558
}
559
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
560
if(ret != GNUTLS_E_SUCCESS){
561
fprintf(stderr, "Syntax error at: %s\n", err);
562
fprintf(stderr, "GnuTLS error: %s\n",
563
safer_gnutls_strerror(ret));
564
gnutls_deinit(*session);
565
return -1;
566
}
324
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
325
!= GNUTLS_E_SUCCESS) {
326
fprintf(stderr, "Syntax error at: %s\n", err);
327
fprintf(stderr, "GnuTLS error: %s\n",
328
safer_gnutls_strerror(ret));
329
return -1;
567
330
}
568
331
569
do {
570
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
571
mc.cred);
572
if(quit_now){
573
gnutls_deinit(*session);
574
return -1;
575
}
576
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
577
if(ret != GNUTLS_E_SUCCESS){
578
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
332
if ((ret = gnutls_credentials_set
333
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
334
!= GNUTLS_E_SUCCESS) {
335
fprintf(stderr, "Error setting a credentials set: %s\n",
579
336
safer_gnutls_strerror(ret));
580
gnutls_deinit(*session);
581
337
return -1;
582
338
}
583
339
584
340
/* ignore client certificate if any. */
585
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
341
gnutls_certificate_server_set_request (es->session,
342
GNUTLS_CERT_IGNORE);
586
343
587
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
344
gnutls_dh_set_prime_bits (es->session, DH_BITS);
588
345
589
346
return 0;
590
347
}
591
348
592
/* Avahi log function callback */
593
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
594
__attribute__((unused)) const char *txt){}
349
void empty_log(__attribute__((unused)) AvahiLogLevel level,
350
__attribute__((unused)) const char *txt){}
595
351
596
/* Called when a Mandos server is found */
597
static int start_mandos_communication(const char *ip, uint16_t port,
598
AvahiIfIndex if_index,
599
int af){
600
int ret, tcp_sd = -1;
601
ssize_t sret;
602
union {
603
struct sockaddr_in in;
604
struct sockaddr_in6 in6;
605
} to;
352
int start_mandos_communication(const char *ip, uint16_t port,
353
unsigned int if_index){
354
int ret, tcp_sd;
355
struct sockaddr_in6 to;
356
encrypted_session es;
606
357
char *buffer = NULL;
607
char *decrypted_buffer = NULL;
358
char *decrypted_buffer;
608
359
size_t buffer_length = 0;
609
360
size_t buffer_capacity = 0;
610
size_t written;
611
int retval = -1;
612
gnutls_session_t session;
613
int pf; /* Protocol family */
614
615
errno = 0;
616
617
if(quit_now){
618
errno = EINTR;
619
return -1;
620
}
621
622
switch(af){
623
case AF_INET6:
624
pf = PF_INET6;
625
break;
626
case AF_INET:
627
pf = PF_INET;
628
break;
629
default:
630
fprintf(stderr, "Bad address family: %d\n", af);
631
errno = EINVAL;
632
return -1;
633
}
634
635
ret = init_gnutls_session(&session);
636
if(ret != 0){
637
return -1;
638
}
639
640
if(debug){
641
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
642
"\n", ip, port);
643
}
644
645
tcp_sd = socket(pf, SOCK_STREAM, 0);
646
if(tcp_sd < 0){
647
int e = errno;
648
perror_plus("socket");
649
errno = e;
650
goto mandos_end;
651
}
652
653
if(quit_now){
654
errno = EINTR;
655
goto mandos_end;
656
}
657
658
memset(&to, 0, sizeof(to));
659
if(af == AF_INET6){
660
to.in6.sin6_family = (sa_family_t)af;
661
ret = inet_pton(af, ip, &to.in6.sin6_addr);
662
} else { /* IPv4 */
663
to.in.sin_family = (sa_family_t)af;
664
ret = inet_pton(af, ip, &to.in.sin_addr);
665
}
666
if(ret < 0 ){
667
int e = errno;
668
perror_plus("inet_pton");
669
errno = e;
670
goto mandos_end;
671
}
361
ssize_t decrypted_buffer_size;
362
size_t written = 0;
363
int retval = 0;
364
char interface[IF_NAMESIZE];
365
366
if(debug){
367
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
368
}
369
370
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
371
if(tcp_sd < 0) {
372
perror("socket");
373
return -1;
374
}
375
376
if(if_indextoname(if_index, interface) == NULL){
377
if(debug){
378
perror("if_indextoname");
379
}
380
return -1;
381
}
382
383
if(debug){
384
fprintf(stderr, "Binding to interface %s\n", interface);
385
}
386
387
memset(&to,0,sizeof(to)); /* Spurious warning */
388
to.sin6_family = AF_INET6;
389
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
390
if (ret < 0 ){
391
perror("inet_pton");
392
return -1;
393
}
672
394
if(ret == 0){
673
int e = errno;
674
395
fprintf(stderr, "Bad address: %s\n", ip);
675
errno = e;
676
goto mandos_end;
677
}
678
if(af == AF_INET6){
679
to.in6.sin6_port = htons(port); /* Spurious warnings from
680
-Wconversion and
681
-Wunreachable-code */
682
683
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
684
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
685
-Wunreachable-code*/
686
if(if_index == AVAHI_IF_UNSPEC){
687
fprintf(stderr, "An IPv6 link-local address is incomplete"
688
" without a network interface\n");
689
errno = EINVAL;
690
goto mandos_end;
691
}
692
/* Set the network interface number as scope */
693
to.in6.sin6_scope_id = (uint32_t)if_index;
694
}
695
} else {
696
to.in.sin_port = htons(port); /* Spurious warnings from
697
-Wconversion and
698
-Wunreachable-code */
699
}
396
return -1;
397
}
398
to.sin6_port = htons(port); /* Spurious warning */
700
399
701
if(quit_now){
702
errno = EINTR;
703
goto mandos_end;
704
}
400
to.sin6_scope_id = (uint32_t)if_index;
705
401
706
402
if(debug){
707
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
708
char interface[IF_NAMESIZE];
709
if(if_indextoname((unsigned int)if_index, interface) == NULL){
710
perror_plus("if_indextoname");
711
} else {
712
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
713
ip, interface, port);
714
}
715
} else {
716
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
717
port);
718
}
719
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
720
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
721
const char *pcret;
722
if(af == AF_INET6){
723
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
724
sizeof(addrstr));
725
} else {
726
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
727
sizeof(addrstr));
728
}
729
if(pcret == NULL){
730
perror_plus("inet_ntop");
731
} else {
732
if(strcmp(addrstr, ip) != 0){
733
fprintf(stderr, "Canonical address form: %s\n", addrstr);
734
}
735
}
736
}
737
738
if(quit_now){
739
errno = EINTR;
740
goto mandos_end;
741
}
742
743
if(af == AF_INET6){
744
ret = connect(tcp_sd, &to.in6, sizeof(to));
745
} else {
746
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
747
}
748
if(ret < 0){
749
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
750
int e = errno;
751
perror_plus("connect");
752
errno = e;
753
}
754
goto mandos_end;
755
}
756
757
if(quit_now){
758
errno = EINTR;
759
goto mandos_end;
760
}
761
762
const char *out = mandos_protocol_version;
763
written = 0;
764
while(true){
765
size_t out_size = strlen(out);
766
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
767
out_size - written));
768
if(ret == -1){
769
int e = errno;
770
perror_plus("write");
771
errno = e;
772
goto mandos_end;
773
}
774
written += (size_t)ret;
775
if(written < out_size){
776
continue;
777
} else {
778
if(out == mandos_protocol_version){
779
written = 0;
780
out = "\r\n";
781
} else {
782
break;
783
}
784
}
785
786
if(quit_now){
787
errno = EINTR;
788
goto mandos_end;
789
}
790
}
403
fprintf(stderr, "Connection to: %s\n", ip);
404
}
405
406
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
407
if (ret < 0){
408
perror("connect");
409
return -1;
410
}
411
412
ret = initgnutls (&es);
413
if (ret != 0){
414
retval = -1;
415
return -1;
416
}
417
418
gnutls_transport_set_ptr (es.session,
419
(gnutls_transport_ptr_t) tcp_sd);
791
420
792
421
if(debug){
793
422
fprintf(stderr, "Establishing TLS session with %s\n", ip);
794
423
}
795
424
796
if(quit_now){
797
errno = EINTR;
798
goto mandos_end;
799
}
800
801
/* Spurious warning from -Wint-to-pointer-cast */
802
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
803
804
if(quit_now){
805
errno = EINTR;
806
goto mandos_end;
807
}
808
809
do {
810
ret = gnutls_handshake(session);
811
if(quit_now){
812
errno = EINTR;
813
goto mandos_end;
814
}
815
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
816
817
if(ret != GNUTLS_E_SUCCESS){
425
ret = gnutls_handshake (es.session);
426
427
if (ret != GNUTLS_E_SUCCESS){
818
428
if(debug){
819
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
820
gnutls_perror(ret);
429
fprintf(stderr, "\n*** Handshake failed ***\n");
430
gnutls_perror (ret);
821
431
}
822
errno = EPROTO;
823
goto mandos_end;
432
retval = -1;
433
goto exit;
824
434
}
825
435
826
/* Read OpenPGP packet that contains the wanted password */
436
//Retrieve OpenPGP packet that contains the wanted password
827
437
828
438
if(debug){
829
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
439
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
830
440
ip);
831
441
}
832
442
833
443
while(true){
834
835
if(quit_now){
836
errno = EINTR;
837
goto mandos_end;
838
}
839
840
buffer_capacity = incbuffer(&buffer, buffer_length,
841
buffer_capacity);
842
if(buffer_capacity == 0){
843
int e = errno;
844
perror_plus("incbuffer");
845
errno = e;
846
goto mandos_end;
847
}
848
849
if(quit_now){
850
errno = EINTR;
851
goto mandos_end;
852
}
853
854
sret = gnutls_record_recv(session, buffer+buffer_length,
855
BUFFER_SIZE);
856
if(sret == 0){
444
if (buffer_length + BUFFER_SIZE > buffer_capacity){
445
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
446
if (buffer == NULL){
447
perror("realloc");
448
goto exit;
449
}
450
buffer_capacity += BUFFER_SIZE;
451
}
452
453
ret = gnutls_record_recv
454
(es.session, buffer+buffer_length, BUFFER_SIZE);
455
if (ret == 0){
857
456
break;
858
457
}
859
if(sret < 0){
860
switch(sret){
458
if (ret < 0){
459
switch(ret){
861
460
case GNUTLS_E_INTERRUPTED:
862
461
case GNUTLS_E_AGAIN:
863
462
break;
864
463
case GNUTLS_E_REHANDSHAKE:
865
do {
866
ret = gnutls_handshake(session);
867
868
if(quit_now){
869
errno = EINTR;
870
goto mandos_end;
871
}
872
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
873
if(ret < 0){
874
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
875
gnutls_perror(ret);
876
errno = EPROTO;
877
goto mandos_end;
464
ret = gnutls_handshake (es.session);
465
if (ret < 0){
466
fprintf(stderr, "\n*** Handshake failed ***\n");
467
gnutls_perror (ret);
468
retval = -1;
469
goto exit;
878
470
}
879
471
break;
880
472
default:
881
473
fprintf(stderr, "Unknown error while reading data from"
882
" encrypted session with Mandos server\n");
883
gnutls_bye(session, GNUTLS_SHUT_RDWR);
884
errno = EIO;
885
goto mandos_end;
474
" encrypted session with mandos server\n");
475
retval = -1;
476
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
477
goto exit;
886
478
}
887
479
} else {
888
buffer_length += (size_t) sret;
889
}
890
}
891
892
if(debug){
893
fprintf(stderr, "Closing TLS session\n");
894
}
895
896
if(quit_now){
897
errno = EINTR;
898
goto mandos_end;
899
}
900
901
do {
902
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
903
if(quit_now){
904
errno = EINTR;
905
goto mandos_end;
906
}
907
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
908
909
if(buffer_length > 0){
910
ssize_t decrypted_buffer_size;
480
buffer_length += (size_t) ret;
481
}
482
}
483
484
if (buffer_length > 0){
911
485
decrypted_buffer_size = pgp_packet_decrypt(buffer,
912
486
buffer_length,
913
&decrypted_buffer);
914
if(decrypted_buffer_size >= 0){
915
916
written = 0;
917
while(written < (size_t) decrypted_buffer_size){
918
if(quit_now){
919
errno = EINTR;
920
goto mandos_end;
921
}
922
923
ret = (int)fwrite(decrypted_buffer + written, 1,
924
(size_t)decrypted_buffer_size - written,
925
stdout);
487
&decrypted_buffer,
488
certdir);
489
if (decrypted_buffer_size >= 0){
490
while(written < decrypted_buffer_size){
491
ret = (int)fwrite (decrypted_buffer + written, 1,
492
(size_t)decrypted_buffer_size - written,
493
stdout);
926
494
if(ret == 0 and ferror(stdout)){
927
int e = errno;
928
495
if(debug){
929
496
fprintf(stderr, "Error writing encrypted data: %s\n",
930
497
strerror(errno));
931
498
}
932
errno = e;
933
goto mandos_end;
499
retval = -1;
500
break;
934
501
}
935
502
written += (size_t)ret;
936
503
}
937
retval = 0;
938
}
939
}
940
941
/* Shutdown procedure */
942
943
mandos_end:
944
{
945
int e = errno;
946
free(decrypted_buffer);
947
free(buffer);
948
if(tcp_sd >= 0){
949
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
950
}
951
if(ret == -1){
952
if(e == 0){
953
e = errno;
954
}
955
perror_plus("close");
956
}
957
gnutls_deinit(session);
958
errno = e;
959
if(quit_now){
960
errno = EINTR;
504
free(decrypted_buffer);
505
} else {
961
506
retval = -1;
962
507
}
963
508
}
509
510
//shutdown procedure
511
512
if(debug){
513
fprintf(stderr, "Closing TLS session\n");
514
}
515
516
free(buffer);
517
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
518
exit:
519
close(tcp_sd);
520
gnutls_deinit (es.session);
521
gnutls_certificate_free_credentials (es.cred);
522
gnutls_global_deinit ();
964
523
return retval;
965
524
}
966
525
967
static void resolve_callback(AvahiSServiceResolver *r,
968
AvahiIfIndex interface,
969
AvahiProtocol proto,
970
AvahiResolverEvent event,
971
const char *name,
972
const char *type,
973
const char *domain,
974
const char *host_name,
975
const AvahiAddress *address,
976
uint16_t port,
977
AVAHI_GCC_UNUSED AvahiStringList *txt,
978
AVAHI_GCC_UNUSED AvahiLookupResultFlags
979
flags,
980
AVAHI_GCC_UNUSED void* userdata){
981
assert(r);
526
static AvahiSimplePoll *simple_poll = NULL;
527
static AvahiServer *server = NULL;
528
529
static void resolve_callback(
530
AvahiSServiceResolver *r,
531
AvahiIfIndex interface,
532
AVAHI_GCC_UNUSED AvahiProtocol protocol,
533
AvahiResolverEvent event,
534
const char *name,
535
const char *type,
536
const char *domain,
537
const char *host_name,
538
const AvahiAddress *address,
539
uint16_t port,
540
AVAHI_GCC_UNUSED AvahiStringList *txt,
541
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
542
AVAHI_GCC_UNUSED void* userdata) {
543
544
assert(r); /* Spurious warning */
982
545
983
546
/* Called whenever a service has been resolved successfully or
984
547
timed out */
985
548
986
if(quit_now){
987
return;
988
}
989
990
switch(event){
549
switch (event) {
991
550
default:
992
551
case AVAHI_RESOLVER_FAILURE:
993
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
994
" of type '%s' in domain '%s': %s\n", name, type, domain,
995
avahi_strerror(avahi_server_errno(mc.server)));
552
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
553
" type '%s' in domain '%s': %s\n", name, type, domain,
554
avahi_strerror(avahi_server_errno(server)));
996
555
break;
997
556
998
557
case AVAHI_RESOLVER_FOUND:
1000
559
char ip[AVAHI_ADDRESS_STR_MAX];
1001
560
avahi_address_snprint(ip, sizeof(ip), address);
1002
561
if(debug){
1003
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
1004
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
1005
ip, (intmax_t)interface, port);
562
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
563
" port %d\n", name, host_name, ip, port);
1006
564
}
1007
int ret = start_mandos_communication(ip, port, interface,
1008
avahi_proto_to_af(proto));
1009
if(ret == 0){
1010
avahi_simple_poll_quit(mc.simple_poll);
1011
} else {
1012
ret = add_server(ip, port, interface,
1013
avahi_proto_to_af(proto));
565
int ret = start_mandos_communication(ip, port,
566
(unsigned int) interface);
567
if (ret == 0){
568
exit(EXIT_SUCCESS);
1014
569
}
1015
570
}
1016
571
}
1017
572
avahi_s_service_resolver_free(r);
1018
573
}
1019
574
1020
static void browse_callback(AvahiSServiceBrowser *b,
1021
AvahiIfIndex interface,
1022
AvahiProtocol protocol,
1023
AvahiBrowserEvent event,
1024
const char *name,
1025
const char *type,
1026
const char *domain,
1027
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1028
flags,
1029
AVAHI_GCC_UNUSED void* userdata){
1030
assert(b);
1031
1032
/* Called whenever a new services becomes available on the LAN or
1033
is removed from the LAN */
1034
1035
if(quit_now){
1036
return;
1037
}
1038
1039
switch(event){
1040
default:
1041
case AVAHI_BROWSER_FAILURE:
1042
1043
fprintf(stderr, "(Avahi browser) %s\n",
1044
avahi_strerror(avahi_server_errno(mc.server)));
1045
avahi_simple_poll_quit(mc.simple_poll);
1046
return;
1047
1048
case AVAHI_BROWSER_NEW:
1049
/* We ignore the returned Avahi resolver object. In the callback
1050
function we free it. If the Avahi server is terminated before
1051
the callback function is called the Avahi server will free the
1052
resolver for us. */
1053
1054
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1055
name, type, domain, protocol, 0,
1056
resolve_callback, NULL) == NULL)
1057
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
1058
name, avahi_strerror(avahi_server_errno(mc.server)));
1059
break;
1060
1061
case AVAHI_BROWSER_REMOVE:
1062
break;
1063
1064
case AVAHI_BROWSER_ALL_FOR_NOW:
1065
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1066
if(debug){
1067
fprintf(stderr, "No Mandos server found, still searching...\n");
1068
}
1069
break;
1070
}
1071
}
1072
1073
/* Signal handler that stops main loop after SIGTERM */
1074
static void handle_sigterm(int sig){
1075
if(quit_now){
1076
return;
1077
}
1078
quit_now = 1;
1079
signal_received = sig;
1080
int old_errno = errno;
1081
/* set main loop to exit */
1082
if(mc.simple_poll != NULL){
1083
avahi_simple_poll_quit(mc.simple_poll);
1084
}
1085
errno = old_errno;
1086
}
1087
1088
bool get_flags(const char *ifname, struct ifreq *ifr){
1089
int ret;
1090
1091
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1092
if(s < 0){
1093
perror_plus("socket");
1094
return false;
1095
}
1096
strcpy(ifr->ifr_name, ifname);
1097
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1098
if(ret == -1){
1099
if(debug){
1100
perror_plus("ioctl SIOCGIFFLAGS");
1101
}
1102
return false;
1103
}
1104
return true;
1105
}
1106
1107
bool good_flags(const char *ifname, const struct ifreq *ifr){
1108
1109
/* Reject the loopback device */
1110
if(ifr->ifr_flags & IFF_LOOPBACK){
1111
if(debug){
1112
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1113
ifname);
1114
}
1115
return false;
1116
}
1117
/* Accept point-to-point devices only if connect_to is specified */
1118
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1119
if(debug){
1120
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1121
ifname);
1122
}
1123
return true;
1124
}
1125
/* Otherwise, reject non-broadcast-capable devices */
1126
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1127
if(debug){
1128
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1129
ifname);
1130
}
1131
return false;
1132
}
1133
/* Reject non-ARP interfaces (including dummy interfaces) */
1134
if(ifr->ifr_flags & IFF_NOARP){
1135
if(debug){
1136
fprintf(stderr, "Rejecting non-ARP interface \"%s\"\n", ifname);
1137
}
1138
return false;
1139
}
1140
1141
/* Accept this device */
1142
if(debug){
1143
fprintf(stderr, "Interface \"%s\" is good\n", ifname);
1144
}
1145
return true;
1146
}
1147
1148
/*
1149
* This function determines if a directory entry in /sys/class/net
1150
* corresponds to an acceptable network device.
1151
* (This function is passed to scandir(3) as a filter function.)
1152
*/
1153
int good_interface(const struct dirent *if_entry){
1154
int ret;
1155
if(if_entry->d_name[0] == '.'){
1156
return 0;
1157
}
1158
struct ifreq ifr;
1159
1160
if(not get_flags(if_entry->d_name, &ifr)){
1161
return 0;
1162
}
1163
1164
if(not good_flags(if_entry->d_name, &ifr)){
1165
return 0;
1166
}
1167
return 1;
1168
}
1169
1170
int notdotentries(const struct dirent *direntry){
1171
/* Skip "." and ".." */
1172
if(direntry->d_name[0] == '.'
1173
and (direntry->d_name[1] == '\0'
1174
or (direntry->d_name[1] == '.'
1175
and direntry->d_name[2] == '\0'))){
1176
return 0;
1177
}
1178
return 1;
1179
}
1180
1181
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1182
int ret;
1183
struct timespec now;
1184
struct timespec waited_time;
1185
intmax_t block_time;
1186
1187
while(true){
1188
if(mc.current_server == NULL){
1189
if (debug){
1190
fprintf(stderr,
1191
"Wait until first server is found. No timeout!\n");
1192
}
1193
ret = avahi_simple_poll_iterate(s, -1);
1194
} else {
1195
if (debug){
1196
fprintf(stderr, "Check current_server if we should run it,"
1197
" or wait\n");
1198
}
1199
/* the current time */
1200
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1201
if(ret == -1){
1202
perror_plus("clock_gettime");
1203
return -1;
1204
}
1205
/* Calculating in ms how long time between now and server
1206
who we visted longest time ago. Now - last seen. */
1207
waited_time.tv_sec = (now.tv_sec
1208
- mc.current_server->last_seen.tv_sec);
1209
waited_time.tv_nsec = (now.tv_nsec
1210
- mc.current_server->last_seen.tv_nsec);
1211
/* total time is 10s/10,000ms.
1212
Converting to s from ms by dividing by 1,000,
1213
and ns to ms by dividing by 1,000,000. */
1214
block_time = ((retry_interval
1215
- ((intmax_t)waited_time.tv_sec * 1000))
1216
- ((intmax_t)waited_time.tv_nsec / 1000000));
1217
1218
if (debug){
1219
fprintf(stderr, "Blocking for %" PRIdMAX " ms\n", block_time);
1220
}
1221
1222
if(block_time <= 0){
1223
ret = start_mandos_communication(mc.current_server->ip,
1224
mc.current_server->port,
1225
mc.current_server->if_index,
1226
mc.current_server->af);
1227
if(ret == 0){
1228
avahi_simple_poll_quit(mc.simple_poll);
1229
return 0;
1230
}
1231
ret = clock_gettime(CLOCK_MONOTONIC,
1232
&mc.current_server->last_seen);
1233
if(ret == -1){
1234
perror_plus("clock_gettime");
1235
return -1;
1236
}
1237
mc.current_server = mc.current_server->next;
1238
block_time = 0; /* Call avahi to find new Mandos
1239
servers, but don't block */
1240
}
1241
1242
ret = avahi_simple_poll_iterate(s, (int)block_time);
1243
}
1244
if(ret != 0){
1245
if (ret > 0 or errno != EINTR) {
1246
return (ret != 1) ? ret : 0;
1247
}
1248
}
1249
}
1250
}
1251
1252
int main(int argc, char *argv[]){
1253
AvahiSServiceBrowser *sb = NULL;
1254
int error;
1255
int ret;
1256
intmax_t tmpmax;
575
static void browse_callback(
576
AvahiSServiceBrowser *b,
577
AvahiIfIndex interface,
578
AvahiProtocol protocol,
579
AvahiBrowserEvent event,
580
const char *name,
581
const char *type,
582
const char *domain,
583
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
584
void* userdata) {
585
586
AvahiServer *s = userdata;
587
assert(b); /* Spurious warning */
588
589
/* Called whenever a new services becomes available on the LAN or
590
is removed from the LAN */
591
592
switch (event) {
593
default:
594
case AVAHI_BROWSER_FAILURE:
595
596
fprintf(stderr, "(Browser) %s\n",
597
avahi_strerror(avahi_server_errno(server)));
598
avahi_simple_poll_quit(simple_poll);
599
return;
600
601
case AVAHI_BROWSER_NEW:
602
/* We ignore the returned resolver object. In the callback
603
function we free it. If the server is terminated before
604
the callback function is called the server will free
605
the resolver for us. */
606
607
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
608
type, domain,
609
AVAHI_PROTO_INET6, 0,
610
resolve_callback, s)))
611
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
612
avahi_strerror(avahi_server_errno(s)));
613
break;
614
615
case AVAHI_BROWSER_REMOVE:
616
break;
617
618
case AVAHI_BROWSER_ALL_FOR_NOW:
619
case AVAHI_BROWSER_CACHE_EXHAUSTED:
620
break;
621
}
622
}
623
624
/* combinds file name and path and returns the malloced new string. som sane checks could/should be added */
625
const char *combinepath(const char *first, const char *second){
1257
626
char *tmp;
1258
int exitcode = EXIT_SUCCESS;
1259
const char *interface = "";
1260
struct ifreq network;
1261
int sd = -1;
1262
bool take_down_interface = false;
1263
uid_t uid;
1264
gid_t gid;
1265
char tempdir[] = "/tmp/mandosXXXXXX";
1266
bool tempdir_created = false;
1267
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1268
const char *seckey = PATHDIR "/" SECKEY;
1269
const char *pubkey = PATHDIR "/" PUBKEY;
1270
1271
bool gnutls_initialized = false;
1272
bool gpgme_initialized = false;
1273
float delay = 2.5f;
1274
double retry_interval = 10; /* 10s between trying a server and
1275
retrying the same server again */
1276
1277
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1278
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1279
1280
uid = getuid();
1281
gid = getgid();
1282
1283
/* Lower any group privileges we might have, just to be safe */
1284
errno = 0;
1285
ret = setgid(gid);
1286
if(ret == -1){
1287
perror_plus("setgid");
1288
}
1289
1290
/* Lower user privileges (temporarily) */
1291
errno = 0;
1292
ret = seteuid(uid);
1293
if(ret == -1){
1294
perror_plus("seteuid");
1295
}
1296
1297
if(quit_now){
1298
goto end;
1299
}
1300
1301
{
1302
struct argp_option options[] = {
1303
{ .name = "debug", .key = 128,
1304
.doc = "Debug mode", .group = 3 },
1305
{ .name = "connect", .key = 'c',
1306
.arg = "ADDRESS:PORT",
1307
.doc = "Connect directly to a specific Mandos server",
1308
.group = 1 },
1309
{ .name = "interface", .key = 'i',
1310
.arg = "NAME",
1311
.doc = "Network interface that will be used to search for"
1312
" Mandos servers",
1313
.group = 1 },
1314
{ .name = "seckey", .key = 's',
1315
.arg = "FILE",
1316
.doc = "OpenPGP secret key file base name",
1317
.group = 1 },
1318
{ .name = "pubkey", .key = 'p',
1319
.arg = "FILE",
1320
.doc = "OpenPGP public key file base name",
1321
.group = 2 },
1322
{ .name = "dh-bits", .key = 129,
1323
.arg = "BITS",
1324
.doc = "Bit length of the prime number used in the"
1325
" Diffie-Hellman key exchange",
1326
.group = 2 },
1327
{ .name = "priority", .key = 130,
1328
.arg = "STRING",
1329
.doc = "GnuTLS priority string for the TLS handshake",
1330
.group = 1 },
1331
{ .name = "delay", .key = 131,
1332
.arg = "SECONDS",
1333
.doc = "Maximum delay to wait for interface startup",
1334
.group = 2 },
1335
{ .name = "retry", .key = 132,
1336
.arg = "SECONDS",
1337
.doc = "Retry interval used when denied by the mandos server",
1338
.group = 2 },
1339
/*
1340
* These reproduce what we would get without ARGP_NO_HELP
1341
*/
1342
{ .name = "help", .key = '?',
1343
.doc = "Give this help list", .group = -1 },
1344
{ .name = "usage", .key = -3,
1345
.doc = "Give a short usage message", .group = -1 },
1346
{ .name = "version", .key = 'V',
1347
.doc = "Print program version", .group = -1 },
1348
{ .name = NULL }
1349
};
1350
1351
error_t parse_opt(int key, char *arg,
1352
struct argp_state *state){
1353
errno = 0;
1354
switch(key){
1355
case 128: /* --debug */
1356
debug = true;
1357
break;
1358
case 'c': /* --connect */
1359
connect_to = arg;
1360
break;
1361
case 'i': /* --interface */
1362
interface = arg;
1363
break;
1364
case 's': /* --seckey */
1365
seckey = arg;
1366
break;
1367
case 'p': /* --pubkey */
1368
pubkey = arg;
1369
break;
1370
case 129: /* --dh-bits */
1371
errno = 0;
1372
tmpmax = strtoimax(arg, &tmp, 10);
1373
if(errno != 0 or tmp == arg or *tmp != '\0'
1374
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1375
argp_error(state, "Bad number of DH bits");
1376
}
1377
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1378
break;
1379
case 130: /* --priority */
1380
mc.priority = arg;
1381
break;
1382
case 131: /* --delay */
1383
errno = 0;
1384
delay = strtof(arg, &tmp);
1385
if(errno != 0 or tmp == arg or *tmp != '\0'){
1386
argp_error(state, "Bad delay");
1387
}
1388
case 132: /* --retry */
1389
errno = 0;
1390
retry_interval = strtod(arg, &tmp);
1391
if(errno != 0 or tmp == arg or *tmp != '\0'
1392
or (retry_interval * 1000) > INT_MAX
1393
or retry_interval < 0){
1394
argp_error(state, "Bad retry interval");
1395
}
1396
break;
1397
/*
1398
* These reproduce what we would get without ARGP_NO_HELP
1399
*/
1400
case '?': /* --help */
1401
argp_state_help(state, state->out_stream,
1402
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1403
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1404
case -3: /* --usage */
1405
argp_state_help(state, state->out_stream,
1406
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1407
case 'V': /* --version */
1408
fprintf(state->out_stream, "%s\n", argp_program_version);
1409
exit(argp_err_exit_status);
1410
break;
1411
default:
1412
return ARGP_ERR_UNKNOWN;
1413
}
1414
return errno;
1415
}
1416
1417
struct argp argp = { .options = options, .parser = parse_opt,
1418
.args_doc = "",
1419
.doc = "Mandos client -- Get and decrypt"
1420
" passwords from a Mandos server" };
1421
ret = argp_parse(&argp, argc, argv,
1422
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1423
switch(ret){
1424
case 0:
1425
break;
1426
case ENOMEM:
1427
default:
1428
errno = ret;
1429
perror_plus("argp_parse");
1430
exitcode = EX_OSERR;
1431
goto end;
1432
case EINVAL:
1433
exitcode = EX_USAGE;
1434
goto end;
1435
}
1436
}
1437
1438
{
1439
/* Work around Debian bug #633582:
1440
<http://bugs.debian.org/633582> */
1441
struct stat st;
1442
1443
/* Re-raise priviliges */
1444
errno = 0;
1445
ret = seteuid(0);
1446
if(ret == -1){
1447
perror_plus("seteuid");
1448
}
1449
1450
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1451
int seckey_fd = open(seckey, O_RDONLY);
1452
if(seckey_fd == -1){
1453
perror_plus("open");
1454
} else {
1455
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1456
if(ret == -1){
1457
perror_plus("fstat");
1458
} else {
1459
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1460
ret = fchown(seckey_fd, uid, gid);
1461
if(ret == -1){
1462
perror_plus("fchown");
1463
}
1464
}
1465
}
1466
TEMP_FAILURE_RETRY(close(seckey_fd));
1467
}
1468
}
1469
1470
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1471
int pubkey_fd = open(pubkey, O_RDONLY);
1472
if(pubkey_fd == -1){
1473
perror_plus("open");
1474
} else {
1475
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1476
if(ret == -1){
1477
perror_plus("fstat");
1478
} else {
1479
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1480
ret = fchown(pubkey_fd, uid, gid);
1481
if(ret == -1){
1482
perror_plus("fchown");
1483
}
1484
}
1485
}
1486
TEMP_FAILURE_RETRY(close(pubkey_fd));
1487
}
1488
}
1489
1490
/* Lower privileges */
1491
errno = 0;
1492
ret = seteuid(uid);
1493
if(ret == -1){
1494
perror_plus("seteuid");
1495
}
1496
}
1497
1498
if(not debug){
1499
avahi_set_log_function(empty_log);
1500
}
1501
1502
if(interface[0] == '\0'){
1503
struct dirent **direntries;
1504
ret = scandir(sys_class_net, &direntries, good_interface,
1505
alphasort);
1506
if(ret >= 1){
1507
/* Pick the first good interface */
1508
interface = strdup(direntries[0]->d_name);
1509
if(debug){
1510
fprintf(stderr, "Using interface \"%s\"\n", interface);
1511
}
1512
if(interface == NULL){
1513
perror_plus("malloc");
1514
free(direntries);
1515
exitcode = EXIT_FAILURE;
1516
goto end;
1517
}
1518
free(direntries);
1519
} else {
1520
free(direntries);
1521
fprintf(stderr, "Could not find a network interface\n");
1522
exitcode = EXIT_FAILURE;
1523
goto end;
1524
}
1525
}
1526
1527
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1528
from the signal handler */
1529
/* Initialize the pseudo-RNG for Avahi */
1530
srand((unsigned int) time(NULL));
1531
mc.simple_poll = avahi_simple_poll_new();
1532
if(mc.simple_poll == NULL){
1533
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1534
exitcode = EX_UNAVAILABLE;
1535
goto end;
1536
}
1537
1538
sigemptyset(&sigterm_action.sa_mask);
1539
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1540
if(ret == -1){
1541
perror_plus("sigaddset");
1542
exitcode = EX_OSERR;
1543
goto end;
1544
}
1545
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1546
if(ret == -1){
1547
perror_plus("sigaddset");
1548
exitcode = EX_OSERR;
1549
goto end;
1550
}
1551
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1552
if(ret == -1){
1553
perror_plus("sigaddset");
1554
exitcode = EX_OSERR;
1555
goto end;
1556
}
1557
/* Need to check if the handler is SIG_IGN before handling:
1558
| [[info:libc:Initial Signal Actions]] |
1559
| [[info:libc:Basic Signal Handling]] |
1560
*/
1561
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1562
if(ret == -1){
1563
perror_plus("sigaction");
1564
return EX_OSERR;
1565
}
1566
if(old_sigterm_action.sa_handler != SIG_IGN){
1567
ret = sigaction(SIGINT, &sigterm_action, NULL);
1568
if(ret == -1){
1569
perror_plus("sigaction");
1570
exitcode = EX_OSERR;
1571
goto end;
1572
}
1573
}
1574
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1575
if(ret == -1){
1576
perror_plus("sigaction");
1577
return EX_OSERR;
1578
}
1579
if(old_sigterm_action.sa_handler != SIG_IGN){
1580
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1581
if(ret == -1){
1582
perror_plus("sigaction");
1583
exitcode = EX_OSERR;
1584
goto end;
1585
}
1586
}
1587
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1588
if(ret == -1){
1589
perror_plus("sigaction");
1590
return EX_OSERR;
1591
}
1592
if(old_sigterm_action.sa_handler != SIG_IGN){
1593
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1594
if(ret == -1){
1595
perror_plus("sigaction");
1596
exitcode = EX_OSERR;
1597
goto end;
1598
}
1599
}
1600
1601
/* If the interface is down, bring it up */
1602
if(strcmp(interface, "none") != 0){
1603
if_index = (AvahiIfIndex) if_nametoindex(interface);
1604
if(if_index == 0){
1605
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1606
exitcode = EX_UNAVAILABLE;
1607
goto end;
1608
}
1609
1610
if(quit_now){
1611
goto end;
1612
}
1613
1614
/* Re-raise priviliges */
1615
errno = 0;
1616
ret = seteuid(0);
1617
if(ret == -1){
1618
perror_plus("seteuid");
1619
}
1620
1621
#ifdef __linux__
1622
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1623
messages about the network interface to mess up the prompt */
1624
ret = klogctl(8, NULL, 5);
1625
bool restore_loglevel = true;
1626
if(ret == -1){
1627
restore_loglevel = false;
1628
perror_plus("klogctl");
1629
}
1630
#endif /* __linux__ */
1631
1632
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1633
if(sd < 0){
1634
perror_plus("socket");
1635
exitcode = EX_OSERR;
1636
#ifdef __linux__
1637
if(restore_loglevel){
1638
ret = klogctl(7, NULL, 0);
1639
if(ret == -1){
1640
perror_plus("klogctl");
1641
}
1642
}
1643
#endif /* __linux__ */
1644
/* Lower privileges */
1645
errno = 0;
1646
ret = seteuid(uid);
1647
if(ret == -1){
1648
perror_plus("seteuid");
1649
}
1650
goto end;
1651
}
1652
strcpy(network.ifr_name, interface);
1653
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1654
if(ret == -1){
1655
perror_plus("ioctl SIOCGIFFLAGS");
1656
#ifdef __linux__
1657
if(restore_loglevel){
1658
ret = klogctl(7, NULL, 0);
1659
if(ret == -1){
1660
perror_plus("klogctl");
1661
}
1662
}
1663
#endif /* __linux__ */
1664
exitcode = EX_OSERR;
1665
/* Lower privileges */
1666
errno = 0;
1667
ret = seteuid(uid);
1668
if(ret == -1){
1669
perror_plus("seteuid");
1670
}
1671
goto end;
1672
}
1673
if((network.ifr_flags & IFF_UP) == 0){
1674
network.ifr_flags |= IFF_UP;
1675
take_down_interface = true;
1676
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1677
if(ret == -1){
1678
take_down_interface = false;
1679
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1680
exitcode = EX_OSERR;
1681
#ifdef __linux__
1682
if(restore_loglevel){
1683
ret = klogctl(7, NULL, 0);
1684
if(ret == -1){
1685
perror_plus("klogctl");
1686
}
1687
}
1688
#endif /* __linux__ */
1689
/* Lower privileges */
1690
errno = 0;
1691
ret = seteuid(uid);
1692
if(ret == -1){
1693
perror_plus("seteuid");
1694
}
1695
goto end;
1696
}
1697
}
1698
/* Sleep checking until interface is running.
1699
Check every 0.25s, up to total time of delay */
1700
for(int i=0; i < delay * 4; i++){
1701
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1702
if(ret == -1){
1703
perror_plus("ioctl SIOCGIFFLAGS");
1704
} else if(network.ifr_flags & IFF_RUNNING){
1705
break;
1706
}
1707
struct timespec sleeptime = { .tv_nsec = 250000000 };
1708
ret = nanosleep(&sleeptime, NULL);
1709
if(ret == -1 and errno != EINTR){
1710
perror_plus("nanosleep");
1711
}
1712
}
1713
if(not take_down_interface){
1714
/* We won't need the socket anymore */
1715
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1716
if(ret == -1){
1717
perror_plus("close");
1718
}
1719
}
1720
#ifdef __linux__
1721
if(restore_loglevel){
1722
/* Restores kernel loglevel to default */
1723
ret = klogctl(7, NULL, 0);
1724
if(ret == -1){
1725
perror_plus("klogctl");
1726
}
1727
}
1728
#endif /* __linux__ */
1729
/* Lower privileges */
1730
errno = 0;
1731
if(take_down_interface){
1732
/* Lower privileges */
1733
ret = seteuid(uid);
1734
if(ret == -1){
1735
perror_plus("seteuid");
1736
}
1737
} else {
1738
/* Lower privileges permanently */
1739
ret = setuid(uid);
1740
if(ret == -1){
1741
perror_plus("setuid");
1742
}
1743
}
1744
}
1745
1746
if(quit_now){
1747
goto end;
1748
}
1749
1750
ret = init_gnutls_global(pubkey, seckey);
1751
if(ret == -1){
1752
fprintf(stderr, "init_gnutls_global failed\n");
1753
exitcode = EX_UNAVAILABLE;
1754
goto end;
1755
} else {
1756
gnutls_initialized = true;
1757
}
1758
1759
if(quit_now){
1760
goto end;
1761
}
1762
1763
if(mkdtemp(tempdir) == NULL){
1764
perror_plus("mkdtemp");
1765
goto end;
1766
}
1767
tempdir_created = true;
1768
1769
if(quit_now){
1770
goto end;
1771
}
1772
1773
if(not init_gpgme(pubkey, seckey, tempdir)){
1774
fprintf(stderr, "init_gpgme failed\n");
1775
exitcode = EX_UNAVAILABLE;
1776
goto end;
1777
} else {
1778
gpgme_initialized = true;
1779
}
1780
1781
if(quit_now){
1782
goto end;
1783
}
1784
1785
if(connect_to != NULL){
1786
/* Connect directly, do not use Zeroconf */
1787
/* (Mainly meant for debugging) */
1788
char *address = strrchr(connect_to, ':');
1789
if(address == NULL){
1790
fprintf(stderr, "No colon in address\n");
1791
exitcode = EX_USAGE;
1792
goto end;
1793
}
1794
1795
if(quit_now){
1796
goto end;
1797
}
1798
1799
uint16_t port;
1800
errno = 0;
1801
tmpmax = strtoimax(address+1, &tmp, 10);
1802
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1803
or tmpmax != (uint16_t)tmpmax){
1804
fprintf(stderr, "Bad port number\n");
1805
exitcode = EX_USAGE;
1806
goto end;
1807
}
1808
1809
if(quit_now){
1810
goto end;
1811
}
1812
1813
port = (uint16_t)tmpmax;
1814
*address = '\0';
1815
/* Colon in address indicates IPv6 */
1816
int af;
1817
if(strchr(connect_to, ':') != NULL){
1818
af = AF_INET6;
1819
/* Accept [] around IPv6 address - see RFC 5952 */
1820
if(connect_to[0] == '[' and address[-1] == ']')
1821
{
1822
connect_to++;
1823
address[-1] = '\0';
1824
}
1825
} else {
1826
af = AF_INET;
1827
}
1828
address = connect_to;
1829
1830
if(quit_now){
1831
goto end;
1832
}
1833
1834
while(not quit_now){
1835
ret = start_mandos_communication(address, port, if_index, af);
1836
if(quit_now or ret == 0){
1837
break;
1838
}
1839
if(debug){
1840
fprintf(stderr, "Retrying in %d seconds\n",
1841
(int)retry_interval);
1842
}
1843
sleep((int)retry_interval);
1844
}
1845
1846
if (not quit_now){
1847
exitcode = EXIT_SUCCESS;
1848
}
1849
1850
goto end;
1851
}
1852
1853
if(quit_now){
1854
goto end;
1855
}
1856
1857
{
627
tmp = malloc(strlen(first) + strlen(second) + 2);
628
if (tmp == NULL){
629
perror("malloc");
630
return NULL;
631
}
632
strcpy(tmp, first);
633
if (first[0] != '\0' and first[strlen(first) - 1] != '/'){
634
strcat(tmp, "/");
635
}
636
strcat(tmp, second);
637
return tmp;
638
}
639
640
641
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
1858
642
AvahiServerConfig config;
1859
/* Do not publish any local Zeroconf records */
643
AvahiSServiceBrowser *sb = NULL;
644
int error;
645
int ret;
646
int returncode = EXIT_SUCCESS;
647
const char *interface = "eth0";
648
649
while (true){
650
static struct option long_options[] = {
651
{"debug", no_argument, (int *)&debug, 1},
652
{"interface", required_argument, 0, 'i'},
653
{"certdir", required_argument, 0, 'd'},
654
{"certkey", required_argument, 0, 'c'},
655
{"certfile", required_argument, 0, 'k'},
656
{0, 0, 0, 0} };
657
658
int option_index = 0;
659
ret = getopt_long (argc, argv, "i:", long_options,
660
&option_index);
661
662
if (ret == -1){
663
break;
664
}
665
666
switch(ret){
667
case 0:
668
break;
669
case 'i':
670
interface = optarg;
671
break;
672
case 'd':
673
certdir = optarg;
674
break;
675
case 'c':
676
certfile = optarg;
677
break;
678
case 'k':
679
certkey = optarg;
680
break;
681
default:
682
exit(EXIT_FAILURE);
683
}
684
}
685
686
certfile = combinepath(certdir, certfile);
687
if (certfile == NULL){
688
goto exit;
689
}
690
691
certkey = combinepath(certdir, certkey);
692
if (certkey == NULL){
693
goto exit;
694
}
695
696
if (not debug){
697
avahi_set_log_function(empty_log);
698
}
699
700
/* Initialize the psuedo-RNG */
701
srand((unsigned int) time(NULL));
702
703
/* Allocate main loop object */
704
if (!(simple_poll = avahi_simple_poll_new())) {
705
fprintf(stderr, "Failed to create simple poll object.\n");
706
707
goto exit;
708
}
709
710
/* Do not publish any local records */
1860
711
avahi_server_config_init(&config);
1861
712
config.publish_hinfo = 0;
1862
713
config.publish_addresses = 0;
1863
714
config.publish_workstation = 0;
1864
715
config.publish_domain = 0;
1865
716
1866
717
/* Allocate a new server */
1867
mc.server = avahi_server_new(avahi_simple_poll_get
1868
(mc.simple_poll), &config, NULL,
1869
NULL, &error);
1870
1871
/* Free the Avahi configuration data */
718
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
719
&config, NULL, NULL, &error);
720
721
/* Free the configuration data */
1872
722
avahi_server_config_free(&config);
1873
}
1874
1875
/* Check if creating the Avahi server object succeeded */
1876
if(mc.server == NULL){
1877
fprintf(stderr, "Failed to create Avahi server: %s\n",
1878
avahi_strerror(error));
1879
exitcode = EX_UNAVAILABLE;
1880
goto end;
1881
}
1882
1883
if(quit_now){
1884
goto end;
1885
}
1886
1887
/* Create the Avahi service browser */
1888
sb = avahi_s_service_browser_new(mc.server, if_index,
1889
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1890
NULL, 0, browse_callback, NULL);
1891
if(sb == NULL){
1892
fprintf(stderr, "Failed to create service browser: %s\n",
1893
avahi_strerror(avahi_server_errno(mc.server)));
1894
exitcode = EX_UNAVAILABLE;
1895
goto end;
1896
}
1897
1898
if(quit_now){
1899
goto end;
1900
}
1901
1902
/* Run the main loop */
1903
1904
if(debug){
1905
fprintf(stderr, "Starting Avahi loop search\n");
1906
}
1907
1908
ret = avahi_loop_with_timeout(mc.simple_poll,
1909
(int)(retry_interval * 1000));
1910
if(debug){
1911
fprintf(stderr, "avahi_loop_with_timeout exited %s\n",
1912
(ret == 0) ? "successfully" : "with error");
1913
}
1914
1915
end:
1916
1917
if(debug){
1918
fprintf(stderr, "%s exiting\n", argv[0]);
1919
}
1920
1921
/* Cleanup things */
1922
if(sb != NULL)
1923
avahi_s_service_browser_free(sb);
1924
1925
if(mc.server != NULL)
1926
avahi_server_free(mc.server);
1927
1928
if(mc.simple_poll != NULL)
1929
avahi_simple_poll_free(mc.simple_poll);
1930
1931
if(gnutls_initialized){
1932
gnutls_certificate_free_credentials(mc.cred);
1933
gnutls_global_deinit();
1934
gnutls_dh_params_deinit(mc.dh_params);
1935
}
1936
1937
if(gpgme_initialized){
1938
gpgme_release(mc.ctx);
1939
}
1940
1941
/* Cleans up the circular linked list of Mandos servers the client
1942
has seen */
1943
if(mc.current_server != NULL){
1944
mc.current_server->prev->next = NULL;
1945
while(mc.current_server != NULL){
1946
server *next = mc.current_server->next;
1947
free(mc.current_server);
1948
mc.current_server = next;
1949
}
1950
}
1951
1952
/* Take down the network interface */
1953
if(take_down_interface){
1954
/* Re-raise priviliges */
1955
errno = 0;
1956
ret = seteuid(0);
1957
if(ret == -1){
1958
perror_plus("seteuid");
1959
}
1960
if(geteuid() == 0){
1961
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1962
if(ret == -1){
1963
perror_plus("ioctl SIOCGIFFLAGS");
1964
} else if(network.ifr_flags & IFF_UP) {
1965
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1966
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1967
if(ret == -1){
1968
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1969
}
1970
}
1971
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1972
if(ret == -1){
1973
perror_plus("close");
1974
}
1975
/* Lower privileges permanently */
1976
errno = 0;
1977
ret = setuid(uid);
1978
if(ret == -1){
1979
perror_plus("setuid");
1980
}
1981
}
1982
}
1983
1984
/* Removes the GPGME temp directory and all files inside */
1985
if(tempdir_created){
1986
struct dirent **direntries = NULL;
1987
struct dirent *direntry = NULL;
1988
int numentries = scandir(tempdir, &direntries, notdotentries,
1989
alphasort);
1990
if (numentries > 0){
1991
for(int i = 0; i < numentries; i++){
1992
direntry = direntries[i];
1993
char *fullname = NULL;
1994
ret = asprintf(&fullname, "%s/%s", tempdir,
1995
direntry->d_name);
1996
if(ret < 0){
1997
perror_plus("asprintf");
1998
continue;
1999
}
2000
ret = remove(fullname);
2001
if(ret == -1){
2002
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
2003
strerror(errno));
2004
}
2005
free(fullname);
2006
}
2007
}
2008
2009
/* need to clean even if 0 because man page doesn't specify */
2010
free(direntries);
2011
if (numentries == -1){
2012
perror_plus("scandir");
2013
}
2014
ret = rmdir(tempdir);
2015
if(ret == -1 and errno != ENOENT){
2016
perror_plus("rmdir");
2017
}
2018
}
2019
2020
if(quit_now){
2021
sigemptyset(&old_sigterm_action.sa_mask);
2022
old_sigterm_action.sa_handler = SIG_DFL;
2023
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
2024
&old_sigterm_action,
2025
NULL));
2026
if(ret == -1){
2027
perror_plus("sigaction");
2028
}
2029
do {
2030
ret = raise(signal_received);
2031
} while(ret != 0 and errno == EINTR);
2032
if(ret != 0){
2033
perror_plus("raise");
2034
abort();
2035
}
2036
TEMP_FAILURE_RETRY(pause());
2037
}
2038
2039
return exitcode;
723
724
/* Check if creating the server object succeeded */
725
if (!server) {
726
fprintf(stderr, "Failed to create server: %s\n",
727
avahi_strerror(error));
728
returncode = EXIT_FAILURE;
729
goto exit;
730
}
731
732
/* Create the service browser */
733
sb = avahi_s_service_browser_new(server,
734
(AvahiIfIndex)
735
if_nametoindex(interface),
736
AVAHI_PROTO_INET6,
737
"_mandos._tcp", NULL, 0,
738
browse_callback, server);
739
if (!sb) {
740
fprintf(stderr, "Failed to create service browser: %s\n",
741
avahi_strerror(avahi_server_errno(server)));
742
returncode = EXIT_FAILURE;
743
goto exit;
744
}
745
746
/* Run the main loop */
747
748
if (debug){
749
fprintf(stderr, "Starting avahi loop search\n");
750
}
751
752
avahi_simple_poll_loop(simple_poll);
753
754
exit:
755
756
if (debug){
757
fprintf(stderr, "%s exiting\n", argv[0]);
758
}
759
760
/* Cleanup things */
761
if (sb)
762
avahi_s_service_browser_free(sb);
763
764
if (server)
765
avahi_server_free(server);
766
767
if (simple_poll)
768
avahi_simple_poll_free(simple_poll);
769
free(certfile);
770
free(certkey);
771
772
return returncode;
2040
773
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0