/mandos/release : revision 269.1.2

43

stdout, ferror(), remove() */

44

#include <stdint.h> /* uint16_t, uint32_t */

45

#include <stddef.h> /* NULL, size_t, ssize_t */

46

#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),

47

strtof(), abort() */

46

#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,

47

srand(), strtof(), abort() */

48

#include <stdbool.h> /* bool, false, true */

49

#include <string.h> /* memset(), strcmp(), strlen(),

50

strerror(), asprintf(), strcpy() */

82

#include <signal.h> /* sigemptyset(), sigaddset(),

83

sigaction(), SIGTERM, sig_atomic_t,

84

raise() */

85

#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,

86

EX_NOHOST, EX_IOERR, EX_PROTOCOL */

87

85

88

86

#ifdef __linux__

89

87

#include <sys/klog.h> /* klogctl() */

556

554

gnutls_session_t session;

557

555

int pf; /* Protocol family */

558

556

559

errno = 0;

560

561

557

if(quit_now){

562

errno = EINTR;

563

558

return -1;

564

559

}

565

560

572

567

break;

573

568

default:

574

569

fprintf(stderr, "Bad address family: %d\n", af);

575

errno = EINVAL;

576

570

return -1;

577

571

}

578

572

588

582

589

583

tcp_sd = socket(pf, SOCK_STREAM, 0);

590

584

if(tcp_sd < 0){

591

int e = errno;

592

585

perror("socket");

593

errno = e;

594

586

goto mandos_end;

595

587

}

596

588

597

589

if(quit_now){

598

errno = EINTR;

599

590

goto mandos_end;

600

591

}

601

592

608

599

ret = inet_pton(af, ip, &to.in.sin_addr);

609

600

}

610

601

if(ret < 0 ){

611

int e = errno;

612

602

perror("inet_pton");

613

errno = e;

614

603

goto mandos_end;

615

604

}

616

605

if(ret == 0){

617

int e = errno;

618

606

fprintf(stderr, "Bad address: %s\n", ip);

619

errno = e;

620

607

goto mandos_end;

621

608

}

622

609

if(af == AF_INET6){

630

617

if(if_index == AVAHI_IF_UNSPEC){

631

618

fprintf(stderr, "An IPv6 link-local address is incomplete"

632

619

" without a network interface\n");

633

errno = EINVAL;

634

620

goto mandos_end;

635

621

}

636

622

/* Set the network interface number as scope */

643

629

}

644

630

645

631

if(quit_now){

646

errno = EINTR;

647

632

goto mandos_end;

648

633

}

649

634

680

665

}

681

666

682

667

if(quit_now){

683

errno = EINTR;

684

668

goto mandos_end;

685

669

}

686

670

690

674

ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */

691

675

}

692

676

if(ret < 0){

693

int e = errno;

694

677

perror("connect");

695

errno = e;

696

678

goto mandos_end;

697

679

}

698

680

699

681

if(quit_now){

700

errno = EINTR;

701

682

goto mandos_end;

702

683

}

703

684

708

689

ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,

709

690

out_size - written));

710

691

if(ret == -1){

711

int e = errno;

712

692

perror("write");

713

errno = e;

714

693

goto mandos_end;

715

694

}

716

695

written += (size_t)ret;

726

705

}

727

706

728

707

if(quit_now){

729

errno = EINTR;

730

708

goto mandos_end;

731

709

}

732

710

}

736

714

}

737

715

738

716

if(quit_now){

739

errno = EINTR;

740

717

goto mandos_end;

741

718

}

742

719

743

720

gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);

744

721

745

722

if(quit_now){

746

errno = EINTR;

747

723

goto mandos_end;

748

724

}

749

725

750

726

do {

751

727

ret = gnutls_handshake(session);

752

728

if(quit_now){

753

errno = EINTR;

754

729

goto mandos_end;

755

730

}

756

731

} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);

760

735

fprintf(stderr, "*** GnuTLS Handshake failed ***\n");

761

736

gnutls_perror(ret);

762

737

}

763

errno = EPROTO;

764

738

goto mandos_end;

765

739

}

766

740

774

748

while(true){

775

749

776

750

if(quit_now){

777

errno = EINTR;

778

751

goto mandos_end;

779

752

}

780

753

781

754

buffer_capacity = incbuffer(&buffer, buffer_length,

782

755

buffer_capacity);

783

756

if(buffer_capacity == 0){

784

int e = errno;

785

757

perror("incbuffer");

786

errno = e;

787

758

goto mandos_end;

788

759

}

789

760

790

761

if(quit_now){

791

errno = EINTR;

792

762

goto mandos_end;

793

763

}

794

764

807

777

ret = gnutls_handshake(session);

808

778

809

779

if(quit_now){

810

errno = EINTR;

811

780

goto mandos_end;

812

781

}

813

782

} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);

814

783

if(ret < 0){

815

784

fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");

816

785

gnutls_perror(ret);

817

errno = EPROTO;

818

786

goto mandos_end;

819

787

}

820

788

break;

822

790

fprintf(stderr, "Unknown error while reading data from"

823

791

" encrypted session with Mandos server\n");

824

792

gnutls_bye(session, GNUTLS_SHUT_RDWR);

825

errno = EIO;

826

793

goto mandos_end;

827

794

}

828

795

} else {

835

802

}

836

803

837

804

if(quit_now){

838

errno = EINTR;

839

805

goto mandos_end;

840

806

}

841

807

842

808

do {

843

809

ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);

844

810

if(quit_now){

845

errno = EINTR;

846

811

goto mandos_end;

847

812

}

848

813

} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);

857

822

written = 0;

858

823

while(written < (size_t) decrypted_buffer_size){

859

824

if(quit_now){

860

errno = EINTR;

861

825

goto mandos_end;

862

826

}

863

827

865

829

(size_t)decrypted_buffer_size - written,

866

830

stdout);

867

831

if(ret == 0 and ferror(stdout)){

868

int e = errno;

869

832

if(debug){

870

833

fprintf(stderr, "Error writing encrypted data: %s\n",

871

834

strerror(errno));

872

835

}

873

errno = e;

874

836

goto mandos_end;

875

837

}

876

838

written += (size_t)ret;

882

844

/* Shutdown procedure */

883

845

884

846

mandos_end:

885

{

886

int e = errno;

887

free(decrypted_buffer);

888

free(buffer);

889

if(tcp_sd >= 0){

890

ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));

891

}

892

if(ret == -1){

893

if(e == 0){

894

e = errno;

895

}

896

perror("close");

897

}

898

gnutls_deinit(session);

899

if(quit_now){

900

e = EINTR;

901

retval = -1;

902

}

903

errno = e;

847

free(decrypted_buffer);

848

free(buffer);

849

if(tcp_sd >= 0){

850

ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));

851

}

852

if(ret == -1){

853

perror("close");

854

}

855

gnutls_deinit(session);

856

if(quit_now){

857

retval = -1;

904

858

}

905

859

return retval;

906

860

}

1198

1152

.arg = "SECONDS",

1199

1153

.doc = "Maximum delay to wait for interface startup",

1200

1154

.group = 2 },

1201

/*

1202

* These reproduce what we would get without ARGP_NO_HELP

1203

*/

1204

{ .name = "help", .key = '?',

1205

.doc = "Give this help list", .group = -1 },

1206

{ .name = "usage", .key = -3,

1207

.doc = "Give a short usage message", .group = -1 },

1208

{ .name = "version", .key = 'V',

1209

.doc = "Print program version", .group = -1 },

1210

1155

{ .name = NULL }

1211

1156

};

1212

1157

1213

1158

error_t parse_opt(int key, char *arg,

1214

1159

struct argp_state *state){

1215

errno = 0;

1216

1160

switch(key){

1217

1161

case 128: /* --debug */

1218

1162

debug = true;

1234

1178

tmpmax = strtoimax(arg, &tmp, 10);

1235

1179

if(errno != 0 or tmp == arg or *tmp != '\0'

1236

1180

or tmpmax != (typeof(mc.dh_bits))tmpmax){

1237

argp_error(state, "Bad number of DH bits");

1181

fprintf(stderr, "Bad number of DH bits\n");

1182

exit(EXIT_FAILURE);

1238

1183

}

1239

1184

mc.dh_bits = (typeof(mc.dh_bits))tmpmax;

1240

1185

break;

1245

1190

errno = 0;

1246

1191

delay = strtof(arg, &tmp);

1247

1192

if(errno != 0 or tmp == arg or *tmp != '\0'){

1248

argp_error(state, "Bad delay");

1193

fprintf(stderr, "Bad delay\n");

1194

exit(EXIT_FAILURE);

1249

1195

}

1250

1196

break;

1251

/*

1252

* These reproduce what we would get without ARGP_NO_HELP

1253

*/

1254

case '?': /* --help */

1255

argp_state_help(state, state->out_stream,

1256

(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)

1257

& ~(unsigned int)ARGP_HELP_EXIT_OK);

1258

case -3: /* --usage */

1259

argp_state_help(state, state->out_stream,

1260

ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);

1261

case 'V': /* --version */

1262

fprintf(state->out_stream, "%s\n", argp_program_version);

1263

exit(argp_err_exit_status);

1197

case ARGP_KEY_ARG:

1198

argp_usage(state);

1199

case ARGP_KEY_END:

1264

1200

break;

1265

1201

default:

1266

1202

return ARGP_ERR_UNKNOWN;

1267

1203

}

1268

return errno;

1204

return 0;

1269

1205

}

1270

1206

1271

1207

struct argp argp = { .options = options, .parser = parse_opt,

1272

1208

.args_doc = "",

1273

1209

.doc = "Mandos client -- Get and decrypt"

1274

1210

" passwords from a Mandos server" };

1275

ret = argp_parse(&argp, argc, argv,

1276

ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);

1277

switch(ret){

1278

case 0:

1279

break;

1280

case ENOMEM:

1281

default:

1282

errno = ret;

1283

perror("argp_parse");

1284

exitcode = EX_OSERR;

1285

goto end;

1286

case EINVAL:

1287

exitcode = EX_USAGE;

1211

ret = argp_parse(&argp, argc, argv, 0, 0, NULL);

1212

if(ret == ARGP_ERR_UNKNOWN){

1213

fprintf(stderr, "Unknown error while parsing arguments\n");

1214

exitcode = EXIT_FAILURE;

1288

1215

goto end;

1289

1216

}

1290

1217

}

1325

1252

mc.simple_poll = avahi_simple_poll_new();

1326

1253

if(mc.simple_poll == NULL){

1327

1254

fprintf(stderr, "Avahi: Failed to create simple poll object.\n");

1328

exitcode = EX_UNAVAILABLE;

1255

exitcode = EXIT_FAILURE;

1329

1256

goto end;

1330

1257

}

1331

1258

1333

1260

ret = sigaddset(&sigterm_action.sa_mask, SIGINT);

1334

1261

if(ret == -1){

1335

1262

perror("sigaddset");

1336

exitcode = EX_OSERR;

1263

exitcode = EXIT_FAILURE;

1337

1264

goto end;

1338

1265

}

1339

1266

ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);

1340

1267

if(ret == -1){

1341

1268

perror("sigaddset");

1342

exitcode = EX_OSERR;

1269

exitcode = EXIT_FAILURE;

1343

1270

goto end;

1344

1271

}

1345

1272

ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);

1346

1273

if(ret == -1){

1347

1274

perror("sigaddset");

1348

exitcode = EX_OSERR;

1275

exitcode = EXIT_FAILURE;

1349

1276

goto end;

1350

1277

}

1351

1278

/* Need to check if the handler is SIG_IGN before handling:

1355

1282

ret = sigaction(SIGINT, NULL, &old_sigterm_action);

1356

1283

if(ret == -1){

1357

1284

perror("sigaction");

1358

return EX_OSERR;

1285

return EXIT_FAILURE;

1359

1286

}

1360

1287

if(old_sigterm_action.sa_handler != SIG_IGN){

1361

1288

ret = sigaction(SIGINT, &sigterm_action, NULL);

1362

1289

if(ret == -1){

1363

1290

perror("sigaction");

1364

exitcode = EX_OSERR;

1291

exitcode = EXIT_FAILURE;

1365

1292

goto end;

1366

1293

}

1367

1294

}

1368

1295

ret = sigaction(SIGHUP, NULL, &old_sigterm_action);

1369

1296

if(ret == -1){

1370

1297

perror("sigaction");

1371

return EX_OSERR;

1298

return EXIT_FAILURE;

1372

1299

}

1373

1300

if(old_sigterm_action.sa_handler != SIG_IGN){

1374

1301

ret = sigaction(SIGHUP, &sigterm_action, NULL);

1375

1302

if(ret == -1){

1376

1303

perror("sigaction");

1377

exitcode = EX_OSERR;

1304

exitcode = EXIT_FAILURE;

1378

1305

goto end;

1379

1306

}

1380

1307

}

1381

1308

ret = sigaction(SIGTERM, NULL, &old_sigterm_action);

1382

1309

if(ret == -1){

1383

1310

perror("sigaction");

1384

return EX_OSERR;

1311

return EXIT_FAILURE;

1385

1312

}

1386

1313

if(old_sigterm_action.sa_handler != SIG_IGN){

1387

1314

ret = sigaction(SIGTERM, &sigterm_action, NULL);

1388

1315

if(ret == -1){

1389

1316

perror("sigaction");

1390

exitcode = EX_OSERR;

1317

exitcode = EXIT_FAILURE;

1391

1318

goto end;

1392

1319

}

1393

1320

}

1397

1324

if_index = (AvahiIfIndex) if_nametoindex(interface);

1398

1325

if(if_index == 0){

1399

1326

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1400

exitcode = EX_UNAVAILABLE;

1327

exitcode = EXIT_FAILURE;

1401

1328

goto end;

1402

1329

}

1403

1330

1414

1341

1415

1342

#ifdef __linux__

1416

1343

/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO

1417

messages about the network interface to mess up the prompt */

1344

messages to mess up the prompt */

1418

1345

ret = klogctl(8, NULL, 5);

1419

1346

bool restore_loglevel = true;

1420

1347

if(ret == -1){

1426

1353

sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

1427

1354

if(sd < 0){

1428

1355

perror("socket");

1429

exitcode = EX_OSERR;

1356

exitcode = EXIT_FAILURE;

1430

1357

#ifdef __linux__

1431

1358

if(restore_loglevel){

1432

1359

ret = klogctl(7, NULL, 0);

1455

1382

}

1456

1383

}

1457

1384

#endif /* __linux__ */

1458

exitcode = EX_OSERR;

1385

exitcode = EXIT_FAILURE;

1459

1386

/* Lower privileges */

1460

1387

errno = 0;

1461

1388

ret = seteuid(uid);

1471

1398

if(ret == -1){

1472

1399

take_down_interface = false;

1473

1400

perror("ioctl SIOCSIFFLAGS +IFF_UP");

1474

exitcode = EX_OSERR;

1401

exitcode = EXIT_FAILURE;

1475

1402

#ifdef __linux__

1476

1403

if(restore_loglevel){

1477

1404

ret = klogctl(7, NULL, 0);

1543

1470

ret = init_gnutls_global(pubkey, seckey);

1544

1471

if(ret == -1){

1545

1472

fprintf(stderr, "init_gnutls_global failed\n");

1546

exitcode = EX_UNAVAILABLE;

1473

exitcode = EXIT_FAILURE;

1547

1474

goto end;

1548

1475

} else {

1549

1476

gnutls_initialized = true;

1566

1493

1567

1494

if(not init_gpgme(pubkey, seckey, tempdir)){

1568

1495

fprintf(stderr, "init_gpgme failed\n");

1569

exitcode = EX_UNAVAILABLE;

1496

exitcode = EXIT_FAILURE;

1570

1497

goto end;

1571

1498

} else {

1572

1499

gpgme_initialized = true;

1582

1509

char *address = strrchr(connect_to, ':');

1583

1510

if(address == NULL){

1584

1511

fprintf(stderr, "No colon in address\n");

1585

exitcode = EX_USAGE;

1512

exitcode = EXIT_FAILURE;

1586

1513

goto end;

1587

1514

}

1588

1515

1596

1523

if(errno != 0 or tmp == address+1 or *tmp != '\0'

1597

1524

or tmpmax != (uint16_t)tmpmax){

1598

1525

fprintf(stderr, "Bad port number\n");

1599

exitcode = EX_USAGE;

1526

exitcode = EXIT_FAILURE;

1600

1527

goto end;

1601

1528

}

1602

1529

1621

1548

1622

1549

ret = start_mandos_communication(address, port, if_index, af);

1623

1550

if(ret < 0){

1624

switch(errno){

1625

case ENETUNREACH:

1626

case EHOSTDOWN:

1627

case EHOSTUNREACH:

1628

exitcode = EX_NOHOST;

1629

break;

1630

case EINVAL:

1631

exitcode = EX_USAGE;

1632

break;

1633

case EIO:

1634

exitcode = EX_IOERR;

1635

break;

1636

case EPROTO:

1637

exitcode = EX_PROTOCOL;

1638

break;

1639

default:

1640

exitcode = EX_OSERR;

1641

break;

1642

}

1551

exitcode = EXIT_FAILURE;

1643

1552

} else {

1644

1553

exitcode = EXIT_SUCCESS;

1645

1554

}

1672

1581

if(mc.server == NULL){

1673

1582

fprintf(stderr, "Failed to create Avahi server: %s\n",

1674

1583

avahi_strerror(error));

1675

exitcode = EX_UNAVAILABLE;

1584

exitcode = EXIT_FAILURE;

1676

1585

goto end;

1677

1586

}

1678

1587

1687

1596

if(sb == NULL){

1688

1597

fprintf(stderr, "Failed to create service browser: %s\n",

1689

1598

avahi_strerror(avahi_server_errno(mc.server)));

1690

exitcode = EX_UNAVAILABLE;

1599

exitcode = EXIT_FAILURE;

1691

1600

goto end;

1692

1601

}

1693

1602

1742

1651

if(ret == -1){

1743

1652

perror("ioctl SIOCGIFFLAGS");

1744

1653

} else if(network.ifr_flags & IFF_UP) {

1745

network.ifr_flags &= ~(short)IFF_UP; /* clear flag */

1654

network.ifr_flags &= ~IFF_UP; /* clear flag */

1746

1655

ret = ioctl(sd, SIOCSIFFLAGS, &network);

1747

1656

if(ret == -1){

1748

1657

perror("ioctl SIOCSIFFLAGS -IFF_UP");