/mandos/release : revision 269.1.2

43

stdout, ferror(), remove() */

44

#include <stdint.h> /* uint16_t, uint32_t */

45

#include <stddef.h> /* NULL, size_t, ssize_t */

46

#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),

47

strtof(), abort() */

46

#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,

47

srand(), strtof(), abort() */

48

#include <stdbool.h> /* bool, false, true */

49

#include <string.h> /* memset(), strcmp(), strlen(),

50

strerror(), asprintf(), strcpy() */

63

strtoimax() */

64

#include <assert.h> /* assert() */

65

#include <errno.h> /* perror(), errno */

66

#include <time.h> /* nanosleep(), time(), sleep() */

66

#include <time.h> /* nanosleep(), time() */

67

#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,

68

SIOCSIFFLAGS, if_indextoname(),

69

if_nametoindex(), IF_NAMESIZE */

82

#include <signal.h> /* sigemptyset(), sigaddset(),

83

sigaction(), SIGTERM, sig_atomic_t,

84

raise() */

85

#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,

86

EX_NOHOST, EX_IOERR, EX_PROTOCOL */

87

85

88

86

#ifdef __linux__

89

87

#include <sys/klog.h> /* klogctl() */

556

554

gnutls_session_t session;

557

555

int pf; /* Protocol family */

558

556

559

errno = 0;

560

561

557

if(quit_now){

562

errno = EINTR;

563

558

return -1;

564

559

}

565

560

572

567

break;

573

568

default:

574

569

fprintf(stderr, "Bad address family: %d\n", af);

575

errno = EINVAL;

576

570

return -1;

577

571

}

578

572

588

582

589

583

tcp_sd = socket(pf, SOCK_STREAM, 0);

590

584

if(tcp_sd < 0){

591

int e = errno;

592

585

perror("socket");

593

errno = e;

594

586

goto mandos_end;

595

587

}

596

588

597

589

if(quit_now){

598

errno = EINTR;

599

590

goto mandos_end;

600

591

}

601

592

608

599

ret = inet_pton(af, ip, &to.in.sin_addr);

609

600

}

610

601

if(ret < 0 ){

611

int e = errno;

612

602

perror("inet_pton");

613

errno = e;

614

603

goto mandos_end;

615

604

}

616

605

if(ret == 0){

617

int e = errno;

618

606

fprintf(stderr, "Bad address: %s\n", ip);

619

errno = e;

620

607

goto mandos_end;

621

608

}

622

609

if(af == AF_INET6){

630

617

if(if_index == AVAHI_IF_UNSPEC){

631

618

fprintf(stderr, "An IPv6 link-local address is incomplete"

632

619

" without a network interface\n");

633

errno = EINVAL;

634

620

goto mandos_end;

635

621

}

636

622

/* Set the network interface number as scope */

643

629

}

644

630

645

631

if(quit_now){

646

errno = EINTR;

647

632

goto mandos_end;

648

633

}

649

634

680

665

}

681

666

682

667

if(quit_now){

683

errno = EINTR;

684

668

goto mandos_end;

685

669

}

686

670

690

674

ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */

691

675

}

692

676

if(ret < 0){

693

if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){

694

int e = errno;

695

perror("connect");

696

errno = e;

697

}

677

perror("connect");

698

678

goto mandos_end;

699

679

}

700

680

701

681

if(quit_now){

702

errno = EINTR;

703

682

goto mandos_end;

704

683

}

705

684

710

689

ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,

711

690

out_size - written));

712

691

if(ret == -1){

713

int e = errno;

714

692

perror("write");

715

errno = e;

716

693

goto mandos_end;

717

694

}

718

695

written += (size_t)ret;

728

705

}

729

706

730

707

if(quit_now){

731

errno = EINTR;

732

708

goto mandos_end;

733

709

}

734

710

}

738

714

}

739

715

740

716

if(quit_now){

741

errno = EINTR;

742

717

goto mandos_end;

743

718

}

744

719

745

720

gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);

746

721

747

722

if(quit_now){

748

errno = EINTR;

749

723

goto mandos_end;

750

724

}

751

725

752

726

do {

753

727

ret = gnutls_handshake(session);

754

728

if(quit_now){

755

errno = EINTR;

756

729

goto mandos_end;

757

730

}

758

731

} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);

762

735

fprintf(stderr, "*** GnuTLS Handshake failed ***\n");

763

736

gnutls_perror(ret);

764

737

}

765

errno = EPROTO;

766

738

goto mandos_end;

767

739

}

768

740

776

748

while(true){

777

749

778

750

if(quit_now){

779

errno = EINTR;

780

751

goto mandos_end;

781

752

}

782

753

783

754

buffer_capacity = incbuffer(&buffer, buffer_length,

784

755

buffer_capacity);

785

756

if(buffer_capacity == 0){

786

int e = errno;

787

757

perror("incbuffer");

788

errno = e;

789

758

goto mandos_end;

790

759

}

791

760

792

761

if(quit_now){

793

errno = EINTR;

794

762

goto mandos_end;

795

763

}

796

764

809

777

ret = gnutls_handshake(session);

810

778

811

779

if(quit_now){

812

errno = EINTR;

813

780

goto mandos_end;

814

781

}

815

782

} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);

816

783

if(ret < 0){

817

784

fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");

818

785

gnutls_perror(ret);

819

errno = EPROTO;

820

786

goto mandos_end;

821

787

}

822

788

break;

824

790

fprintf(stderr, "Unknown error while reading data from"

825

791

" encrypted session with Mandos server\n");

826

792

gnutls_bye(session, GNUTLS_SHUT_RDWR);

827

errno = EIO;

828

793

goto mandos_end;

829

794

}

830

795

} else {

837

802

}

838

803

839

804

if(quit_now){

840

errno = EINTR;

841

805

goto mandos_end;

842

806

}

843

807

844

808

do {

845

809

ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);

846

810

if(quit_now){

847

errno = EINTR;

848

811

goto mandos_end;

849

812

}

850

813

} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);

859

822

written = 0;

860

823

while(written < (size_t) decrypted_buffer_size){

861

824

if(quit_now){

862

errno = EINTR;

863

825

goto mandos_end;

864

826

}

865

827

867

829

(size_t)decrypted_buffer_size - written,

868

830

stdout);

869

831

if(ret == 0 and ferror(stdout)){

870

int e = errno;

871

832

if(debug){

872

833

fprintf(stderr, "Error writing encrypted data: %s\n",

873

834

strerror(errno));

874

835

}

875

errno = e;

876

836

goto mandos_end;

877

837

}

878

838

written += (size_t)ret;

884

844

/* Shutdown procedure */

885

845

886

846

mandos_end:

887

{

888

int e = errno;

889

free(decrypted_buffer);

890

free(buffer);

891

if(tcp_sd >= 0){

892

ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));

893

}

894

if(ret == -1){

895

if(e == 0){

896

e = errno;

897

}

898

perror("close");

899

}

900

gnutls_deinit(session);

901

if(quit_now){

902

e = EINTR;

903

retval = -1;

904

}

905

errno = e;

847

free(decrypted_buffer);

848

free(buffer);

849

if(tcp_sd >= 0){

850

ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));

851

}

852

if(ret == -1){

853

perror("close");

854

}

855

gnutls_deinit(session);

856

if(quit_now){

857

retval = -1;

906

858

}

907

859

return retval;

908

860

}

1200

1152

.arg = "SECONDS",

1201

1153

.doc = "Maximum delay to wait for interface startup",

1202

1154

.group = 2 },

1203

/*

1204

* These reproduce what we would get without ARGP_NO_HELP

1205

*/

1206

{ .name = "help", .key = '?',

1207

.doc = "Give this help list", .group = -1 },

1208

{ .name = "usage", .key = -3,

1209

.doc = "Give a short usage message", .group = -1 },

1210

{ .name = "version", .key = 'V',

1211

.doc = "Print program version", .group = -1 },

1212

1155

{ .name = NULL }

1213

1156

};

1214

1157

1215

1158

error_t parse_opt(int key, char *arg,

1216

1159

struct argp_state *state){

1217

errno = 0;

1218

1160

switch(key){

1219

1161

case 128: /* --debug */

1220

1162

debug = true;

1236

1178

tmpmax = strtoimax(arg, &tmp, 10);

1237

1179

if(errno != 0 or tmp == arg or *tmp != '\0'

1238

1180

or tmpmax != (typeof(mc.dh_bits))tmpmax){

1239

argp_error(state, "Bad number of DH bits");

1181

fprintf(stderr, "Bad number of DH bits\n");

1182

exit(EXIT_FAILURE);

1240

1183

}

1241

1184

mc.dh_bits = (typeof(mc.dh_bits))tmpmax;

1242

1185

break;

1247

1190

errno = 0;

1248

1191

delay = strtof(arg, &tmp);

1249

1192

if(errno != 0 or tmp == arg or *tmp != '\0'){

1250

argp_error(state, "Bad delay");

1193

fprintf(stderr, "Bad delay\n");

1194

exit(EXIT_FAILURE);

1251

1195

}

1252

1196

break;

1253

/*

1254

* These reproduce what we would get without ARGP_NO_HELP

1255

*/

1256

case '?': /* --help */

1257

argp_state_help(state, state->out_stream,

1258

(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)

1259

& ~(unsigned int)ARGP_HELP_EXIT_OK);

1260

case -3: /* --usage */

1261

argp_state_help(state, state->out_stream,

1262

ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);

1263

case 'V': /* --version */

1264

fprintf(state->out_stream, "%s\n", argp_program_version);

1265

exit(argp_err_exit_status);

1197

case ARGP_KEY_ARG:

1198

argp_usage(state);

1199

case ARGP_KEY_END:

1266

1200

break;

1267

1201

default:

1268

1202

return ARGP_ERR_UNKNOWN;

1269

1203

}

1270

return errno;

1204

return 0;

1271

1205

}

1272

1206

1273

1207

struct argp argp = { .options = options, .parser = parse_opt,

1274

1208

.args_doc = "",

1275

1209

.doc = "Mandos client -- Get and decrypt"

1276

1210

" passwords from a Mandos server" };

1277

ret = argp_parse(&argp, argc, argv,

1278

ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);

1279

switch(ret){

1280

case 0:

1281

break;

1282

case ENOMEM:

1283

default:

1284

errno = ret;

1285

perror("argp_parse");

1286

exitcode = EX_OSERR;

1287

goto end;

1288

case EINVAL:

1289

exitcode = EX_USAGE;

1211

ret = argp_parse(&argp, argc, argv, 0, 0, NULL);

1212

if(ret == ARGP_ERR_UNKNOWN){

1213

fprintf(stderr, "Unknown error while parsing arguments\n");

1214

exitcode = EXIT_FAILURE;

1290

1215

goto end;

1291

1216

}

1292

1217

}

1327

1252

mc.simple_poll = avahi_simple_poll_new();

1328

1253

if(mc.simple_poll == NULL){

1329

1254

fprintf(stderr, "Avahi: Failed to create simple poll object.\n");

1330

exitcode = EX_UNAVAILABLE;

1255

exitcode = EXIT_FAILURE;

1331

1256

goto end;

1332

1257

}

1333

1258

1335

1260

ret = sigaddset(&sigterm_action.sa_mask, SIGINT);

1336

1261

if(ret == -1){

1337

1262

perror("sigaddset");

1338

exitcode = EX_OSERR;

1263

exitcode = EXIT_FAILURE;

1339

1264

goto end;

1340

1265

}

1341

1266

ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);

1342

1267

if(ret == -1){

1343

1268

perror("sigaddset");

1344

exitcode = EX_OSERR;

1269

exitcode = EXIT_FAILURE;

1345

1270

goto end;

1346

1271

}

1347

1272

ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);

1348

1273

if(ret == -1){

1349

1274

perror("sigaddset");

1350

exitcode = EX_OSERR;

1275

exitcode = EXIT_FAILURE;

1351

1276

goto end;

1352

1277

}

1353

1278

/* Need to check if the handler is SIG_IGN before handling:

1357

1282

ret = sigaction(SIGINT, NULL, &old_sigterm_action);

1358

1283

if(ret == -1){

1359

1284

perror("sigaction");

1360

return EX_OSERR;

1285

return EXIT_FAILURE;

1361

1286

}

1362

1287

if(old_sigterm_action.sa_handler != SIG_IGN){

1363

1288

ret = sigaction(SIGINT, &sigterm_action, NULL);

1364

1289

if(ret == -1){

1365

1290

perror("sigaction");

1366

exitcode = EX_OSERR;

1291

exitcode = EXIT_FAILURE;

1367

1292

goto end;

1368

1293

}

1369

1294

}

1370

1295

ret = sigaction(SIGHUP, NULL, &old_sigterm_action);

1371

1296

if(ret == -1){

1372

1297

perror("sigaction");

1373

return EX_OSERR;

1298

return EXIT_FAILURE;

1374

1299

}

1375

1300

if(old_sigterm_action.sa_handler != SIG_IGN){

1376

1301

ret = sigaction(SIGHUP, &sigterm_action, NULL);

1377

1302

if(ret == -1){

1378

1303

perror("sigaction");

1379

exitcode = EX_OSERR;

1304

exitcode = EXIT_FAILURE;

1380

1305

goto end;

1381

1306

}

1382

1307

}

1383

1308

ret = sigaction(SIGTERM, NULL, &old_sigterm_action);

1384

1309

if(ret == -1){

1385

1310

perror("sigaction");

1386

return EX_OSERR;

1311

return EXIT_FAILURE;

1387

1312

}

1388

1313

if(old_sigterm_action.sa_handler != SIG_IGN){

1389

1314

ret = sigaction(SIGTERM, &sigterm_action, NULL);

1390

1315

if(ret == -1){

1391

1316

perror("sigaction");

1392

exitcode = EX_OSERR;

1317

exitcode = EXIT_FAILURE;

1393

1318

goto end;

1394

1319

}

1395

1320

}

1399

1324

if_index = (AvahiIfIndex) if_nametoindex(interface);

1400

1325

if(if_index == 0){

1401

1326

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1402

exitcode = EX_UNAVAILABLE;

1327

exitcode = EXIT_FAILURE;

1403

1328

goto end;

1404

1329

}

1405

1330

1416

1341

1417

1342

#ifdef __linux__

1418

1343

/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO

1419

messages about the network interface to mess up the prompt */

1344

messages to mess up the prompt */

1420

1345

ret = klogctl(8, NULL, 5);

1421

1346

bool restore_loglevel = true;

1422

1347

if(ret == -1){

1428

1353

sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

1429

1354

if(sd < 0){

1430

1355

perror("socket");

1431

exitcode = EX_OSERR;

1356

exitcode = EXIT_FAILURE;

1432

1357

#ifdef __linux__

1433

1358

if(restore_loglevel){

1434

1359

ret = klogctl(7, NULL, 0);

1457

1382

}

1458

1383

}

1459

1384

#endif /* __linux__ */

1460

exitcode = EX_OSERR;

1385

exitcode = EXIT_FAILURE;

1461

1386

/* Lower privileges */

1462

1387

errno = 0;

1463

1388

ret = seteuid(uid);

1473

1398

if(ret == -1){

1474

1399

take_down_interface = false;

1475

1400

perror("ioctl SIOCSIFFLAGS +IFF_UP");

1476

exitcode = EX_OSERR;

1401

exitcode = EXIT_FAILURE;

1477

1402

#ifdef __linux__

1478

1403

if(restore_loglevel){

1479

1404

ret = klogctl(7, NULL, 0);

1545

1470

ret = init_gnutls_global(pubkey, seckey);

1546

1471

if(ret == -1){

1547

1472

fprintf(stderr, "init_gnutls_global failed\n");

1548

exitcode = EX_UNAVAILABLE;

1473

exitcode = EXIT_FAILURE;

1549

1474

goto end;

1550

1475

} else {

1551

1476

gnutls_initialized = true;

1568

1493

1569

1494

if(not init_gpgme(pubkey, seckey, tempdir)){

1570

1495

fprintf(stderr, "init_gpgme failed\n");

1571

exitcode = EX_UNAVAILABLE;

1496

exitcode = EXIT_FAILURE;

1572

1497

goto end;

1573

1498

} else {

1574

1499

gpgme_initialized = true;

1584

1509

char *address = strrchr(connect_to, ':');

1585

1510

if(address == NULL){

1586

1511

fprintf(stderr, "No colon in address\n");

1587

exitcode = EX_USAGE;

1512

exitcode = EXIT_FAILURE;

1588

1513

goto end;

1589

1514

}

1590

1515

1598

1523

if(errno != 0 or tmp == address+1 or *tmp != '\0'

1599

1524

or tmpmax != (uint16_t)tmpmax){

1600

1525

fprintf(stderr, "Bad port number\n");

1601

exitcode = EX_USAGE;

1526

exitcode = EXIT_FAILURE;

1602

1527

goto end;

1603

1528

}

1604

1529

1620

1545

if(quit_now){

1621

1546

goto end;

1622

1547

}

1623

1624

while(not quit_now){

1625

ret = start_mandos_communication(address, port, if_index, af);

1626

if(quit_now or ret == 0){

1627

break;

1628

}

1629

sleep(15);

1630

};

1631

1632

if (not quit_now){

1548

1549

ret = start_mandos_communication(address, port, if_index, af);

1550

if(ret < 0){

1551

exitcode = EXIT_FAILURE;

1552

} else {

1633

1553

exitcode = EXIT_SUCCESS;

1634

1554

}

1635

1636

1555

goto end;

1637

1556

}

1638

1557

1662

1581

if(mc.server == NULL){

1663

1582

fprintf(stderr, "Failed to create Avahi server: %s\n",

1664

1583

avahi_strerror(error));

1665

exitcode = EX_UNAVAILABLE;

1584

exitcode = EXIT_FAILURE;

1666

1585

goto end;

1667

1586

}

1668

1587

1677

1596

if(sb == NULL){

1678

1597

fprintf(stderr, "Failed to create service browser: %s\n",

1679

1598

avahi_strerror(avahi_server_errno(mc.server)));

1680

exitcode = EX_UNAVAILABLE;

1599

exitcode = EXIT_FAILURE;

1681

1600

goto end;

1682

1601

}

1683

1602

1732

1651

if(ret == -1){

1733

1652

perror("ioctl SIOCGIFFLAGS");

1734

1653

} else if(network.ifr_flags & IFF_UP) {

1735

network.ifr_flags &= ~(short)IFF_UP; /* clear flag */

1654

network.ifr_flags &= ~IFF_UP; /* clear flag */

1736

1655

ret = ioctl(sd, SIOCSIFFLAGS, &network);

1737

1656

if(ret == -1){

1738

1657

perror("ioctl SIOCSIFFLAGS -IFF_UP");