115
33
#include <avahi-common/malloc.h>
116
34
#include <avahi-common/error.h>
119
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
122
init_gnutls_session(),
124
#include <gnutls/openpgp.h>
125
/* gnutls_certificate_set_openpgp_key_file(),
126
GNUTLS_OPENPGP_FMT_BASE64 */
129
#include <gpgme.h> /* All GPGME types, constants and
132
GPGME_PROTOCOL_OpenPGP,
37
#include <sys/types.h> /* socket(), setsockopt(), inet_pton() */
38
#include <sys/socket.h> /* socket(), setsockopt(), struct sockaddr_in6, struct in6_addr, inet_pton() */
39
#include <gnutls/gnutls.h> /* ALL GNUTLS STUFF */
40
#include <gnutls/openpgp.h> /* gnutls with openpgp stuff */
42
#include <unistd.h> /* close() */
43
#include <netinet/in.h>
44
#include <stdbool.h> /* true */
45
#include <string.h> /* memset */
46
#include <arpa/inet.h> /* inet_pton() */
47
#include <iso646.h> /* not */
50
#include <errno.h> /* perror() */
55
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
57
#define CERTFILE CERT_ROOT "openpgp-client.txt"
58
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
135
59
#define BUFFER_SIZE 256
137
#define PATHDIR "/conf/conf.d/mandos"
138
#define SECKEY "seckey.txt"
139
#define PUBKEY "pubkey.txt"
140
#define HOOKDIR "/lib/mandos/network-hooks.d"
143
static const char mandos_protocol_version[] = "1";
144
const char *argp_program_version = "mandos-client " VERSION;
145
const char *argp_program_bug_address = "<mandos@recompile.se>";
146
static const char sys_class_net[] = "/sys/class/net";
147
char *connect_to = NULL;
148
const char *hookdir = HOOKDIR;
153
/* Doubly linked list that need to be circularly linked when used */
154
typedef struct server{
157
AvahiIfIndex if_index;
159
struct timespec last_seen;
164
/* Used for passing in values through the Avahi callback functions */
65
gnutls_session_t session;
167
66
gnutls_certificate_credentials_t cred;
168
unsigned int dh_bits;
169
67
gnutls_dh_params_t dh_params;
170
const char *priority;
71
ssize_t gpg_packet_decrypt (char *packet, size_t packet_size, char **new_packet, char *homedir){
72
gpgme_data_t dh_crypto, dh_plain;
172
server *current_server;
174
size_t interfaces_size;
177
/* global so signal handler can reach it*/
178
AvahiSimplePoll *simple_poll;
180
sig_atomic_t quit_now = 0;
181
int signal_received = 0;
183
/* Function to use when printing errors */
184
void perror_plus(const char *print_text){
186
fprintf(stderr, "Mandos plugin %s: ",
187
program_invocation_short_name);
192
__attribute__((format (gnu_printf, 2, 3), nonnull))
193
int fprintf_plus(FILE *stream, const char *format, ...){
195
va_start (ap, format);
197
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
198
program_invocation_short_name));
199
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
203
* Make additional room in "buffer" for at least BUFFER_SIZE more
204
* bytes. "buffer_capacity" is how much is currently allocated,
205
* "buffer_length" is how much is already used.
207
__attribute__((nonnull, warn_unused_result))
208
size_t incbuffer(char **buffer, size_t buffer_length,
209
size_t buffer_capacity){
210
if(buffer_length + BUFFER_SIZE > buffer_capacity){
211
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
213
int old_errno = errno;
220
buffer_capacity += BUFFER_SIZE;
222
return buffer_capacity;
225
/* Add server to set of servers to retry periodically */
226
__attribute__((nonnull, warn_unused_result))
227
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
228
int af, server **current_server){
230
server *new_server = malloc(sizeof(server));
231
if(new_server == NULL){
232
perror_plus("malloc");
235
*new_server = (server){ .ip = strdup(ip),
237
.if_index = if_index,
239
if(new_server->ip == NULL){
240
perror_plus("strdup");
244
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
246
perror_plus("clock_gettime");
248
#pragma GCC diagnostic push
249
#pragma GCC diagnostic ignored "-Wcast-qual"
251
free((char *)(new_server->ip));
253
#pragma GCC diagnostic pop
258
/* Special case of first server */
259
if(*current_server == NULL){
260
new_server->next = new_server;
261
new_server->prev = new_server;
262
*current_server = new_server;
264
/* Place the new server last in the list */
265
new_server->next = *current_server;
266
new_server->prev = (*current_server)->prev;
267
new_server->prev->next = new_server;
268
(*current_server)->prev = new_server;
276
__attribute__((nonnull, warn_unused_result))
277
static bool init_gpgme(const char * const seckey,
278
const char * const pubkey,
279
const char * const tempdir,
76
size_t new_packet_capacity = 0;
77
size_t new_packet_length = 0;
282
78
gpgme_engine_info_t engine_info;
285
* Helper function to insert pub and seckey to the engine keyring.
287
bool import_key(const char * const filename){
290
gpgme_data_t pgp_data;
292
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
298
rc = gpgme_data_new_from_fd(&pgp_data, fd);
299
if(rc != GPG_ERR_NO_ERROR){
300
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
301
gpgme_strsource(rc), gpgme_strerror(rc));
305
rc = gpgme_op_import(mc->ctx, pgp_data);
306
if(rc != GPG_ERR_NO_ERROR){
307
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
308
gpgme_strsource(rc), gpgme_strerror(rc));
314
perror_plus("close");
316
gpgme_data_release(pgp_data);
321
fprintf_plus(stderr, "Initializing GPGME\n");
81
fprintf(stderr, "Attempting to decrypt password from gpg packet\n");
325
85
gpgme_check_version(NULL);
326
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
327
if(rc != GPG_ERR_NO_ERROR){
328
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
329
gpgme_strsource(rc), gpgme_strerror(rc));
86
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
333
/* Set GPGME home directory for the OpenPGP engine only */
334
rc = gpgme_get_engine_info(&engine_info);
335
if(rc != GPG_ERR_NO_ERROR){
336
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
337
gpgme_strsource(rc), gpgme_strerror(rc));
88
/* Set GPGME home directory */
89
rc = gpgme_get_engine_info (&engine_info);
90
if (rc != GPG_ERR_NO_ERROR){
91
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
92
gpgme_strsource(rc), gpgme_strerror(rc));
340
95
while(engine_info != NULL){
341
96
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
342
97
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
343
engine_info->file_name, tempdir);
98
engine_info->file_name, homedir);
346
101
engine_info = engine_info->next;
348
103
if(engine_info == NULL){
349
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
354
/* Create new GPGME "context" */
355
rc = gpgme_new(&(mc->ctx));
356
if(rc != GPG_ERR_NO_ERROR){
357
fprintf_plus(stderr, "Mandos plugin mandos-client: "
358
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
363
if(not import_key(pubkey) or not import_key(seckey)){
371
* Decrypt OpenPGP data.
372
* Returns -1 on error
374
__attribute__((nonnull, warn_unused_result))
375
static ssize_t pgp_packet_decrypt(const char *cryptotext,
379
gpgme_data_t dh_crypto, dh_plain;
382
size_t plaintext_capacity = 0;
383
ssize_t plaintext_length = 0;
386
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
389
/* Create new GPGME data buffer from memory cryptotext */
390
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
392
if(rc != GPG_ERR_NO_ERROR){
393
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
394
gpgme_strsource(rc), gpgme_strerror(rc));
104
fprintf(stderr, "Could not set home dir to %s\n", homedir);
108
/* Create new GPGME data buffer from packet buffer */
109
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
110
if (rc != GPG_ERR_NO_ERROR){
111
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
112
gpgme_strsource(rc), gpgme_strerror(rc));
398
116
/* Create new empty GPGME data buffer for the plaintext */
399
117
rc = gpgme_data_new(&dh_plain);
400
if(rc != GPG_ERR_NO_ERROR){
401
fprintf_plus(stderr, "Mandos plugin mandos-client: "
402
"bad gpgme_data_new: %s: %s\n",
403
gpgme_strsource(rc), gpgme_strerror(rc));
404
gpgme_data_release(dh_crypto);
408
/* Decrypt data from the cryptotext data buffer to the plaintext
410
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
411
if(rc != GPG_ERR_NO_ERROR){
412
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
413
gpgme_strsource(rc), gpgme_strerror(rc));
414
plaintext_length = -1;
416
gpgme_decrypt_result_t result;
417
result = gpgme_op_decrypt_result(mc->ctx);
419
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
421
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
422
result->unsupported_algorithm);
423
fprintf_plus(stderr, "Wrong key usage: %u\n",
424
result->wrong_key_usage);
425
if(result->file_name != NULL){
426
fprintf_plus(stderr, "File name: %s\n", result->file_name);
428
gpgme_recipient_t recipient;
429
recipient = result->recipients;
118
if (rc != GPG_ERR_NO_ERROR){
119
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
120
gpgme_strsource(rc), gpgme_strerror(rc));
124
/* Create new GPGME "context" */
125
rc = gpgme_new(&ctx);
126
if (rc != GPG_ERR_NO_ERROR){
127
fprintf(stderr, "bad gpgme_new: %s: %s\n",
128
gpgme_strsource(rc), gpgme_strerror(rc));
132
/* Decrypt data from the FILE pointer to the plaintext data buffer */
133
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
134
if (rc != GPG_ERR_NO_ERROR){
135
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
136
gpgme_strsource(rc), gpgme_strerror(rc));
141
fprintf(stderr, "decryption of gpg packet succeeded\n");
145
gpgme_decrypt_result_t result;
146
result = gpgme_op_decrypt_result(ctx);
148
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
150
fprintf(stderr, "Unsupported algorithm: %s\n", result->unsupported_algorithm);
151
fprintf(stderr, "Wrong key usage: %d\n", result->wrong_key_usage);
152
if(result->file_name != NULL){
153
fprintf(stderr, "File name: %s\n", result->file_name);
155
gpgme_recipient_t recipient;
156
recipient = result->recipients;
430
158
while(recipient != NULL){
431
fprintf_plus(stderr, "Public key algorithm: %s\n",
432
gpgme_pubkey_algo_name
433
(recipient->pubkey_algo));
434
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
435
fprintf_plus(stderr, "Secret key available: %s\n",
436
recipient->status == GPG_ERR_NO_SECKEY
159
fprintf(stderr, "Public key algorithm: %s\n",
160
gpgme_pubkey_algo_name(recipient->pubkey_algo));
161
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
162
fprintf(stderr, "Secret key available: %s\n",
163
recipient->status == GPG_ERR_NO_SECKEY ? "No" : "Yes");
438
164
recipient = recipient->next;
446
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
170
/* Delete the GPGME FILE pointer cryptotext data buffer */
171
gpgme_data_release(dh_crypto);
449
173
/* Seek back to the beginning of the GPGME plaintext data buffer */
450
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
451
perror_plus("gpgme_data_seek");
452
plaintext_length = -1;
174
gpgme_data_seek(dh_plain, 0, SEEK_SET);
458
plaintext_capacity = incbuffer(plaintext,
459
(size_t)plaintext_length,
461
if(plaintext_capacity == 0){
462
perror_plus("incbuffer");
463
plaintext_length = -1;
178
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
179
*new_packet = realloc(*new_packet, new_packet_capacity + BUFFER_SIZE);
180
if (*new_packet == NULL){
184
new_packet_capacity += BUFFER_SIZE;
467
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
187
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length, BUFFER_SIZE);
469
188
/* Print the data, if any */
190
/* If password is empty, then a incorrect error will be printed */
475
perror_plus("gpgme_data_read");
476
plaintext_length = -1;
194
perror("gpgme_data_read");
479
plaintext_length += ret;
197
new_packet_length += ret;
483
fprintf_plus(stderr, "Decrypted password is: ");
484
for(ssize_t i = 0; i < plaintext_length; i++){
485
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
487
fprintf(stderr, "\n");
201
fprintf(stderr, "decrypted password is: %s\n", *new_packet);
492
/* Delete the GPGME cryptotext data buffer */
493
gpgme_data_release(dh_crypto);
495
/* Delete the GPGME plaintext data buffer */
204
/* Delete the GPGME plaintext data buffer */
496
205
gpgme_data_release(dh_plain);
497
return plaintext_length;
500
__attribute__((warn_unused_result, const))
501
static const char *safe_string(const char *str){
507
__attribute__((warn_unused_result))
508
static const char *safer_gnutls_strerror(int value){
509
const char *ret = gnutls_strerror(value);
510
return safe_string(ret);
513
/* GnuTLS log function callback */
514
__attribute__((nonnull))
515
static void debuggnutls(__attribute__((unused)) int level,
517
fprintf_plus(stderr, "GnuTLS: %s", string);
520
__attribute__((nonnull(1, 2, 4), warn_unused_result))
521
static int init_gnutls_global(const char *pubkeyfilename,
522
const char *seckeyfilename,
523
const char *dhparamsfilename,
206
return new_packet_length;
209
static const char * safer_gnutls_strerror (int value) {
210
const char *ret = gnutls_strerror (value);
216
void debuggnutls(int level, const char* string){
217
fprintf(stderr, "%s", string);
220
int initgnutls(encrypted_session *es){
529
fprintf_plus(stderr, "Initializing GnuTLS\n");
533
/* "Use a log level over 10 to enable all debugging options."
225
fprintf(stderr, "Initializing gnutls\n");
229
if ((ret = gnutls_global_init ())
230
!= GNUTLS_E_SUCCESS) {
231
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
536
236
gnutls_global_set_log_level(11);
537
237
gnutls_global_set_log_function(debuggnutls);
540
/* OpenPGP credentials */
541
ret = gnutls_certificate_allocate_credentials(&mc->cred);
542
if(ret != GNUTLS_E_SUCCESS){
543
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
544
safer_gnutls_strerror(ret));
241
/* openpgp credentials */
242
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
243
!= GNUTLS_E_SUCCESS) {
244
fprintf (stderr, "memory error: %s\n", safer_gnutls_strerror(ret));
549
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
550
" secret key %s as GnuTLS credentials\n",
249
fprintf(stderr, "Attempting to use openpgp certificate %s"
250
" and keyfile %s as gnutls credentials\n", CERTFILE, KEYFILE);
555
253
ret = gnutls_certificate_set_openpgp_key_file
556
(mc->cred, pubkeyfilename, seckeyfilename,
557
GNUTLS_OPENPGP_FMT_BASE64);
558
if(ret != GNUTLS_E_SUCCESS){
560
"Error[%d] while reading the OpenPGP key pair ('%s',"
561
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
562
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
563
safer_gnutls_strerror(ret));
567
/* GnuTLS server initialization */
568
ret = gnutls_dh_params_init(&mc->dh_params);
569
if(ret != GNUTLS_E_SUCCESS){
570
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
571
" initialization: %s\n",
572
safer_gnutls_strerror(ret));
575
/* If a Diffie-Hellman parameters file was given, try to use it */
576
if(dhparamsfilename != NULL){
577
gnutls_datum_t params = { .data = NULL, .size = 0 };
579
int dhpfile = open(dhparamsfilename, O_RDONLY);
582
dhparamsfilename = NULL;
585
size_t params_capacity = 0;
587
params_capacity = incbuffer((char **)¶ms.data,
589
(size_t)params_capacity);
590
if(params_capacity == 0){
591
perror_plus("incbuffer");
594
dhparamsfilename = NULL;
597
ssize_t bytes_read = read(dhpfile,
598
params.data + params.size,
604
/* check bytes_read for failure */
609
dhparamsfilename = NULL;
612
params.size += (unsigned int)bytes_read;
614
if(params.data == NULL){
615
dhparamsfilename = NULL;
617
if(dhparamsfilename == NULL){
620
ret = gnutls_dh_params_import_pkcs3(mc->dh_params, ¶ms,
621
GNUTLS_X509_FMT_PEM);
622
if(ret != GNUTLS_E_SUCCESS){
623
fprintf_plus(stderr, "Failed to parse DH parameters in file"
624
" \"%s\": %s\n", dhparamsfilename,
625
safer_gnutls_strerror(ret));
626
dhparamsfilename = NULL;
630
if(dhparamsfilename == NULL){
631
if(mc->dh_bits == 0){
632
/* Find out the optimal number of DH bits */
633
/* Try to read the private key file */
634
gnutls_datum_t buffer = { .data = NULL, .size = 0 };
636
int secfile = open(seckeyfilename, O_RDONLY);
641
size_t buffer_capacity = 0;
643
buffer_capacity = incbuffer((char **)&buffer.data,
645
(size_t)buffer_capacity);
646
if(buffer_capacity == 0){
647
perror_plus("incbuffer");
652
ssize_t bytes_read = read(secfile,
653
buffer.data + buffer.size,
659
/* check bytes_read for failure */
666
buffer.size += (unsigned int)bytes_read;
670
/* If successful, use buffer to parse private key */
671
gnutls_sec_param_t sec_param = GNUTLS_SEC_PARAM_ULTRA;
672
if(buffer.data != NULL){
674
gnutls_openpgp_privkey_t privkey = NULL;
675
ret = gnutls_openpgp_privkey_init(&privkey);
676
if(ret != GNUTLS_E_SUCCESS){
677
fprintf_plus(stderr, "Error initializing OpenPGP key"
679
safer_gnutls_strerror(ret));
683
ret = gnutls_openpgp_privkey_import
684
(privkey, &buffer, GNUTLS_OPENPGP_FMT_BASE64, "", 0);
685
if(ret != GNUTLS_E_SUCCESS){
686
fprintf_plus(stderr, "Error importing OpenPGP key : %s",
687
safer_gnutls_strerror(ret));
693
/* Use private key to suggest an appropriate
695
sec_param = gnutls_openpgp_privkey_sec_param(privkey);
696
gnutls_openpgp_privkey_deinit(privkey);
698
fprintf_plus(stderr, "This OpenPGP key implies using"
699
" a GnuTLS security parameter \"%s\".\n",
700
safe_string(gnutls_sec_param_get_name
706
if(sec_param == GNUTLS_SEC_PARAM_UNKNOWN){
707
/* Err on the side of caution */
708
sec_param = GNUTLS_SEC_PARAM_ULTRA;
710
fprintf_plus(stderr, "Falling back to security parameter"
712
safe_string(gnutls_sec_param_get_name
717
uret = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, sec_param);
721
fprintf_plus(stderr, "A \"%s\" GnuTLS security parameter"
722
" implies %u DH bits; using that.\n",
723
safe_string(gnutls_sec_param_get_name
728
fprintf_plus(stderr, "Failed to get implied number of DH"
729
" bits for security parameter \"%s\"): %s\n",
730
safe_string(gnutls_sec_param_get_name
732
safer_gnutls_strerror(ret));
736
fprintf_plus(stderr, "DH bits explicitly set to %u\n",
739
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
740
if(ret != GNUTLS_E_SUCCESS){
741
fprintf_plus(stderr, "Error in GnuTLS prime generation (%u"
742
" bits): %s\n", mc->dh_bits,
743
safer_gnutls_strerror(ret));
747
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
753
gnutls_certificate_free_credentials(mc->cred);
754
gnutls_dh_params_deinit(mc->dh_params);
758
__attribute__((nonnull, warn_unused_result))
759
static int init_gnutls_session(gnutls_session_t *session,
762
/* GnuTLS session creation */
764
ret = gnutls_init(session, GNUTLS_SERVER);
768
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
769
if(ret != GNUTLS_E_SUCCESS){
771
"Error in GnuTLS session initialization: %s\n",
772
safer_gnutls_strerror(ret));
778
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
780
gnutls_deinit(*session);
783
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
784
if(ret != GNUTLS_E_SUCCESS){
785
fprintf_plus(stderr, "Syntax error at: %s\n", err);
786
fprintf_plus(stderr, "GnuTLS error: %s\n",
787
safer_gnutls_strerror(ret));
788
gnutls_deinit(*session);
794
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
797
gnutls_deinit(*session);
800
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
801
if(ret != GNUTLS_E_SUCCESS){
802
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
803
safer_gnutls_strerror(ret));
804
gnutls_deinit(*session);
254
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
255
if (ret != GNUTLS_E_SUCCESS) {
257
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s', '%s')\n",
258
ret, CERTFILE, KEYFILE);
259
fprintf(stdout, "The Error is: %s\n",
260
safer_gnutls_strerror(ret));
264
//Gnutls server initialization
265
if ((ret = gnutls_dh_params_init (&es->dh_params))
266
!= GNUTLS_E_SUCCESS) {
267
fprintf (stderr, "Error in dh parameter initialization: %s\n",
268
safer_gnutls_strerror(ret));
272
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
273
!= GNUTLS_E_SUCCESS) {
274
fprintf (stderr, "Error in prime generation: %s\n",
275
safer_gnutls_strerror(ret));
279
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
281
// Gnutls session creation
282
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
283
!= GNUTLS_E_SUCCESS){
284
fprintf(stderr, "Error in gnutls session initialization: %s\n",
285
safer_gnutls_strerror(ret));
288
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
289
!= GNUTLS_E_SUCCESS) {
290
fprintf(stderr, "Syntax error at: %s\n", err);
291
fprintf(stderr, "Gnutls error: %s\n",
292
safer_gnutls_strerror(ret));
296
if ((ret = gnutls_credentials_set
297
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
298
!= GNUTLS_E_SUCCESS) {
299
fprintf(stderr, "Error setting a credentials set: %s\n",
300
safer_gnutls_strerror(ret));
808
304
/* ignore client certificate if any. */
809
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
305
gnutls_certificate_server_set_request (es->session, GNUTLS_CERT_IGNORE);
307
gnutls_dh_set_prime_bits (es->session, DH_BITS);
814
/* Avahi log function callback */
815
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
816
__attribute__((unused)) const char *txt){}
818
/* Set effective uid to 0, return errno */
819
__attribute__((warn_unused_result))
820
error_t raise_privileges(void){
821
error_t old_errno = errno;
822
error_t ret_errno = 0;
823
if(seteuid(0) == -1){
830
/* Set effective and real user ID to 0. Return errno. */
831
__attribute__((warn_unused_result))
832
error_t raise_privileges_permanently(void){
833
error_t old_errno = errno;
834
error_t ret_errno = raise_privileges();
846
/* Set effective user ID to unprivileged saved user ID */
847
__attribute__((warn_unused_result))
848
error_t lower_privileges(void){
849
error_t old_errno = errno;
850
error_t ret_errno = 0;
851
if(seteuid(uid) == -1){
858
/* Lower privileges permanently */
859
__attribute__((warn_unused_result))
860
error_t lower_privileges_permanently(void){
861
error_t old_errno = errno;
862
error_t ret_errno = 0;
863
if(setuid(uid) == -1){
870
/* Helper function to add_local_route() and delete_local_route() */
871
__attribute__((nonnull, warn_unused_result))
872
static bool add_delete_local_route(const bool add,
874
AvahiIfIndex if_index){
876
char helper[] = "mandos-client-iprouteadddel";
877
char add_arg[] = "add";
878
char delete_arg[] = "delete";
879
char debug_flag[] = "--debug";
880
char *pluginhelperdir = getenv("MANDOSPLUGINHELPERDIR");
881
if(pluginhelperdir == NULL){
883
fprintf_plus(stderr, "MANDOSPLUGINHELPERDIR environment"
884
" variable not set; cannot run helper\n");
889
char interface[IF_NAMESIZE];
890
if(if_indextoname((unsigned int)if_index, interface) == NULL){
891
perror_plus("if_indextoname");
895
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
897
perror_plus("open(\"/dev/null\", O_RDONLY)");
903
/* Raise privileges */
904
errno = raise_privileges_permanently();
906
perror_plus("Failed to raise privileges");
907
/* _exit(EX_NOPERM); */
913
perror_plus("setgid");
916
/* Reset supplementary groups */
918
ret = setgroups(0, NULL);
920
perror_plus("setgroups");
924
ret = dup2(devnull, STDIN_FILENO);
926
perror_plus("dup2(devnull, STDIN_FILENO)");
929
ret = close(devnull);
931
perror_plus("close");
934
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
936
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
939
int helperdir_fd = (int)TEMP_FAILURE_RETRY(open(pluginhelperdir,
944
if(helperdir_fd == -1){
946
_exit(EX_UNAVAILABLE);
948
int helper_fd = (int)TEMP_FAILURE_RETRY(openat(helperdir_fd,
951
perror_plus("openat");
953
_exit(EX_UNAVAILABLE);
957
#pragma GCC diagnostic push
958
#pragma GCC diagnostic ignored "-Wcast-qual"
960
if(fexecve(helper_fd, (char *const [])
961
{ helper, add ? add_arg : delete_arg, (char *)address,
962
interface, debug ? debug_flag : NULL, NULL },
965
#pragma GCC diagnostic pop
967
perror_plus("fexecve");
979
pret = waitpid(pid, &status, 0);
980
if(pret == -1 and errno == EINTR and quit_now){
981
int errno_raising = 0;
982
if((errno = raise_privileges()) != 0){
983
errno_raising = errno;
984
perror_plus("Failed to raise privileges in order to"
985
" kill helper program");
987
if(kill(pid, SIGTERM) == -1){
990
if((errno_raising == 0) and (errno = lower_privileges()) != 0){
991
perror_plus("Failed to lower privileges after killing"
996
} while(pret == -1 and errno == EINTR);
998
perror_plus("waitpid");
1001
if(WIFEXITED(status)){
1002
if(WEXITSTATUS(status) != 0){
1003
fprintf_plus(stderr, "Error: iprouteadddel exited"
1004
" with status %d\n", WEXITSTATUS(status));
1009
if(WIFSIGNALED(status)){
1010
fprintf_plus(stderr, "Error: iprouteadddel died by"
1011
" signal %d\n", WTERMSIG(status));
1014
fprintf_plus(stderr, "Error: iprouteadddel crashed\n");
1018
__attribute__((nonnull, warn_unused_result))
1019
static bool add_local_route(const char *address,
1020
AvahiIfIndex if_index){
1022
fprintf_plus(stderr, "Adding route to %s\n", address);
1024
return add_delete_local_route(true, address, if_index);
1027
__attribute__((nonnull, warn_unused_result))
1028
static bool delete_local_route(const char *address,
1029
AvahiIfIndex if_index){
1031
fprintf_plus(stderr, "Removing route to %s\n", address);
1033
return add_delete_local_route(false, address, if_index);
1036
/* Called when a Mandos server is found */
1037
__attribute__((nonnull, warn_unused_result))
1038
static int start_mandos_communication(const char *ip, in_port_t port,
1039
AvahiIfIndex if_index,
1040
int af, mandos_context *mc){
1041
int ret, tcp_sd = -1;
1043
struct sockaddr_storage to;
312
void empty_log(AvahiLogLevel level, const char *txt){}
314
int start_mandos_communcation(char *ip, uint16_t port){
316
struct sockaddr_in6 to;
317
struct in6_addr ip_addr;
318
encrypted_session es;
1044
319
char *buffer = NULL;
1045
char *decrypted_buffer = NULL;
320
char *decrypted_buffer;
1046
321
size_t buffer_length = 0;
1047
322
size_t buffer_capacity = 0;
1050
gnutls_session_t session;
1051
int pf; /* Protocol family */
1052
bool route_added = false;
1069
fprintf_plus(stderr, "Bad address family: %d\n", af);
1074
/* If the interface is specified and we have a list of interfaces */
1075
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
1076
/* Check if the interface is one of the interfaces we are using */
1079
char *interface = NULL;
1080
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
1082
if(if_nametoindex(interface) == (unsigned int)if_index){
1089
/* This interface does not match any in the list, so we don't
1090
connect to the server */
1092
char interface[IF_NAMESIZE];
1093
if(if_indextoname((unsigned int)if_index, interface) == NULL){
1094
perror_plus("if_indextoname");
1096
fprintf_plus(stderr, "Skipping server on non-used interface"
1098
if_indextoname((unsigned int)if_index,
1106
ret = init_gnutls_session(&session, mc);
1112
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
1113
PRIuMAX "\n", ip, (uintmax_t)port);
1116
tcp_sd = socket(pf, SOCK_STREAM | SOCK_CLOEXEC, 0);
1119
perror_plus("socket");
1130
struct sockaddr_in6 *to6 = (struct sockaddr_in6 *)&to;
1131
*to6 = (struct sockaddr_in6){ .sin6_family = (sa_family_t)af };
1132
ret = inet_pton(af, ip, &to6->sin6_addr);
1134
struct sockaddr_in *to4 = (struct sockaddr_in *)&to;
1135
*to4 = (struct sockaddr_in){ .sin_family = (sa_family_t)af };
1136
ret = inet_pton(af, ip, &to4->sin_addr);
1140
perror_plus("inet_pton");
323
ssize_t decrypted_buffer_size;
325
const char interface[] = "eth0";
328
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
331
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
338
fprintf(stderr, "Binding to interface %s\n", interface);
341
ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, interface, 5);
343
perror("setsockopt bindtodevice");
347
memset(&to,0,sizeof(to));
348
to.sin6_family = AF_INET6;
349
ret = inet_pton(AF_INET6, ip, &ip_addr);
1146
fprintf_plus(stderr, "Bad address: %s\n", ip);
1151
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
1152
if(IN6_IS_ADDR_LINKLOCAL
1153
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
1154
if(if_index == AVAHI_IF_UNSPEC){
1155
fprintf_plus(stderr, "An IPv6 link-local address is"
1156
" incomplete without a network interface\n");
1160
/* Set the network interface number as scope */
1161
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
1164
((struct sockaddr_in *)&to)->sin_port = htons(port);
1173
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
1174
char interface[IF_NAMESIZE];
1175
if(if_indextoname((unsigned int)if_index, interface) == NULL){
1176
perror_plus("if_indextoname");
1178
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
1179
"\n", ip, interface, (uintmax_t)port);
1182
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
1183
ip, (uintmax_t)port);
1185
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
1186
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
1188
ret = getnameinfo((struct sockaddr *)&to,
1189
sizeof(struct sockaddr_in6),
1190
addrstr, sizeof(addrstr), NULL, 0,
1193
ret = getnameinfo((struct sockaddr *)&to,
1194
sizeof(struct sockaddr_in),
1195
addrstr, sizeof(addrstr), NULL, 0,
1198
if(ret == EAI_SYSTEM){
1199
perror_plus("getnameinfo");
1200
} else if(ret != 0) {
1201
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
1202
} else if(strcmp(addrstr, ip) != 0){
1203
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
1214
ret = connect(tcp_sd, (struct sockaddr *)&to,
1215
sizeof(struct sockaddr_in6));
1217
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
1218
sizeof(struct sockaddr_in));
1221
if(((errno == ENETUNREACH) or (errno == EHOSTUNREACH))
1222
and if_index != AVAHI_IF_UNSPEC
1223
and connect_to == NULL
1224
and not route_added and
1225
((af == AF_INET6 and not
1226
IN6_IS_ADDR_LINKLOCAL(&(((struct sockaddr_in6 *)
1228
or (af == AF_INET and
1229
/* Not a a IPv4LL address */
1230
(ntohl(((struct sockaddr_in *)&to)->sin_addr.s_addr)
1231
& 0xFFFF0000L) != 0xA9FE0000L))){
1232
/* Work around Avahi bug - Avahi does not announce link-local
1233
addresses if it has a global address, so local hosts with
1234
*only* a link-local address (e.g. Mandos clients) cannot
1235
connect to a Mandos server announced by Avahi on a server
1236
host with a global address. Work around this by retrying
1237
with an explicit route added with the server's address.
1239
Avahi bug reference:
1240
http://lists.freedesktop.org/archives/avahi/2010-February/001833.html
1241
https://bugs.debian.org/587961
1244
fprintf_plus(stderr, "Mandos server unreachable, trying"
1248
route_added = add_local_route(ip, if_index);
1254
if(errno != ECONNREFUSED or debug){
1256
perror_plus("connect");
1269
const char *out = mandos_protocol_version;
1272
size_t out_size = strlen(out);
1273
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
1274
out_size - written));
1277
perror_plus("write");
1281
written += (size_t)ret;
1282
if(written < out_size){
1285
if(out == mandos_protocol_version){
1300
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
1308
/* This casting via intptr_t is to eliminate warning about casting
1309
an int to a pointer type. This is exactly how the GnuTLS Guile
1310
function "set-session-transport-fd!" does it. */
1311
gnutls_transport_set_ptr(session,
1312
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
1320
ret = gnutls_handshake(session);
1325
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
1327
if(ret != GNUTLS_E_SUCCESS){
1329
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
1336
/* Read OpenPGP packet that contains the wanted password */
1339
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
1350
buffer_capacity = incbuffer(&buffer, buffer_length,
1352
if(buffer_capacity == 0){
1354
perror_plus("incbuffer");
1364
sret = gnutls_record_recv(session, buffer+buffer_length,
355
fprintf(stderr, "Bad address: %s\n", ip);
358
to.sin6_port = htons(port);
359
to.sin6_scope_id = if_nametoindex(interface);
362
fprintf(stderr, "Connection to: %s\n", ip);
365
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
371
ret = initgnutls (&es);
378
gnutls_transport_set_ptr (es.session, (gnutls_transport_ptr_t) tcp_sd);
381
fprintf(stderr, "Establishing tls session with %s\n", ip);
385
ret = gnutls_handshake (es.session);
387
if (ret != GNUTLS_E_SUCCESS){
388
fprintf(stderr, "\n*** Handshake failed ***\n");
394
//Retrieve gpg packet that contains the wanted password
397
fprintf(stderr, "Retrieving pgp encrypted password from %s\n", ip);
401
if (buffer_length + BUFFER_SIZE > buffer_capacity){
402
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
407
buffer_capacity += BUFFER_SIZE;
410
ret = gnutls_record_recv
411
(es.session, buffer+buffer_length, BUFFER_SIZE);
1371
417
case GNUTLS_E_INTERRUPTED:
1372
418
case GNUTLS_E_AGAIN:
1374
420
case GNUTLS_E_REHANDSHAKE:
1376
ret = gnutls_handshake(session);
1382
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
1384
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
421
ret = gnutls_handshake (es.session);
423
fprintf(stderr, "\n*** Handshake failed ***\n");
1392
fprintf_plus(stderr, "Unknown error while reading data from"
1393
" encrypted session with Mandos server\n");
1394
gnutls_bye(session, GNUTLS_SHUT_RDWR);
1399
buffer_length += (size_t) sret;
1404
fprintf_plus(stderr, "Closing TLS session\n");
1413
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
1418
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
1420
if(buffer_length > 0){
1421
ssize_t decrypted_buffer_size;
1422
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
1423
&decrypted_buffer, mc);
1424
if(decrypted_buffer_size >= 0){
1427
while(written < (size_t) decrypted_buffer_size){
1433
ret = (int)fwrite(decrypted_buffer + written, 1,
1434
(size_t)decrypted_buffer_size - written,
1436
if(ret == 0 and ferror(stdout)){
1439
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
1445
written += (size_t)ret;
1451
/* Shutdown procedure */
1456
if(not delete_local_route(ip, if_index)){
1457
fprintf_plus(stderr, "Failed to delete local route to %s on"
1458
" interface %d", ip, if_index);
1462
free(decrypted_buffer);
1465
ret = close(tcp_sd);
1471
perror_plus("close");
1473
gnutls_deinit(session);
430
fprintf(stderr, "Unknown error while reading data from encrypted session with mandos server\n");
432
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
436
buffer_length += ret;
440
if (buffer_length > 0){
441
if ((decrypted_buffer_size = gpg_packet_decrypt(buffer, buffer_length, &decrypted_buffer, CERT_ROOT)) >= 0){
442
fwrite (decrypted_buffer, 1, decrypted_buffer_size, stdout);
443
free(decrypted_buffer);
452
fprintf(stderr, "Closing tls session\n");
456
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
459
gnutls_deinit (es.session);
460
gnutls_certificate_free_credentials (es.cred);
461
gnutls_global_deinit ();
1483
__attribute__((nonnull))
1484
static void resolve_callback(AvahiSServiceResolver *r,
1485
AvahiIfIndex interface,
1486
AvahiProtocol proto,
1487
AvahiResolverEvent event,
1491
const char *host_name,
1492
const AvahiAddress *address,
1494
AVAHI_GCC_UNUSED AvahiStringList *txt,
1495
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1502
/* Called whenever a service has been resolved successfully or
465
static AvahiSimplePoll *simple_poll = NULL;
466
static AvahiServer *server = NULL;
468
static void resolve_callback(
469
AvahiSServiceResolver *r,
470
AVAHI_GCC_UNUSED AvahiIfIndex interface,
471
AVAHI_GCC_UNUSED AvahiProtocol protocol,
472
AvahiResolverEvent event,
476
const char *host_name,
477
const AvahiAddress *address,
479
AvahiStringList *txt,
480
AvahiLookupResultFlags flags,
481
AVAHI_GCC_UNUSED void* userdata) {
485
/* Called whenever a service has been resolved successfully or timed out */
488
case AVAHI_RESOLVER_FAILURE:
489
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of type '%s' in domain '%s': %s\n", name, type, domain, avahi_strerror(avahi_server_errno(server)));
492
case AVAHI_RESOLVER_FOUND: {
493
char ip[AVAHI_ADDRESS_STR_MAX];
494
avahi_address_snprint(ip, sizeof(ip), address);
496
fprintf(stderr, "Mandos server found at %s on port %d\n", ip, port);
498
int ret = start_mandos_communcation(ip, port);
1506
506
avahi_s_service_resolver_free(r);
1512
case AVAHI_RESOLVER_FAILURE:
1513
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1514
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1516
avahi_strerror(avahi_server_errno
1517
(((mandos_context*)mc)->server)));
1520
case AVAHI_RESOLVER_FOUND:
1522
char ip[AVAHI_ADDRESS_STR_MAX];
1523
avahi_address_snprint(ip, sizeof(ip), address);
1525
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1526
PRIdMAX ") on port %" PRIu16 "\n", name,
1527
host_name, ip, (intmax_t)interface, port);
1529
int ret = start_mandos_communication(ip, (in_port_t)port,
1531
avahi_proto_to_af(proto),
1534
avahi_simple_poll_quit(simple_poll);
1536
if(not add_server(ip, (in_port_t)port, interface,
1537
avahi_proto_to_af(proto),
1538
&((mandos_context*)mc)->current_server)){
1539
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1545
avahi_s_service_resolver_free(r);
1548
static void browse_callback(AvahiSServiceBrowser *b,
1549
AvahiIfIndex interface,
1550
AvahiProtocol protocol,
1551
AvahiBrowserEvent event,
1555
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1562
/* Called whenever a new services becomes available on the LAN or
1563
is removed from the LAN */
1571
case AVAHI_BROWSER_FAILURE:
1573
fprintf_plus(stderr, "(Avahi browser) %s\n",
1574
avahi_strerror(avahi_server_errno
1575
(((mandos_context*)mc)->server)));
1576
avahi_simple_poll_quit(simple_poll);
1579
case AVAHI_BROWSER_NEW:
1580
/* We ignore the returned Avahi resolver object. In the callback
1581
function we free it. If the Avahi server is terminated before
1582
the callback function is called the Avahi server will free the
1585
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1586
interface, protocol, name, type,
1587
domain, protocol, 0,
1588
resolve_callback, mc) == NULL)
1589
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1591
avahi_strerror(avahi_server_errno
1592
(((mandos_context*)mc)->server)));
1595
case AVAHI_BROWSER_REMOVE:
1598
case AVAHI_BROWSER_ALL_FOR_NOW:
1599
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1601
fprintf_plus(stderr, "No Mandos server found, still"
1608
/* Signal handler that stops main loop after SIGTERM */
1609
static void handle_sigterm(int sig){
1614
signal_received = sig;
1615
int old_errno = errno;
1616
/* set main loop to exit */
1617
if(simple_poll != NULL){
1618
avahi_simple_poll_quit(simple_poll);
1623
__attribute__((nonnull, warn_unused_result))
1624
bool get_flags(const char *ifname, struct ifreq *ifr){
1628
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1631
perror_plus("socket");
1635
strncpy(ifr->ifr_name, ifname, IF_NAMESIZE);
1636
ifr->ifr_name[IF_NAMESIZE-1] = '\0'; /* NUL terminate */
1637
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1641
perror_plus("ioctl SIOCGIFFLAGS");
1649
__attribute__((nonnull, warn_unused_result))
1650
bool good_flags(const char *ifname, const struct ifreq *ifr){
1652
/* Reject the loopback device */
1653
if(ifr->ifr_flags & IFF_LOOPBACK){
1655
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1660
/* Accept point-to-point devices only if connect_to is specified */
1661
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1663
fprintf_plus(stderr, "Accepting point-to-point interface"
1664
" \"%s\"\n", ifname);
1668
/* Otherwise, reject non-broadcast-capable devices */
1669
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1671
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1672
" \"%s\"\n", ifname);
1676
/* Reject non-ARP interfaces (including dummy interfaces) */
1677
if(ifr->ifr_flags & IFF_NOARP){
1679
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1685
/* Accept this device */
1687
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1693
* This function determines if a directory entry in /sys/class/net
1694
* corresponds to an acceptable network device.
1695
* (This function is passed to scandir(3) as a filter function.)
1697
__attribute__((nonnull, warn_unused_result))
1698
int good_interface(const struct dirent *if_entry){
1699
if(if_entry->d_name[0] == '.'){
1704
if(not get_flags(if_entry->d_name, &ifr)){
1706
fprintf_plus(stderr, "Failed to get flags for interface "
1707
"\"%s\"\n", if_entry->d_name);
1712
if(not good_flags(if_entry->d_name, &ifr)){
1719
* This function determines if a network interface is up.
1721
__attribute__((nonnull, warn_unused_result))
1722
bool interface_is_up(const char *interface){
1724
if(not get_flags(interface, &ifr)){
1726
fprintf_plus(stderr, "Failed to get flags for interface "
1727
"\"%s\"\n", interface);
1732
return (bool)(ifr.ifr_flags & IFF_UP);
1736
* This function determines if a network interface is running
1738
__attribute__((nonnull, warn_unused_result))
1739
bool interface_is_running(const char *interface){
1741
if(not get_flags(interface, &ifr)){
1743
fprintf_plus(stderr, "Failed to get flags for interface "
1744
"\"%s\"\n", interface);
1749
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1752
__attribute__((nonnull, pure, warn_unused_result))
1753
int notdotentries(const struct dirent *direntry){
1754
/* Skip "." and ".." */
1755
if(direntry->d_name[0] == '.'
1756
and (direntry->d_name[1] == '\0'
1757
or (direntry->d_name[1] == '.'
1758
and direntry->d_name[2] == '\0'))){
1764
/* Is this directory entry a runnable program? */
1765
__attribute__((nonnull, warn_unused_result))
1766
int runnable_hook(const struct dirent *direntry){
1771
if((direntry->d_name)[0] == '\0'){
1776
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1777
"abcdefghijklmnopqrstuvwxyz"
1780
if((direntry->d_name)[sret] != '\0'){
1781
/* Contains non-allowed characters */
1783
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1789
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1792
perror_plus("Could not stat hook");
1796
if(not (S_ISREG(st.st_mode))){
1797
/* Not a regular file */
1799
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1804
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1805
/* Not executable */
1807
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1813
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1819
__attribute__((nonnull, warn_unused_result))
1820
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1821
mandos_context *mc){
1823
struct timespec now;
1824
struct timespec waited_time;
1825
intmax_t block_time;
1828
if(mc->current_server == NULL){
1830
fprintf_plus(stderr, "Wait until first server is found."
1833
ret = avahi_simple_poll_iterate(s, -1);
1836
fprintf_plus(stderr, "Check current_server if we should run"
1839
/* the current time */
1840
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1842
perror_plus("clock_gettime");
1845
/* Calculating in ms how long time between now and server
1846
who we visted longest time ago. Now - last seen. */
1847
waited_time.tv_sec = (now.tv_sec
1848
- mc->current_server->last_seen.tv_sec);
1849
waited_time.tv_nsec = (now.tv_nsec
1850
- mc->current_server->last_seen.tv_nsec);
1851
/* total time is 10s/10,000ms.
1852
Converting to s from ms by dividing by 1,000,
1853
and ns to ms by dividing by 1,000,000. */
1854
block_time = ((retry_interval
1855
- ((intmax_t)waited_time.tv_sec * 1000))
1856
- ((intmax_t)waited_time.tv_nsec / 1000000));
1859
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1863
if(block_time <= 0){
1864
ret = start_mandos_communication(mc->current_server->ip,
1865
mc->current_server->port,
1866
mc->current_server->if_index,
1867
mc->current_server->af, mc);
1869
avahi_simple_poll_quit(s);
1872
ret = clock_gettime(CLOCK_MONOTONIC,
1873
&mc->current_server->last_seen);
1875
perror_plus("clock_gettime");
1878
mc->current_server = mc->current_server->next;
1879
block_time = 0; /* Call avahi to find new Mandos
1880
servers, but don't block */
1883
ret = avahi_simple_poll_iterate(s, (int)block_time);
1886
if(ret > 0 or errno != EINTR){
1887
return (ret != 1) ? ret : 0;
1893
__attribute__((nonnull))
1894
void run_network_hooks(const char *mode, const char *interface,
1896
struct dirent **direntries = NULL;
1897
if(hookdir_fd == -1){
1898
hookdir_fd = open(hookdir, O_RDONLY | O_DIRECTORY | O_PATH
1900
if(hookdir_fd == -1){
1901
if(errno == ENOENT){
1903
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1904
" found\n", hookdir);
1907
perror_plus("open");
1912
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1913
runnable_hook, alphasort);
1915
perror_plus("scandir");
1918
struct dirent *direntry;
1920
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
1922
perror_plus("open(\"/dev/null\", O_RDONLY)");
1925
for(int i = 0; i < numhooks; i++){
1926
direntry = direntries[i];
1928
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1931
pid_t hook_pid = fork();
1934
/* Raise privileges */
1935
errno = raise_privileges_permanently();
1937
perror_plus("Failed to raise privileges");
1944
perror_plus("setgid");
1947
/* Reset supplementary groups */
1949
ret = setgroups(0, NULL);
1951
perror_plus("setgroups");
1954
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1956
perror_plus("setenv");
1959
ret = setenv("DEVICE", interface, 1);
1961
perror_plus("setenv");
1964
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1966
perror_plus("setenv");
1969
ret = setenv("MODE", mode, 1);
1971
perror_plus("setenv");
1975
ret = asprintf(&delaystring, "%f", (double)delay);
1977
perror_plus("asprintf");
1980
ret = setenv("DELAY", delaystring, 1);
1983
perror_plus("setenv");
1987
if(connect_to != NULL){
1988
ret = setenv("CONNECT", connect_to, 1);
1990
perror_plus("setenv");
1994
int hook_fd = (int)TEMP_FAILURE_RETRY(openat(hookdir_fd,
1998
perror_plus("openat");
1999
_exit(EXIT_FAILURE);
2001
if(close(hookdir_fd) == -1){
2002
perror_plus("close");
2003
_exit(EXIT_FAILURE);
2005
ret = dup2(devnull, STDIN_FILENO);
2007
perror_plus("dup2(devnull, STDIN_FILENO)");
2010
ret = close(devnull);
2012
perror_plus("close");
2015
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
2017
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
2020
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
2022
perror_plus("fexecve");
2023
_exit(EXIT_FAILURE);
2027
perror_plus("fork");
2032
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
2033
perror_plus("waitpid");
2037
if(WIFEXITED(status)){
2038
if(WEXITSTATUS(status) != 0){
2039
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
2040
" with status %d\n", direntry->d_name,
2041
WEXITSTATUS(status));
2045
} else if(WIFSIGNALED(status)){
2046
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
2047
" signal %d\n", direntry->d_name,
2052
fprintf_plus(stderr, "Warning: network hook \"%s\""
2053
" crashed\n", direntry->d_name);
2059
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
2065
if(close(hookdir_fd) == -1){
2066
perror_plus("close");
2073
__attribute__((nonnull, warn_unused_result))
2074
error_t bring_up_interface(const char *const interface,
2076
error_t old_errno = errno;
2078
struct ifreq network;
2079
unsigned int if_index = if_nametoindex(interface);
2081
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
2091
if(not interface_is_up(interface)){
2092
error_t ret_errno = 0, ioctl_errno = 0;
2093
if(not get_flags(interface, &network)){
2095
fprintf_plus(stderr, "Failed to get flags for interface "
2096
"\"%s\"\n", interface);
2100
network.ifr_flags |= IFF_UP; /* set flag */
2102
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
2105
perror_plus("socket");
2113
perror_plus("close");
2120
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
2124
/* Raise privileges */
2125
ret_errno = raise_privileges();
2128
perror_plus("Failed to raise privileges");
2133
bool restore_loglevel = false;
2135
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
2136
messages about the network interface to mess up the prompt */
2137
ret_linux = klogctl(8, NULL, 5);
2138
if(ret_linux == -1){
2139
perror_plus("klogctl");
2141
restore_loglevel = true;
2144
#endif /* __linux__ */
2145
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
2146
ioctl_errno = errno;
2148
if(restore_loglevel){
2149
ret_linux = klogctl(7, NULL, 0);
2150
if(ret_linux == -1){
2151
perror_plus("klogctl");
2154
#endif /* __linux__ */
2156
/* If raise_privileges() succeeded above */
2158
/* Lower privileges */
2159
ret_errno = lower_privileges();
2162
perror_plus("Failed to lower privileges");
2166
/* Close the socket */
2169
perror_plus("close");
2172
if(ret_setflags == -1){
2173
errno = ioctl_errno;
2174
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
2179
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
2183
/* Sleep checking until interface is running.
2184
Check every 0.25s, up to total time of delay */
2185
for(int i=0; i < delay * 4; i++){
2186
if(interface_is_running(interface)){
2189
struct timespec sleeptime = { .tv_nsec = 250000000 };
2190
ret = nanosleep(&sleeptime, NULL);
2191
if(ret == -1 and errno != EINTR){
2192
perror_plus("nanosleep");
2200
__attribute__((nonnull, warn_unused_result))
2201
error_t take_down_interface(const char *const interface){
2202
error_t old_errno = errno;
2203
struct ifreq network;
2204
unsigned int if_index = if_nametoindex(interface);
2206
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
2210
if(interface_is_up(interface)){
2211
error_t ret_errno = 0, ioctl_errno = 0;
2212
if(not get_flags(interface, &network) and debug){
2214
fprintf_plus(stderr, "Failed to get flags for interface "
2215
"\"%s\"\n", interface);
2219
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2221
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
2224
perror_plus("socket");
2230
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
2234
/* Raise privileges */
2235
ret_errno = raise_privileges();
2238
perror_plus("Failed to raise privileges");
2241
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
2242
ioctl_errno = errno;
2244
/* If raise_privileges() succeeded above */
2246
/* Lower privileges */
2247
ret_errno = lower_privileges();
2250
perror_plus("Failed to lower privileges");
2254
/* Close the socket */
2255
int ret = close(sd);
2257
perror_plus("close");
2260
if(ret_setflags == -1){
2261
errno = ioctl_errno;
2262
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2267
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
2275
int main(int argc, char *argv[]){
2276
mandos_context mc = { .server = NULL, .dh_bits = 0,
2277
.priority = "SECURE256:!CTYPE-X.509"
2278
":+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256",
2279
.current_server = NULL, .interfaces = NULL,
2280
.interfaces_size = 0 };
2281
AvahiSServiceBrowser *sb = NULL;
2286
int exitcode = EXIT_SUCCESS;
2287
char *interfaces_to_take_down = NULL;
2288
size_t interfaces_to_take_down_size = 0;
2289
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
2290
char old_tempdir[] = "/tmp/mandosXXXXXX";
2291
char *tempdir = NULL;
2292
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
2293
const char *seckey = PATHDIR "/" SECKEY;
2294
const char *pubkey = PATHDIR "/" PUBKEY;
2295
const char *dh_params_file = NULL;
2296
char *interfaces_hooks = NULL;
2298
bool gnutls_initialized = false;
2299
bool gpgme_initialized = false;
2301
double retry_interval = 10; /* 10s between trying a server and
2302
retrying the same server again */
2304
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
2305
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
2310
/* Lower any group privileges we might have, just to be safe */
2314
perror_plus("setgid");
2317
/* Lower user privileges (temporarily) */
2321
perror_plus("seteuid");
2329
struct argp_option options[] = {
2330
{ .name = "debug", .key = 128,
2331
.doc = "Debug mode", .group = 3 },
2332
{ .name = "connect", .key = 'c',
2333
.arg = "ADDRESS:PORT",
2334
.doc = "Connect directly to a specific Mandos server",
2336
{ .name = "interface", .key = 'i',
2338
.doc = "Network interface that will be used to search for"
2341
{ .name = "seckey", .key = 's',
2343
.doc = "OpenPGP secret key file base name",
2345
{ .name = "pubkey", .key = 'p',
2347
.doc = "OpenPGP public key file base name",
2349
{ .name = "dh-bits", .key = 129,
2351
.doc = "Bit length of the prime number used in the"
2352
" Diffie-Hellman key exchange",
2354
{ .name = "dh-params", .key = 134,
2356
.doc = "PEM-encoded PKCS#3 file with pre-generated parameters"
2357
" for the Diffie-Hellman key exchange",
2359
{ .name = "priority", .key = 130,
2361
.doc = "GnuTLS priority string for the TLS handshake",
2363
{ .name = "delay", .key = 131,
2365
.doc = "Maximum delay to wait for interface startup",
2367
{ .name = "retry", .key = 132,
2369
.doc = "Retry interval used when denied by the Mandos server",
2371
{ .name = "network-hook-dir", .key = 133,
2373
.doc = "Directory where network hooks are located",
2376
* These reproduce what we would get without ARGP_NO_HELP
2378
{ .name = "help", .key = '?',
2379
.doc = "Give this help list", .group = -1 },
2380
{ .name = "usage", .key = -3,
2381
.doc = "Give a short usage message", .group = -1 },
2382
{ .name = "version", .key = 'V',
2383
.doc = "Print program version", .group = -1 },
2387
error_t parse_opt(int key, char *arg,
2388
struct argp_state *state){
2391
case 128: /* --debug */
2394
case 'c': /* --connect */
2397
case 'i': /* --interface */
2398
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
2401
argp_error(state, "%s", strerror(ret_errno));
2404
case 's': /* --seckey */
2407
case 'p': /* --pubkey */
2410
case 129: /* --dh-bits */
2412
tmpmax = strtoimax(arg, &tmp, 10);
2413
if(errno != 0 or tmp == arg or *tmp != '\0'
2414
or tmpmax != (typeof(mc.dh_bits))tmpmax){
2415
argp_error(state, "Bad number of DH bits");
2417
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
2419
case 134: /* --dh-params */
2420
dh_params_file = arg;
2422
case 130: /* --priority */
2425
case 131: /* --delay */
2427
delay = strtof(arg, &tmp);
2428
if(errno != 0 or tmp == arg or *tmp != '\0'){
2429
argp_error(state, "Bad delay");
2431
case 132: /* --retry */
2433
retry_interval = strtod(arg, &tmp);
2434
if(errno != 0 or tmp == arg or *tmp != '\0'
2435
or (retry_interval * 1000) > INT_MAX
2436
or retry_interval < 0){
2437
argp_error(state, "Bad retry interval");
2440
case 133: /* --network-hook-dir */
2444
* These reproduce what we would get without ARGP_NO_HELP
2446
case '?': /* --help */
2447
argp_state_help(state, state->out_stream,
2448
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
2449
& ~(unsigned int)ARGP_HELP_EXIT_OK);
2450
case -3: /* --usage */
2451
argp_state_help(state, state->out_stream,
2452
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
2453
case 'V': /* --version */
2454
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
2455
exit(argp_err_exit_status);
2458
return ARGP_ERR_UNKNOWN;
2463
struct argp argp = { .options = options, .parser = parse_opt,
2465
.doc = "Mandos client -- Get and decrypt"
2466
" passwords from a Mandos server" };
2467
ret = argp_parse(&argp, argc, argv,
2468
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
2475
perror_plus("argp_parse");
2476
exitcode = EX_OSERR;
2479
exitcode = EX_USAGE;
2485
/* Work around Debian bug #633582:
2486
<http://bugs.debian.org/633582> */
2488
/* Re-raise privileges */
2489
ret_errno = raise_privileges();
2492
perror_plus("Failed to raise privileges");
2496
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2497
int seckey_fd = open(seckey, O_RDONLY);
2498
if(seckey_fd == -1){
2499
perror_plus("open");
2501
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
2503
perror_plus("fstat");
2505
if(S_ISREG(st.st_mode)
2506
and st.st_uid == 0 and st.st_gid == 0){
2507
ret = fchown(seckey_fd, uid, gid);
2509
perror_plus("fchown");
2517
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
2518
int pubkey_fd = open(pubkey, O_RDONLY);
2519
if(pubkey_fd == -1){
2520
perror_plus("open");
2522
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
2524
perror_plus("fstat");
2526
if(S_ISREG(st.st_mode)
2527
and st.st_uid == 0 and st.st_gid == 0){
2528
ret = fchown(pubkey_fd, uid, gid);
2530
perror_plus("fchown");
2538
if(dh_params_file != NULL
2539
and strcmp(dh_params_file, PATHDIR "/dhparams.pem" ) == 0){
2540
int dhparams_fd = open(dh_params_file, O_RDONLY);
2541
if(dhparams_fd == -1){
2542
perror_plus("open");
2544
ret = (int)TEMP_FAILURE_RETRY(fstat(dhparams_fd, &st));
2546
perror_plus("fstat");
2548
if(S_ISREG(st.st_mode)
2549
and st.st_uid == 0 and st.st_gid == 0){
2550
ret = fchown(dhparams_fd, uid, gid);
2552
perror_plus("fchown");
2560
/* Lower privileges */
2561
ret_errno = lower_privileges();
2564
perror_plus("Failed to lower privileges");
2569
/* Remove invalid interface names (except "none") */
2571
char *interface = NULL;
2572
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2574
if(strcmp(interface, "none") != 0
2575
and if_nametoindex(interface) == 0){
2576
if(interface[0] != '\0'){
2577
fprintf_plus(stderr, "Not using nonexisting interface"
2578
" \"%s\"\n", interface);
2580
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2586
/* Run network hooks */
2588
if(mc.interfaces != NULL){
2589
interfaces_hooks = malloc(mc.interfaces_size);
2590
if(interfaces_hooks == NULL){
2591
perror_plus("malloc");
2594
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2595
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2597
run_network_hooks("start", interfaces_hooks != NULL ?
2598
interfaces_hooks : "", delay);
2602
avahi_set_log_function(empty_log);
2605
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
2606
from the signal handler */
2607
/* Initialize the pseudo-RNG for Avahi */
2608
srand((unsigned int) time(NULL));
2609
simple_poll = avahi_simple_poll_new();
2610
if(simple_poll == NULL){
2611
fprintf_plus(stderr,
2612
"Avahi: Failed to create simple poll object.\n");
2613
exitcode = EX_UNAVAILABLE;
2617
sigemptyset(&sigterm_action.sa_mask);
2618
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
2620
perror_plus("sigaddset");
2621
exitcode = EX_OSERR;
2624
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
2626
perror_plus("sigaddset");
2627
exitcode = EX_OSERR;
2630
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
2632
perror_plus("sigaddset");
2633
exitcode = EX_OSERR;
2636
/* Need to check if the handler is SIG_IGN before handling:
2637
| [[info:libc:Initial Signal Actions]] |
2638
| [[info:libc:Basic Signal Handling]] |
2640
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
2642
perror_plus("sigaction");
2645
if(old_sigterm_action.sa_handler != SIG_IGN){
2646
ret = sigaction(SIGINT, &sigterm_action, NULL);
2648
perror_plus("sigaction");
2649
exitcode = EX_OSERR;
2653
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
2655
perror_plus("sigaction");
2658
if(old_sigterm_action.sa_handler != SIG_IGN){
2659
ret = sigaction(SIGHUP, &sigterm_action, NULL);
2661
perror_plus("sigaction");
2662
exitcode = EX_OSERR;
2666
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
2668
perror_plus("sigaction");
2671
if(old_sigterm_action.sa_handler != SIG_IGN){
2672
ret = sigaction(SIGTERM, &sigterm_action, NULL);
2674
perror_plus("sigaction");
2675
exitcode = EX_OSERR;
2680
/* If no interfaces were specified, make a list */
2681
if(mc.interfaces == NULL){
2682
struct dirent **direntries = NULL;
2683
/* Look for any good interfaces */
2684
ret = scandir(sys_class_net, &direntries, good_interface,
2687
/* Add all found interfaces to interfaces list */
2688
for(int i = 0; i < ret; ++i){
2689
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2690
direntries[i]->d_name);
2693
perror_plus("argz_add");
2694
free(direntries[i]);
2698
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2699
direntries[i]->d_name);
2701
free(direntries[i]);
2708
fprintf_plus(stderr, "Could not find a network interface\n");
2709
exitcode = EXIT_FAILURE;
2714
/* Bring up interfaces which are down, and remove any "none"s */
2716
char *interface = NULL;
2717
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2719
/* If interface name is "none", stop bringing up interfaces.
2720
Also remove all instances of "none" from the list */
2721
if(strcmp(interface, "none") == 0){
2722
argz_delete(&mc.interfaces, &mc.interfaces_size,
2725
while((interface = argz_next(mc.interfaces,
2726
mc.interfaces_size, interface))){
2727
if(strcmp(interface, "none") == 0){
2728
argz_delete(&mc.interfaces, &mc.interfaces_size,
2735
bool interface_was_up = interface_is_up(interface);
2736
errno = bring_up_interface(interface, delay);
2737
if(not interface_was_up){
2739
fprintf_plus(stderr, "Failed to bring up interface \"%s\":"
2740
" %s\n", interface, strerror(errno));
2742
errno = argz_add(&interfaces_to_take_down,
2743
&interfaces_to_take_down_size,
2746
perror_plus("argz_add");
2751
if(debug and (interfaces_to_take_down == NULL)){
2752
fprintf_plus(stderr, "No interfaces were brought up\n");
2756
/* If we only got one interface, explicitly use only that one */
2757
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2759
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2762
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2769
ret = init_gnutls_global(pubkey, seckey, dh_params_file, &mc);
2771
fprintf_plus(stderr, "init_gnutls_global failed\n");
2772
exitcode = EX_UNAVAILABLE;
2775
gnutls_initialized = true;
2782
/* Try /run/tmp before /tmp */
2783
tempdir = mkdtemp(run_tempdir);
2784
if(tempdir == NULL and errno == ENOENT){
2786
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2787
run_tempdir, old_tempdir);
2789
tempdir = mkdtemp(old_tempdir);
2791
if(tempdir == NULL){
2792
perror_plus("mkdtemp");
2800
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2801
fprintf_plus(stderr, "init_gpgme failed\n");
2802
exitcode = EX_UNAVAILABLE;
2805
gpgme_initialized = true;
2812
if(connect_to != NULL){
2813
/* Connect directly, do not use Zeroconf */
2814
/* (Mainly meant for debugging) */
2815
char *address = strrchr(connect_to, ':');
2817
if(address == NULL){
2818
fprintf_plus(stderr, "No colon in address\n");
2819
exitcode = EX_USAGE;
2829
tmpmax = strtoimax(address+1, &tmp, 10);
2830
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2831
or tmpmax != (in_port_t)tmpmax){
2832
fprintf_plus(stderr, "Bad port number\n");
2833
exitcode = EX_USAGE;
2841
port = (in_port_t)tmpmax;
2843
/* Colon in address indicates IPv6 */
2845
if(strchr(connect_to, ':') != NULL){
2847
/* Accept [] around IPv6 address - see RFC 5952 */
2848
if(connect_to[0] == '[' and address[-1] == ']')
2856
address = connect_to;
2862
while(not quit_now){
2863
ret = start_mandos_communication(address, port, if_index, af,
2865
if(quit_now or ret == 0){
2869
fprintf_plus(stderr, "Retrying in %d seconds\n",
2870
(int)retry_interval);
2872
sleep((unsigned int)retry_interval);
2876
exitcode = EXIT_SUCCESS;
509
static void browse_callback(
510
AvahiSServiceBrowser *b,
511
AvahiIfIndex interface,
512
AvahiProtocol protocol,
513
AvahiBrowserEvent event,
517
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
520
AvahiServer *s = userdata;
523
/* Called whenever a new services becomes available on the LAN or is removed from the LAN */
527
case AVAHI_BROWSER_FAILURE:
529
fprintf(stderr, "(Browser) %s\n", avahi_strerror(avahi_server_errno(server)));
530
avahi_simple_poll_quit(simple_poll);
533
case AVAHI_BROWSER_NEW:
534
/* We ignore the returned resolver object. In the callback
535
function we free it. If the server is terminated before
536
the callback function is called the server will free
537
the resolver for us. */
539
if (!(avahi_s_service_resolver_new(s, interface, protocol, name, type, domain, AVAHI_PROTO_INET6, 0, resolve_callback, s)))
540
fprintf(stderr, "Failed to resolve service '%s': %s\n", name, avahi_strerror(avahi_server_errno(s)));
544
case AVAHI_BROWSER_REMOVE:
547
case AVAHI_BROWSER_ALL_FOR_NOW:
548
case AVAHI_BROWSER_CACHE_EXHAUSTED:
553
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
2887
554
AvahiServerConfig config;
2888
/* Do not publish any local Zeroconf records */
555
AvahiSServiceBrowser *sb = NULL;
556
const char db[] = "--debug";
559
int returncode = EXIT_SUCCESS;
560
char *basename = rindex(argv[0], '/');
561
if(basename == NULL){
567
char *program_name = malloc(strlen(basename) + sizeof(db));
569
if (program_name == NULL){
574
program_name[0] = '\0';
576
for (int i = 1; i < argc; i++){
577
if (not strncmp(argv[i], db, 5)){
578
strcat(strcat(strcat(program_name, db ), "="), basename);
579
if(not strcmp(argv[i], db) or not strcmp(argv[i], program_name)){
587
avahi_set_log_function(empty_log);
590
/* Initialize the psuedo-RNG */
593
/* Allocate main loop object */
594
if (!(simple_poll = avahi_simple_poll_new())) {
595
fprintf(stderr, "Failed to create simple poll object.\n");
600
/* Do not publish any local records */
2889
601
avahi_server_config_init(&config);
2890
602
config.publish_hinfo = 0;
2891
603
config.publish_addresses = 0;
2892
604
config.publish_workstation = 0;
2893
605
config.publish_domain = 0;
2895
607
/* Allocate a new server */
2896
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2897
&config, NULL, NULL, &ret_errno);
2899
/* Free the Avahi configuration data */
608
server = avahi_server_new(avahi_simple_poll_get(simple_poll), &config, NULL, NULL, &error);
610
/* Free the configuration data */
2900
611
avahi_server_config_free(&config);
2903
/* Check if creating the Avahi server object succeeded */
2904
if(mc.server == NULL){
2905
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2906
avahi_strerror(ret_errno));
2907
exitcode = EX_UNAVAILABLE;
2915
/* Create the Avahi service browser */
2916
sb = avahi_s_service_browser_new(mc.server, if_index,
2917
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2918
NULL, 0, browse_callback,
2921
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2922
avahi_strerror(avahi_server_errno(mc.server)));
2923
exitcode = EX_UNAVAILABLE;
2931
/* Run the main loop */
2934
fprintf_plus(stderr, "Starting Avahi loop search\n");
2937
ret = avahi_loop_with_timeout(simple_poll,
2938
(int)(retry_interval * 1000), &mc);
2940
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2941
(ret == 0) ? "successfully" : "with error");
2947
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2950
/* Cleanup things */
2951
free(mc.interfaces);
2954
avahi_s_service_browser_free(sb);
2956
if(mc.server != NULL)
2957
avahi_server_free(mc.server);
2959
if(simple_poll != NULL)
2960
avahi_simple_poll_free(simple_poll);
2962
if(gnutls_initialized){
2963
gnutls_certificate_free_credentials(mc.cred);
2964
gnutls_dh_params_deinit(mc.dh_params);
2967
if(gpgme_initialized){
2968
gpgme_release(mc.ctx);
2971
/* Cleans up the circular linked list of Mandos servers the client
2973
if(mc.current_server != NULL){
2974
mc.current_server->prev->next = NULL;
2975
while(mc.current_server != NULL){
2976
server *next = mc.current_server->next;
2978
#pragma GCC diagnostic push
2979
#pragma GCC diagnostic ignored "-Wcast-qual"
2981
free((char *)(mc.current_server->ip));
2983
#pragma GCC diagnostic pop
2985
free(mc.current_server);
2986
mc.current_server = next;
2990
/* Re-raise privileges */
2992
ret_errno = raise_privileges();
2995
perror_plus("Failed to raise privileges");
2998
/* Run network hooks */
2999
run_network_hooks("stop", interfaces_hooks != NULL ?
3000
interfaces_hooks : "", delay);
3002
/* Take down the network interfaces which were brought up */
3004
char *interface = NULL;
3005
while((interface=argz_next(interfaces_to_take_down,
3006
interfaces_to_take_down_size,
3008
ret_errno = take_down_interface(interface);
3011
perror_plus("Failed to take down interface");
3014
if(debug and (interfaces_to_take_down == NULL)){
3015
fprintf_plus(stderr, "No interfaces needed to be taken"
3021
ret_errno = lower_privileges_permanently();
3024
perror_plus("Failed to lower privileges permanently");
3028
free(interfaces_to_take_down);
3029
free(interfaces_hooks);
3031
void clean_dir_at(int base, const char * const dirname,
3033
struct dirent **direntries = NULL;
3035
int dir_fd = (int)TEMP_FAILURE_RETRY(openat(base, dirname,
3041
perror_plus("open");
3043
int numentries = scandirat(dir_fd, ".", &direntries,
3044
notdotentries, alphasort);
3045
if(numentries >= 0){
3046
for(int i = 0; i < numentries; i++){
3048
fprintf_plus(stderr, "Unlinking \"%s/%s\"\n",
3049
dirname, direntries[i]->d_name);
3051
dret = unlinkat(dir_fd, direntries[i]->d_name, 0);
3053
if(errno == EISDIR){
3054
dret = unlinkat(dir_fd, direntries[i]->d_name,
3057
if((dret == -1) and (errno == ENOTEMPTY)
3058
and (strcmp(direntries[i]->d_name, "private-keys-v1.d")
3059
== 0) and (level == 0)){
3060
/* Recurse only in this special case */
3061
clean_dir_at(dir_fd, direntries[i]->d_name, level+1);
3065
fprintf_plus(stderr, "unlink(\"%s/%s\"): %s\n", dirname,
3066
direntries[i]->d_name, strerror(errno));
3069
free(direntries[i]);
3072
/* need to clean even if 0 because man page doesn't specify */
3074
if(numentries == -1){
3075
perror_plus("scandirat");
3077
dret = unlinkat(base, dirname, AT_REMOVEDIR);
3078
if(dret == -1 and errno != ENOENT){
3079
perror_plus("rmdir");
3082
perror_plus("scandirat");
3087
/* Removes the GPGME temp directory and all files inside */
3088
if(tempdir != NULL){
3089
clean_dir_at(-1, tempdir, 0);
3093
sigemptyset(&old_sigterm_action.sa_mask);
3094
old_sigterm_action.sa_handler = SIG_DFL;
3095
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
3096
&old_sigterm_action,
3099
perror_plus("sigaction");
3102
ret = raise(signal_received);
3103
} while(ret != 0 and errno == EINTR);
3105
perror_plus("raise");
3108
TEMP_FAILURE_RETRY(pause());
613
/* Check if creating the server object succeeded */
615
fprintf(stderr, "Failed to create server: %s\n", avahi_strerror(error));
616
returncode = EXIT_FAILURE;
620
/* Create the service browser */
621
if (!(sb = avahi_s_service_browser_new(server, if_nametoindex("eth0"), AVAHI_PROTO_INET6, "_mandos._tcp", NULL, 0, browse_callback, server))) {
622
fprintf(stderr, "Failed to create service browser: %s\n", avahi_strerror(avahi_server_errno(server)));
623
returncode = EXIT_FAILURE;
627
/* Run the main loop */
630
fprintf(stderr, "Starting avahi loop search\n");
633
avahi_simple_poll_loop(simple_poll);
638
fprintf(stderr, "%s exiting\n", argv[0]);
643
avahi_s_service_browser_free(sb);
646
avahi_server_free(server);
649
avahi_simple_poll_free(simple_poll);