To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 237.2.31
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.31
- Committer: Teddy Hogeborn
- Date: 2009-10-25 19:06:56 UTC
- mto: (24.1.170 mandos) (237.4.29 release)
- mto: This revision was merged to the branch mainline in revision 419.
- Revision ID: teddy@fukt.bsnet.se-20091025190656-jdj54g1ra7wbglxh
* Makefile: Don't use PIE if BROKEN_PIE is set.
* debian/rules: Set BROKEN_PIE on mips and mipsel architectures.
* debian/rules: Set BROKEN_PIE on mips and mipsel architectures.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- ca.pem
- files renamed:
- server.py => mandos
- server.conf => mandos.conf
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos client - get and decrypt data from a Mandos server
3
* Mandos-client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
13
14
*
14
15
* This program is free software: you can redistribute it and/or
15
16
* modify it under the terms of the GNU General Public License as
29
30
*/
30
31
31
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
32
34
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
33
37
#define _FILE_OFFSET_BITS 64
34
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
#include <sys/ioctl.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
41
#include <net/if.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
42
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
86
#ifdef __linux__
87
#include <sys/klog.h> /* klogctl() */
88
#endif /* __linux__ */
89
90
/* Avahi */
91
/* All Avahi types, constants and functions
92
Avahi*, avahi_*,
93
AVAHI_* */
43
94
#include <avahi-core/core.h>
44
95
#include <avahi-core/lookup.h>
45
96
#include <avahi-core/log.h>
47
98
#include <avahi-common/malloc.h>
48
99
#include <avahi-common/error.h>
49
100
50
//mandos client part
51
#include <sys/types.h> /* socket(), inet_pton() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton() */
54
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
55
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
56
57
#include <unistd.h> /* close() */
58
#include <netinet/in.h>
59
#include <stdbool.h> /* true */
60
#include <string.h> /* memset */
61
#include <arpa/inet.h> /* inet_pton() */
62
#include <iso646.h> /* not */
63
64
// gpgme
65
#include <errno.h> /* perror() */
66
#include <gpgme.h>
67
68
// getopt_long
69
#include <getopt.h>
101
/* GnuTLS */
102
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
103
functions:
104
gnutls_*
105
init_gnutls_session(),
106
GNUTLS_* */
107
#include <gnutls/openpgp.h>
108
/* gnutls_certificate_set_openpgp_key_file(),
109
GNUTLS_OPENPGP_FMT_BASE64 */
110
111
/* GPGME */
112
#include <gpgme.h> /* All GPGME types, constants and
113
functions:
114
gpgme_*
115
GPGME_PROTOCOL_OpenPGP,
116
GPG_ERR_NO_* */
70
117
71
118
#define BUFFER_SIZE 256
72
119
73
static const char *keydir = "/conf/conf.d/mandos";
74
static const char *pubkeyfile = "pubkey.txt";
75
static const char *seckeyfile = "seckey.txt";
120
#define PATHDIR "/conf/conf.d/mandos"
121
#define SECKEY "seckey.txt"
122
#define PUBKEY "pubkey.txt"
76
123
77
124
bool debug = false;
125
static const char mandos_protocol_version[] = "1";
126
const char *argp_program_version = "mandos-client " VERSION;
127
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
78
128
79
/* Used for passing in values through all the callback functions */
129
/* Used for passing in values through the Avahi callback functions */
80
130
typedef struct {
81
131
AvahiSimplePoll *simple_poll;
82
132
AvahiServer *server;
83
133
gnutls_certificate_credentials_t cred;
84
134
unsigned int dh_bits;
135
gnutls_dh_params_t dh_params;
85
136
const char *priority;
137
gpgme_ctx_t ctx;
86
138
} mandos_context;
87
139
88
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
89
char **new_packet,
90
const char *homedir){
91
gpgme_data_t dh_crypto, dh_plain;
92
gpgme_ctx_t ctx;
140
/* global context so signal handler can reach it*/
141
mandos_context mc = { .simple_poll = NULL, .server = NULL,
142
.dh_bits = 1024, .priority = "SECURE256"
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
144
145
sig_atomic_t quit_now = 0;
146
int signal_received = 0;
147
148
/*
149
* Make additional room in "buffer" for at least BUFFER_SIZE more
150
* bytes. "buffer_capacity" is how much is currently allocated,
151
* "buffer_length" is how much is already used.
152
*/
153
size_t incbuffer(char **buffer, size_t buffer_length,
154
size_t buffer_capacity){
155
if(buffer_length + BUFFER_SIZE > buffer_capacity){
156
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
157
if(buffer == NULL){
158
return 0;
159
}
160
buffer_capacity += BUFFER_SIZE;
161
}
162
return buffer_capacity;
163
}
164
165
/*
166
* Initialize GPGME.
167
*/
168
static bool init_gpgme(const char *seckey,
169
const char *pubkey, const char *tempdir){
93
170
gpgme_error_t rc;
94
ssize_t ret;
95
ssize_t new_packet_capacity = 0;
96
ssize_t new_packet_length = 0;
97
171
gpgme_engine_info_t engine_info;
98
99
if (debug){
100
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
172
173
174
/*
175
* Helper function to insert pub and seckey to the engine keyring.
176
*/
177
bool import_key(const char *filename){
178
int ret;
179
int fd;
180
gpgme_data_t pgp_data;
181
182
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
183
if(fd == -1){
184
perror("open");
185
return false;
186
}
187
188
rc = gpgme_data_new_from_fd(&pgp_data, fd);
189
if(rc != GPG_ERR_NO_ERROR){
190
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
191
gpgme_strsource(rc), gpgme_strerror(rc));
192
return false;
193
}
194
195
rc = gpgme_op_import(mc.ctx, pgp_data);
196
if(rc != GPG_ERR_NO_ERROR){
197
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
198
gpgme_strsource(rc), gpgme_strerror(rc));
199
return false;
200
}
201
202
ret = (int)TEMP_FAILURE_RETRY(close(fd));
203
if(ret == -1){
204
perror("close");
205
}
206
gpgme_data_release(pgp_data);
207
return true;
208
}
209
210
if(debug){
211
fprintf(stderr, "Initializing GPGME\n");
101
212
}
102
213
103
214
/* Init GPGME */
104
215
gpgme_check_version(NULL);
105
216
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
106
if (rc != GPG_ERR_NO_ERROR){
217
if(rc != GPG_ERR_NO_ERROR){
107
218
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
108
219
gpgme_strsource(rc), gpgme_strerror(rc));
109
return -1;
220
return false;
110
221
}
111
222
112
/* Set GPGME home directory */
113
rc = gpgme_get_engine_info (&engine_info);
114
if (rc != GPG_ERR_NO_ERROR){
223
/* Set GPGME home directory for the OpenPGP engine only */
224
rc = gpgme_get_engine_info(&engine_info);
225
if(rc != GPG_ERR_NO_ERROR){
115
226
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
116
227
gpgme_strsource(rc), gpgme_strerror(rc));
117
return -1;
228
return false;
118
229
}
119
230
while(engine_info != NULL){
120
231
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
121
232
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
122
engine_info->file_name, homedir);
233
engine_info->file_name, tempdir);
123
234
break;
124
235
}
125
236
engine_info = engine_info->next;
126
237
}
127
238
if(engine_info == NULL){
128
fprintf(stderr, "Could not set home dir to %s\n", homedir);
129
return -1;
130
}
131
132
/* Create new GPGME data buffer from packet buffer */
133
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
134
if (rc != GPG_ERR_NO_ERROR){
239
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
240
return false;
241
}
242
243
/* Create new GPGME "context" */
244
rc = gpgme_new(&(mc.ctx));
245
if(rc != GPG_ERR_NO_ERROR){
246
fprintf(stderr, "bad gpgme_new: %s: %s\n",
247
gpgme_strsource(rc), gpgme_strerror(rc));
248
return false;
249
}
250
251
if(not import_key(pubkey) or not import_key(seckey)){
252
return false;
253
}
254
255
return true;
256
}
257
258
/*
259
* Decrypt OpenPGP data.
260
* Returns -1 on error
261
*/
262
static ssize_t pgp_packet_decrypt(const char *cryptotext,
263
size_t crypto_size,
264
char **plaintext){
265
gpgme_data_t dh_crypto, dh_plain;
266
gpgme_error_t rc;
267
ssize_t ret;
268
size_t plaintext_capacity = 0;
269
ssize_t plaintext_length = 0;
270
271
if(debug){
272
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
273
}
274
275
/* Create new GPGME data buffer from memory cryptotext */
276
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
277
0);
278
if(rc != GPG_ERR_NO_ERROR){
135
279
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
136
280
gpgme_strsource(rc), gpgme_strerror(rc));
137
281
return -1;
139
283
140
284
/* Create new empty GPGME data buffer for the plaintext */
141
285
rc = gpgme_data_new(&dh_plain);
142
if (rc != GPG_ERR_NO_ERROR){
286
if(rc != GPG_ERR_NO_ERROR){
143
287
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
144
288
gpgme_strsource(rc), gpgme_strerror(rc));
145
return -1;
146
}
147
148
/* Create new GPGME "context" */
149
rc = gpgme_new(&ctx);
150
if (rc != GPG_ERR_NO_ERROR){
151
fprintf(stderr, "bad gpgme_new: %s: %s\n",
152
gpgme_strsource(rc), gpgme_strerror(rc));
153
return -1;
154
}
155
156
/* Decrypt data from the FILE pointer to the plaintext data
157
buffer */
158
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
159
if (rc != GPG_ERR_NO_ERROR){
289
gpgme_data_release(dh_crypto);
290
return -1;
291
}
292
293
/* Decrypt data from the cryptotext data buffer to the plaintext
294
data buffer */
295
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
296
if(rc != GPG_ERR_NO_ERROR){
160
297
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
161
298
gpgme_strsource(rc), gpgme_strerror(rc));
162
return -1;
163
}
164
165
if(debug){
166
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
167
}
168
169
if (debug){
170
gpgme_decrypt_result_t result;
171
result = gpgme_op_decrypt_result(ctx);
172
if (result == NULL){
173
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
174
} else {
175
fprintf(stderr, "Unsupported algorithm: %s\n",
176
result->unsupported_algorithm);
177
fprintf(stderr, "Wrong key usage: %d\n",
178
result->wrong_key_usage);
179
if(result->file_name != NULL){
180
fprintf(stderr, "File name: %s\n", result->file_name);
181
}
182
gpgme_recipient_t recipient;
183
recipient = result->recipients;
184
if(recipient){
299
plaintext_length = -1;
300
if(debug){
301
gpgme_decrypt_result_t result;
302
result = gpgme_op_decrypt_result(mc.ctx);
303
if(result == NULL){
304
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
305
} else {
306
fprintf(stderr, "Unsupported algorithm: %s\n",
307
result->unsupported_algorithm);
308
fprintf(stderr, "Wrong key usage: %u\n",
309
result->wrong_key_usage);
310
if(result->file_name != NULL){
311
fprintf(stderr, "File name: %s\n", result->file_name);
312
}
313
gpgme_recipient_t recipient;
314
recipient = result->recipients;
185
315
while(recipient != NULL){
186
316
fprintf(stderr, "Public key algorithm: %s\n",
187
317
gpgme_pubkey_algo_name(recipient->pubkey_algo));
193
323
}
194
324
}
195
325
}
326
goto decrypt_end;
196
327
}
197
328
198
/* Delete the GPGME FILE pointer cryptotext data buffer */
199
gpgme_data_release(dh_crypto);
329
if(debug){
330
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
331
}
200
332
201
333
/* Seek back to the beginning of the GPGME plaintext data buffer */
202
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
203
perror("pgpme_data_seek");
334
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
335
perror("gpgme_data_seek");
336
plaintext_length = -1;
337
goto decrypt_end;
204
338
}
205
339
206
*new_packet = 0;
340
*plaintext = NULL;
207
341
while(true){
208
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
209
*new_packet = realloc(*new_packet,
210
(unsigned int)new_packet_capacity
211
+ BUFFER_SIZE);
212
if (*new_packet == NULL){
213
perror("realloc");
214
return -1;
215
}
216
new_packet_capacity += BUFFER_SIZE;
342
plaintext_capacity = incbuffer(plaintext,
343
(size_t)plaintext_length,
344
plaintext_capacity);
345
if(plaintext_capacity == 0){
346
perror("incbuffer");
347
plaintext_length = -1;
348
goto decrypt_end;
217
349
}
218
350
219
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
351
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
220
352
BUFFER_SIZE);
221
353
/* Print the data, if any */
222
if (ret == 0){
354
if(ret == 0){
355
/* EOF */
223
356
break;
224
357
}
225
358
if(ret < 0){
226
359
perror("gpgme_data_read");
227
return -1;
228
}
229
new_packet_length += ret;
230
}
231
232
/* FIXME: check characters before printing to screen so to not print
233
terminal control characters */
234
/* if(debug){ */
235
/* fprintf(stderr, "decrypted password is: "); */
236
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
237
/* fprintf(stderr, "\n"); */
238
/* } */
360
plaintext_length = -1;
361
goto decrypt_end;
362
}
363
plaintext_length += ret;
364
}
365
366
if(debug){
367
fprintf(stderr, "Decrypted password is: ");
368
for(ssize_t i = 0; i < plaintext_length; i++){
369
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
370
}
371
fprintf(stderr, "\n");
372
}
373
374
decrypt_end:
375
376
/* Delete the GPGME cryptotext data buffer */
377
gpgme_data_release(dh_crypto);
239
378
240
379
/* Delete the GPGME plaintext data buffer */
241
380
gpgme_data_release(dh_plain);
242
return new_packet_length;
381
return plaintext_length;
243
382
}
244
383
245
static const char * safer_gnutls_strerror (int value) {
246
const char *ret = gnutls_strerror (value);
247
if (ret == NULL)
384
static const char * safer_gnutls_strerror(int value){
385
const char *ret = gnutls_strerror(value); /* Spurious warning from
386
-Wunreachable-code */
387
if(ret == NULL)
248
388
ret = "(unknown)";
249
389
return ret;
250
390
}
251
391
392
/* GnuTLS log function callback */
252
393
static void debuggnutls(__attribute__((unused)) int level,
253
394
const char* string){
254
fprintf(stderr, "%s", string);
395
fprintf(stderr, "GnuTLS: %s", string);
255
396
}
256
397
257
static int initgnutls(mandos_context *mc, gnutls_session_t *session,
258
gnutls_dh_params_t *dh_params){
259
const char *err;
398
static int init_gnutls_global(const char *pubkeyfilename,
399
const char *seckeyfilename){
260
400
int ret;
261
401
262
402
if(debug){
263
403
fprintf(stderr, "Initializing GnuTLS\n");
264
404
}
265
266
if ((ret = gnutls_global_init ())
267
!= GNUTLS_E_SUCCESS) {
268
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
405
406
ret = gnutls_global_init();
407
if(ret != GNUTLS_E_SUCCESS){
408
fprintf(stderr, "GnuTLS global_init: %s\n",
409
safer_gnutls_strerror(ret));
269
410
return -1;
270
411
}
271
412
272
if (debug){
413
if(debug){
414
/* "Use a log level over 10 to enable all debugging options."
415
* - GnuTLS manual
416
*/
273
417
gnutls_global_set_log_level(11);
274
418
gnutls_global_set_log_function(debuggnutls);
275
419
}
276
420
277
/* openpgp credentials */
278
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
279
!= GNUTLS_E_SUCCESS) {
280
fprintf (stderr, "memory error: %s\n",
281
safer_gnutls_strerror(ret));
421
/* OpenPGP credentials */
422
gnutls_certificate_allocate_credentials(&mc.cred);
423
if(ret != GNUTLS_E_SUCCESS){
424
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
425
from
426
-Wunreachable-code
427
*/
428
safer_gnutls_strerror(ret));
429
gnutls_global_deinit();
282
430
return -1;
283
431
}
284
432
285
433
if(debug){
286
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
287
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
288
seckeyfile);
434
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
435
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
436
seckeyfilename);
289
437
}
290
438
291
439
ret = gnutls_certificate_set_openpgp_key_file
292
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
293
if (ret != GNUTLS_E_SUCCESS) {
294
fprintf
295
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
296
" '%s')\n",
297
ret, pubkeyfile, seckeyfile);
298
fprintf(stdout, "The Error is: %s\n",
299
safer_gnutls_strerror(ret));
300
return -1;
301
}
302
303
//GnuTLS server initialization
304
if ((ret = gnutls_dh_params_init(dh_params))
305
!= GNUTLS_E_SUCCESS) {
306
fprintf (stderr, "Error in dh parameter initialization: %s\n",
307
safer_gnutls_strerror(ret));
308
return -1;
309
}
310
311
if ((ret = gnutls_dh_params_generate2(*dh_params, mc->dh_bits))
312
!= GNUTLS_E_SUCCESS) {
313
fprintf (stderr, "Error in prime generation: %s\n",
314
safer_gnutls_strerror(ret));
315
return -1;
316
}
317
318
gnutls_certificate_set_dh_params(mc->cred, *dh_params);
319
320
// GnuTLS session creation
321
if ((ret = gnutls_init(session, GNUTLS_SERVER))
322
!= GNUTLS_E_SUCCESS){
440
(mc.cred, pubkeyfilename, seckeyfilename,
441
GNUTLS_OPENPGP_FMT_BASE64);
442
if(ret != GNUTLS_E_SUCCESS){
443
fprintf(stderr,
444
"Error[%d] while reading the OpenPGP key pair ('%s',"
445
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
446
fprintf(stderr, "The GnuTLS error is: %s\n",
447
safer_gnutls_strerror(ret));
448
goto globalfail;
449
}
450
451
/* GnuTLS server initialization */
452
ret = gnutls_dh_params_init(&mc.dh_params);
453
if(ret != GNUTLS_E_SUCCESS){
454
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
455
" %s\n", safer_gnutls_strerror(ret));
456
goto globalfail;
457
}
458
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
459
if(ret != GNUTLS_E_SUCCESS){
460
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
461
safer_gnutls_strerror(ret));
462
goto globalfail;
463
}
464
465
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
466
467
return 0;
468
469
globalfail:
470
471
gnutls_certificate_free_credentials(mc.cred);
472
gnutls_global_deinit();
473
gnutls_dh_params_deinit(mc.dh_params);
474
return -1;
475
}
476
477
static int init_gnutls_session(gnutls_session_t *session){
478
int ret;
479
/* GnuTLS session creation */
480
do {
481
ret = gnutls_init(session, GNUTLS_SERVER);
482
if(quit_now){
483
return -1;
484
}
485
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
486
if(ret != GNUTLS_E_SUCCESS){
323
487
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
324
488
safer_gnutls_strerror(ret));
325
489
}
326
490
327
if ((ret = gnutls_priority_set_direct(*session, mc->priority, &err))
328
!= GNUTLS_E_SUCCESS) {
329
fprintf(stderr, "Syntax error at: %s\n", err);
330
fprintf(stderr, "GnuTLS error: %s\n",
331
safer_gnutls_strerror(ret));
332
return -1;
491
{
492
const char *err;
493
do {
494
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
495
if(quit_now){
496
gnutls_deinit(*session);
497
return -1;
498
}
499
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
500
if(ret != GNUTLS_E_SUCCESS){
501
fprintf(stderr, "Syntax error at: %s\n", err);
502
fprintf(stderr, "GnuTLS error: %s\n",
503
safer_gnutls_strerror(ret));
504
gnutls_deinit(*session);
505
return -1;
506
}
333
507
}
334
508
335
if ((ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
336
mc->cred))
337
!= GNUTLS_E_SUCCESS) {
338
fprintf(stderr, "Error setting a credentials set: %s\n",
509
do {
510
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
511
mc.cred);
512
if(quit_now){
513
gnutls_deinit(*session);
514
return -1;
515
}
516
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
517
if(ret != GNUTLS_E_SUCCESS){
518
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
339
519
safer_gnutls_strerror(ret));
520
gnutls_deinit(*session);
340
521
return -1;
341
522
}
342
523
343
524
/* ignore client certificate if any. */
344
gnutls_certificate_server_set_request (*session,
345
GNUTLS_CERT_IGNORE);
525
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
346
526
347
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
527
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
348
528
349
529
return 0;
350
530
}
351
531
532
/* Avahi log function callback */
352
533
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
353
534
__attribute__((unused)) const char *txt){}
354
535
536
/* Called when a Mandos server is found */
355
537
static int start_mandos_communication(const char *ip, uint16_t port,
356
538
AvahiIfIndex if_index,
357
mandos_context *mc){
358
int ret, tcp_sd;
359
struct sockaddr_in6 to;
539
int af){
540
int ret, tcp_sd = -1;
541
ssize_t sret;
542
union {
543
struct sockaddr_in in;
544
struct sockaddr_in6 in6;
545
} to;
360
546
char *buffer = NULL;
361
char *decrypted_buffer;
547
char *decrypted_buffer = NULL;
362
548
size_t buffer_length = 0;
363
549
size_t buffer_capacity = 0;
364
ssize_t decrypted_buffer_size;
365
size_t written = 0;
366
int retval = 0;
367
char interface[IF_NAMESIZE];
550
size_t written;
551
int retval = -1;
368
552
gnutls_session_t session;
369
gnutls_dh_params_t dh_params;
553
int pf; /* Protocol family */
554
555
if(quit_now){
556
return -1;
557
}
558
559
switch(af){
560
case AF_INET6:
561
pf = PF_INET6;
562
break;
563
case AF_INET:
564
pf = PF_INET;
565
break;
566
default:
567
fprintf(stderr, "Bad address family: %d\n", af);
568
return -1;
569
}
570
571
ret = init_gnutls_session(&session);
572
if(ret != 0){
573
return -1;
574
}
370
575
371
576
if(debug){
372
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
373
ip, port);
577
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
578
"\n", ip, port);
374
579
}
375
580
376
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
377
if(tcp_sd < 0) {
581
tcp_sd = socket(pf, SOCK_STREAM, 0);
582
if(tcp_sd < 0){
378
583
perror("socket");
379
return -1;
380
}
381
382
if(debug){
383
if(if_indextoname((unsigned int)if_index, interface) == NULL){
384
perror("if_indextoname");
385
return -1;
386
}
387
fprintf(stderr, "Binding to interface %s\n", interface);
388
}
389
390
memset(&to,0,sizeof(to)); /* Spurious warning */
391
to.sin6_family = AF_INET6;
392
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
393
if (ret < 0 ){
584
goto mandos_end;
585
}
586
587
if(quit_now){
588
goto mandos_end;
589
}
590
591
memset(&to, 0, sizeof(to));
592
if(af == AF_INET6){
593
to.in6.sin6_family = (sa_family_t)af;
594
ret = inet_pton(af, ip, &to.in6.sin6_addr);
595
} else { /* IPv4 */
596
to.in.sin_family = (sa_family_t)af;
597
ret = inet_pton(af, ip, &to.in.sin_addr);
598
}
599
if(ret < 0 ){
394
600
perror("inet_pton");
395
return -1;
601
goto mandos_end;
396
602
}
397
603
if(ret == 0){
398
604
fprintf(stderr, "Bad address: %s\n", ip);
399
return -1;
400
}
401
to.sin6_port = htons(port); /* Spurious warning */
605
goto mandos_end;
606
}
607
if(af == AF_INET6){
608
to.in6.sin6_port = htons(port); /* Spurious warnings from
609
-Wconversion and
610
-Wunreachable-code */
611
612
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
613
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
614
-Wunreachable-code*/
615
if(if_index == AVAHI_IF_UNSPEC){
616
fprintf(stderr, "An IPv6 link-local address is incomplete"
617
" without a network interface\n");
618
goto mandos_end;
619
}
620
/* Set the network interface number as scope */
621
to.in6.sin6_scope_id = (uint32_t)if_index;
622
}
623
} else {
624
to.in.sin_port = htons(port); /* Spurious warnings from
625
-Wconversion and
626
-Wunreachable-code */
627
}
402
628
403
to.sin6_scope_id = (uint32_t)if_index;
629
if(quit_now){
630
goto mandos_end;
631
}
404
632
405
633
if(debug){
406
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
407
char addrstr[INET6_ADDRSTRLEN] = "";
408
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
409
sizeof(addrstr)) == NULL){
634
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
635
char interface[IF_NAMESIZE];
636
if(if_indextoname((unsigned int)if_index, interface) == NULL){
637
perror("if_indextoname");
638
} else {
639
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
640
ip, interface, port);
641
}
642
} else {
643
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
644
port);
645
}
646
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
647
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
648
const char *pcret;
649
if(af == AF_INET6){
650
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
651
sizeof(addrstr));
652
} else {
653
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
654
sizeof(addrstr));
655
}
656
if(pcret == NULL){
410
657
perror("inet_ntop");
411
658
} else {
412
659
if(strcmp(addrstr, ip) != 0){
415
662
}
416
663
}
417
664
418
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
419
if (ret < 0){
665
if(quit_now){
666
goto mandos_end;
667
}
668
669
if(af == AF_INET6){
670
ret = connect(tcp_sd, &to.in6, sizeof(to));
671
} else {
672
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
673
}
674
if(ret < 0){
420
675
perror("connect");
421
return -1;
422
}
423
424
ret = initgnutls (mc, &session, &dh_params);
425
if (ret != 0){
426
retval = -1;
427
return -1;
428
}
429
430
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
676
goto mandos_end;
677
}
678
679
if(quit_now){
680
goto mandos_end;
681
}
682
683
const char *out = mandos_protocol_version;
684
written = 0;
685
while(true){
686
size_t out_size = strlen(out);
687
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
688
out_size - written));
689
if(ret == -1){
690
perror("write");
691
goto mandos_end;
692
}
693
written += (size_t)ret;
694
if(written < out_size){
695
continue;
696
} else {
697
if(out == mandos_protocol_version){
698
written = 0;
699
out = "\r\n";
700
} else {
701
break;
702
}
703
}
704
705
if(quit_now){
706
goto mandos_end;
707
}
708
}
431
709
432
710
if(debug){
433
711
fprintf(stderr, "Establishing TLS session with %s\n", ip);
434
712
}
435
713
436
ret = gnutls_handshake (session);
437
438
if (ret != GNUTLS_E_SUCCESS){
714
if(quit_now){
715
goto mandos_end;
716
}
717
718
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
719
720
if(quit_now){
721
goto mandos_end;
722
}
723
724
do {
725
ret = gnutls_handshake(session);
726
if(quit_now){
727
goto mandos_end;
728
}
729
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
730
731
if(ret != GNUTLS_E_SUCCESS){
439
732
if(debug){
440
fprintf(stderr, "\n*** Handshake failed ***\n");
441
gnutls_perror (ret);
733
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
734
gnutls_perror(ret);
442
735
}
443
retval = -1;
444
goto exit;
736
goto mandos_end;
445
737
}
446
738
447
//Retrieve OpenPGP packet that contains the wanted password
739
/* Read OpenPGP packet that contains the wanted password */
448
740
449
741
if(debug){
450
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
742
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
451
743
ip);
452
744
}
453
745
454
746
while(true){
455
if (buffer_length + BUFFER_SIZE > buffer_capacity){
456
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
457
if (buffer == NULL){
458
perror("realloc");
459
goto exit;
460
}
461
buffer_capacity += BUFFER_SIZE;
462
}
463
464
ret = gnutls_record_recv(session, buffer+buffer_length,
465
BUFFER_SIZE);
466
if (ret == 0){
747
748
if(quit_now){
749
goto mandos_end;
750
}
751
752
buffer_capacity = incbuffer(&buffer, buffer_length,
753
buffer_capacity);
754
if(buffer_capacity == 0){
755
perror("incbuffer");
756
goto mandos_end;
757
}
758
759
if(quit_now){
760
goto mandos_end;
761
}
762
763
sret = gnutls_record_recv(session, buffer+buffer_length,
764
BUFFER_SIZE);
765
if(sret == 0){
467
766
break;
468
767
}
469
if (ret < 0){
470
switch(ret){
768
if(sret < 0){
769
switch(sret){
471
770
case GNUTLS_E_INTERRUPTED:
472
771
case GNUTLS_E_AGAIN:
473
772
break;
474
773
case GNUTLS_E_REHANDSHAKE:
475
ret = gnutls_handshake (session);
476
if (ret < 0){
477
fprintf(stderr, "\n*** Handshake failed ***\n");
478
gnutls_perror (ret);
479
retval = -1;
480
goto exit;
774
do {
775
ret = gnutls_handshake(session);
776
777
if(quit_now){
778
goto mandos_end;
779
}
780
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
781
if(ret < 0){
782
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
783
gnutls_perror(ret);
784
goto mandos_end;
481
785
}
482
786
break;
483
787
default:
484
788
fprintf(stderr, "Unknown error while reading data from"
485
" encrypted session with mandos server\n");
486
retval = -1;
487
gnutls_bye (session, GNUTLS_SHUT_RDWR);
488
goto exit;
789
" encrypted session with Mandos server\n");
790
gnutls_bye(session, GNUTLS_SHUT_RDWR);
791
goto mandos_end;
489
792
}
490
793
} else {
491
buffer_length += (size_t) ret;
492
}
493
}
494
495
if (buffer_length > 0){
794
buffer_length += (size_t) sret;
795
}
796
}
797
798
if(debug){
799
fprintf(stderr, "Closing TLS session\n");
800
}
801
802
if(quit_now){
803
goto mandos_end;
804
}
805
806
do {
807
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
808
if(quit_now){
809
goto mandos_end;
810
}
811
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
812
813
if(buffer_length > 0){
814
ssize_t decrypted_buffer_size;
496
815
decrypted_buffer_size = pgp_packet_decrypt(buffer,
497
816
buffer_length,
498
&decrypted_buffer,
499
keydir);
500
if (decrypted_buffer_size >= 0){
817
&decrypted_buffer);
818
if(decrypted_buffer_size >= 0){
819
820
written = 0;
501
821
while(written < (size_t) decrypted_buffer_size){
502
ret = (int)fwrite (decrypted_buffer + written, 1,
503
(size_t)decrypted_buffer_size - written,
504
stdout);
822
if(quit_now){
823
goto mandos_end;
824
}
825
826
ret = (int)fwrite(decrypted_buffer + written, 1,
827
(size_t)decrypted_buffer_size - written,
828
stdout);
505
829
if(ret == 0 and ferror(stdout)){
506
830
if(debug){
507
831
fprintf(stderr, "Error writing encrypted data: %s\n",
508
832
strerror(errno));
509
833
}
510
retval = -1;
511
break;
834
goto mandos_end;
512
835
}
513
836
written += (size_t)ret;
514
837
}
515
free(decrypted_buffer);
516
} else {
517
retval = -1;
838
retval = 0;
518
839
}
519
840
}
520
521
//shutdown procedure
522
523
if(debug){
524
fprintf(stderr, "Closing TLS session\n");
525
}
526
841
842
/* Shutdown procedure */
843
844
mandos_end:
845
free(decrypted_buffer);
527
846
free(buffer);
528
gnutls_bye (session, GNUTLS_SHUT_RDWR);
529
exit:
530
close(tcp_sd);
531
gnutls_deinit (session);
532
gnutls_certificate_free_credentials (mc->cred);
533
gnutls_global_deinit ();
847
if(tcp_sd >= 0){
848
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
849
}
850
if(ret == -1){
851
perror("close");
852
}
853
gnutls_deinit(session);
854
if(quit_now){
855
retval = -1;
856
}
534
857
return retval;
535
858
}
536
859
537
static void resolve_callback( AvahiSServiceResolver *r,
538
AvahiIfIndex interface,
539
AVAHI_GCC_UNUSED AvahiProtocol protocol,
540
AvahiResolverEvent event,
541
const char *name,
542
const char *type,
543
const char *domain,
544
const char *host_name,
545
const AvahiAddress *address,
546
uint16_t port,
547
AVAHI_GCC_UNUSED AvahiStringList *txt,
548
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
549
void* userdata) {
550
mandos_context *mc = userdata;
551
assert(r); /* Spurious warning */
860
static void resolve_callback(AvahiSServiceResolver *r,
861
AvahiIfIndex interface,
862
AvahiProtocol proto,
863
AvahiResolverEvent event,
864
const char *name,
865
const char *type,
866
const char *domain,
867
const char *host_name,
868
const AvahiAddress *address,
869
uint16_t port,
870
AVAHI_GCC_UNUSED AvahiStringList *txt,
871
AVAHI_GCC_UNUSED AvahiLookupResultFlags
872
flags,
873
AVAHI_GCC_UNUSED void* userdata){
874
assert(r);
552
875
553
876
/* Called whenever a service has been resolved successfully or
554
877
timed out */
555
878
556
switch (event) {
879
if(quit_now){
880
return;
881
}
882
883
switch(event){
557
884
default:
558
885
case AVAHI_RESOLVER_FAILURE:
559
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
560
" type '%s' in domain '%s': %s\n", name, type, domain,
561
avahi_strerror(avahi_server_errno(mc->server)));
886
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
887
" of type '%s' in domain '%s': %s\n", name, type, domain,
888
avahi_strerror(avahi_server_errno(mc.server)));
562
889
break;
563
890
564
891
case AVAHI_RESOLVER_FOUND:
566
893
char ip[AVAHI_ADDRESS_STR_MAX];
567
894
avahi_address_snprint(ip, sizeof(ip), address);
568
895
if(debug){
569
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
570
" port %d\n", name, host_name, ip, port);
896
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
897
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
898
ip, (intmax_t)interface, port);
571
899
}
572
int ret = start_mandos_communication(ip, port, interface, mc);
573
if (ret == 0){
574
exit(EXIT_SUCCESS);
900
int ret = start_mandos_communication(ip, port, interface,
901
avahi_proto_to_af(proto));
902
if(ret == 0){
903
avahi_simple_poll_quit(mc.simple_poll);
575
904
}
576
905
}
577
906
}
578
907
avahi_s_service_resolver_free(r);
579
908
}
580
909
581
static void browse_callback( AvahiSServiceBrowser *b,
582
AvahiIfIndex interface,
583
AvahiProtocol protocol,
584
AvahiBrowserEvent event,
585
const char *name,
586
const char *type,
587
const char *domain,
588
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
589
void* userdata) {
590
mandos_context *mc = userdata;
591
assert(b); /* Spurious warning */
910
static void browse_callback(AvahiSServiceBrowser *b,
911
AvahiIfIndex interface,
912
AvahiProtocol protocol,
913
AvahiBrowserEvent event,
914
const char *name,
915
const char *type,
916
const char *domain,
917
AVAHI_GCC_UNUSED AvahiLookupResultFlags
918
flags,
919
AVAHI_GCC_UNUSED void* userdata){
920
assert(b);
592
921
593
922
/* Called whenever a new services becomes available on the LAN or
594
923
is removed from the LAN */
595
924
596
switch (event) {
925
if(quit_now){
926
return;
927
}
928
929
switch(event){
597
930
default:
598
931
case AVAHI_BROWSER_FAILURE:
599
932
600
fprintf(stderr, "(Browser) %s\n",
601
avahi_strerror(avahi_server_errno(mc->server)));
602
avahi_simple_poll_quit(mc->simple_poll);
933
fprintf(stderr, "(Avahi browser) %s\n",
934
avahi_strerror(avahi_server_errno(mc.server)));
935
avahi_simple_poll_quit(mc.simple_poll);
603
936
return;
604
937
605
938
case AVAHI_BROWSER_NEW:
606
/* We ignore the returned resolver object. In the callback
607
function we free it. If the server is terminated before
608
the callback function is called the server will free
609
the resolver for us. */
939
/* We ignore the returned Avahi resolver object. In the callback
940
function we free it. If the Avahi server is terminated before
941
the callback function is called the Avahi server will free the
942
resolver for us. */
610
943
611
if (!(avahi_s_service_resolver_new(mc->server, interface, protocol, name,
612
type, domain,
613
AVAHI_PROTO_INET6, 0,
614
resolve_callback, mc)))
615
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
616
avahi_strerror(avahi_server_errno(mc->server)));
944
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
945
name, type, domain, protocol, 0,
946
resolve_callback, NULL) == NULL)
947
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
948
name, avahi_strerror(avahi_server_errno(mc.server)));
617
949
break;
618
950
619
951
case AVAHI_BROWSER_REMOVE:
621
953
622
954
case AVAHI_BROWSER_ALL_FOR_NOW:
623
955
case AVAHI_BROWSER_CACHE_EXHAUSTED:
956
if(debug){
957
fprintf(stderr, "No Mandos server found, still searching...\n");
958
}
624
959
break;
625
960
}
626
961
}
627
962
628
/* Combines file name and path and returns the malloced new
629
string. some sane checks could/should be added */
630
static const char *combinepath(const char *first, const char *second){
631
size_t f_len = strlen(first);
632
size_t s_len = strlen(second);
633
char *tmp = malloc(f_len + s_len + 2);
634
if (tmp == NULL){
635
return NULL;
636
}
637
if(f_len > 0){
638
memcpy(tmp, first, f_len); /* Spurious warning */
639
}
640
tmp[f_len] = '/';
641
if(s_len > 0){
642
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
643
}
644
tmp[f_len + 1 + s_len] = '\0';
645
return tmp;
963
/* stop main loop after sigterm has been called */
964
static void handle_sigterm(int sig){
965
if(quit_now){
966
return;
967
}
968
quit_now = 1;
969
signal_received = sig;
970
int old_errno = errno;
971
if(mc.simple_poll != NULL){
972
avahi_simple_poll_quit(mc.simple_poll);
973
}
974
errno = old_errno;
646
975
}
647
976
648
649
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
650
AvahiServerConfig config;
651
AvahiSServiceBrowser *sb = NULL;
652
int error;
653
int ret;
654
int debug_int;
655
int returncode = EXIT_SUCCESS;
656
const char *interface = "eth0";
657
struct ifreq network;
658
int sd;
659
char *connect_to = NULL;
660
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
661
mandos_context mc = { .simple_poll = NULL, .server = NULL,
662
.dh_bits = 1024, .priority = "SECURE256"};
977
int main(int argc, char *argv[]){
978
AvahiSServiceBrowser *sb = NULL;
979
int error;
980
int ret;
981
intmax_t tmpmax;
982
char *tmp;
983
int exitcode = EXIT_SUCCESS;
984
const char *interface = "eth0";
985
struct ifreq network;
986
int sd = -1;
987
bool take_down_interface = false;
988
uid_t uid;
989
gid_t gid;
990
char *connect_to = NULL;
991
char tempdir[] = "/tmp/mandosXXXXXX";
992
bool tempdir_created = false;
993
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
994
const char *seckey = PATHDIR "/" SECKEY;
995
const char *pubkey = PATHDIR "/" PUBKEY;
996
997
bool gnutls_initialized = false;
998
bool gpgme_initialized = false;
999
float delay = 2.5f;
1000
1001
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1002
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1003
1004
uid = getuid();
1005
gid = getgid();
1006
1007
/* Lower any group privileges we might have, just to be safe */
1008
errno = 0;
1009
ret = setgid(gid);
1010
if(ret == -1){
1011
perror("setgid");
1012
}
1013
1014
/* Lower user privileges (temporarily) */
1015
errno = 0;
1016
ret = seteuid(uid);
1017
if(ret == -1){
1018
perror("seteuid");
1019
}
1020
1021
if(quit_now){
1022
goto end;
1023
}
1024
1025
{
1026
struct argp_option options[] = {
1027
{ .name = "debug", .key = 128,
1028
.doc = "Debug mode", .group = 3 },
1029
{ .name = "connect", .key = 'c',
1030
.arg = "ADDRESS:PORT",
1031
.doc = "Connect directly to a specific Mandos server",
1032
.group = 1 },
1033
{ .name = "interface", .key = 'i',
1034
.arg = "NAME",
1035
.doc = "Network interface that will be used to search for"
1036
" Mandos servers",
1037
.group = 1 },
1038
{ .name = "seckey", .key = 's',
1039
.arg = "FILE",
1040
.doc = "OpenPGP secret key file base name",
1041
.group = 1 },
1042
{ .name = "pubkey", .key = 'p',
1043
.arg = "FILE",
1044
.doc = "OpenPGP public key file base name",
1045
.group = 2 },
1046
{ .name = "dh-bits", .key = 129,
1047
.arg = "BITS",
1048
.doc = "Bit length of the prime number used in the"
1049
" Diffie-Hellman key exchange",
1050
.group = 2 },
1051
{ .name = "priority", .key = 130,
1052
.arg = "STRING",
1053
.doc = "GnuTLS priority string for the TLS handshake",
1054
.group = 1 },
1055
{ .name = "delay", .key = 131,
1056
.arg = "SECONDS",
1057
.doc = "Maximum delay to wait for interface startup",
1058
.group = 2 },
1059
{ .name = NULL }
1060
};
663
1061
664
debug_int = debug ? 1 : 0;
665
while (true){
666
struct option long_options[] = {
667
{"debug", no_argument, &debug_int, 1},
668
{"connect", required_argument, NULL, 'c'},
669
{"interface", required_argument, NULL, 'i'},
670
{"keydir", required_argument, NULL, 'd'},
671
{"seckey", required_argument, NULL, 's'},
672
{"pubkey", required_argument, NULL, 'p'},
673
{"dh-bits", required_argument, NULL, 'D'},
674
{"priority", required_argument, NULL, 'P'},
675
{0, 0, 0, 0} };
676
677
int option_index = 0;
678
ret = getopt_long (argc, argv, "i:", long_options,
679
&option_index);
680
681
if (ret == -1){
682
break;
683
}
684
685
switch(ret){
686
case 0:
687
break;
688
case 'i':
689
interface = optarg;
690
break;
691
case 'c':
692
connect_to = optarg;
693
break;
694
case 'd':
695
keydir = optarg;
696
break;
697
case 'p':
698
pubkeyfile = optarg;
699
break;
700
case 's':
701
seckeyfile = optarg;
702
break;
703
case 'D':
704
errno = 0;
705
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
706
if (errno){
707
perror("strtol");
708
exit(EXIT_FAILURE);
709
}
710
break;
711
case 'P':
712
mc.priority = optarg;
713
break;
714
case '?':
1062
error_t parse_opt(int key, char *arg,
1063
struct argp_state *state){
1064
switch(key){
1065
case 128: /* --debug */
1066
debug = true;
1067
break;
1068
case 'c': /* --connect */
1069
connect_to = arg;
1070
break;
1071
case 'i': /* --interface */
1072
interface = arg;
1073
break;
1074
case 's': /* --seckey */
1075
seckey = arg;
1076
break;
1077
case 'p': /* --pubkey */
1078
pubkey = arg;
1079
break;
1080
case 129: /* --dh-bits */
1081
errno = 0;
1082
tmpmax = strtoimax(arg, &tmp, 10);
1083
if(errno != 0 or tmp == arg or *tmp != '\0'
1084
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1085
fprintf(stderr, "Bad number of DH bits\n");
1086
exit(EXIT_FAILURE);
1087
}
1088
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1089
break;
1090
case 130: /* --priority */
1091
mc.priority = arg;
1092
break;
1093
case 131: /* --delay */
1094
errno = 0;
1095
delay = strtof(arg, &tmp);
1096
if(errno != 0 or tmp == arg or *tmp != '\0'){
1097
fprintf(stderr, "Bad delay\n");
1098
exit(EXIT_FAILURE);
1099
}
1100
break;
1101
case ARGP_KEY_ARG:
1102
argp_usage(state);
1103
case ARGP_KEY_END:
1104
break;
715
1105
default:
716
exit(EXIT_FAILURE);
1106
return ARGP_ERR_UNKNOWN;
717
1107
}
718
}
719
debug = debug_int ? true : false;
720
721
pubkeyfile = combinepath(keydir, pubkeyfile);
722
if (pubkeyfile == NULL){
723
perror("combinepath");
724
returncode = EXIT_FAILURE;
725
goto exit;
726
}
727
728
seckeyfile = combinepath(keydir, seckeyfile);
729
if (seckeyfile == NULL){
730
perror("combinepath");
731
goto exit;
732
}
733
1108
return 0;
1109
}
1110
1111
struct argp argp = { .options = options, .parser = parse_opt,
1112
.args_doc = "",
1113
.doc = "Mandos client -- Get and decrypt"
1114
" passwords from a Mandos server" };
1115
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1116
if(ret == ARGP_ERR_UNKNOWN){
1117
fprintf(stderr, "Unknown error while parsing arguments\n");
1118
exitcode = EXIT_FAILURE;
1119
goto end;
1120
}
1121
}
1122
1123
if(not debug){
1124
avahi_set_log_function(empty_log);
1125
}
1126
1127
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1128
from the signal handler */
1129
/* Initialize the pseudo-RNG for Avahi */
1130
srand((unsigned int) time(NULL));
1131
mc.simple_poll = avahi_simple_poll_new();
1132
if(mc.simple_poll == NULL){
1133
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1134
exitcode = EXIT_FAILURE;
1135
goto end;
1136
}
1137
1138
sigemptyset(&sigterm_action.sa_mask);
1139
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1140
if(ret == -1){
1141
perror("sigaddset");
1142
exitcode = EXIT_FAILURE;
1143
goto end;
1144
}
1145
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1146
if(ret == -1){
1147
perror("sigaddset");
1148
exitcode = EXIT_FAILURE;
1149
goto end;
1150
}
1151
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1152
if(ret == -1){
1153
perror("sigaddset");
1154
exitcode = EXIT_FAILURE;
1155
goto end;
1156
}
1157
/* Need to check if the handler is SIG_IGN before handling:
1158
| [[info:libc:Initial Signal Actions]] |
1159
| [[info:libc:Basic Signal Handling]] |
1160
*/
1161
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1162
if(ret == -1){
1163
perror("sigaction");
1164
return EXIT_FAILURE;
1165
}
1166
if(old_sigterm_action.sa_handler != SIG_IGN){
1167
ret = sigaction(SIGINT, &sigterm_action, NULL);
1168
if(ret == -1){
1169
perror("sigaction");
1170
exitcode = EXIT_FAILURE;
1171
goto end;
1172
}
1173
}
1174
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1175
if(ret == -1){
1176
perror("sigaction");
1177
return EXIT_FAILURE;
1178
}
1179
if(old_sigterm_action.sa_handler != SIG_IGN){
1180
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1181
if(ret == -1){
1182
perror("sigaction");
1183
exitcode = EXIT_FAILURE;
1184
goto end;
1185
}
1186
}
1187
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1188
if(ret == -1){
1189
perror("sigaction");
1190
return EXIT_FAILURE;
1191
}
1192
if(old_sigterm_action.sa_handler != SIG_IGN){
1193
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1194
if(ret == -1){
1195
perror("sigaction");
1196
exitcode = EXIT_FAILURE;
1197
goto end;
1198
}
1199
}
1200
1201
/* If the interface is down, bring it up */
1202
if(interface[0] != '\0'){
734
1203
if_index = (AvahiIfIndex) if_nametoindex(interface);
735
1204
if(if_index == 0){
736
1205
fprintf(stderr, "No such interface: \"%s\"\n", interface);
737
exit(EXIT_FAILURE);
738
}
739
740
if(connect_to != NULL){
741
/* Connect directly, do not use Zeroconf */
742
/* (Mainly meant for debugging) */
743
char *address = strrchr(connect_to, ':');
744
if(address == NULL){
745
fprintf(stderr, "No colon in address\n");
746
exit(EXIT_FAILURE);
747
}
748
errno = 0;
749
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
750
if(errno){
751
perror("Bad port number");
752
exit(EXIT_FAILURE);
753
}
754
*address = '\0';
755
address = connect_to;
756
ret = start_mandos_communication(address, port, if_index, &mc);
757
if(ret < 0){
758
exit(EXIT_FAILURE);
759
} else {
760
exit(EXIT_SUCCESS);
761
}
762
}
1206
exitcode = EXIT_FAILURE;
1207
goto end;
1208
}
1209
1210
if(quit_now){
1211
goto end;
1212
}
1213
1214
/* Re-raise priviliges */
1215
errno = 0;
1216
ret = seteuid(0);
1217
if(ret == -1){
1218
perror("seteuid");
1219
}
1220
1221
#ifdef __linux__
1222
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1223
messages to mess up the prompt */
1224
ret = klogctl(8, NULL, 5);
1225
bool restore_loglevel = true;
1226
if(ret == -1){
1227
restore_loglevel = false;
1228
perror("klogctl");
1229
}
1230
#endif /* __linux__ */
763
1231
764
1232
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
765
if(sd < 0) {
1233
if(sd < 0){
766
1234
perror("socket");
767
returncode = EXIT_FAILURE;
768
goto exit;
1235
exitcode = EXIT_FAILURE;
1236
#ifdef __linux__
1237
if(restore_loglevel){
1238
ret = klogctl(7, NULL, 0);
1239
if(ret == -1){
1240
perror("klogctl");
1241
}
1242
}
1243
#endif /* __linux__ */
1244
/* Lower privileges */
1245
errno = 0;
1246
ret = seteuid(uid);
1247
if(ret == -1){
1248
perror("seteuid");
1249
}
1250
goto end;
769
1251
}
770
strcpy(network.ifr_name, interface); /* Spurious warning */
1252
strcpy(network.ifr_name, interface);
771
1253
ret = ioctl(sd, SIOCGIFFLAGS, &network);
772
1254
if(ret == -1){
773
774
1255
perror("ioctl SIOCGIFFLAGS");
775
returncode = EXIT_FAILURE;
776
goto exit;
1256
#ifdef __linux__
1257
if(restore_loglevel){
1258
ret = klogctl(7, NULL, 0);
1259
if(ret == -1){
1260
perror("klogctl");
1261
}
1262
}
1263
#endif /* __linux__ */
1264
exitcode = EXIT_FAILURE;
1265
/* Lower privileges */
1266
errno = 0;
1267
ret = seteuid(uid);
1268
if(ret == -1){
1269
perror("seteuid");
1270
}
1271
goto end;
777
1272
}
778
1273
if((network.ifr_flags & IFF_UP) == 0){
779
1274
network.ifr_flags |= IFF_UP;
1275
take_down_interface = true;
780
1276
ret = ioctl(sd, SIOCSIFFLAGS, &network);
781
1277
if(ret == -1){
1278
take_down_interface = false;
782
1279
perror("ioctl SIOCSIFFLAGS");
783
returncode = EXIT_FAILURE;
784
goto exit;
785
}
786
}
787
close(sd);
788
789
if (not debug){
790
avahi_set_log_function(empty_log);
791
}
792
793
/* Initialize the psuedo-RNG */
794
srand((unsigned int) time(NULL));
795
796
/* Allocate main loop object */
797
if (!(mc.simple_poll = avahi_simple_poll_new())) {
798
fprintf(stderr, "Failed to create simple poll object.\n");
799
returncode = EXIT_FAILURE;
800
goto exit;
801
}
802
803
/* Do not publish any local records */
1280
exitcode = EXIT_FAILURE;
1281
#ifdef __linux__
1282
if(restore_loglevel){
1283
ret = klogctl(7, NULL, 0);
1284
if(ret == -1){
1285
perror("klogctl");
1286
}
1287
}
1288
#endif /* __linux__ */
1289
/* Lower privileges */
1290
errno = 0;
1291
ret = seteuid(uid);
1292
if(ret == -1){
1293
perror("seteuid");
1294
}
1295
goto end;
1296
}
1297
}
1298
/* sleep checking until interface is running */
1299
for(int i=0; i < delay * 4; i++){
1300
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1301
if(ret == -1){
1302
perror("ioctl SIOCGIFFLAGS");
1303
} else if(network.ifr_flags & IFF_RUNNING){
1304
break;
1305
}
1306
struct timespec sleeptime = { .tv_nsec = 250000000 };
1307
ret = nanosleep(&sleeptime, NULL);
1308
if(ret == -1 and errno != EINTR){
1309
perror("nanosleep");
1310
}
1311
}
1312
if(not take_down_interface){
1313
/* We won't need the socket anymore */
1314
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1315
if(ret == -1){
1316
perror("close");
1317
}
1318
}
1319
#ifdef __linux__
1320
if(restore_loglevel){
1321
/* Restores kernel loglevel to default */
1322
ret = klogctl(7, NULL, 0);
1323
if(ret == -1){
1324
perror("klogctl");
1325
}
1326
}
1327
#endif /* __linux__ */
1328
/* Lower privileges */
1329
errno = 0;
1330
if(take_down_interface){
1331
/* Lower privileges */
1332
ret = seteuid(uid);
1333
if(ret == -1){
1334
perror("seteuid");
1335
}
1336
} else {
1337
/* Lower privileges permanently */
1338
ret = setuid(uid);
1339
if(ret == -1){
1340
perror("setuid");
1341
}
1342
}
1343
}
1344
1345
if(quit_now){
1346
goto end;
1347
}
1348
1349
ret = init_gnutls_global(pubkey, seckey);
1350
if(ret == -1){
1351
fprintf(stderr, "init_gnutls_global failed\n");
1352
exitcode = EXIT_FAILURE;
1353
goto end;
1354
} else {
1355
gnutls_initialized = true;
1356
}
1357
1358
if(quit_now){
1359
goto end;
1360
}
1361
1362
tempdir_created = true;
1363
if(mkdtemp(tempdir) == NULL){
1364
tempdir_created = false;
1365
perror("mkdtemp");
1366
goto end;
1367
}
1368
1369
if(quit_now){
1370
goto end;
1371
}
1372
1373
if(not init_gpgme(pubkey, seckey, tempdir)){
1374
fprintf(stderr, "init_gpgme failed\n");
1375
exitcode = EXIT_FAILURE;
1376
goto end;
1377
} else {
1378
gpgme_initialized = true;
1379
}
1380
1381
if(quit_now){
1382
goto end;
1383
}
1384
1385
if(connect_to != NULL){
1386
/* Connect directly, do not use Zeroconf */
1387
/* (Mainly meant for debugging) */
1388
char *address = strrchr(connect_to, ':');
1389
if(address == NULL){
1390
fprintf(stderr, "No colon in address\n");
1391
exitcode = EXIT_FAILURE;
1392
goto end;
1393
}
1394
1395
if(quit_now){
1396
goto end;
1397
}
1398
1399
uint16_t port;
1400
errno = 0;
1401
tmpmax = strtoimax(address+1, &tmp, 10);
1402
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1403
or tmpmax != (uint16_t)tmpmax){
1404
fprintf(stderr, "Bad port number\n");
1405
exitcode = EXIT_FAILURE;
1406
goto end;
1407
}
1408
1409
if(quit_now){
1410
goto end;
1411
}
1412
1413
port = (uint16_t)tmpmax;
1414
*address = '\0';
1415
address = connect_to;
1416
/* Colon in address indicates IPv6 */
1417
int af;
1418
if(strchr(address, ':') != NULL){
1419
af = AF_INET6;
1420
} else {
1421
af = AF_INET;
1422
}
1423
1424
if(quit_now){
1425
goto end;
1426
}
1427
1428
ret = start_mandos_communication(address, port, if_index, af);
1429
if(ret < 0){
1430
exitcode = EXIT_FAILURE;
1431
} else {
1432
exitcode = EXIT_SUCCESS;
1433
}
1434
goto end;
1435
}
1436
1437
if(quit_now){
1438
goto end;
1439
}
1440
1441
{
1442
AvahiServerConfig config;
1443
/* Do not publish any local Zeroconf records */
804
1444
avahi_server_config_init(&config);
805
1445
config.publish_hinfo = 0;
806
1446
config.publish_addresses = 0;
807
1447
config.publish_workstation = 0;
808
1448
config.publish_domain = 0;
809
1449
810
1450
/* Allocate a new server */
811
mc.server=avahi_server_new(avahi_simple_poll_get(mc.simple_poll),
812
&config, NULL, NULL, &error);
1451
mc.server = avahi_server_new(avahi_simple_poll_get
1452
(mc.simple_poll), &config, NULL,
1453
NULL, &error);
813
1454
814
/* Free the configuration data */
1455
/* Free the Avahi configuration data */
815
1456
avahi_server_config_free(&config);
816
817
/* Check if creating the server object succeeded */
818
if (!mc.server) {
819
fprintf(stderr, "Failed to create server: %s\n",
820
avahi_strerror(error));
821
returncode = EXIT_FAILURE;
822
goto exit;
823
}
824
825
/* Create the service browser */
826
sb = avahi_s_service_browser_new(mc.server, if_index,
827
AVAHI_PROTO_INET6,
828
"_mandos._tcp", NULL, 0,
829
browse_callback, &mc);
830
if (!sb) {
831
fprintf(stderr, "Failed to create service browser: %s\n",
832
avahi_strerror(avahi_server_errno(mc.server)));
833
returncode = EXIT_FAILURE;
834
goto exit;
835
}
836
837
/* Run the main loop */
838
839
if (debug){
840
fprintf(stderr, "Starting avahi loop search\n");
841
}
842
843
avahi_simple_poll_loop(mc.simple_poll);
844
845
exit:
846
847
if (debug){
848
fprintf(stderr, "%s exiting\n", argv[0]);
849
}
850
851
/* Cleanup things */
852
if (sb)
853
avahi_s_service_browser_free(sb);
854
855
if (mc.server)
856
avahi_server_free(mc.server);
857
858
if (mc.simple_poll)
859
avahi_simple_poll_free(mc.simple_poll);
860
free(pubkeyfile);
861
free(seckeyfile);
862
863
return returncode;
1457
}
1458
1459
/* Check if creating the Avahi server object succeeded */
1460
if(mc.server == NULL){
1461
fprintf(stderr, "Failed to create Avahi server: %s\n",
1462
avahi_strerror(error));
1463
exitcode = EXIT_FAILURE;
1464
goto end;
1465
}
1466
1467
if(quit_now){
1468
goto end;
1469
}
1470
1471
/* Create the Avahi service browser */
1472
sb = avahi_s_service_browser_new(mc.server, if_index,
1473
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1474
NULL, 0, browse_callback, NULL);
1475
if(sb == NULL){
1476
fprintf(stderr, "Failed to create service browser: %s\n",
1477
avahi_strerror(avahi_server_errno(mc.server)));
1478
exitcode = EXIT_FAILURE;
1479
goto end;
1480
}
1481
1482
if(quit_now){
1483
goto end;
1484
}
1485
1486
/* Run the main loop */
1487
1488
if(debug){
1489
fprintf(stderr, "Starting Avahi loop search\n");
1490
}
1491
1492
avahi_simple_poll_loop(mc.simple_poll);
1493
1494
end:
1495
1496
if(debug){
1497
fprintf(stderr, "%s exiting\n", argv[0]);
1498
}
1499
1500
/* Cleanup things */
1501
if(sb != NULL)
1502
avahi_s_service_browser_free(sb);
1503
1504
if(mc.server != NULL)
1505
avahi_server_free(mc.server);
1506
1507
if(mc.simple_poll != NULL)
1508
avahi_simple_poll_free(mc.simple_poll);
1509
1510
if(gnutls_initialized){
1511
gnutls_certificate_free_credentials(mc.cred);
1512
gnutls_global_deinit();
1513
gnutls_dh_params_deinit(mc.dh_params);
1514
}
1515
1516
if(gpgme_initialized){
1517
gpgme_release(mc.ctx);
1518
}
1519
1520
/* Take down the network interface */
1521
if(take_down_interface){
1522
/* Re-raise priviliges */
1523
errno = 0;
1524
ret = seteuid(0);
1525
if(ret == -1){
1526
perror("seteuid");
1527
}
1528
if(geteuid() == 0){
1529
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1530
if(ret == -1){
1531
perror("ioctl SIOCGIFFLAGS");
1532
} else if(network.ifr_flags & IFF_UP) {
1533
network.ifr_flags &= ~IFF_UP; /* clear flag */
1534
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1535
if(ret == -1){
1536
perror("ioctl SIOCSIFFLAGS");
1537
}
1538
}
1539
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1540
if(ret == -1){
1541
perror("close");
1542
}
1543
/* Lower privileges permanently */
1544
errno = 0;
1545
ret = setuid(uid);
1546
if(ret == -1){
1547
perror("setuid");
1548
}
1549
}
1550
}
1551
1552
/* Removes the temp directory used by GPGME */
1553
if(tempdir_created){
1554
DIR *d;
1555
struct dirent *direntry;
1556
d = opendir(tempdir);
1557
if(d == NULL){
1558
if(errno != ENOENT){
1559
perror("opendir");
1560
}
1561
} else {
1562
while(true){
1563
direntry = readdir(d);
1564
if(direntry == NULL){
1565
break;
1566
}
1567
/* Skip "." and ".." */
1568
if(direntry->d_name[0] == '.'
1569
and (direntry->d_name[1] == '\0'
1570
or (direntry->d_name[1] == '.'
1571
and direntry->d_name[2] == '\0'))){
1572
continue;
1573
}
1574
char *fullname = NULL;
1575
ret = asprintf(&fullname, "%s/%s", tempdir,
1576
direntry->d_name);
1577
if(ret < 0){
1578
perror("asprintf");
1579
continue;
1580
}
1581
ret = remove(fullname);
1582
if(ret == -1){
1583
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1584
strerror(errno));
1585
}
1586
free(fullname);
1587
}
1588
closedir(d);
1589
}
1590
ret = rmdir(tempdir);
1591
if(ret == -1 and errno != ENOENT){
1592
perror("rmdir");
1593
}
1594
}
1595
1596
if(quit_now){
1597
sigemptyset(&old_sigterm_action.sa_mask);
1598
old_sigterm_action.sa_handler = SIG_DFL;
1599
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1600
&old_sigterm_action,
1601
NULL));
1602
if(ret == -1){
1603
perror("sigaction");
1604
}
1605
do {
1606
ret = raise(signal_received);
1607
} while(ret != 0 and errno == EINTR);
1608
if(ret != 0){
1609
perror("raise");
1610
abort();
1611
}
1612
TEMP_FAILURE_RETRY(pause());
1613
}
1614
1615
return exitcode;
864
1616
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0