334
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
214
/* Delete the GPGME FILE pointer cryptotext data buffer */
215
gpgme_data_release(dh_crypto);
337
217
/* Seek back to the beginning of the GPGME plaintext data buffer */
338
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
339
perror("gpgme_data_seek");
340
plaintext_length = -1;
218
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
219
perror("pgpme_data_seek");
346
plaintext_capacity = incbuffer(plaintext,
347
(size_t)plaintext_length,
349
if(plaintext_capacity == 0){
351
plaintext_length = -1;
224
new_packet_capacity = adjustbuffer(*new_packet, new_packet_length,
225
new_packet_capacity);
226
if (new_packet_capacity == 0){
227
perror("adjustbuffer");
230
new_packet_capacity += BUFFER_SIZE;
355
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
233
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
357
235
/* Print the data, if any */
363
240
perror("gpgme_data_read");
364
plaintext_length = -1;
367
plaintext_length += ret;
371
fprintf(stderr, "Decrypted password is: ");
372
for(ssize_t i = 0; i < plaintext_length; i++){
373
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
375
fprintf(stderr, "\n");
380
/* Delete the GPGME cryptotext data buffer */
381
gpgme_data_release(dh_crypto);
243
new_packet_length += ret;
246
/* FIXME: check characters before printing to screen so to not print
247
terminal control characters */
249
/* fprintf(stderr, "decrypted password is: "); */
250
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
251
/* fprintf(stderr, "\n"); */
383
254
/* Delete the GPGME plaintext data buffer */
384
255
gpgme_data_release(dh_plain);
385
return plaintext_length;
256
return new_packet_length;
388
static const char * safer_gnutls_strerror(int value){
389
const char *ret = gnutls_strerror(value); /* Spurious warning from
390
-Wunreachable-code */
259
static const char * safer_gnutls_strerror (int value) {
260
const char *ret = gnutls_strerror (value);
392
262
ret = "(unknown)";
396
/* GnuTLS log function callback */
397
266
static void debuggnutls(__attribute__((unused)) int level,
398
267
const char* string){
399
fprintf(stderr, "GnuTLS: %s", string);
268
fprintf(stderr, "%s", string);
402
static int init_gnutls_global(const char *pubkeyfilename,
403
const char *seckeyfilename){
271
static int initgnutls(mandos_context *mc){
407
276
fprintf(stderr, "Initializing GnuTLS\n");
410
ret = gnutls_global_init();
411
if(ret != GNUTLS_E_SUCCESS){
412
fprintf(stderr, "GnuTLS global_init: %s\n",
413
safer_gnutls_strerror(ret));
279
if ((ret = gnutls_global_init ())
280
!= GNUTLS_E_SUCCESS) {
281
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
418
/* "Use a log level over 10 to enable all debugging options."
421
286
gnutls_global_set_log_level(11);
422
287
gnutls_global_set_log_function(debuggnutls);
425
/* OpenPGP credentials */
426
gnutls_certificate_allocate_credentials(&mc.cred);
427
if(ret != GNUTLS_E_SUCCESS){
428
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
432
safer_gnutls_strerror(ret));
433
gnutls_global_deinit();
290
/* openpgp credentials */
291
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
292
!= GNUTLS_E_SUCCESS) {
293
fprintf (stderr, "memory error: %s\n",
294
safer_gnutls_strerror(ret));
438
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
439
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
299
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
300
" and keyfile %s as GnuTLS credentials\n", certfile,
443
304
ret = gnutls_certificate_set_openpgp_key_file
444
(mc.cred, pubkeyfilename, seckeyfilename,
445
GNUTLS_OPENPGP_FMT_BASE64);
446
if(ret != GNUTLS_E_SUCCESS){
448
"Error[%d] while reading the OpenPGP key pair ('%s',"
449
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
450
fprintf(stderr, "The GnuTLS error is: %s\n",
451
safer_gnutls_strerror(ret));
455
/* GnuTLS server initialization */
456
ret = gnutls_dh_params_init(&mc.dh_params);
457
if(ret != GNUTLS_E_SUCCESS){
458
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
459
" %s\n", safer_gnutls_strerror(ret));
462
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
463
if(ret != GNUTLS_E_SUCCESS){
464
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
465
safer_gnutls_strerror(ret));
469
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
475
gnutls_certificate_free_credentials(mc.cred);
476
gnutls_global_deinit();
477
gnutls_dh_params_deinit(mc.dh_params);
481
static int init_gnutls_session(gnutls_session_t *session){
483
/* GnuTLS session creation */
485
ret = gnutls_init(session, GNUTLS_SERVER);
489
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
490
if(ret != GNUTLS_E_SUCCESS){
305
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
306
if (ret != GNUTLS_E_SUCCESS) {
308
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
310
ret, certfile, certkey);
311
fprintf(stdout, "The Error is: %s\n",
312
safer_gnutls_strerror(ret));
316
//GnuTLS server initialization
317
if ((ret = gnutls_dh_params_init (&es->dh_params))
318
!= GNUTLS_E_SUCCESS) {
319
fprintf (stderr, "Error in dh parameter initialization: %s\n",
320
safer_gnutls_strerror(ret));
324
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
325
!= GNUTLS_E_SUCCESS) {
326
fprintf (stderr, "Error in prime generation: %s\n",
327
safer_gnutls_strerror(ret));
331
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
333
// GnuTLS session creation
334
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
335
!= GNUTLS_E_SUCCESS){
491
336
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
492
337
safer_gnutls_strerror(ret));
498
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
500
gnutls_deinit(*session);
503
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
504
if(ret != GNUTLS_E_SUCCESS){
505
fprintf(stderr, "Syntax error at: %s\n", err);
506
fprintf(stderr, "GnuTLS error: %s\n",
507
safer_gnutls_strerror(ret));
508
gnutls_deinit(*session);
340
if ((ret = gnutls_priority_set_direct (es->session, mc->priority, &err))
341
!= GNUTLS_E_SUCCESS) {
342
fprintf(stderr, "Syntax error at: %s\n", err);
343
fprintf(stderr, "GnuTLS error: %s\n",
344
safer_gnutls_strerror(ret));
514
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
517
gnutls_deinit(*session);
520
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
521
if(ret != GNUTLS_E_SUCCESS){
522
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
348
if ((ret = gnutls_credentials_set
349
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
350
!= GNUTLS_E_SUCCESS) {
351
fprintf(stderr, "Error setting a credentials set: %s\n",
523
352
safer_gnutls_strerror(ret));
524
gnutls_deinit(*session);
528
356
/* ignore client certificate if any. */
529
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
357
gnutls_certificate_server_set_request (es->session,
531
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
360
gnutls_dh_set_prime_bits (es->session, DH_BITS);
536
/* Avahi log function callback */
537
365
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
538
366
__attribute__((unused)) const char *txt){}
540
/* Called when a Mandos server is found */
541
368
static int start_mandos_communication(const char *ip, uint16_t port,
542
369
AvahiIfIndex if_index,
544
int ret, tcp_sd = -1;
547
struct sockaddr_in in;
548
struct sockaddr_in6 in6;
372
struct sockaddr_in6 to;
373
encrypted_session es;
550
374
char *buffer = NULL;
551
char *decrypted_buffer = NULL;
375
char *decrypted_buffer;
552
376
size_t buffer_length = 0;
553
377
size_t buffer_capacity = 0;
378
ssize_t decrypted_buffer_size;
556
gnutls_session_t session;
557
int pf; /* Protocol family */
574
fprintf(stderr, "Bad address family: %d\n", af);
579
ret = init_gnutls_session(&session);
381
char interface[IF_NAMESIZE];
585
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
384
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
589
tcp_sd = socket(pf, SOCK_STREAM, 0);
388
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
592
390
perror("socket");
602
memset(&to, 0, sizeof(to));
604
to.in6.sin6_family = (sa_family_t)af;
605
ret = inet_pton(af, ip, &to.in6.sin6_addr);
607
to.in.sin_family = (sa_family_t)af;
608
ret = inet_pton(af, ip, &to.in.sin_addr);
395
if(if_indextoname((unsigned int)if_index, interface) == NULL){
397
perror("if_indextoname");
402
fprintf(stderr, "Binding to interface %s\n", interface);
405
memset(&to,0,sizeof(to)); /* Spurious warning */
406
to.sin6_family = AF_INET6;
407
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
612
409
perror("inet_pton");
618
413
fprintf(stderr, "Bad address: %s\n", ip);
623
to.in6.sin6_port = htons(port); /* Spurious warnings from
625
-Wunreachable-code */
627
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
628
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
630
if(if_index == AVAHI_IF_UNSPEC){
631
fprintf(stderr, "An IPv6 link-local address is incomplete"
632
" without a network interface\n");
636
/* Set the network interface number as scope */
637
to.in6.sin6_scope_id = (uint32_t)if_index;
640
to.in.sin_port = htons(port); /* Spurious warnings from
642
-Wunreachable-code */
416
to.sin6_port = htons(port); /* Spurious warning */
418
to.sin6_scope_id = (uint32_t)if_index;
651
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
652
char interface[IF_NAMESIZE];
653
if(if_indextoname((unsigned int)if_index, interface) == NULL){
654
perror("if_indextoname");
656
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
657
ip, interface, port);
660
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
663
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
664
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
667
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
670
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
676
if(strcmp(addrstr, ip) != 0){
677
fprintf(stderr, "Canonical address form: %s\n", addrstr);
688
ret = connect(tcp_sd, &to.in6, sizeof(to));
690
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
693
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
706
const char *out = mandos_protocol_version;
421
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
422
/* char addrstr[INET6_ADDRSTRLEN]; */
423
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
424
/* sizeof(addrstr)) == NULL){ */
425
/* perror("inet_ntop"); */
427
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
428
/* addrstr, ntohs(to.sin6_port)); */
432
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
438
char *out = mandos_protocol_version;
709
441
size_t out_size = strlen(out);
710
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
442
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
711
443
out_size - written));
718
written += (size_t)ret;
719
450
if(written < out_size){
722
if(out == mandos_protocol_version){
453
if (out == mandos_protocol_version){
462
ret = initgnutls (&es);
468
gnutls_transport_set_ptr (es.session,
469
(gnutls_transport_ptr_t) tcp_sd);
737
472
fprintf(stderr, "Establishing TLS session with %s\n", ip);
745
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
753
ret = gnutls_handshake(session);
758
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
760
if(ret != GNUTLS_E_SUCCESS){
475
ret = gnutls_handshake (es.session);
477
if (ret != GNUTLS_E_SUCCESS){
762
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
479
fprintf(stderr, "\n*** Handshake failed ***\n");
769
/* Read OpenPGP packet that contains the wanted password */
486
//Retrieve OpenPGP packet that contains the wanted password
772
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
489
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
783
buffer_capacity = incbuffer(&buffer, buffer_length,
785
if(buffer_capacity == 0){
797
sret = gnutls_record_recv(session, buffer+buffer_length,
494
buffer_capacity = adjustbuffer(buffer, buffer_length, buffer_capacity);
495
if (buffer_capacity == 0){
496
perror("adjustbuffer");
501
ret = gnutls_record_recv
502
(es.session, buffer+buffer_length, BUFFER_SIZE);
804
508
case GNUTLS_E_INTERRUPTED:
805
509
case GNUTLS_E_AGAIN:
807
511
case GNUTLS_E_REHANDSHAKE:
809
ret = gnutls_handshake(session);
815
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
817
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
512
ret = gnutls_handshake (es.session);
514
fprintf(stderr, "\n*** Handshake failed ***\n");
824
521
fprintf(stderr, "Unknown error while reading data from"
825
" encrypted session with Mandos server\n");
826
gnutls_bye(session, GNUTLS_SHUT_RDWR);
522
" encrypted session with mandos server\n");
524
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
831
buffer_length += (size_t) sret;
836
fprintf(stderr, "Closing TLS session\n");
845
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
850
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
852
if(buffer_length > 0){
853
ssize_t decrypted_buffer_size;
528
buffer_length += (size_t) ret;
532
if (buffer_length > 0){
854
533
decrypted_buffer_size = pgp_packet_decrypt(buffer,
857
if(decrypted_buffer_size >= 0){
537
if (decrypted_buffer_size >= 0){
860
539
while(written < (size_t) decrypted_buffer_size){
866
ret = (int)fwrite(decrypted_buffer + written, 1,
867
(size_t)decrypted_buffer_size - written,
540
ret = (int)fwrite (decrypted_buffer + written, 1,
541
(size_t)decrypted_buffer_size - written,
869
543
if(ret == 0 and ferror(stdout)){
872
545
fprintf(stderr, "Error writing encrypted data: %s\n",
873
546
strerror(errno));
878
551
written += (size_t)ret;
884
/* Shutdown procedure */
889
free(decrypted_buffer);
892
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
900
gnutls_deinit(session);
553
free(decrypted_buffer);
562
fprintf(stderr, "Closing TLS session\n");
566
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
569
gnutls_deinit (es.session);
570
gnutls_certificate_free_credentials (es.cred);
571
gnutls_global_deinit ();
910
static void resolve_callback(AvahiSServiceResolver *r,
911
AvahiIfIndex interface,
913
AvahiResolverEvent event,
917
const char *host_name,
918
const AvahiAddress *address,
920
AVAHI_GCC_UNUSED AvahiStringList *txt,
921
AVAHI_GCC_UNUSED AvahiLookupResultFlags
923
AVAHI_GCC_UNUSED void* userdata){
575
static void resolve_callback( AvahiSServiceResolver *r,
576
AvahiIfIndex interface,
577
AVAHI_GCC_UNUSED AvahiProtocol protocol,
578
AvahiResolverEvent event,
582
const char *host_name,
583
const AvahiAddress *address,
585
AVAHI_GCC_UNUSED AvahiStringList *txt,
586
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
587
AVAHI_GCC_UNUSED void* userdata) {
588
mandos_context *mc = userdata;
589
assert(r); /* Spurious warning */
926
591
/* Called whenever a service has been resolved successfully or
935
596
case AVAHI_RESOLVER_FAILURE:
936
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
937
" of type '%s' in domain '%s': %s\n", name, type, domain,
938
avahi_strerror(avahi_server_errno(mc.server)));
597
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
598
" type '%s' in domain '%s': %s\n", name, type, domain,
599
avahi_strerror(avahi_server_errno(mc->server)));
941
602
case AVAHI_RESOLVER_FOUND:
943
604
char ip[AVAHI_ADDRESS_STR_MAX];
944
605
avahi_address_snprint(ip, sizeof(ip), address);
946
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
947
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
948
ip, (intmax_t)interface, port);
607
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
608
" port %d\n", name, host_name, ip, port);
950
int ret = start_mandos_communication(ip, port, interface,
951
avahi_proto_to_af(proto));
953
avahi_simple_poll_quit(mc.simple_poll);
610
int ret = start_mandos_communication(ip, port, interface, mc);
957
616
avahi_s_service_resolver_free(r);
960
static void browse_callback(AvahiSServiceBrowser *b,
961
AvahiIfIndex interface,
962
AvahiProtocol protocol,
963
AvahiBrowserEvent event,
967
AVAHI_GCC_UNUSED AvahiLookupResultFlags
969
AVAHI_GCC_UNUSED void* userdata){
619
static void browse_callback( AvahiSServiceBrowser *b,
620
AvahiIfIndex interface,
621
AvahiProtocol protocol,
622
AvahiBrowserEvent event,
626
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
628
mandos_context *mc = userdata;
629
assert(b); /* Spurious warning */
972
631
/* Called whenever a new services becomes available on the LAN or
973
632
is removed from the LAN */
981
636
case AVAHI_BROWSER_FAILURE:
983
fprintf(stderr, "(Avahi browser) %s\n",
984
avahi_strerror(avahi_server_errno(mc.server)));
985
avahi_simple_poll_quit(mc.simple_poll);
638
fprintf(stderr, "(Browser) %s\n",
639
avahi_strerror(avahi_server_errno(mc->server)));
640
avahi_simple_poll_quit(mc->simple_poll);
988
643
case AVAHI_BROWSER_NEW:
989
/* We ignore the returned Avahi resolver object. In the callback
990
function we free it. If the Avahi server is terminated before
991
the callback function is called the Avahi server will free the
994
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
995
name, type, domain, protocol, 0,
996
resolve_callback, NULL) == NULL)
997
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
998
name, avahi_strerror(avahi_server_errno(mc.server)));
644
/* We ignore the returned resolver object. In the callback
645
function we free it. If the server is terminated before
646
the callback function is called the server will free
647
the resolver for us. */
649
if (!(avahi_s_service_resolver_new(mc->server, interface, protocol, name,
651
AVAHI_PROTO_INET6, 0,
652
resolve_callback, mc)))
653
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
654
avahi_strerror(avahi_server_errno(s)));
1001
657
case AVAHI_BROWSER_REMOVE:
1004
660
case AVAHI_BROWSER_ALL_FOR_NOW:
1005
661
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1007
fprintf(stderr, "No Mandos server found, still searching...\n");
1013
/* stop main loop after sigterm has been called */
1014
static void handle_sigterm(int sig){
1019
signal_received = sig;
1020
int old_errno = errno;
1021
if(mc.simple_poll != NULL){
1022
avahi_simple_poll_quit(mc.simple_poll);
1028
* This function determines if a directory entry in /sys/class/net
1029
* corresponds to an acceptable network device.
1030
* (This function is passed to scandir(3) as a filter function.)
1032
int good_interface(const struct dirent *if_entry){
1034
char *flagname = NULL;
1035
if(if_entry->d_name[0] == '.'){
1038
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
1044
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1051
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1052
/* read line from flags_fd */
1053
ssize_t to_read = (sizeof(ifreq_flags)*2)+3; /* "0x1003\n" */
1054
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1055
flagstring[(size_t)to_read] = '\0';
1056
if(flagstring == NULL){
1062
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1079
tmpmax = strtoimax(flagstring, &tmp, 0);
1080
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1081
and not (isspace(*tmp)))
1082
or tmpmax != (ifreq_flags)tmpmax){
1084
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1085
flagstring, if_entry->d_name);
1091
ifreq_flags flags = (ifreq_flags)tmpmax;
1092
/* Reject the loopback device */
1093
if(flags & IFF_LOOPBACK){
1095
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1100
/* Accept point-to-point devices only if connect_to is specified */
1101
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1103
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1108
/* Otherwise, reject non-broadcast-capable devices */
1109
if(not (flags & IFF_BROADCAST)){
1111
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1116
/* Reject non-ARP interfaces (including dummy interfaces) */
1117
if(flags & IFF_NOARP){
1119
fprintf(stderr, "Rejecting non-ARP interface \"%s\"\n",
1124
/* Accept this device */
1126
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1132
int main(int argc, char *argv[]){
1133
AvahiSServiceBrowser *sb = NULL;
1138
int exitcode = EXIT_SUCCESS;
1139
const char *interface = "";
1140
struct ifreq network;
1142
bool take_down_interface = false;
1145
char tempdir[] = "/tmp/mandosXXXXXX";
1146
bool tempdir_created = false;
1147
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1148
const char *seckey = PATHDIR "/" SECKEY;
1149
const char *pubkey = PATHDIR "/" PUBKEY;
1151
bool gnutls_initialized = false;
1152
bool gpgme_initialized = false;
1155
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1156
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1161
/* Lower any group privileges we might have, just to be safe */
1168
/* Lower user privileges (temporarily) */
1180
struct argp_option options[] = {
1181
{ .name = "debug", .key = 128,
1182
.doc = "Debug mode", .group = 3 },
1183
{ .name = "connect", .key = 'c',
1184
.arg = "ADDRESS:PORT",
1185
.doc = "Connect directly to a specific Mandos server",
1187
{ .name = "interface", .key = 'i',
1189
.doc = "Network interface that will be used to search for"
1192
{ .name = "seckey", .key = 's',
1194
.doc = "OpenPGP secret key file base name",
1196
{ .name = "pubkey", .key = 'p',
1198
.doc = "OpenPGP public key file base name",
1200
{ .name = "dh-bits", .key = 129,
1202
.doc = "Bit length of the prime number used in the"
1203
" Diffie-Hellman key exchange",
1205
{ .name = "priority", .key = 130,
1207
.doc = "GnuTLS priority string for the TLS handshake",
1209
{ .name = "delay", .key = 131,
1211
.doc = "Maximum delay to wait for interface startup",
1214
* These reproduce what we would get without ARGP_NO_HELP
1216
{ .name = "help", .key = '?',
1217
.doc = "Give this help list", .group = -1 },
1218
{ .name = "usage", .key = -3,
1219
.doc = "Give a short usage message", .group = -1 },
1220
{ .name = "version", .key = 'V',
1221
.doc = "Print program version", .group = -1 },
666
/* Combines file name and path and returns the malloced new
667
string. some sane checks could/should be added */
668
static const char *combinepath(const char *first, const char *second){
669
size_t f_len = strlen(first);
670
size_t s_len = strlen(second);
671
char *tmp = malloc(f_len + s_len + 2);
676
memcpy(tmp, first, f_len);
680
memcpy(tmp + f_len + 1, second, s_len);
682
tmp[f_len + 1 + s_len] = '\0';
687
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
688
AvahiServerConfig config;
689
AvahiSServiceBrowser *sb = NULL;
692
int returncode = EXIT_SUCCESS;
693
const char *interface = "eth0";
694
struct ifreq network;
696
char *connect_to = NULL;
697
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
698
mandos_context mc = { .simple_poll = NULL, .server = NULL,
699
.dh_bits = 2048, .priority = "SECURE256"};
1225
error_t parse_opt(int key, char *arg,
1226
struct argp_state *state){
1229
case 128: /* --debug */
1232
case 'c': /* --connect */
1235
case 'i': /* --interface */
1238
case 's': /* --seckey */
1241
case 'p': /* --pubkey */
1244
case 129: /* --dh-bits */
1246
tmpmax = strtoimax(arg, &tmp, 10);
1247
if(errno != 0 or tmp == arg or *tmp != '\0'
1248
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1249
argp_error(state, "Bad number of DH bits");
1251
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1253
case 130: /* --priority */
1256
case 131: /* --delay */
1258
delay = strtof(arg, &tmp);
1259
if(errno != 0 or tmp == arg or *tmp != '\0'){
1260
argp_error(state, "Bad delay");
1264
* These reproduce what we would get without ARGP_NO_HELP
1266
case '?': /* --help */
1267
argp_state_help(state, state->out_stream,
1268
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1269
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1270
case -3: /* --usage */
1271
argp_state_help(state, state->out_stream,
1272
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1273
case 'V': /* --version */
1274
fprintf(state->out_stream, "%s\n", argp_program_version);
1275
exit(argp_err_exit_status);
702
static struct option long_options[] = {
703
{"debug", no_argument, (int *)&debug, 1},
704
{"connect", required_argument, 0, 'C'},
705
{"interface", required_argument, 0, 'i'},
706
{"certdir", required_argument, 0, 'd'},
707
{"certkey", required_argument, 0, 'c'},
708
{"certfile", required_argument, 0, 'k'},
709
{"dh_bits", required_argument, 0, 'D'},
710
{"priority", required_argument, 0, 'p'},
713
int option_index = 0;
714
ret = getopt_long (argc, argv, "i:", long_options,
743
tmp = strtol(optarg, NULL, 10);
744
if (errno == ERANGE){
752
mc.priority = optarg;
1278
return ARGP_ERR_UNKNOWN;
1283
struct argp argp = { .options = options, .parser = parse_opt,
1285
.doc = "Mandos client -- Get and decrypt"
1286
" passwords from a Mandos server" };
1287
ret = argp_parse(&argp, argc, argv,
1288
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1295
perror("argp_parse");
1296
exitcode = EX_OSERR;
1299
exitcode = EX_USAGE;
759
certfile = combinepath(certdir, certfile);
760
if (certfile == NULL){
761
perror("combinepath");
762
returncode = EXIT_FAILURE;
1305
avahi_set_log_function(empty_log);
1308
if(interface[0] == '\0'){
1309
struct dirent **direntries;
1310
ret = scandir(sys_class_net, &direntries, good_interface,
1313
/* Pick the first good interface */
1314
interface = strdup(direntries[0]->d_name);
1316
fprintf(stderr, "Using interface \"%s\"\n", interface);
1318
if(interface == NULL){
1321
exitcode = EXIT_FAILURE;
1327
fprintf(stderr, "Could not find a network interface\n");
1328
exitcode = EXIT_FAILURE;
1333
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1334
from the signal handler */
1335
/* Initialize the pseudo-RNG for Avahi */
1336
srand((unsigned int) time(NULL));
1337
mc.simple_poll = avahi_simple_poll_new();
1338
if(mc.simple_poll == NULL){
1339
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1340
exitcode = EX_UNAVAILABLE;
1344
sigemptyset(&sigterm_action.sa_mask);
1345
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1347
perror("sigaddset");
1348
exitcode = EX_OSERR;
1351
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1353
perror("sigaddset");
1354
exitcode = EX_OSERR;
1357
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1359
perror("sigaddset");
1360
exitcode = EX_OSERR;
1363
/* Need to check if the handler is SIG_IGN before handling:
1364
| [[info:libc:Initial Signal Actions]] |
1365
| [[info:libc:Basic Signal Handling]] |
1367
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1369
perror("sigaction");
1372
if(old_sigterm_action.sa_handler != SIG_IGN){
1373
ret = sigaction(SIGINT, &sigterm_action, NULL);
1375
perror("sigaction");
1376
exitcode = EX_OSERR;
1380
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1382
perror("sigaction");
1385
if(old_sigterm_action.sa_handler != SIG_IGN){
1386
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1388
perror("sigaction");
1389
exitcode = EX_OSERR;
1393
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1395
perror("sigaction");
1398
if(old_sigterm_action.sa_handler != SIG_IGN){
1399
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1401
perror("sigaction");
1402
exitcode = EX_OSERR;
1407
/* If the interface is down, bring it up */
1408
if(strcmp(interface, "none") != 0){
766
certkey = combinepath(certdir, certkey);
767
if (certkey == NULL){
768
perror("combinepath");
769
returncode = EXIT_FAILURE;
1409
773
if_index = (AvahiIfIndex) if_nametoindex(interface);
1410
774
if(if_index == 0){
1411
775
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1412
exitcode = EX_UNAVAILABLE;
1420
/* Re-raise priviliges */
1428
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1429
messages about the network interface to mess up the prompt */
1430
ret = klogctl(8, NULL, 5);
1431
bool restore_loglevel = true;
1433
restore_loglevel = false;
1436
#endif /* __linux__ */
779
if(connect_to != NULL){
780
/* Connect directly, do not use Zeroconf */
781
/* (Mainly meant for debugging) */
782
char *address = strrchr(connect_to, ':');
784
fprintf(stderr, "No colon in address\n");
788
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
790
perror("Bad port number");
794
address = connect_to;
795
ret = start_mandos_communication(address, port, if_index);
1438
803
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1440
805
perror("socket");
1441
exitcode = EX_OSERR;
1443
if(restore_loglevel){
1444
ret = klogctl(7, NULL, 0);
1449
#endif /* __linux__ */
1450
/* Lower privileges */
806
returncode = EXIT_FAILURE;
1458
strcpy(network.ifr_name, interface);
809
strcpy(network.ifr_name, interface);
1459
810
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1461
813
perror("ioctl SIOCGIFFLAGS");
1463
if(restore_loglevel){
1464
ret = klogctl(7, NULL, 0);
1469
#endif /* __linux__ */
1470
exitcode = EX_OSERR;
1471
/* Lower privileges */
814
returncode = EXIT_FAILURE;
1479
817
if((network.ifr_flags & IFF_UP) == 0){
1480
818
network.ifr_flags |= IFF_UP;
1481
take_down_interface = true;
1482
819
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1484
take_down_interface = false;
1485
perror("ioctl SIOCSIFFLAGS +IFF_UP");
1486
exitcode = EX_OSERR;
1488
if(restore_loglevel){
1489
ret = klogctl(7, NULL, 0);
1494
#endif /* __linux__ */
1495
/* Lower privileges */
1504
/* sleep checking until interface is running */
1505
for(int i=0; i < delay * 4; i++){
1506
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1508
perror("ioctl SIOCGIFFLAGS");
1509
} else if(network.ifr_flags & IFF_RUNNING){
1512
struct timespec sleeptime = { .tv_nsec = 250000000 };
1513
ret = nanosleep(&sleeptime, NULL);
1514
if(ret == -1 and errno != EINTR){
1515
perror("nanosleep");
1518
if(not take_down_interface){
1519
/* We won't need the socket anymore */
1520
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1526
if(restore_loglevel){
1527
/* Restores kernel loglevel to default */
1528
ret = klogctl(7, NULL, 0);
1533
#endif /* __linux__ */
1534
/* Lower privileges */
1536
if(take_down_interface){
1537
/* Lower privileges */
1543
/* Lower privileges permanently */
1555
ret = init_gnutls_global(pubkey, seckey);
1557
fprintf(stderr, "init_gnutls_global failed\n");
1558
exitcode = EX_UNAVAILABLE;
1561
gnutls_initialized = true;
1568
tempdir_created = true;
1569
if(mkdtemp(tempdir) == NULL){
1570
tempdir_created = false;
1579
if(not init_gpgme(pubkey, seckey, tempdir)){
1580
fprintf(stderr, "init_gpgme failed\n");
1581
exitcode = EX_UNAVAILABLE;
1584
gpgme_initialized = true;
1591
if(connect_to != NULL){
1592
/* Connect directly, do not use Zeroconf */
1593
/* (Mainly meant for debugging) */
1594
char *address = strrchr(connect_to, ':');
1595
if(address == NULL){
1596
fprintf(stderr, "No colon in address\n");
1597
exitcode = EX_USAGE;
1607
tmpmax = strtoimax(address+1, &tmp, 10);
1608
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1609
or tmpmax != (uint16_t)tmpmax){
1610
fprintf(stderr, "Bad port number\n");
1611
exitcode = EX_USAGE;
1619
port = (uint16_t)tmpmax;
1621
address = connect_to;
1622
/* Colon in address indicates IPv6 */
1624
if(strchr(address, ':') != NULL){
1634
while(not quit_now){
1635
ret = start_mandos_communication(address, port, if_index, af);
1636
if(quit_now or ret == 0){
1643
exitcode = EXIT_SUCCESS;
1654
AvahiServerConfig config;
1655
/* Do not publish any local Zeroconf records */
821
perror("ioctl SIOCSIFFLAGS");
822
returncode = EXIT_FAILURE;
829
avahi_set_log_function(empty_log);
832
/* Initialize the psuedo-RNG */
833
srand((unsigned int) time(NULL));
835
/* Allocate main loop object */
836
if (!(mc.simple_poll = avahi_simple_poll_new())) {
837
fprintf(stderr, "Failed to create simple poll object.\n");
838
returncode = EXIT_FAILURE;
842
/* Do not publish any local records */
1656
843
avahi_server_config_init(&config);
1657
844
config.publish_hinfo = 0;
1658
845
config.publish_addresses = 0;
1659
846
config.publish_workstation = 0;
1660
847
config.publish_domain = 0;
1662
849
/* Allocate a new server */
1663
mc.server = avahi_server_new(avahi_simple_poll_get
1664
(mc.simple_poll), &config, NULL,
1667
/* Free the Avahi configuration data */
850
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
851
&config, NULL, NULL, &error);
853
/* Free the configuration data */
1668
854
avahi_server_config_free(&config);
1671
/* Check if creating the Avahi server object succeeded */
1672
if(mc.server == NULL){
1673
fprintf(stderr, "Failed to create Avahi server: %s\n",
1674
avahi_strerror(error));
1675
exitcode = EX_UNAVAILABLE;
1683
/* Create the Avahi service browser */
1684
sb = avahi_s_service_browser_new(mc.server, if_index,
1685
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1686
NULL, 0, browse_callback, NULL);
1688
fprintf(stderr, "Failed to create service browser: %s\n",
1689
avahi_strerror(avahi_server_errno(mc.server)));
1690
exitcode = EX_UNAVAILABLE;
1698
/* Run the main loop */
1701
fprintf(stderr, "Starting Avahi loop search\n");
1704
avahi_simple_poll_loop(mc.simple_poll);
1709
fprintf(stderr, "%s exiting\n", argv[0]);
1712
/* Cleanup things */
1714
avahi_s_service_browser_free(sb);
1716
if(mc.server != NULL)
1717
avahi_server_free(mc.server);
1719
if(mc.simple_poll != NULL)
1720
avahi_simple_poll_free(mc.simple_poll);
1722
if(gnutls_initialized){
1723
gnutls_certificate_free_credentials(mc.cred);
1724
gnutls_global_deinit();
1725
gnutls_dh_params_deinit(mc.dh_params);
1728
if(gpgme_initialized){
1729
gpgme_release(mc.ctx);
1732
/* Take down the network interface */
1733
if(take_down_interface){
1734
/* Re-raise priviliges */
1741
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1743
perror("ioctl SIOCGIFFLAGS");
1744
} else if(network.ifr_flags & IFF_UP) {
1745
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1746
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1748
perror("ioctl SIOCSIFFLAGS -IFF_UP");
1751
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1755
/* Lower privileges permanently */
1764
/* Removes the temp directory used by GPGME */
1765
if(tempdir_created){
1767
struct dirent *direntry;
1768
d = opendir(tempdir);
1770
if(errno != ENOENT){
1775
direntry = readdir(d);
1776
if(direntry == NULL){
1779
/* Skip "." and ".." */
1780
if(direntry->d_name[0] == '.'
1781
and (direntry->d_name[1] == '\0'
1782
or (direntry->d_name[1] == '.'
1783
and direntry->d_name[2] == '\0'))){
1786
char *fullname = NULL;
1787
ret = asprintf(&fullname, "%s/%s", tempdir,
1793
ret = remove(fullname);
1795
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1802
ret = rmdir(tempdir);
1803
if(ret == -1 and errno != ENOENT){
1809
sigemptyset(&old_sigterm_action.sa_mask);
1810
old_sigterm_action.sa_handler = SIG_DFL;
1811
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1812
&old_sigterm_action,
1815
perror("sigaction");
1818
ret = raise(signal_received);
1819
} while(ret != 0 and errno == EINTR);
1824
TEMP_FAILURE_RETRY(pause());
856
/* Check if creating the server object succeeded */
858
fprintf(stderr, "Failed to create server: %s\n",
859
avahi_strerror(error));
860
returncode = EXIT_FAILURE;
864
/* Create the service browser */
865
sb = avahi_s_service_browser_new(mc.server, if_index,
867
"_mandos._tcp", NULL, 0,
868
browse_callback, &mc);
870
fprintf(stderr, "Failed to create service browser: %s\n",
871
avahi_strerror(avahi_server_errno(mc.server)));
872
returncode = EXIT_FAILURE;
876
/* Run the main loop */
879
fprintf(stderr, "Starting avahi loop search\n");
882
avahi_simple_poll_loop(simple_poll);
887
fprintf(stderr, "%s exiting\n", argv[0]);
892
avahi_s_service_browser_free(sb);
895
avahi_server_free(mc.server);
898
avahi_simple_poll_free(simple_poll);