To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 238
- compare with another revision
- download diff
- download tarball
- view history from revision 238
- Committer: Teddy Hogeborn
- Date: 2008-12-10 01:26:02 UTC
- mfrom: (237.1.2 mandos)
- Revision ID: teddy@fukt.bsnet.se-20081210012602-vhz3h75xkj24t340
First version of a somewhat complete D-Bus server interface. Also
change user/group name to "_mandos".
* debian/mandos.postinst: Rename old "mandos" user and group to
"_mandos"; create "_mandos" user and group
if none exist.
* debian/mandos-client.postinst: - '' -
* initramfs-tools-hook: Try "_mandos" before "mandos" as user and
group name.
* mandos (_datetime_to_dbus_struct): New; was previously local.
(Client.started): Renamed to "last_started". All users changed.
(Client.started): New; boolean.
(Client.dbus_object_path): New.
(Client.check_command): Renamed to "checker_command". All users
changed.
(Client.__init__): Set and use "self.dbus_object_path". Set
"self.started".
(Client.start): Update "self.started". Emit "self.PropertyChanged"
signals for both "started" and "last_started".
(Client.stop): Update "self.started". Emit "self.PropertyChanged"
signal for "started".
(Client.checker_callback): Take additional "command" argument. All
callers changed. Emit
"self.PropertyChanged" signal.
(Client.bump_timeout): Emit "self.PropertyChanged" signal for
"last_checked_ok".
(Client.start_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.stop_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.still_valid): Bug fix: use "getattr(self, started, False)"
instead of "self.started" in case this client
object is so new that the "started" attribute
has not been created yet.
(Client.IntervalChanged, Client.CheckerIsRunning, Client.GetChecker,
Client.GetCreated, Client.GetFingerprint, Client.GetHost,
Client.GetInterval, Client.GetName, Client.GetStarted,
Client.GetTimeout, Client.StateChanged, Client.TimeoutChanged):
Removed; all callers changed.
(Client.CheckerCompleted): Add "condition" and "command" arguments.
All callers changed.
(Client.GetAllProperties, Client.PropertyChanged): New.
(Client.StillValid): Renamed to "IsStillValid".
(Client.StartChecker): Changed to its own function to avoid the
return value from "Client.start_checker()".
(Client.Stop): Changed to its own function to avoid the return value
from "Client.stop()".
(main): Try "_mandos" before "mandos" as user and group name.
Removed inner function "remove_from_clients". New inner
class "MandosServer".
change user/group name to "_mandos".
* debian/mandos.postinst: Rename old "mandos" user and group to
"_mandos"; create "_mandos" user and group
if none exist.
* debian/mandos-client.postinst: - '' -
* initramfs-tools-hook: Try "_mandos" before "mandos" as user and
group name.
* mandos (_datetime_to_dbus_struct): New; was previously local.
(Client.started): Renamed to "last_started". All users changed.
(Client.started): New; boolean.
(Client.dbus_object_path): New.
(Client.check_command): Renamed to "checker_command". All users
changed.
(Client.__init__): Set and use "self.dbus_object_path". Set
"self.started".
(Client.start): Update "self.started". Emit "self.PropertyChanged"
signals for both "started" and "last_started".
(Client.stop): Update "self.started". Emit "self.PropertyChanged"
signal for "started".
(Client.checker_callback): Take additional "command" argument. All
callers changed. Emit
"self.PropertyChanged" signal.
(Client.bump_timeout): Emit "self.PropertyChanged" signal for
"last_checked_ok".
(Client.start_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.stop_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.still_valid): Bug fix: use "getattr(self, started, False)"
instead of "self.started" in case this client
object is so new that the "started" attribute
has not been created yet.
(Client.IntervalChanged, Client.CheckerIsRunning, Client.GetChecker,
Client.GetCreated, Client.GetFingerprint, Client.GetHost,
Client.GetInterval, Client.GetName, Client.GetStarted,
Client.GetTimeout, Client.StateChanged, Client.TimeoutChanged):
Removed; all callers changed.
(Client.CheckerCompleted): Add "condition" and "command" arguments.
All callers changed.
(Client.GetAllProperties, Client.PropertyChanged): New.
(Client.StillValid): Renamed to "IsStillValid".
(Client.StartChecker): Changed to its own function to avoid the
return value from "Client.start_checker()".
(Client.Stop): Changed to its own function to avoid the return value
from "Client.stop()".
(main): Try "_mandos" before "mandos" as user and group name.
Removed inner function "remove_from_clients". New inner
class "MandosServer".
- files added:
- debian/mandos-client.config
- files removed:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
3
* Mandos client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2011 Teddy Hogeborn
13
* Copyright © 2008-2011 Björn Påhlsson
12
* Copyright © 2008 Teddy Hogeborn
13
* Copyright © 2008 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
30
30
*/
31
31
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
33
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
34
#define _FILE_OFFSET_BITS 64
38
#endif
39
35
40
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
37
42
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
39
stdout, ferror() */
44
40
#include <stdint.h> /* uint16_t, uint32_t */
45
41
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
42
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
43
srand() */
44
#include <stdbool.h> /* bool, true */
49
45
#include <string.h> /* memset(), strcmp(), strlen(),
50
46
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/ioctl.h> /* ioctl */
52
48
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
49
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
50
SOCK_STREAM, INET6_ADDRSTRLEN,
51
uid_t, gid_t, open(), opendir(), DIR */
56
52
#include <sys/stat.h> /* open() */
57
53
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
54
struct in6_addr, inet_pton(),
55
connect() */
59
56
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
57
#include <dirent.h> /* opendir(), struct dirent, readdir() */
58
#include <inttypes.h> /* PRIu16 */
64
59
#include <assert.h> /* assert() */
65
60
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time(), sleep() */
61
#include <time.h> /* time() */
67
62
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
63
SIOCSIFFLAGS, if_indextoname(),
69
64
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
65
#include <netinet/in.h>
73
66
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
67
getuid(), getgid(), setuid(),
68
setgid() */
76
69
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
70
#include <iso646.h> /* not, and */
78
71
#include <argp.h> /* struct argp_option, error_t, struct
79
72
argp_state, struct argp,
80
73
argp_parse(), ARGP_KEY_ARG,
81
74
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
86
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
87
88
#ifdef __linux__
89
#include <sys/klog.h> /* klogctl() */
90
#endif /* __linux__ */
91
75
92
76
/* Avahi */
93
77
/* All Avahi types, constants and functions
106
90
gnutls_*
107
91
init_gnutls_session(),
108
92
GNUTLS_* */
109
#include <gnutls/openpgp.h>
110
/* gnutls_certificate_set_openpgp_key_file(),
93
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
111
94
GNUTLS_OPENPGP_FMT_BASE64 */
112
95
113
96
/* GPGME */
127
110
static const char mandos_protocol_version[] = "1";
128
111
const char *argp_program_version = "mandos-client " VERSION;
129
112
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
130
static const char sys_class_net[] = "/sys/class/net";
131
char *connect_to = NULL;
132
113
133
114
/* Used for passing in values through the Avahi callback functions */
134
115
typedef struct {
141
122
gpgme_ctx_t ctx;
142
123
} mandos_context;
143
124
144
/* global context so signal handler can reach it*/
145
mandos_context mc = { .simple_poll = NULL, .server = NULL,
146
.dh_bits = 1024, .priority = "SECURE256"
147
":!CTYPE-X.509:+CTYPE-OPENPGP" };
148
149
sig_atomic_t quit_now = 0;
150
int signal_received = 0;
151
152
125
/*
153
* Make additional room in "buffer" for at least BUFFER_SIZE more
154
* bytes. "buffer_capacity" is how much is currently allocated,
126
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
127
* "buffer_capacity" is how much is currently allocated,
155
128
* "buffer_length" is how much is already used.
156
129
*/
157
size_t incbuffer(char **buffer, size_t buffer_length,
130
size_t adjustbuffer(char **buffer, size_t buffer_length,
158
131
size_t buffer_capacity){
159
if(buffer_length + BUFFER_SIZE > buffer_capacity){
132
if (buffer_length + BUFFER_SIZE > buffer_capacity){
160
133
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
161
if(buffer == NULL){
134
if (buffer == NULL){
162
135
return 0;
163
136
}
164
137
buffer_capacity += BUFFER_SIZE;
169
142
/*
170
143
* Initialize GPGME.
171
144
*/
172
static bool init_gpgme(const char *seckey,
145
static bool init_gpgme(mandos_context *mc, const char *seckey,
173
146
const char *pubkey, const char *tempdir){
147
int ret;
174
148
gpgme_error_t rc;
175
149
gpgme_engine_info_t engine_info;
176
150
177
151
178
152
/*
179
* Helper function to insert pub and seckey to the engine keyring.
153
* Helper function to insert pub and seckey to the enigne keyring.
180
154
*/
181
155
bool import_key(const char *filename){
182
int ret;
183
156
int fd;
184
157
gpgme_data_t pgp_data;
185
158
186
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
159
fd = TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
187
160
if(fd == -1){
188
161
perror("open");
189
162
return false;
190
163
}
191
164
192
165
rc = gpgme_data_new_from_fd(&pgp_data, fd);
193
if(rc != GPG_ERR_NO_ERROR){
166
if (rc != GPG_ERR_NO_ERROR){
194
167
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
195
168
gpgme_strsource(rc), gpgme_strerror(rc));
196
169
return false;
197
170
}
198
171
199
rc = gpgme_op_import(mc.ctx, pgp_data);
200
if(rc != GPG_ERR_NO_ERROR){
172
rc = gpgme_op_import(mc->ctx, pgp_data);
173
if (rc != GPG_ERR_NO_ERROR){
201
174
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
202
175
gpgme_strsource(rc), gpgme_strerror(rc));
203
176
return false;
204
177
}
205
178
206
ret = (int)TEMP_FAILURE_RETRY(close(fd));
179
ret = TEMP_FAILURE_RETRY(close(fd));
207
180
if(ret == -1){
208
181
perror("close");
209
182
}
211
184
return true;
212
185
}
213
186
214
if(debug){
215
fprintf(stderr, "Initializing GPGME\n");
187
if (debug){
188
fprintf(stderr, "Initialize gpgme\n");
216
189
}
217
190
218
191
/* Init GPGME */
219
192
gpgme_check_version(NULL);
220
193
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
221
if(rc != GPG_ERR_NO_ERROR){
194
if (rc != GPG_ERR_NO_ERROR){
222
195
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
223
196
gpgme_strsource(rc), gpgme_strerror(rc));
224
197
return false;
225
198
}
226
199
227
200
/* Set GPGME home directory for the OpenPGP engine only */
228
rc = gpgme_get_engine_info(&engine_info);
229
if(rc != GPG_ERR_NO_ERROR){
201
rc = gpgme_get_engine_info (&engine_info);
202
if (rc != GPG_ERR_NO_ERROR){
230
203
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
231
204
gpgme_strsource(rc), gpgme_strerror(rc));
232
205
return false;
245
218
}
246
219
247
220
/* Create new GPGME "context" */
248
rc = gpgme_new(&(mc.ctx));
249
if(rc != GPG_ERR_NO_ERROR){
221
rc = gpgme_new(&(mc->ctx));
222
if (rc != GPG_ERR_NO_ERROR){
250
223
fprintf(stderr, "bad gpgme_new: %s: %s\n",
251
224
gpgme_strsource(rc), gpgme_strerror(rc));
252
225
return false;
253
226
}
254
227
255
if(not import_key(pubkey) or not import_key(seckey)){
228
if (not import_key(pubkey) or not import_key(seckey)){
256
229
return false;
257
230
}
258
231
259
return true;
232
return true;
260
233
}
261
234
262
235
/*
263
236
* Decrypt OpenPGP data.
264
237
* Returns -1 on error
265
238
*/
266
static ssize_t pgp_packet_decrypt(const char *cryptotext,
267
size_t crypto_size,
268
char **plaintext){
239
static ssize_t pgp_packet_decrypt (const mandos_context *mc,
240
const char *cryptotext,
241
size_t crypto_size,
242
char **plaintext){
269
243
gpgme_data_t dh_crypto, dh_plain;
270
244
gpgme_error_t rc;
271
245
ssize_t ret;
272
246
size_t plaintext_capacity = 0;
273
247
ssize_t plaintext_length = 0;
274
248
275
if(debug){
249
if (debug){
276
250
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
277
251
}
278
252
279
253
/* Create new GPGME data buffer from memory cryptotext */
280
254
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
281
255
0);
282
if(rc != GPG_ERR_NO_ERROR){
256
if (rc != GPG_ERR_NO_ERROR){
283
257
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
284
258
gpgme_strsource(rc), gpgme_strerror(rc));
285
259
return -1;
287
261
288
262
/* Create new empty GPGME data buffer for the plaintext */
289
263
rc = gpgme_data_new(&dh_plain);
290
if(rc != GPG_ERR_NO_ERROR){
264
if (rc != GPG_ERR_NO_ERROR){
291
265
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
292
266
gpgme_strsource(rc), gpgme_strerror(rc));
293
267
gpgme_data_release(dh_crypto);
296
270
297
271
/* Decrypt data from the cryptotext data buffer to the plaintext
298
272
data buffer */
299
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
300
if(rc != GPG_ERR_NO_ERROR){
273
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
274
if (rc != GPG_ERR_NO_ERROR){
301
275
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
302
276
gpgme_strsource(rc), gpgme_strerror(rc));
303
277
plaintext_length = -1;
304
if(debug){
278
if (debug){
305
279
gpgme_decrypt_result_t result;
306
result = gpgme_op_decrypt_result(mc.ctx);
307
if(result == NULL){
280
result = gpgme_op_decrypt_result(mc->ctx);
281
if (result == NULL){
308
282
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
309
283
} else {
310
284
fprintf(stderr, "Unsupported algorithm: %s\n",
316
290
}
317
291
gpgme_recipient_t recipient;
318
292
recipient = result->recipients;
319
while(recipient != NULL){
320
fprintf(stderr, "Public key algorithm: %s\n",
321
gpgme_pubkey_algo_name(recipient->pubkey_algo));
322
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
323
fprintf(stderr, "Secret key available: %s\n",
324
recipient->status == GPG_ERR_NO_SECKEY
325
? "No" : "Yes");
326
recipient = recipient->next;
293
if(recipient){
294
while(recipient != NULL){
295
fprintf(stderr, "Public key algorithm: %s\n",
296
gpgme_pubkey_algo_name(recipient->pubkey_algo));
297
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
298
fprintf(stderr, "Secret key available: %s\n",
299
recipient->status == GPG_ERR_NO_SECKEY
300
? "No" : "Yes");
301
recipient = recipient->next;
302
}
327
303
}
328
304
}
329
305
}
335
311
}
336
312
337
313
/* Seek back to the beginning of the GPGME plaintext data buffer */
338
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
314
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
339
315
perror("gpgme_data_seek");
340
316
plaintext_length = -1;
341
317
goto decrypt_end;
343
319
344
320
*plaintext = NULL;
345
321
while(true){
346
plaintext_capacity = incbuffer(plaintext,
322
plaintext_capacity = adjustbuffer(plaintext,
347
323
(size_t)plaintext_length,
348
324
plaintext_capacity);
349
if(plaintext_capacity == 0){
350
perror("incbuffer");
325
if (plaintext_capacity == 0){
326
perror("adjustbuffer");
351
327
plaintext_length = -1;
352
328
goto decrypt_end;
353
329
}
355
331
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
356
332
BUFFER_SIZE);
357
333
/* Print the data, if any */
358
if(ret == 0){
334
if (ret == 0){
359
335
/* EOF */
360
336
break;
361
337
}
385
361
return plaintext_length;
386
362
}
387
363
388
static const char * safer_gnutls_strerror(int value){
389
const char *ret = gnutls_strerror(value); /* Spurious warning from
390
-Wunreachable-code */
391
if(ret == NULL)
364
static const char * safer_gnutls_strerror (int value) {
365
const char *ret = gnutls_strerror (value); /* Spurious warning */
366
if (ret == NULL)
392
367
ret = "(unknown)";
393
368
return ret;
394
369
}
399
374
fprintf(stderr, "GnuTLS: %s", string);
400
375
}
401
376
402
static int init_gnutls_global(const char *pubkeyfilename,
377
static int init_gnutls_global(mandos_context *mc,
378
const char *pubkeyfilename,
403
379
const char *seckeyfilename){
404
380
int ret;
405
381
408
384
}
409
385
410
386
ret = gnutls_global_init();
411
if(ret != GNUTLS_E_SUCCESS){
412
fprintf(stderr, "GnuTLS global_init: %s\n",
413
safer_gnutls_strerror(ret));
387
if (ret != GNUTLS_E_SUCCESS) {
388
fprintf (stderr, "GnuTLS global_init: %s\n",
389
safer_gnutls_strerror(ret));
414
390
return -1;
415
391
}
416
392
417
if(debug){
393
if (debug){
418
394
/* "Use a log level over 10 to enable all debugging options."
419
395
* - GnuTLS manual
420
396
*/
423
399
}
424
400
425
401
/* OpenPGP credentials */
426
gnutls_certificate_allocate_credentials(&mc.cred);
427
if(ret != GNUTLS_E_SUCCESS){
428
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
429
from
430
-Wunreachable-code
431
*/
432
safer_gnutls_strerror(ret));
433
gnutls_global_deinit();
402
gnutls_certificate_allocate_credentials(&mc->cred);
403
if (ret != GNUTLS_E_SUCCESS){
404
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
405
warning */
406
safer_gnutls_strerror(ret));
407
gnutls_global_deinit ();
434
408
return -1;
435
409
}
436
410
441
415
}
442
416
443
417
ret = gnutls_certificate_set_openpgp_key_file
444
(mc.cred, pubkeyfilename, seckeyfilename,
418
(mc->cred, pubkeyfilename, seckeyfilename,
445
419
GNUTLS_OPENPGP_FMT_BASE64);
446
if(ret != GNUTLS_E_SUCCESS){
420
if (ret != GNUTLS_E_SUCCESS) {
447
421
fprintf(stderr,
448
422
"Error[%d] while reading the OpenPGP key pair ('%s',"
449
423
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
453
427
}
454
428
455
429
/* GnuTLS server initialization */
456
ret = gnutls_dh_params_init(&mc.dh_params);
457
if(ret != GNUTLS_E_SUCCESS){
458
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
459
" %s\n", safer_gnutls_strerror(ret));
430
ret = gnutls_dh_params_init(&mc->dh_params);
431
if (ret != GNUTLS_E_SUCCESS) {
432
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
433
" %s\n", safer_gnutls_strerror(ret));
460
434
goto globalfail;
461
435
}
462
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
463
if(ret != GNUTLS_E_SUCCESS){
464
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
465
safer_gnutls_strerror(ret));
436
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
437
if (ret != GNUTLS_E_SUCCESS) {
438
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
439
safer_gnutls_strerror(ret));
466
440
goto globalfail;
467
441
}
468
442
469
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
443
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
470
444
471
445
return 0;
472
446
473
447
globalfail:
474
448
475
gnutls_certificate_free_credentials(mc.cred);
449
gnutls_certificate_free_credentials(mc->cred);
476
450
gnutls_global_deinit();
477
gnutls_dh_params_deinit(mc.dh_params);
451
gnutls_dh_params_deinit(mc->dh_params);
478
452
return -1;
479
453
}
480
454
481
static int init_gnutls_session(gnutls_session_t *session){
455
static int init_gnutls_session(mandos_context *mc,
456
gnutls_session_t *session){
482
457
int ret;
483
458
/* GnuTLS session creation */
484
do {
485
ret = gnutls_init(session, GNUTLS_SERVER);
486
if(quit_now){
487
return -1;
488
}
489
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
490
if(ret != GNUTLS_E_SUCCESS){
459
ret = gnutls_init(session, GNUTLS_SERVER);
460
if (ret != GNUTLS_E_SUCCESS){
491
461
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
492
462
safer_gnutls_strerror(ret));
493
463
}
494
464
495
465
{
496
466
const char *err;
497
do {
498
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
499
if(quit_now){
500
gnutls_deinit(*session);
501
return -1;
502
}
503
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
504
if(ret != GNUTLS_E_SUCCESS){
467
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
468
if (ret != GNUTLS_E_SUCCESS) {
505
469
fprintf(stderr, "Syntax error at: %s\n", err);
506
470
fprintf(stderr, "GnuTLS error: %s\n",
507
471
safer_gnutls_strerror(ret));
508
gnutls_deinit(*session);
472
gnutls_deinit (*session);
509
473
return -1;
510
474
}
511
475
}
512
476
513
do {
514
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
515
mc.cred);
516
if(quit_now){
517
gnutls_deinit(*session);
518
return -1;
519
}
520
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
521
if(ret != GNUTLS_E_SUCCESS){
477
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
478
mc->cred);
479
if (ret != GNUTLS_E_SUCCESS) {
522
480
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
523
481
safer_gnutls_strerror(ret));
524
gnutls_deinit(*session);
482
gnutls_deinit (*session);
525
483
return -1;
526
484
}
527
485
528
486
/* ignore client certificate if any. */
529
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
487
gnutls_certificate_server_set_request (*session,
488
GNUTLS_CERT_IGNORE);
530
489
531
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
490
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
532
491
533
492
return 0;
534
493
}
540
499
/* Called when a Mandos server is found */
541
500
static int start_mandos_communication(const char *ip, uint16_t port,
542
501
AvahiIfIndex if_index,
543
int af){
544
int ret, tcp_sd = -1;
545
ssize_t sret;
546
union {
547
struct sockaddr_in in;
548
struct sockaddr_in6 in6;
549
} to;
502
mandos_context *mc){
503
int ret, tcp_sd;
504
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
550
505
char *buffer = NULL;
551
char *decrypted_buffer = NULL;
506
char *decrypted_buffer;
552
507
size_t buffer_length = 0;
553
508
size_t buffer_capacity = 0;
509
ssize_t decrypted_buffer_size;
554
510
size_t written;
555
int retval = -1;
511
int retval = 0;
512
char interface[IF_NAMESIZE];
556
513
gnutls_session_t session;
557
int pf; /* Protocol family */
558
559
errno = 0;
560
561
if(quit_now){
562
errno = EINTR;
563
return -1;
564
}
565
566
switch(af){
567
case AF_INET6:
568
pf = PF_INET6;
569
break;
570
case AF_INET:
571
pf = PF_INET;
572
break;
573
default:
574
fprintf(stderr, "Bad address family: %d\n", af);
575
errno = EINVAL;
576
return -1;
577
}
578
579
ret = init_gnutls_session(&session);
580
if(ret != 0){
514
515
ret = init_gnutls_session (mc, &session);
516
if (ret != 0){
581
517
return -1;
582
518
}
583
519
584
520
if(debug){
585
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
521
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
586
522
"\n", ip, port);
587
523
}
588
524
589
tcp_sd = socket(pf, SOCK_STREAM, 0);
590
if(tcp_sd < 0){
591
int e = errno;
525
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
526
if(tcp_sd < 0) {
592
527
perror("socket");
593
errno = e;
594
goto mandos_end;
528
return -1;
595
529
}
596
530
597
if(quit_now){
598
errno = EINTR;
599
goto mandos_end;
531
if(debug){
532
if(if_indextoname((unsigned int)if_index, interface) == NULL){
533
perror("if_indextoname");
534
return -1;
535
}
536
fprintf(stderr, "Binding to interface %s\n", interface);
600
537
}
601
538
602
539
memset(&to, 0, sizeof(to));
603
if(af == AF_INET6){
604
to.in6.sin6_family = (sa_family_t)af;
605
ret = inet_pton(af, ip, &to.in6.sin6_addr);
606
} else { /* IPv4 */
607
to.in.sin_family = (sa_family_t)af;
608
ret = inet_pton(af, ip, &to.in.sin_addr);
609
}
610
if(ret < 0 ){
611
int e = errno;
540
to.in6.sin6_family = AF_INET6;
541
/* It would be nice to have a way to detect if we were passed an
542
IPv4 address here. Now we assume an IPv6 address. */
543
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
544
if (ret < 0 ){
612
545
perror("inet_pton");
613
errno = e;
614
goto mandos_end;
546
return -1;
615
547
}
616
548
if(ret == 0){
617
int e = errno;
618
549
fprintf(stderr, "Bad address: %s\n", ip);
619
errno = e;
620
goto mandos_end;
621
}
622
if(af == AF_INET6){
623
to.in6.sin6_port = htons(port); /* Spurious warnings from
624
-Wconversion and
625
-Wunreachable-code */
626
627
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
628
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
629
-Wunreachable-code*/
630
if(if_index == AVAHI_IF_UNSPEC){
631
fprintf(stderr, "An IPv6 link-local address is incomplete"
632
" without a network interface\n");
633
errno = EINVAL;
634
goto mandos_end;
635
}
636
/* Set the network interface number as scope */
637
to.in6.sin6_scope_id = (uint32_t)if_index;
638
}
639
} else {
640
to.in.sin_port = htons(port); /* Spurious warnings from
641
-Wconversion and
642
-Wunreachable-code */
643
}
550
return -1;
551
}
552
to.in6.sin6_port = htons(port); /* Spurious warning */
644
553
645
if(quit_now){
646
errno = EINTR;
647
goto mandos_end;
648
}
554
to.in6.sin6_scope_id = (uint32_t)if_index;
649
555
650
556
if(debug){
651
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
652
char interface[IF_NAMESIZE];
653
if(if_indextoname((unsigned int)if_index, interface) == NULL){
654
perror("if_indextoname");
655
} else {
656
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
657
ip, interface, port);
658
}
659
} else {
660
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
661
port);
662
}
663
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
664
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
665
const char *pcret;
666
if(af == AF_INET6){
667
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
668
sizeof(addrstr));
669
} else {
670
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
671
sizeof(addrstr));
672
}
673
if(pcret == NULL){
557
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
558
port);
559
char addrstr[INET6_ADDRSTRLEN] = "";
560
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
561
sizeof(addrstr)) == NULL){
674
562
perror("inet_ntop");
675
563
} else {
676
564
if(strcmp(addrstr, ip) != 0){
679
567
}
680
568
}
681
569
682
if(quit_now){
683
errno = EINTR;
684
goto mandos_end;
685
}
686
687
if(af == AF_INET6){
688
ret = connect(tcp_sd, &to.in6, sizeof(to));
689
} else {
690
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
691
}
692
if(ret < 0){
693
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
694
int e = errno;
695
perror("connect");
696
errno = e;
697
}
698
goto mandos_end;
699
}
700
701
if(quit_now){
702
errno = EINTR;
703
goto mandos_end;
570
ret = connect(tcp_sd, &to.in, sizeof(to));
571
if (ret < 0){
572
perror("connect");
573
return -1;
704
574
}
705
575
706
576
const char *out = mandos_protocol_version;
707
577
written = 0;
708
while(true){
578
while (true){
709
579
size_t out_size = strlen(out);
710
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
580
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
711
581
out_size - written));
712
if(ret == -1){
713
int e = errno;
582
if (ret == -1){
714
583
perror("write");
715
errno = e;
584
retval = -1;
716
585
goto mandos_end;
717
586
}
718
587
written += (size_t)ret;
719
588
if(written < out_size){
720
589
continue;
721
590
} else {
722
if(out == mandos_protocol_version){
591
if (out == mandos_protocol_version){
723
592
written = 0;
724
593
out = "\r\n";
725
594
} else {
726
595
break;
727
596
}
728
597
}
729
730
if(quit_now){
731
errno = EINTR;
732
goto mandos_end;
733
}
734
598
}
735
599
736
600
if(debug){
737
601
fprintf(stderr, "Establishing TLS session with %s\n", ip);
738
602
}
739
603
740
if(quit_now){
741
errno = EINTR;
742
goto mandos_end;
743
}
744
745
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
746
747
if(quit_now){
748
errno = EINTR;
749
goto mandos_end;
750
}
751
752
do {
753
ret = gnutls_handshake(session);
754
if(quit_now){
755
errno = EINTR;
756
goto mandos_end;
757
}
604
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
605
606
do{
607
ret = gnutls_handshake (session);
758
608
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
759
609
760
if(ret != GNUTLS_E_SUCCESS){
610
if (ret != GNUTLS_E_SUCCESS){
761
611
if(debug){
762
612
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
763
gnutls_perror(ret);
613
gnutls_perror (ret);
764
614
}
765
errno = EPROTO;
615
retval = -1;
766
616
goto mandos_end;
767
617
}
768
618
769
619
/* Read OpenPGP packet that contains the wanted password */
770
620
771
621
if(debug){
772
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
622
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
773
623
ip);
774
624
}
775
625
776
626
while(true){
777
778
if(quit_now){
779
errno = EINTR;
780
goto mandos_end;
781
}
782
783
buffer_capacity = incbuffer(&buffer, buffer_length,
627
buffer_capacity = adjustbuffer(&buffer, buffer_length,
784
628
buffer_capacity);
785
if(buffer_capacity == 0){
786
int e = errno;
787
perror("incbuffer");
788
errno = e;
789
goto mandos_end;
790
}
791
792
if(quit_now){
793
errno = EINTR;
794
goto mandos_end;
795
}
796
797
sret = gnutls_record_recv(session, buffer+buffer_length,
798
BUFFER_SIZE);
799
if(sret == 0){
629
if (buffer_capacity == 0){
630
perror("adjustbuffer");
631
retval = -1;
632
goto mandos_end;
633
}
634
635
ret = gnutls_record_recv(session, buffer+buffer_length,
636
BUFFER_SIZE);
637
if (ret == 0){
800
638
break;
801
639
}
802
if(sret < 0){
803
switch(sret){
640
if (ret < 0){
641
switch(ret){
804
642
case GNUTLS_E_INTERRUPTED:
805
643
case GNUTLS_E_AGAIN:
806
644
break;
807
645
case GNUTLS_E_REHANDSHAKE:
808
do {
809
ret = gnutls_handshake(session);
810
811
if(quit_now){
812
errno = EINTR;
813
goto mandos_end;
814
}
646
do{
647
ret = gnutls_handshake (session);
815
648
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
816
if(ret < 0){
649
if (ret < 0){
817
650
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
818
gnutls_perror(ret);
819
errno = EPROTO;
651
gnutls_perror (ret);
652
retval = -1;
820
653
goto mandos_end;
821
654
}
822
655
break;
823
656
default:
824
657
fprintf(stderr, "Unknown error while reading data from"
825
658
" encrypted session with Mandos server\n");
826
gnutls_bye(session, GNUTLS_SHUT_RDWR);
827
errno = EIO;
659
retval = -1;
660
gnutls_bye (session, GNUTLS_SHUT_RDWR);
828
661
goto mandos_end;
829
662
}
830
663
} else {
831
buffer_length += (size_t) sret;
664
buffer_length += (size_t) ret;
832
665
}
833
666
}
834
667
836
669
fprintf(stderr, "Closing TLS session\n");
837
670
}
838
671
839
if(quit_now){
840
errno = EINTR;
841
goto mandos_end;
842
}
843
844
do {
845
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
846
if(quit_now){
847
errno = EINTR;
848
goto mandos_end;
849
}
850
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
851
852
if(buffer_length > 0){
853
ssize_t decrypted_buffer_size;
854
decrypted_buffer_size = pgp_packet_decrypt(buffer,
672
gnutls_bye (session, GNUTLS_SHUT_RDWR);
673
674
if (buffer_length > 0){
675
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
855
676
buffer_length,
856
677
&decrypted_buffer);
857
if(decrypted_buffer_size >= 0){
858
678
if (decrypted_buffer_size >= 0){
859
679
written = 0;
860
680
while(written < (size_t) decrypted_buffer_size){
861
if(quit_now){
862
errno = EINTR;
863
goto mandos_end;
864
}
865
866
ret = (int)fwrite(decrypted_buffer + written, 1,
867
(size_t)decrypted_buffer_size - written,
868
stdout);
681
ret = (int)fwrite (decrypted_buffer + written, 1,
682
(size_t)decrypted_buffer_size - written,
683
stdout);
869
684
if(ret == 0 and ferror(stdout)){
870
int e = errno;
871
685
if(debug){
872
686
fprintf(stderr, "Error writing encrypted data: %s\n",
873
687
strerror(errno));
874
688
}
875
errno = e;
876
goto mandos_end;
689
retval = -1;
690
break;
877
691
}
878
692
written += (size_t)ret;
879
693
}
880
retval = 0;
694
free(decrypted_buffer);
695
} else {
696
retval = -1;
881
697
}
698
} else {
699
retval = -1;
882
700
}
883
701
884
702
/* Shutdown procedure */
885
703
886
704
mandos_end:
887
{
888
int e = errno;
889
free(decrypted_buffer);
890
free(buffer);
891
if(tcp_sd >= 0){
892
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
893
}
894
if(ret == -1){
895
if(e == 0){
896
e = errno;
897
}
898
perror("close");
899
}
900
gnutls_deinit(session);
901
if(quit_now){
902
e = EINTR;
903
retval = -1;
904
}
905
errno = e;
705
free(buffer);
706
ret = TEMP_FAILURE_RETRY(close(tcp_sd));
707
if(ret == -1){
708
perror("close");
906
709
}
710
gnutls_deinit (session);
907
711
return retval;
908
712
}
909
713
910
714
static void resolve_callback(AvahiSServiceResolver *r,
911
715
AvahiIfIndex interface,
912
AvahiProtocol proto,
716
AVAHI_GCC_UNUSED AvahiProtocol protocol,
913
717
AvahiResolverEvent event,
914
718
const char *name,
915
719
const char *type,
920
724
AVAHI_GCC_UNUSED AvahiStringList *txt,
921
725
AVAHI_GCC_UNUSED AvahiLookupResultFlags
922
726
flags,
923
AVAHI_GCC_UNUSED void* userdata){
727
void* userdata) {
728
mandos_context *mc = userdata;
924
729
assert(r);
925
730
926
731
/* Called whenever a service has been resolved successfully or
927
732
timed out */
928
733
929
if(quit_now){
930
return;
931
}
932
933
switch(event){
734
switch (event) {
934
735
default:
935
736
case AVAHI_RESOLVER_FAILURE:
936
737
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
937
738
" of type '%s' in domain '%s': %s\n", name, type, domain,
938
avahi_strerror(avahi_server_errno(mc.server)));
739
avahi_strerror(avahi_server_errno(mc->server)));
939
740
break;
940
741
941
742
case AVAHI_RESOLVER_FOUND:
944
745
avahi_address_snprint(ip, sizeof(ip), address);
945
746
if(debug){
946
747
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
947
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
948
ip, (intmax_t)interface, port);
748
PRIu16 ") on port %d\n", name, host_name, ip,
749
interface, port);
949
750
}
950
int ret = start_mandos_communication(ip, port, interface,
951
avahi_proto_to_af(proto));
952
if(ret == 0){
953
avahi_simple_poll_quit(mc.simple_poll);
751
int ret = start_mandos_communication(ip, port, interface, mc);
752
if (ret == 0){
753
avahi_simple_poll_quit(mc->simple_poll);
954
754
}
955
755
}
956
756
}
957
757
avahi_s_service_resolver_free(r);
958
758
}
959
759
960
static void browse_callback(AvahiSServiceBrowser *b,
961
AvahiIfIndex interface,
962
AvahiProtocol protocol,
963
AvahiBrowserEvent event,
964
const char *name,
965
const char *type,
966
const char *domain,
967
AVAHI_GCC_UNUSED AvahiLookupResultFlags
968
flags,
969
AVAHI_GCC_UNUSED void* userdata){
760
static void browse_callback( AvahiSServiceBrowser *b,
761
AvahiIfIndex interface,
762
AvahiProtocol protocol,
763
AvahiBrowserEvent event,
764
const char *name,
765
const char *type,
766
const char *domain,
767
AVAHI_GCC_UNUSED AvahiLookupResultFlags
768
flags,
769
void* userdata) {
770
mandos_context *mc = userdata;
970
771
assert(b);
971
772
972
773
/* Called whenever a new services becomes available on the LAN or
973
774
is removed from the LAN */
974
775
975
if(quit_now){
976
return;
977
}
978
979
switch(event){
776
switch (event) {
980
777
default:
981
778
case AVAHI_BROWSER_FAILURE:
982
779
983
780
fprintf(stderr, "(Avahi browser) %s\n",
984
avahi_strerror(avahi_server_errno(mc.server)));
985
avahi_simple_poll_quit(mc.simple_poll);
781
avahi_strerror(avahi_server_errno(mc->server)));
782
avahi_simple_poll_quit(mc->simple_poll);
986
783
return;
987
784
988
785
case AVAHI_BROWSER_NEW:
991
788
the callback function is called the Avahi server will free the
992
789
resolver for us. */
993
790
994
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
995
name, type, domain, protocol, 0,
996
resolve_callback, NULL) == NULL)
791
if (!(avahi_s_service_resolver_new(mc->server, interface,
792
protocol, name, type, domain,
793
AVAHI_PROTO_INET6, 0,
794
resolve_callback, mc)))
997
795
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
998
name, avahi_strerror(avahi_server_errno(mc.server)));
796
name, avahi_strerror(avahi_server_errno(mc->server)));
999
797
break;
1000
798
1001
799
case AVAHI_BROWSER_REMOVE:
1010
808
}
1011
809
}
1012
810
1013
/* stop main loop after sigterm has been called */
1014
static void handle_sigterm(int sig){
1015
if(quit_now){
1016
return;
1017
}
1018
quit_now = 1;
1019
signal_received = sig;
1020
int old_errno = errno;
1021
if(mc.simple_poll != NULL){
1022
avahi_simple_poll_quit(mc.simple_poll);
1023
}
1024
errno = old_errno;
1025
}
1026
1027
/*
1028
* This function determines if a directory entry in /sys/class/net
1029
* corresponds to an acceptable network device.
1030
* (This function is passed to scandir(3) as a filter function.)
1031
*/
1032
int good_interface(const struct dirent *if_entry){
1033
ssize_t ssret;
1034
char *flagname = NULL;
1035
if(if_entry->d_name[0] == '.'){
1036
return 0;
1037
}
1038
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
1039
if_entry->d_name);
1040
if(ret < 0){
1041
perror("asprintf");
1042
return 0;
1043
}
1044
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1045
if(flags_fd == -1){
1046
perror("open");
1047
free(flagname);
1048
return 0;
1049
}
1050
free(flagname);
1051
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1052
/* read line from flags_fd */
1053
ssize_t to_read = (sizeof(ifreq_flags)*2)+3; /* "0x1003\n" */
1054
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1055
flagstring[(size_t)to_read] = '\0';
1056
if(flagstring == NULL){
1057
perror("malloc");
1058
close(flags_fd);
1059
return 0;
1060
}
1061
while(to_read > 0){
1062
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1063
(size_t)to_read));
1064
if(ssret == -1){
1065
perror("read");
1066
free(flagstring);
1067
close(flags_fd);
1068
return 0;
1069
}
1070
to_read -= ssret;
1071
if(ssret == 0){
1072
break;
1073
}
1074
}
1075
close(flags_fd);
1076
intmax_t tmpmax;
1077
char *tmp;
1078
errno = 0;
1079
tmpmax = strtoimax(flagstring, &tmp, 0);
1080
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1081
and not (isspace(*tmp)))
1082
or tmpmax != (ifreq_flags)tmpmax){
1083
if(debug){
1084
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1085
flagstring, if_entry->d_name);
1086
}
1087
free(flagstring);
1088
return 0;
1089
}
1090
free(flagstring);
1091
ifreq_flags flags = (ifreq_flags)tmpmax;
1092
/* Reject the loopback device */
1093
if(flags & IFF_LOOPBACK){
1094
if(debug){
1095
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1096
if_entry->d_name);
1097
}
1098
return 0;
1099
}
1100
/* Accept point-to-point devices only if connect_to is specified */
1101
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1102
if(debug){
1103
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1104
if_entry->d_name);
1105
}
1106
return 1;
1107
}
1108
/* Otherwise, reject non-broadcast-capable devices */
1109
if(not (flags & IFF_BROADCAST)){
1110
if(debug){
1111
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1112
if_entry->d_name);
1113
}
1114
return 0;
1115
}
1116
/* Reject non-ARP interfaces (including dummy interfaces) */
1117
if(flags & IFF_NOARP){
1118
if(debug){
1119
fprintf(stderr, "Rejecting non-ARP interface \"%s\"\n",
1120
if_entry->d_name);
1121
}
1122
return 0;
1123
}
1124
/* Accept this device */
1125
if(debug){
1126
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1127
if_entry->d_name);
1128
}
1129
return 1;
1130
}
1131
1132
811
int main(int argc, char *argv[]){
1133
AvahiSServiceBrowser *sb = NULL;
1134
int error;
1135
int ret;
1136
intmax_t tmpmax;
1137
char *tmp;
1138
int exitcode = EXIT_SUCCESS;
1139
const char *interface = "";
1140
struct ifreq network;
1141
int sd = -1;
1142
bool take_down_interface = false;
1143
uid_t uid;
1144
gid_t gid;
1145
char tempdir[] = "/tmp/mandosXXXXXX";
1146
bool tempdir_created = false;
1147
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1148
const char *seckey = PATHDIR "/" SECKEY;
1149
const char *pubkey = PATHDIR "/" PUBKEY;
1150
1151
bool gnutls_initialized = false;
1152
bool gpgme_initialized = false;
1153
float delay = 2.5f;
1154
1155
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1156
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1157
1158
uid = getuid();
1159
gid = getgid();
1160
1161
/* Lower any group privileges we might have, just to be safe */
1162
errno = 0;
1163
ret = setgid(gid);
1164
if(ret == -1){
1165
perror("setgid");
1166
}
1167
1168
/* Lower user privileges (temporarily) */
1169
errno = 0;
1170
ret = seteuid(uid);
1171
if(ret == -1){
1172
perror("seteuid");
1173
}
1174
1175
if(quit_now){
1176
goto end;
1177
}
1178
1179
{
1180
struct argp_option options[] = {
1181
{ .name = "debug", .key = 128,
1182
.doc = "Debug mode", .group = 3 },
1183
{ .name = "connect", .key = 'c',
1184
.arg = "ADDRESS:PORT",
1185
.doc = "Connect directly to a specific Mandos server",
1186
.group = 1 },
1187
{ .name = "interface", .key = 'i',
1188
.arg = "NAME",
1189
.doc = "Network interface that will be used to search for"
1190
" Mandos servers",
1191
.group = 1 },
1192
{ .name = "seckey", .key = 's',
1193
.arg = "FILE",
1194
.doc = "OpenPGP secret key file base name",
1195
.group = 1 },
1196
{ .name = "pubkey", .key = 'p',
1197
.arg = "FILE",
1198
.doc = "OpenPGP public key file base name",
1199
.group = 2 },
1200
{ .name = "dh-bits", .key = 129,
1201
.arg = "BITS",
1202
.doc = "Bit length of the prime number used in the"
1203
" Diffie-Hellman key exchange",
1204
.group = 2 },
1205
{ .name = "priority", .key = 130,
1206
.arg = "STRING",
1207
.doc = "GnuTLS priority string for the TLS handshake",
1208
.group = 1 },
1209
{ .name = "delay", .key = 131,
1210
.arg = "SECONDS",
1211
.doc = "Maximum delay to wait for interface startup",
1212
.group = 2 },
1213
/*
1214
* These reproduce what we would get without ARGP_NO_HELP
1215
*/
1216
{ .name = "help", .key = '?',
1217
.doc = "Give this help list", .group = -1 },
1218
{ .name = "usage", .key = -3,
1219
.doc = "Give a short usage message", .group = -1 },
1220
{ .name = "version", .key = 'V',
1221
.doc = "Print program version", .group = -1 },
1222
{ .name = NULL }
1223
};
1224
1225
error_t parse_opt(int key, char *arg,
1226
struct argp_state *state){
1227
errno = 0;
1228
switch(key){
1229
case 128: /* --debug */
1230
debug = true;
1231
break;
1232
case 'c': /* --connect */
1233
connect_to = arg;
1234
break;
1235
case 'i': /* --interface */
1236
interface = arg;
1237
break;
1238
case 's': /* --seckey */
1239
seckey = arg;
1240
break;
1241
case 'p': /* --pubkey */
1242
pubkey = arg;
1243
break;
1244
case 129: /* --dh-bits */
1245
errno = 0;
1246
tmpmax = strtoimax(arg, &tmp, 10);
1247
if(errno != 0 or tmp == arg or *tmp != '\0'
1248
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1249
argp_error(state, "Bad number of DH bits");
1250
}
1251
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1252
break;
1253
case 130: /* --priority */
1254
mc.priority = arg;
1255
break;
1256
case 131: /* --delay */
1257
errno = 0;
1258
delay = strtof(arg, &tmp);
1259
if(errno != 0 or tmp == arg or *tmp != '\0'){
1260
argp_error(state, "Bad delay");
1261
}
1262
break;
1263
/*
1264
* These reproduce what we would get without ARGP_NO_HELP
1265
*/
1266
case '?': /* --help */
1267
argp_state_help(state, state->out_stream,
1268
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1269
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1270
case -3: /* --usage */
1271
argp_state_help(state, state->out_stream,
1272
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1273
case 'V': /* --version */
1274
fprintf(state->out_stream, "%s\n", argp_program_version);
1275
exit(argp_err_exit_status);
1276
break;
1277
default:
1278
return ARGP_ERR_UNKNOWN;
1279
}
1280
return errno;
1281
}
1282
1283
struct argp argp = { .options = options, .parser = parse_opt,
1284
.args_doc = "",
1285
.doc = "Mandos client -- Get and decrypt"
1286
" passwords from a Mandos server" };
1287
ret = argp_parse(&argp, argc, argv,
1288
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1289
switch(ret){
1290
case 0:
1291
break;
1292
case ENOMEM:
1293
default:
1294
errno = ret;
1295
perror("argp_parse");
1296
exitcode = EX_OSERR;
1297
goto end;
1298
case EINVAL:
1299
exitcode = EX_USAGE;
1300
goto end;
1301
}
1302
}
1303
1304
if(not debug){
1305
avahi_set_log_function(empty_log);
1306
}
1307
1308
if(interface[0] == '\0'){
1309
struct dirent **direntries;
1310
ret = scandir(sys_class_net, &direntries, good_interface,
1311
alphasort);
1312
if(ret >= 1){
1313
/* Pick the first good interface */
1314
interface = strdup(direntries[0]->d_name);
1315
if(debug){
1316
fprintf(stderr, "Using interface \"%s\"\n", interface);
1317
}
1318
if(interface == NULL){
1319
perror("malloc");
1320
free(direntries);
1321
exitcode = EXIT_FAILURE;
1322
goto end;
1323
}
1324
free(direntries);
1325
} else {
1326
free(direntries);
1327
fprintf(stderr, "Could not find a network interface\n");
1328
exitcode = EXIT_FAILURE;
1329
goto end;
1330
}
1331
}
1332
1333
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1334
from the signal handler */
1335
/* Initialize the pseudo-RNG for Avahi */
1336
srand((unsigned int) time(NULL));
1337
mc.simple_poll = avahi_simple_poll_new();
1338
if(mc.simple_poll == NULL){
1339
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1340
exitcode = EX_UNAVAILABLE;
1341
goto end;
1342
}
1343
1344
sigemptyset(&sigterm_action.sa_mask);
1345
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1346
if(ret == -1){
1347
perror("sigaddset");
1348
exitcode = EX_OSERR;
1349
goto end;
1350
}
1351
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1352
if(ret == -1){
1353
perror("sigaddset");
1354
exitcode = EX_OSERR;
1355
goto end;
1356
}
1357
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1358
if(ret == -1){
1359
perror("sigaddset");
1360
exitcode = EX_OSERR;
1361
goto end;
1362
}
1363
/* Need to check if the handler is SIG_IGN before handling:
1364
| [[info:libc:Initial Signal Actions]] |
1365
| [[info:libc:Basic Signal Handling]] |
1366
*/
1367
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1368
if(ret == -1){
1369
perror("sigaction");
1370
return EX_OSERR;
1371
}
1372
if(old_sigterm_action.sa_handler != SIG_IGN){
1373
ret = sigaction(SIGINT, &sigterm_action, NULL);
1374
if(ret == -1){
1375
perror("sigaction");
1376
exitcode = EX_OSERR;
1377
goto end;
1378
}
1379
}
1380
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1381
if(ret == -1){
1382
perror("sigaction");
1383
return EX_OSERR;
1384
}
1385
if(old_sigterm_action.sa_handler != SIG_IGN){
1386
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1387
if(ret == -1){
1388
perror("sigaction");
1389
exitcode = EX_OSERR;
1390
goto end;
1391
}
1392
}
1393
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1394
if(ret == -1){
1395
perror("sigaction");
1396
return EX_OSERR;
1397
}
1398
if(old_sigterm_action.sa_handler != SIG_IGN){
1399
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1400
if(ret == -1){
1401
perror("sigaction");
1402
exitcode = EX_OSERR;
1403
goto end;
1404
}
1405
}
1406
1407
/* If the interface is down, bring it up */
1408
if(strcmp(interface, "none") != 0){
812
AvahiSServiceBrowser *sb = NULL;
813
int error;
814
int ret;
815
int exitcode = EXIT_SUCCESS;
816
const char *interface = "eth0";
817
struct ifreq network;
818
int sd;
819
uid_t uid;
820
gid_t gid;
821
char *connect_to = NULL;
822
char tempdir[] = "/tmp/mandosXXXXXX";
823
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
824
const char *seckey = PATHDIR "/" SECKEY;
825
const char *pubkey = PATHDIR "/" PUBKEY;
826
827
mandos_context mc = { .simple_poll = NULL, .server = NULL,
828
.dh_bits = 1024, .priority = "SECURE256"
829
":!CTYPE-X.509:+CTYPE-OPENPGP" };
830
bool gnutls_initalized = false;
831
bool gpgme_initalized = false;
832
833
{
834
struct argp_option options[] = {
835
{ .name = "debug", .key = 128,
836
.doc = "Debug mode", .group = 3 },
837
{ .name = "connect", .key = 'c',
838
.arg = "ADDRESS:PORT",
839
.doc = "Connect directly to a specific Mandos server",
840
.group = 1 },
841
{ .name = "interface", .key = 'i',
842
.arg = "NAME",
843
.doc = "Interface that will be used to search for Mandos"
844
" servers",
845
.group = 1 },
846
{ .name = "seckey", .key = 's',
847
.arg = "FILE",
848
.doc = "OpenPGP secret key file base name",
849
.group = 1 },
850
{ .name = "pubkey", .key = 'p',
851
.arg = "FILE",
852
.doc = "OpenPGP public key file base name",
853
.group = 2 },
854
{ .name = "dh-bits", .key = 129,
855
.arg = "BITS",
856
.doc = "Bit length of the prime number used in the"
857
" Diffie-Hellman key exchange",
858
.group = 2 },
859
{ .name = "priority", .key = 130,
860
.arg = "STRING",
861
.doc = "GnuTLS priority string for the TLS handshake",
862
.group = 1 },
863
{ .name = NULL }
864
};
865
866
error_t parse_opt (int key, char *arg,
867
struct argp_state *state) {
868
/* Get the INPUT argument from `argp_parse', which we know is
869
a pointer to our plugin list pointer. */
870
switch (key) {
871
case 128: /* --debug */
872
debug = true;
873
break;
874
case 'c': /* --connect */
875
connect_to = arg;
876
break;
877
case 'i': /* --interface */
878
interface = arg;
879
break;
880
case 's': /* --seckey */
881
seckey = arg;
882
break;
883
case 'p': /* --pubkey */
884
pubkey = arg;
885
break;
886
case 129: /* --dh-bits */
887
errno = 0;
888
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
889
if (errno){
890
perror("strtol");
891
exit(EXIT_FAILURE);
892
}
893
break;
894
case 130: /* --priority */
895
mc.priority = arg;
896
break;
897
case ARGP_KEY_ARG:
898
argp_usage (state);
899
case ARGP_KEY_END:
900
break;
901
default:
902
return ARGP_ERR_UNKNOWN;
903
}
904
return 0;
905
}
906
907
struct argp argp = { .options = options, .parser = parse_opt,
908
.args_doc = "",
909
.doc = "Mandos client -- Get and decrypt"
910
" passwords from a Mandos server" };
911
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
912
if (ret == ARGP_ERR_UNKNOWN){
913
fprintf(stderr, "Unknown error while parsing arguments\n");
914
exitcode = EXIT_FAILURE;
915
goto end;
916
}
917
}
918
919
/* If the interface is down, bring it up */
920
{
921
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
922
if(sd < 0) {
923
perror("socket");
924
exitcode = EXIT_FAILURE;
925
goto end;
926
}
927
strcpy(network.ifr_name, interface);
928
ret = ioctl(sd, SIOCGIFFLAGS, &network);
929
if(ret == -1){
930
perror("ioctl SIOCGIFFLAGS");
931
exitcode = EXIT_FAILURE;
932
goto end;
933
}
934
if((network.ifr_flags & IFF_UP) == 0){
935
network.ifr_flags |= IFF_UP;
936
ret = ioctl(sd, SIOCSIFFLAGS, &network);
937
if(ret == -1){
938
perror("ioctl SIOCSIFFLAGS");
939
exitcode = EXIT_FAILURE;
940
goto end;
941
}
942
}
943
ret = TEMP_FAILURE_RETRY(close(sd));
944
if(ret == -1){
945
perror("close");
946
}
947
}
948
949
uid = getuid();
950
gid = getgid();
951
952
ret = setuid(uid);
953
if (ret == -1){
954
perror("setuid");
955
}
956
957
setgid(gid);
958
if (ret == -1){
959
perror("setgid");
960
}
961
962
ret = init_gnutls_global(&mc, pubkey, seckey);
963
if (ret == -1){
964
fprintf(stderr, "init_gnutls_global failed\n");
965
exitcode = EXIT_FAILURE;
966
goto end;
967
} else {
968
gnutls_initalized = true;
969
}
970
971
if(mkdtemp(tempdir) == NULL){
972
perror("mkdtemp");
973
tempdir[0] = '\0';
974
goto end;
975
}
976
977
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
978
fprintf(stderr, "gpgme_initalized failed\n");
979
exitcode = EXIT_FAILURE;
980
goto end;
981
} else {
982
gpgme_initalized = true;
983
}
984
1409
985
if_index = (AvahiIfIndex) if_nametoindex(interface);
1410
986
if(if_index == 0){
1411
987
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1412
exitcode = EX_UNAVAILABLE;
1413
goto end;
1414
}
1415
1416
if(quit_now){
1417
goto end;
1418
}
1419
1420
/* Re-raise priviliges */
1421
errno = 0;
1422
ret = seteuid(0);
1423
if(ret == -1){
1424
perror("seteuid");
1425
}
1426
1427
#ifdef __linux__
1428
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1429
messages about the network interface to mess up the prompt */
1430
ret = klogctl(8, NULL, 5);
1431
bool restore_loglevel = true;
1432
if(ret == -1){
1433
restore_loglevel = false;
1434
perror("klogctl");
1435
}
1436
#endif /* __linux__ */
1437
1438
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1439
if(sd < 0){
1440
perror("socket");
1441
exitcode = EX_OSERR;
1442
#ifdef __linux__
1443
if(restore_loglevel){
1444
ret = klogctl(7, NULL, 0);
1445
if(ret == -1){
1446
perror("klogctl");
1447
}
1448
}
1449
#endif /* __linux__ */
1450
/* Lower privileges */
1451
errno = 0;
1452
ret = seteuid(uid);
1453
if(ret == -1){
1454
perror("seteuid");
1455
}
1456
goto end;
1457
}
1458
strcpy(network.ifr_name, interface);
1459
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1460
if(ret == -1){
1461
perror("ioctl SIOCGIFFLAGS");
1462
#ifdef __linux__
1463
if(restore_loglevel){
1464
ret = klogctl(7, NULL, 0);
1465
if(ret == -1){
1466
perror("klogctl");
1467
}
1468
}
1469
#endif /* __linux__ */
1470
exitcode = EX_OSERR;
1471
/* Lower privileges */
1472
errno = 0;
1473
ret = seteuid(uid);
1474
if(ret == -1){
1475
perror("seteuid");
1476
}
1477
goto end;
1478
}
1479
if((network.ifr_flags & IFF_UP) == 0){
1480
network.ifr_flags |= IFF_UP;
1481
take_down_interface = true;
1482
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1483
if(ret == -1){
1484
take_down_interface = false;
1485
perror("ioctl SIOCSIFFLAGS +IFF_UP");
1486
exitcode = EX_OSERR;
1487
#ifdef __linux__
1488
if(restore_loglevel){
1489
ret = klogctl(7, NULL, 0);
1490
if(ret == -1){
1491
perror("klogctl");
1492
}
1493
}
1494
#endif /* __linux__ */
1495
/* Lower privileges */
1496
errno = 0;
1497
ret = seteuid(uid);
1498
if(ret == -1){
1499
perror("seteuid");
1500
}
1501
goto end;
1502
}
1503
}
1504
/* sleep checking until interface is running */
1505
for(int i=0; i < delay * 4; i++){
1506
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1507
if(ret == -1){
1508
perror("ioctl SIOCGIFFLAGS");
1509
} else if(network.ifr_flags & IFF_RUNNING){
1510
break;
1511
}
1512
struct timespec sleeptime = { .tv_nsec = 250000000 };
1513
ret = nanosleep(&sleeptime, NULL);
1514
if(ret == -1 and errno != EINTR){
1515
perror("nanosleep");
1516
}
1517
}
1518
if(not take_down_interface){
1519
/* We won't need the socket anymore */
1520
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1521
if(ret == -1){
1522
perror("close");
1523
}
1524
}
1525
#ifdef __linux__
1526
if(restore_loglevel){
1527
/* Restores kernel loglevel to default */
1528
ret = klogctl(7, NULL, 0);
1529
if(ret == -1){
1530
perror("klogctl");
1531
}
1532
}
1533
#endif /* __linux__ */
1534
/* Lower privileges */
1535
errno = 0;
1536
if(take_down_interface){
1537
/* Lower privileges */
1538
ret = seteuid(uid);
1539
if(ret == -1){
1540
perror("seteuid");
1541
}
1542
} else {
1543
/* Lower privileges permanently */
1544
ret = setuid(uid);
1545
if(ret == -1){
1546
perror("setuid");
1547
}
1548
}
1549
}
1550
1551
if(quit_now){
1552
goto end;
1553
}
1554
1555
ret = init_gnutls_global(pubkey, seckey);
1556
if(ret == -1){
1557
fprintf(stderr, "init_gnutls_global failed\n");
1558
exitcode = EX_UNAVAILABLE;
1559
goto end;
1560
} else {
1561
gnutls_initialized = true;
1562
}
1563
1564
if(quit_now){
1565
goto end;
1566
}
1567
1568
tempdir_created = true;
1569
if(mkdtemp(tempdir) == NULL){
1570
tempdir_created = false;
1571
perror("mkdtemp");
1572
goto end;
1573
}
1574
1575
if(quit_now){
1576
goto end;
1577
}
1578
1579
if(not init_gpgme(pubkey, seckey, tempdir)){
1580
fprintf(stderr, "init_gpgme failed\n");
1581
exitcode = EX_UNAVAILABLE;
1582
goto end;
1583
} else {
1584
gpgme_initialized = true;
1585
}
1586
1587
if(quit_now){
1588
goto end;
1589
}
1590
1591
if(connect_to != NULL){
1592
/* Connect directly, do not use Zeroconf */
1593
/* (Mainly meant for debugging) */
1594
char *address = strrchr(connect_to, ':');
1595
if(address == NULL){
1596
fprintf(stderr, "No colon in address\n");
1597
exitcode = EX_USAGE;
1598
goto end;
1599
}
1600
1601
if(quit_now){
1602
goto end;
1603
}
1604
1605
uint16_t port;
1606
errno = 0;
1607
tmpmax = strtoimax(address+1, &tmp, 10);
1608
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1609
or tmpmax != (uint16_t)tmpmax){
1610
fprintf(stderr, "Bad port number\n");
1611
exitcode = EX_USAGE;
1612
goto end;
1613
}
1614
1615
if(quit_now){
1616
goto end;
1617
}
1618
1619
port = (uint16_t)tmpmax;
1620
*address = '\0';
1621
address = connect_to;
1622
/* Colon in address indicates IPv6 */
1623
int af;
1624
if(strchr(address, ':') != NULL){
1625
af = AF_INET6;
1626
} else {
1627
af = AF_INET;
1628
}
1629
1630
if(quit_now){
1631
goto end;
1632
}
1633
1634
while(not quit_now){
1635
ret = start_mandos_communication(address, port, if_index, af);
1636
if(quit_now or ret == 0){
1637
break;
1638
}
1639
sleep(15);
1640
};
1641
1642
if (not quit_now){
1643
exitcode = EXIT_SUCCESS;
1644
}
1645
1646
goto end;
1647
}
1648
1649
if(quit_now){
1650
goto end;
1651
}
1652
1653
{
1654
AvahiServerConfig config;
1655
/* Do not publish any local Zeroconf records */
1656
avahi_server_config_init(&config);
1657
config.publish_hinfo = 0;
1658
config.publish_addresses = 0;
1659
config.publish_workstation = 0;
1660
config.publish_domain = 0;
1661
1662
/* Allocate a new server */
1663
mc.server = avahi_server_new(avahi_simple_poll_get
1664
(mc.simple_poll), &config, NULL,
1665
NULL, &error);
1666
1667
/* Free the Avahi configuration data */
1668
avahi_server_config_free(&config);
1669
}
1670
1671
/* Check if creating the Avahi server object succeeded */
1672
if(mc.server == NULL){
1673
fprintf(stderr, "Failed to create Avahi server: %s\n",
1674
avahi_strerror(error));
1675
exitcode = EX_UNAVAILABLE;
1676
goto end;
1677
}
1678
1679
if(quit_now){
1680
goto end;
1681
}
1682
1683
/* Create the Avahi service browser */
1684
sb = avahi_s_service_browser_new(mc.server, if_index,
1685
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1686
NULL, 0, browse_callback, NULL);
1687
if(sb == NULL){
1688
fprintf(stderr, "Failed to create service browser: %s\n",
1689
avahi_strerror(avahi_server_errno(mc.server)));
1690
exitcode = EX_UNAVAILABLE;
1691
goto end;
1692
}
1693
1694
if(quit_now){
1695
goto end;
1696
}
1697
1698
/* Run the main loop */
1699
1700
if(debug){
1701
fprintf(stderr, "Starting Avahi loop search\n");
1702
}
1703
1704
avahi_simple_poll_loop(mc.simple_poll);
1705
988
exit(EXIT_FAILURE);
989
}
990
991
if(connect_to != NULL){
992
/* Connect directly, do not use Zeroconf */
993
/* (Mainly meant for debugging) */
994
char *address = strrchr(connect_to, ':');
995
if(address == NULL){
996
fprintf(stderr, "No colon in address\n");
997
exitcode = EXIT_FAILURE;
998
goto end;
999
}
1000
errno = 0;
1001
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
1002
if(errno){
1003
perror("Bad port number");
1004
exitcode = EXIT_FAILURE;
1005
goto end;
1006
}
1007
*address = '\0';
1008
address = connect_to;
1009
ret = start_mandos_communication(address, port, if_index, &mc);
1010
if(ret < 0){
1011
exitcode = EXIT_FAILURE;
1012
} else {
1013
exitcode = EXIT_SUCCESS;
1014
}
1015
goto end;
1016
}
1017
1018
if (not debug){
1019
avahi_set_log_function(empty_log);
1020
}
1021
1022
/* Initialize the pseudo-RNG for Avahi */
1023
srand((unsigned int) time(NULL));
1024
1025
/* Allocate main Avahi loop object */
1026
mc.simple_poll = avahi_simple_poll_new();
1027
if (mc.simple_poll == NULL) {
1028
fprintf(stderr, "Avahi: Failed to create simple poll"
1029
" object.\n");
1030
exitcode = EXIT_FAILURE;
1031
goto end;
1032
}
1033
1034
{
1035
AvahiServerConfig config;
1036
/* Do not publish any local Zeroconf records */
1037
avahi_server_config_init(&config);
1038
config.publish_hinfo = 0;
1039
config.publish_addresses = 0;
1040
config.publish_workstation = 0;
1041
config.publish_domain = 0;
1042
1043
/* Allocate a new server */
1044
mc.server = avahi_server_new(avahi_simple_poll_get
1045
(mc.simple_poll), &config, NULL,
1046
NULL, &error);
1047
1048
/* Free the Avahi configuration data */
1049
avahi_server_config_free(&config);
1050
}
1051
1052
/* Check if creating the Avahi server object succeeded */
1053
if (mc.server == NULL) {
1054
fprintf(stderr, "Failed to create Avahi server: %s\n",
1055
avahi_strerror(error));
1056
exitcode = EXIT_FAILURE;
1057
goto end;
1058
}
1059
1060
/* Create the Avahi service browser */
1061
sb = avahi_s_service_browser_new(mc.server, if_index,
1062
AVAHI_PROTO_INET6,
1063
"_mandos._tcp", NULL, 0,
1064
browse_callback, &mc);
1065
if (sb == NULL) {
1066
fprintf(stderr, "Failed to create service browser: %s\n",
1067
avahi_strerror(avahi_server_errno(mc.server)));
1068
exitcode = EXIT_FAILURE;
1069
goto end;
1070
}
1071
1072
/* Run the main loop */
1073
1074
if (debug){
1075
fprintf(stderr, "Starting Avahi loop search\n");
1076
}
1077
1078
avahi_simple_poll_loop(mc.simple_poll);
1079
1706
1080
end:
1707
1708
if(debug){
1709
fprintf(stderr, "%s exiting\n", argv[0]);
1710
}
1711
1712
/* Cleanup things */
1713
if(sb != NULL)
1714
avahi_s_service_browser_free(sb);
1715
1716
if(mc.server != NULL)
1717
avahi_server_free(mc.server);
1718
1719
if(mc.simple_poll != NULL)
1720
avahi_simple_poll_free(mc.simple_poll);
1721
1722
if(gnutls_initialized){
1723
gnutls_certificate_free_credentials(mc.cred);
1724
gnutls_global_deinit();
1725
gnutls_dh_params_deinit(mc.dh_params);
1726
}
1727
1728
if(gpgme_initialized){
1729
gpgme_release(mc.ctx);
1730
}
1731
1732
/* Take down the network interface */
1733
if(take_down_interface){
1734
/* Re-raise priviliges */
1735
errno = 0;
1736
ret = seteuid(0);
1737
if(ret == -1){
1738
perror("seteuid");
1739
}
1740
if(geteuid() == 0){
1741
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1742
if(ret == -1){
1743
perror("ioctl SIOCGIFFLAGS");
1744
} else if(network.ifr_flags & IFF_UP) {
1745
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1746
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1747
if(ret == -1){
1748
perror("ioctl SIOCSIFFLAGS -IFF_UP");
1749
}
1750
}
1751
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1752
if(ret == -1){
1753
perror("close");
1754
}
1755
/* Lower privileges permanently */
1756
errno = 0;
1757
ret = setuid(uid);
1758
if(ret == -1){
1759
perror("setuid");
1760
}
1761
}
1762
}
1763
1764
/* Removes the temp directory used by GPGME */
1765
if(tempdir_created){
1766
DIR *d;
1767
struct dirent *direntry;
1768
d = opendir(tempdir);
1769
if(d == NULL){
1770
if(errno != ENOENT){
1081
1082
if (debug){
1083
fprintf(stderr, "%s exiting\n", argv[0]);
1084
}
1085
1086
/* Cleanup things */
1087
if (sb != NULL)
1088
avahi_s_service_browser_free(sb);
1089
1090
if (mc.server != NULL)
1091
avahi_server_free(mc.server);
1092
1093
if (mc.simple_poll != NULL)
1094
avahi_simple_poll_free(mc.simple_poll);
1095
1096
if (gnutls_initalized){
1097
gnutls_certificate_free_credentials(mc.cred);
1098
gnutls_global_deinit ();
1099
gnutls_dh_params_deinit(mc.dh_params);
1100
}
1101
1102
if(gpgme_initalized){
1103
gpgme_release(mc.ctx);
1104
}
1105
1106
/* Removes the temp directory used by GPGME */
1107
if(tempdir[0] != '\0'){
1108
DIR *d;
1109
struct dirent *direntry;
1110
d = opendir(tempdir);
1111
if(d == NULL){
1771
1112
perror("opendir");
1772
}
1773
} else {
1774
while(true){
1775
direntry = readdir(d);
1776
if(direntry == NULL){
1777
break;
1778
}
1779
/* Skip "." and ".." */
1780
if(direntry->d_name[0] == '.'
1781
and (direntry->d_name[1] == '\0'
1782
or (direntry->d_name[1] == '.'
1783
and direntry->d_name[2] == '\0'))){
1784
continue;
1785
}
1786
char *fullname = NULL;
1787
ret = asprintf(&fullname, "%s/%s", tempdir,
1788
direntry->d_name);
1789
if(ret < 0){
1790
perror("asprintf");
1791
continue;
1792
}
1793
ret = remove(fullname);
1794
if(ret == -1){
1795
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1796
strerror(errno));
1797
}
1798
free(fullname);
1799
}
1800
closedir(d);
1801
}
1802
ret = rmdir(tempdir);
1803
if(ret == -1 and errno != ENOENT){
1804
perror("rmdir");
1805
}
1806
}
1807
1808
if(quit_now){
1809
sigemptyset(&old_sigterm_action.sa_mask);
1810
old_sigterm_action.sa_handler = SIG_DFL;
1811
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1812
&old_sigterm_action,
1813
NULL));
1814
if(ret == -1){
1815
perror("sigaction");
1816
}
1817
do {
1818
ret = raise(signal_received);
1819
} while(ret != 0 and errno == EINTR);
1820
if(ret != 0){
1821
perror("raise");
1822
abort();
1823
}
1824
TEMP_FAILURE_RETRY(pause());
1825
}
1826
1827
return exitcode;
1113
} else {
1114
while(true){
1115
direntry = readdir(d);
1116
if(direntry == NULL){
1117
break;
1118
}
1119
if (direntry->d_type == DT_REG){
1120
char *fullname = NULL;
1121
ret = asprintf(&fullname, "%s/%s", tempdir,
1122
direntry->d_name);
1123
if(ret < 0){
1124
perror("asprintf");
1125
continue;
1126
}
1127
ret = unlink(fullname);
1128
if(ret == -1){
1129
fprintf(stderr, "unlink(\"%s\"): %s",
1130
fullname, strerror(errno));
1131
}
1132
free(fullname);
1133
}
1134
}
1135
closedir(d);
1136
}
1137
ret = rmdir(tempdir);
1138
if(ret == -1){
1139
perror("rmdir");
1140
}
1141
}
1142
1143
return exitcode;
1828
1144
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0