42
42
#include <stddef.h> /* NULL, size_t, ssize_t */
43
43
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
45
#include <stdbool.h> /* bool, false, true */
45
#include <stdbool.h> /* bool, true */
46
46
#include <string.h> /* memset(), strcmp(), strlen(),
47
47
strerror(), asprintf(), strcpy() */
48
#include <sys/ioctl.h> /* ioctl */
48
#include <sys/ioctl.h> /* ioctl */
49
49
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
50
50
sockaddr_in6, PF_INET6,
51
SOCK_STREAM, uid_t, gid_t, open(),
51
SOCK_STREAM, INET6_ADDRSTRLEN,
52
uid_t, gid_t, open(), opendir(),
53
54
#include <sys/stat.h> /* open() */
54
55
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
inet_pton(), connect() */
56
struct in6_addr, inet_pton(),
56
58
#include <fcntl.h> /* open() */
57
59
#include <dirent.h> /* opendir(), struct dirent, readdir()
63
65
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
64
66
SIOCSIFFLAGS, if_indextoname(),
65
67
if_nametoindex(), IF_NAMESIZE */
66
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
67
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
68
#include <netinet/in.h>
69
69
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
70
70
getuid(), getgid(), setuid(),
72
72
#include <arpa/inet.h> /* inet_pton(), htons */
73
#include <iso646.h> /* not, or, and */
73
#include <iso646.h> /* not, and, or */
74
74
#include <argp.h> /* struct argp_option, error_t, struct
75
75
argp_state, struct argp,
76
76
argp_parse(), ARGP_KEY_ARG,
130
130
} mandos_context;
133
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
134
* "buffer_capacity" is how much is currently allocated,
135
* "buffer_length" is how much is already used.
133
* Make additional room in "buffer" for at least BUFFER_SIZE
134
* additional bytes. "buffer_capacity" is how much is currently
135
* allocated, "buffer_length" is how much is already used.
137
size_t adjustbuffer(char **buffer, size_t buffer_length,
137
size_t incbuffer(char **buffer, size_t buffer_length,
138
138
size_t buffer_capacity){
139
139
if(buffer_length + BUFFER_SIZE > buffer_capacity){
140
140
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
327
327
*plaintext = NULL;
329
plaintext_capacity = adjustbuffer(plaintext,
329
plaintext_capacity = incbuffer(plaintext,
330
330
(size_t)plaintext_length,
331
331
plaintext_capacity);
332
332
if(plaintext_capacity == 0){
333
perror("adjustbuffer");
334
334
plaintext_length = -1;
335
335
goto decrypt_end;
410
410
gnutls_certificate_allocate_credentials(&mc->cred);
411
411
if(ret != GNUTLS_E_SUCCESS){
412
412
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
416
416
safer_gnutls_strerror(ret));
417
417
gnutls_global_deinit();
509
509
/* Called when a Mandos server is found */
510
510
static int start_mandos_communication(const char *ip, uint16_t port,
511
511
AvahiIfIndex if_index,
512
mandos_context *mc, int af){
516
struct sockaddr_in in;
517
struct sockaddr_in6 in6;
515
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
519
516
char *buffer = NULL;
520
517
char *decrypted_buffer;
521
518
size_t buffer_length = 0;
523
520
ssize_t decrypted_buffer_size;
523
char interface[IF_NAMESIZE];
526
524
gnutls_session_t session;
527
int pf; /* Protocol family */
537
fprintf(stderr, "Bad address family: %d\n", af);
541
526
ret = init_gnutls_session(mc, &session);
547
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
532
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
551
tcp_sd = socket(pf, SOCK_STREAM, 0);
536
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
553
538
perror("socket");
543
if(if_indextoname((unsigned int)if_index, interface) == NULL){
544
perror("if_indextoname");
547
fprintf(stderr, "Binding to interface %s\n", interface);
557
550
memset(&to, 0, sizeof(to));
559
to.in6.sin6_family = (uint16_t)af;
560
ret = inet_pton(af, ip, &to.in6.sin6_addr);
562
to.in.sin_family = (sa_family_t)af;
563
ret = inet_pton(af, ip, &to.in.sin_addr);
551
to.in6.sin6_family = AF_INET6;
552
/* It would be nice to have a way to detect if we were passed an
553
IPv4 address here. Now we assume an IPv6 address. */
554
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
566
556
perror("inet_pton");
570
560
fprintf(stderr, "Bad address: %s\n", ip);
574
to.in6.sin6_port = htons(port); /* Spurious warnings from
576
-Wunreachable-code */
578
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
579
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
581
if(if_index == AVAHI_IF_UNSPEC){
582
fprintf(stderr, "An IPv6 link-local address is incomplete"
583
" without a network interface\n");
586
/* Set the network interface number as scope */
587
to.in6.sin6_scope_id = (uint32_t)if_index;
590
to.in.sin_port = htons(port); /* Spurious warnings from
563
to.in6.sin6_port = htons(port); /* Spurious warnings from
592
565
-Wunreachable-code */
567
to.in6.sin6_scope_id = (uint32_t)if_index;
596
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
597
char interface[IF_NAMESIZE];
598
if(if_indextoname((unsigned int)if_index, interface) == NULL){
599
perror("if_indextoname");
601
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
602
ip, interface, port);
605
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
608
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
609
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
612
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
615
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
570
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
572
char addrstr[INET6_ADDRSTRLEN] = "";
573
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
574
sizeof(addrstr)) == NULL){
619
575
perror("inet_ntop");
621
577
if(strcmp(addrstr, ip) != 0){
628
ret = connect(tcp_sd, &to.in6, sizeof(to));
630
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
583
ret = connect(tcp_sd, &to.in, sizeof(to));
633
585
perror("connect");
680
632
/* Read OpenPGP packet that contains the wanted password */
683
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
635
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
688
buffer_capacity = adjustbuffer(&buffer, buffer_length,
640
buffer_capacity = incbuffer(&buffer, buffer_length,
689
641
buffer_capacity);
690
642
if(buffer_capacity == 0){
691
perror("adjustbuffer");
809
761
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
810
762
ip, (intmax_t)interface, port);
812
int ret = start_mandos_communication(ip, port, interface, mc,
813
avahi_proto_to_af(proto));
764
int ret = start_mandos_communication(ip, port, interface, mc);
815
766
avahi_simple_poll_quit(mc->simple_poll);
907
858
{ .name = "interface", .key = 'i',
909
.doc = "Network interface that will be used to search for"
860
.doc = "Interface that will be used to search for Mandos"
912
863
{ .name = "seckey", .key = 's',
995
946
/* If the interface is down, bring it up */
996
if(interface[0] != '\0'){
998
949
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
999
950
messages to mess up the prompt */
1000
951
ret = klogctl(8, NULL, 5);
1001
bool restore_loglevel = true;
1003
restore_loglevel = false;
1004
953
perror("klogctl");
1025
972
perror("ioctl SIOCGIFFLAGS");
1026
973
#ifdef __linux__
1027
if(restore_loglevel){
1028
ret = klogctl(7, NULL, 0);
974
ret = klogctl(7, NULL, 0);
1034
979
exitcode = EXIT_FAILURE;
1041
986
perror("ioctl SIOCSIFFLAGS");
1042
987
exitcode = EXIT_FAILURE;
1043
988
#ifdef __linux__
1044
if(restore_loglevel){
1045
ret = klogctl(7, NULL, 0);
989
ret = klogctl(7, NULL, 0);
1070
1013
perror("close");
1072
1015
#ifdef __linux__
1073
if(restore_loglevel){
1074
/* Restores kernel loglevel to default */
1075
ret = klogctl(7, NULL, 0);
1016
/* Restores kernel loglevel to default */
1017
ret = klogctl(7, NULL, 0);
1117
1057
gpgme_initialized = true;
1120
if(interface[0] != '\0'){
1121
if_index = (AvahiIfIndex) if_nametoindex(interface);
1123
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1124
exitcode = EXIT_FAILURE;
1060
if_index = (AvahiIfIndex) if_nametoindex(interface);
1062
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1063
exitcode = EXIT_FAILURE;
1129
1067
if(connect_to != NULL){
1146
1084
port = (uint16_t)tmpmax;
1147
1085
*address = '\0';
1148
1086
address = connect_to;
1149
/* Colon in address indicates IPv6 */
1151
if(strchr(address, ':') != NULL){
1156
ret = start_mandos_communication(address, port, if_index, &mc,
1087
ret = start_mandos_communication(address, port, if_index, &mc);
1159
1089
exitcode = EXIT_FAILURE;