To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 238
- compare with another revision
- download diff
- download tarball
- view history from revision 238
- Committer: Teddy Hogeborn
- Date: 2008-12-10 01:26:02 UTC
- mfrom: (237.1.2 mandos)
- Revision ID: teddy@fukt.bsnet.se-20081210012602-vhz3h75xkj24t340
First version of a somewhat complete D-Bus server interface. Also
change user/group name to "_mandos".
* debian/mandos.postinst: Rename old "mandos" user and group to
"_mandos"; create "_mandos" user and group
if none exist.
* debian/mandos-client.postinst: - '' -
* initramfs-tools-hook: Try "_mandos" before "mandos" as user and
group name.
* mandos (_datetime_to_dbus_struct): New; was previously local.
(Client.started): Renamed to "last_started". All users changed.
(Client.started): New; boolean.
(Client.dbus_object_path): New.
(Client.check_command): Renamed to "checker_command". All users
changed.
(Client.__init__): Set and use "self.dbus_object_path". Set
"self.started".
(Client.start): Update "self.started". Emit "self.PropertyChanged"
signals for both "started" and "last_started".
(Client.stop): Update "self.started". Emit "self.PropertyChanged"
signal for "started".
(Client.checker_callback): Take additional "command" argument. All
callers changed. Emit
"self.PropertyChanged" signal.
(Client.bump_timeout): Emit "self.PropertyChanged" signal for
"last_checked_ok".
(Client.start_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.stop_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.still_valid): Bug fix: use "getattr(self, started, False)"
instead of "self.started" in case this client
object is so new that the "started" attribute
has not been created yet.
(Client.IntervalChanged, Client.CheckerIsRunning, Client.GetChecker,
Client.GetCreated, Client.GetFingerprint, Client.GetHost,
Client.GetInterval, Client.GetName, Client.GetStarted,
Client.GetTimeout, Client.StateChanged, Client.TimeoutChanged):
Removed; all callers changed.
(Client.CheckerCompleted): Add "condition" and "command" arguments.
All callers changed.
(Client.GetAllProperties, Client.PropertyChanged): New.
(Client.StillValid): Renamed to "IsStillValid".
(Client.StartChecker): Changed to its own function to avoid the
return value from "Client.start_checker()".
(Client.Stop): Changed to its own function to avoid the return value
from "Client.stop()".
(main): Try "_mandos" before "mandos" as user and group name.
Removed inner function "remove_from_clients". New inner
class "MandosServer".
change user/group name to "_mandos".
* debian/mandos.postinst: Rename old "mandos" user and group to
"_mandos"; create "_mandos" user and group
if none exist.
* debian/mandos-client.postinst: - '' -
* initramfs-tools-hook: Try "_mandos" before "mandos" as user and
group name.
* mandos (_datetime_to_dbus_struct): New; was previously local.
(Client.started): Renamed to "last_started". All users changed.
(Client.started): New; boolean.
(Client.dbus_object_path): New.
(Client.check_command): Renamed to "checker_command". All users
changed.
(Client.__init__): Set and use "self.dbus_object_path". Set
"self.started".
(Client.start): Update "self.started". Emit "self.PropertyChanged"
signals for both "started" and "last_started".
(Client.stop): Update "self.started". Emit "self.PropertyChanged"
signal for "started".
(Client.checker_callback): Take additional "command" argument. All
callers changed. Emit
"self.PropertyChanged" signal.
(Client.bump_timeout): Emit "self.PropertyChanged" signal for
"last_checked_ok".
(Client.start_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.stop_checker): Emit "self.PropertyChanged" signal for
"checker_running".
(Client.still_valid): Bug fix: use "getattr(self, started, False)"
instead of "self.started" in case this client
object is so new that the "started" attribute
has not been created yet.
(Client.IntervalChanged, Client.CheckerIsRunning, Client.GetChecker,
Client.GetCreated, Client.GetFingerprint, Client.GetHost,
Client.GetInterval, Client.GetName, Client.GetStarted,
Client.GetTimeout, Client.StateChanged, Client.TimeoutChanged):
Removed; all callers changed.
(Client.CheckerCompleted): Add "condition" and "command" arguments.
All callers changed.
(Client.GetAllProperties, Client.PropertyChanged): New.
(Client.StillValid): Renamed to "IsStillValid".
(Client.StartChecker): Changed to its own function to avoid the
return value from "Client.start_checker()".
(Client.Stop): Changed to its own function to avoid the return value
from "Client.stop()".
(main): Try "_mandos" before "mandos" as user and group name.
Removed inner function "remove_from_clients". New inner
class "MandosServer".
- files added:
- debian/mandos-client.config
- files removed:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
3
* Mandos client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2011 Teddy Hogeborn
13
* Copyright © 2008-2011 Björn Påhlsson
12
* Copyright © 2008 Teddy Hogeborn
13
* Copyright © 2008 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
26
26
* along with this program. If not, see
27
27
* <http://www.gnu.org/licenses/>.
28
28
*
29
* Contact the authors at <mandos@recompile.se>.
29
* Contact the authors at <mandos@fukt.bsnet.se>.
30
30
*/
31
31
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
33
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
34
#define _FILE_OFFSET_BITS 64
38
#endif
39
35
40
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
37
42
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
39
stdout, ferror() */
44
40
#include <stdint.h> /* uint16_t, uint32_t */
45
41
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
42
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
43
srand() */
44
#include <stdbool.h> /* bool, true */
49
45
#include <string.h> /* memset(), strcmp(), strlen(),
50
46
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/ioctl.h> /* ioctl */
52
48
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
49
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open(), S_ISREG */
50
SOCK_STREAM, INET6_ADDRSTRLEN,
51
uid_t, gid_t, open(), opendir(), DIR */
52
#include <sys/stat.h> /* open() */
57
53
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
54
struct in6_addr, inet_pton(),
55
connect() */
59
56
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
57
#include <dirent.h> /* opendir(), struct dirent, readdir() */
58
#include <inttypes.h> /* PRIu16 */
64
59
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno,
66
program_invocation_short_name */
67
#include <time.h> /* nanosleep(), time(), sleep() */
60
#include <errno.h> /* perror(), errno */
61
#include <time.h> /* time() */
68
62
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
69
63
SIOCSIFFLAGS, if_indextoname(),
70
64
if_nametoindex(), IF_NAMESIZE */
71
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
72
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
73
*/
65
#include <netinet/in.h>
74
66
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
75
getuid(), getgid(), seteuid(),
76
setgid(), pause() */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
78
#include <iso646.h> /* not, or, and */
67
getuid(), getgid(), setuid(),
68
setgid() */
69
#include <arpa/inet.h> /* inet_pton(), htons */
70
#include <iso646.h> /* not, and */
79
71
#include <argp.h> /* struct argp_option, error_t, struct
80
72
argp_state, struct argp,
81
73
argp_parse(), ARGP_KEY_ARG,
82
74
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
83
#include <signal.h> /* sigemptyset(), sigaddset(),
84
sigaction(), SIGTERM, sig_atomic_t,
85
raise() */
86
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
87
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
89
WEXITSTATUS(), WTERMSIG() */
90
91
#ifdef __linux__
92
#include <sys/klog.h> /* klogctl() */
93
#endif /* __linux__ */
94
75
95
76
/* Avahi */
96
77
/* All Avahi types, constants and functions
109
90
gnutls_*
110
91
init_gnutls_session(),
111
92
GNUTLS_* */
112
#include <gnutls/openpgp.h>
113
/* gnutls_certificate_set_openpgp_key_file(),
93
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
114
94
GNUTLS_OPENPGP_FMT_BASE64 */
115
95
116
96
/* GPGME */
125
105
#define PATHDIR "/conf/conf.d/mandos"
126
106
#define SECKEY "seckey.txt"
127
107
#define PUBKEY "pubkey.txt"
128
#define HOOKDIR "/lib/mandos/network-hooks.d"
129
108
130
109
bool debug = false;
131
110
static const char mandos_protocol_version[] = "1";
132
111
const char *argp_program_version = "mandos-client " VERSION;
133
const char *argp_program_bug_address = "<mandos@recompile.se>";
134
static const char sys_class_net[] = "/sys/class/net";
135
char *connect_to = NULL;
136
const char *hookdir = HOOKDIR;
137
138
/* Doubly linked list that need to be circularly linked when used */
139
typedef struct server{
140
const char *ip;
141
uint16_t port;
142
AvahiIfIndex if_index;
143
int af;
144
struct timespec last_seen;
145
struct server *next;
146
struct server *prev;
147
} server;
112
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
148
113
149
114
/* Used for passing in values through the Avahi callback functions */
150
115
typedef struct {
155
120
gnutls_dh_params_t dh_params;
156
121
const char *priority;
157
122
gpgme_ctx_t ctx;
158
server *current_server;
159
123
} mandos_context;
160
124
161
/* global context so signal handler can reach it*/
162
mandos_context mc = { .simple_poll = NULL, .server = NULL,
163
.dh_bits = 1024, .priority = "SECURE256"
164
":!CTYPE-X.509:+CTYPE-OPENPGP",
165
.current_server = NULL };
166
167
sig_atomic_t quit_now = 0;
168
int signal_received = 0;
169
170
/* Function to use when printing errors */
171
void perror_plus(const char *print_text){
172
fprintf(stderr, "Mandos plugin %s: ",
173
program_invocation_short_name);
174
perror(print_text);
175
}
176
177
125
/*
178
* Make additional room in "buffer" for at least BUFFER_SIZE more
179
* bytes. "buffer_capacity" is how much is currently allocated,
126
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
127
* "buffer_capacity" is how much is currently allocated,
180
128
* "buffer_length" is how much is already used.
181
129
*/
182
size_t incbuffer(char **buffer, size_t buffer_length,
130
size_t adjustbuffer(char **buffer, size_t buffer_length,
183
131
size_t buffer_capacity){
184
if(buffer_length + BUFFER_SIZE > buffer_capacity){
132
if (buffer_length + BUFFER_SIZE > buffer_capacity){
185
133
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
186
if(buffer == NULL){
134
if (buffer == NULL){
187
135
return 0;
188
136
}
189
137
buffer_capacity += BUFFER_SIZE;
191
139
return buffer_capacity;
192
140
}
193
141
194
/* Add server to set of servers to retry periodically */
195
int add_server(const char *ip, uint16_t port,
196
AvahiIfIndex if_index,
197
int af){
198
int ret;
199
server *new_server = malloc(sizeof(server));
200
if(new_server == NULL){
201
perror_plus("malloc");
202
return -1;
203
}
204
*new_server = (server){ .ip = strdup(ip),
205
.port = port,
206
.if_index = if_index,
207
.af = af };
208
if(new_server->ip == NULL){
209
perror_plus("strdup");
210
return -1;
211
}
212
/* Special case of first server */
213
if (mc.current_server == NULL){
214
new_server->next = new_server;
215
new_server->prev = new_server;
216
mc.current_server = new_server;
217
/* Place the new server last in the list */
218
} else {
219
new_server->next = mc.current_server;
220
new_server->prev = mc.current_server->prev;
221
new_server->prev->next = new_server;
222
mc.current_server->prev = new_server;
223
}
224
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
225
if(ret == -1){
226
perror_plus("clock_gettime");
227
return -1;
228
}
229
return 0;
230
}
231
232
142
/*
233
143
* Initialize GPGME.
234
144
*/
235
static bool init_gpgme(const char *seckey,
145
static bool init_gpgme(mandos_context *mc, const char *seckey,
236
146
const char *pubkey, const char *tempdir){
147
int ret;
237
148
gpgme_error_t rc;
238
149
gpgme_engine_info_t engine_info;
239
150
240
151
241
152
/*
242
* Helper function to insert pub and seckey to the engine keyring.
153
* Helper function to insert pub and seckey to the enigne keyring.
243
154
*/
244
155
bool import_key(const char *filename){
245
int ret;
246
156
int fd;
247
157
gpgme_data_t pgp_data;
248
158
249
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
159
fd = TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
250
160
if(fd == -1){
251
perror_plus("open");
161
perror("open");
252
162
return false;
253
163
}
254
164
255
165
rc = gpgme_data_new_from_fd(&pgp_data, fd);
256
if(rc != GPG_ERR_NO_ERROR){
257
fprintf(stderr, "Mandos plugin mandos-client: "
258
"bad gpgme_data_new_from_fd: %s: %s\n",
259
gpgme_strsource(rc), gpgme_strerror(rc));
260
return false;
261
}
262
263
rc = gpgme_op_import(mc.ctx, pgp_data);
264
if(rc != GPG_ERR_NO_ERROR){
265
fprintf(stderr, "Mandos plugin mandos-client: "
266
"bad gpgme_op_import: %s: %s\n",
267
gpgme_strsource(rc), gpgme_strerror(rc));
268
return false;
269
}
270
271
ret = (int)TEMP_FAILURE_RETRY(close(fd));
166
if (rc != GPG_ERR_NO_ERROR){
167
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
168
gpgme_strsource(rc), gpgme_strerror(rc));
169
return false;
170
}
171
172
rc = gpgme_op_import(mc->ctx, pgp_data);
173
if (rc != GPG_ERR_NO_ERROR){
174
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
175
gpgme_strsource(rc), gpgme_strerror(rc));
176
return false;
177
}
178
179
ret = TEMP_FAILURE_RETRY(close(fd));
272
180
if(ret == -1){
273
perror_plus("close");
181
perror("close");
274
182
}
275
183
gpgme_data_release(pgp_data);
276
184
return true;
277
185
}
278
186
279
if(debug){
280
fprintf(stderr, "Mandos plugin mandos-client: "
281
"Initializing GPGME\n");
187
if (debug){
188
fprintf(stderr, "Initialize gpgme\n");
282
189
}
283
190
284
191
/* Init GPGME */
285
192
gpgme_check_version(NULL);
286
193
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
287
if(rc != GPG_ERR_NO_ERROR){
288
fprintf(stderr, "Mandos plugin mandos-client: "
289
"bad gpgme_engine_check_version: %s: %s\n",
194
if (rc != GPG_ERR_NO_ERROR){
195
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
290
196
gpgme_strsource(rc), gpgme_strerror(rc));
291
197
return false;
292
198
}
293
199
294
/* Set GPGME home directory for the OpenPGP engine only */
295
rc = gpgme_get_engine_info(&engine_info);
296
if(rc != GPG_ERR_NO_ERROR){
297
fprintf(stderr, "Mandos plugin mandos-client: "
298
"bad gpgme_get_engine_info: %s: %s\n",
200
/* Set GPGME home directory for the OpenPGP engine only */
201
rc = gpgme_get_engine_info (&engine_info);
202
if (rc != GPG_ERR_NO_ERROR){
203
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
299
204
gpgme_strsource(rc), gpgme_strerror(rc));
300
205
return false;
301
206
}
308
213
engine_info = engine_info->next;
309
214
}
310
215
if(engine_info == NULL){
311
fprintf(stderr, "Mandos plugin mandos-client: "
312
"Could not set GPGME home dir to %s\n", tempdir);
216
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
313
217
return false;
314
218
}
315
219
316
220
/* Create new GPGME "context" */
317
rc = gpgme_new(&(mc.ctx));
318
if(rc != GPG_ERR_NO_ERROR){
319
fprintf(stderr, "Mandos plugin mandos-client: "
320
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
321
gpgme_strerror(rc));
322
return false;
323
}
324
325
if(not import_key(pubkey) or not import_key(seckey)){
326
return false;
327
}
328
329
return true;
221
rc = gpgme_new(&(mc->ctx));
222
if (rc != GPG_ERR_NO_ERROR){
223
fprintf(stderr, "bad gpgme_new: %s: %s\n",
224
gpgme_strsource(rc), gpgme_strerror(rc));
225
return false;
226
}
227
228
if (not import_key(pubkey) or not import_key(seckey)){
229
return false;
230
}
231
232
return true;
330
233
}
331
234
332
235
/*
333
236
* Decrypt OpenPGP data.
334
237
* Returns -1 on error
335
238
*/
336
static ssize_t pgp_packet_decrypt(const char *cryptotext,
337
size_t crypto_size,
338
char **plaintext){
239
static ssize_t pgp_packet_decrypt (const mandos_context *mc,
240
const char *cryptotext,
241
size_t crypto_size,
242
char **plaintext){
339
243
gpgme_data_t dh_crypto, dh_plain;
340
244
gpgme_error_t rc;
341
245
ssize_t ret;
342
246
size_t plaintext_capacity = 0;
343
247
ssize_t plaintext_length = 0;
344
248
345
if(debug){
346
fprintf(stderr, "Mandos plugin mandos-client: "
347
"Trying to decrypt OpenPGP data\n");
249
if (debug){
250
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
348
251
}
349
252
350
253
/* Create new GPGME data buffer from memory cryptotext */
351
254
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
352
255
0);
353
if(rc != GPG_ERR_NO_ERROR){
354
fprintf(stderr, "Mandos plugin mandos-client: "
355
"bad gpgme_data_new_from_mem: %s: %s\n",
256
if (rc != GPG_ERR_NO_ERROR){
257
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
356
258
gpgme_strsource(rc), gpgme_strerror(rc));
357
259
return -1;
358
260
}
359
261
360
262
/* Create new empty GPGME data buffer for the plaintext */
361
263
rc = gpgme_data_new(&dh_plain);
362
if(rc != GPG_ERR_NO_ERROR){
363
fprintf(stderr, "Mandos plugin mandos-client: "
364
"bad gpgme_data_new: %s: %s\n",
264
if (rc != GPG_ERR_NO_ERROR){
265
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
365
266
gpgme_strsource(rc), gpgme_strerror(rc));
366
267
gpgme_data_release(dh_crypto);
367
268
return -1;
369
270
370
271
/* Decrypt data from the cryptotext data buffer to the plaintext
371
272
data buffer */
372
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
373
if(rc != GPG_ERR_NO_ERROR){
374
fprintf(stderr, "Mandos plugin mandos-client: "
375
"bad gpgme_op_decrypt: %s: %s\n",
273
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
274
if (rc != GPG_ERR_NO_ERROR){
275
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
376
276
gpgme_strsource(rc), gpgme_strerror(rc));
377
277
plaintext_length = -1;
378
if(debug){
278
if (debug){
379
279
gpgme_decrypt_result_t result;
380
result = gpgme_op_decrypt_result(mc.ctx);
381
if(result == NULL){
382
fprintf(stderr, "Mandos plugin mandos-client: "
383
"gpgme_op_decrypt_result failed\n");
280
result = gpgme_op_decrypt_result(mc->ctx);
281
if (result == NULL){
282
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
384
283
} else {
385
fprintf(stderr, "Mandos plugin mandos-client: "
386
"Unsupported algorithm: %s\n",
284
fprintf(stderr, "Unsupported algorithm: %s\n",
387
285
result->unsupported_algorithm);
388
fprintf(stderr, "Mandos plugin mandos-client: "
389
"Wrong key usage: %u\n",
286
fprintf(stderr, "Wrong key usage: %u\n",
390
287
result->wrong_key_usage);
391
288
if(result->file_name != NULL){
392
fprintf(stderr, "Mandos plugin mandos-client: "
393
"File name: %s\n", result->file_name);
289
fprintf(stderr, "File name: %s\n", result->file_name);
394
290
}
395
291
gpgme_recipient_t recipient;
396
292
recipient = result->recipients;
397
while(recipient != NULL){
398
fprintf(stderr, "Mandos plugin mandos-client: "
399
"Public key algorithm: %s\n",
400
gpgme_pubkey_algo_name(recipient->pubkey_algo));
401
fprintf(stderr, "Mandos plugin mandos-client: "
402
"Key ID: %s\n", recipient->keyid);
403
fprintf(stderr, "Mandos plugin mandos-client: "
404
"Secret key available: %s\n",
405
recipient->status == GPG_ERR_NO_SECKEY
406
? "No" : "Yes");
407
recipient = recipient->next;
293
if(recipient){
294
while(recipient != NULL){
295
fprintf(stderr, "Public key algorithm: %s\n",
296
gpgme_pubkey_algo_name(recipient->pubkey_algo));
297
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
298
fprintf(stderr, "Secret key available: %s\n",
299
recipient->status == GPG_ERR_NO_SECKEY
300
? "No" : "Yes");
301
recipient = recipient->next;
302
}
408
303
}
409
304
}
410
305
}
412
307
}
413
308
414
309
if(debug){
415
fprintf(stderr, "Mandos plugin mandos-client: "
416
"Decryption of OpenPGP data succeeded\n");
310
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
417
311
}
418
312
419
313
/* Seek back to the beginning of the GPGME plaintext data buffer */
420
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
421
perror_plus("gpgme_data_seek");
314
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
315
perror("gpgme_data_seek");
422
316
plaintext_length = -1;
423
317
goto decrypt_end;
424
318
}
425
319
426
320
*plaintext = NULL;
427
321
while(true){
428
plaintext_capacity = incbuffer(plaintext,
322
plaintext_capacity = adjustbuffer(plaintext,
429
323
(size_t)plaintext_length,
430
324
plaintext_capacity);
431
if(plaintext_capacity == 0){
432
perror_plus("incbuffer");
325
if (plaintext_capacity == 0){
326
perror("adjustbuffer");
433
327
plaintext_length = -1;
434
328
goto decrypt_end;
435
329
}
437
331
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
438
332
BUFFER_SIZE);
439
333
/* Print the data, if any */
440
if(ret == 0){
334
if (ret == 0){
441
335
/* EOF */
442
336
break;
443
337
}
444
338
if(ret < 0){
445
perror_plus("gpgme_data_read");
339
perror("gpgme_data_read");
446
340
plaintext_length = -1;
447
341
goto decrypt_end;
448
342
}
450
344
}
451
345
452
346
if(debug){
453
fprintf(stderr, "Mandos plugin mandos-client: "
454
"Decrypted password is: ");
347
fprintf(stderr, "Decrypted password is: ");
455
348
for(ssize_t i = 0; i < plaintext_length; i++){
456
349
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
457
350
}
468
361
return plaintext_length;
469
362
}
470
363
471
static const char * safer_gnutls_strerror(int value){
472
const char *ret = gnutls_strerror(value); /* Spurious warning from
473
-Wunreachable-code */
474
if(ret == NULL)
364
static const char * safer_gnutls_strerror (int value) {
365
const char *ret = gnutls_strerror (value); /* Spurious warning */
366
if (ret == NULL)
475
367
ret = "(unknown)";
476
368
return ret;
477
369
}
479
371
/* GnuTLS log function callback */
480
372
static void debuggnutls(__attribute__((unused)) int level,
481
373
const char* string){
482
fprintf(stderr, "Mandos plugin mandos-client: GnuTLS: %s", string);
374
fprintf(stderr, "GnuTLS: %s", string);
483
375
}
484
376
485
static int init_gnutls_global(const char *pubkeyfilename,
377
static int init_gnutls_global(mandos_context *mc,
378
const char *pubkeyfilename,
486
379
const char *seckeyfilename){
487
380
int ret;
488
381
489
382
if(debug){
490
fprintf(stderr, "Mandos plugin mandos-client: "
491
"Initializing GnuTLS\n");
383
fprintf(stderr, "Initializing GnuTLS\n");
492
384
}
493
385
494
386
ret = gnutls_global_init();
495
if(ret != GNUTLS_E_SUCCESS){
496
fprintf(stderr, "Mandos plugin mandos-client: "
497
"GnuTLS global_init: %s\n", safer_gnutls_strerror(ret));
387
if (ret != GNUTLS_E_SUCCESS) {
388
fprintf (stderr, "GnuTLS global_init: %s\n",
389
safer_gnutls_strerror(ret));
498
390
return -1;
499
391
}
500
392
501
if(debug){
393
if (debug){
502
394
/* "Use a log level over 10 to enable all debugging options."
503
395
* - GnuTLS manual
504
396
*/
507
399
}
508
400
509
401
/* OpenPGP credentials */
510
ret = gnutls_certificate_allocate_credentials(&mc.cred);
511
if(ret != GNUTLS_E_SUCCESS){
512
fprintf(stderr, "Mandos plugin mandos-client: "
513
"GnuTLS memory error: %s\n", safer_gnutls_strerror(ret));
514
gnutls_global_deinit();
402
gnutls_certificate_allocate_credentials(&mc->cred);
403
if (ret != GNUTLS_E_SUCCESS){
404
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
405
warning */
406
safer_gnutls_strerror(ret));
407
gnutls_global_deinit ();
515
408
return -1;
516
409
}
517
410
518
411
if(debug){
519
fprintf(stderr, "Mandos plugin mandos-client: "
520
"Attempting to use OpenPGP public key %s and"
412
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
521
413
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
522
414
seckeyfilename);
523
415
}
524
416
525
417
ret = gnutls_certificate_set_openpgp_key_file
526
(mc.cred, pubkeyfilename, seckeyfilename,
418
(mc->cred, pubkeyfilename, seckeyfilename,
527
419
GNUTLS_OPENPGP_FMT_BASE64);
528
if(ret != GNUTLS_E_SUCCESS){
420
if (ret != GNUTLS_E_SUCCESS) {
529
421
fprintf(stderr,
530
"Mandos plugin mandos-client: "
531
422
"Error[%d] while reading the OpenPGP key pair ('%s',"
532
423
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
533
fprintf(stderr, "Mandos plugin mandos-client: "
534
"The GnuTLS error is: %s\n", safer_gnutls_strerror(ret));
424
fprintf(stderr, "The GnuTLS error is: %s\n",
425
safer_gnutls_strerror(ret));
535
426
goto globalfail;
536
427
}
537
428
538
429
/* GnuTLS server initialization */
539
ret = gnutls_dh_params_init(&mc.dh_params);
540
if(ret != GNUTLS_E_SUCCESS){
541
fprintf(stderr, "Mandos plugin mandos-client: "
542
"Error in GnuTLS DH parameter initialization:"
543
" %s\n", safer_gnutls_strerror(ret));
430
ret = gnutls_dh_params_init(&mc->dh_params);
431
if (ret != GNUTLS_E_SUCCESS) {
432
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
433
" %s\n", safer_gnutls_strerror(ret));
544
434
goto globalfail;
545
435
}
546
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
547
if(ret != GNUTLS_E_SUCCESS){
548
fprintf(stderr, "Mandos plugin mandos-client: "
549
"Error in GnuTLS prime generation: %s\n",
550
safer_gnutls_strerror(ret));
436
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
437
if (ret != GNUTLS_E_SUCCESS) {
438
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
439
safer_gnutls_strerror(ret));
551
440
goto globalfail;
552
441
}
553
442
554
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
443
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
555
444
556
445
return 0;
557
446
558
447
globalfail:
559
448
560
gnutls_certificate_free_credentials(mc.cred);
449
gnutls_certificate_free_credentials(mc->cred);
561
450
gnutls_global_deinit();
562
gnutls_dh_params_deinit(mc.dh_params);
451
gnutls_dh_params_deinit(mc->dh_params);
563
452
return -1;
564
453
}
565
454
566
static int init_gnutls_session(gnutls_session_t *session){
455
static int init_gnutls_session(mandos_context *mc,
456
gnutls_session_t *session){
567
457
int ret;
568
458
/* GnuTLS session creation */
569
do {
570
ret = gnutls_init(session, GNUTLS_SERVER);
571
if(quit_now){
572
return -1;
573
}
574
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
575
if(ret != GNUTLS_E_SUCCESS){
576
fprintf(stderr, "Mandos plugin mandos-client: "
577
"Error in GnuTLS session initialization: %s\n",
459
ret = gnutls_init(session, GNUTLS_SERVER);
460
if (ret != GNUTLS_E_SUCCESS){
461
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
578
462
safer_gnutls_strerror(ret));
579
463
}
580
464
581
465
{
582
466
const char *err;
583
do {
584
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
585
if(quit_now){
586
gnutls_deinit(*session);
587
return -1;
588
}
589
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
590
if(ret != GNUTLS_E_SUCCESS){
591
fprintf(stderr, "Mandos plugin mandos-client: "
592
"Syntax error at: %s\n", err);
593
fprintf(stderr, "Mandos plugin mandos-client: "
594
"GnuTLS error: %s\n", safer_gnutls_strerror(ret));
595
gnutls_deinit(*session);
467
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
468
if (ret != GNUTLS_E_SUCCESS) {
469
fprintf(stderr, "Syntax error at: %s\n", err);
470
fprintf(stderr, "GnuTLS error: %s\n",
471
safer_gnutls_strerror(ret));
472
gnutls_deinit (*session);
596
473
return -1;
597
474
}
598
475
}
599
476
600
do {
601
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
602
mc.cred);
603
if(quit_now){
604
gnutls_deinit(*session);
605
return -1;
606
}
607
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
608
if(ret != GNUTLS_E_SUCCESS){
609
fprintf(stderr, "Mandos plugin mandos-client: "
610
"Error setting GnuTLS credentials: %s\n",
477
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
478
mc->cred);
479
if (ret != GNUTLS_E_SUCCESS) {
480
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
611
481
safer_gnutls_strerror(ret));
612
gnutls_deinit(*session);
482
gnutls_deinit (*session);
613
483
return -1;
614
484
}
615
485
616
486
/* ignore client certificate if any. */
617
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
487
gnutls_certificate_server_set_request (*session,
488
GNUTLS_CERT_IGNORE);
618
489
619
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
490
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
620
491
621
492
return 0;
622
493
}
628
499
/* Called when a Mandos server is found */
629
500
static int start_mandos_communication(const char *ip, uint16_t port,
630
501
AvahiIfIndex if_index,
631
int af){
632
int ret, tcp_sd = -1;
633
ssize_t sret;
634
union {
635
struct sockaddr_in in;
636
struct sockaddr_in6 in6;
637
} to;
502
mandos_context *mc){
503
int ret, tcp_sd;
504
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
638
505
char *buffer = NULL;
639
char *decrypted_buffer = NULL;
506
char *decrypted_buffer;
640
507
size_t buffer_length = 0;
641
508
size_t buffer_capacity = 0;
509
ssize_t decrypted_buffer_size;
642
510
size_t written;
643
int retval = -1;
511
int retval = 0;
512
char interface[IF_NAMESIZE];
644
513
gnutls_session_t session;
645
int pf; /* Protocol family */
646
647
errno = 0;
648
649
if(quit_now){
650
errno = EINTR;
651
return -1;
652
}
653
654
switch(af){
655
case AF_INET6:
656
pf = PF_INET6;
657
break;
658
case AF_INET:
659
pf = PF_INET;
660
break;
661
default:
662
fprintf(stderr, "Mandos plugin mandos-client: "
663
"Bad address family: %d\n", af);
664
errno = EINVAL;
665
return -1;
666
}
667
668
ret = init_gnutls_session(&session);
669
if(ret != 0){
514
515
ret = init_gnutls_session (mc, &session);
516
if (ret != 0){
670
517
return -1;
671
518
}
672
519
673
520
if(debug){
674
fprintf(stderr, "Mandos plugin mandos-client: "
675
"Setting up a TCP connection to %s, port %" PRIu16
521
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
676
522
"\n", ip, port);
677
523
}
678
524
679
tcp_sd = socket(pf, SOCK_STREAM, 0);
680
if(tcp_sd < 0){
681
int e = errno;
682
perror_plus("socket");
683
errno = e;
684
goto mandos_end;
525
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
526
if(tcp_sd < 0) {
527
perror("socket");
528
return -1;
685
529
}
686
530
687
if(quit_now){
688
errno = EINTR;
689
goto mandos_end;
531
if(debug){
532
if(if_indextoname((unsigned int)if_index, interface) == NULL){
533
perror("if_indextoname");
534
return -1;
535
}
536
fprintf(stderr, "Binding to interface %s\n", interface);
690
537
}
691
538
692
539
memset(&to, 0, sizeof(to));
693
if(af == AF_INET6){
694
to.in6.sin6_family = (sa_family_t)af;
695
ret = inet_pton(af, ip, &to.in6.sin6_addr);
696
} else { /* IPv4 */
697
to.in.sin_family = (sa_family_t)af;
698
ret = inet_pton(af, ip, &to.in.sin_addr);
699
}
700
if(ret < 0 ){
701
int e = errno;
702
perror_plus("inet_pton");
703
errno = e;
704
goto mandos_end;
540
to.in6.sin6_family = AF_INET6;
541
/* It would be nice to have a way to detect if we were passed an
542
IPv4 address here. Now we assume an IPv6 address. */
543
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
544
if (ret < 0 ){
545
perror("inet_pton");
546
return -1;
705
547
}
706
548
if(ret == 0){
707
int e = errno;
708
fprintf(stderr, "Mandos plugin mandos-client: "
709
"Bad address: %s\n", ip);
710
errno = e;
711
goto mandos_end;
712
}
713
if(af == AF_INET6){
714
to.in6.sin6_port = htons(port); /* Spurious warnings from
715
-Wconversion and
716
-Wunreachable-code */
717
718
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
719
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
720
-Wunreachable-code*/
721
if(if_index == AVAHI_IF_UNSPEC){
722
fprintf(stderr, "Mandos plugin mandos-client: "
723
"An IPv6 link-local address is incomplete"
724
" without a network interface\n");
725
errno = EINVAL;
726
goto mandos_end;
727
}
728
/* Set the network interface number as scope */
729
to.in6.sin6_scope_id = (uint32_t)if_index;
730
}
731
} else {
732
to.in.sin_port = htons(port); /* Spurious warnings from
733
-Wconversion and
734
-Wunreachable-code */
735
}
549
fprintf(stderr, "Bad address: %s\n", ip);
550
return -1;
551
}
552
to.in6.sin6_port = htons(port); /* Spurious warning */
736
553
737
if(quit_now){
738
errno = EINTR;
739
goto mandos_end;
740
}
554
to.in6.sin6_scope_id = (uint32_t)if_index;
741
555
742
556
if(debug){
743
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
744
char interface[IF_NAMESIZE];
745
if(if_indextoname((unsigned int)if_index, interface) == NULL){
746
perror_plus("if_indextoname");
747
} else {
748
fprintf(stderr, "Mandos plugin mandos-client: "
749
"Connection to: %s%%%s, port %" PRIu16 "\n",
750
ip, interface, port);
751
}
752
} else {
753
fprintf(stderr, "Mandos plugin mandos-client: "
754
"Connection to: %s, port %" PRIu16 "\n", ip, port);
755
}
756
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
757
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
758
const char *pcret;
759
if(af == AF_INET6){
760
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
761
sizeof(addrstr));
762
} else {
763
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
764
sizeof(addrstr));
765
}
766
if(pcret == NULL){
767
perror_plus("inet_ntop");
557
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
558
port);
559
char addrstr[INET6_ADDRSTRLEN] = "";
560
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
561
sizeof(addrstr)) == NULL){
562
perror("inet_ntop");
768
563
} else {
769
564
if(strcmp(addrstr, ip) != 0){
770
fprintf(stderr, "Mandos plugin mandos-client: "
771
"Canonical address form: %s\n", addrstr);
565
fprintf(stderr, "Canonical address form: %s\n", addrstr);
772
566
}
773
567
}
774
568
}
775
569
776
if(quit_now){
777
errno = EINTR;
778
goto mandos_end;
779
}
780
781
if(af == AF_INET6){
782
ret = connect(tcp_sd, &to.in6, sizeof(to));
783
} else {
784
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
785
}
786
if(ret < 0){
787
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
788
int e = errno;
789
perror_plus("connect");
790
errno = e;
791
}
792
goto mandos_end;
793
}
794
795
if(quit_now){
796
errno = EINTR;
797
goto mandos_end;
570
ret = connect(tcp_sd, &to.in, sizeof(to));
571
if (ret < 0){
572
perror("connect");
573
return -1;
798
574
}
799
575
800
576
const char *out = mandos_protocol_version;
801
577
written = 0;
802
while(true){
578
while (true){
803
579
size_t out_size = strlen(out);
804
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
580
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
805
581
out_size - written));
806
if(ret == -1){
807
int e = errno;
808
perror_plus("write");
809
errno = e;
582
if (ret == -1){
583
perror("write");
584
retval = -1;
810
585
goto mandos_end;
811
586
}
812
587
written += (size_t)ret;
813
588
if(written < out_size){
814
589
continue;
815
590
} else {
816
if(out == mandos_protocol_version){
591
if (out == mandos_protocol_version){
817
592
written = 0;
818
593
out = "\r\n";
819
594
} else {
820
595
break;
821
596
}
822
597
}
823
824
if(quit_now){
825
errno = EINTR;
826
goto mandos_end;
827
}
828
598
}
829
599
830
600
if(debug){
831
fprintf(stderr, "Mandos plugin mandos-client: "
832
"Establishing TLS session with %s\n", ip);
833
}
834
835
if(quit_now){
836
errno = EINTR;
837
goto mandos_end;
838
}
839
840
/* Spurious warning from -Wint-to-pointer-cast */
841
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
842
843
if(quit_now){
844
errno = EINTR;
845
goto mandos_end;
846
}
847
848
do {
849
ret = gnutls_handshake(session);
850
if(quit_now){
851
errno = EINTR;
852
goto mandos_end;
853
}
601
fprintf(stderr, "Establishing TLS session with %s\n", ip);
602
}
603
604
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
605
606
do{
607
ret = gnutls_handshake (session);
854
608
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
855
609
856
if(ret != GNUTLS_E_SUCCESS){
610
if (ret != GNUTLS_E_SUCCESS){
857
611
if(debug){
858
fprintf(stderr, "Mandos plugin mandos-client: "
859
"*** GnuTLS Handshake failed ***\n");
860
gnutls_perror(ret);
612
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
613
gnutls_perror (ret);
861
614
}
862
errno = EPROTO;
615
retval = -1;
863
616
goto mandos_end;
864
617
}
865
618
866
619
/* Read OpenPGP packet that contains the wanted password */
867
620
868
621
if(debug){
869
fprintf(stderr, "Mandos plugin mandos-client: "
870
"Retrieving OpenPGP encrypted password from %s\n", ip);
622
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
623
ip);
871
624
}
872
625
873
626
while(true){
874
875
if(quit_now){
876
errno = EINTR;
877
goto mandos_end;
878
}
879
880
buffer_capacity = incbuffer(&buffer, buffer_length,
627
buffer_capacity = adjustbuffer(&buffer, buffer_length,
881
628
buffer_capacity);
882
if(buffer_capacity == 0){
883
int e = errno;
884
perror_plus("incbuffer");
885
errno = e;
886
goto mandos_end;
887
}
888
889
if(quit_now){
890
errno = EINTR;
891
goto mandos_end;
892
}
893
894
sret = gnutls_record_recv(session, buffer+buffer_length,
895
BUFFER_SIZE);
896
if(sret == 0){
629
if (buffer_capacity == 0){
630
perror("adjustbuffer");
631
retval = -1;
632
goto mandos_end;
633
}
634
635
ret = gnutls_record_recv(session, buffer+buffer_length,
636
BUFFER_SIZE);
637
if (ret == 0){
897
638
break;
898
639
}
899
if(sret < 0){
900
switch(sret){
640
if (ret < 0){
641
switch(ret){
901
642
case GNUTLS_E_INTERRUPTED:
902
643
case GNUTLS_E_AGAIN:
903
644
break;
904
645
case GNUTLS_E_REHANDSHAKE:
905
do {
906
ret = gnutls_handshake(session);
907
908
if(quit_now){
909
errno = EINTR;
910
goto mandos_end;
911
}
646
do{
647
ret = gnutls_handshake (session);
912
648
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
913
if(ret < 0){
914
fprintf(stderr, "Mandos plugin mandos-client: "
915
"*** GnuTLS Re-handshake failed ***\n");
916
gnutls_perror(ret);
917
errno = EPROTO;
649
if (ret < 0){
650
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
651
gnutls_perror (ret);
652
retval = -1;
918
653
goto mandos_end;
919
654
}
920
655
break;
921
656
default:
922
fprintf(stderr, "Mandos plugin mandos-client: "
923
"Unknown error while reading data from"
657
fprintf(stderr, "Unknown error while reading data from"
924
658
" encrypted session with Mandos server\n");
925
gnutls_bye(session, GNUTLS_SHUT_RDWR);
926
errno = EIO;
659
retval = -1;
660
gnutls_bye (session, GNUTLS_SHUT_RDWR);
927
661
goto mandos_end;
928
662
}
929
663
} else {
930
buffer_length += (size_t) sret;
664
buffer_length += (size_t) ret;
931
665
}
932
666
}
933
667
934
668
if(debug){
935
fprintf(stderr, "Mandos plugin mandos-client: "
936
"Closing TLS session\n");
937
}
938
939
if(quit_now){
940
errno = EINTR;
941
goto mandos_end;
942
}
943
944
do {
945
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
946
if(quit_now){
947
errno = EINTR;
948
goto mandos_end;
949
}
950
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
951
952
if(buffer_length > 0){
953
ssize_t decrypted_buffer_size;
954
decrypted_buffer_size = pgp_packet_decrypt(buffer,
669
fprintf(stderr, "Closing TLS session\n");
670
}
671
672
gnutls_bye (session, GNUTLS_SHUT_RDWR);
673
674
if (buffer_length > 0){
675
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
955
676
buffer_length,
956
677
&decrypted_buffer);
957
if(decrypted_buffer_size >= 0){
958
678
if (decrypted_buffer_size >= 0){
959
679
written = 0;
960
680
while(written < (size_t) decrypted_buffer_size){
961
if(quit_now){
962
errno = EINTR;
963
goto mandos_end;
964
}
965
966
ret = (int)fwrite(decrypted_buffer + written, 1,
967
(size_t)decrypted_buffer_size - written,
968
stdout);
681
ret = (int)fwrite (decrypted_buffer + written, 1,
682
(size_t)decrypted_buffer_size - written,
683
stdout);
969
684
if(ret == 0 and ferror(stdout)){
970
int e = errno;
971
685
if(debug){
972
fprintf(stderr, "Mandos plugin mandos-client: "
973
"Error writing encrypted data: %s\n",
686
fprintf(stderr, "Error writing encrypted data: %s\n",
974
687
strerror(errno));
975
688
}
976
errno = e;
977
goto mandos_end;
689
retval = -1;
690
break;
978
691
}
979
692
written += (size_t)ret;
980
693
}
981
retval = 0;
694
free(decrypted_buffer);
695
} else {
696
retval = -1;
982
697
}
698
} else {
699
retval = -1;
983
700
}
984
701
985
702
/* Shutdown procedure */
986
703
987
704
mandos_end:
988
{
989
int e = errno;
990
free(decrypted_buffer);
991
free(buffer);
992
if(tcp_sd >= 0){
993
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
994
}
995
if(ret == -1){
996
if(e == 0){
997
e = errno;
998
}
999
perror_plus("close");
1000
}
1001
gnutls_deinit(session);
1002
errno = e;
1003
if(quit_now){
1004
errno = EINTR;
1005
retval = -1;
1006
}
705
free(buffer);
706
ret = TEMP_FAILURE_RETRY(close(tcp_sd));
707
if(ret == -1){
708
perror("close");
1007
709
}
710
gnutls_deinit (session);
1008
711
return retval;
1009
712
}
1010
713
1011
714
static void resolve_callback(AvahiSServiceResolver *r,
1012
715
AvahiIfIndex interface,
1013
AvahiProtocol proto,
716
AVAHI_GCC_UNUSED AvahiProtocol protocol,
1014
717
AvahiResolverEvent event,
1015
718
const char *name,
1016
719
const char *type,
1021
724
AVAHI_GCC_UNUSED AvahiStringList *txt,
1022
725
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1023
726
flags,
1024
AVAHI_GCC_UNUSED void* userdata){
727
void* userdata) {
728
mandos_context *mc = userdata;
1025
729
assert(r);
1026
730
1027
731
/* Called whenever a service has been resolved successfully or
1028
732
timed out */
1029
733
1030
if(quit_now){
1031
return;
1032
}
1033
1034
switch(event){
734
switch (event) {
1035
735
default:
1036
736
case AVAHI_RESOLVER_FAILURE:
1037
fprintf(stderr, "Mandos plugin mandos-client: "
1038
"(Avahi Resolver) Failed to resolve service '%s'"
737
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
1039
738
" of type '%s' in domain '%s': %s\n", name, type, domain,
1040
avahi_strerror(avahi_server_errno(mc.server)));
739
avahi_strerror(avahi_server_errno(mc->server)));
1041
740
break;
1042
741
1043
742
case AVAHI_RESOLVER_FOUND:
1045
744
char ip[AVAHI_ADDRESS_STR_MAX];
1046
745
avahi_address_snprint(ip, sizeof(ip), address);
1047
746
if(debug){
1048
fprintf(stderr, "Mandos plugin mandos-client: "
1049
"Mandos server \"%s\" found on %s (%s, %"
1050
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
1051
ip, (intmax_t)interface, port);
747
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
748
PRIu16 ") on port %d\n", name, host_name, ip,
749
interface, port);
1052
750
}
1053
int ret = start_mandos_communication(ip, port, interface,
1054
avahi_proto_to_af(proto));
1055
if(ret == 0){
1056
avahi_simple_poll_quit(mc.simple_poll);
1057
} else {
1058
ret = add_server(ip, port, interface,
1059
avahi_proto_to_af(proto));
751
int ret = start_mandos_communication(ip, port, interface, mc);
752
if (ret == 0){
753
avahi_simple_poll_quit(mc->simple_poll);
1060
754
}
1061
755
}
1062
756
}
1063
757
avahi_s_service_resolver_free(r);
1064
758
}
1065
759
1066
static void browse_callback(AvahiSServiceBrowser *b,
1067
AvahiIfIndex interface,
1068
AvahiProtocol protocol,
1069
AvahiBrowserEvent event,
1070
const char *name,
1071
const char *type,
1072
const char *domain,
1073
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1074
flags,
1075
AVAHI_GCC_UNUSED void* userdata){
760
static void browse_callback( AvahiSServiceBrowser *b,
761
AvahiIfIndex interface,
762
AvahiProtocol protocol,
763
AvahiBrowserEvent event,
764
const char *name,
765
const char *type,
766
const char *domain,
767
AVAHI_GCC_UNUSED AvahiLookupResultFlags
768
flags,
769
void* userdata) {
770
mandos_context *mc = userdata;
1076
771
assert(b);
1077
772
1078
773
/* Called whenever a new services becomes available on the LAN or
1079
774
is removed from the LAN */
1080
775
1081
if(quit_now){
1082
return;
1083
}
1084
1085
switch(event){
776
switch (event) {
1086
777
default:
1087
778
case AVAHI_BROWSER_FAILURE:
1088
779
1089
fprintf(stderr, "Mandos plugin mandos-client: "
1090
"(Avahi browser) %s\n",
1091
avahi_strerror(avahi_server_errno(mc.server)));
1092
avahi_simple_poll_quit(mc.simple_poll);
780
fprintf(stderr, "(Avahi browser) %s\n",
781
avahi_strerror(avahi_server_errno(mc->server)));
782
avahi_simple_poll_quit(mc->simple_poll);
1093
783
return;
1094
784
1095
785
case AVAHI_BROWSER_NEW:
1098
788
the callback function is called the Avahi server will free the
1099
789
resolver for us. */
1100
790
1101
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1102
name, type, domain, protocol, 0,
1103
resolve_callback, NULL) == NULL)
1104
fprintf(stderr, "Mandos plugin mandos-client: "
1105
"Avahi: Failed to resolve service '%s': %s\n",
1106
name, avahi_strerror(avahi_server_errno(mc.server)));
791
if (!(avahi_s_service_resolver_new(mc->server, interface,
792
protocol, name, type, domain,
793
AVAHI_PROTO_INET6, 0,
794
resolve_callback, mc)))
795
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
796
name, avahi_strerror(avahi_server_errno(mc->server)));
1107
797
break;
1108
798
1109
799
case AVAHI_BROWSER_REMOVE:
1112
802
case AVAHI_BROWSER_ALL_FOR_NOW:
1113
803
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1114
804
if(debug){
1115
fprintf(stderr, "Mandos plugin mandos-client: "
1116
"No Mandos server found, still searching...\n");
805
fprintf(stderr, "No Mandos server found, still searching...\n");
1117
806
}
1118
807
break;
1119
808
}
1120
809
}
1121
810
1122
/* Signal handler that stops main loop after SIGTERM */
1123
static void handle_sigterm(int sig){
1124
if(quit_now){
1125
return;
1126
}
1127
quit_now = 1;
1128
signal_received = sig;
1129
int old_errno = errno;
1130
/* set main loop to exit */
1131
if(mc.simple_poll != NULL){
1132
avahi_simple_poll_quit(mc.simple_poll);
1133
}
1134
errno = old_errno;
1135
}
1136
1137
bool get_flags(const char *ifname, struct ifreq *ifr){
1138
int ret;
1139
1140
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1141
if(s < 0){
1142
perror_plus("socket");
1143
return false;
1144
}
1145
strcpy(ifr->ifr_name, ifname);
1146
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1147
if(ret == -1){
1148
if(debug){
1149
perror_plus("ioctl SIOCGIFFLAGS");
1150
}
1151
return false;
1152
}
1153
return true;
1154
}
1155
1156
bool good_flags(const char *ifname, const struct ifreq *ifr){
1157
1158
/* Reject the loopback device */
1159
if(ifr->ifr_flags & IFF_LOOPBACK){
1160
if(debug){
1161
fprintf(stderr, "Mandos plugin mandos-client: "
1162
"Rejecting loopback interface \"%s\"\n", ifname);
1163
}
1164
return false;
1165
}
1166
/* Accept point-to-point devices only if connect_to is specified */
1167
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1168
if(debug){
1169
fprintf(stderr, "Mandos plugin mandos-client: "
1170
"Accepting point-to-point interface \"%s\"\n", ifname);
1171
}
1172
return true;
1173
}
1174
/* Otherwise, reject non-broadcast-capable devices */
1175
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1176
if(debug){
1177
fprintf(stderr, "Mandos plugin mandos-client: "
1178
"Rejecting non-broadcast interface \"%s\"\n", ifname);
1179
}
1180
return false;
1181
}
1182
/* Reject non-ARP interfaces (including dummy interfaces) */
1183
if(ifr->ifr_flags & IFF_NOARP){
1184
if(debug){
1185
fprintf(stderr, "Mandos plugin mandos-client: "
1186
"Rejecting non-ARP interface \"%s\"\n", ifname);
1187
}
1188
return false;
1189
}
1190
1191
/* Accept this device */
1192
if(debug){
1193
fprintf(stderr, "Mandos plugin mandos-client: "
1194
"Interface \"%s\" is good\n", ifname);
1195
}
1196
return true;
1197
}
1198
1199
/*
1200
* This function determines if a directory entry in /sys/class/net
1201
* corresponds to an acceptable network device.
1202
* (This function is passed to scandir(3) as a filter function.)
1203
*/
1204
int good_interface(const struct dirent *if_entry){
1205
if(if_entry->d_name[0] == '.'){
1206
return 0;
1207
}
1208
1209
struct ifreq ifr;
1210
if(not get_flags(if_entry->d_name, &ifr)){
1211
if(debug){
1212
fprintf(stderr, "Mandos plugin mandos-client: "
1213
"Failed to get flags for interface \"%s\"\n",
1214
if_entry->d_name);
1215
}
1216
return 0;
1217
}
1218
1219
if(not good_flags(if_entry->d_name, &ifr)){
1220
return 0;
1221
}
1222
return 1;
1223
}
1224
1225
/*
1226
* This function determines if a directory entry in /sys/class/net
1227
* corresponds to an acceptable network device which is up.
1228
* (This function is passed to scandir(3) as a filter function.)
1229
*/
1230
int up_interface(const struct dirent *if_entry){
1231
if(if_entry->d_name[0] == '.'){
1232
return 0;
1233
}
1234
1235
struct ifreq ifr;
1236
if(not get_flags(if_entry->d_name, &ifr)){
1237
if(debug){
1238
fprintf(stderr, "Mandos plugin mandos-client: "
1239
"Failed to get flags for interface \"%s\"\n",
1240
if_entry->d_name);
1241
}
1242
return 0;
1243
}
1244
1245
/* Reject down interfaces */
1246
if(not (ifr.ifr_flags & IFF_UP)){
1247
if(debug){
1248
fprintf(stderr, "Mandos plugin mandos-client: "
1249
"Rejecting down interface \"%s\"\n",
1250
if_entry->d_name);
1251
}
1252
return 0;
1253
}
1254
1255
/* Reject non-running interfaces */
1256
if(not (ifr.ifr_flags & IFF_RUNNING)){
1257
if(debug){
1258
fprintf(stderr, "Mandos plugin mandos-client: "
1259
"Rejecting non-running interface \"%s\"\n",
1260
if_entry->d_name);
1261
}
1262
return 0;
1263
}
1264
1265
if(not good_flags(if_entry->d_name, &ifr)){
1266
return 0;
1267
}
1268
return 1;
1269
}
1270
1271
int notdotentries(const struct dirent *direntry){
1272
/* Skip "." and ".." */
1273
if(direntry->d_name[0] == '.'
1274
and (direntry->d_name[1] == '\0'
1275
or (direntry->d_name[1] == '.'
1276
and direntry->d_name[2] == '\0'))){
1277
return 0;
1278
}
1279
return 1;
1280
}
1281
1282
/* Is this directory entry a runnable program? */
1283
int runnable_hook(const struct dirent *direntry){
1284
int ret;
1285
struct stat st;
1286
1287
if((direntry->d_name)[0] == '\0'){
1288
/* Empty name? */
1289
return 0;
1290
}
1291
1292
/* Save pointer to last character */
1293
char *end = strchr(direntry->d_name, '\0')-1;
1294
1295
if(*end == '~'){
1296
/* Backup name~ */
1297
return 0;
1298
}
1299
1300
if(((direntry->d_name)[0] == '#')
1301
and (*end == '#')){
1302
/* Temporary #name# */
1303
return 0;
1304
}
1305
1306
/* XXX more rules here */
1307
1308
char *fullname = NULL;
1309
ret = asprintf(&fullname, "%s/%s", hookdir,
1310
direntry->d_name);
1311
if(ret < 0){
1312
perror_plus("asprintf");
1313
return 0;
1314
}
1315
1316
ret = stat(fullname, &st);
1317
if(ret == -1){
1318
if(debug){
1319
perror_plus("Could not stat plugin");
1320
}
1321
return 0;
1322
}
1323
if(not (S_ISREG(st.st_mode))){
1324
/* Not a regular file */
1325
return 0;
1326
}
1327
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1328
/* Not executable */
1329
return 0;
1330
}
1331
return 1;
1332
}
1333
1334
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1335
int ret;
1336
struct timespec now;
1337
struct timespec waited_time;
1338
intmax_t block_time;
1339
1340
while(true){
1341
if(mc.current_server == NULL){
1342
if (debug){
1343
fprintf(stderr, "Mandos plugin mandos-client: "
1344
"Wait until first server is found. No timeout!\n");
1345
}
1346
ret = avahi_simple_poll_iterate(s, -1);
1347
} else {
1348
if (debug){
1349
fprintf(stderr, "Mandos plugin mandos-client: "
1350
"Check current_server if we should run it,"
1351
" or wait\n");
1352
}
1353
/* the current time */
1354
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1355
if(ret == -1){
1356
perror_plus("clock_gettime");
1357
return -1;
1358
}
1359
/* Calculating in ms how long time between now and server
1360
who we visted longest time ago. Now - last seen. */
1361
waited_time.tv_sec = (now.tv_sec
1362
- mc.current_server->last_seen.tv_sec);
1363
waited_time.tv_nsec = (now.tv_nsec
1364
- mc.current_server->last_seen.tv_nsec);
1365
/* total time is 10s/10,000ms.
1366
Converting to s from ms by dividing by 1,000,
1367
and ns to ms by dividing by 1,000,000. */
1368
block_time = ((retry_interval
1369
- ((intmax_t)waited_time.tv_sec * 1000))
1370
- ((intmax_t)waited_time.tv_nsec / 1000000));
1371
1372
if (debug){
1373
fprintf(stderr, "Mandos plugin mandos-client: "
1374
"Blocking for %" PRIdMAX " ms\n", block_time);
1375
}
1376
1377
if(block_time <= 0){
1378
ret = start_mandos_communication(mc.current_server->ip,
1379
mc.current_server->port,
1380
mc.current_server->if_index,
1381
mc.current_server->af);
1382
if(ret == 0){
1383
avahi_simple_poll_quit(mc.simple_poll);
1384
return 0;
1385
}
1386
ret = clock_gettime(CLOCK_MONOTONIC,
1387
&mc.current_server->last_seen);
1388
if(ret == -1){
1389
perror_plus("clock_gettime");
1390
return -1;
1391
}
1392
mc.current_server = mc.current_server->next;
1393
block_time = 0; /* Call avahi to find new Mandos
1394
servers, but don't block */
1395
}
1396
1397
ret = avahi_simple_poll_iterate(s, (int)block_time);
1398
}
1399
if(ret != 0){
1400
if (ret > 0 or errno != EINTR){
1401
return (ret != 1) ? ret : 0;
1402
}
1403
}
1404
}
1405
}
1406
1407
811
int main(int argc, char *argv[]){
1408
AvahiSServiceBrowser *sb = NULL;
1409
int error;
1410
int ret;
1411
intmax_t tmpmax;
1412
char *tmp;
1413
int exitcode = EXIT_SUCCESS;
1414
const char *interface = "";
1415
struct ifreq network;
1416
int sd = -1;
1417
bool take_down_interface = false;
1418
uid_t uid;
1419
gid_t gid;
1420
char tempdir[] = "/tmp/mandosXXXXXX";
1421
bool tempdir_created = false;
1422
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1423
const char *seckey = PATHDIR "/" SECKEY;
1424
const char *pubkey = PATHDIR "/" PUBKEY;
1425
1426
bool gnutls_initialized = false;
1427
bool gpgme_initialized = false;
1428
float delay = 2.5f;
1429
double retry_interval = 10; /* 10s between trying a server and
1430
retrying the same server again */
1431
1432
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1433
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1434
1435
uid = getuid();
1436
gid = getgid();
1437
1438
/* Lower any group privileges we might have, just to be safe */
1439
errno = 0;
1440
ret = setgid(gid);
1441
if(ret == -1){
1442
perror_plus("setgid");
1443
}
1444
1445
/* Lower user privileges (temporarily) */
1446
errno = 0;
1447
ret = seteuid(uid);
1448
if(ret == -1){
1449
perror_plus("seteuid");
1450
}
1451
1452
if(quit_now){
1453
goto end;
1454
}
1455
1456
{
1457
struct argp_option options[] = {
1458
{ .name = "debug", .key = 128,
1459
.doc = "Debug mode", .group = 3 },
1460
{ .name = "connect", .key = 'c',
1461
.arg = "ADDRESS:PORT",
1462
.doc = "Connect directly to a specific Mandos server",
1463
.group = 1 },
1464
{ .name = "interface", .key = 'i',
1465
.arg = "NAME",
1466
.doc = "Network interface that will be used to search for"
1467
" Mandos servers",
1468
.group = 1 },
1469
{ .name = "seckey", .key = 's',
1470
.arg = "FILE",
1471
.doc = "OpenPGP secret key file base name",
1472
.group = 1 },
1473
{ .name = "pubkey", .key = 'p',
1474
.arg = "FILE",
1475
.doc = "OpenPGP public key file base name",
1476
.group = 2 },
1477
{ .name = "dh-bits", .key = 129,
1478
.arg = "BITS",
1479
.doc = "Bit length of the prime number used in the"
1480
" Diffie-Hellman key exchange",
1481
.group = 2 },
1482
{ .name = "priority", .key = 130,
1483
.arg = "STRING",
1484
.doc = "GnuTLS priority string for the TLS handshake",
1485
.group = 1 },
1486
{ .name = "delay", .key = 131,
1487
.arg = "SECONDS",
1488
.doc = "Maximum delay to wait for interface startup",
1489
.group = 2 },
1490
{ .name = "retry", .key = 132,
1491
.arg = "SECONDS",
1492
.doc = "Retry interval used when denied by the mandos server",
1493
.group = 2 },
1494
{ .name = "network-hook-dir", .key = 133,
1495
.arg = "DIR",
1496
.doc = "Directory where network hooks are located",
1497
.group = 2 },
1498
/*
1499
* These reproduce what we would get without ARGP_NO_HELP
1500
*/
1501
{ .name = "help", .key = '?',
1502
.doc = "Give this help list", .group = -1 },
1503
{ .name = "usage", .key = -3,
1504
.doc = "Give a short usage message", .group = -1 },
1505
{ .name = "version", .key = 'V',
1506
.doc = "Print program version", .group = -1 },
1507
{ .name = NULL }
1508
};
1509
1510
error_t parse_opt(int key, char *arg,
1511
struct argp_state *state){
1512
errno = 0;
1513
switch(key){
1514
case 128: /* --debug */
1515
debug = true;
1516
break;
1517
case 'c': /* --connect */
1518
connect_to = arg;
1519
break;
1520
case 'i': /* --interface */
1521
interface = arg;
1522
break;
1523
case 's': /* --seckey */
1524
seckey = arg;
1525
break;
1526
case 'p': /* --pubkey */
1527
pubkey = arg;
1528
break;
1529
case 129: /* --dh-bits */
1530
errno = 0;
1531
tmpmax = strtoimax(arg, &tmp, 10);
1532
if(errno != 0 or tmp == arg or *tmp != '\0'
1533
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1534
argp_error(state, "Bad number of DH bits");
1535
}
1536
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1537
break;
1538
case 130: /* --priority */
1539
mc.priority = arg;
1540
break;
1541
case 131: /* --delay */
1542
errno = 0;
1543
delay = strtof(arg, &tmp);
1544
if(errno != 0 or tmp == arg or *tmp != '\0'){
1545
argp_error(state, "Bad delay");
1546
}
1547
case 132: /* --retry */
1548
errno = 0;
1549
retry_interval = strtod(arg, &tmp);
1550
if(errno != 0 or tmp == arg or *tmp != '\0'
1551
or (retry_interval * 1000) > INT_MAX
1552
or retry_interval < 0){
1553
argp_error(state, "Bad retry interval");
1554
}
1555
break;
1556
case 133: /* --network-hook-dir */
1557
hookdir = arg;
1558
break;
1559
/*
1560
* These reproduce what we would get without ARGP_NO_HELP
1561
*/
1562
case '?': /* --help */
1563
argp_state_help(state, state->out_stream,
1564
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1565
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1566
case -3: /* --usage */
1567
argp_state_help(state, state->out_stream,
1568
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1569
case 'V': /* --version */
1570
fprintf(state->out_stream, "Mandos plugin mandos-client: ");
1571
fprintf(state->out_stream, "%s\n", argp_program_version);
1572
exit(argp_err_exit_status);
1573
break;
1574
default:
1575
return ARGP_ERR_UNKNOWN;
1576
}
1577
return errno;
1578
}
1579
1580
struct argp argp = { .options = options, .parser = parse_opt,
1581
.args_doc = "",
1582
.doc = "Mandos client -- Get and decrypt"
1583
" passwords from a Mandos server" };
1584
ret = argp_parse(&argp, argc, argv,
1585
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1586
switch(ret){
1587
case 0:
1588
break;
1589
case ENOMEM:
1590
default:
1591
errno = ret;
1592
perror_plus("argp_parse");
1593
exitcode = EX_OSERR;
1594
goto end;
1595
case EINVAL:
1596
exitcode = EX_USAGE;
1597
goto end;
1598
}
1599
}
1600
1601
{
1602
/* Work around Debian bug #633582:
1603
<http://bugs.debian.org/633582> */
1604
struct stat st;
1605
1606
/* Re-raise priviliges */
1607
errno = 0;
1608
ret = seteuid(0);
1609
if(ret == -1){
1610
perror_plus("seteuid");
1611
}
1612
1613
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1614
int seckey_fd = open(seckey, O_RDONLY);
1615
if(seckey_fd == -1){
1616
perror_plus("open");
1617
} else {
1618
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1619
if(ret == -1){
1620
perror_plus("fstat");
1621
} else {
1622
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1623
ret = fchown(seckey_fd, uid, gid);
1624
if(ret == -1){
1625
perror_plus("fchown");
1626
}
1627
}
1628
}
1629
TEMP_FAILURE_RETRY(close(seckey_fd));
1630
}
1631
}
1632
1633
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1634
int pubkey_fd = open(pubkey, O_RDONLY);
1635
if(pubkey_fd == -1){
1636
perror_plus("open");
1637
} else {
1638
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1639
if(ret == -1){
1640
perror_plus("fstat");
1641
} else {
1642
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1643
ret = fchown(pubkey_fd, uid, gid);
1644
if(ret == -1){
1645
perror_plus("fchown");
1646
}
1647
}
1648
}
1649
TEMP_FAILURE_RETRY(close(pubkey_fd));
1650
}
1651
}
1652
1653
/* Lower privileges */
1654
errno = 0;
1655
ret = seteuid(uid);
1656
if(ret == -1){
1657
perror_plus("seteuid");
1658
}
1659
}
1660
1661
/* Find network hooks and run them */
1662
{
1663
struct dirent **direntries;
1664
struct dirent *direntry;
1665
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1666
alphasort);
1667
if(numhooks == -1){
1668
perror_plus("scandir");
1669
} else {
1670
int devnull = open("/dev/null", O_RDONLY);
1671
for(int i = 0; i < numhooks; i++){
1672
direntry = direntries[0];
1673
char *fullname = NULL;
1674
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1675
if(ret < 0){
1676
perror_plus("asprintf");
1677
continue;
1678
}
1679
pid_t hook_pid = fork();
1680
if(hook_pid == 0){
1681
/* Child */
1682
dup2(devnull, STDIN_FILENO);
1683
close(devnull);
1684
dup2(STDERR_FILENO, STDOUT_FILENO);
1685
ret = setenv("DEVICE", interface, 1);
1686
if(ret == -1){
1687
perror_plus("setenv");
1688
exit(1);
1689
}
1690
ret = setenv("VERBOSE", debug ? "1" : "0", 1);
1691
if(ret == -1){
1692
perror_plus("setenv");
1693
exit(1);
1694
}
1695
ret = setenv("MODE", "start", 1);
1696
if(ret == -1){
1697
perror_plus("setenv");
1698
exit(1);
1699
}
1700
char *delaystring;
1701
ret = asprintf(&delaystring, "%f", delay);
1702
if(ret == -1){
1703
perror_plus("asprintf");
1704
exit(1);
1705
}
1706
ret = setenv("DELAY", delaystring, 1);
1707
if(ret == -1){
1708
free(delaystring);
1709
perror_plus("setenv");
1710
exit(1);
1711
}
1712
free(delaystring);
1713
ret = execl(fullname, direntry->d_name, "start", NULL);
1714
perror_plus("execl");
1715
} else {
1716
int status;
1717
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1718
perror_plus("waitpid");
1719
free(fullname);
1720
continue;
1721
}
1722
if(WIFEXITED(status)){
1723
if(WEXITSTATUS(status) != 0){
1724
fprintf(stderr, "Mandos plugin mandos-client: "
1725
"Warning: network hook \"%s\" exited"
1726
" with status %d\n", direntry->d_name,
1727
WEXITSTATUS(status));
1728
free(fullname);
1729
continue;
1730
}
1731
} else if(WIFSIGNALED(status)){
1732
fprintf(stderr, "Mandos plugin mandos-client: "
1733
"Warning: network hook \"%s\" died by"
1734
" signal %d\n", direntry->d_name,
1735
WTERMSIG(status));
1736
free(fullname);
1737
continue;
1738
} else {
1739
fprintf(stderr, "Mandos plugin mandos-client: "
1740
"Warning: network hook \"%s\" crashed\n",
1741
direntry->d_name);
1742
free(fullname);
1743
continue;
1744
}
1745
}
1746
free(fullname);
1747
if(quit_now){
812
AvahiSServiceBrowser *sb = NULL;
813
int error;
814
int ret;
815
int exitcode = EXIT_SUCCESS;
816
const char *interface = "eth0";
817
struct ifreq network;
818
int sd;
819
uid_t uid;
820
gid_t gid;
821
char *connect_to = NULL;
822
char tempdir[] = "/tmp/mandosXXXXXX";
823
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
824
const char *seckey = PATHDIR "/" SECKEY;
825
const char *pubkey = PATHDIR "/" PUBKEY;
826
827
mandos_context mc = { .simple_poll = NULL, .server = NULL,
828
.dh_bits = 1024, .priority = "SECURE256"
829
":!CTYPE-X.509:+CTYPE-OPENPGP" };
830
bool gnutls_initalized = false;
831
bool gpgme_initalized = false;
832
833
{
834
struct argp_option options[] = {
835
{ .name = "debug", .key = 128,
836
.doc = "Debug mode", .group = 3 },
837
{ .name = "connect", .key = 'c',
838
.arg = "ADDRESS:PORT",
839
.doc = "Connect directly to a specific Mandos server",
840
.group = 1 },
841
{ .name = "interface", .key = 'i',
842
.arg = "NAME",
843
.doc = "Interface that will be used to search for Mandos"
844
" servers",
845
.group = 1 },
846
{ .name = "seckey", .key = 's',
847
.arg = "FILE",
848
.doc = "OpenPGP secret key file base name",
849
.group = 1 },
850
{ .name = "pubkey", .key = 'p',
851
.arg = "FILE",
852
.doc = "OpenPGP public key file base name",
853
.group = 2 },
854
{ .name = "dh-bits", .key = 129,
855
.arg = "BITS",
856
.doc = "Bit length of the prime number used in the"
857
" Diffie-Hellman key exchange",
858
.group = 2 },
859
{ .name = "priority", .key = 130,
860
.arg = "STRING",
861
.doc = "GnuTLS priority string for the TLS handshake",
862
.group = 1 },
863
{ .name = NULL }
864
};
865
866
error_t parse_opt (int key, char *arg,
867
struct argp_state *state) {
868
/* Get the INPUT argument from `argp_parse', which we know is
869
a pointer to our plugin list pointer. */
870
switch (key) {
871
case 128: /* --debug */
872
debug = true;
873
break;
874
case 'c': /* --connect */
875
connect_to = arg;
876
break;
877
case 'i': /* --interface */
878
interface = arg;
879
break;
880
case 's': /* --seckey */
881
seckey = arg;
882
break;
883
case 'p': /* --pubkey */
884
pubkey = arg;
885
break;
886
case 129: /* --dh-bits */
887
errno = 0;
888
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
889
if (errno){
890
perror("strtol");
891
exit(EXIT_FAILURE);
892
}
893
break;
894
case 130: /* --priority */
895
mc.priority = arg;
896
break;
897
case ARGP_KEY_ARG:
898
argp_usage (state);
899
case ARGP_KEY_END:
900
break;
901
default:
902
return ARGP_ERR_UNKNOWN;
903
}
904
return 0;
905
}
906
907
struct argp argp = { .options = options, .parser = parse_opt,
908
.args_doc = "",
909
.doc = "Mandos client -- Get and decrypt"
910
" passwords from a Mandos server" };
911
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
912
if (ret == ARGP_ERR_UNKNOWN){
913
fprintf(stderr, "Unknown error while parsing arguments\n");
914
exitcode = EXIT_FAILURE;
915
goto end;
916
}
917
}
918
919
/* If the interface is down, bring it up */
920
{
921
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
922
if(sd < 0) {
923
perror("socket");
924
exitcode = EXIT_FAILURE;
925
goto end;
926
}
927
strcpy(network.ifr_name, interface);
928
ret = ioctl(sd, SIOCGIFFLAGS, &network);
929
if(ret == -1){
930
perror("ioctl SIOCGIFFLAGS");
931
exitcode = EXIT_FAILURE;
932
goto end;
933
}
934
if((network.ifr_flags & IFF_UP) == 0){
935
network.ifr_flags |= IFF_UP;
936
ret = ioctl(sd, SIOCSIFFLAGS, &network);
937
if(ret == -1){
938
perror("ioctl SIOCSIFFLAGS");
939
exitcode = EXIT_FAILURE;
1748
940
goto end;
1749
941
}
1750
942
}
1751
close(devnull);
1752
}
1753
}
1754
1755
if(not debug){
1756
avahi_set_log_function(empty_log);
1757
}
1758
1759
if(interface[0] == '\0'){
1760
struct dirent **direntries;
1761
/* First look for interfaces that are up */
1762
ret = scandir(sys_class_net, &direntries, up_interface,
1763
alphasort);
1764
if(ret == 0){
1765
/* No up interfaces, look for any good interfaces */
1766
free(direntries);
1767
ret = scandir(sys_class_net, &direntries, good_interface,
1768
alphasort);
1769
}
1770
if(ret >= 1){
1771
/* Pick the first interface returned */
1772
interface = strdup(direntries[0]->d_name);
1773
if(debug){
1774
fprintf(stderr, "Mandos plugin mandos-client: "
1775
"Using interface \"%s\"\n", interface);
1776
}
1777
if(interface == NULL){
1778
perror_plus("malloc");
1779
free(direntries);
1780
exitcode = EXIT_FAILURE;
1781
goto end;
1782
}
1783
free(direntries);
1784
} else {
1785
free(direntries);
1786
fprintf(stderr, "Mandos plugin mandos-client: "
1787
"Could not find a network interface\n");
1788
exitcode = EXIT_FAILURE;
1789
goto end;
1790
}
1791
}
1792
1793
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1794
from the signal handler */
1795
/* Initialize the pseudo-RNG for Avahi */
1796
srand((unsigned int) time(NULL));
1797
mc.simple_poll = avahi_simple_poll_new();
1798
if(mc.simple_poll == NULL){
1799
fprintf(stderr, "Mandos plugin mandos-client: "
1800
"Avahi: Failed to create simple poll object.\n");
1801
exitcode = EX_UNAVAILABLE;
1802
goto end;
1803
}
1804
1805
sigemptyset(&sigterm_action.sa_mask);
1806
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1807
if(ret == -1){
1808
perror_plus("sigaddset");
1809
exitcode = EX_OSERR;
1810
goto end;
1811
}
1812
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1813
if(ret == -1){
1814
perror_plus("sigaddset");
1815
exitcode = EX_OSERR;
1816
goto end;
1817
}
1818
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1819
if(ret == -1){
1820
perror_plus("sigaddset");
1821
exitcode = EX_OSERR;
1822
goto end;
1823
}
1824
/* Need to check if the handler is SIG_IGN before handling:
1825
| [[info:libc:Initial Signal Actions]] |
1826
| [[info:libc:Basic Signal Handling]] |
1827
*/
1828
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1829
if(ret == -1){
1830
perror_plus("sigaction");
1831
return EX_OSERR;
1832
}
1833
if(old_sigterm_action.sa_handler != SIG_IGN){
1834
ret = sigaction(SIGINT, &sigterm_action, NULL);
1835
if(ret == -1){
1836
perror_plus("sigaction");
1837
exitcode = EX_OSERR;
1838
goto end;
1839
}
1840
}
1841
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1842
if(ret == -1){
1843
perror_plus("sigaction");
1844
return EX_OSERR;
1845
}
1846
if(old_sigterm_action.sa_handler != SIG_IGN){
1847
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1848
if(ret == -1){
1849
perror_plus("sigaction");
1850
exitcode = EX_OSERR;
1851
goto end;
1852
}
1853
}
1854
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1855
if(ret == -1){
1856
perror_plus("sigaction");
1857
return EX_OSERR;
1858
}
1859
if(old_sigterm_action.sa_handler != SIG_IGN){
1860
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1861
if(ret == -1){
1862
perror_plus("sigaction");
1863
exitcode = EX_OSERR;
1864
goto end;
1865
}
1866
}
1867
1868
/* If the interface is down, bring it up */
1869
if(strcmp(interface, "none") != 0){
943
ret = TEMP_FAILURE_RETRY(close(sd));
944
if(ret == -1){
945
perror("close");
946
}
947
}
948
949
uid = getuid();
950
gid = getgid();
951
952
ret = setuid(uid);
953
if (ret == -1){
954
perror("setuid");
955
}
956
957
setgid(gid);
958
if (ret == -1){
959
perror("setgid");
960
}
961
962
ret = init_gnutls_global(&mc, pubkey, seckey);
963
if (ret == -1){
964
fprintf(stderr, "init_gnutls_global failed\n");
965
exitcode = EXIT_FAILURE;
966
goto end;
967
} else {
968
gnutls_initalized = true;
969
}
970
971
if(mkdtemp(tempdir) == NULL){
972
perror("mkdtemp");
973
tempdir[0] = '\0';
974
goto end;
975
}
976
977
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
978
fprintf(stderr, "gpgme_initalized failed\n");
979
exitcode = EXIT_FAILURE;
980
goto end;
981
} else {
982
gpgme_initalized = true;
983
}
984
1870
985
if_index = (AvahiIfIndex) if_nametoindex(interface);
1871
986
if(if_index == 0){
1872
fprintf(stderr, "Mandos plugin mandos-client: "
1873
"No such interface: \"%s\"\n", interface);
1874
exitcode = EX_UNAVAILABLE;
1875
goto end;
1876
}
1877
1878
if(quit_now){
1879
goto end;
1880
}
1881
1882
/* Re-raise priviliges */
1883
errno = 0;
1884
ret = seteuid(0);
1885
if(ret == -1){
1886
perror_plus("seteuid");
1887
}
1888
1889
#ifdef __linux__
1890
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1891
messages about the network interface to mess up the prompt */
1892
ret = klogctl(8, NULL, 5);
1893
bool restore_loglevel = true;
1894
if(ret == -1){
1895
restore_loglevel = false;
1896
perror_plus("klogctl");
1897
}
1898
#endif /* __linux__ */
1899
1900
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1901
if(sd < 0){
1902
perror_plus("socket");
1903
exitcode = EX_OSERR;
1904
#ifdef __linux__
1905
if(restore_loglevel){
1906
ret = klogctl(7, NULL, 0);
1907
if(ret == -1){
1908
perror_plus("klogctl");
1909
}
1910
}
1911
#endif /* __linux__ */
1912
/* Lower privileges */
1913
errno = 0;
1914
ret = seteuid(uid);
1915
if(ret == -1){
1916
perror_plus("seteuid");
1917
}
1918
goto end;
1919
}
1920
strcpy(network.ifr_name, interface);
1921
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1922
if(ret == -1){
1923
perror_plus("ioctl SIOCGIFFLAGS");
1924
#ifdef __linux__
1925
if(restore_loglevel){
1926
ret = klogctl(7, NULL, 0);
1927
if(ret == -1){
1928
perror_plus("klogctl");
1929
}
1930
}
1931
#endif /* __linux__ */
1932
exitcode = EX_OSERR;
1933
/* Lower privileges */
1934
errno = 0;
1935
ret = seteuid(uid);
1936
if(ret == -1){
1937
perror_plus("seteuid");
1938
}
1939
goto end;
1940
}
1941
if((network.ifr_flags & IFF_UP) == 0){
1942
network.ifr_flags |= IFF_UP;
1943
take_down_interface = true;
1944
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1945
if(ret == -1){
1946
take_down_interface = false;
1947
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1948
exitcode = EX_OSERR;
1949
#ifdef __linux__
1950
if(restore_loglevel){
1951
ret = klogctl(7, NULL, 0);
1952
if(ret == -1){
1953
perror_plus("klogctl");
1954
}
1955
}
1956
#endif /* __linux__ */
1957
/* Lower privileges */
1958
errno = 0;
1959
ret = seteuid(uid);
1960
if(ret == -1){
1961
perror_plus("seteuid");
1962
}
1963
goto end;
1964
}
1965
}
1966
/* Sleep checking until interface is running.
1967
Check every 0.25s, up to total time of delay */
1968
for(int i=0; i < delay * 4; i++){
1969
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1970
if(ret == -1){
1971
perror_plus("ioctl SIOCGIFFLAGS");
1972
} else if(network.ifr_flags & IFF_RUNNING){
1973
break;
1974
}
1975
struct timespec sleeptime = { .tv_nsec = 250000000 };
1976
ret = nanosleep(&sleeptime, NULL);
1977
if(ret == -1 and errno != EINTR){
1978
perror_plus("nanosleep");
1979
}
1980
}
1981
if(not take_down_interface){
1982
/* We won't need the socket anymore */
1983
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1984
if(ret == -1){
1985
perror_plus("close");
1986
}
1987
}
1988
#ifdef __linux__
1989
if(restore_loglevel){
1990
/* Restores kernel loglevel to default */
1991
ret = klogctl(7, NULL, 0);
1992
if(ret == -1){
1993
perror_plus("klogctl");
1994
}
1995
}
1996
#endif /* __linux__ */
1997
/* Lower privileges */
1998
errno = 0;
1999
if(take_down_interface){
2000
/* Lower privileges */
2001
ret = seteuid(uid);
2002
if(ret == -1){
2003
perror_plus("seteuid");
2004
}
2005
} else {
2006
/* Lower privileges permanently */
2007
ret = setuid(uid);
2008
if(ret == -1){
2009
perror_plus("setuid");
2010
}
2011
}
2012
}
2013
2014
if(quit_now){
2015
goto end;
2016
}
2017
2018
ret = init_gnutls_global(pubkey, seckey);
2019
if(ret == -1){
2020
fprintf(stderr, "Mandos plugin mandos-client: "
2021
"init_gnutls_global failed\n");
2022
exitcode = EX_UNAVAILABLE;
2023
goto end;
2024
} else {
2025
gnutls_initialized = true;
2026
}
2027
2028
if(quit_now){
2029
goto end;
2030
}
2031
2032
if(mkdtemp(tempdir) == NULL){
2033
perror_plus("mkdtemp");
2034
goto end;
2035
}
2036
tempdir_created = true;
2037
2038
if(quit_now){
2039
goto end;
2040
}
2041
2042
if(not init_gpgme(pubkey, seckey, tempdir)){
2043
fprintf(stderr, "Mandos plugin mandos-client: "
2044
"init_gpgme failed\n");
2045
exitcode = EX_UNAVAILABLE;
2046
goto end;
2047
} else {
2048
gpgme_initialized = true;
2049
}
2050
2051
if(quit_now){
2052
goto end;
2053
}
2054
2055
if(connect_to != NULL){
2056
/* Connect directly, do not use Zeroconf */
2057
/* (Mainly meant for debugging) */
2058
char *address = strrchr(connect_to, ':');
2059
if(address == NULL){
2060
fprintf(stderr, "Mandos plugin mandos-client: "
2061
"No colon in address\n");
2062
exitcode = EX_USAGE;
2063
goto end;
2064
}
2065
2066
if(quit_now){
2067
goto end;
2068
}
2069
2070
uint16_t port;
2071
errno = 0;
2072
tmpmax = strtoimax(address+1, &tmp, 10);
2073
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2074
or tmpmax != (uint16_t)tmpmax){
2075
fprintf(stderr, "Mandos plugin mandos-client: "
2076
"Bad port number\n");
2077
exitcode = EX_USAGE;
2078
goto end;
2079
}
2080
2081
if(quit_now){
2082
goto end;
2083
}
2084
2085
port = (uint16_t)tmpmax;
2086
*address = '\0';
2087
/* Colon in address indicates IPv6 */
2088
int af;
2089
if(strchr(connect_to, ':') != NULL){
2090
af = AF_INET6;
2091
/* Accept [] around IPv6 address - see RFC 5952 */
2092
if(connect_to[0] == '[' and address[-1] == ']')
2093
{
2094
connect_to++;
2095
address[-1] = '\0';
2096
}
2097
} else {
2098
af = AF_INET;
2099
}
2100
address = connect_to;
2101
2102
if(quit_now){
2103
goto end;
2104
}
2105
2106
while(not quit_now){
2107
ret = start_mandos_communication(address, port, if_index, af);
2108
if(quit_now or ret == 0){
2109
break;
2110
}
2111
if(debug){
2112
fprintf(stderr, "Mandos plugin mandos-client: "
2113
"Retrying in %d seconds\n", (int)retry_interval);
2114
}
2115
sleep((int)retry_interval);
2116
}
2117
2118
if (not quit_now){
2119
exitcode = EXIT_SUCCESS;
2120
}
2121
2122
goto end;
2123
}
2124
2125
if(quit_now){
2126
goto end;
2127
}
2128
2129
{
2130
AvahiServerConfig config;
2131
/* Do not publish any local Zeroconf records */
2132
avahi_server_config_init(&config);
2133
config.publish_hinfo = 0;
2134
config.publish_addresses = 0;
2135
config.publish_workstation = 0;
2136
config.publish_domain = 0;
2137
2138
/* Allocate a new server */
2139
mc.server = avahi_server_new(avahi_simple_poll_get
2140
(mc.simple_poll), &config, NULL,
2141
NULL, &error);
2142
2143
/* Free the Avahi configuration data */
2144
avahi_server_config_free(&config);
2145
}
2146
2147
/* Check if creating the Avahi server object succeeded */
2148
if(mc.server == NULL){
2149
fprintf(stderr, "Mandos plugin mandos-client: "
2150
"Failed to create Avahi server: %s\n",
2151
avahi_strerror(error));
2152
exitcode = EX_UNAVAILABLE;
2153
goto end;
2154
}
2155
2156
if(quit_now){
2157
goto end;
2158
}
2159
2160
/* Create the Avahi service browser */
2161
sb = avahi_s_service_browser_new(mc.server, if_index,
2162
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2163
NULL, 0, browse_callback, NULL);
2164
if(sb == NULL){
2165
fprintf(stderr, "Mandos plugin mandos-client: "
2166
"Failed to create service browser: %s\n",
2167
avahi_strerror(avahi_server_errno(mc.server)));
2168
exitcode = EX_UNAVAILABLE;
2169
goto end;
2170
}
2171
2172
if(quit_now){
2173
goto end;
2174
}
2175
2176
/* Run the main loop */
2177
2178
if(debug){
2179
fprintf(stderr, "Mandos plugin mandos-client: "
2180
"Starting Avahi loop search\n");
2181
}
2182
2183
ret = avahi_loop_with_timeout(mc.simple_poll,
2184
(int)(retry_interval * 1000));
2185
if(debug){
2186
fprintf(stderr, "Mandos plugin mandos-client: "
2187
"avahi_loop_with_timeout exited %s\n",
2188
(ret == 0) ? "successfully" : "with error");
2189
}
2190
987
fprintf(stderr, "No such interface: \"%s\"\n", interface);
988
exit(EXIT_FAILURE);
989
}
990
991
if(connect_to != NULL){
992
/* Connect directly, do not use Zeroconf */
993
/* (Mainly meant for debugging) */
994
char *address = strrchr(connect_to, ':');
995
if(address == NULL){
996
fprintf(stderr, "No colon in address\n");
997
exitcode = EXIT_FAILURE;
998
goto end;
999
}
1000
errno = 0;
1001
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
1002
if(errno){
1003
perror("Bad port number");
1004
exitcode = EXIT_FAILURE;
1005
goto end;
1006
}
1007
*address = '\0';
1008
address = connect_to;
1009
ret = start_mandos_communication(address, port, if_index, &mc);
1010
if(ret < 0){
1011
exitcode = EXIT_FAILURE;
1012
} else {
1013
exitcode = EXIT_SUCCESS;
1014
}
1015
goto end;
1016
}
1017
1018
if (not debug){
1019
avahi_set_log_function(empty_log);
1020
}
1021
1022
/* Initialize the pseudo-RNG for Avahi */
1023
srand((unsigned int) time(NULL));
1024
1025
/* Allocate main Avahi loop object */
1026
mc.simple_poll = avahi_simple_poll_new();
1027
if (mc.simple_poll == NULL) {
1028
fprintf(stderr, "Avahi: Failed to create simple poll"
1029
" object.\n");
1030
exitcode = EXIT_FAILURE;
1031
goto end;
1032
}
1033
1034
{
1035
AvahiServerConfig config;
1036
/* Do not publish any local Zeroconf records */
1037
avahi_server_config_init(&config);
1038
config.publish_hinfo = 0;
1039
config.publish_addresses = 0;
1040
config.publish_workstation = 0;
1041
config.publish_domain = 0;
1042
1043
/* Allocate a new server */
1044
mc.server = avahi_server_new(avahi_simple_poll_get
1045
(mc.simple_poll), &config, NULL,
1046
NULL, &error);
1047
1048
/* Free the Avahi configuration data */
1049
avahi_server_config_free(&config);
1050
}
1051
1052
/* Check if creating the Avahi server object succeeded */
1053
if (mc.server == NULL) {
1054
fprintf(stderr, "Failed to create Avahi server: %s\n",
1055
avahi_strerror(error));
1056
exitcode = EXIT_FAILURE;
1057
goto end;
1058
}
1059
1060
/* Create the Avahi service browser */
1061
sb = avahi_s_service_browser_new(mc.server, if_index,
1062
AVAHI_PROTO_INET6,
1063
"_mandos._tcp", NULL, 0,
1064
browse_callback, &mc);
1065
if (sb == NULL) {
1066
fprintf(stderr, "Failed to create service browser: %s\n",
1067
avahi_strerror(avahi_server_errno(mc.server)));
1068
exitcode = EXIT_FAILURE;
1069
goto end;
1070
}
1071
1072
/* Run the main loop */
1073
1074
if (debug){
1075
fprintf(stderr, "Starting Avahi loop search\n");
1076
}
1077
1078
avahi_simple_poll_loop(mc.simple_poll);
1079
2191
1080
end:
2192
2193
if(debug){
2194
fprintf(stderr, "Mandos plugin mandos-client: "
2195
"%s exiting\n", argv[0]);
2196
}
2197
2198
/* Cleanup things */
2199
if(sb != NULL)
2200
avahi_s_service_browser_free(sb);
2201
2202
if(mc.server != NULL)
2203
avahi_server_free(mc.server);
2204
2205
if(mc.simple_poll != NULL)
2206
avahi_simple_poll_free(mc.simple_poll);
2207
2208
if(gnutls_initialized){
2209
gnutls_certificate_free_credentials(mc.cred);
2210
gnutls_global_deinit();
2211
gnutls_dh_params_deinit(mc.dh_params);
2212
}
2213
2214
if(gpgme_initialized){
2215
gpgme_release(mc.ctx);
2216
}
2217
2218
/* Cleans up the circular linked list of Mandos servers the client
2219
has seen */
2220
if(mc.current_server != NULL){
2221
mc.current_server->prev->next = NULL;
2222
while(mc.current_server != NULL){
2223
server *next = mc.current_server->next;
2224
free(mc.current_server);
2225
mc.current_server = next;
2226
}
2227
}
2228
2229
/* XXX run network hooks "stop" here */
2230
2231
/* Take down the network interface */
2232
if(take_down_interface){
2233
/* Re-raise priviliges */
2234
errno = 0;
2235
ret = seteuid(0);
2236
if(ret == -1){
2237
perror_plus("seteuid");
2238
}
2239
if(geteuid() == 0){
2240
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2241
if(ret == -1){
2242
perror_plus("ioctl SIOCGIFFLAGS");
2243
} else if(network.ifr_flags & IFF_UP){
2244
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2245
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2246
if(ret == -1){
2247
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2248
}
2249
}
2250
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2251
if(ret == -1){
2252
perror_plus("close");
2253
}
2254
/* Lower privileges permanently */
2255
errno = 0;
2256
ret = setuid(uid);
2257
if(ret == -1){
2258
perror_plus("setuid");
2259
}
2260
}
2261
}
2262
2263
/* Removes the GPGME temp directory and all files inside */
2264
if(tempdir_created){
2265
struct dirent **direntries = NULL;
2266
struct dirent *direntry = NULL;
2267
int numentries = scandir(tempdir, &direntries, notdotentries,
2268
alphasort);
2269
if (numentries > 0){
2270
for(int i = 0; i < numentries; i++){
2271
direntry = direntries[i];
2272
char *fullname = NULL;
2273
ret = asprintf(&fullname, "%s/%s", tempdir,
2274
direntry->d_name);
2275
if(ret < 0){
2276
perror_plus("asprintf");
2277
continue;
2278
}
2279
ret = remove(fullname);
2280
if(ret == -1){
2281
fprintf(stderr, "Mandos plugin mandos-client: "
2282
"remove(\"%s\"): %s\n", fullname, strerror(errno));
2283
}
2284
free(fullname);
2285
}
2286
}
2287
2288
/* need to clean even if 0 because man page doesn't specify */
2289
free(direntries);
2290
if (numentries == -1){
2291
perror_plus("scandir");
2292
}
2293
ret = rmdir(tempdir);
2294
if(ret == -1 and errno != ENOENT){
2295
perror_plus("rmdir");
2296
}
2297
}
2298
2299
if(quit_now){
2300
sigemptyset(&old_sigterm_action.sa_mask);
2301
old_sigterm_action.sa_handler = SIG_DFL;
2302
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
2303
&old_sigterm_action,
2304
NULL));
2305
if(ret == -1){
2306
perror_plus("sigaction");
2307
}
2308
do {
2309
ret = raise(signal_received);
2310
} while(ret != 0 and errno == EINTR);
2311
if(ret != 0){
2312
perror_plus("raise");
2313
abort();
2314
}
2315
TEMP_FAILURE_RETRY(pause());
2316
}
2317
2318
return exitcode;
1081
1082
if (debug){
1083
fprintf(stderr, "%s exiting\n", argv[0]);
1084
}
1085
1086
/* Cleanup things */
1087
if (sb != NULL)
1088
avahi_s_service_browser_free(sb);
1089
1090
if (mc.server != NULL)
1091
avahi_server_free(mc.server);
1092
1093
if (mc.simple_poll != NULL)
1094
avahi_simple_poll_free(mc.simple_poll);
1095
1096
if (gnutls_initalized){
1097
gnutls_certificate_free_credentials(mc.cred);
1098
gnutls_global_deinit ();
1099
gnutls_dh_params_deinit(mc.dh_params);
1100
}
1101
1102
if(gpgme_initalized){
1103
gpgme_release(mc.ctx);
1104
}
1105
1106
/* Removes the temp directory used by GPGME */
1107
if(tempdir[0] != '\0'){
1108
DIR *d;
1109
struct dirent *direntry;
1110
d = opendir(tempdir);
1111
if(d == NULL){
1112
perror("opendir");
1113
} else {
1114
while(true){
1115
direntry = readdir(d);
1116
if(direntry == NULL){
1117
break;
1118
}
1119
if (direntry->d_type == DT_REG){
1120
char *fullname = NULL;
1121
ret = asprintf(&fullname, "%s/%s", tempdir,
1122
direntry->d_name);
1123
if(ret < 0){
1124
perror("asprintf");
1125
continue;
1126
}
1127
ret = unlink(fullname);
1128
if(ret == -1){
1129
fprintf(stderr, "unlink(\"%s\"): %s",
1130
fullname, strerror(errno));
1131
}
1132
free(fullname);
1133
}
1134
}
1135
closedir(d);
1136
}
1137
ret = rmdir(tempdir);
1138
if(ret == -1){
1139
perror("rmdir");
1140
}
1141
}
1142
1143
return exitcode;
2319
1144
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0