To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 19
- compare with another revision
- download diff
- download tarball
- view history from revision 19
- Committer: Teddy Hogeborn
- Date: 2008-07-21 02:35:05 UTC
- Revision ID: teddy@fukt.bsnet.se-20080721023505-x7pjntkgur2h5jkg
* plugins.d/mandosclient.c (start_mandos_communcation): Renamed to
"start_mandos_communication"
"start_mandos_communication"
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- network-hooks.d
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
1
/* -*- coding: utf-8 -*- */
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
4
*
5
* This program is partly derived from an example program for an Avahi
6
* service browser, downloaded from
7
* <http://avahi.org/browser/examples/core-browse-services.c>. This
8
* includes the following functions: "resolve_callback",
9
* "browse_callback", and parts of "main".
10
*
11
* Everything else is
12
* Copyright © 2008-2013 Teddy Hogeborn
13
* Copyright © 2008-2013 Björn Påhlsson
14
*
15
* This program is free software: you can redistribute it and/or
16
* modify it under the terms of the GNU General Public License as
17
* published by the Free Software Foundation, either version 3 of the
18
* License, or (at your option) any later version.
19
*
20
* This program is distributed in the hope that it will be useful, but
21
* WITHOUT ANY WARRANTY; without even the implied warranty of
22
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
23
* General Public License for more details.
24
*
25
* You should have received a copy of the GNU General Public License
26
* along with this program. If not, see
27
* <http://www.gnu.org/licenses/>.
28
*
29
* Contact the authors at <mandos@recompile.se>.
30
*/
1
/***
2
This file is part of avahi.
3
4
avahi is free software; you can redistribute it and/or modify it
5
under the terms of the GNU Lesser General Public License as
6
published by the Free Software Foundation; either version 2.1 of the
7
License, or (at your option) any later version.
8
9
avahi is distributed in the hope that it will be useful, but WITHOUT
10
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
11
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
12
Public License for more details.
13
14
You should have received a copy of the GNU Lesser General Public
15
License along with avahi; if not, write to the Free Software
16
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
17
USA.
18
***/
31
19
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
20
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
21
#define _FILE_OFFSET_BITS 64
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open(), S_ISREG */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect(),
59
getnameinfo() */
60
#include <fcntl.h> /* open() */
61
#include <dirent.h> /* opendir(), struct dirent, readdir()
62
*/
63
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
64
strtoimax() */
65
#include <errno.h> /* perror(), errno,
66
program_invocation_short_name */
67
#include <time.h> /* nanosleep(), time(), sleep() */
68
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
69
SIOCSIFFLAGS, if_indextoname(),
70
if_nametoindex(), IF_NAMESIZE */
71
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
72
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
73
*/
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
75
getuid(), getgid(), seteuid(),
76
setgid(), pause(), _exit() */
77
#include <arpa/inet.h> /* inet_pton(), htons() */
78
#include <iso646.h> /* not, or, and */
79
#include <argp.h> /* struct argp_option, error_t, struct
80
argp_state, struct argp,
81
argp_parse(), ARGP_KEY_ARG,
82
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
83
#include <signal.h> /* sigemptyset(), sigaddset(),
84
sigaction(), SIGTERM, sig_atomic_t,
85
raise() */
86
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
87
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
89
WEXITSTATUS(), WTERMSIG() */
90
#include <grp.h> /* setgroups() */
91
#include <argz.h> /* argz_add_sep(), argz_next(),
92
argz_delete(), argz_append(),
93
argz_stringify(), argz_add(),
94
argz_count() */
95
#include <netdb.h> /* getnameinfo(), NI_NUMERICHOST,
96
EAI_SYSTEM, gai_strerror() */
97
98
#ifdef __linux__
99
#include <sys/klog.h> /* klogctl() */
100
#endif /* __linux__ */
101
102
/* Avahi */
103
/* All Avahi types, constants and functions
104
Avahi*, avahi_*,
105
AVAHI_* */
22
23
#include <stdio.h>
24
#include <assert.h>
25
#include <stdlib.h>
26
#include <time.h>
27
#include <net/if.h> /* if_nametoindex */
28
106
29
#include <avahi-core/core.h>
107
30
#include <avahi-core/lookup.h>
108
31
#include <avahi-core/log.h>
110
33
#include <avahi-common/malloc.h>
111
34
#include <avahi-common/error.h>
112
35
113
/* GnuTLS */
114
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
115
functions:
116
gnutls_*
117
init_gnutls_session(),
118
GNUTLS_* */
119
#include <gnutls/openpgp.h>
120
/* gnutls_certificate_set_openpgp_key_file(),
121
GNUTLS_OPENPGP_FMT_BASE64 */
122
123
/* GPGME */
124
#include <gpgme.h> /* All GPGME types, constants and
125
functions:
126
gpgme_*
127
GPGME_PROTOCOL_OpenPGP,
128
GPG_ERR_NO_* */
129
36
//mandos client part
37
#include <sys/types.h> /* socket(), setsockopt(), inet_pton() */
38
#include <sys/socket.h> /* socket(), setsockopt(), struct sockaddr_in6, struct in6_addr, inet_pton() */
39
#include <gnutls/gnutls.h> /* ALL GNUTLS STUFF */
40
#include <gnutls/openpgp.h> /* gnutls with openpgp stuff */
41
42
#include <unistd.h> /* close() */
43
#include <netinet/in.h>
44
#include <stdbool.h> /* true */
45
#include <string.h> /* memset */
46
#include <arpa/inet.h> /* inet_pton() */
47
#include <iso646.h> /* not */
48
49
// gpgme
50
#include <errno.h> /* perror() */
51
#include <gpgme.h>
52
53
54
#ifndef CERT_ROOT
55
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
56
#endif
57
#define CERTFILE CERT_ROOT "openpgp-client.txt"
58
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
130
59
#define BUFFER_SIZE 256
131
132
#define PATHDIR "/conf/conf.d/mandos"
133
#define SECKEY "seckey.txt"
134
#define PUBKEY "pubkey.txt"
135
#define HOOKDIR "/lib/mandos/network-hooks.d"
60
#define DH_BITS 1024
136
61
137
62
bool debug = false;
138
static const char mandos_protocol_version[] = "1";
139
const char *argp_program_version = "mandos-client " VERSION;
140
const char *argp_program_bug_address = "<mandos@recompile.se>";
141
static const char sys_class_net[] = "/sys/class/net";
142
char *connect_to = NULL;
143
const char *hookdir = HOOKDIR;
144
uid_t uid = 65534;
145
gid_t gid = 65534;
146
147
/* Doubly linked list that need to be circularly linked when used */
148
typedef struct server{
149
const char *ip;
150
in_port_t port;
151
AvahiIfIndex if_index;
152
int af;
153
struct timespec last_seen;
154
struct server *next;
155
struct server *prev;
156
} server;
157
158
/* Used for passing in values through the Avahi callback functions */
63
159
64
typedef struct {
160
AvahiServer *server;
65
gnutls_session_t session;
161
66
gnutls_certificate_credentials_t cred;
162
unsigned int dh_bits;
163
67
gnutls_dh_params_t dh_params;
164
const char *priority;
68
} encrypted_session;
69
70
71
ssize_t gpg_packet_decrypt (char *packet, size_t packet_size, char **new_packet, char *homedir){
72
gpgme_data_t dh_crypto, dh_plain;
165
73
gpgme_ctx_t ctx;
166
server *current_server;
167
char *interfaces;
168
size_t interfaces_size;
169
} mandos_context;
170
171
/* global so signal handler can reach it*/
172
AvahiSimplePoll *simple_poll;
173
174
sig_atomic_t quit_now = 0;
175
int signal_received = 0;
176
177
/* Function to use when printing errors */
178
void perror_plus(const char *print_text){
179
int e = errno;
180
fprintf(stderr, "Mandos plugin %s: ",
181
program_invocation_short_name);
182
errno = e;
183
perror(print_text);
184
}
185
186
__attribute__((format (gnu_printf, 2, 3)))
187
int fprintf_plus(FILE *stream, const char *format, ...){
188
va_list ap;
189
va_start (ap, format);
190
191
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
192
program_invocation_short_name));
193
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
194
}
195
196
/*
197
* Make additional room in "buffer" for at least BUFFER_SIZE more
198
* bytes. "buffer_capacity" is how much is currently allocated,
199
* "buffer_length" is how much is already used.
200
*/
201
size_t incbuffer(char **buffer, size_t buffer_length,
202
size_t buffer_capacity){
203
if(buffer_length + BUFFER_SIZE > buffer_capacity){
204
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
205
if(new_buf == NULL){
206
int old_errno = errno;
207
free(*buffer);
208
errno = old_errno;
209
*buffer = NULL;
210
return 0;
211
}
212
*buffer = new_buf;
213
buffer_capacity += BUFFER_SIZE;
214
}
215
return buffer_capacity;
216
}
217
218
/* Add server to set of servers to retry periodically */
219
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
220
int af, server **current_server){
221
int ret;
222
server *new_server = malloc(sizeof(server));
223
if(new_server == NULL){
224
perror_plus("malloc");
225
return false;
226
}
227
*new_server = (server){ .ip = strdup(ip),
228
.port = port,
229
.if_index = if_index,
230
.af = af };
231
if(new_server->ip == NULL){
232
perror_plus("strdup");
233
return false;
234
}
235
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
236
if(ret == -1){
237
perror_plus("clock_gettime");
238
return false;
239
}
240
/* Special case of first server */
241
if(*current_server == NULL){
242
new_server->next = new_server;
243
new_server->prev = new_server;
244
*current_server = new_server;
245
/* Place the new server last in the list */
246
} else {
247
new_server->next = *current_server;
248
new_server->prev = (*current_server)->prev;
249
new_server->prev->next = new_server;
250
(*current_server)->prev = new_server;
251
}
252
return true;
253
}
254
255
/*
256
* Initialize GPGME.
257
*/
258
static bool init_gpgme(const char *seckey, const char *pubkey,
259
const char *tempdir, mandos_context *mc){
260
74
gpgme_error_t rc;
75
ssize_t ret;
76
size_t new_packet_capacity = 0;
77
size_t new_packet_length = 0;
261
78
gpgme_engine_info_t engine_info;
262
263
/*
264
* Helper function to insert pub and seckey to the engine keyring.
265
*/
266
bool import_key(const char *filename){
267
int ret;
268
int fd;
269
gpgme_data_t pgp_data;
270
271
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
272
if(fd == -1){
273
perror_plus("open");
274
return false;
275
}
276
277
rc = gpgme_data_new_from_fd(&pgp_data, fd);
278
if(rc != GPG_ERR_NO_ERROR){
279
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
280
gpgme_strsource(rc), gpgme_strerror(rc));
281
return false;
282
}
283
284
rc = gpgme_op_import(mc->ctx, pgp_data);
285
if(rc != GPG_ERR_NO_ERROR){
286
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
287
gpgme_strsource(rc), gpgme_strerror(rc));
288
return false;
289
}
290
291
ret = (int)TEMP_FAILURE_RETRY(close(fd));
292
if(ret == -1){
293
perror_plus("close");
294
}
295
gpgme_data_release(pgp_data);
296
return true;
297
}
298
299
if(debug){
300
fprintf_plus(stderr, "Initializing GPGME\n");
79
80
if (debug){
81
fprintf(stderr, "Attempting to decrypt password from gpg packet\n");
301
82
}
302
83
303
84
/* Init GPGME */
304
85
gpgme_check_version(NULL);
305
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
306
if(rc != GPG_ERR_NO_ERROR){
307
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
308
gpgme_strsource(rc), gpgme_strerror(rc));
309
return false;
310
}
86
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
311
87
312
/* Set GPGME home directory for the OpenPGP engine only */
313
rc = gpgme_get_engine_info(&engine_info);
314
if(rc != GPG_ERR_NO_ERROR){
315
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
316
gpgme_strsource(rc), gpgme_strerror(rc));
317
return false;
88
/* Set GPGME home directory */
89
rc = gpgme_get_engine_info (&engine_info);
90
if (rc != GPG_ERR_NO_ERROR){
91
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
92
gpgme_strsource(rc), gpgme_strerror(rc));
93
return -1;
318
94
}
319
95
while(engine_info != NULL){
320
96
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
321
97
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
322
engine_info->file_name, tempdir);
98
engine_info->file_name, homedir);
323
99
break;
324
100
}
325
101
engine_info = engine_info->next;
326
102
}
327
103
if(engine_info == NULL){
328
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
329
tempdir);
330
return false;
331
}
332
333
/* Create new GPGME "context" */
334
rc = gpgme_new(&(mc->ctx));
335
if(rc != GPG_ERR_NO_ERROR){
336
fprintf_plus(stderr, "Mandos plugin mandos-client: "
337
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
338
gpgme_strerror(rc));
339
return false;
340
}
341
342
if(not import_key(pubkey) or not import_key(seckey)){
343
return false;
344
}
345
346
return true;
347
}
348
349
/*
350
* Decrypt OpenPGP data.
351
* Returns -1 on error
352
*/
353
static ssize_t pgp_packet_decrypt(const char *cryptotext,
354
size_t crypto_size,
355
char **plaintext,
356
mandos_context *mc){
357
gpgme_data_t dh_crypto, dh_plain;
358
gpgme_error_t rc;
359
ssize_t ret;
360
size_t plaintext_capacity = 0;
361
ssize_t plaintext_length = 0;
362
363
if(debug){
364
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
365
}
366
367
/* Create new GPGME data buffer from memory cryptotext */
368
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
369
0);
370
if(rc != GPG_ERR_NO_ERROR){
371
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
372
gpgme_strsource(rc), gpgme_strerror(rc));
104
fprintf(stderr, "Could not set home dir to %s\n", homedir);
105
return -1;
106
}
107
108
/* Create new GPGME data buffer from packet buffer */
109
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
110
if (rc != GPG_ERR_NO_ERROR){
111
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
112
gpgme_strsource(rc), gpgme_strerror(rc));
373
113
return -1;
374
114
}
375
115
376
116
/* Create new empty GPGME data buffer for the plaintext */
377
117
rc = gpgme_data_new(&dh_plain);
378
if(rc != GPG_ERR_NO_ERROR){
379
fprintf_plus(stderr, "Mandos plugin mandos-client: "
380
"bad gpgme_data_new: %s: %s\n",
381
gpgme_strsource(rc), gpgme_strerror(rc));
382
gpgme_data_release(dh_crypto);
383
return -1;
384
}
385
386
/* Decrypt data from the cryptotext data buffer to the plaintext
387
data buffer */
388
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
389
if(rc != GPG_ERR_NO_ERROR){
390
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
391
gpgme_strsource(rc), gpgme_strerror(rc));
392
plaintext_length = -1;
393
if(debug){
394
gpgme_decrypt_result_t result;
395
result = gpgme_op_decrypt_result(mc->ctx);
396
if(result == NULL){
397
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
398
} else {
399
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
400
result->unsupported_algorithm);
401
fprintf_plus(stderr, "Wrong key usage: %u\n",
402
result->wrong_key_usage);
403
if(result->file_name != NULL){
404
fprintf_plus(stderr, "File name: %s\n", result->file_name);
405
}
406
gpgme_recipient_t recipient;
407
recipient = result->recipients;
118
if (rc != GPG_ERR_NO_ERROR){
119
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
120
gpgme_strsource(rc), gpgme_strerror(rc));
121
return -1;
122
}
123
124
/* Create new GPGME "context" */
125
rc = gpgme_new(&ctx);
126
if (rc != GPG_ERR_NO_ERROR){
127
fprintf(stderr, "bad gpgme_new: %s: %s\n",
128
gpgme_strsource(rc), gpgme_strerror(rc));
129
return -1;
130
}
131
132
/* Decrypt data from the FILE pointer to the plaintext data buffer */
133
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
134
if (rc != GPG_ERR_NO_ERROR){
135
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
136
gpgme_strsource(rc), gpgme_strerror(rc));
137
return -1;
138
}
139
140
if(debug){
141
fprintf(stderr, "decryption of gpg packet succeeded\n");
142
}
143
144
if (debug){
145
gpgme_decrypt_result_t result;
146
result = gpgme_op_decrypt_result(ctx);
147
if (result == NULL){
148
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
149
} else {
150
fprintf(stderr, "Unsupported algorithm: %s\n", result->unsupported_algorithm);
151
fprintf(stderr, "Wrong key usage: %d\n", result->wrong_key_usage);
152
if(result->file_name != NULL){
153
fprintf(stderr, "File name: %s\n", result->file_name);
154
}
155
gpgme_recipient_t recipient;
156
recipient = result->recipients;
157
if(recipient){
408
158
while(recipient != NULL){
409
fprintf_plus(stderr, "Public key algorithm: %s\n",
410
gpgme_pubkey_algo_name
411
(recipient->pubkey_algo));
412
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
413
fprintf_plus(stderr, "Secret key available: %s\n",
414
recipient->status == GPG_ERR_NO_SECKEY
415
? "No" : "Yes");
159
fprintf(stderr, "Public key algorithm: %s\n",
160
gpgme_pubkey_algo_name(recipient->pubkey_algo));
161
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
162
fprintf(stderr, "Secret key available: %s\n",
163
recipient->status == GPG_ERR_NO_SECKEY ? "No" : "Yes");
416
164
recipient = recipient->next;
417
165
}
418
166
}
419
167
}
420
goto decrypt_end;
421
168
}
422
169
423
if(debug){
424
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
425
}
170
/* Delete the GPGME FILE pointer cryptotext data buffer */
171
gpgme_data_release(dh_crypto);
426
172
427
173
/* Seek back to the beginning of the GPGME plaintext data buffer */
428
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
429
perror_plus("gpgme_data_seek");
430
plaintext_length = -1;
431
goto decrypt_end;
432
}
433
434
*plaintext = NULL;
174
gpgme_data_seek(dh_plain, 0, SEEK_SET);
175
176
*new_packet = 0;
435
177
while(true){
436
plaintext_capacity = incbuffer(plaintext,
437
(size_t)plaintext_length,
438
plaintext_capacity);
439
if(plaintext_capacity == 0){
440
perror_plus("incbuffer");
441
plaintext_length = -1;
442
goto decrypt_end;
178
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
179
*new_packet = realloc(*new_packet, new_packet_capacity + BUFFER_SIZE);
180
if (*new_packet == NULL){
181
perror("realloc");
182
return -1;
183
}
184
new_packet_capacity += BUFFER_SIZE;
443
185
}
444
186
445
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
446
BUFFER_SIZE);
187
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length, BUFFER_SIZE);
447
188
/* Print the data, if any */
448
if(ret == 0){
449
/* EOF */
189
if (ret == 0){
190
/* If password is empty, then a incorrect error will be printed */
450
191
break;
451
192
}
452
193
if(ret < 0){
453
perror_plus("gpgme_data_read");
454
plaintext_length = -1;
455
goto decrypt_end;
194
perror("gpgme_data_read");
195
return -1;
456
196
}
457
plaintext_length += ret;
197
new_packet_length += ret;
458
198
}
459
199
460
200
if(debug){
461
fprintf_plus(stderr, "Decrypted password is: ");
462
for(ssize_t i = 0; i < plaintext_length; i++){
463
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
464
}
465
fprintf(stderr, "\n");
201
fprintf(stderr, "decrypted password is: %s\n", *new_packet);
466
202
}
467
468
decrypt_end:
469
470
/* Delete the GPGME cryptotext data buffer */
471
gpgme_data_release(dh_crypto);
472
473
/* Delete the GPGME plaintext data buffer */
203
204
/* Delete the GPGME plaintext data buffer */
474
205
gpgme_data_release(dh_plain);
475
return plaintext_length;
206
return new_packet_length;
476
207
}
477
208
478
static const char * safer_gnutls_strerror(int value){
479
const char *ret = gnutls_strerror(value);
480
if(ret == NULL)
209
static const char * safer_gnutls_strerror (int value) {
210
const char *ret = gnutls_strerror (value);
211
if (ret == NULL)
481
212
ret = "(unknown)";
482
213
return ret;
483
214
}
484
215
485
/* GnuTLS log function callback */
486
static void debuggnutls(__attribute__((unused)) int level,
487
const char* string){
488
fprintf_plus(stderr, "GnuTLS: %s", string);
216
void debuggnutls(int level, const char* string){
217
fprintf(stderr, "%s", string);
489
218
}
490
219
491
static int init_gnutls_global(const char *pubkeyfilename,
492
const char *seckeyfilename,
493
mandos_context *mc){
220
int initgnutls(encrypted_session *es){
221
const char *err;
494
222
int ret;
495
223
496
224
if(debug){
497
fprintf_plus(stderr, "Initializing GnuTLS\n");
225
fprintf(stderr, "Initializing gnutls\n");
498
226
}
227
499
228
500
ret = gnutls_global_init();
501
if(ret != GNUTLS_E_SUCCESS){
502
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
503
safer_gnutls_strerror(ret));
229
if ((ret = gnutls_global_init ())
230
!= GNUTLS_E_SUCCESS) {
231
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
504
232
return -1;
505
233
}
506
507
if(debug){
508
/* "Use a log level over 10 to enable all debugging options."
509
* - GnuTLS manual
510
*/
234
235
if (debug){
511
236
gnutls_global_set_log_level(11);
512
237
gnutls_global_set_log_function(debuggnutls);
513
238
}
514
239
515
/* OpenPGP credentials */
516
ret = gnutls_certificate_allocate_credentials(&mc->cred);
517
if(ret != GNUTLS_E_SUCCESS){
518
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
519
safer_gnutls_strerror(ret));
520
gnutls_global_deinit();
240
241
/* openpgp credentials */
242
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
243
!= GNUTLS_E_SUCCESS) {
244
fprintf (stderr, "memory error: %s\n", safer_gnutls_strerror(ret));
521
245
return -1;
522
246
}
523
247
524
248
if(debug){
525
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
526
" secret key %s as GnuTLS credentials\n",
527
pubkeyfilename,
528
seckeyfilename);
249
fprintf(stderr, "Attempting to use openpgp certificate %s"
250
" and keyfile %s as gnutls credentials\n", CERTFILE, KEYFILE);
529
251
}
530
252
531
253
ret = gnutls_certificate_set_openpgp_key_file
532
(mc->cred, pubkeyfilename, seckeyfilename,
533
GNUTLS_OPENPGP_FMT_BASE64);
534
if(ret != GNUTLS_E_SUCCESS){
535
fprintf_plus(stderr,
536
"Error[%d] while reading the OpenPGP key pair ('%s',"
537
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
538
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
539
safer_gnutls_strerror(ret));
540
goto globalfail;
541
}
542
543
/* GnuTLS server initialization */
544
ret = gnutls_dh_params_init(&mc->dh_params);
545
if(ret != GNUTLS_E_SUCCESS){
546
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
547
" initialization: %s\n",
548
safer_gnutls_strerror(ret));
549
goto globalfail;
550
}
551
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
552
if(ret != GNUTLS_E_SUCCESS){
553
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
554
safer_gnutls_strerror(ret));
555
goto globalfail;
556
}
557
558
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
559
560
return 0;
561
562
globalfail:
563
564
gnutls_certificate_free_credentials(mc->cred);
565
gnutls_global_deinit();
566
gnutls_dh_params_deinit(mc->dh_params);
567
return -1;
568
}
569
570
static int init_gnutls_session(gnutls_session_t *session,
571
mandos_context *mc){
572
int ret;
573
/* GnuTLS session creation */
574
do {
575
ret = gnutls_init(session, GNUTLS_SERVER);
576
if(quit_now){
577
return -1;
578
}
579
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
580
if(ret != GNUTLS_E_SUCCESS){
581
fprintf_plus(stderr,
582
"Error in GnuTLS session initialization: %s\n",
583
safer_gnutls_strerror(ret));
584
}
585
586
{
587
const char *err;
588
do {
589
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
590
if(quit_now){
591
gnutls_deinit(*session);
592
return -1;
593
}
594
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
595
if(ret != GNUTLS_E_SUCCESS){
596
fprintf_plus(stderr, "Syntax error at: %s\n", err);
597
fprintf_plus(stderr, "GnuTLS error: %s\n",
598
safer_gnutls_strerror(ret));
599
gnutls_deinit(*session);
600
return -1;
601
}
602
}
603
604
do {
605
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
606
mc->cred);
607
if(quit_now){
608
gnutls_deinit(*session);
609
return -1;
610
}
611
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
612
if(ret != GNUTLS_E_SUCCESS){
613
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
614
safer_gnutls_strerror(ret));
615
gnutls_deinit(*session);
616
return -1;
617
}
618
254
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
255
if (ret != GNUTLS_E_SUCCESS) {
256
fprintf
257
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s', '%s')\n",
258
ret, CERTFILE, KEYFILE);
259
fprintf(stdout, "The Error is: %s\n",
260
safer_gnutls_strerror(ret));
261
return -1;
262
}
263
264
//Gnutls server initialization
265
if ((ret = gnutls_dh_params_init (&es->dh_params))
266
!= GNUTLS_E_SUCCESS) {
267
fprintf (stderr, "Error in dh parameter initialization: %s\n",
268
safer_gnutls_strerror(ret));
269
return -1;
270
}
271
272
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
273
!= GNUTLS_E_SUCCESS) {
274
fprintf (stderr, "Error in prime generation: %s\n",
275
safer_gnutls_strerror(ret));
276
return -1;
277
}
278
279
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
280
281
// Gnutls session creation
282
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
283
!= GNUTLS_E_SUCCESS){
284
fprintf(stderr, "Error in gnutls session initialization: %s\n",
285
safer_gnutls_strerror(ret));
286
}
287
288
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
289
!= GNUTLS_E_SUCCESS) {
290
fprintf(stderr, "Syntax error at: %s\n", err);
291
fprintf(stderr, "Gnutls error: %s\n",
292
safer_gnutls_strerror(ret));
293
return -1;
294
}
295
296
if ((ret = gnutls_credentials_set
297
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
298
!= GNUTLS_E_SUCCESS) {
299
fprintf(stderr, "Error setting a credentials set: %s\n",
300
safer_gnutls_strerror(ret));
301
return -1;
302
}
303
619
304
/* ignore client certificate if any. */
620
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
305
gnutls_certificate_server_set_request (es->session, GNUTLS_CERT_IGNORE);
621
306
622
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
307
gnutls_dh_set_prime_bits (es->session, DH_BITS);
623
308
624
309
return 0;
625
310
}
626
311
627
/* Avahi log function callback */
628
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
629
__attribute__((unused)) const char *txt){}
312
void empty_log(AvahiLogLevel level, const char *txt){}
630
313
631
/* Called when a Mandos server is found */
632
static int start_mandos_communication(const char *ip, in_port_t port,
633
AvahiIfIndex if_index,
634
int af, mandos_context *mc){
635
int ret, tcp_sd = -1;
636
ssize_t sret;
637
struct sockaddr_storage to;
314
int start_mandos_communication(char *ip, uint16_t port){
315
int ret, tcp_sd;
316
struct sockaddr_in6 to;
317
encrypted_session es;
638
318
char *buffer = NULL;
639
char *decrypted_buffer = NULL;
319
char *decrypted_buffer;
640
320
size_t buffer_length = 0;
641
321
size_t buffer_capacity = 0;
642
size_t written;
643
int retval = -1;
644
gnutls_session_t session;
645
int pf; /* Protocol family */
646
647
errno = 0;
648
649
if(quit_now){
650
errno = EINTR;
651
return -1;
652
}
653
654
switch(af){
655
case AF_INET6:
656
pf = PF_INET6;
657
break;
658
case AF_INET:
659
pf = PF_INET;
660
break;
661
default:
662
fprintf_plus(stderr, "Bad address family: %d\n", af);
663
errno = EINVAL;
664
return -1;
665
}
666
667
/* If the interface is specified and we have a list of interfaces */
668
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
669
/* Check if the interface is one of the interfaces we are using */
670
bool match = false;
671
{
672
char *interface = NULL;
673
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
674
interface))){
675
if(if_nametoindex(interface) == (unsigned int)if_index){
676
match = true;
677
break;
678
}
679
}
680
}
681
if(not match){
682
/* This interface does not match any in the list, so we don't
683
connect to the server */
684
if(debug){
685
char interface[IF_NAMESIZE];
686
if(if_indextoname((unsigned int)if_index, interface) == NULL){
687
perror_plus("if_indextoname");
688
} else {
689
fprintf_plus(stderr, "Skipping server on non-used interface"
690
" \"%s\"\n",
691
if_indextoname((unsigned int)if_index,
692
interface));
693
}
694
}
695
return -1;
696
}
697
}
698
699
ret = init_gnutls_session(&session, mc);
700
if(ret != 0){
701
return -1;
702
}
703
704
if(debug){
705
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
706
PRIuMAX "\n", ip, (uintmax_t)port);
707
}
708
709
tcp_sd = socket(pf, SOCK_STREAM, 0);
710
if(tcp_sd < 0){
711
int e = errno;
712
perror_plus("socket");
713
errno = e;
714
goto mandos_end;
715
}
716
717
if(quit_now){
718
errno = EINTR;
719
goto mandos_end;
720
}
721
722
memset(&to, 0, sizeof(to));
723
if(af == AF_INET6){
724
((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;
725
ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);
726
} else { /* IPv4 */
727
((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;
728
ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);
729
}
730
if(ret < 0 ){
731
int e = errno;
732
perror_plus("inet_pton");
733
errno = e;
734
goto mandos_end;
735
}
322
ssize_t decrypted_buffer_size;
323
int retval = 0;
324
const char interface[] = "eth0";
325
326
if(debug){
327
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
328
}
329
330
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
331
if(tcp_sd < 0) {
332
perror("socket");
333
return -1;
334
}
335
336
if(debug){
337
fprintf(stderr, "Binding to interface %s\n", interface);
338
}
339
340
ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, interface, 5);
341
if(tcp_sd < 0) {
342
perror("setsockopt bindtodevice");
343
return -1;
344
}
345
346
memset(&to,0,sizeof(to));
347
to.sin6_family = AF_INET6;
348
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
349
if (ret < 0 ){
350
perror("inet_pton");
351
return -1;
352
}
736
353
if(ret == 0){
737
int e = errno;
738
fprintf_plus(stderr, "Bad address: %s\n", ip);
739
errno = e;
740
goto mandos_end;
741
}
742
if(af == AF_INET6){
743
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
744
if(IN6_IS_ADDR_LINKLOCAL
745
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
746
if(if_index == AVAHI_IF_UNSPEC){
747
fprintf_plus(stderr, "An IPv6 link-local address is"
748
" incomplete without a network interface\n");
749
errno = EINVAL;
750
goto mandos_end;
751
}
752
/* Set the network interface number as scope */
753
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
754
}
755
} else {
756
((struct sockaddr_in *)&to)->sin_port = htons(port);
757
}
758
759
if(quit_now){
760
errno = EINTR;
761
goto mandos_end;
762
}
763
764
if(debug){
765
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
766
char interface[IF_NAMESIZE];
767
if(if_indextoname((unsigned int)if_index, interface) == NULL){
768
perror_plus("if_indextoname");
769
} else {
770
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
771
"\n", ip, interface, (uintmax_t)port);
772
}
773
} else {
774
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
775
ip, (uintmax_t)port);
776
}
777
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
778
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
779
if(af == AF_INET6){
780
ret = getnameinfo((struct sockaddr *)&to,
781
sizeof(struct sockaddr_in6),
782
addrstr, sizeof(addrstr), NULL, 0,
783
NI_NUMERICHOST);
784
} else {
785
ret = getnameinfo((struct sockaddr *)&to,
786
sizeof(struct sockaddr_in),
787
addrstr, sizeof(addrstr), NULL, 0,
788
NI_NUMERICHOST);
789
}
790
if(ret == EAI_SYSTEM){
791
perror_plus("getnameinfo");
792
} else if(ret != 0) {
793
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
794
} else if(strcmp(addrstr, ip) != 0){
795
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
796
}
797
}
798
799
if(quit_now){
800
errno = EINTR;
801
goto mandos_end;
802
}
803
804
if(af == AF_INET6){
805
ret = connect(tcp_sd, (struct sockaddr *)&to,
806
sizeof(struct sockaddr_in6));
807
} else {
808
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
809
sizeof(struct sockaddr_in));
810
}
811
if(ret < 0){
812
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
813
int e = errno;
814
perror_plus("connect");
815
errno = e;
816
}
817
goto mandos_end;
818
}
819
820
if(quit_now){
821
errno = EINTR;
822
goto mandos_end;
823
}
824
825
const char *out = mandos_protocol_version;
826
written = 0;
827
while(true){
828
size_t out_size = strlen(out);
829
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
830
out_size - written));
831
if(ret == -1){
832
int e = errno;
833
perror_plus("write");
834
errno = e;
835
goto mandos_end;
836
}
837
written += (size_t)ret;
838
if(written < out_size){
839
continue;
840
} else {
841
if(out == mandos_protocol_version){
842
written = 0;
843
out = "\r\n";
844
} else {
845
break;
846
}
847
}
848
849
if(quit_now){
850
errno = EINTR;
851
goto mandos_end;
852
}
853
}
854
855
if(debug){
856
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
857
}
858
859
if(quit_now){
860
errno = EINTR;
861
goto mandos_end;
862
}
863
864
/* This casting via intptr_t is to eliminate warning about casting
865
an int to a pointer type. This is exactly how the GnuTLS Guile
866
function "set-session-transport-fd!" does it. */
867
gnutls_transport_set_ptr(session,
868
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
869
870
if(quit_now){
871
errno = EINTR;
872
goto mandos_end;
873
}
874
875
do {
876
ret = gnutls_handshake(session);
877
if(quit_now){
878
errno = EINTR;
879
goto mandos_end;
880
}
881
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
882
883
if(ret != GNUTLS_E_SUCCESS){
884
if(debug){
885
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
886
gnutls_perror(ret);
887
}
888
errno = EPROTO;
889
goto mandos_end;
890
}
891
892
/* Read OpenPGP packet that contains the wanted password */
893
894
if(debug){
895
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
896
" %s\n", ip);
897
}
898
899
while(true){
900
901
if(quit_now){
902
errno = EINTR;
903
goto mandos_end;
904
}
905
906
buffer_capacity = incbuffer(&buffer, buffer_length,
907
buffer_capacity);
908
if(buffer_capacity == 0){
909
int e = errno;
910
perror_plus("incbuffer");
911
errno = e;
912
goto mandos_end;
913
}
914
915
if(quit_now){
916
errno = EINTR;
917
goto mandos_end;
918
}
919
920
sret = gnutls_record_recv(session, buffer+buffer_length,
921
BUFFER_SIZE);
922
if(sret == 0){
354
fprintf(stderr, "Bad address: %s\n", ip);
355
return -1;
356
}
357
to.sin6_port = htons(port);
358
to.sin6_scope_id = if_nametoindex(interface);
359
360
if(debug){
361
fprintf(stderr, "Connection to: %s\n", ip);
362
}
363
364
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
365
if (ret < 0){
366
perror("connect");
367
return -1;
368
}
369
370
ret = initgnutls (&es);
371
if (ret != 0){
372
retval = -1;
373
return -1;
374
}
375
376
377
gnutls_transport_set_ptr (es.session, (gnutls_transport_ptr_t) tcp_sd);
378
379
if(debug){
380
fprintf(stderr, "Establishing tls session with %s\n", ip);
381
}
382
383
384
ret = gnutls_handshake (es.session);
385
386
if (ret != GNUTLS_E_SUCCESS){
387
fprintf(stderr, "\n*** Handshake failed ***\n");
388
gnutls_perror (ret);
389
retval = -1;
390
goto exit;
391
}
392
393
//Retrieve gpg packet that contains the wanted password
394
395
if(debug){
396
fprintf(stderr, "Retrieving pgp encrypted password from %s\n", ip);
397
}
398
399
while(true){
400
if (buffer_length + BUFFER_SIZE > buffer_capacity){
401
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
402
if (buffer == NULL){
403
perror("realloc");
404
goto exit;
405
}
406
buffer_capacity += BUFFER_SIZE;
407
}
408
409
ret = gnutls_record_recv
410
(es.session, buffer+buffer_length, BUFFER_SIZE);
411
if (ret == 0){
923
412
break;
924
413
}
925
if(sret < 0){
926
switch(sret){
414
if (ret < 0){
415
switch(ret){
927
416
case GNUTLS_E_INTERRUPTED:
928
417
case GNUTLS_E_AGAIN:
929
418
break;
930
419
case GNUTLS_E_REHANDSHAKE:
931
do {
932
ret = gnutls_handshake(session);
933
934
if(quit_now){
935
errno = EINTR;
936
goto mandos_end;
937
}
938
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
939
if(ret < 0){
940
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
941
"***\n");
942
gnutls_perror(ret);
943
errno = EPROTO;
944
goto mandos_end;
420
ret = gnutls_handshake (es.session);
421
if (ret < 0){
422
fprintf(stderr, "\n*** Handshake failed ***\n");
423
gnutls_perror (ret);
424
retval = -1;
425
goto exit;
945
426
}
946
427
break;
947
428
default:
948
fprintf_plus(stderr, "Unknown error while reading data from"
949
" encrypted session with Mandos server\n");
950
gnutls_bye(session, GNUTLS_SHUT_RDWR);
951
errno = EIO;
952
goto mandos_end;
953
}
954
} else {
955
buffer_length += (size_t) sret;
956
}
957
}
958
959
if(debug){
960
fprintf_plus(stderr, "Closing TLS session\n");
961
}
962
963
if(quit_now){
964
errno = EINTR;
965
goto mandos_end;
966
}
967
968
do {
969
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
970
if(quit_now){
971
errno = EINTR;
972
goto mandos_end;
973
}
974
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
975
976
if(buffer_length > 0){
977
ssize_t decrypted_buffer_size;
978
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
979
&decrypted_buffer, mc);
980
if(decrypted_buffer_size >= 0){
981
982
written = 0;
983
while(written < (size_t) decrypted_buffer_size){
984
if(quit_now){
985
errno = EINTR;
986
goto mandos_end;
987
}
988
989
ret = (int)fwrite(decrypted_buffer + written, 1,
990
(size_t)decrypted_buffer_size - written,
991
stdout);
992
if(ret == 0 and ferror(stdout)){
993
int e = errno;
994
if(debug){
995
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
996
strerror(errno));
997
}
998
errno = e;
999
goto mandos_end;
1000
}
1001
written += (size_t)ret;
1002
}
1003
retval = 0;
1004
}
1005
}
1006
1007
/* Shutdown procedure */
1008
1009
mandos_end:
1010
{
1011
int e = errno;
1012
free(decrypted_buffer);
1013
free(buffer);
1014
if(tcp_sd >= 0){
1015
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
1016
}
1017
if(ret == -1){
1018
if(e == 0){
1019
e = errno;
1020
}
1021
perror_plus("close");
1022
}
1023
gnutls_deinit(session);
1024
errno = e;
1025
if(quit_now){
1026
errno = EINTR;
429
fprintf(stderr, "Unknown error while reading data from encrypted session with mandos server\n");
430
retval = -1;
431
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
432
goto exit;
433
}
434
} else {
435
buffer_length += ret;
436
}
437
}
438
439
if (buffer_length > 0){
440
if ((decrypted_buffer_size = gpg_packet_decrypt(buffer, buffer_length, &decrypted_buffer, CERT_ROOT)) >= 0){
441
fwrite (decrypted_buffer, 1, decrypted_buffer_size, stdout);
442
free(decrypted_buffer);
443
} else {
1027
444
retval = -1;
1028
445
}
1029
446
}
447
448
//shutdown procedure
449
450
if(debug){
451
fprintf(stderr, "Closing tls session\n");
452
}
453
454
free(buffer);
455
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
456
exit:
457
close(tcp_sd);
458
gnutls_deinit (es.session);
459
gnutls_certificate_free_credentials (es.cred);
460
gnutls_global_deinit ();
1030
461
return retval;
1031
462
}
1032
463
1033
static void resolve_callback(AvahiSServiceResolver *r,
1034
AvahiIfIndex interface,
1035
AvahiProtocol proto,
1036
AvahiResolverEvent event,
1037
const char *name,
1038
const char *type,
1039
const char *domain,
1040
const char *host_name,
1041
const AvahiAddress *address,
1042
uint16_t port,
1043
AVAHI_GCC_UNUSED AvahiStringList *txt,
1044
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1045
flags,
1046
void* mc){
1047
if(r == NULL){
1048
return;
1049
}
1050
1051
/* Called whenever a service has been resolved successfully or
1052
timed out */
1053
1054
if(quit_now){
1055
return;
1056
}
1057
1058
switch(event){
1059
default:
1060
case AVAHI_RESOLVER_FAILURE:
1061
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1062
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1063
domain,
1064
avahi_strerror(avahi_server_errno
1065
(((mandos_context*)mc)->server)));
1066
break;
1067
1068
case AVAHI_RESOLVER_FOUND:
1069
{
1070
char ip[AVAHI_ADDRESS_STR_MAX];
1071
avahi_address_snprint(ip, sizeof(ip), address);
1072
if(debug){
1073
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1074
PRIdMAX ") on port %" PRIu16 "\n", name,
1075
host_name, ip, (intmax_t)interface, port);
1076
}
1077
int ret = start_mandos_communication(ip, (in_port_t)port,
1078
interface,
1079
avahi_proto_to_af(proto),
1080
mc);
1081
if(ret == 0){
1082
avahi_simple_poll_quit(simple_poll);
1083
} else {
1084
if(not add_server(ip, (in_port_t)port, interface,
1085
avahi_proto_to_af(proto),
1086
&((mandos_context*)mc)->current_server)){
1087
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1088
" list\n", name);
1089
}
1090
}
1091
}
1092
}
1093
avahi_s_service_resolver_free(r);
1094
}
1095
1096
static void browse_callback(AvahiSServiceBrowser *b,
1097
AvahiIfIndex interface,
1098
AvahiProtocol protocol,
1099
AvahiBrowserEvent event,
1100
const char *name,
1101
const char *type,
1102
const char *domain,
1103
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1104
flags,
1105
void* mc){
1106
if(b == NULL){
1107
return;
1108
}
1109
1110
/* Called whenever a new services becomes available on the LAN or
1111
is removed from the LAN */
1112
1113
if(quit_now){
1114
return;
1115
}
1116
1117
switch(event){
1118
default:
1119
case AVAHI_BROWSER_FAILURE:
1120
1121
fprintf_plus(stderr, "(Avahi browser) %s\n",
1122
avahi_strerror(avahi_server_errno
1123
(((mandos_context*)mc)->server)));
1124
avahi_simple_poll_quit(simple_poll);
1125
return;
1126
1127
case AVAHI_BROWSER_NEW:
1128
/* We ignore the returned Avahi resolver object. In the callback
1129
function we free it. If the Avahi server is terminated before
1130
the callback function is called the Avahi server will free the
1131
resolver for us. */
1132
1133
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1134
interface, protocol, name, type,
1135
domain, protocol, 0,
1136
resolve_callback, mc) == NULL)
1137
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1138
" %s\n", name,
1139
avahi_strerror(avahi_server_errno
1140
(((mandos_context*)mc)->server)));
1141
break;
1142
1143
case AVAHI_BROWSER_REMOVE:
1144
break;
1145
1146
case AVAHI_BROWSER_ALL_FOR_NOW:
1147
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1148
if(debug){
1149
fprintf_plus(stderr, "No Mandos server found, still"
1150
" searching...\n");
1151
}
1152
break;
1153
}
1154
}
1155
1156
/* Signal handler that stops main loop after SIGTERM */
1157
static void handle_sigterm(int sig){
1158
if(quit_now){
1159
return;
1160
}
1161
quit_now = 1;
1162
signal_received = sig;
1163
int old_errno = errno;
1164
/* set main loop to exit */
1165
if(simple_poll != NULL){
1166
avahi_simple_poll_quit(simple_poll);
1167
}
1168
errno = old_errno;
1169
}
1170
1171
bool get_flags(const char *ifname, struct ifreq *ifr){
1172
int ret;
1173
error_t ret_errno;
1174
1175
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1176
if(s < 0){
1177
ret_errno = errno;
1178
perror_plus("socket");
1179
errno = ret_errno;
1180
return false;
1181
}
1182
strcpy(ifr->ifr_name, ifname);
1183
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1184
if(ret == -1){
1185
if(debug){
1186
ret_errno = errno;
1187
perror_plus("ioctl SIOCGIFFLAGS");
1188
errno = ret_errno;
1189
}
1190
return false;
1191
}
1192
return true;
1193
}
1194
1195
bool good_flags(const char *ifname, const struct ifreq *ifr){
1196
1197
/* Reject the loopback device */
1198
if(ifr->ifr_flags & IFF_LOOPBACK){
1199
if(debug){
1200
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1201
ifname);
1202
}
1203
return false;
1204
}
1205
/* Accept point-to-point devices only if connect_to is specified */
1206
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1207
if(debug){
1208
fprintf_plus(stderr, "Accepting point-to-point interface"
1209
" \"%s\"\n", ifname);
1210
}
1211
return true;
1212
}
1213
/* Otherwise, reject non-broadcast-capable devices */
1214
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1215
if(debug){
1216
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1217
" \"%s\"\n", ifname);
1218
}
1219
return false;
1220
}
1221
/* Reject non-ARP interfaces (including dummy interfaces) */
1222
if(ifr->ifr_flags & IFF_NOARP){
1223
if(debug){
1224
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1225
ifname);
1226
}
1227
return false;
1228
}
1229
1230
/* Accept this device */
1231
if(debug){
1232
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1233
}
1234
return true;
1235
}
1236
1237
/*
1238
* This function determines if a directory entry in /sys/class/net
1239
* corresponds to an acceptable network device.
1240
* (This function is passed to scandir(3) as a filter function.)
1241
*/
1242
int good_interface(const struct dirent *if_entry){
1243
if(if_entry->d_name[0] == '.'){
1244
return 0;
1245
}
1246
1247
struct ifreq ifr;
1248
if(not get_flags(if_entry->d_name, &ifr)){
1249
if(debug){
1250
fprintf_plus(stderr, "Failed to get flags for interface "
1251
"\"%s\"\n", if_entry->d_name);
1252
}
1253
return 0;
1254
}
1255
1256
if(not good_flags(if_entry->d_name, &ifr)){
1257
return 0;
1258
}
1259
return 1;
1260
}
1261
1262
/*
1263
* This function determines if a network interface is up.
1264
*/
1265
bool interface_is_up(const char *interface){
1266
struct ifreq ifr;
1267
if(not get_flags(interface, &ifr)){
1268
if(debug){
1269
fprintf_plus(stderr, "Failed to get flags for interface "
1270
"\"%s\"\n", interface);
1271
}
1272
return false;
1273
}
1274
1275
return (bool)(ifr.ifr_flags & IFF_UP);
1276
}
1277
1278
/*
1279
* This function determines if a network interface is running
1280
*/
1281
bool interface_is_running(const char *interface){
1282
struct ifreq ifr;
1283
if(not get_flags(interface, &ifr)){
1284
if(debug){
1285
fprintf_plus(stderr, "Failed to get flags for interface "
1286
"\"%s\"\n", interface);
1287
}
1288
return false;
1289
}
1290
1291
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1292
}
1293
1294
int notdotentries(const struct dirent *direntry){
1295
/* Skip "." and ".." */
1296
if(direntry->d_name[0] == '.'
1297
and (direntry->d_name[1] == '\0'
1298
or (direntry->d_name[1] == '.'
1299
and direntry->d_name[2] == '\0'))){
1300
return 0;
1301
}
1302
return 1;
1303
}
1304
1305
/* Is this directory entry a runnable program? */
1306
int runnable_hook(const struct dirent *direntry){
1307
int ret;
1308
size_t sret;
1309
struct stat st;
1310
1311
if((direntry->d_name)[0] == '\0'){
1312
/* Empty name? */
1313
return 0;
1314
}
1315
1316
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1317
"abcdefghijklmnopqrstuvwxyz"
1318
"0123456789"
1319
"_-");
1320
if((direntry->d_name)[sret] != '\0'){
1321
/* Contains non-allowed characters */
1322
if(debug){
1323
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1324
direntry->d_name);
1325
}
1326
return 0;
1327
}
1328
1329
char *fullname = NULL;
1330
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1331
if(ret < 0){
1332
perror_plus("asprintf");
1333
return 0;
1334
}
1335
1336
ret = stat(fullname, &st);
1337
if(ret == -1){
1338
if(debug){
1339
perror_plus("Could not stat hook");
1340
}
1341
return 0;
1342
}
1343
if(not (S_ISREG(st.st_mode))){
1344
/* Not a regular file */
1345
if(debug){
1346
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1347
direntry->d_name);
1348
}
1349
return 0;
1350
}
1351
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1352
/* Not executable */
1353
if(debug){
1354
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1355
direntry->d_name);
1356
}
1357
return 0;
1358
}
1359
if(debug){
1360
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1361
direntry->d_name);
1362
}
1363
return 1;
1364
}
1365
1366
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1367
mandos_context *mc){
1368
int ret;
1369
struct timespec now;
1370
struct timespec waited_time;
1371
intmax_t block_time;
1372
1373
while(true){
1374
if(mc->current_server == NULL){
1375
if (debug){
1376
fprintf_plus(stderr, "Wait until first server is found."
1377
" No timeout!\n");
1378
}
1379
ret = avahi_simple_poll_iterate(s, -1);
1380
} else {
1381
if (debug){
1382
fprintf_plus(stderr, "Check current_server if we should run"
1383
" it, or wait\n");
1384
}
1385
/* the current time */
1386
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1387
if(ret == -1){
1388
perror_plus("clock_gettime");
1389
return -1;
1390
}
1391
/* Calculating in ms how long time between now and server
1392
who we visted longest time ago. Now - last seen. */
1393
waited_time.tv_sec = (now.tv_sec
1394
- mc->current_server->last_seen.tv_sec);
1395
waited_time.tv_nsec = (now.tv_nsec
1396
- mc->current_server->last_seen.tv_nsec);
1397
/* total time is 10s/10,000ms.
1398
Converting to s from ms by dividing by 1,000,
1399
and ns to ms by dividing by 1,000,000. */
1400
block_time = ((retry_interval
1401
- ((intmax_t)waited_time.tv_sec * 1000))
1402
- ((intmax_t)waited_time.tv_nsec / 1000000));
1403
1404
if (debug){
1405
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1406
block_time);
1407
}
1408
1409
if(block_time <= 0){
1410
ret = start_mandos_communication(mc->current_server->ip,
1411
mc->current_server->port,
1412
mc->current_server->if_index,
1413
mc->current_server->af, mc);
1414
if(ret == 0){
1415
avahi_simple_poll_quit(s);
1416
return 0;
1417
}
1418
ret = clock_gettime(CLOCK_MONOTONIC,
1419
&mc->current_server->last_seen);
1420
if(ret == -1){
1421
perror_plus("clock_gettime");
1422
return -1;
1423
}
1424
mc->current_server = mc->current_server->next;
1425
block_time = 0; /* Call avahi to find new Mandos
1426
servers, but don't block */
1427
}
1428
1429
ret = avahi_simple_poll_iterate(s, (int)block_time);
1430
}
1431
if(ret != 0){
1432
if (ret > 0 or errno != EINTR){
1433
return (ret != 1) ? ret : 0;
1434
}
1435
}
1436
}
1437
}
1438
1439
/* Set effective uid to 0, return errno */
1440
error_t raise_privileges(void){
1441
error_t old_errno = errno;
1442
error_t ret_errno = 0;
1443
if(seteuid(0) == -1){
1444
ret_errno = errno;
1445
perror_plus("seteuid");
1446
}
1447
errno = old_errno;
1448
return ret_errno;
1449
}
1450
1451
/* Set effective and real user ID to 0. Return errno. */
1452
error_t raise_privileges_permanently(void){
1453
error_t old_errno = errno;
1454
error_t ret_errno = raise_privileges();
1455
if(ret_errno != 0){
1456
errno = old_errno;
1457
return ret_errno;
1458
}
1459
if(setuid(0) == -1){
1460
ret_errno = errno;
1461
perror_plus("seteuid");
1462
}
1463
errno = old_errno;
1464
return ret_errno;
1465
}
1466
1467
/* Set effective user ID to unprivileged saved user ID */
1468
error_t lower_privileges(void){
1469
error_t old_errno = errno;
1470
error_t ret_errno = 0;
1471
if(seteuid(uid) == -1){
1472
ret_errno = errno;
1473
perror_plus("seteuid");
1474
}
1475
errno = old_errno;
1476
return ret_errno;
1477
}
1478
1479
/* Lower privileges permanently */
1480
error_t lower_privileges_permanently(void){
1481
error_t old_errno = errno;
1482
error_t ret_errno = 0;
1483
if(setuid(uid) == -1){
1484
ret_errno = errno;
1485
perror_plus("setuid");
1486
}
1487
errno = old_errno;
1488
return ret_errno;
1489
}
1490
1491
bool run_network_hooks(const char *mode, const char *interface,
1492
const float delay){
1493
struct dirent **direntries;
1494
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1495
alphasort);
1496
if(numhooks == -1){
1497
if(errno == ENOENT){
1498
if(debug){
1499
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1500
" found\n", hookdir);
1501
}
1502
} else {
1503
perror_plus("scandir");
1504
}
1505
} else {
1506
struct dirent *direntry;
1507
int ret;
1508
int devnull = open("/dev/null", O_RDONLY);
1509
for(int i = 0; i < numhooks; i++){
1510
direntry = direntries[i];
1511
char *fullname = NULL;
1512
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1513
if(ret < 0){
1514
perror_plus("asprintf");
1515
continue;
1516
}
1517
if(debug){
1518
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1519
direntry->d_name);
1520
}
1521
pid_t hook_pid = fork();
1522
if(hook_pid == 0){
1523
/* Child */
1524
/* Raise privileges */
1525
raise_privileges_permanently();
1526
/* Set group */
1527
errno = 0;
1528
ret = setgid(0);
1529
if(ret == -1){
1530
perror_plus("setgid");
1531
}
1532
/* Reset supplementary groups */
1533
errno = 0;
1534
ret = setgroups(0, NULL);
1535
if(ret == -1){
1536
perror_plus("setgroups");
1537
}
1538
dup2(devnull, STDIN_FILENO);
1539
close(devnull);
1540
dup2(STDERR_FILENO, STDOUT_FILENO);
1541
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1542
if(ret == -1){
1543
perror_plus("setenv");
1544
_exit(EX_OSERR);
1545
}
1546
ret = setenv("DEVICE", interface, 1);
1547
if(ret == -1){
1548
perror_plus("setenv");
1549
_exit(EX_OSERR);
1550
}
1551
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1552
if(ret == -1){
1553
perror_plus("setenv");
1554
_exit(EX_OSERR);
1555
}
1556
ret = setenv("MODE", mode, 1);
1557
if(ret == -1){
1558
perror_plus("setenv");
1559
_exit(EX_OSERR);
1560
}
1561
char *delaystring;
1562
ret = asprintf(&delaystring, "%f", delay);
1563
if(ret == -1){
1564
perror_plus("asprintf");
1565
_exit(EX_OSERR);
1566
}
1567
ret = setenv("DELAY", delaystring, 1);
1568
if(ret == -1){
1569
free(delaystring);
1570
perror_plus("setenv");
1571
_exit(EX_OSERR);
1572
}
1573
free(delaystring);
1574
if(connect_to != NULL){
1575
ret = setenv("CONNECT", connect_to, 1);
1576
if(ret == -1){
1577
perror_plus("setenv");
1578
_exit(EX_OSERR);
1579
}
1580
}
1581
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1582
perror_plus("execl");
1583
_exit(EXIT_FAILURE);
1584
}
1585
} else {
1586
int status;
1587
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1588
perror_plus("waitpid");
1589
free(fullname);
1590
continue;
1591
}
1592
if(WIFEXITED(status)){
1593
if(WEXITSTATUS(status) != 0){
1594
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1595
" with status %d\n", direntry->d_name,
1596
WEXITSTATUS(status));
1597
free(fullname);
1598
continue;
1599
}
1600
} else if(WIFSIGNALED(status)){
1601
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1602
" signal %d\n", direntry->d_name,
1603
WTERMSIG(status));
1604
free(fullname);
1605
continue;
1606
} else {
1607
fprintf_plus(stderr, "Warning: network hook \"%s\""
1608
" crashed\n", direntry->d_name);
1609
free(fullname);
1610
continue;
1611
}
1612
}
1613
free(fullname);
1614
if(debug){
1615
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1616
direntry->d_name);
1617
}
1618
}
1619
close(devnull);
1620
}
1621
return true;
1622
}
1623
1624
error_t bring_up_interface(const char *const interface,
1625
const float delay){
1626
int sd = -1;
1627
error_t old_errno = errno;
1628
error_t ret_errno = 0;
1629
int ret, ret_setflags;
1630
struct ifreq network;
1631
unsigned int if_index = if_nametoindex(interface);
1632
if(if_index == 0){
1633
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1634
errno = old_errno;
1635
return ENXIO;
1636
}
1637
1638
if(quit_now){
1639
errno = old_errno;
1640
return EINTR;
1641
}
1642
1643
if(not interface_is_up(interface)){
1644
if(not get_flags(interface, &network) and debug){
1645
ret_errno = errno;
1646
fprintf_plus(stderr, "Failed to get flags for interface "
1647
"\"%s\"\n", interface);
1648
return ret_errno;
1649
}
1650
network.ifr_flags |= IFF_UP;
1651
1652
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1653
if(sd < 0){
1654
ret_errno = errno;
1655
perror_plus("socket");
1656
errno = old_errno;
1657
return ret_errno;
1658
}
1659
1660
if(quit_now){
1661
close(sd);
1662
errno = old_errno;
1663
return EINTR;
1664
}
1665
1666
if(debug){
1667
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
1668
interface);
1669
}
1670
1671
/* Raise priviliges */
1672
raise_privileges();
1673
1674
#ifdef __linux__
1675
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1676
messages about the network interface to mess up the prompt */
1677
int ret_linux = klogctl(8, NULL, 5);
1678
bool restore_loglevel = true;
1679
if(ret_linux == -1){
1680
restore_loglevel = false;
1681
perror_plus("klogctl");
1682
}
1683
#endif /* __linux__ */
1684
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1685
ret_errno = errno;
1686
#ifdef __linux__
1687
if(restore_loglevel){
1688
ret_linux = klogctl(7, NULL, 0);
1689
if(ret_linux == -1){
1690
perror_plus("klogctl");
1691
}
1692
}
1693
#endif /* __linux__ */
1694
1695
/* Lower privileges */
1696
lower_privileges();
1697
1698
/* Close the socket */
1699
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1700
if(ret == -1){
1701
perror_plus("close");
1702
}
1703
1704
if(ret_setflags == -1){
1705
errno = ret_errno;
1706
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1707
errno = old_errno;
1708
return ret_errno;
1709
}
1710
} else if(debug){
1711
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1712
interface);
1713
}
1714
1715
/* Sleep checking until interface is running.
1716
Check every 0.25s, up to total time of delay */
1717
for(int i=0; i < delay * 4; i++){
1718
if(interface_is_running(interface)){
1719
break;
1720
}
1721
struct timespec sleeptime = { .tv_nsec = 250000000 };
1722
ret = nanosleep(&sleeptime, NULL);
1723
if(ret == -1 and errno != EINTR){
1724
perror_plus("nanosleep");
1725
}
1726
}
1727
1728
errno = old_errno;
1729
return 0;
1730
}
1731
1732
error_t take_down_interface(const char *const interface){
1733
error_t old_errno = errno;
1734
struct ifreq network;
1735
unsigned int if_index = if_nametoindex(interface);
1736
if(if_index == 0){
1737
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1738
errno = old_errno;
1739
return ENXIO;
1740
}
1741
if(interface_is_up(interface)){
1742
error_t ret_errno = 0;
1743
if(not get_flags(interface, &network) and debug){
1744
ret_errno = errno;
1745
fprintf_plus(stderr, "Failed to get flags for interface "
1746
"\"%s\"\n", interface);
1747
return ret_errno;
1748
}
1749
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1750
1751
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1752
if(sd < 0){
1753
ret_errno = errno;
1754
perror_plus("socket");
1755
errno = old_errno;
1756
return ret_errno;
1757
}
1758
1759
if(debug){
1760
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
1761
interface);
1762
}
1763
1764
/* Raise priviliges */
1765
raise_privileges();
1766
1767
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1768
ret_errno = errno;
1769
1770
/* Lower privileges */
1771
lower_privileges();
1772
1773
/* Close the socket */
1774
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1775
if(ret == -1){
1776
perror_plus("close");
1777
}
1778
1779
if(ret_setflags == -1){
1780
errno = ret_errno;
1781
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1782
errno = old_errno;
1783
return ret_errno;
1784
}
1785
} else if(debug){
1786
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1787
interface);
1788
}
1789
1790
errno = old_errno;
1791
return 0;
1792
}
1793
1794
int main(int argc, char *argv[]){
1795
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1796
.priority = "SECURE256:!CTYPE-X.509:"
1797
"+CTYPE-OPENPGP", .current_server = NULL,
1798
.interfaces = NULL, .interfaces_size = 0 };
1799
AvahiSServiceBrowser *sb = NULL;
1800
error_t ret_errno;
1801
int ret;
1802
intmax_t tmpmax;
1803
char *tmp;
1804
int exitcode = EXIT_SUCCESS;
1805
char *interfaces_to_take_down = NULL;
1806
size_t interfaces_to_take_down_size = 0;
1807
char tempdir[] = "/tmp/mandosXXXXXX";
1808
bool tempdir_created = false;
1809
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1810
const char *seckey = PATHDIR "/" SECKEY;
1811
const char *pubkey = PATHDIR "/" PUBKEY;
1812
char *interfaces_hooks = NULL;
1813
1814
bool gnutls_initialized = false;
1815
bool gpgme_initialized = false;
1816
float delay = 2.5f;
1817
double retry_interval = 10; /* 10s between trying a server and
1818
retrying the same server again */
1819
1820
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1821
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1822
1823
uid = getuid();
1824
gid = getgid();
1825
1826
/* Lower any group privileges we might have, just to be safe */
1827
errno = 0;
1828
ret = setgid(gid);
1829
if(ret == -1){
1830
perror_plus("setgid");
1831
}
1832
1833
/* Lower user privileges (temporarily) */
1834
errno = 0;
1835
ret = seteuid(uid);
1836
if(ret == -1){
1837
perror_plus("seteuid");
1838
}
1839
1840
if(quit_now){
1841
goto end;
1842
}
1843
1844
{
1845
struct argp_option options[] = {
1846
{ .name = "debug", .key = 128,
1847
.doc = "Debug mode", .group = 3 },
1848
{ .name = "connect", .key = 'c',
1849
.arg = "ADDRESS:PORT",
1850
.doc = "Connect directly to a specific Mandos server",
1851
.group = 1 },
1852
{ .name = "interface", .key = 'i',
1853
.arg = "NAME",
1854
.doc = "Network interface that will be used to search for"
1855
" Mandos servers",
1856
.group = 1 },
1857
{ .name = "seckey", .key = 's',
1858
.arg = "FILE",
1859
.doc = "OpenPGP secret key file base name",
1860
.group = 1 },
1861
{ .name = "pubkey", .key = 'p',
1862
.arg = "FILE",
1863
.doc = "OpenPGP public key file base name",
1864
.group = 2 },
1865
{ .name = "dh-bits", .key = 129,
1866
.arg = "BITS",
1867
.doc = "Bit length of the prime number used in the"
1868
" Diffie-Hellman key exchange",
1869
.group = 2 },
1870
{ .name = "priority", .key = 130,
1871
.arg = "STRING",
1872
.doc = "GnuTLS priority string for the TLS handshake",
1873
.group = 1 },
1874
{ .name = "delay", .key = 131,
1875
.arg = "SECONDS",
1876
.doc = "Maximum delay to wait for interface startup",
1877
.group = 2 },
1878
{ .name = "retry", .key = 132,
1879
.arg = "SECONDS",
1880
.doc = "Retry interval used when denied by the Mandos server",
1881
.group = 2 },
1882
{ .name = "network-hook-dir", .key = 133,
1883
.arg = "DIR",
1884
.doc = "Directory where network hooks are located",
1885
.group = 2 },
1886
/*
1887
* These reproduce what we would get without ARGP_NO_HELP
1888
*/
1889
{ .name = "help", .key = '?',
1890
.doc = "Give this help list", .group = -1 },
1891
{ .name = "usage", .key = -3,
1892
.doc = "Give a short usage message", .group = -1 },
1893
{ .name = "version", .key = 'V',
1894
.doc = "Print program version", .group = -1 },
1895
{ .name = NULL }
1896
};
1897
1898
error_t parse_opt(int key, char *arg,
1899
struct argp_state *state){
1900
errno = 0;
1901
switch(key){
1902
case 128: /* --debug */
1903
debug = true;
1904
break;
1905
case 'c': /* --connect */
1906
connect_to = arg;
1907
break;
1908
case 'i': /* --interface */
1909
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
1910
arg, (int)',');
1911
if(ret_errno != 0){
1912
argp_error(state, "%s", strerror(ret_errno));
1913
}
1914
break;
1915
case 's': /* --seckey */
1916
seckey = arg;
1917
break;
1918
case 'p': /* --pubkey */
1919
pubkey = arg;
1920
break;
1921
case 129: /* --dh-bits */
1922
errno = 0;
1923
tmpmax = strtoimax(arg, &tmp, 10);
1924
if(errno != 0 or tmp == arg or *tmp != '\0'
1925
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1926
argp_error(state, "Bad number of DH bits");
1927
}
1928
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1929
break;
1930
case 130: /* --priority */
1931
mc.priority = arg;
1932
break;
1933
case 131: /* --delay */
1934
errno = 0;
1935
delay = strtof(arg, &tmp);
1936
if(errno != 0 or tmp == arg or *tmp != '\0'){
1937
argp_error(state, "Bad delay");
1938
}
1939
case 132: /* --retry */
1940
errno = 0;
1941
retry_interval = strtod(arg, &tmp);
1942
if(errno != 0 or tmp == arg or *tmp != '\0'
1943
or (retry_interval * 1000) > INT_MAX
1944
or retry_interval < 0){
1945
argp_error(state, "Bad retry interval");
1946
}
1947
break;
1948
case 133: /* --network-hook-dir */
1949
hookdir = arg;
1950
break;
1951
/*
1952
* These reproduce what we would get without ARGP_NO_HELP
1953
*/
1954
case '?': /* --help */
1955
argp_state_help(state, state->out_stream,
1956
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1957
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1958
case -3: /* --usage */
1959
argp_state_help(state, state->out_stream,
1960
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1961
case 'V': /* --version */
1962
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1963
exit(argp_err_exit_status);
1964
break;
1965
default:
1966
return ARGP_ERR_UNKNOWN;
1967
}
1968
return errno;
1969
}
1970
1971
struct argp argp = { .options = options, .parser = parse_opt,
1972
.args_doc = "",
1973
.doc = "Mandos client -- Get and decrypt"
1974
" passwords from a Mandos server" };
1975
ret = argp_parse(&argp, argc, argv,
1976
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1977
switch(ret){
1978
case 0:
1979
break;
1980
case ENOMEM:
1981
default:
1982
errno = ret;
1983
perror_plus("argp_parse");
1984
exitcode = EX_OSERR;
1985
goto end;
1986
case EINVAL:
1987
exitcode = EX_USAGE;
1988
goto end;
1989
}
1990
}
1991
1992
{
1993
/* Work around Debian bug #633582:
1994
<http://bugs.debian.org/633582> */
1995
1996
/* Re-raise priviliges */
1997
if(raise_privileges() == 0){
1998
struct stat st;
1999
2000
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2001
int seckey_fd = open(seckey, O_RDONLY);
2002
if(seckey_fd == -1){
2003
perror_plus("open");
2004
} else {
2005
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
2006
if(ret == -1){
2007
perror_plus("fstat");
2008
} else {
2009
if(S_ISREG(st.st_mode)
2010
and st.st_uid == 0 and st.st_gid == 0){
2011
ret = fchown(seckey_fd, uid, gid);
2012
if(ret == -1){
2013
perror_plus("fchown");
2014
}
2015
}
2016
}
2017
TEMP_FAILURE_RETRY(close(seckey_fd));
2018
}
2019
}
2020
2021
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
2022
int pubkey_fd = open(pubkey, O_RDONLY);
2023
if(pubkey_fd == -1){
2024
perror_plus("open");
2025
} else {
2026
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
2027
if(ret == -1){
2028
perror_plus("fstat");
2029
} else {
2030
if(S_ISREG(st.st_mode)
2031
and st.st_uid == 0 and st.st_gid == 0){
2032
ret = fchown(pubkey_fd, uid, gid);
2033
if(ret == -1){
2034
perror_plus("fchown");
2035
}
2036
}
2037
}
2038
TEMP_FAILURE_RETRY(close(pubkey_fd));
2039
}
2040
}
2041
2042
/* Lower privileges */
2043
lower_privileges();
2044
}
2045
}
2046
2047
/* Remove invalid interface names (except "none") */
2048
{
2049
char *interface = NULL;
2050
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2051
interface))){
2052
if(strcmp(interface, "none") != 0
2053
and if_nametoindex(interface) == 0){
2054
if(interface[0] != '\0'){
2055
fprintf_plus(stderr, "Not using nonexisting interface"
2056
" \"%s\"\n", interface);
2057
}
2058
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2059
interface = NULL;
2060
}
2061
}
2062
}
2063
2064
/* Run network hooks */
2065
{
2066
if(mc.interfaces != NULL){
2067
interfaces_hooks = malloc(mc.interfaces_size);
2068
if(interfaces_hooks == NULL){
2069
perror_plus("malloc");
2070
goto end;
2071
}
2072
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2073
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2074
}
2075
if(not run_network_hooks("start", interfaces_hooks != NULL ?
2076
interfaces_hooks : "", delay)){
2077
goto end;
2078
}
2079
}
2080
2081
if(not debug){
2082
avahi_set_log_function(empty_log);
2083
}
2084
2085
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
2086
from the signal handler */
2087
/* Initialize the pseudo-RNG for Avahi */
2088
srand((unsigned int) time(NULL));
2089
simple_poll = avahi_simple_poll_new();
2090
if(simple_poll == NULL){
2091
fprintf_plus(stderr,
2092
"Avahi: Failed to create simple poll object.\n");
2093
exitcode = EX_UNAVAILABLE;
2094
goto end;
2095
}
2096
2097
sigemptyset(&sigterm_action.sa_mask);
2098
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
2099
if(ret == -1){
2100
perror_plus("sigaddset");
2101
exitcode = EX_OSERR;
2102
goto end;
2103
}
2104
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
2105
if(ret == -1){
2106
perror_plus("sigaddset");
2107
exitcode = EX_OSERR;
2108
goto end;
2109
}
2110
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
2111
if(ret == -1){
2112
perror_plus("sigaddset");
2113
exitcode = EX_OSERR;
2114
goto end;
2115
}
2116
/* Need to check if the handler is SIG_IGN before handling:
2117
| [[info:libc:Initial Signal Actions]] |
2118
| [[info:libc:Basic Signal Handling]] |
2119
*/
2120
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
2121
if(ret == -1){
2122
perror_plus("sigaction");
2123
return EX_OSERR;
2124
}
2125
if(old_sigterm_action.sa_handler != SIG_IGN){
2126
ret = sigaction(SIGINT, &sigterm_action, NULL);
2127
if(ret == -1){
2128
perror_plus("sigaction");
2129
exitcode = EX_OSERR;
2130
goto end;
2131
}
2132
}
2133
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
2134
if(ret == -1){
2135
perror_plus("sigaction");
2136
return EX_OSERR;
2137
}
2138
if(old_sigterm_action.sa_handler != SIG_IGN){
2139
ret = sigaction(SIGHUP, &sigterm_action, NULL);
2140
if(ret == -1){
2141
perror_plus("sigaction");
2142
exitcode = EX_OSERR;
2143
goto end;
2144
}
2145
}
2146
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
2147
if(ret == -1){
2148
perror_plus("sigaction");
2149
return EX_OSERR;
2150
}
2151
if(old_sigterm_action.sa_handler != SIG_IGN){
2152
ret = sigaction(SIGTERM, &sigterm_action, NULL);
2153
if(ret == -1){
2154
perror_plus("sigaction");
2155
exitcode = EX_OSERR;
2156
goto end;
2157
}
2158
}
2159
2160
/* If no interfaces were specified, make a list */
2161
if(mc.interfaces == NULL){
2162
struct dirent **direntries;
2163
/* Look for any good interfaces */
2164
ret = scandir(sys_class_net, &direntries, good_interface,
2165
alphasort);
2166
if(ret >= 1){
2167
/* Add all found interfaces to interfaces list */
2168
for(int i = 0; i < ret; ++i){
2169
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2170
direntries[i]->d_name);
2171
if(ret_errno != 0){
2172
errno = ret_errno;
2173
perror_plus("argz_add");
2174
continue;
2175
}
2176
if(debug){
2177
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2178
direntries[i]->d_name);
2179
}
2180
}
2181
free(direntries);
2182
} else {
2183
free(direntries);
2184
fprintf_plus(stderr, "Could not find a network interface\n");
2185
exitcode = EXIT_FAILURE;
2186
goto end;
2187
}
2188
}
2189
2190
/* Bring up interfaces which are down, and remove any "none"s */
2191
{
2192
char *interface = NULL;
2193
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2194
interface))){
2195
/* If interface name is "none", stop bringing up interfaces.
2196
Also remove all instances of "none" from the list */
2197
if(strcmp(interface, "none") == 0){
2198
argz_delete(&mc.interfaces, &mc.interfaces_size,
2199
interface);
2200
interface = NULL;
2201
while((interface = argz_next(mc.interfaces,
2202
mc.interfaces_size, interface))){
2203
if(strcmp(interface, "none") == 0){
2204
argz_delete(&mc.interfaces, &mc.interfaces_size,
2205
interface);
2206
interface = NULL;
2207
}
2208
}
2209
break;
2210
}
2211
bool interface_was_up = interface_is_up(interface);
2212
ret = bring_up_interface(interface, delay);
2213
if(not interface_was_up){
2214
if(ret != 0){
2215
errno = ret;
2216
perror_plus("Failed to bring up interface");
2217
} else {
2218
ret_errno = argz_add(&interfaces_to_take_down,
2219
&interfaces_to_take_down_size,
2220
interface);
2221
if(ret_errno != 0){
2222
errno = ret_errno;
2223
perror_plus("argz_add");
2224
}
2225
}
2226
}
2227
}
2228
if(debug and (interfaces_to_take_down == NULL)){
2229
fprintf_plus(stderr, "No interfaces were brought up\n");
2230
}
2231
}
2232
2233
/* If we only got one interface, explicitly use only that one */
2234
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2235
if(debug){
2236
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2237
mc.interfaces);
2238
}
2239
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2240
}
2241
2242
if(quit_now){
2243
goto end;
2244
}
2245
2246
ret = init_gnutls_global(pubkey, seckey, &mc);
2247
if(ret == -1){
2248
fprintf_plus(stderr, "init_gnutls_global failed\n");
2249
exitcode = EX_UNAVAILABLE;
2250
goto end;
2251
} else {
2252
gnutls_initialized = true;
2253
}
2254
2255
if(quit_now){
2256
goto end;
2257
}
2258
2259
if(mkdtemp(tempdir) == NULL){
2260
perror_plus("mkdtemp");
2261
goto end;
2262
}
2263
tempdir_created = true;
2264
2265
if(quit_now){
2266
goto end;
2267
}
2268
2269
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2270
fprintf_plus(stderr, "init_gpgme failed\n");
2271
exitcode = EX_UNAVAILABLE;
2272
goto end;
2273
} else {
2274
gpgme_initialized = true;
2275
}
2276
2277
if(quit_now){
2278
goto end;
2279
}
2280
2281
if(connect_to != NULL){
2282
/* Connect directly, do not use Zeroconf */
2283
/* (Mainly meant for debugging) */
2284
char *address = strrchr(connect_to, ':');
2285
2286
if(address == NULL){
2287
fprintf_plus(stderr, "No colon in address\n");
2288
exitcode = EX_USAGE;
2289
goto end;
2290
}
2291
2292
if(quit_now){
2293
goto end;
2294
}
2295
2296
in_port_t port;
2297
errno = 0;
2298
tmpmax = strtoimax(address+1, &tmp, 10);
2299
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2300
or tmpmax != (in_port_t)tmpmax){
2301
fprintf_plus(stderr, "Bad port number\n");
2302
exitcode = EX_USAGE;
2303
goto end;
2304
}
2305
2306
if(quit_now){
2307
goto end;
2308
}
2309
2310
port = (in_port_t)tmpmax;
2311
*address = '\0';
2312
/* Colon in address indicates IPv6 */
2313
int af;
2314
if(strchr(connect_to, ':') != NULL){
2315
af = AF_INET6;
2316
/* Accept [] around IPv6 address - see RFC 5952 */
2317
if(connect_to[0] == '[' and address[-1] == ']')
2318
{
2319
connect_to++;
2320
address[-1] = '\0';
2321
}
2322
} else {
2323
af = AF_INET;
2324
}
2325
address = connect_to;
2326
2327
if(quit_now){
2328
goto end;
2329
}
2330
2331
while(not quit_now){
2332
ret = start_mandos_communication(address, port, if_index, af,
2333
&mc);
2334
if(quit_now or ret == 0){
2335
break;
2336
}
2337
if(debug){
2338
fprintf_plus(stderr, "Retrying in %d seconds\n",
2339
(int)retry_interval);
2340
}
2341
sleep((unsigned int)retry_interval);
2342
}
2343
2344
if (not quit_now){
2345
exitcode = EXIT_SUCCESS;
2346
}
2347
2348
goto end;
2349
}
2350
2351
if(quit_now){
2352
goto end;
2353
}
2354
2355
{
464
static AvahiSimplePoll *simple_poll = NULL;
465
static AvahiServer *server = NULL;
466
467
static void resolve_callback(
468
AvahiSServiceResolver *r,
469
AVAHI_GCC_UNUSED AvahiIfIndex interface,
470
AVAHI_GCC_UNUSED AvahiProtocol protocol,
471
AvahiResolverEvent event,
472
const char *name,
473
const char *type,
474
const char *domain,
475
const char *host_name,
476
const AvahiAddress *address,
477
uint16_t port,
478
AvahiStringList *txt,
479
AvahiLookupResultFlags flags,
480
AVAHI_GCC_UNUSED void* userdata) {
481
482
assert(r);
483
484
/* Called whenever a service has been resolved successfully or timed out */
485
486
switch (event) {
487
case AVAHI_RESOLVER_FAILURE:
488
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of type '%s' in domain '%s': %s\n", name, type, domain, avahi_strerror(avahi_server_errno(server)));
489
break;
490
491
case AVAHI_RESOLVER_FOUND: {
492
char ip[AVAHI_ADDRESS_STR_MAX];
493
avahi_address_snprint(ip, sizeof(ip), address);
494
if(debug){
495
fprintf(stderr, "Mandos server found at %s on port %d\n", ip, port);
496
}
497
int ret = start_mandos_communication(ip, port);
498
if (ret == 0){
499
exit(EXIT_SUCCESS);
500
} else {
501
exit(EXIT_FAILURE);
502
}
503
}
504
}
505
avahi_s_service_resolver_free(r);
506
}
507
508
static void browse_callback(
509
AvahiSServiceBrowser *b,
510
AvahiIfIndex interface,
511
AvahiProtocol protocol,
512
AvahiBrowserEvent event,
513
const char *name,
514
const char *type,
515
const char *domain,
516
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
517
void* userdata) {
518
519
AvahiServer *s = userdata;
520
assert(b);
521
522
/* Called whenever a new services becomes available on the LAN or is removed from the LAN */
523
524
switch (event) {
525
526
case AVAHI_BROWSER_FAILURE:
527
528
fprintf(stderr, "(Browser) %s\n", avahi_strerror(avahi_server_errno(server)));
529
avahi_simple_poll_quit(simple_poll);
530
return;
531
532
case AVAHI_BROWSER_NEW:
533
/* We ignore the returned resolver object. In the callback
534
function we free it. If the server is terminated before
535
the callback function is called the server will free
536
the resolver for us. */
537
538
if (!(avahi_s_service_resolver_new(s, interface, protocol, name, type, domain, AVAHI_PROTO_INET6, 0, resolve_callback, s)))
539
fprintf(stderr, "Failed to resolve service '%s': %s\n", name, avahi_strerror(avahi_server_errno(s)));
540
541
break;
542
543
case AVAHI_BROWSER_REMOVE:
544
break;
545
546
case AVAHI_BROWSER_ALL_FOR_NOW:
547
case AVAHI_BROWSER_CACHE_EXHAUSTED:
548
break;
549
}
550
}
551
552
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
2356
553
AvahiServerConfig config;
2357
/* Do not publish any local Zeroconf records */
554
AvahiSServiceBrowser *sb = NULL;
555
const char db[] = "--debug";
556
int error;
557
int ret = 1;
558
int returncode = EXIT_SUCCESS;
559
char *basename = rindex(argv[0], '/');
560
if(basename == NULL){
561
basename = argv[0];
562
} else {
563
basename++;
564
}
565
566
char *program_name = malloc(strlen(basename) + sizeof(db));
567
568
if (program_name == NULL){
569
perror("argv[0]");
570
return EXIT_FAILURE;
571
}
572
573
program_name[0] = '\0';
574
575
for (int i = 1; i < argc; i++){
576
if (not strncmp(argv[i], db, 5)){
577
strcat(strcat(strcat(program_name, db ), "="), basename);
578
if(not strcmp(argv[i], db) or not strcmp(argv[i], program_name)){
579
debug = true;
580
}
581
}
582
}
583
free(program_name);
584
585
if (not debug){
586
avahi_set_log_function(empty_log);
587
}
588
589
/* Initialize the psuedo-RNG */
590
srand(time(NULL));
591
592
/* Allocate main loop object */
593
if (!(simple_poll = avahi_simple_poll_new())) {
594
fprintf(stderr, "Failed to create simple poll object.\n");
595
596
goto exit;
597
}
598
599
/* Do not publish any local records */
2358
600
avahi_server_config_init(&config);
2359
601
config.publish_hinfo = 0;
2360
602
config.publish_addresses = 0;
2361
603
config.publish_workstation = 0;
2362
604
config.publish_domain = 0;
2363
605
2364
606
/* Allocate a new server */
2365
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2366
&config, NULL, NULL, &ret_errno);
2367
2368
/* Free the Avahi configuration data */
607
server = avahi_server_new(avahi_simple_poll_get(simple_poll), &config, NULL, NULL, &error);
608
609
/* Free the configuration data */
2369
610
avahi_server_config_free(&config);
2370
}
2371
2372
/* Check if creating the Avahi server object succeeded */
2373
if(mc.server == NULL){
2374
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2375
avahi_strerror(ret_errno));
2376
exitcode = EX_UNAVAILABLE;
2377
goto end;
2378
}
2379
2380
if(quit_now){
2381
goto end;
2382
}
2383
2384
/* Create the Avahi service browser */
2385
sb = avahi_s_service_browser_new(mc.server, if_index,
2386
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2387
NULL, 0, browse_callback,
2388
(void *)&mc);
2389
if(sb == NULL){
2390
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2391
avahi_strerror(avahi_server_errno(mc.server)));
2392
exitcode = EX_UNAVAILABLE;
2393
goto end;
2394
}
2395
2396
if(quit_now){
2397
goto end;
2398
}
2399
2400
/* Run the main loop */
2401
2402
if(debug){
2403
fprintf_plus(stderr, "Starting Avahi loop search\n");
2404
}
2405
2406
ret = avahi_loop_with_timeout(simple_poll,
2407
(int)(retry_interval * 1000), &mc);
2408
if(debug){
2409
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2410
(ret == 0) ? "successfully" : "with error");
2411
}
2412
2413
end:
2414
2415
if(debug){
2416
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2417
}
2418
2419
/* Cleanup things */
2420
free(mc.interfaces);
2421
2422
if(sb != NULL)
2423
avahi_s_service_browser_free(sb);
2424
2425
if(mc.server != NULL)
2426
avahi_server_free(mc.server);
2427
2428
if(simple_poll != NULL)
2429
avahi_simple_poll_free(simple_poll);
2430
2431
if(gnutls_initialized){
2432
gnutls_certificate_free_credentials(mc.cred);
2433
gnutls_global_deinit();
2434
gnutls_dh_params_deinit(mc.dh_params);
2435
}
2436
2437
if(gpgme_initialized){
2438
gpgme_release(mc.ctx);
2439
}
2440
2441
/* Cleans up the circular linked list of Mandos servers the client
2442
has seen */
2443
if(mc.current_server != NULL){
2444
mc.current_server->prev->next = NULL;
2445
while(mc.current_server != NULL){
2446
server *next = mc.current_server->next;
2447
free(mc.current_server);
2448
mc.current_server = next;
2449
}
2450
}
2451
2452
/* Re-raise priviliges */
2453
{
2454
raise_privileges();
2455
2456
/* Run network hooks */
2457
run_network_hooks("stop", interfaces_hooks != NULL ?
2458
interfaces_hooks : "", delay);
2459
2460
/* Take down the network interfaces which were brought up */
2461
{
2462
char *interface = NULL;
2463
while((interface=argz_next(interfaces_to_take_down,
2464
interfaces_to_take_down_size,
2465
interface))){
2466
ret_errno = take_down_interface(interface);
2467
if(ret_errno != 0){
2468
errno = ret_errno;
2469
perror_plus("Failed to take down interface");
2470
}
2471
}
2472
if(debug and (interfaces_to_take_down == NULL)){
2473
fprintf_plus(stderr, "No interfaces needed to be taken"
2474
" down\n");
2475
}
2476
}
2477
2478
lower_privileges_permanently();
2479
}
2480
2481
free(interfaces_to_take_down);
2482
free(interfaces_hooks);
2483
2484
/* Removes the GPGME temp directory and all files inside */
2485
if(tempdir_created){
2486
struct dirent **direntries = NULL;
2487
struct dirent *direntry = NULL;
2488
int numentries = scandir(tempdir, &direntries, notdotentries,
2489
alphasort);
2490
if (numentries > 0){
2491
for(int i = 0; i < numentries; i++){
2492
direntry = direntries[i];
2493
char *fullname = NULL;
2494
ret = asprintf(&fullname, "%s/%s", tempdir,
2495
direntry->d_name);
2496
if(ret < 0){
2497
perror_plus("asprintf");
2498
continue;
2499
}
2500
ret = remove(fullname);
2501
if(ret == -1){
2502
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2503
strerror(errno));
2504
}
2505
free(fullname);
2506
}
2507
}
2508
2509
/* need to clean even if 0 because man page doesn't specify */
2510
free(direntries);
2511
if (numentries == -1){
2512
perror_plus("scandir");
2513
}
2514
ret = rmdir(tempdir);
2515
if(ret == -1 and errno != ENOENT){
2516
perror_plus("rmdir");
2517
}
2518
}
2519
2520
if(quit_now){
2521
sigemptyset(&old_sigterm_action.sa_mask);
2522
old_sigterm_action.sa_handler = SIG_DFL;
2523
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
2524
&old_sigterm_action,
2525
NULL));
2526
if(ret == -1){
2527
perror_plus("sigaction");
2528
}
2529
do {
2530
ret = raise(signal_received);
2531
} while(ret != 0 and errno == EINTR);
2532
if(ret != 0){
2533
perror_plus("raise");
2534
abort();
2535
}
2536
TEMP_FAILURE_RETRY(pause());
2537
}
2538
2539
return exitcode;
611
612
/* Check if creating the server object succeeded */
613
if (!server) {
614
fprintf(stderr, "Failed to create server: %s\n", avahi_strerror(error));
615
returncode = EXIT_FAILURE;
616
goto exit;
617
}
618
619
/* Create the service browser */
620
if (!(sb = avahi_s_service_browser_new(server, if_nametoindex("eth0"), AVAHI_PROTO_INET6, "_mandos._tcp", NULL, 0, browse_callback, server))) {
621
fprintf(stderr, "Failed to create service browser: %s\n", avahi_strerror(avahi_server_errno(server)));
622
returncode = EXIT_FAILURE;
623
goto exit;
624
}
625
626
/* Run the main loop */
627
628
if (debug){
629
fprintf(stderr, "Starting avahi loop search\n");
630
}
631
632
avahi_simple_poll_loop(simple_poll);
633
634
exit:
635
636
if (debug){
637
fprintf(stderr, "%s exiting\n", argv[0]);
638
}
639
640
/* Cleanup things */
641
if (sb)
642
avahi_s_service_browser_free(sb);
643
644
if (server)
645
avahi_server_free(server);
646
647
if (simple_poll)
648
avahi_simple_poll_free(simple_poll);
649
650
return ret;
2540
651
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0