331
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
194
/* Delete the GPGME FILE pointer cryptotext data buffer */
195
gpgme_data_release(dh_crypto);
334
197
/* Seek back to the beginning of the GPGME plaintext data buffer */
335
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
336
perror("gpgme_data_seek");
337
plaintext_length = -1;
198
gpgme_data_seek(dh_plain, 0, SEEK_SET);
343
plaintext_capacity = incbuffer(plaintext,
344
(size_t)plaintext_length,
346
if(plaintext_capacity == 0){
348
plaintext_length = -1;
202
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
203
*new_packet = realloc(*new_packet,
204
(unsigned int)new_packet_capacity
206
if (*new_packet == NULL){
210
new_packet_capacity += BUFFER_SIZE;
352
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
213
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
354
215
/* Print the data, if any */
360
220
perror("gpgme_data_read");
361
plaintext_length = -1;
364
plaintext_length += ret;
368
fprintf(stderr, "Decrypted password is: ");
369
for(ssize_t i = 0; i < plaintext_length; i++){
370
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
372
fprintf(stderr, "\n");
377
/* Delete the GPGME cryptotext data buffer */
378
gpgme_data_release(dh_crypto);
223
new_packet_length += ret;
226
/* FIXME: check characters before printing to screen so to not print
227
terminal control characters */
229
/* fprintf(stderr, "decrypted password is: "); */
230
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
231
/* fprintf(stderr, "\n"); */
380
234
/* Delete the GPGME plaintext data buffer */
381
235
gpgme_data_release(dh_plain);
382
return plaintext_length;
236
return new_packet_length;
385
static const char * safer_gnutls_strerror(int value){
386
const char *ret = gnutls_strerror(value); /* Spurious warning from
387
-Wunreachable-code */
239
static const char * safer_gnutls_strerror (int value) {
240
const char *ret = gnutls_strerror (value);
389
242
ret = "(unknown)";
393
/* GnuTLS log function callback */
394
static void debuggnutls(__attribute__((unused)) int level,
396
fprintf(stderr, "GnuTLS: %s", string);
246
void debuggnutls(__attribute__((unused)) int level,
248
fprintf(stderr, "%s", string);
399
static int init_gnutls_global(const char *pubkeyfilename,
400
const char *seckeyfilename){
251
int initgnutls(encrypted_session *es){
404
256
fprintf(stderr, "Initializing GnuTLS\n");
407
ret = gnutls_global_init();
408
if(ret != GNUTLS_E_SUCCESS){
409
fprintf(stderr, "GnuTLS global_init: %s\n",
410
safer_gnutls_strerror(ret));
259
if ((ret = gnutls_global_init ())
260
!= GNUTLS_E_SUCCESS) {
261
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
415
/* "Use a log level over 10 to enable all debugging options."
418
266
gnutls_global_set_log_level(11);
419
267
gnutls_global_set_log_function(debuggnutls);
422
/* OpenPGP credentials */
423
gnutls_certificate_allocate_credentials(&mc.cred);
424
if(ret != GNUTLS_E_SUCCESS){
425
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
429
safer_gnutls_strerror(ret));
430
gnutls_global_deinit();
270
/* openpgp credentials */
271
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
272
!= GNUTLS_E_SUCCESS) {
273
fprintf (stderr, "memory error: %s\n",
274
safer_gnutls_strerror(ret));
435
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
436
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
279
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
280
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
440
284
ret = gnutls_certificate_set_openpgp_key_file
441
(mc.cred, pubkeyfilename, seckeyfilename,
442
GNUTLS_OPENPGP_FMT_BASE64);
443
if(ret != GNUTLS_E_SUCCESS){
445
"Error[%d] while reading the OpenPGP key pair ('%s',"
446
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
447
fprintf(stderr, "The GnuTLS error is: %s\n",
448
safer_gnutls_strerror(ret));
452
/* GnuTLS server initialization */
453
ret = gnutls_dh_params_init(&mc.dh_params);
454
if(ret != GNUTLS_E_SUCCESS){
455
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
456
" %s\n", safer_gnutls_strerror(ret));
459
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
460
if(ret != GNUTLS_E_SUCCESS){
461
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
462
safer_gnutls_strerror(ret));
466
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
472
gnutls_certificate_free_credentials(mc.cred);
473
gnutls_global_deinit();
474
gnutls_dh_params_deinit(mc.dh_params);
478
static int init_gnutls_session(gnutls_session_t *session){
480
/* GnuTLS session creation */
482
ret = gnutls_init(session, GNUTLS_SERVER);
486
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
487
if(ret != GNUTLS_E_SUCCESS){
285
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
286
if (ret != GNUTLS_E_SUCCESS) {
288
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
290
ret, CERTFILE, KEYFILE);
291
fprintf(stdout, "The Error is: %s\n",
292
safer_gnutls_strerror(ret));
296
//GnuTLS server initialization
297
if ((ret = gnutls_dh_params_init (&es->dh_params))
298
!= GNUTLS_E_SUCCESS) {
299
fprintf (stderr, "Error in dh parameter initialization: %s\n",
300
safer_gnutls_strerror(ret));
304
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
305
!= GNUTLS_E_SUCCESS) {
306
fprintf (stderr, "Error in prime generation: %s\n",
307
safer_gnutls_strerror(ret));
311
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
313
// GnuTLS session creation
314
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
315
!= GNUTLS_E_SUCCESS){
488
316
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
489
317
safer_gnutls_strerror(ret));
495
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
497
gnutls_deinit(*session);
500
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
501
if(ret != GNUTLS_E_SUCCESS){
502
fprintf(stderr, "Syntax error at: %s\n", err);
503
fprintf(stderr, "GnuTLS error: %s\n",
504
safer_gnutls_strerror(ret));
505
gnutls_deinit(*session);
320
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
321
!= GNUTLS_E_SUCCESS) {
322
fprintf(stderr, "Syntax error at: %s\n", err);
323
fprintf(stderr, "GnuTLS error: %s\n",
324
safer_gnutls_strerror(ret));
511
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
514
gnutls_deinit(*session);
517
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
518
if(ret != GNUTLS_E_SUCCESS){
519
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
328
if ((ret = gnutls_credentials_set
329
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
330
!= GNUTLS_E_SUCCESS) {
331
fprintf(stderr, "Error setting a credentials set: %s\n",
520
332
safer_gnutls_strerror(ret));
521
gnutls_deinit(*session);
525
336
/* ignore client certificate if any. */
526
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
337
gnutls_certificate_server_set_request (es->session,
528
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
340
gnutls_dh_set_prime_bits (es->session, DH_BITS);
533
/* Avahi log function callback */
534
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
535
__attribute__((unused)) const char *txt){}
345
void empty_log(__attribute__((unused)) AvahiLogLevel level,
346
__attribute__((unused)) const char *txt){}
537
/* Called when a Mandos server is found */
538
static int start_mandos_communication(const char *ip, uint16_t port,
539
AvahiIfIndex if_index,
541
int ret, tcp_sd = -1;
544
struct sockaddr_in in;
545
struct sockaddr_in6 in6;
348
int start_mandos_communication(char *ip, uint16_t port,
349
unsigned int if_index){
351
struct sockaddr_in6 to;
352
encrypted_session es;
547
353
char *buffer = NULL;
548
char *decrypted_buffer = NULL;
354
char *decrypted_buffer;
549
355
size_t buffer_length = 0;
550
356
size_t buffer_capacity = 0;
553
gnutls_session_t session;
554
int pf; /* Protocol family */
568
fprintf(stderr, "Bad address family: %d\n", af);
572
ret = init_gnutls_session(&session);
357
ssize_t decrypted_buffer_size;
359
char interface[IF_NAMESIZE];
578
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
362
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
582
tcp_sd = socket(pf, SOCK_STREAM, 0);
365
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
584
367
perror("socket");
592
memset(&to, 0, sizeof(to));
594
to.in6.sin6_family = (sa_family_t)af;
595
ret = inet_pton(af, ip, &to.in6.sin6_addr);
597
to.in.sin_family = (sa_family_t)af;
598
ret = inet_pton(af, ip, &to.in.sin_addr);
371
if(if_indextoname(if_index, interface) == NULL){
373
perror("if_indextoname");
379
fprintf(stderr, "Binding to interface %s\n", interface);
382
ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, interface, 5);
384
perror("setsockopt bindtodevice");
388
memset(&to,0,sizeof(to));
389
to.sin6_family = AF_INET6;
390
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
601
392
perror("inet_pton");
605
396
fprintf(stderr, "Bad address: %s\n", ip);
609
to.in6.sin6_port = htons(port); /* Spurious warnings from
611
-Wunreachable-code */
613
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
614
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
616
if(if_index == AVAHI_IF_UNSPEC){
617
fprintf(stderr, "An IPv6 link-local address is incomplete"
618
" without a network interface\n");
621
/* Set the network interface number as scope */
622
to.in6.sin6_scope_id = (uint32_t)if_index;
625
to.in.sin_port = htons(port); /* Spurious warnings from
627
-Wunreachable-code */
399
/* Spurious warnings for the next line, see for instance
400
<http://bugs.debian.org/488884> */
401
to.sin6_port = htons(port);
403
to.sin6_scope_id = (uint32_t)if_index;
635
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
636
char interface[IF_NAMESIZE];
637
if(if_indextoname((unsigned int)if_index, interface) == NULL){
638
perror("if_indextoname");
640
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
641
ip, interface, port);
644
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
647
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
648
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
651
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
654
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
660
if(strcmp(addrstr, ip) != 0){
661
fprintf(stderr, "Canonical address form: %s\n", addrstr);
671
ret = connect(tcp_sd, &to.in6, sizeof(to));
673
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
406
fprintf(stderr, "Connection to: %s\n", ip);
409
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
676
411
perror("connect");
684
const char *out = mandos_protocol_version;
687
size_t out_size = strlen(out);
688
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
689
out_size - written));
694
written += (size_t)ret;
695
if(written < out_size){
698
if(out == mandos_protocol_version){
415
ret = initgnutls (&es);
421
gnutls_transport_set_ptr (es.session,
422
(gnutls_transport_ptr_t) tcp_sd);
712
425
fprintf(stderr, "Establishing TLS session with %s\n", ip);
719
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
726
ret = gnutls_handshake(session);
730
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
732
if(ret != GNUTLS_E_SUCCESS){
734
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
740
/* Read OpenPGP packet that contains the wanted password */
428
ret = gnutls_handshake (es.session);
430
if (ret != GNUTLS_E_SUCCESS){
431
fprintf(stderr, "\n*** Handshake failed ***\n");
437
//Retrieve OpenPGP packet that contains the wanted password
743
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
440
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
753
buffer_capacity = incbuffer(&buffer, buffer_length,
755
if(buffer_capacity == 0){
764
sret = gnutls_record_recv(session, buffer+buffer_length,
445
if (buffer_length + BUFFER_SIZE > buffer_capacity){
446
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
451
buffer_capacity += BUFFER_SIZE;
454
ret = gnutls_record_recv
455
(es.session, buffer+buffer_length, BUFFER_SIZE);
771
461
case GNUTLS_E_INTERRUPTED:
772
462
case GNUTLS_E_AGAIN:
774
464
case GNUTLS_E_REHANDSHAKE:
776
ret = gnutls_handshake(session);
781
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
783
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
465
ret = gnutls_handshake (es.session);
467
fprintf(stderr, "\n*** Handshake failed ***\n");
789
474
fprintf(stderr, "Unknown error while reading data from"
790
" encrypted session with Mandos server\n");
791
gnutls_bye(session, GNUTLS_SHUT_RDWR);
475
" encrypted session with mandos server\n");
477
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
795
buffer_length += (size_t) sret;
800
fprintf(stderr, "Closing TLS session\n");
808
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
812
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
814
if(buffer_length > 0){
815
ssize_t decrypted_buffer_size;
481
buffer_length += (size_t) ret;
485
if (buffer_length > 0){
816
486
decrypted_buffer_size = pgp_packet_decrypt(buffer,
819
if(decrypted_buffer_size >= 0){
822
while(written < (size_t) decrypted_buffer_size){
827
ret = (int)fwrite(decrypted_buffer + written, 1,
828
(size_t)decrypted_buffer_size - written,
490
if (decrypted_buffer_size >= 0){
491
while(decrypted_buffer_size > 0){
492
ret = fwrite (decrypted_buffer, 1, (size_t)decrypted_buffer_size,
830
494
if(ret == 0 and ferror(stdout)){
832
496
fprintf(stderr, "Error writing encrypted data: %s\n",
833
497
strerror(errno));
837
written += (size_t)ret;
502
decrypted_buffer += ret;
503
decrypted_buffer_size -= ret;
505
free(decrypted_buffer);
843
/* Shutdown procedure */
846
free(decrypted_buffer);
514
fprintf(stderr, "Closing TLS session\n");
849
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
854
gnutls_deinit(session);
518
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
521
gnutls_deinit (es.session);
522
gnutls_certificate_free_credentials (es.cred);
523
gnutls_global_deinit ();
861
static void resolve_callback(AvahiSServiceResolver *r,
862
AvahiIfIndex interface,
864
AvahiResolverEvent event,
868
const char *host_name,
869
const AvahiAddress *address,
871
AVAHI_GCC_UNUSED AvahiStringList *txt,
872
AVAHI_GCC_UNUSED AvahiLookupResultFlags
874
AVAHI_GCC_UNUSED void* userdata){
527
static AvahiSimplePoll *simple_poll = NULL;
528
static AvahiServer *server = NULL;
530
static void resolve_callback(
531
AvahiSServiceResolver *r,
532
AVAHI_GCC_UNUSED AvahiIfIndex interface,
533
AVAHI_GCC_UNUSED AvahiProtocol protocol,
534
AvahiResolverEvent event,
538
const char *host_name,
539
const AvahiAddress *address,
541
AVAHI_GCC_UNUSED AvahiStringList *txt,
542
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
543
AVAHI_GCC_UNUSED void* userdata) {
877
547
/* Called whenever a service has been resolved successfully or
886
552
case AVAHI_RESOLVER_FAILURE:
887
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
888
" of type '%s' in domain '%s': %s\n", name, type, domain,
889
avahi_strerror(avahi_server_errno(mc.server)));
553
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
554
" type '%s' in domain '%s': %s\n", name, type, domain,
555
avahi_strerror(avahi_server_errno(server)));
892
558
case AVAHI_RESOLVER_FOUND:
894
560
char ip[AVAHI_ADDRESS_STR_MAX];
895
561
avahi_address_snprint(ip, sizeof(ip), address);
897
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
898
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
899
ip, (intmax_t)interface, port);
563
fprintf(stderr, "Mandos server found on %s (%s) on port %d\n",
564
host_name, ip, port);
901
int ret = start_mandos_communication(ip, port, interface,
902
avahi_proto_to_af(proto));
904
avahi_simple_poll_quit(mc.simple_poll);
566
int ret = start_mandos_communication(ip, port,
908
576
avahi_s_service_resolver_free(r);
911
static void browse_callback(AvahiSServiceBrowser *b,
912
AvahiIfIndex interface,
913
AvahiProtocol protocol,
914
AvahiBrowserEvent event,
918
AVAHI_GCC_UNUSED AvahiLookupResultFlags
920
AVAHI_GCC_UNUSED void* userdata){
923
/* Called whenever a new services becomes available on the LAN or
924
is removed from the LAN */
932
case AVAHI_BROWSER_FAILURE:
934
fprintf(stderr, "(Avahi browser) %s\n",
935
avahi_strerror(avahi_server_errno(mc.server)));
936
avahi_simple_poll_quit(mc.simple_poll);
939
case AVAHI_BROWSER_NEW:
940
/* We ignore the returned Avahi resolver object. In the callback
941
function we free it. If the Avahi server is terminated before
942
the callback function is called the Avahi server will free the
945
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
946
name, type, domain, protocol, 0,
947
resolve_callback, NULL) == NULL)
948
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
949
name, avahi_strerror(avahi_server_errno(mc.server)));
952
case AVAHI_BROWSER_REMOVE:
955
case AVAHI_BROWSER_ALL_FOR_NOW:
956
case AVAHI_BROWSER_CACHE_EXHAUSTED:
958
fprintf(stderr, "No Mandos server found, still searching...\n");
964
/* stop main loop after sigterm has been called */
965
static void handle_sigterm(int sig){
970
signal_received = sig;
971
int old_errno = errno;
972
if(mc.simple_poll != NULL){
973
avahi_simple_poll_quit(mc.simple_poll);
978
int main(int argc, char *argv[]){
979
AvahiSServiceBrowser *sb = NULL;
984
int exitcode = EXIT_SUCCESS;
985
const char *interface = "eth0";
986
struct ifreq network;
988
bool take_down_interface = false;
991
char *connect_to = NULL;
992
char tempdir[] = "/tmp/mandosXXXXXX";
993
bool tempdir_created = false;
994
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
995
const char *seckey = PATHDIR "/" SECKEY;
996
const char *pubkey = PATHDIR "/" PUBKEY;
998
bool gnutls_initialized = false;
999
bool gpgme_initialized = false;
1002
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1003
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1008
/* Lower any group privileges we might have, just to be safe */
1015
/* Lower user privileges (temporarily) */
1027
struct argp_option options[] = {
1028
{ .name = "debug", .key = 128,
1029
.doc = "Debug mode", .group = 3 },
1030
{ .name = "connect", .key = 'c',
1031
.arg = "ADDRESS:PORT",
1032
.doc = "Connect directly to a specific Mandos server",
1034
{ .name = "interface", .key = 'i',
1036
.doc = "Network interface that will be used to search for"
1039
{ .name = "seckey", .key = 's',
1041
.doc = "OpenPGP secret key file base name",
1043
{ .name = "pubkey", .key = 'p',
1045
.doc = "OpenPGP public key file base name",
1047
{ .name = "dh-bits", .key = 129,
1049
.doc = "Bit length of the prime number used in the"
1050
" Diffie-Hellman key exchange",
1052
{ .name = "priority", .key = 130,
1054
.doc = "GnuTLS priority string for the TLS handshake",
1056
{ .name = "delay", .key = 131,
1058
.doc = "Maximum delay to wait for interface startup",
1061
* These reproduce what we would get without ARGP_NO_HELP
1063
{ .name = "help", .key = '?',
1064
.doc = "Give this help list", .group = -1 },
1065
{ .name = "usage", .key = -3,
1066
.doc = "Give a short usage message", .group = -1 },
1067
{ .name = "version", .key = 'V',
1068
.doc = "Print program version", .group = -1 },
1072
error_t parse_opt(int key, char *arg,
1073
struct argp_state *state){
1076
case 128: /* --debug */
1079
case 'c': /* --connect */
1082
case 'i': /* --interface */
1085
case 's': /* --seckey */
1088
case 'p': /* --pubkey */
1091
case 129: /* --dh-bits */
1093
tmpmax = strtoimax(arg, &tmp, 10);
1094
if(errno != 0 or tmp == arg or *tmp != '\0'
1095
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1096
argp_error(state, "Bad number of DH bits");
1098
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1100
case 130: /* --priority */
1103
case 131: /* --delay */
1105
delay = strtof(arg, &tmp);
1106
if(errno != 0 or tmp == arg or *tmp != '\0'){
1107
argp_error(state, "Bad delay");
1111
* These reproduce what we would get without ARGP_NO_HELP
1113
case '?': /* --help */
1114
argp_state_help(state, state->out_stream,
1115
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1116
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1117
case -3: /* --usage */
1118
argp_state_help(state, state->out_stream,
1119
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1120
case 'V': /* --version */
1121
fprintf(state->out_stream, "%s\n", argp_program_version);
1122
exit(argp_err_exit_status);
1125
return ARGP_ERR_UNKNOWN;
1130
struct argp argp = { .options = options, .parser = parse_opt,
1132
.doc = "Mandos client -- Get and decrypt"
1133
" passwords from a Mandos server" };
1134
ret = argp_parse(&argp, argc, argv,
1135
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
579
static void browse_callback(
580
AvahiSServiceBrowser *b,
581
AvahiIfIndex interface,
582
AvahiProtocol protocol,
583
AvahiBrowserEvent event,
587
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
590
AvahiServer *s = userdata;
593
/* Called whenever a new services becomes available on the LAN or
594
is removed from the LAN */
1142
perror("argp_parse");
1143
exitcode = EX_OSERR;
1146
exitcode = EX_USAGE;
1152
avahi_set_log_function(empty_log);
1155
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1156
from the signal handler */
1157
/* Initialize the pseudo-RNG for Avahi */
1158
srand((unsigned int) time(NULL));
1159
mc.simple_poll = avahi_simple_poll_new();
1160
if(mc.simple_poll == NULL){
1161
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1162
exitcode = EXIT_FAILURE;
1166
sigemptyset(&sigterm_action.sa_mask);
1167
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1169
perror("sigaddset");
1170
exitcode = EXIT_FAILURE;
1173
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1175
perror("sigaddset");
1176
exitcode = EXIT_FAILURE;
1179
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1181
perror("sigaddset");
1182
exitcode = EXIT_FAILURE;
1185
/* Need to check if the handler is SIG_IGN before handling:
1186
| [[info:libc:Initial Signal Actions]] |
1187
| [[info:libc:Basic Signal Handling]] |
1189
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1191
perror("sigaction");
1192
return EXIT_FAILURE;
1194
if(old_sigterm_action.sa_handler != SIG_IGN){
1195
ret = sigaction(SIGINT, &sigterm_action, NULL);
1197
perror("sigaction");
1198
exitcode = EXIT_FAILURE;
1202
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1204
perror("sigaction");
1205
return EXIT_FAILURE;
1207
if(old_sigterm_action.sa_handler != SIG_IGN){
1208
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1210
perror("sigaction");
1211
exitcode = EXIT_FAILURE;
1215
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1217
perror("sigaction");
1218
return EXIT_FAILURE;
1220
if(old_sigterm_action.sa_handler != SIG_IGN){
1221
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1223
perror("sigaction");
1224
exitcode = EXIT_FAILURE;
1229
/* If the interface is down, bring it up */
1230
if(interface[0] != '\0'){
1231
if_index = (AvahiIfIndex) if_nametoindex(interface);
1233
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1234
exitcode = EXIT_FAILURE;
1242
/* Re-raise priviliges */
1250
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1251
messages about the network interface to mess up the prompt */
1252
ret = klogctl(8, NULL, 5);
1253
bool restore_loglevel = true;
1255
restore_loglevel = false;
1258
#endif /* __linux__ */
1260
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1263
exitcode = EXIT_FAILURE;
1265
if(restore_loglevel){
1266
ret = klogctl(7, NULL, 0);
1271
#endif /* __linux__ */
1272
/* Lower privileges */
1280
strcpy(network.ifr_name, interface);
1281
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1283
perror("ioctl SIOCGIFFLAGS");
1285
if(restore_loglevel){
1286
ret = klogctl(7, NULL, 0);
1291
#endif /* __linux__ */
1292
exitcode = EXIT_FAILURE;
1293
/* Lower privileges */
1301
if((network.ifr_flags & IFF_UP) == 0){
1302
network.ifr_flags |= IFF_UP;
1303
take_down_interface = true;
1304
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1306
take_down_interface = false;
1307
perror("ioctl SIOCSIFFLAGS");
1308
exitcode = EXIT_FAILURE;
1310
if(restore_loglevel){
1311
ret = klogctl(7, NULL, 0);
1316
#endif /* __linux__ */
1317
/* Lower privileges */
1326
/* sleep checking until interface is running */
1327
for(int i=0; i < delay * 4; i++){
1328
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1330
perror("ioctl SIOCGIFFLAGS");
1331
} else if(network.ifr_flags & IFF_RUNNING){
1334
struct timespec sleeptime = { .tv_nsec = 250000000 };
1335
ret = nanosleep(&sleeptime, NULL);
1336
if(ret == -1 and errno != EINTR){
1337
perror("nanosleep");
1340
if(not take_down_interface){
1341
/* We won't need the socket anymore */
1342
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1348
if(restore_loglevel){
1349
/* Restores kernel loglevel to default */
1350
ret = klogctl(7, NULL, 0);
1355
#endif /* __linux__ */
1356
/* Lower privileges */
1358
if(take_down_interface){
1359
/* Lower privileges */
1365
/* Lower privileges permanently */
1377
ret = init_gnutls_global(pubkey, seckey);
1379
fprintf(stderr, "init_gnutls_global failed\n");
1380
exitcode = EXIT_FAILURE;
1383
gnutls_initialized = true;
1390
tempdir_created = true;
1391
if(mkdtemp(tempdir) == NULL){
1392
tempdir_created = false;
1401
if(not init_gpgme(pubkey, seckey, tempdir)){
1402
fprintf(stderr, "init_gpgme failed\n");
1403
exitcode = EXIT_FAILURE;
1406
gpgme_initialized = true;
1413
if(connect_to != NULL){
1414
/* Connect directly, do not use Zeroconf */
1415
/* (Mainly meant for debugging) */
1416
char *address = strrchr(connect_to, ':');
1417
if(address == NULL){
1418
fprintf(stderr, "No colon in address\n");
1419
exitcode = EXIT_FAILURE;
1429
tmpmax = strtoimax(address+1, &tmp, 10);
1430
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1431
or tmpmax != (uint16_t)tmpmax){
1432
fprintf(stderr, "Bad port number\n");
1433
exitcode = EXIT_FAILURE;
1441
port = (uint16_t)tmpmax;
1443
address = connect_to;
1444
/* Colon in address indicates IPv6 */
1446
if(strchr(address, ':') != NULL){
1456
ret = start_mandos_communication(address, port, if_index, af);
1458
exitcode = EXIT_FAILURE;
1460
exitcode = EXIT_SUCCESS;
598
case AVAHI_BROWSER_FAILURE:
600
fprintf(stderr, "(Browser) %s\n",
601
avahi_strerror(avahi_server_errno(server)));
602
avahi_simple_poll_quit(simple_poll);
605
case AVAHI_BROWSER_NEW:
606
/* We ignore the returned resolver object. In the callback
607
function we free it. If the server is terminated before
608
the callback function is called the server will free
609
the resolver for us. */
611
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
613
AVAHI_PROTO_INET6, 0,
614
resolve_callback, s)))
615
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
616
avahi_strerror(avahi_server_errno(s)));
619
case AVAHI_BROWSER_REMOVE:
622
case AVAHI_BROWSER_ALL_FOR_NOW:
623
case AVAHI_BROWSER_CACHE_EXHAUSTED:
628
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
1470
629
AvahiServerConfig config;
1471
/* Do not publish any local Zeroconf records */
630
AvahiSServiceBrowser *sb = NULL;
633
int returncode = EXIT_SUCCESS;
634
const char *interface = "eth0";
637
static struct option long_options[] = {
638
{"debug", no_argument, (int *)&debug, 1},
639
{"interface", required_argument, 0, 'i'},
642
int option_index = 0;
643
ret = getopt_long (argc, argv, "i:", long_options,
662
avahi_set_log_function(empty_log);
665
/* Initialize the psuedo-RNG */
666
srand((unsigned int) time(NULL));
668
/* Allocate main loop object */
669
if (!(simple_poll = avahi_simple_poll_new())) {
670
fprintf(stderr, "Failed to create simple poll object.\n");
675
/* Do not publish any local records */
1472
676
avahi_server_config_init(&config);
1473
677
config.publish_hinfo = 0;
1474
678
config.publish_addresses = 0;
1475
679
config.publish_workstation = 0;
1476
680
config.publish_domain = 0;
1478
682
/* Allocate a new server */
1479
mc.server = avahi_server_new(avahi_simple_poll_get
1480
(mc.simple_poll), &config, NULL,
1483
/* Free the Avahi configuration data */
683
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
684
&config, NULL, NULL, &error);
686
/* Free the configuration data */
1484
687
avahi_server_config_free(&config);
1487
/* Check if creating the Avahi server object succeeded */
1488
if(mc.server == NULL){
1489
fprintf(stderr, "Failed to create Avahi server: %s\n",
1490
avahi_strerror(error));
1491
exitcode = EXIT_FAILURE;
1499
/* Create the Avahi service browser */
1500
sb = avahi_s_service_browser_new(mc.server, if_index,
1501
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1502
NULL, 0, browse_callback, NULL);
1504
fprintf(stderr, "Failed to create service browser: %s\n",
1505
avahi_strerror(avahi_server_errno(mc.server)));
1506
exitcode = EXIT_FAILURE;
1514
/* Run the main loop */
1517
fprintf(stderr, "Starting Avahi loop search\n");
1520
avahi_simple_poll_loop(mc.simple_poll);
1525
fprintf(stderr, "%s exiting\n", argv[0]);
1528
/* Cleanup things */
1530
avahi_s_service_browser_free(sb);
1532
if(mc.server != NULL)
1533
avahi_server_free(mc.server);
1535
if(mc.simple_poll != NULL)
1536
avahi_simple_poll_free(mc.simple_poll);
1538
if(gnutls_initialized){
1539
gnutls_certificate_free_credentials(mc.cred);
1540
gnutls_global_deinit();
1541
gnutls_dh_params_deinit(mc.dh_params);
1544
if(gpgme_initialized){
1545
gpgme_release(mc.ctx);
1548
/* Take down the network interface */
1549
if(take_down_interface){
1550
/* Re-raise priviliges */
1557
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1559
perror("ioctl SIOCGIFFLAGS");
1560
} else if(network.ifr_flags & IFF_UP) {
1561
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1562
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1564
perror("ioctl SIOCSIFFLAGS");
1567
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1571
/* Lower privileges permanently */
1580
/* Removes the temp directory used by GPGME */
1581
if(tempdir_created){
1583
struct dirent *direntry;
1584
d = opendir(tempdir);
1586
if(errno != ENOENT){
1591
direntry = readdir(d);
1592
if(direntry == NULL){
1595
/* Skip "." and ".." */
1596
if(direntry->d_name[0] == '.'
1597
and (direntry->d_name[1] == '\0'
1598
or (direntry->d_name[1] == '.'
1599
and direntry->d_name[2] == '\0'))){
1602
char *fullname = NULL;
1603
ret = asprintf(&fullname, "%s/%s", tempdir,
1609
ret = remove(fullname);
1611
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1618
ret = rmdir(tempdir);
1619
if(ret == -1 and errno != ENOENT){
1625
sigemptyset(&old_sigterm_action.sa_mask);
1626
old_sigterm_action.sa_handler = SIG_DFL;
1627
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1628
&old_sigterm_action,
1631
perror("sigaction");
1634
ret = raise(signal_received);
1635
} while(ret != 0 and errno == EINTR);
1640
TEMP_FAILURE_RETRY(pause());
689
/* Check if creating the server object succeeded */
691
fprintf(stderr, "Failed to create server: %s\n",
692
avahi_strerror(error));
693
returncode = EXIT_FAILURE;
697
/* Create the service browser */
698
sb = avahi_s_service_browser_new(server,
700
if_nametoindex(interface),
702
"_mandos._tcp", NULL, 0,
703
browse_callback, server);
705
fprintf(stderr, "Failed to create service browser: %s\n",
706
avahi_strerror(avahi_server_errno(server)));
707
returncode = EXIT_FAILURE;
711
/* Run the main loop */
714
fprintf(stderr, "Starting avahi loop search\n");
717
avahi_simple_poll_loop(simple_poll);
722
fprintf(stderr, "%s exiting\n", argv[0]);
727
avahi_s_service_browser_free(sb);
730
avahi_server_free(server);
733
avahi_simple_poll_free(simple_poll);