To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 39
- compare with another revision
- download diff
- download tarball
- view history from revision 39
- Committer: Teddy Hogeborn
- Date: 2008-08-03 03:33:56 UTC
- Revision ID: teddy@fukt.bsnet.se-20080803033356-6aemgj0g0hoz91ow
* plugins.d/mandosclient.c (pgp_packet_decrypt): Renamed variables.
On debug, show
decrypted plaintext
in hexadecimal. Free
the GPGME data
buffers even on
errors.
On debug, show
decrypted plaintext
in hexadecimal. Free
the GPGME data
buffers even on
errors.
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
3
* Mandos client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2010 Teddy Hogeborn
13
* Copyright © 2008-2010 Björn Påhlsson
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
13
*
15
14
* This program is free software: you can redistribute it and/or
16
15
* modify it under the terms of the GNU General Public License as
30
29
*/
31
30
32
31
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
32
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
33
#define _FILE_OFFSET_BITS 64
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time(), sleep() */
34
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
41
SIOCSIFFLAGS */
67
42
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
86
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
87
88
#ifdef __linux__
89
#include <sys/klog.h> /* klogctl() */
90
#endif /* __linux__ */
91
92
/* Avahi */
93
/* All Avahi types, constants and functions
94
Avahi*, avahi_*,
95
AVAHI_* */
43
SIOCSIFFLAGS */
44
96
45
#include <avahi-core/core.h>
97
46
#include <avahi-core/lookup.h>
98
47
#include <avahi-core/log.h>
100
49
#include <avahi-common/malloc.h>
101
50
#include <avahi-common/error.h>
102
51
103
/* GnuTLS */
104
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
105
functions:
106
gnutls_*
107
init_gnutls_session(),
108
GNUTLS_* */
109
#include <gnutls/openpgp.h>
110
/* gnutls_certificate_set_openpgp_key_file(),
111
GNUTLS_OPENPGP_FMT_BASE64 */
112
113
/* GPGME */
114
#include <gpgme.h> /* All GPGME types, constants and
115
functions:
116
gpgme_*
117
GPGME_PROTOCOL_OpenPGP,
118
GPG_ERR_NO_* */
52
//mandos client part
53
#include <sys/types.h> /* socket(), inet_pton() */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
struct in6_addr, inet_pton() */
56
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
57
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
58
59
#include <unistd.h> /* close() */
60
#include <netinet/in.h>
61
#include <stdbool.h> /* true */
62
#include <string.h> /* memset */
63
#include <arpa/inet.h> /* inet_pton() */
64
#include <iso646.h> /* not */
65
66
// gpgme
67
#include <errno.h> /* perror() */
68
#include <gpgme.h>
69
70
// getopt_long
71
#include <getopt.h>
119
72
120
73
#define BUFFER_SIZE 256
121
74
122
#define PATHDIR "/conf/conf.d/mandos"
123
#define SECKEY "seckey.txt"
124
#define PUBKEY "pubkey.txt"
75
static const char *keydir = "/conf/conf.d/mandos";
76
static const char *pubkeyfile = "pubkey.txt";
77
static const char *seckeyfile = "seckey.txt";
125
78
126
79
bool debug = false;
127
static const char mandos_protocol_version[] = "1";
128
const char *argp_program_version = "mandos-client " VERSION;
129
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
130
static const char sys_class_net[] = "/sys/class/net";
131
char *connect_to = NULL;
132
80
133
/* Used for passing in values through the Avahi callback functions */
81
/* Used for passing in values through all the callback functions */
134
82
typedef struct {
135
83
AvahiSimplePoll *simple_poll;
136
84
AvahiServer *server;
137
85
gnutls_certificate_credentials_t cred;
138
86
unsigned int dh_bits;
139
gnutls_dh_params_t dh_params;
140
87
const char *priority;
88
} mandos_context;
89
90
/*
91
* Decrypt OpenPGP data using keyrings in HOMEDIR.
92
* Returns -1 on error
93
*/
94
static ssize_t pgp_packet_decrypt (const char *cryptotext,
95
size_t crypto_size,
96
char **plaintext,
97
const char *homedir){
98
gpgme_data_t dh_crypto, dh_plain;
141
99
gpgme_ctx_t ctx;
142
} mandos_context;
143
144
/* global context so signal handler can reach it*/
145
mandos_context mc = { .simple_poll = NULL, .server = NULL,
146
.dh_bits = 1024, .priority = "SECURE256"
147
":!CTYPE-X.509:+CTYPE-OPENPGP" };
148
149
sig_atomic_t quit_now = 0;
150
int signal_received = 0;
151
152
/*
153
* Make additional room in "buffer" for at least BUFFER_SIZE more
154
* bytes. "buffer_capacity" is how much is currently allocated,
155
* "buffer_length" is how much is already used.
156
*/
157
size_t incbuffer(char **buffer, size_t buffer_length,
158
size_t buffer_capacity){
159
if(buffer_length + BUFFER_SIZE > buffer_capacity){
160
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
161
if(buffer == NULL){
162
return 0;
163
}
164
buffer_capacity += BUFFER_SIZE;
165
}
166
return buffer_capacity;
167
}
168
169
/*
170
* Initialize GPGME.
171
*/
172
static bool init_gpgme(const char *seckey,
173
const char *pubkey, const char *tempdir){
174
100
gpgme_error_t rc;
101
ssize_t ret;
102
ssize_t plaintext_capacity = 0;
103
ssize_t plaintext_length = 0;
175
104
gpgme_engine_info_t engine_info;
176
105
177
178
/*
179
* Helper function to insert pub and seckey to the engine keyring.
180
*/
181
bool import_key(const char *filename){
182
int ret;
183
int fd;
184
gpgme_data_t pgp_data;
185
186
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
187
if(fd == -1){
188
perror("open");
189
return false;
190
}
191
192
rc = gpgme_data_new_from_fd(&pgp_data, fd);
193
if(rc != GPG_ERR_NO_ERROR){
194
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
195
gpgme_strsource(rc), gpgme_strerror(rc));
196
return false;
197
}
198
199
rc = gpgme_op_import(mc.ctx, pgp_data);
200
if(rc != GPG_ERR_NO_ERROR){
201
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
202
gpgme_strsource(rc), gpgme_strerror(rc));
203
return false;
204
}
205
206
ret = (int)TEMP_FAILURE_RETRY(close(fd));
207
if(ret == -1){
208
perror("close");
209
}
210
gpgme_data_release(pgp_data);
211
return true;
212
}
213
214
if(debug){
215
fprintf(stderr, "Initializing GPGME\n");
106
if (debug){
107
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
216
108
}
217
109
218
110
/* Init GPGME */
219
111
gpgme_check_version(NULL);
220
112
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
221
if(rc != GPG_ERR_NO_ERROR){
113
if (rc != GPG_ERR_NO_ERROR){
222
114
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
223
115
gpgme_strsource(rc), gpgme_strerror(rc));
224
return false;
116
return -1;
225
117
}
226
118
227
/* Set GPGME home directory for the OpenPGP engine only */
228
rc = gpgme_get_engine_info(&engine_info);
229
if(rc != GPG_ERR_NO_ERROR){
119
/* Set GPGME home directory for the OpenPGP engine only */
120
rc = gpgme_get_engine_info (&engine_info);
121
if (rc != GPG_ERR_NO_ERROR){
230
122
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
231
123
gpgme_strsource(rc), gpgme_strerror(rc));
232
return false;
124
return -1;
233
125
}
234
126
while(engine_info != NULL){
235
127
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
236
128
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
237
engine_info->file_name, tempdir);
129
engine_info->file_name, homedir);
238
130
break;
239
131
}
240
132
engine_info = engine_info->next;
241
133
}
242
134
if(engine_info == NULL){
243
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
244
return false;
245
}
246
247
/* Create new GPGME "context" */
248
rc = gpgme_new(&(mc.ctx));
249
if(rc != GPG_ERR_NO_ERROR){
250
fprintf(stderr, "bad gpgme_new: %s: %s\n",
251
gpgme_strsource(rc), gpgme_strerror(rc));
252
return false;
253
}
254
255
if(not import_key(pubkey) or not import_key(seckey)){
256
return false;
257
}
258
259
return true;
260
}
261
262
/*
263
* Decrypt OpenPGP data.
264
* Returns -1 on error
265
*/
266
static ssize_t pgp_packet_decrypt(const char *cryptotext,
267
size_t crypto_size,
268
char **plaintext){
269
gpgme_data_t dh_crypto, dh_plain;
270
gpgme_error_t rc;
271
ssize_t ret;
272
size_t plaintext_capacity = 0;
273
ssize_t plaintext_length = 0;
274
275
if(debug){
276
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
135
fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);
136
return -1;
277
137
}
278
138
279
139
/* Create new GPGME data buffer from memory cryptotext */
280
140
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
281
141
0);
282
if(rc != GPG_ERR_NO_ERROR){
142
if (rc != GPG_ERR_NO_ERROR){
283
143
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
284
144
gpgme_strsource(rc), gpgme_strerror(rc));
285
145
return -1;
287
147
288
148
/* Create new empty GPGME data buffer for the plaintext */
289
149
rc = gpgme_data_new(&dh_plain);
290
if(rc != GPG_ERR_NO_ERROR){
150
if (rc != GPG_ERR_NO_ERROR){
291
151
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
292
152
gpgme_strsource(rc), gpgme_strerror(rc));
293
153
gpgme_data_release(dh_crypto);
294
154
return -1;
295
155
}
296
156
157
/* Create new GPGME "context" */
158
rc = gpgme_new(&ctx);
159
if (rc != GPG_ERR_NO_ERROR){
160
fprintf(stderr, "bad gpgme_new: %s: %s\n",
161
gpgme_strsource(rc), gpgme_strerror(rc));
162
plaintext_length = -1;
163
goto decrypt_end;
164
}
165
297
166
/* Decrypt data from the cryptotext data buffer to the plaintext
298
167
data buffer */
299
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
300
if(rc != GPG_ERR_NO_ERROR){
168
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
169
if (rc != GPG_ERR_NO_ERROR){
301
170
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
302
171
gpgme_strsource(rc), gpgme_strerror(rc));
303
172
plaintext_length = -1;
304
if(debug){
305
gpgme_decrypt_result_t result;
306
result = gpgme_op_decrypt_result(mc.ctx);
307
if(result == NULL){
308
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
309
} else {
310
fprintf(stderr, "Unsupported algorithm: %s\n",
311
result->unsupported_algorithm);
312
fprintf(stderr, "Wrong key usage: %u\n",
313
result->wrong_key_usage);
314
if(result->file_name != NULL){
315
fprintf(stderr, "File name: %s\n", result->file_name);
316
}
317
gpgme_recipient_t recipient;
318
recipient = result->recipients;
173
goto decrypt_end;
174
}
175
176
if(debug){
177
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
178
}
179
180
if (debug){
181
gpgme_decrypt_result_t result;
182
result = gpgme_op_decrypt_result(ctx);
183
if (result == NULL){
184
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
185
} else {
186
fprintf(stderr, "Unsupported algorithm: %s\n",
187
result->unsupported_algorithm);
188
fprintf(stderr, "Wrong key usage: %d\n",
189
result->wrong_key_usage);
190
if(result->file_name != NULL){
191
fprintf(stderr, "File name: %s\n", result->file_name);
192
}
193
gpgme_recipient_t recipient;
194
recipient = result->recipients;
195
if(recipient){
319
196
while(recipient != NULL){
320
197
fprintf(stderr, "Public key algorithm: %s\n",
321
198
gpgme_pubkey_algo_name(recipient->pubkey_algo));
327
204
}
328
205
}
329
206
}
330
goto decrypt_end;
331
}
332
333
if(debug){
334
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
335
207
}
336
208
337
209
/* Seek back to the beginning of the GPGME plaintext data buffer */
338
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
339
perror("gpgme_data_seek");
210
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
211
perror("pgpme_data_seek");
340
212
plaintext_length = -1;
341
213
goto decrypt_end;
342
214
}
343
215
344
216
*plaintext = NULL;
345
217
while(true){
346
plaintext_capacity = incbuffer(plaintext,
347
(size_t)plaintext_length,
348
plaintext_capacity);
349
if(plaintext_capacity == 0){
350
perror("incbuffer");
218
if (plaintext_length + BUFFER_SIZE > plaintext_capacity){
219
*plaintext = realloc(*plaintext,
220
(unsigned int)plaintext_capacity
221
+ BUFFER_SIZE);
222
if (*plaintext == NULL){
223
perror("realloc");
351
224
plaintext_length = -1;
352
225
goto decrypt_end;
226
}
227
plaintext_capacity += BUFFER_SIZE;
353
228
}
354
229
355
230
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
356
231
BUFFER_SIZE);
357
232
/* Print the data, if any */
358
if(ret == 0){
233
if (ret == 0){
359
234
/* EOF */
360
235
break;
361
236
}
366
241
}
367
242
plaintext_length += ret;
368
243
}
369
244
370
245
if(debug){
371
246
fprintf(stderr, "Decrypted password is: ");
372
for(ssize_t i = 0; i < plaintext_length; i++){
247
for(size_t i = 0; i < plaintext_length; i++){
373
248
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
374
249
}
375
250
fprintf(stderr, "\n");
385
260
return plaintext_length;
386
261
}
387
262
388
static const char * safer_gnutls_strerror(int value){
389
const char *ret = gnutls_strerror(value); /* Spurious warning from
390
-Wunreachable-code */
391
if(ret == NULL)
263
static const char * safer_gnutls_strerror (int value) {
264
const char *ret = gnutls_strerror (value);
265
if (ret == NULL)
392
266
ret = "(unknown)";
393
267
return ret;
394
268
}
395
269
396
/* GnuTLS log function callback */
397
270
static void debuggnutls(__attribute__((unused)) int level,
398
271
const char* string){
399
fprintf(stderr, "GnuTLS: %s", string);
272
fprintf(stderr, "%s", string);
400
273
}
401
274
402
static int init_gnutls_global(const char *pubkeyfilename,
403
const char *seckeyfilename){
275
static int initgnutls(mandos_context *mc, gnutls_session_t *session,
276
gnutls_dh_params_t *dh_params){
277
const char *err;
404
278
int ret;
405
279
406
280
if(debug){
407
281
fprintf(stderr, "Initializing GnuTLS\n");
408
282
}
409
410
ret = gnutls_global_init();
411
if(ret != GNUTLS_E_SUCCESS){
412
fprintf(stderr, "GnuTLS global_init: %s\n",
413
safer_gnutls_strerror(ret));
283
284
if ((ret = gnutls_global_init ())
285
!= GNUTLS_E_SUCCESS) {
286
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
414
287
return -1;
415
288
}
416
289
417
if(debug){
418
/* "Use a log level over 10 to enable all debugging options."
419
* - GnuTLS manual
420
*/
290
if (debug){
421
291
gnutls_global_set_log_level(11);
422
292
gnutls_global_set_log_function(debuggnutls);
423
293
}
424
294
425
/* OpenPGP credentials */
426
gnutls_certificate_allocate_credentials(&mc.cred);
427
if(ret != GNUTLS_E_SUCCESS){
428
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
429
from
430
-Wunreachable-code
431
*/
432
safer_gnutls_strerror(ret));
433
gnutls_global_deinit();
295
/* openpgp credentials */
296
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
297
!= GNUTLS_E_SUCCESS) {
298
fprintf (stderr, "memory error: %s\n",
299
safer_gnutls_strerror(ret));
434
300
return -1;
435
301
}
436
302
437
303
if(debug){
438
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
439
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
440
seckeyfilename);
304
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
305
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
306
seckeyfile);
441
307
}
442
308
443
309
ret = gnutls_certificate_set_openpgp_key_file
444
(mc.cred, pubkeyfilename, seckeyfilename,
445
GNUTLS_OPENPGP_FMT_BASE64);
446
if(ret != GNUTLS_E_SUCCESS){
447
fprintf(stderr,
448
"Error[%d] while reading the OpenPGP key pair ('%s',"
449
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
450
fprintf(stderr, "The GnuTLS error is: %s\n",
451
safer_gnutls_strerror(ret));
452
goto globalfail;
453
}
454
455
/* GnuTLS server initialization */
456
ret = gnutls_dh_params_init(&mc.dh_params);
457
if(ret != GNUTLS_E_SUCCESS){
458
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
459
" %s\n", safer_gnutls_strerror(ret));
460
goto globalfail;
461
}
462
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
463
if(ret != GNUTLS_E_SUCCESS){
464
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
465
safer_gnutls_strerror(ret));
466
goto globalfail;
467
}
468
469
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
470
471
return 0;
472
473
globalfail:
474
475
gnutls_certificate_free_credentials(mc.cred);
476
gnutls_global_deinit();
477
gnutls_dh_params_deinit(mc.dh_params);
478
return -1;
479
}
480
481
static int init_gnutls_session(gnutls_session_t *session){
482
int ret;
483
/* GnuTLS session creation */
484
do {
485
ret = gnutls_init(session, GNUTLS_SERVER);
486
if(quit_now){
487
return -1;
488
}
489
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
490
if(ret != GNUTLS_E_SUCCESS){
310
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
311
if (ret != GNUTLS_E_SUCCESS) {
312
fprintf
313
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
314
" '%s')\n",
315
ret, pubkeyfile, seckeyfile);
316
fprintf(stdout, "The Error is: %s\n",
317
safer_gnutls_strerror(ret));
318
return -1;
319
}
320
321
//GnuTLS server initialization
322
if ((ret = gnutls_dh_params_init(dh_params))
323
!= GNUTLS_E_SUCCESS) {
324
fprintf (stderr, "Error in dh parameter initialization: %s\n",
325
safer_gnutls_strerror(ret));
326
return -1;
327
}
328
329
if ((ret = gnutls_dh_params_generate2(*dh_params, mc->dh_bits))
330
!= GNUTLS_E_SUCCESS) {
331
fprintf (stderr, "Error in prime generation: %s\n",
332
safer_gnutls_strerror(ret));
333
return -1;
334
}
335
336
gnutls_certificate_set_dh_params(mc->cred, *dh_params);
337
338
// GnuTLS session creation
339
if ((ret = gnutls_init(session, GNUTLS_SERVER))
340
!= GNUTLS_E_SUCCESS){
491
341
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
492
342
safer_gnutls_strerror(ret));
493
343
}
494
344
495
{
496
const char *err;
497
do {
498
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
499
if(quit_now){
500
gnutls_deinit(*session);
501
return -1;
502
}
503
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
504
if(ret != GNUTLS_E_SUCCESS){
505
fprintf(stderr, "Syntax error at: %s\n", err);
506
fprintf(stderr, "GnuTLS error: %s\n",
507
safer_gnutls_strerror(ret));
508
gnutls_deinit(*session);
509
return -1;
510
}
345
if ((ret = gnutls_priority_set_direct(*session, mc->priority, &err))
346
!= GNUTLS_E_SUCCESS) {
347
fprintf(stderr, "Syntax error at: %s\n", err);
348
fprintf(stderr, "GnuTLS error: %s\n",
349
safer_gnutls_strerror(ret));
350
return -1;
511
351
}
512
352
513
do {
514
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
515
mc.cred);
516
if(quit_now){
517
gnutls_deinit(*session);
518
return -1;
519
}
520
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
521
if(ret != GNUTLS_E_SUCCESS){
522
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
353
if ((ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
354
mc->cred))
355
!= GNUTLS_E_SUCCESS) {
356
fprintf(stderr, "Error setting a credentials set: %s\n",
523
357
safer_gnutls_strerror(ret));
524
gnutls_deinit(*session);
525
358
return -1;
526
359
}
527
360
528
361
/* ignore client certificate if any. */
529
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
362
gnutls_certificate_server_set_request (*session,
363
GNUTLS_CERT_IGNORE);
530
364
531
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
365
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
532
366
533
367
return 0;
534
368
}
535
369
536
/* Avahi log function callback */
537
370
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
538
371
__attribute__((unused)) const char *txt){}
539
372
540
/* Called when a Mandos server is found */
541
373
static int start_mandos_communication(const char *ip, uint16_t port,
542
374
AvahiIfIndex if_index,
543
int af){
544
int ret, tcp_sd = -1;
545
ssize_t sret;
546
union {
547
struct sockaddr_in in;
548
struct sockaddr_in6 in6;
549
} to;
375
mandos_context *mc){
376
int ret, tcp_sd;
377
struct sockaddr_in6 to;
550
378
char *buffer = NULL;
551
char *decrypted_buffer = NULL;
379
char *decrypted_buffer;
552
380
size_t buffer_length = 0;
553
381
size_t buffer_capacity = 0;
554
size_t written;
555
int retval = -1;
382
ssize_t decrypted_buffer_size;
383
size_t written = 0;
384
int retval = 0;
385
char interface[IF_NAMESIZE];
556
386
gnutls_session_t session;
557
int pf; /* Protocol family */
558
559
errno = 0;
560
561
if(quit_now){
562
errno = EINTR;
563
return -1;
564
}
565
566
switch(af){
567
case AF_INET6:
568
pf = PF_INET6;
569
break;
570
case AF_INET:
571
pf = PF_INET;
572
break;
573
default:
574
fprintf(stderr, "Bad address family: %d\n", af);
575
errno = EINVAL;
576
return -1;
577
}
578
579
ret = init_gnutls_session(&session);
580
if(ret != 0){
581
return -1;
582
}
387
gnutls_dh_params_t dh_params;
583
388
584
389
if(debug){
585
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
586
"\n", ip, port);
390
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
391
ip, port);
587
392
}
588
393
589
tcp_sd = socket(pf, SOCK_STREAM, 0);
590
if(tcp_sd < 0){
591
int e = errno;
394
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
395
if(tcp_sd < 0) {
592
396
perror("socket");
593
errno = e;
594
goto mandos_end;
595
}
596
597
if(quit_now){
598
errno = EINTR;
599
goto mandos_end;
600
}
601
602
memset(&to, 0, sizeof(to));
603
if(af == AF_INET6){
604
to.in6.sin6_family = (sa_family_t)af;
605
ret = inet_pton(af, ip, &to.in6.sin6_addr);
606
} else { /* IPv4 */
607
to.in.sin_family = (sa_family_t)af;
608
ret = inet_pton(af, ip, &to.in.sin_addr);
609
}
610
if(ret < 0 ){
611
int e = errno;
397
return -1;
398
}
399
400
if(debug){
401
if(if_indextoname((unsigned int)if_index, interface) == NULL){
402
perror("if_indextoname");
403
return -1;
404
}
405
fprintf(stderr, "Binding to interface %s\n", interface);
406
}
407
408
memset(&to,0,sizeof(to)); /* Spurious warning */
409
to.sin6_family = AF_INET6;
410
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
411
if (ret < 0 ){
612
412
perror("inet_pton");
613
errno = e;
614
goto mandos_end;
413
return -1;
615
414
}
616
415
if(ret == 0){
617
int e = errno;
618
416
fprintf(stderr, "Bad address: %s\n", ip);
619
errno = e;
620
goto mandos_end;
621
}
622
if(af == AF_INET6){
623
to.in6.sin6_port = htons(port); /* Spurious warnings from
624
-Wconversion and
625
-Wunreachable-code */
626
627
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
628
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
629
-Wunreachable-code*/
630
if(if_index == AVAHI_IF_UNSPEC){
631
fprintf(stderr, "An IPv6 link-local address is incomplete"
632
" without a network interface\n");
633
errno = EINVAL;
634
goto mandos_end;
635
}
636
/* Set the network interface number as scope */
637
to.in6.sin6_scope_id = (uint32_t)if_index;
638
}
639
} else {
640
to.in.sin_port = htons(port); /* Spurious warnings from
641
-Wconversion and
642
-Wunreachable-code */
643
}
417
return -1;
418
}
419
to.sin6_port = htons(port); /* Spurious warning */
644
420
645
if(quit_now){
646
errno = EINTR;
647
goto mandos_end;
648
}
421
to.sin6_scope_id = (uint32_t)if_index;
649
422
650
423
if(debug){
651
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
652
char interface[IF_NAMESIZE];
653
if(if_indextoname((unsigned int)if_index, interface) == NULL){
654
perror("if_indextoname");
655
} else {
656
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
657
ip, interface, port);
658
}
659
} else {
660
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
661
port);
662
}
663
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
664
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
665
const char *pcret;
666
if(af == AF_INET6){
667
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
668
sizeof(addrstr));
669
} else {
670
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
671
sizeof(addrstr));
672
}
673
if(pcret == NULL){
424
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
425
char addrstr[INET6_ADDRSTRLEN] = "";
426
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
427
sizeof(addrstr)) == NULL){
674
428
perror("inet_ntop");
675
429
} else {
676
430
if(strcmp(addrstr, ip) != 0){
679
433
}
680
434
}
681
435
682
if(quit_now){
683
errno = EINTR;
684
goto mandos_end;
685
}
686
687
if(af == AF_INET6){
688
ret = connect(tcp_sd, &to.in6, sizeof(to));
689
} else {
690
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
691
}
692
if(ret < 0){
693
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
694
int e = errno;
695
perror("connect");
696
errno = e;
697
}
698
goto mandos_end;
699
}
700
701
if(quit_now){
702
errno = EINTR;
703
goto mandos_end;
704
}
705
706
const char *out = mandos_protocol_version;
707
written = 0;
708
while(true){
709
size_t out_size = strlen(out);
710
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
711
out_size - written));
712
if(ret == -1){
713
int e = errno;
714
perror("write");
715
errno = e;
716
goto mandos_end;
717
}
718
written += (size_t)ret;
719
if(written < out_size){
720
continue;
721
} else {
722
if(out == mandos_protocol_version){
723
written = 0;
724
out = "\r\n";
725
} else {
726
break;
727
}
728
}
729
730
if(quit_now){
731
errno = EINTR;
732
goto mandos_end;
733
}
734
}
436
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
437
if (ret < 0){
438
perror("connect");
439
return -1;
440
}
441
442
ret = initgnutls (mc, &session, &dh_params);
443
if (ret != 0){
444
retval = -1;
445
return -1;
446
}
447
448
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
735
449
736
450
if(debug){
737
451
fprintf(stderr, "Establishing TLS session with %s\n", ip);
738
452
}
739
453
740
if(quit_now){
741
errno = EINTR;
742
goto mandos_end;
743
}
744
745
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
746
747
if(quit_now){
748
errno = EINTR;
749
goto mandos_end;
750
}
751
752
do {
753
ret = gnutls_handshake(session);
754
if(quit_now){
755
errno = EINTR;
756
goto mandos_end;
757
}
758
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
759
760
if(ret != GNUTLS_E_SUCCESS){
454
ret = gnutls_handshake (session);
455
456
if (ret != GNUTLS_E_SUCCESS){
761
457
if(debug){
762
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
763
gnutls_perror(ret);
458
fprintf(stderr, "\n*** Handshake failed ***\n");
459
gnutls_perror (ret);
764
460
}
765
errno = EPROTO;
766
goto mandos_end;
461
retval = -1;
462
goto exit;
767
463
}
768
464
769
/* Read OpenPGP packet that contains the wanted password */
465
//Retrieve OpenPGP packet that contains the wanted password
770
466
771
467
if(debug){
772
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
468
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
773
469
ip);
774
470
}
775
471
776
472
while(true){
777
778
if(quit_now){
779
errno = EINTR;
780
goto mandos_end;
781
}
782
783
buffer_capacity = incbuffer(&buffer, buffer_length,
784
buffer_capacity);
785
if(buffer_capacity == 0){
786
int e = errno;
787
perror("incbuffer");
788
errno = e;
789
goto mandos_end;
790
}
791
792
if(quit_now){
793
errno = EINTR;
794
goto mandos_end;
795
}
796
797
sret = gnutls_record_recv(session, buffer+buffer_length,
798
BUFFER_SIZE);
799
if(sret == 0){
473
if (buffer_length + BUFFER_SIZE > buffer_capacity){
474
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
475
if (buffer == NULL){
476
perror("realloc");
477
goto exit;
478
}
479
buffer_capacity += BUFFER_SIZE;
480
}
481
482
ret = gnutls_record_recv(session, buffer+buffer_length,
483
BUFFER_SIZE);
484
if (ret == 0){
800
485
break;
801
486
}
802
if(sret < 0){
803
switch(sret){
487
if (ret < 0){
488
switch(ret){
804
489
case GNUTLS_E_INTERRUPTED:
805
490
case GNUTLS_E_AGAIN:
806
491
break;
807
492
case GNUTLS_E_REHANDSHAKE:
808
do {
809
ret = gnutls_handshake(session);
810
811
if(quit_now){
812
errno = EINTR;
813
goto mandos_end;
814
}
815
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
816
if(ret < 0){
817
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
818
gnutls_perror(ret);
819
errno = EPROTO;
820
goto mandos_end;
493
ret = gnutls_handshake (session);
494
if (ret < 0){
495
fprintf(stderr, "\n*** Handshake failed ***\n");
496
gnutls_perror (ret);
497
retval = -1;
498
goto exit;
821
499
}
822
500
break;
823
501
default:
824
502
fprintf(stderr, "Unknown error while reading data from"
825
" encrypted session with Mandos server\n");
826
gnutls_bye(session, GNUTLS_SHUT_RDWR);
827
errno = EIO;
828
goto mandos_end;
503
" encrypted session with mandos server\n");
504
retval = -1;
505
gnutls_bye (session, GNUTLS_SHUT_RDWR);
506
goto exit;
829
507
}
830
508
} else {
831
buffer_length += (size_t) sret;
832
}
833
}
834
835
if(debug){
836
fprintf(stderr, "Closing TLS session\n");
837
}
838
839
if(quit_now){
840
errno = EINTR;
841
goto mandos_end;
842
}
843
844
do {
845
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
846
if(quit_now){
847
errno = EINTR;
848
goto mandos_end;
849
}
850
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
851
852
if(buffer_length > 0){
853
ssize_t decrypted_buffer_size;
509
buffer_length += (size_t) ret;
510
}
511
}
512
513
if (buffer_length > 0){
854
514
decrypted_buffer_size = pgp_packet_decrypt(buffer,
855
515
buffer_length,
856
&decrypted_buffer);
857
if(decrypted_buffer_size >= 0){
858
859
written = 0;
516
&decrypted_buffer,
517
keydir);
518
if (decrypted_buffer_size >= 0){
860
519
while(written < (size_t) decrypted_buffer_size){
861
if(quit_now){
862
errno = EINTR;
863
goto mandos_end;
864
}
865
866
ret = (int)fwrite(decrypted_buffer + written, 1,
867
(size_t)decrypted_buffer_size - written,
868
stdout);
520
ret = (int)fwrite (decrypted_buffer + written, 1,
521
(size_t)decrypted_buffer_size - written,
522
stdout);
869
523
if(ret == 0 and ferror(stdout)){
870
int e = errno;
871
524
if(debug){
872
525
fprintf(stderr, "Error writing encrypted data: %s\n",
873
526
strerror(errno));
874
527
}
875
errno = e;
876
goto mandos_end;
528
retval = -1;
529
break;
877
530
}
878
531
written += (size_t)ret;
879
532
}
880
retval = 0;
881
}
882
}
883
884
/* Shutdown procedure */
885
886
mandos_end:
887
{
888
int e = errno;
889
free(decrypted_buffer);
890
free(buffer);
891
if(tcp_sd >= 0){
892
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
893
}
894
if(ret == -1){
895
if(e == 0){
896
e = errno;
897
}
898
perror("close");
899
}
900
gnutls_deinit(session);
901
if(quit_now){
902
e = EINTR;
533
free(decrypted_buffer);
534
} else {
903
535
retval = -1;
904
536
}
905
errno = e;
906
}
537
}
538
539
//shutdown procedure
540
541
if(debug){
542
fprintf(stderr, "Closing TLS session\n");
543
}
544
545
free(buffer);
546
gnutls_bye (session, GNUTLS_SHUT_RDWR);
547
exit:
548
close(tcp_sd);
549
gnutls_deinit (session);
550
gnutls_certificate_free_credentials (mc->cred);
551
gnutls_global_deinit ();
907
552
return retval;
908
553
}
909
554
910
555
static void resolve_callback(AvahiSServiceResolver *r,
911
556
AvahiIfIndex interface,
912
AvahiProtocol proto,
557
AVAHI_GCC_UNUSED AvahiProtocol protocol,
913
558
AvahiResolverEvent event,
914
559
const char *name,
915
560
const char *type,
920
565
AVAHI_GCC_UNUSED AvahiStringList *txt,
921
566
AVAHI_GCC_UNUSED AvahiLookupResultFlags
922
567
flags,
923
AVAHI_GCC_UNUSED void* userdata){
924
assert(r);
568
void* userdata) {
569
mandos_context *mc = userdata;
570
assert(r); /* Spurious warning */
925
571
926
572
/* Called whenever a service has been resolved successfully or
927
573
timed out */
928
574
929
if(quit_now){
930
return;
931
}
932
933
switch(event){
575
switch (event) {
934
576
default:
935
577
case AVAHI_RESOLVER_FAILURE:
936
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
937
" of type '%s' in domain '%s': %s\n", name, type, domain,
938
avahi_strerror(avahi_server_errno(mc.server)));
578
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
579
" type '%s' in domain '%s': %s\n", name, type, domain,
580
avahi_strerror(avahi_server_errno(mc->server)));
939
581
break;
940
582
941
583
case AVAHI_RESOLVER_FOUND:
943
585
char ip[AVAHI_ADDRESS_STR_MAX];
944
586
avahi_address_snprint(ip, sizeof(ip), address);
945
587
if(debug){
946
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
947
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
948
ip, (intmax_t)interface, port);
588
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
589
" port %d\n", name, host_name, ip, port);
949
590
}
950
int ret = start_mandos_communication(ip, port, interface,
951
avahi_proto_to_af(proto));
952
if(ret == 0){
953
avahi_simple_poll_quit(mc.simple_poll);
591
int ret = start_mandos_communication(ip, port, interface, mc);
592
if (ret == 0){
593
exit(EXIT_SUCCESS);
954
594
}
955
595
}
956
596
}
957
597
avahi_s_service_resolver_free(r);
958
598
}
959
599
960
static void browse_callback(AvahiSServiceBrowser *b,
961
AvahiIfIndex interface,
962
AvahiProtocol protocol,
963
AvahiBrowserEvent event,
964
const char *name,
965
const char *type,
966
const char *domain,
967
AVAHI_GCC_UNUSED AvahiLookupResultFlags
968
flags,
969
AVAHI_GCC_UNUSED void* userdata){
970
assert(b);
600
static void browse_callback( AvahiSServiceBrowser *b,
601
AvahiIfIndex interface,
602
AvahiProtocol protocol,
603
AvahiBrowserEvent event,
604
const char *name,
605
const char *type,
606
const char *domain,
607
AVAHI_GCC_UNUSED AvahiLookupResultFlags
608
flags,
609
void* userdata) {
610
mandos_context *mc = userdata;
611
assert(b); /* Spurious warning */
971
612
972
613
/* Called whenever a new services becomes available on the LAN or
973
614
is removed from the LAN */
974
615
975
if(quit_now){
976
return;
977
}
978
979
switch(event){
616
switch (event) {
980
617
default:
981
618
case AVAHI_BROWSER_FAILURE:
982
619
983
fprintf(stderr, "(Avahi browser) %s\n",
984
avahi_strerror(avahi_server_errno(mc.server)));
985
avahi_simple_poll_quit(mc.simple_poll);
620
fprintf(stderr, "(Browser) %s\n",
621
avahi_strerror(avahi_server_errno(mc->server)));
622
avahi_simple_poll_quit(mc->simple_poll);
986
623
return;
987
624
988
625
case AVAHI_BROWSER_NEW:
989
/* We ignore the returned Avahi resolver object. In the callback
990
function we free it. If the Avahi server is terminated before
991
the callback function is called the Avahi server will free the
992
resolver for us. */
626
/* We ignore the returned resolver object. In the callback
627
function we free it. If the server is terminated before
628
the callback function is called the server will free
629
the resolver for us. */
993
630
994
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
995
name, type, domain, protocol, 0,
996
resolve_callback, NULL) == NULL)
997
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
998
name, avahi_strerror(avahi_server_errno(mc.server)));
631
if (!(avahi_s_service_resolver_new(mc->server, interface,
632
protocol, name, type, domain,
633
AVAHI_PROTO_INET6, 0,
634
resolve_callback, mc)))
635
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
636
avahi_strerror(avahi_server_errno(mc->server)));
999
637
break;
1000
638
1001
639
case AVAHI_BROWSER_REMOVE:
1003
641
1004
642
case AVAHI_BROWSER_ALL_FOR_NOW:
1005
643
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1006
if(debug){
1007
fprintf(stderr, "No Mandos server found, still searching...\n");
1008
}
1009
644
break;
1010
645
}
1011
646
}
1012
647
1013
/* stop main loop after sigterm has been called */
1014
static void handle_sigterm(int sig){
1015
if(quit_now){
1016
return;
1017
}
1018
quit_now = 1;
1019
signal_received = sig;
1020
int old_errno = errno;
1021
if(mc.simple_poll != NULL){
1022
avahi_simple_poll_quit(mc.simple_poll);
1023
}
1024
errno = old_errno;
1025
}
1026
1027
/*
1028
* This function determines if a directory entry in /sys/class/net
1029
* corresponds to an acceptable network device.
1030
* (This function is passed to scandir(3) as a filter function.)
1031
*/
1032
int good_interface(const struct dirent *if_entry){
1033
ssize_t ssret;
1034
char *flagname = NULL;
1035
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
1036
if_entry->d_name);
1037
if(ret < 0){
1038
perror("asprintf");
1039
return 0;
1040
}
1041
if(if_entry->d_name[0] == '.'){
1042
return 0;
1043
}
1044
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1045
if(flags_fd == -1){
1046
perror("open");
1047
return 0;
1048
}
1049
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1050
/* read line from flags_fd */
1051
ssize_t to_read = (sizeof(ifreq_flags)*2)+3; /* "0x1003\n" */
1052
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1053
flagstring[(size_t)to_read] = '\0';
1054
if(flagstring == NULL){
1055
perror("malloc");
1056
close(flags_fd);
1057
return 0;
1058
}
1059
while(to_read > 0){
1060
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1061
(size_t)to_read));
1062
if(ssret == -1){
1063
perror("read");
1064
free(flagstring);
1065
close(flags_fd);
1066
return 0;
1067
}
1068
to_read -= ssret;
1069
if(ssret == 0){
1070
break;
1071
}
1072
}
1073
close(flags_fd);
1074
intmax_t tmpmax;
1075
char *tmp;
1076
errno = 0;
1077
tmpmax = strtoimax(flagstring, &tmp, 0);
1078
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1079
and not (isspace(*tmp)))
1080
or tmpmax != (ifreq_flags)tmpmax){
1081
if(debug){
1082
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1083
flagstring, if_entry->d_name);
1084
}
1085
free(flagstring);
1086
return 0;
1087
}
1088
free(flagstring);
1089
ifreq_flags flags = (ifreq_flags)tmpmax;
1090
/* Reject the loopback device */
1091
if(flags & IFF_LOOPBACK){
1092
if(debug){
1093
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1094
if_entry->d_name);
1095
}
1096
return 0;
1097
}
1098
/* Accept point-to-point devices only if connect_to is specified */
1099
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1100
if(debug){
1101
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1102
if_entry->d_name);
1103
}
1104
return 1;
1105
}
1106
/* Otherwise, reject non-broadcast-capable devices */
1107
if(not (flags & IFF_BROADCAST)){
1108
if(debug){
1109
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1110
if_entry->d_name);
1111
}
1112
return 0;
1113
}
1114
/* Accept this device */
1115
if(debug){
1116
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1117
if_entry->d_name);
1118
}
1119
return 1;
1120
}
1121
1122
int main(int argc, char *argv[]){
1123
AvahiSServiceBrowser *sb = NULL;
1124
int error;
1125
int ret;
1126
intmax_t tmpmax;
1127
char *tmp;
1128
int exitcode = EXIT_SUCCESS;
1129
const char *interface = "";
1130
struct ifreq network;
1131
int sd = -1;
1132
bool take_down_interface = false;
1133
uid_t uid;
1134
gid_t gid;
1135
char tempdir[] = "/tmp/mandosXXXXXX";
1136
bool tempdir_created = false;
1137
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1138
const char *seckey = PATHDIR "/" SECKEY;
1139
const char *pubkey = PATHDIR "/" PUBKEY;
1140
1141
bool gnutls_initialized = false;
1142
bool gpgme_initialized = false;
1143
float delay = 2.5f;
1144
1145
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1146
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1147
1148
uid = getuid();
1149
gid = getgid();
1150
1151
/* Lower any group privileges we might have, just to be safe */
1152
errno = 0;
1153
ret = setgid(gid);
1154
if(ret == -1){
1155
perror("setgid");
1156
}
1157
1158
/* Lower user privileges (temporarily) */
1159
errno = 0;
1160
ret = seteuid(uid);
1161
if(ret == -1){
1162
perror("seteuid");
1163
}
1164
1165
if(quit_now){
1166
goto end;
1167
}
1168
1169
{
1170
struct argp_option options[] = {
1171
{ .name = "debug", .key = 128,
1172
.doc = "Debug mode", .group = 3 },
1173
{ .name = "connect", .key = 'c',
1174
.arg = "ADDRESS:PORT",
1175
.doc = "Connect directly to a specific Mandos server",
1176
.group = 1 },
1177
{ .name = "interface", .key = 'i',
1178
.arg = "NAME",
1179
.doc = "Network interface that will be used to search for"
1180
" Mandos servers",
1181
.group = 1 },
1182
{ .name = "seckey", .key = 's',
1183
.arg = "FILE",
1184
.doc = "OpenPGP secret key file base name",
1185
.group = 1 },
1186
{ .name = "pubkey", .key = 'p',
1187
.arg = "FILE",
1188
.doc = "OpenPGP public key file base name",
1189
.group = 2 },
1190
{ .name = "dh-bits", .key = 129,
1191
.arg = "BITS",
1192
.doc = "Bit length of the prime number used in the"
1193
" Diffie-Hellman key exchange",
1194
.group = 2 },
1195
{ .name = "priority", .key = 130,
1196
.arg = "STRING",
1197
.doc = "GnuTLS priority string for the TLS handshake",
1198
.group = 1 },
1199
{ .name = "delay", .key = 131,
1200
.arg = "SECONDS",
1201
.doc = "Maximum delay to wait for interface startup",
1202
.group = 2 },
1203
/*
1204
* These reproduce what we would get without ARGP_NO_HELP
1205
*/
1206
{ .name = "help", .key = '?',
1207
.doc = "Give this help list", .group = -1 },
1208
{ .name = "usage", .key = -3,
1209
.doc = "Give a short usage message", .group = -1 },
1210
{ .name = "version", .key = 'V',
1211
.doc = "Print program version", .group = -1 },
1212
{ .name = NULL }
1213
};
648
/* Combines file name and path and returns the malloced new
649
string. some sane checks could/should be added */
650
static const char *combinepath(const char *first, const char *second){
651
size_t f_len = strlen(first);
652
size_t s_len = strlen(second);
653
char *tmp = malloc(f_len + s_len + 2);
654
if (tmp == NULL){
655
return NULL;
656
}
657
if(f_len > 0){
658
memcpy(tmp, first, f_len); /* Spurious warning */
659
}
660
tmp[f_len] = '/';
661
if(s_len > 0){
662
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
663
}
664
tmp[f_len + 1 + s_len] = '\0';
665
return tmp;
666
}
667
668
669
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
670
AvahiServerConfig config;
671
AvahiSServiceBrowser *sb = NULL;
672
int error;
673
int ret;
674
int debug_int;
675
int returncode = EXIT_SUCCESS;
676
const char *interface = "eth0";
677
struct ifreq network;
678
int sd;
679
char *connect_to = NULL;
680
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
681
mandos_context mc = { .simple_poll = NULL, .server = NULL,
682
.dh_bits = 1024, .priority = "SECURE256"};
1214
683
1215
error_t parse_opt(int key, char *arg,
1216
struct argp_state *state){
1217
errno = 0;
1218
switch(key){
1219
case 128: /* --debug */
1220
debug = true;
1221
break;
1222
case 'c': /* --connect */
1223
connect_to = arg;
1224
break;
1225
case 'i': /* --interface */
1226
interface = arg;
1227
break;
1228
case 's': /* --seckey */
1229
seckey = arg;
1230
break;
1231
case 'p': /* --pubkey */
1232
pubkey = arg;
1233
break;
1234
case 129: /* --dh-bits */
1235
errno = 0;
1236
tmpmax = strtoimax(arg, &tmp, 10);
1237
if(errno != 0 or tmp == arg or *tmp != '\0'
1238
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1239
argp_error(state, "Bad number of DH bits");
1240
}
1241
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1242
break;
1243
case 130: /* --priority */
1244
mc.priority = arg;
1245
break;
1246
case 131: /* --delay */
1247
errno = 0;
1248
delay = strtof(arg, &tmp);
1249
if(errno != 0 or tmp == arg or *tmp != '\0'){
1250
argp_error(state, "Bad delay");
1251
}
1252
break;
1253
/*
1254
* These reproduce what we would get without ARGP_NO_HELP
1255
*/
1256
case '?': /* --help */
1257
argp_state_help(state, state->out_stream,
1258
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1259
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1260
case -3: /* --usage */
1261
argp_state_help(state, state->out_stream,
1262
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1263
case 'V': /* --version */
1264
fprintf(state->out_stream, "%s\n", argp_program_version);
1265
exit(argp_err_exit_status);
1266
break;
684
debug_int = debug ? 1 : 0;
685
while (true){
686
struct option long_options[] = {
687
{"debug", no_argument, &debug_int, 1},
688
{"connect", required_argument, NULL, 'c'},
689
{"interface", required_argument, NULL, 'i'},
690
{"keydir", required_argument, NULL, 'd'},
691
{"seckey", required_argument, NULL, 's'},
692
{"pubkey", required_argument, NULL, 'p'},
693
{"dh-bits", required_argument, NULL, 'D'},
694
{"priority", required_argument, NULL, 'P'},
695
{0, 0, 0, 0} };
696
697
int option_index = 0;
698
ret = getopt_long (argc, argv, "i:", long_options,
699
&option_index);
700
701
if (ret == -1){
702
break;
703
}
704
705
switch(ret){
706
case 0:
707
break;
708
case 'i':
709
interface = optarg;
710
break;
711
case 'c':
712
connect_to = optarg;
713
break;
714
case 'd':
715
keydir = optarg;
716
break;
717
case 'p':
718
pubkeyfile = optarg;
719
break;
720
case 's':
721
seckeyfile = optarg;
722
break;
723
case 'D':
724
errno = 0;
725
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
726
if (errno){
727
perror("strtol");
728
exit(EXIT_FAILURE);
729
}
730
break;
731
case 'P':
732
mc.priority = optarg;
733
break;
734
case '?':
1267
735
default:
1268
return ARGP_ERR_UNKNOWN;
1269
}
1270
return errno;
1271
}
1272
1273
struct argp argp = { .options = options, .parser = parse_opt,
1274
.args_doc = "",
1275
.doc = "Mandos client -- Get and decrypt"
1276
" passwords from a Mandos server" };
1277
ret = argp_parse(&argp, argc, argv,
1278
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1279
switch(ret){
1280
case 0:
1281
break;
1282
case ENOMEM:
1283
default:
1284
errno = ret;
1285
perror("argp_parse");
1286
exitcode = EX_OSERR;
1287
goto end;
1288
case EINVAL:
1289
exitcode = EX_USAGE;
1290
goto end;
1291
}
1292
}
1293
1294
if(not debug){
1295
avahi_set_log_function(empty_log);
1296
}
1297
1298
if(interface[0] == '\0'){
1299
struct dirent **direntries;
1300
ret = scandir(sys_class_net, &direntries, good_interface,
1301
alphasort);
1302
if(ret >= 1){
1303
/* Pick the first good interface */
1304
interface = strdup(direntries[0]->d_name);
1305
if(debug){
1306
fprintf(stderr, "Using interface \"%s\"\n", interface);
1307
}
1308
if(interface == NULL){
1309
perror("malloc");
1310
free(direntries);
1311
exitcode = EXIT_FAILURE;
1312
goto end;
1313
}
1314
free(direntries);
1315
} else {
1316
free(direntries);
1317
fprintf(stderr, "Could not find a network interface\n");
1318
exitcode = EXIT_FAILURE;
1319
goto end;
1320
}
1321
}
1322
1323
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1324
from the signal handler */
1325
/* Initialize the pseudo-RNG for Avahi */
1326
srand((unsigned int) time(NULL));
1327
mc.simple_poll = avahi_simple_poll_new();
1328
if(mc.simple_poll == NULL){
1329
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1330
exitcode = EX_UNAVAILABLE;
1331
goto end;
1332
}
1333
1334
sigemptyset(&sigterm_action.sa_mask);
1335
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1336
if(ret == -1){
1337
perror("sigaddset");
1338
exitcode = EX_OSERR;
1339
goto end;
1340
}
1341
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1342
if(ret == -1){
1343
perror("sigaddset");
1344
exitcode = EX_OSERR;
1345
goto end;
1346
}
1347
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1348
if(ret == -1){
1349
perror("sigaddset");
1350
exitcode = EX_OSERR;
1351
goto end;
1352
}
1353
/* Need to check if the handler is SIG_IGN before handling:
1354
| [[info:libc:Initial Signal Actions]] |
1355
| [[info:libc:Basic Signal Handling]] |
1356
*/
1357
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1358
if(ret == -1){
1359
perror("sigaction");
1360
return EX_OSERR;
1361
}
1362
if(old_sigterm_action.sa_handler != SIG_IGN){
1363
ret = sigaction(SIGINT, &sigterm_action, NULL);
1364
if(ret == -1){
1365
perror("sigaction");
1366
exitcode = EX_OSERR;
1367
goto end;
1368
}
1369
}
1370
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1371
if(ret == -1){
1372
perror("sigaction");
1373
return EX_OSERR;
1374
}
1375
if(old_sigterm_action.sa_handler != SIG_IGN){
1376
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1377
if(ret == -1){
1378
perror("sigaction");
1379
exitcode = EX_OSERR;
1380
goto end;
1381
}
1382
}
1383
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1384
if(ret == -1){
1385
perror("sigaction");
1386
return EX_OSERR;
1387
}
1388
if(old_sigterm_action.sa_handler != SIG_IGN){
1389
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1390
if(ret == -1){
1391
perror("sigaction");
1392
exitcode = EX_OSERR;
1393
goto end;
1394
}
1395
}
1396
1397
/* If the interface is down, bring it up */
1398
if(strcmp(interface, "none") != 0){
736
exit(EXIT_FAILURE);
737
}
738
}
739
debug = debug_int ? true : false;
740
741
pubkeyfile = combinepath(keydir, pubkeyfile);
742
if (pubkeyfile == NULL){
743
perror("combinepath");
744
returncode = EXIT_FAILURE;
745
goto exit;
746
}
747
748
seckeyfile = combinepath(keydir, seckeyfile);
749
if (seckeyfile == NULL){
750
perror("combinepath");
751
goto exit;
752
}
753
1399
754
if_index = (AvahiIfIndex) if_nametoindex(interface);
1400
755
if(if_index == 0){
1401
756
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1402
exitcode = EX_UNAVAILABLE;
1403
goto end;
1404
}
1405
1406
if(quit_now){
1407
goto end;
1408
}
1409
1410
/* Re-raise priviliges */
1411
errno = 0;
1412
ret = seteuid(0);
1413
if(ret == -1){
1414
perror("seteuid");
1415
}
1416
1417
#ifdef __linux__
1418
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1419
messages about the network interface to mess up the prompt */
1420
ret = klogctl(8, NULL, 5);
1421
bool restore_loglevel = true;
1422
if(ret == -1){
1423
restore_loglevel = false;
1424
perror("klogctl");
1425
}
1426
#endif /* __linux__ */
757
exit(EXIT_FAILURE);
758
}
759
760
if(connect_to != NULL){
761
/* Connect directly, do not use Zeroconf */
762
/* (Mainly meant for debugging) */
763
char *address = strrchr(connect_to, ':');
764
if(address == NULL){
765
fprintf(stderr, "No colon in address\n");
766
exit(EXIT_FAILURE);
767
}
768
errno = 0;
769
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
770
if(errno){
771
perror("Bad port number");
772
exit(EXIT_FAILURE);
773
}
774
*address = '\0';
775
address = connect_to;
776
ret = start_mandos_communication(address, port, if_index, &mc);
777
if(ret < 0){
778
exit(EXIT_FAILURE);
779
} else {
780
exit(EXIT_SUCCESS);
781
}
782
}
1427
783
1428
784
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1429
if(sd < 0){
785
if(sd < 0) {
1430
786
perror("socket");
1431
exitcode = EX_OSERR;
1432
#ifdef __linux__
1433
if(restore_loglevel){
1434
ret = klogctl(7, NULL, 0);
1435
if(ret == -1){
1436
perror("klogctl");
1437
}
1438
}
1439
#endif /* __linux__ */
1440
/* Lower privileges */
1441
errno = 0;
1442
ret = seteuid(uid);
1443
if(ret == -1){
1444
perror("seteuid");
1445
}
1446
goto end;
787
returncode = EXIT_FAILURE;
788
goto exit;
1447
789
}
1448
strcpy(network.ifr_name, interface);
790
strcpy(network.ifr_name, interface); /* Spurious warning */
1449
791
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1450
792
if(ret == -1){
793
1451
794
perror("ioctl SIOCGIFFLAGS");
1452
#ifdef __linux__
1453
if(restore_loglevel){
1454
ret = klogctl(7, NULL, 0);
1455
if(ret == -1){
1456
perror("klogctl");
1457
}
1458
}
1459
#endif /* __linux__ */
1460
exitcode = EX_OSERR;
1461
/* Lower privileges */
1462
errno = 0;
1463
ret = seteuid(uid);
1464
if(ret == -1){
1465
perror("seteuid");
1466
}
1467
goto end;
795
returncode = EXIT_FAILURE;
796
goto exit;
1468
797
}
1469
798
if((network.ifr_flags & IFF_UP) == 0){
1470
799
network.ifr_flags |= IFF_UP;
1471
take_down_interface = true;
1472
800
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1473
801
if(ret == -1){
1474
take_down_interface = false;
1475
perror("ioctl SIOCSIFFLAGS +IFF_UP");
1476
exitcode = EX_OSERR;
1477
#ifdef __linux__
1478
if(restore_loglevel){
1479
ret = klogctl(7, NULL, 0);
1480
if(ret == -1){
1481
perror("klogctl");
1482
}
1483
}
1484
#endif /* __linux__ */
1485
/* Lower privileges */
1486
errno = 0;
1487
ret = seteuid(uid);
1488
if(ret == -1){
1489
perror("seteuid");
1490
}
1491
goto end;
1492
}
1493
}
1494
/* sleep checking until interface is running */
1495
for(int i=0; i < delay * 4; i++){
1496
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1497
if(ret == -1){
1498
perror("ioctl SIOCGIFFLAGS");
1499
} else if(network.ifr_flags & IFF_RUNNING){
1500
break;
1501
}
1502
struct timespec sleeptime = { .tv_nsec = 250000000 };
1503
ret = nanosleep(&sleeptime, NULL);
1504
if(ret == -1 and errno != EINTR){
1505
perror("nanosleep");
1506
}
1507
}
1508
if(not take_down_interface){
1509
/* We won't need the socket anymore */
1510
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1511
if(ret == -1){
1512
perror("close");
1513
}
1514
}
1515
#ifdef __linux__
1516
if(restore_loglevel){
1517
/* Restores kernel loglevel to default */
1518
ret = klogctl(7, NULL, 0);
1519
if(ret == -1){
1520
perror("klogctl");
1521
}
1522
}
1523
#endif /* __linux__ */
1524
/* Lower privileges */
1525
errno = 0;
1526
if(take_down_interface){
1527
/* Lower privileges */
1528
ret = seteuid(uid);
1529
if(ret == -1){
1530
perror("seteuid");
1531
}
1532
} else {
1533
/* Lower privileges permanently */
1534
ret = setuid(uid);
1535
if(ret == -1){
1536
perror("setuid");
1537
}
1538
}
1539
}
1540
1541
if(quit_now){
1542
goto end;
1543
}
1544
1545
ret = init_gnutls_global(pubkey, seckey);
1546
if(ret == -1){
1547
fprintf(stderr, "init_gnutls_global failed\n");
1548
exitcode = EX_UNAVAILABLE;
1549
goto end;
1550
} else {
1551
gnutls_initialized = true;
1552
}
1553
1554
if(quit_now){
1555
goto end;
1556
}
1557
1558
tempdir_created = true;
1559
if(mkdtemp(tempdir) == NULL){
1560
tempdir_created = false;
1561
perror("mkdtemp");
1562
goto end;
1563
}
1564
1565
if(quit_now){
1566
goto end;
1567
}
1568
1569
if(not init_gpgme(pubkey, seckey, tempdir)){
1570
fprintf(stderr, "init_gpgme failed\n");
1571
exitcode = EX_UNAVAILABLE;
1572
goto end;
1573
} else {
1574
gpgme_initialized = true;
1575
}
1576
1577
if(quit_now){
1578
goto end;
1579
}
1580
1581
if(connect_to != NULL){
1582
/* Connect directly, do not use Zeroconf */
1583
/* (Mainly meant for debugging) */
1584
char *address = strrchr(connect_to, ':');
1585
if(address == NULL){
1586
fprintf(stderr, "No colon in address\n");
1587
exitcode = EX_USAGE;
1588
goto end;
1589
}
1590
1591
if(quit_now){
1592
goto end;
1593
}
1594
1595
uint16_t port;
1596
errno = 0;
1597
tmpmax = strtoimax(address+1, &tmp, 10);
1598
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1599
or tmpmax != (uint16_t)tmpmax){
1600
fprintf(stderr, "Bad port number\n");
1601
exitcode = EX_USAGE;
1602
goto end;
1603
}
1604
1605
if(quit_now){
1606
goto end;
1607
}
1608
1609
port = (uint16_t)tmpmax;
1610
*address = '\0';
1611
address = connect_to;
1612
/* Colon in address indicates IPv6 */
1613
int af;
1614
if(strchr(address, ':') != NULL){
1615
af = AF_INET6;
1616
} else {
1617
af = AF_INET;
1618
}
1619
1620
if(quit_now){
1621
goto end;
1622
}
1623
1624
while(not quit_now){
1625
ret = start_mandos_communication(address, port, if_index, af);
1626
if(quit_now or ret == 0){
1627
break;
1628
}
1629
sleep(15);
1630
};
1631
1632
if (not quit_now){
1633
exitcode = EXIT_SUCCESS;
1634
}
1635
1636
goto end;
1637
}
1638
1639
if(quit_now){
1640
goto end;
1641
}
1642
1643
{
1644
AvahiServerConfig config;
1645
/* Do not publish any local Zeroconf records */
802
perror("ioctl SIOCSIFFLAGS");
803
returncode = EXIT_FAILURE;
804
goto exit;
805
}
806
}
807
close(sd);
808
809
if (not debug){
810
avahi_set_log_function(empty_log);
811
}
812
813
/* Initialize the psuedo-RNG */
814
srand((unsigned int) time(NULL));
815
816
/* Allocate main loop object */
817
if (!(mc.simple_poll = avahi_simple_poll_new())) {
818
fprintf(stderr, "Failed to create simple poll object.\n");
819
returncode = EXIT_FAILURE;
820
goto exit;
821
}
822
823
/* Do not publish any local records */
1646
824
avahi_server_config_init(&config);
1647
825
config.publish_hinfo = 0;
1648
826
config.publish_addresses = 0;
1649
827
config.publish_workstation = 0;
1650
828
config.publish_domain = 0;
1651
829
1652
830
/* Allocate a new server */
1653
mc.server = avahi_server_new(avahi_simple_poll_get
1654
(mc.simple_poll), &config, NULL,
1655
NULL, &error);
831
mc.server=avahi_server_new(avahi_simple_poll_get(mc.simple_poll),
832
&config, NULL, NULL, &error);
1656
833
1657
/* Free the Avahi configuration data */
834
/* Free the configuration data */
1658
835
avahi_server_config_free(&config);
1659
}
1660
1661
/* Check if creating the Avahi server object succeeded */
1662
if(mc.server == NULL){
1663
fprintf(stderr, "Failed to create Avahi server: %s\n",
1664
avahi_strerror(error));
1665
exitcode = EX_UNAVAILABLE;
1666
goto end;
1667
}
1668
1669
if(quit_now){
1670
goto end;
1671
}
1672
1673
/* Create the Avahi service browser */
1674
sb = avahi_s_service_browser_new(mc.server, if_index,
1675
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1676
NULL, 0, browse_callback, NULL);
1677
if(sb == NULL){
1678
fprintf(stderr, "Failed to create service browser: %s\n",
1679
avahi_strerror(avahi_server_errno(mc.server)));
1680
exitcode = EX_UNAVAILABLE;
1681
goto end;
1682
}
1683
1684
if(quit_now){
1685
goto end;
1686
}
1687
1688
/* Run the main loop */
1689
1690
if(debug){
1691
fprintf(stderr, "Starting Avahi loop search\n");
1692
}
1693
1694
avahi_simple_poll_loop(mc.simple_poll);
1695
1696
end:
1697
1698
if(debug){
1699
fprintf(stderr, "%s exiting\n", argv[0]);
1700
}
1701
1702
/* Cleanup things */
1703
if(sb != NULL)
1704
avahi_s_service_browser_free(sb);
1705
1706
if(mc.server != NULL)
1707
avahi_server_free(mc.server);
1708
1709
if(mc.simple_poll != NULL)
1710
avahi_simple_poll_free(mc.simple_poll);
1711
1712
if(gnutls_initialized){
1713
gnutls_certificate_free_credentials(mc.cred);
1714
gnutls_global_deinit();
1715
gnutls_dh_params_deinit(mc.dh_params);
1716
}
1717
1718
if(gpgme_initialized){
1719
gpgme_release(mc.ctx);
1720
}
1721
1722
/* Take down the network interface */
1723
if(take_down_interface){
1724
/* Re-raise priviliges */
1725
errno = 0;
1726
ret = seteuid(0);
1727
if(ret == -1){
1728
perror("seteuid");
1729
}
1730
if(geteuid() == 0){
1731
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1732
if(ret == -1){
1733
perror("ioctl SIOCGIFFLAGS");
1734
} else if(network.ifr_flags & IFF_UP) {
1735
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1736
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1737
if(ret == -1){
1738
perror("ioctl SIOCSIFFLAGS -IFF_UP");
1739
}
1740
}
1741
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1742
if(ret == -1){
1743
perror("close");
1744
}
1745
/* Lower privileges permanently */
1746
errno = 0;
1747
ret = setuid(uid);
1748
if(ret == -1){
1749
perror("setuid");
1750
}
1751
}
1752
}
1753
1754
/* Removes the temp directory used by GPGME */
1755
if(tempdir_created){
1756
DIR *d;
1757
struct dirent *direntry;
1758
d = opendir(tempdir);
1759
if(d == NULL){
1760
if(errno != ENOENT){
1761
perror("opendir");
1762
}
1763
} else {
1764
while(true){
1765
direntry = readdir(d);
1766
if(direntry == NULL){
1767
break;
1768
}
1769
/* Skip "." and ".." */
1770
if(direntry->d_name[0] == '.'
1771
and (direntry->d_name[1] == '\0'
1772
or (direntry->d_name[1] == '.'
1773
and direntry->d_name[2] == '\0'))){
1774
continue;
1775
}
1776
char *fullname = NULL;
1777
ret = asprintf(&fullname, "%s/%s", tempdir,
1778
direntry->d_name);
1779
if(ret < 0){
1780
perror("asprintf");
1781
continue;
1782
}
1783
ret = remove(fullname);
1784
if(ret == -1){
1785
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1786
strerror(errno));
1787
}
1788
free(fullname);
1789
}
1790
closedir(d);
1791
}
1792
ret = rmdir(tempdir);
1793
if(ret == -1 and errno != ENOENT){
1794
perror("rmdir");
1795
}
1796
}
1797
1798
if(quit_now){
1799
sigemptyset(&old_sigterm_action.sa_mask);
1800
old_sigterm_action.sa_handler = SIG_DFL;
1801
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1802
&old_sigterm_action,
1803
NULL));
1804
if(ret == -1){
1805
perror("sigaction");
1806
}
1807
do {
1808
ret = raise(signal_received);
1809
} while(ret != 0 and errno == EINTR);
1810
if(ret != 0){
1811
perror("raise");
1812
abort();
1813
}
1814
TEMP_FAILURE_RETRY(pause());
1815
}
1816
1817
return exitcode;
836
837
/* Check if creating the server object succeeded */
838
if (!mc.server) {
839
fprintf(stderr, "Failed to create server: %s\n",
840
avahi_strerror(error));
841
returncode = EXIT_FAILURE;
842
goto exit;
843
}
844
845
/* Create the service browser */
846
sb = avahi_s_service_browser_new(mc.server, if_index,
847
AVAHI_PROTO_INET6,
848
"_mandos._tcp", NULL, 0,
849
browse_callback, &mc);
850
if (!sb) {
851
fprintf(stderr, "Failed to create service browser: %s\n",
852
avahi_strerror(avahi_server_errno(mc.server)));
853
returncode = EXIT_FAILURE;
854
goto exit;
855
}
856
857
/* Run the main loop */
858
859
if (debug){
860
fprintf(stderr, "Starting avahi loop search\n");
861
}
862
863
avahi_simple_poll_loop(mc.simple_poll);
864
865
exit:
866
867
if (debug){
868
fprintf(stderr, "%s exiting\n", argv[0]);
869
}
870
871
/* Cleanup things */
872
if (sb)
873
avahi_s_service_browser_free(sb);
874
875
if (mc.server)
876
avahi_server_free(mc.server);
877
878
if (mc.simple_poll)
879
avahi_simple_poll_free(mc.simple_poll);
880
free(pubkeyfile);
881
free(seckeyfile);
882
883
return returncode;
1818
884
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0